safari-mcp 2.15.7 → 2.15.9

package/README.md

@@ -304,6 +304,38 @@ The recommended pattern for AI agents using Safari MCP:
 
 ---
 
+## Running several agents at once
+
+Multiple agents or subagents driving one Safari at the same time will fight over the active tab — unless you run them against a **shared HTTP daemon** instead of one process per client:
+
+```bash
+SAFARI_MCP_HTTP=1 SAFARI_MCP_HTTP_PORT=9225 npx safari-mcp
+```
+
+Then point every client at it:
+
+```json
+{ "mcpServers": { "safari-mcp": { "type": "http", "url": "http://127.0.0.1:9225/mcp" } } }
+```
+
+One daemon, many sessions — and each session gets its **own tab state**. The server keys `activeTabIndex`, the ownership flag and a unique tab marker off the MCP session id, so session A physically cannot read or steer session B's tab.
+
+Two properties make this safe rather than merely tidy:
+
+- **Tab identity is a marker, not an index.** Each session stamps a unique id into the page it opens, so ownership survives navigation *and* survives the user reordering or closing other tabs. An index alone would silently drift onto the wrong tab.
+- **It fails closed.** If a session's marked tab can't be re-found, every tool refuses instead of falling back to whatever tab is in front — because that tab is usually yours:
+
+  ```
+  Tab tracking lost — refusing to fall back to "current tab of window"
+  (would target the user's active tab). Call safari_new_tab to reopen.
+  ```
+
+This also drops process count sharply: ~17 node processes for 17 concurrent sessions becomes 1.
+
+`SAFARI_PROFILE` stays optional — leave it unset and sessions bind to your ordinary Safari windows, cookies and logins intact. Details in [docs/http-transport-design.md](docs/http-transport-design.md).
+
+---
+
 ## Tools (97)
 
 <details>

package/extension/background.js

@@ -226,7 +226,14 @@ async function handleCommand(type, payload) {
     if (anyOwned) {
       throw new Error(`⚠️ Tab safety: refusing "${type}" on tab ${tabId} (${targetTab.url || 'unknown'}) — not opened by this MCP session. Use safari_new_tab first.`);
     }
-    // If no tabs owned yet, allow operation (backward compatibility for sessions that don't use new_tab)
+    // No tabs owned yet → allow, for sessions that never call new_tab. That leniency is
+    // survivable for a write (worst case: it edits the page the user is already on) but not
+    // for a close, which throws their tab away. It also fires for a session re-initialised
+    // after a transport drop, which reports owning nothing while its tab is still open —
+    // the state in which close_tab destroyed a user's tab (#68).
+    if (_destructiveTabCommands.has(type)) {
+      throw new Error(`⚠️ Tab safety: refusing "${type}" on tab ${tabId} (${targetTab.url || 'unknown'}) — this session owns no tabs, so it has none to close. Use safari_new_tab first.`);
+    }
   }
 
   switch (type) {
@@ -1117,6 +1124,11 @@ async function handleCommand(type, payload) {
         // could resolve the wrong tab or leave a stale last-tab verdict).
         const target = _winTabs[payload.index - 1];
         if (target) {
+          // The ownership guard above checked `tabId` — this branch closes a tab chosen by
+          // index instead, so it must be checked on its own or the guard is decorative.
+          if (!_isTabOwnedBySession(sessionId, target.id)) {
+            throw new Error(`⚠️ Tab safety: refusing to close tab ${payload.index} (${target.url || 'unknown'}) — not opened by this MCP session.`);
+          }
           _removeOwnedTab(sessionId, target.id);
           if (_isLastTab) {
             await browser.tabs.update(target.id, { url: "about:blank" });
@@ -1828,6 +1840,10 @@ function _isTabOwnedBySession(sessionId, tabId) {
   return set ? set.has(tabId) : false;
 }
 
