safari-mcp 2.16.0 → 2.16.2

package/README.md

@@ -64,12 +64,27 @@ Native WebKit. ~60% less CPU. Background operation. 97 tools. One `npx` command.
 
 ---
 
+## In users' own words
+
+Not solicited testimonials — quotes lifted from the public issue tracker, each linked to the thread it came from.
+
+> "I run multiple Pi sessions/subagents against my normal Safari profile in parallel. **Sharing its cookies and logins is intentional.**"
+> — [@maxim](https://github.com/achiya-automation/safari-mcp/issues/76), on running concurrent agents against a real browser
+
+> "The server has a deliberate tab-ownership model … **the code is careful about this, and for the default case that's the right safety posture.**"
+> — [@turner-moore](https://github.com/achiya-automation/safari-mcp/issues/92), on why the guards refuse to touch your tabs
+
+> "Direct local validation from the package: **Safari MCP doctor 6/6.**"
+> — [@jrepp](https://github.com/achiya-automation/safari-mcp/pull/53), who found and fixed a queue-alignment bug in the focus helper
+
+---
+
 ## Quick Start
 
 ### Prerequisites
 
 - macOS (any version with Safari)
-- Node.js 18+
+- Node.js 20+
 - Safari → Settings → Advanced → **Show features for web developers** ✓
 - Safari → Develop → **Allow JavaScript from Apple Events** ✓
 
@@ -869,7 +884,7 @@ If Safari MCP saves you from Chrome overhead, **a star helps others discover it:
 
 [![Star this repo](https://img.shields.io/github/stars/achiya-automation/safari-mcp?style=social)](https://github.com/achiya-automation/safari-mcp)
 
-[Share on Twitter/X](https://twitter.com/intent/tweet?text=Safari%20MCP%20%E2%80%94%20Stop%20running%20Chrome%20just%20so%20your%20AI%20agent%20can%20browse.%2096%20tools%2C%20native%20Safari%2C%2060%25%20less%20CPU.&url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Write about it](https://dev.to/)
+[Share on Twitter/X](https://twitter.com/intent/tweet?text=Safari%20MCP%20%E2%80%94%20Stop%20running%20Chrome%20just%20so%20your%20AI%20agent%20can%20browse.%2097%20tools%2C%20native%20Safari%2C%2060%25%20less%20CPU.&url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Write about it](https://dev.to/)
 
 [![Star History Chart](https://api.star-history.com/svg?repos=achiya-automation/safari-mcp&type=Date)](https://star-history.com/#achiya-automation/safari-mcp&Date)
 

package/extension/background.js

@@ -1941,6 +1941,10 @@ browser.tabs.onRemoved.addListener((tabId) => {
 async function _verifyProfileMatch(expectedProfile) {
   try {
     const allWindows = await browser.windows.getAll({ populate: true });
+    // No window in this profile → it cannot be the profile the server drives, and probing
+    // would have to CREATE one: browser.tabs.create() with no open window opens a fresh window
+    // that jumps to the front. That is the personal profile popping up every reconnect.
+    if (!allWindows.length) return false;
     // Check if any window's tab titles contain the profile name pattern "ProfileName —"
     // Safari profile windows show: "ProfileName — Tab Title" in window name
     // But the extension only sees its OWN profile's windows, so we check if tabs exist at all.

package/glama.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "name": "Safari MCP Server",
-  "description": "Native Safari browser automation for AI agents. 96 tools via AppleScript — zero overhead, keeps logins, runs silently in background.",
+  "description": "Native Safari browser automation for AI agents. 97 tools via AppleScript — zero overhead, keeps logins, runs silently in background.",
   "repository": "https://github.com/achiya-automation/safari-mcp",
   "homepage": "https://github.com/achiya-automation/safari-mcp",
   "author": "achiya-automation",

