safari-mcp 2.15.7 → 2.15.8

package/extension/background.js

@@ -226,7 +226,14 @@ async function handleCommand(type, payload) {
     if (anyOwned) {
       throw new Error(`⚠️ Tab safety: refusing "${type}" on tab ${tabId} (${targetTab.url || 'unknown'}) — not opened by this MCP session. Use safari_new_tab first.`);
     }
-    // If no tabs owned yet, allow operation (backward compatibility for sessions that don't use new_tab)
+    // No tabs owned yet → allow, for sessions that never call new_tab. That leniency is
+    // survivable for a write (worst case: it edits the page the user is already on) but not
+    // for a close, which throws their tab away. It also fires for a session re-initialised
+    // after a transport drop, which reports owning nothing while its tab is still open —
+    // the state in which close_tab destroyed a user's tab (#68).
+    if (_destructiveTabCommands.has(type)) {
+      throw new Error(`⚠️ Tab safety: refusing "${type}" on tab ${tabId} (${targetTab.url || 'unknown'}) — this session owns no tabs, so it has none to close. Use safari_new_tab first.`);
+    }
   }
 
   switch (type) {
@@ -1117,6 +1124,11 @@ async function handleCommand(type, payload) {
         // could resolve the wrong tab or leave a stale last-tab verdict).
         const target = _winTabs[payload.index - 1];
         if (target) {
+          // The ownership guard above checked `tabId` — this branch closes a tab chosen by
+          // index instead, so it must be checked on its own or the guard is decorative.
+          if (!_isTabOwnedBySession(sessionId, target.id)) {
+            throw new Error(`⚠️ Tab safety: refusing to close tab ${payload.index} (${target.url || 'unknown'}) — not opened by this MCP session.`);
+          }
           _removeOwnedTab(sessionId, target.id);
           if (_isLastTab) {
             await browser.tabs.update(target.id, { url: "about:blank" });
@@ -1828,6 +1840,10 @@ function _isTabOwnedBySession(sessionId, tabId) {
   return set ? set.has(tabId) : false;
 }
 
+// Commands that destroy a tab rather than change a page. They get no "no tabs owned yet"
+// leniency: a session that owns nothing has nothing to close (#68).
+const _destructiveTabCommands = new Set(["close_tab"]);
+
 // Read-only commands that don't modify the page — allowed on any tab
 const _readOnlyCommands = new Set([
   "list_tabs", "read_page", "get_source", "snapshot", "accessibility_snapshot",

package/index.js

@@ -81,10 +81,9 @@ async function _cleanupTabs() {
       const tabs = await safari.listTabs();
       const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
       const match = parsed.find(t => t.url === url);
-      if (match) {
-        safari.setActiveTabIndex(match.index);
-        await safari.closeTab();
-      }
+      // Name the tab explicitly: it was just resolved out of our own opened-tab table, and
+      // closeTab refuses anything it cannot prove it owns (#68).
+      if (match) await safari.closeTab(match.index);
     } catch {}
   }
   _openedTabs.clear();
@@ -153,10 +152,7 @@ async function _closeOldestMCPTab() {
         const tabs = await safari.listTabs();
         const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
         const match = parsed.find(t => t.url === info.url);
-        if (match) {
-          safari.setActiveTabIndex(match.index);
-          await safari.closeTab();
-        }
+        if (match) await safari.closeTab(match.index);
       }
     } catch {}
     _untrackTab(oldestIdx);
@@ -657,8 +653,12 @@ const _nullMeansFailure = new Set([
 
 // Operations that don't need tab ownership (read-only or tab management)
 const _noOwnershipCheck = new Set([
-  // Tab management
-  "new_tab", "list_tabs", "close_tab", "switch_tab",
+  // Tab management. NOTE: "close_tab" is deliberately NOT here. It sat in this set as
+  // "tab management" next to new_tab/list_tabs/switch_tab, but it is the only member that
+  // destroys a user tab: new_tab creates one, list_tabs reads, and switch_tab carries its
+  // own ownership check at the tool. close_tab had none — exempt from the shared guard and
+  // unguarded underneath, which is how it closed a user's tab in #68.
+  "new_tab", "list_tabs", "switch_tab",
   // Extension self-management (doesn't touch tabs)
   "reload_extension",
   // Read-only — don't modify the page
@@ -1378,8 +1378,7 @@ server.tool(
       if (oldestIdx !== null) {
         console.error(`[Safari MCP] Tab limit (${MAX_TABS}) reached — closing oldest tab #${oldestIdx}`);
         try {
-          safari.setActiveTabIndex(oldestIdx);
-          await safari.closeTab();
+          await safari.closeTab(oldestIdx);
         } catch {}
         _untrackTab(oldestIdx);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.7",
+  "version": "2.15.8",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -3484,8 +3484,37 @@ export async function newTab(url = "") {
   return info;
 }
 
