safari-mcp 2.17.0 → 2.17.1

package/README.md

@@ -15,14 +15,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![macOS](https://img.shields.io/badge/macOS-only-blue)](https://www.apple.com/macos/)
 
-[![Glama AAA](https://img.shields.io/badge/Glama-AAA_Score-22c55e?logo=ai)](https://glama.ai/mcp/servers/@achiya-automation/safari-mcp)
-[![MCP Registry](https://img.shields.io/badge/MCP_Registry-Verified-2563eb)](https://registry.modelcontextprotocol.io/v0/servers?search=achiya-automation)
-[![Smithery](https://img.shields.io/badge/Smithery-Listed-7c3aed)](https://smithery.ai/server/@achiya-automation/safari-mcp)
-[![MCP Score](https://mcpscoreboard.com/badge/05977769-8762-4e89-aff3-a0c5776843bb.svg)](https://mcpscoreboard.com/server/05977769-8762-4e89-aff3-a0c5776843bb/)
-
-<a href="vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code-Install_Server-0078d4?logo=visual-studio-code&logoColor=white" alt="Install in VS Code"></a>
-<a href="https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code_Insiders-Install_Server-24bfa5?logo=visual-studio-code&logoColor=white" alt="Install in VS Code Insiders"></a>
-<a href="cursor://anysphere.cursor-deeplink/mcp/install?name=safari-mcp&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D"><img src="https://img.shields.io/badge/Cursor-Install_Server-f97316?logo=cursor&logoColor=white" alt="Install in Cursor"></a>
+[Install in VS Code](vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D) ·
+[VS Code Insiders](https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D) ·
+[Install in Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=safari-mcp&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D)
 
 **97 tools** · **No Chrome/Puppeteer/Playwright needed** · **~5ms per command** · **60% less CPU than Chrome**
 

package/extension/background.js

@@ -428,6 +428,7 @@ browser.runtime.onMessage.addListener((msg, sender, sendResponse) => {
       if (_reconnectTimer) { clearTimeout(_reconnectTimer); _reconnectTimer = null; }
       _reconnectDelay = 3000;
       _stopHeartbeat();
+      _disconnectContentKeepalivePort();
       updateBadge("OFF");
     } else {
       updateBadge("");
@@ -449,9 +450,31 @@ browser.runtime.onMessage.addListener((msg, sender, sendResponse) => {
 // it into a command channel: accept only the exact name, require a real sender tab,
 // inspect only the fixed ping type, and never receive or return tab/session data.
 const _CONTENT_KEEPALIVE_PORT_NAME = "mcp-content-keepalive-v1";
+let _contentKeepalivePort = null;
+function _disconnectContentKeepalivePort() {
+  const port = _contentKeepalivePort;
+  _contentKeepalivePort = null;
+  if (port) {
+    try { port.disconnect(); } catch (_) {}
+  }
+}
 browser.runtime.onConnect.addListener((port) => {
   if (port?.name !== _CONTENT_KEEPALIVE_PORT_NAME) return;
   if (!Number.isInteger(port?.sender?.tab?.id)) return;
+  if (!_enabled || _bridgeWorkerSuperseded || _bridgeWorkerRetiring) {
+    try { port.disconnect(); } catch (_) {}
+    return;
+  }
+  // The content-side lease should already converge on one sender. Enforce the same
+  // invariant here so a brief storage-election race cannot leave many live Ports.
+  if (_contentKeepalivePort && _contentKeepalivePort !== port) {
+    try { port.disconnect(); } catch (_) {}
+    return;
+  }
+  _contentKeepalivePort = port;
+  port.onDisconnect.addListener(() => {
+    if (_contentKeepalivePort === port) _contentKeepalivePort = null;
+  });
   port.onMessage.addListener((message) => {
     if (message?.type !== "ping") return;
     // Intentionally empty: delivery of this event is the keepalive.
@@ -622,6 +645,7 @@ async function pollForCommands(pollGeneration) {
         isConnected = false;
         updateBadge("");
         _stopHeartbeat();
+        _disconnectContentKeepalivePort();
         return;
       }
       if (res.status === 401 || res.status === 403 || res.status === 409) {