+// Commands that destroy a tab rather than change a page. They get no "no tabs owned yet"
+// leniency: a session that owns nothing has nothing to close (#68).
+const _destructiveTabCommands = new Set(["close_tab"]);
+
 // Read-only commands that don't modify the page — allowed on any tab
 const _readOnlyCommands = new Set([
   "list_tabs", "read_page", "get_source", "snapshot", "accessibility_snapshot",

package/index.js

@@ -81,10 +81,9 @@ async function _cleanupTabs() {
       const tabs = await safari.listTabs();
       const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
       const match = parsed.find(t => t.url === url);
-      if (match) {
-        safari.setActiveTabIndex(match.index);
-        await safari.closeTab();
-      }
+      // Name the tab explicitly: it was just resolved out of our own opened-tab table, and
+      // closeTab refuses anything it cannot prove it owns (#68).
+      if (match) await safari.closeTab(match.index);
     } catch {}
   }
   _openedTabs.clear();
@@ -153,10 +152,7 @@ async function _closeOldestMCPTab() {
         const tabs = await safari.listTabs();
         const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
         const match = parsed.find(t => t.url === info.url);
-        if (match) {
-          safari.setActiveTabIndex(match.index);
-          await safari.closeTab();
-        }
+        if (match) await safari.closeTab(match.index);
       }
     } catch {}
     _untrackTab(oldestIdx);
@@ -657,8 +653,12 @@ const _nullMeansFailure = new Set([
 
 // Operations that don't need tab ownership (read-only or tab management)
 const _noOwnershipCheck = new Set([
-  // Tab management
-  "new_tab", "list_tabs", "close_tab", "switch_tab",
+  // Tab management. NOTE: "close_tab" is deliberately NOT here. It sat in this set as
+  // "tab management" next to new_tab/list_tabs/switch_tab, but it is the only member that
+  // destroys a user tab: new_tab creates one, list_tabs reads, and switch_tab carries its
+  // own ownership check at the tool. close_tab had none — exempt from the shared guard and
+  // unguarded underneath, which is how it closed a user's tab in #68.
+  "new_tab", "list_tabs", "switch_tab",
   // Extension self-management (doesn't touch tabs)
   "reload_extension",
   // Read-only — don't modify the page
@@ -1378,8 +1378,7 @@ server.tool(
       if (oldestIdx !== null) {
         console.error(`[Safari MCP] Tab limit (${MAX_TABS}) reached — closing oldest tab #${oldestIdx}`);
         try {
-          safari.setActiveTabIndex(oldestIdx);
-          await safari.closeTab();
+          await safari.closeTab(oldestIdx);
         } catch {}
         _untrackTab(oldestIdx);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.15.7",
+  "version": "2.15.9",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -508,7 +508,7 @@ export async function restoreFocusIfStolen(savedBundleId) {
 // callers fail toward "user is idle" (preserving the pre-existing hide behavior).
 async function _userIdleSeconds() {
   try {
-    const { stdout } = await execFileAsync("ioreg", ["-c", "IOHIDSystem", "-r", "-d", "1"], { timeout: 1500 });
+    const { stdout } = await execFileAsync("/usr/sbin/ioreg", ["-c", "IOHIDSystem", "-r", "-d", "1"], { timeout: 1500 });
     const m = stdout.match(/"HIDIdleTime"\s*=\s*(\d+)/);
     if (!m) return Infinity;
     return parseInt(m[1], 10) / 1e9; // nanoseconds → seconds
@@ -3154,7 +3154,7 @@ export async function screenshot({ fullPage = false } = {}) {
       `tell application "Safari" to return id of ${getTargetWindowRef()}`
     ).catch(() => null) : null;
     // Window IDs are OS-assigned integers — reject anything non-numeric before it reaches
-    // `do shell script "screencapture -l<id>"` (defense-in-depth against odd AppleScript stdout).
+    // `do shell script "/usr/sbin/screencapture -l<id>"` (defense-in-depth against odd AppleScript stdout).
     const windowId = windowIdRaw != null && /^\d+$/.test(String(windowIdRaw).trim()) ? String(windowIdRaw).trim() : null;
 