-export async function closeTab() {
+// A tab index this session can prove it owns, or null. Destructive paths only: they may
+// never guess, so "can't prove it" has to read as null rather than as the front document.
+// `resolveActiveTab()` re-finds the tab through its identity marker (surviving the index
+// shifts of #54) and fails closed to null when the marker is on no tab at all.
+async function _provenOwnTabIndex() {
+  return (await resolveActiveTab()) || null;
+}
+
+// `explicitIndex` — the caller naming the tab, the same opt-out convention the identity
+// guard uses. Internal cleanup resolves its own indices out of the opened-tab table and
+// passes them here; everything else must prove ownership.
+export async function closeTab(explicitIndex) {
   await refreshTargetWindow();
+
+  // ── Guard: close nothing this session cannot prove it owns. There is deliberately no
+  // front-document fallback here, unlike the read paths: `close current tab of window` is
+  // the tab the USER is looking at whenever our index is unknown — and "unknown" is exactly
+  // what a session re-initialised after a transport drop reports, mid-task, while a tab of
+  // its own is still open. That fail-open destroyed a user's tab (#68, the destructive
+  // sibling of #64). An unmarked front document stays readable for a genuinely fresh
+  // session, because a bad read costs information; a bad close costs their work.
+  const idx = explicitIndex || (await _provenOwnTabIndex());
+  if (!idx) {
+    throw new Error(
+      `Tab tracking lost — refusing to close a tab this session cannot prove it opened ` +
+      `(closing "current tab of window" would close the user's active tab). ` +
+      `Call safari_new_tab to open a tab this session owns, or safari_list_tabs and ` +
+      `safari_switch_tab to re-anchor to a known one.`
+    );
+  }
+
   // ── Guard: never close a window's LAST tab. Closing it shuts the window —
   // which quits Safari if it's the only window, AND (for profile-targeted
   // instances) makes the target window vanish so every later op throws
@@ -3500,10 +3529,11 @@ export async function closeTab() {
       10
     );
     if (Number.isFinite(_winTabs) && _winTabs <= 1) {
-      const _ref = _st().activeTabIndex
-        ? `tab ${_st().activeTabIndex} of ${getTargetWindowRef()}`
-        : `current tab of ${getTargetWindowRef()}`;
-      await osascript(`tell application "Safari" to set URL of ${_ref} to "about:blank"`);
+      // Blanking is destructive too — it throws away whatever page is loaded — so it
+      // targets the proven index, never the front document.
+      await osascript(
+        `tell application "Safari" to set URL of tab ${idx} of ${getTargetWindowRef()} to "about:blank"`
+      );
       _st().activeTabIndex = null;
       _st().activeTabURL = null;
       _st().lastTabCount = null;
@@ -3512,16 +3542,15 @@ export async function closeTab() {
     }
   } catch { /* count check failed — fall through to normal close */ }
 
-  if (_st().activeTabIndex) {
-    await osascript(
-      `tell application "Safari" to close tab ${_st().activeTabIndex} of ${getTargetWindowRef()}`
-    );
+  await osascript(
+    `tell application "Safari" to close tab ${idx} of ${getTargetWindowRef()}`
+  );
+  if (!explicitIndex || idx === _st().activeTabIndex) {
     _st().activeTabIndex = null;
     _st().activeTabURL = null;
-  } else {
-    await osascript(
-      `tell application "Safari" to close current tab of ${getTargetWindowRef()}`
-    );
+    // The tab is gone, so its marker is too — keeping it would let a later resolve
+    // match a stale identity.
+    _st().activeTabMarker = null;
   }
   _st().lastTabCount = null;    // Invalidate — tab count changed
   _st().lastResolveTime = 0;    // Force re-resolve on next operation