package/extension/command-content.js

@@ -7,38 +7,110 @@
 
 // Register on every execution. Safari can preserve the isolated-world globals while
 // invalidating the old runtime listener during an extension update; a persistent
-// boolean guard then falsely says the bridge is installed. sendContentCommand only
-// reinjects this file after a message failure, so duplicate live listeners are rare
-// and harmless (the first synchronous response wins).
+// boolean guard would then falsely say the bridge is installed. Hot reload can also
+// leave the old listener alive, so every listener belongs to a revocable generation:
+// only the newest generation may execute a command, even if removing the old runtime
+// listener fails because its extension runtime has already been invalidated.
 
 // Safari may unload an MV3 service worker even while it owns an HTTP long-poll. A
-// content script lives with the page, so use a narrow extension Port to generate a
-// real worker event comfortably inside Safari's roughly 30-second idle window. The
-// ping carries no page URL, DOM data, receipt, or other authority. If Safari drops the
-// worker, onDisconnect retries quickly; the normal interval remains the bounded
-// fallback if the extension was reloaded and this script's runtime became stale.
+// content script lives with the page, so elect ONE top-frame page to send a narrow
+// extension-Port ping inside Safari's roughly 30-second idle window. Visible pages
+// take priority; when Safari marks every background-app page hidden, a short storage
+// lease provides one fallback leader. Non-leaders have no Port and do no periodic
+// storage work. The shared record and ping contain no URL, DOM data, receipt, or other
+// authority.
+(() => {
+  const previousKeepaliveState = globalThis.__mcpKeepaliveState;
+  const inheritedKeepaliveId = /^[0-9a-f]{24}$/.test(String(previousKeepaliveState?.leaseId || ""))
+    ? previousKeepaliveState.leaseId
+    : "";
+  try { previousKeepaliveState?.cleanup?.(); } catch (_) {}
+
 const _MCP_KEEPALIVE_PORT_NAME = "mcp-content-keepalive-v1";
-const _MCP_KEEPALIVE_INTERVAL_MS = 10000;
+const _MCP_KEEPALIVE_LEASE_KEY = "mcpContentKeepaliveLeaseV1";
+const _MCP_KEEPALIVE_LEASE_MS = 26000;
+const _MCP_KEEPALIVE_RENEW_MS = 18000;
+const _MCP_KEEPALIVE_PING_MS = 8000;
 const _MCP_KEEPALIVE_RECONNECT_MS = 1500;
+const _mcpKeepaliveInstanceId = inheritedKeepaliveId || (() => {
+  const bytes = new Uint8Array(12);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+})();
 let _mcpKeepalivePort = null;
 let _mcpKeepaliveReconnectTimer = null;
-let _mcpKeepaliveTickRunning = false;
+let _mcpKeepaliveLeaseTimer = null;
+let _mcpKeepaliveLeaseTimerDueAt = 0;
+let _mcpKeepalivePingTimer = null;
+let _mcpKeepaliveEnabled = true;
+let _mcpKeepaliveEnabledRevision = 0;
+let _mcpKeepaliveLeader = false;
+let _mcpKeepaliveClaiming = false;
+let _mcpKeepaliveDisposed = false;
+
+function _isMcpKeepaliveTopFrame() {
+  try { return window.top === window; } catch (_) { return false; }
+}
+
+function _mcpKeepaliveVisible() {
+  return document.visibilityState === "visible";
+}
+
+function _validMcpKeepaliveLease(value, now = Date.now()) {
+  return value && typeof value.id === "string" && /^[0-9a-f]{24}$/.test(value.id)
+    && Number.isFinite(value.expiresAt) && value.expiresAt > now
+    && value.expiresAt <= now + (_MCP_KEEPALIVE_LEASE_MS * 2)
+    ? value
+    : null;
+}
+
+function _clearMcpKeepaliveLeaseTimer() {
+  if (_mcpKeepaliveLeaseTimer) clearTimeout(_mcpKeepaliveLeaseTimer);
+  _mcpKeepaliveLeaseTimer = null;
+  _mcpKeepaliveLeaseTimerDueAt = 0;
+}
+
+function _scheduleMcpKeepaliveLeaseCheck(delayMs) {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled || !_isMcpKeepaliveTopFrame()) return;
+  const boundedDelay = Math.max(0, Math.min(Number(delayMs) || 0, _MCP_KEEPALIVE_LEASE_MS));
+  const dueAt = Date.now() + boundedDelay;
+  if (_mcpKeepaliveLeaseTimer && _mcpKeepaliveLeaseTimerDueAt <= dueAt) return;
+  _clearMcpKeepaliveLeaseTimer();
+  _mcpKeepaliveLeaseTimerDueAt = dueAt;
+  _mcpKeepaliveLeaseTimer = setTimeout(() => {
+    if (_mcpKeepaliveDisposed) return;
+    _mcpKeepaliveLeaseTimer = null;
+    _mcpKeepaliveLeaseTimerDueAt = 0;
+    if (_mcpKeepaliveLeader) _renewMcpKeepaliveLeaseAndPing();
+    else _attemptMcpKeepaliveClaim();
+  }, boundedDelay);
+}
 