     // On macOS Tahoe, screencapture -l may briefly steal focus.
@@ -3178,9 +3178,10 @@ export async function screenshot({ fullPage = false } = {}) {
           );
           try {
             await new Promise((r) => setTimeout(r, 500));
-            // Use do shell script to inherit osascript's Screen Recording permission
-            await osascript(
-              `do shell script "screencapture -l${windowId} -o -x '${tmpFile}'"`,
+            // Route capture through the TCC-granted helper (NSAppleScript → do shell script):
+            // under the launchd daemon, node has no Screen Recording grant — the helper does.
+            await osascriptFast(
+              `do shell script "/usr/sbin/screencapture -l${windowId} -o -x '${tmpFile}'"`,
               { timeout: 15000 }
             );
           } finally {
@@ -3192,13 +3193,13 @@ export async function screenshot({ fullPage = false } = {}) {
         } else {
           // Try direct execFile first (works if VS Code has Screen Recording permission)
           try {
-            await execFileAsync("screencapture", ["-l" + windowId, "-o", "-x", tmpFile]);
+            await execFileAsync("/usr/sbin/screencapture", ["-l" + windowId, "-o", "-x", tmpFile]);
             const testData = await readFile(tmpFile);
             if (testData.length < 100) throw new Error("empty");
           } catch (_) {
-            // Fallback: use do shell script (osascript may have permission)
-            await osascript(
-              `do shell script "screencapture -l${windowId} -o -x '${tmpFile}'"`,
+            // Fallback: do shell script via the TCC-granted helper (node lacks Screen Recording under launchd)
+            await osascriptFast(
+              `do shell script "/usr/sbin/screencapture -l${windowId} -o -x '${tmpFile}'"`,
               { timeout: 15000 }
             );
           }
@@ -3340,8 +3341,17 @@ export async function screenshotElement({ selector }) {
       );
       if (!bounds) throw new Error(typeof result === 'string' && result.startsWith('Element') ? result : 'Element not found for screenshot');
 
-      // Full window screenshot then crop with sips
-      await execFileAsync("screencapture", ["-l" + windowId, "-o", "-x", tmpFile]);
+      // Full window screenshot then crop with sips. Direct execFile works when this process
+      // has Screen Recording (stdio mode); under the launchd daemon it doesn't — fall back
+      // to the TCC-granted helper.
+      try {
+        await execFileAsync("/usr/sbin/screencapture", ["-l" + windowId, "-o", "-x", tmpFile]);
+      } catch {
+        await osascriptFast(
+          `do shell script "/usr/sbin/screencapture -l${windowId} -o -x '${tmpFile}'"`,
+          { timeout: 15000 }
+        );
+      }
       const { x, y, w, h, dpr = 1 } = JSON.parse(bounds);
       // Use sips to crop (macOS built-in). Use the DYNAMIC toolbar height — Sequoia+ chrome is
       // ~90px, not 74, so a hardcoded 74 left element screenshots vertically offset. Fall back
@@ -3484,8 +3494,37 @@ export async function newTab(url = "") {
   return info;
 }
 
-export async function closeTab() {
+// A tab index this session can prove it owns, or null. Destructive paths only: they may
+// never guess, so "can't prove it" has to read as null rather than as the front document.
+// `resolveActiveTab()` re-finds the tab through its identity marker (surviving the index
+// shifts of #54) and fails closed to null when the marker is on no tab at all.
+async function _provenOwnTabIndex() {
+  return (await resolveActiveTab()) || null;
+}
+
+// `explicitIndex` — the caller naming the tab, the same opt-out convention the identity
+// guard uses. Internal cleanup resolves its own indices out of the opened-tab table and
+// passes them here; everything else must prove ownership.
+export async function closeTab(explicitIndex) {
   await refreshTargetWindow();
+
+  // ── Guard: close nothing this session cannot prove it owns. There is deliberately no
+  // front-document fallback here, unlike the read paths: `close current tab of window` is
+  // the tab the USER is looking at whenever our index is unknown — and "unknown" is exactly
+  // what a session re-initialised after a transport drop reports, mid-task, while a tab of
+  // its own is still open. That fail-open destroyed a user's tab (#68, the destructive
+  // sibling of #64). An unmarked front document stays readable for a genuinely fresh
+  // session, because a bad read costs information; a bad close costs their work.
+  const idx = explicitIndex || (await _provenOwnTabIndex());
+  if (!idx) {
+    throw new Error(
+      `Tab tracking lost — refusing to close a tab this session cannot prove it opened ` +
+      `(closing "current tab of window" would close the user's active tab). ` +
+      `Call safari_new_tab to open a tab this session owns, or safari_list_tabs and ` +
+      `safari_switch_tab to re-anchor to a known one.`
+    );
+  }
+
   // ── Guard: never close a window's LAST tab. Closing it shuts the window —
   // which quits Safari if it's the only window, AND (for profile-targeted
   // instances) makes the target window vanish so every later op throws
@@ -3500,10 +3539,11 @@ export async function closeTab() {
       10
     );
     if (Number.isFinite(_winTabs) && _winTabs <= 1) {
-      const _ref = _st().activeTabIndex
-        ? `tab ${_st().activeTabIndex} of ${getTargetWindowRef()}`
-        : `current tab of ${getTargetWindowRef()}`;
-      await osascript(`tell application "Safari" to set URL of ${_ref} to "about:blank"`);
+      // Blanking is destructive too — it throws away whatever page is loaded — so it
+      // targets the proven index, never the front document.
+      await osascript(
+        `tell application "Safari" to set URL of tab ${idx} of ${getTargetWindowRef()} to "about:blank"`
+      );
       _st().activeTabIndex = null;
       _st().activeTabURL = null;
       _st().lastTabCount = null;
@@ -3512,16 +3552,15 @@ export async function closeTab() {
     }
   } catch { /* count check failed — fall through to normal close */ }
 