package/index.js

@@ -403,7 +403,7 @@ try {
           const execFileAsync = pfy(execFileCb);
           // Don't launch Safari if it's not running
           try {
-            await execFileAsync("pgrep", ["-x", "Safari"], { timeout: 2000 });
+            await execFileAsync("pgrep", ["-x", "Safari"], { timeout: 1000 });
           } catch {
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ match: false, error: "Safari is not running" }));
@@ -423,7 +423,11 @@ try {
             end repeat
             return "notfound"
           end tell`;
-          const { stdout } = await execFileAsync("osascript", ["-e", script], { timeout: 5000 });
+          // Must finish well inside the extension's 5s fetch timeout: if the extension aborts
+          // first it never caches the verdict, so it re-probes every few seconds — and each probe
+          // opens a *new window* in any profile that has none (the personal profile popping up).
+          // 1s pgrep + 2.5s osascript = 3.5s worst case, and the catch below still answers 200.
+          const { stdout } = await execFileAsync("osascript", ["-e", script], { timeout: 2500 });
           const out = stdout.trim();
           if (out === "match") {
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -2397,7 +2401,10 @@ try {
       let version = "?";
       try { version = JSON.parse(readFileSync(pkgPath, "utf8")).version; } catch {}
       console.error("");
-      console.error(`[Safari MCP] 🦁 v${version} ready — 96 tools, native WebKit, zero Chrome.`);
+      // Count tools at runtime — a hardcoded number here drifted to 96 while the code had 97.
+      const toolCount = Object.keys(server._registeredTools ?? {}).length;
+      const toolsPhrase = toolCount ? `${toolCount} tools, ` : "";
+      console.error(`[Safari MCP] 🦁 v${version} ready — ${toolsPhrase}native WebKit, zero Chrome.`);
       console.error(`[Safari MCP] ⭐ Like it? Star: https://github.com/achiya-automation/safari-mcp`);
       console.error("");
       try { writeFileSync(bannerStateFile, String(Date.now()), { mode: 0o600 }); } catch {}

package/injected-escape.js

@@ -7,9 +7,19 @@
 // ORDER MATTERS: backslash is escaped BEFORE the quote, or the backslash inserted in front
 // of the quote gets doubled and the string breaks out. Locked by test/escaping.test.mjs
 // and test/injection-safety.test.mjs.
+// NOTE: \r and \n are escaped to \\r/\\n so that multiline values round-trip as escape
+// sequences inside the single-quoted JS literal rather than being silently space-flattened
+// by runJS. U+2028/U+2029 are ECMAScript LineTerminators and must also be spelled as
+// escape sequences -- raw U+2028/U+2029 inside a regex literal is a SyntaxError.
 
 export function escJsSingleQuote(s) {
-  return String(s).replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return String(s)
+    .replace(/\\/g, "\\\\")
+    .replace(/'/g, "\\'")
+    .replace(/\r/g, "\\r")
+    .replace(/\n/g, "\\n")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
 }
 
 // Also strips CR/LF: a raw newline would close the AppleScript string and allow injection.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "safari-mcp",
-  "version": "2.16.0",
+  "version": "2.16.2",
   "mcpName": "io.github.achiya-automation/safari-mcp",
-  "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 96 tools via AppleScript + JavaScript.",
+  "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 97 tools via AppleScript + JavaScript.",
   "type": "module",
   "main": "index.js",
   "bin": {

package/safari.js

@@ -3262,6 +3262,64 @@ async function _screenshotFronted({ fullPage }) {
       }
     }
 