 function _scheduleMcpKeepaliveReconnect() {
-  if (_mcpKeepaliveReconnectTimer) return;
+  if (_mcpKeepaliveDisposed || _mcpKeepaliveReconnectTimer || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return;
   _mcpKeepaliveReconnectTimer = setTimeout(() => {
     _mcpKeepaliveReconnectTimer = null;
-    _mcpKeepaliveTick();
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return;
+    const port = _openMcpKeepalivePort();
+    if (port) {
+      try { port.postMessage({ type: "ping" }); }
+      catch (_) {
+        if (_mcpKeepalivePort === port) _mcpKeepalivePort = null;
+        try { port.disconnect(); } catch (_) {}
+        _scheduleMcpKeepaliveReconnect();
+      }
+    }
   }, _MCP_KEEPALIVE_RECONNECT_MS);
 }
 
 function _openMcpKeepalivePort() {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return null;
   if (_mcpKeepalivePort) return _mcpKeepalivePort;
   try {
     const port = browser.runtime.connect({ name: _MCP_KEEPALIVE_PORT_NAME });
     _mcpKeepalivePort = port;
     port.onDisconnect.addListener(() => {
-      if (_mcpKeepalivePort !== port) return;
+      if (_mcpKeepaliveDisposed || _mcpKeepalivePort !== port) return;
       _mcpKeepalivePort = null;
       _scheduleMcpKeepaliveReconnect();
     });
@@ -49,58 +121,248 @@ function _openMcpKeepalivePort() {
   }
 }
 