-  if (_st().activeTabIndex) {
-    await osascript(
-      `tell application "Safari" to close tab ${_st().activeTabIndex} of ${getTargetWindowRef()}`
-    );
+  await osascript(
+    `tell application "Safari" to close tab ${idx} of ${getTargetWindowRef()}`
+  );
+  if (!explicitIndex || idx === _st().activeTabIndex) {
     _st().activeTabIndex = null;
     _st().activeTabURL = null;
-  } else {
-    await osascript(
-      `tell application "Safari" to close current tab of ${getTargetWindowRef()}`
-    );
+    // The tab is gone, so its marker is too — keeping it would let a later resolve
+    // match a stale identity.
+    _st().activeTabMarker = null;
   }
   _st().lastTabCount = null;    // Invalidate — tab count changed
   _st().lastResolveTime = 0;    // Force re-resolve on next operation
@@ -4262,76 +4301,58 @@ export async function clearConsoleCapture() {
 export async function savePDF({ path: pdfPath }) {
   await refreshTargetWindow();
   _validateFilePath(pdfPath);  // allowlist (/Users//tmp//var-folders) + block sensitive paths — prevents arbitrary overwrite
-  // NO focus stealing — uses screencapture + Python Quartz to generate PDF
+  // NO app focus stealing — tab selection, window resize and screencapture all stay
+  // inside our window; the user's frontmost app is never activated.
 
-  // Step 1: Get full page dimensions
-  const dims = await runJS("JSON.stringify({h:document.documentElement.scrollHeight,w:document.documentElement.scrollWidth})");
-  const { h, w } = JSON.parse(dims);
-
-  // Step 2: Save current bounds and resize to capture full page
-  const origBounds = await osascript(
-    `tell application "Safari" to return bounds of ${getTargetWindowRef()}`
-  );
-  const captureHeight = Math.min(Number(h) + 100, 16000);
-  await osascript(
-    `tell application "Safari" to set bounds of ${getTargetWindowRef()} to {0, 0, ${Number(w)}, ${captureHeight}}`
-  );
-  await new Promise(r => setTimeout(r, 500)); // Let page reflow
-
-  // Step 3: Take screenshot via screencapture -l (window-targeted, NO focus steal)
-  const windowIdRaw = await osascript(
-    `tell application "Safari" to return id of ${getTargetWindowRef()}`
-  );
-  const windowId = windowIdRaw != null && /^\d+$/.test(String(windowIdRaw).trim()) ? String(windowIdRaw).trim() : null;
-  if (!windowId) throw new Error("Cannot get Safari window ID for PDF capture");
   const tmpPng = join(tmpdir(), `safari-mcp-pdf-${Date.now()}.png`);
-  try {
-    // Use do shell script to inherit osascript's Screen Recording permission
+  // screencapture -l grabs the window's SELECTED tab — front ours for the duration
+  // (selection restored by _withTargetTabFronted), otherwise the PDF shows whatever
+  // tab the user last left selected in that window.
+  await _withTargetTabFronted(async () => {
+    // Step 1: Get full page dimensions
+    const dims = await runJS("JSON.stringify({h:document.documentElement.scrollHeight,w:document.documentElement.scrollWidth})");
+    const { h, w } = JSON.parse(dims);
+
+    // Step 2: Save current bounds and resize to capture full page
+    const origBounds = await osascript(
+      `tell application "Safari" to return bounds of ${getTargetWindowRef()}`
+    );
+    const captureHeight = Math.min(Number(h) + 100, 16000);
     await osascript(
-      `do shell script "screencapture -l${windowId} -o -x '${tmpPng}'"`,
-      { timeout: 15000 }
+      `tell application "Safari" to set bounds of ${getTargetWindowRef()} to {0, 0, ${Number(w)}, ${captureHeight}}`
     );
-  } catch (err) {
-    // Restore bounds on failure
-    await osascript(`tell application "Safari" to set bounds of ${getTargetWindowRef()} to {${origBounds}}`).catch(() => {});
-    throw new Error(`PDF screenshot capture failed: ${err.message}`);
-  }
+    await new Promise(r => setTimeout(r, 500)); // Let page reflow
 