+    // Fallback: full-screen capture + crop to the window rect.
+    //
+    // macOS 26 (Tahoe) broke `screencapture -l<windowId>` for Safari: it exits 1
+    // with "could not create image from window" for EVERY window, while a plain
+    // full-screen `screencapture -x` from the same process succeeds. So this is
+    // not a TCC problem — safari_doctor reports Screen Recording as granted and
+    // is telling the truth. Diagnosed 17.08.2026, when the by-id path started
+    // failing mid-session and the misleading "permission may have been lost"
+    // error below sent the investigation after a permission that was never gone.
+    //
+    // Crop math: AppleScript bounds are in points, the capture is in pixels.
+    // devicePixelRatio from the page gives the backing-scale factor.
+    if (windowId) {
+      try {
+        // A locked screen captures as solid black. Say so instead of returning a
+        // black rectangle the caller has to guess at.
+        const locked = await execFileAsync("/bin/sh", ["-c",
+          "ioreg -n Root -d1 -r -a 2>/dev/null | grep -c CGSSessionScreenIsLocked || true"])
+          .then((r) => String(r.stdout).trim() !== "0").catch(() => false);
+        if (locked) {
+          throw new Error("SCREEN_LOCKED");
+        }
+        const boundsRaw = await osascript(
+          `tell application "Safari" to return bounds of ${getTargetWindowRef()}`
+        );
+        const [x1, y1, x2, y2] = String(boundsRaw).split(",").map((v) => parseInt(v.trim(), 10));
+        const dpr = Math.max(1, Math.round(Number(await runJS("window.devicePixelRatio")) || 1));
+        const w = (x2 - x1) * dpr, h = (y2 - y1) * dpr;
+        if ([x1, y1, x2, y2].every(Number.isFinite) && w > 0 && h > 0) {
+          const fullFile = tmpFile.replace(/\.png$/, "-full.png");
+          const cropFile = tmpFile.replace(/\.png$/, "-crop.jpg");
+          try {
+            // Direct first (VS Code / terminal grant), helper second (launchd daemon has no grant of its own)
+            await execFileAsync("/usr/sbin/screencapture", ["-x", fullFile], { timeout: 15000 })
+              .catch(() => osascriptFast(`do shell script "/usr/sbin/screencapture -x '${fullFile}'"`, { timeout: 15000 }));
+            await execFileAsync("sips", [
+              "-c", String(h), String(w), "--cropOffset", String(y1 * dpr), String(x1 * dpr),
+              fullFile, "--out", cropFile,
+            ], { timeout: 10000 });
+            await execFileAsync("sips", [
+              "-s", "format", "jpeg", "-s", "formatOptions", "50", "--resampleWidth", "1200",
+              cropFile, "--out", cropFile,
+            ], { timeout: 10000 });
+            const cropped = await readFile(cropFile);
+            if (cropped.length > 100) return cropped.toString("base64");
+          } finally {
+            await unlink(fullFile).catch(() => {});
+            await unlink(cropFile).catch(() => {});
+          }
+        }
+      } catch (e) {
+        if (e && e.message === "SCREEN_LOCKED") {
+          throw new Error("screenshot unavailable — the screen is locked, so the capture would be solid black. Unlock the Mac and retry. (Text-based tools — safari_snapshot / safari_read_page / safari_evaluate — work regardless.)");
+        }
+        // crop path failed too — fall through to the JS canvas method
+      }
+    }
+
     // Fallback: JS-based screenshot via canvas (no permissions needed)
     const dataUrl = await runJS(
       `(async function(){` +

package/scripts/postinstall.cjs

@@ -3,7 +3,7 @@
 // Skipped silently in CI and when stdout is not a TTY (npm install in scripts).
 
 const path = require("path");
-const { execSync } = require("child_process");
+const { execFileSync, spawnSync } = require("child_process");
 const fs = require("fs");
 
 const c = {
@@ -31,7 +31,10 @@ function readHelperId(helper) {
     // NOTE: the Identifier= line is only emitted with --verbose. Plain `codesign -d`
     // prints nothing matchable, so the old grep always failed → the early-return never
     // fired and any verify read came back empty (a false "re-sign failed" signal).
-    return execSync(`codesign -d --verbose=2 -- "${helper}" 2>&1 | grep "^Identifier="`, { encoding: "utf8" }).trim();
+    const result = spawnSync("codesign", ["-d", "--verbose=2", "--", helper], { encoding: "utf8" });
+    const output = (result.stdout || "") + (result.stderr || "");
+    const match = output.split("\n").find((l) => l.startsWith("Identifier="));
+    return match ? match.trim() : "";
   } catch { return ""; }
 }
 function ensureCodesign() {
@@ -43,9 +46,11 @@ function ensureCodesign() {
     const current = readHelperId(helper);
     if (current.includes(STABLE_ID)) return;
     const entitlements = path.join(__dirname, "..", "safari-helper.entitlements");
-    const entFlag = fs.existsSync(entitlements) ? `--entitlements "${entitlements}"` : "";
+    const codesignArgs = ["-s", "-", "-f", "--identifier", STABLE_ID];
+    if (fs.existsSync(entitlements)) codesignArgs.push("--entitlements", entitlements);
+    codesignArgs.push(helper);
     // NOTE: do NOT swallow codesign's stderr (the old `2>/dev/null` hid real failures).
-    execSync(`codesign -s - -f --identifier ${STABLE_ID} ${entFlag} "${helper}"`, { stdio: ["ignore", "ignore", "pipe"] });
+    execFileSync("codesign", codesignArgs, { stdio: ["ignore", "ignore", "pipe"] });
     // Verify the re-sign actually took. A SILENT failure here is the #1 cause of native
     // clicks "succeeding" while never reaching the page — the Accessibility grant is keyed
     // to the identifier, so a wrong/unstable identifier breaks it invisibly. Make it loud.