-async function _mcpKeepaliveTick() {
-  if (_mcpKeepaliveTickRunning) return;
-  _mcpKeepaliveTickRunning = true;
+function _closeMcpKeepalivePort() {
+  const port = _mcpKeepalivePort;
+  _mcpKeepalivePort = null;
+  if (port) {
+    try { port.disconnect(); } catch (_) {}
+  }
+}
+
+function _clearMcpKeepalivePingTimer() {
+  if (_mcpKeepalivePingTimer) clearTimeout(_mcpKeepalivePingTimer);
+  _mcpKeepalivePingTimer = null;
+}
+
+function _sendMcpKeepalivePing() {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return;
+  _clearMcpKeepalivePingTimer();
+  const port = _openMcpKeepalivePort();
+  if (port) {
+    try { port.postMessage({ type: "ping" }); }
+    catch (_) {
+      if (_mcpKeepalivePort === port) _mcpKeepalivePort = null;
+      try { port.disconnect(); } catch (_) {}
+      _scheduleMcpKeepaliveReconnect();
+    }
+  }
+  _mcpKeepalivePingTimer = setTimeout(_sendMcpKeepalivePing, _MCP_KEEPALIVE_PING_MS);
+}
+
+function _stopMcpKeepaliveLeadership() {
+  _mcpKeepaliveLeader = false;
+  _clearMcpKeepaliveLeaseTimer();
+  if (_mcpKeepaliveReconnectTimer) clearTimeout(_mcpKeepaliveReconnectTimer);
+  _mcpKeepaliveReconnectTimer = null;
+  _clearMcpKeepalivePingTimer();
+  _closeMcpKeepalivePort();
+}
+
+async function _renewMcpKeepaliveLeaseAndPing() {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled || !_isMcpKeepaliveTopFrame()) return;
+  const stored = await browser.storage.local.get(_MCP_KEEPALIVE_LEASE_KEY).catch(() => ({}));
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return;
+  const current = _validMcpKeepaliveLease(stored?.[_MCP_KEEPALIVE_LEASE_KEY]);
+  if (!current || current.id !== _mcpKeepaliveInstanceId) {
+    _stopMcpKeepaliveLeadership();
+    _considerMcpKeepaliveLeadership(current);
+    return;
+  }
+  const lease = {
+    id: _mcpKeepaliveInstanceId,
+    expiresAt: Date.now() + _MCP_KEEPALIVE_LEASE_MS,
+    visible: _mcpKeepaliveVisible(),
+  };
+  await browser.storage.local.set({ [_MCP_KEEPALIVE_LEASE_KEY]: lease }).catch(() => {});
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveLeader || !_mcpKeepaliveEnabled) return;
+  _sendMcpKeepalivePing();
+  _scheduleMcpKeepaliveLeaseCheck(_MCP_KEEPALIVE_RENEW_MS);
+}
+
+function _becomeMcpKeepaliveLeader() {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled || !_isMcpKeepaliveTopFrame()) return;
+  _mcpKeepaliveLeader = true;
+  _clearMcpKeepaliveLeaseTimer();
+  _renewMcpKeepaliveLeaseAndPing();
+}
+
+async function _attemptMcpKeepaliveClaim() {
+  if (_mcpKeepaliveDisposed || _mcpKeepaliveClaiming || _mcpKeepaliveLeader || !_mcpKeepaliveEnabled || !_isMcpKeepaliveTopFrame()) return;
+  _mcpKeepaliveClaiming = true;
   try {
-    // Respect the popup's OFF state without waking the service worker merely to ask.
-    const stored = await browser.storage.local.get("mcpEnabled").catch(() => null);
-    if (!stored || stored.mcpEnabled === false) {
-      if (_mcpKeepalivePort) {
-        try { _mcpKeepalivePort.disconnect(); } catch (_) {}
-        _mcpKeepalivePort = null;
-      }
+    const stored = await browser.storage.local.get(_MCP_KEEPALIVE_LEASE_KEY).catch(() => ({}));
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+    const current = _validMcpKeepaliveLease(stored?.[_MCP_KEEPALIVE_LEASE_KEY]);
+    const mayPreemptHidden = _mcpKeepaliveVisible() && current && current.visible !== true;
+    if (current && current.id !== _mcpKeepaliveInstanceId && !mayPreemptHidden) {
+      const jitter = _mcpKeepaliveVisible() ? Math.random() * 100 : 250 + Math.random() * 1000;
+      _scheduleMcpKeepaliveLeaseCheck(current.expiresAt - Date.now() + jitter);
       return;
     }
-    const port = _openMcpKeepalivePort();
-    if (!port) return;
-    try {
-      port.postMessage({ type: "ping" });
-    } catch (_) {
-      if (_mcpKeepalivePort === port) _mcpKeepalivePort = null;
-      _scheduleMcpKeepaliveReconnect();
+    const candidate = {
+      id: _mcpKeepaliveInstanceId,
+      expiresAt: Date.now() + _MCP_KEEPALIVE_LEASE_MS,
+      visible: _mcpKeepaliveVisible(),
+    };
+    const storedCandidate = await browser.storage.local
+      .set({ [_MCP_KEEPALIVE_LEASE_KEY]: candidate })
+      .then(() => true)
+      .catch(() => false);
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+    if (!storedCandidate) {
+      _scheduleMcpKeepaliveLeaseCheck(1000 + Math.random() * 1000);
+      return;
     }
+    // Storage writes are serialized but not compare-and-swap. A short settle window
+    // lets simultaneous candidates overwrite one another; only the final stored id
+    // is allowed to open a Port.
+    await new Promise((resolve) => setTimeout(resolve, 75 + Math.random() * 75));
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+    const verified = await browser.storage.local.get(_MCP_KEEPALIVE_LEASE_KEY).catch(() => ({}));
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+    if (verified?.[_MCP_KEEPALIVE_LEASE_KEY]?.id === _mcpKeepaliveInstanceId) {
+      _becomeMcpKeepaliveLeader();
+      return;
+    }
+    _considerMcpKeepaliveLeadership(verified?.[_MCP_KEEPALIVE_LEASE_KEY]);
   } finally {
-    _mcpKeepaliveTickRunning = false;
+    _mcpKeepaliveClaiming = false;
+  }
+}
+
+function _considerMcpKeepaliveLeadership(knownLease) {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled || !_isMcpKeepaliveTopFrame()) return;
+  const current = _validMcpKeepaliveLease(knownLease);
+  if (current?.id === _mcpKeepaliveInstanceId) {
+    if (!_mcpKeepaliveLeader && !_mcpKeepaliveClaiming) _becomeMcpKeepaliveLeader();
+    return;
+  }
+  if (current) {
+    if (_mcpKeepaliveVisible() && current.visible !== true) {
+      _scheduleMcpKeepaliveLeaseCheck(Math.random() * 100);
+    } else {
+      const jitter = _mcpKeepaliveVisible() ? Math.random() * 100 : 250 + Math.random() * 1000;
+      _scheduleMcpKeepaliveLeaseCheck(current.expiresAt - Date.now() + jitter);
+    }
+    return;
   }
+  // Let a visible page win first. If Safari reports every background-app page as
+  // hidden, randomized fallback candidates still converge on one verified lease.
+  const initialDelay = _mcpKeepaliveVisible()
+    ? Math.random() * 100
+    : 1000 + Math.random() * 1500;
+  _scheduleMcpKeepaliveLeaseCheck(initialDelay);
 }
 
