safari-mcp 2.16.1 → 2.16.3

package/README.md

@@ -64,12 +64,27 @@ Native WebKit. ~60% less CPU. Background operation. 97 tools. One `npx` command.
 
 ---
 
+## In users' own words
+
+Not solicited testimonials — quotes lifted from the public issue tracker, each linked to the thread it came from.
+
+> "I run multiple Pi sessions/subagents against my normal Safari profile in parallel. **Sharing its cookies and logins is intentional.**"
+> — [@maxim](https://github.com/achiya-automation/safari-mcp/issues/76), on running concurrent agents against a real browser
+
+> "The server has a deliberate tab-ownership model … **the code is careful about this, and for the default case that's the right safety posture.**"
+> — [@turner-moore](https://github.com/achiya-automation/safari-mcp/issues/92), on why the guards refuse to touch your tabs
+
+> "Direct local validation from the package: **Safari MCP doctor 6/6.**"
+> — [@jrepp](https://github.com/achiya-automation/safari-mcp/pull/53), who found and fixed a queue-alignment bug in the focus helper
+
+---
+
 ## Quick Start
 
 ### Prerequisites
 
 - macOS (any version with Safari)
-- Node.js 18+
+- Node.js 20+
 - Safari → Settings → Advanced → **Show features for web developers** ✓
 - Safari → Develop → **Allow JavaScript from Apple Events** ✓
 
@@ -553,7 +568,7 @@ Safari MCP runs locally on your Mac with minimal attack surface:
 | Network | **No remote connections** — all communication is local (stdio + localhost) |
 | Permissions | macOS system permissions required (Screen Recording for screenshots) |
 | Data | No telemetry, no analytics, no data sent anywhere |
-| Extension | Communicates only with `localhost:9224`, validated by Safari |
+| Extension | Communicates only with the local profile bridges (`localhost:9224/9228/9232/9236`), validated by Safari |
 | Code | Fully open source (MIT) — audit every line |
 
 ---
@@ -683,23 +698,25 @@ The extension requires a one-time build with Xcode (free, included with macOS).
 git clone https://github.com/achiya-automation/safari-mcp.git
 cd safari-mcp
 
-# 2. Build the extension
+# 2. Build a clean, Apple Development-signed app
+# If needed, first choose your Team in Xcode → Signing & Capabilities.
 xcodebuild -project "xcode/Safari MCP/Safari MCP.xcodeproj" \
-  -scheme "Safari MCP (macOS)" -configuration Release build
+  -scheme "Safari MCP (macOS)" -configuration Release \
+  -allowProvisioningUpdates clean build
 
-# 3. Ad-hoc sign the built app so Safari will load it
-# (xcodebuild without a signing identity produces a bundle Safari silently rejects)
+# 3. Locate the signed app
 APP_PATH=$(find ~/Library/Developer/Xcode/DerivedData/Safari_MCP-*/Build/Products/Release -name "Safari MCP.app" -maxdepth 2 | head -1)
-codesign --sign - --force --deep "$APP_PATH"
 
 # 4. Re-sign safari-helper with the Apple Events entitlement
 # (helps macOS surface the TCC Automation prompt reliably)
 codesign --sign - --force --entitlements safari-helper.entitlements safari-helper
 
-# 4. Open the app (needed once so Safari registers the extension)
+# 5. Open the app (needed once so Safari registers the extension)
 open "$APP_PATH"
 ```
 
+> **Do not ad-hoc re-sign `Safari MCP.app` with `codesign --deep --sign -`.** That replaces the Apple Development identity on the wrapper and embedded extension; current Safari can then silently disable or mark the extension as removed. If a previous build was ad-hoc signed, run the `clean build` command above again.
+
 Alternatively, open `xcode/Safari MCP/Safari MCP.xcodeproj` directly in Xcode, select your Apple ID under Signing & Capabilities, and click Run. A free personal Apple Developer account is sufficient for local use.
 
 Then in Safari:
@@ -707,7 +724,7 @@ Then in Safari:
 2. Safari → Develop → **Allow Unsigned Extensions** (required each Safari restart)
 3. Safari → Settings → Extensions → enable **Safari MCP Bridge**
 
-The extension connects automatically to the MCP server on port `9224`.
+The extension connects automatically to the first local bridge whose declared Safari profile matches its own. The default bridge ports are `9224`, `9228`, `9232`, and `9236`; a single-profile setup normally uses `9224`.
 
 > **Note:** "Allow Unsigned Extensions" resets every time Safari restarts. You'll need to re-enable it in the Develop menu after each restart. The extension itself stays installed.
 
@@ -869,7 +886,7 @@ If Safari MCP saves you from Chrome overhead, **a star helps others discover it:
 
 [![Star this repo](https://img.shields.io/github/stars/achiya-automation/safari-mcp?style=social)](https://github.com/achiya-automation/safari-mcp)
 
-[Share on Twitter/X](https://twitter.com/intent/tweet?text=Safari%20MCP%20%E2%80%94%20Stop%20running%20Chrome%20just%20so%20your%20AI%20agent%20can%20browse.%2096%20tools%2C%20native%20Safari%2C%2060%25%20less%20CPU.&url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Write about it](https://dev.to/)
+[Share on Twitter/X](https://twitter.com/intent/tweet?text=Safari%20MCP%20%E2%80%94%20Stop%20running%20Chrome%20just%20so%20your%20AI%20agent%20can%20browse.%2097%20tools%2C%20native%20Safari%2C%2060%25%20less%20CPU.&url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgithub.com%2Fachiya-automation%2Fsafari-mcp) · [Write about it](https://dev.to/)
 
 [![Star History Chart](https://api.star-history.com/svg?repos=achiya-automation/safari-mcp&type=Date)](https://star-history.com/#achiya-automation/safari-mcp&Date)