-  // Step 4: Restore original bounds
-  await osascript(
-    `tell application "Safari" to set bounds of ${getTargetWindowRef()} to {${origBounds}}`
-  ).catch(() => {});
+    // Step 3: Take screenshot via screencapture -l (window-targeted, NO focus steal)
+    const windowIdRaw = await osascript(
+      `tell application "Safari" to return id of ${getTargetWindowRef()}`
+    );
+    const windowId = windowIdRaw != null && /^\d+$/.test(String(windowIdRaw).trim()) ? String(windowIdRaw).trim() : null;
+    if (!windowId) throw new Error("Cannot get Safari window ID for PDF capture");
+    try {
+      // Route capture through the TCC-granted helper (NSAppleScript → do shell script):
+      // under the launchd daemon, node has no Screen Recording grant — the helper does.
+      await osascriptFast(
+        `do shell script "/usr/sbin/screencapture -l${windowId} -o -x '${tmpPng}'"`,
+        { timeout: 15000 }
+      );
+    } catch (err) {
+      // Restore bounds on failure
+      await osascript(`tell application "Safari" to set bounds of ${getTargetWindowRef()} to {${origBounds}}`).catch(() => {});
+      throw new Error(`PDF screenshot capture failed: ${err.message}`);
+    }
+
+    // Step 4: Restore original bounds
+    await osascript(
+      `tell application "Safari" to set bounds of ${getTargetWindowRef()} to {${origBounds}}`
+    ).catch(() => {});
+  });
 
-  // Step 5: Convert screenshot to PDF using Python3 + macOS Quartz (no external deps).
-  // Paths are passed as argv — NOT interpolated into the source — so there is no shell
-  // or Python string-escaping to get wrong, and no code-injection surface.
+  // Step 5: Convert screenshot to PDF with sips (macOS built-in). Replaces the previous
+  // python3+Quartz converter: current macOS ships pyobjc for neither the system nor the
+  // homebrew python3, so any bare `python3` died with ModuleNotFoundError: Quartz.
   try {
-    await execFileAsync("python3", ["-c", `
-import sys
-from Quartz import CGImageSourceCreateWithURL, CGImageSourceCreateImageAtIndex, CGImageGetWidth, CGImageGetHeight, CGPDFContextCreateWithURL, CGRectMake, CGPDFContextBeginPage, CGPDFContextEndPage, CGContextDrawImage
-from CoreFoundation import CFURLCreateFromFileSystemRepresentation
-
-png_path = sys.argv[1].encode('utf-8')
-pdf_path = sys.argv[2].encode('utf-8')
-
-src_url = CFURLCreateFromFileSystemRepresentation(None, png_path, len(png_path), False)
-img_src = CGImageSourceCreateWithURL(src_url, None)
-if not img_src:
-    print("ERROR: failed to read screenshot", file=sys.stderr); sys.exit(1)
-img = CGImageSourceCreateImageAtIndex(img_src, 0, None)
-if not img:
-    print("ERROR: failed to decode image", file=sys.stderr); sys.exit(1)
-w = CGImageGetWidth(img)
-h = CGImageGetHeight(img)
-
-pdf_url = CFURLCreateFromFileSystemRepresentation(None, pdf_path, len(pdf_path), False)
-ctx = CGPDFContextCreateWithURL(pdf_url, CGRectMake(0, 0, w, h), None)
-CGPDFContextBeginPage(ctx, None)
-CGContextDrawImage(ctx, CGRectMake(0, 0, w, h), img)
-CGPDFContextEndPage(ctx)
-del ctx
-print(f"OK {w}x{h}")
-`.trim(), tmpPng, pdfPath], { timeout: 15000 });
+    await execFileAsync("/usr/bin/sips", ["-s", "format", "pdf", tmpPng, "--out", pdfPath], { timeout: 15000 });
   } catch (err) {
     throw new Error(`PDF conversion failed: ${err.message}`);
   } finally {