-_mcpKeepaliveTick();
-setInterval(_mcpKeepaliveTick, _MCP_KEEPALIVE_INTERVAL_MS);
+function _onMcpKeepaliveVisibilityChange() {
+  if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+  if (_mcpKeepaliveLeader) {
+    _renewMcpKeepaliveLeaseAndPing();
+  } else {
+    browser.storage.local.get(_MCP_KEEPALIVE_LEASE_KEY)
+      .then((stored) => _considerMcpKeepaliveLeadership(stored?.[_MCP_KEEPALIVE_LEASE_KEY]))
+      .catch(() => {});
+  }
+}
+
+async function _initializeMcpKeepalive() {
+  if (_mcpKeepaliveDisposed || !_isMcpKeepaliveTopFrame()) return;
+  document.addEventListener("visibilitychange", _onMcpKeepaliveVisibilityChange);
+  browser.storage.onChanged.addListener(_onMcpKeepaliveStorageChanged);
+  const enabledRevision = _mcpKeepaliveEnabledRevision;
+  const stored = await browser.storage.local.get(["mcpEnabled", _MCP_KEEPALIVE_LEASE_KEY]).catch(() => ({}));
+  if (_mcpKeepaliveDisposed || enabledRevision !== _mcpKeepaliveEnabledRevision) return;
+  _mcpKeepaliveEnabled = stored.mcpEnabled !== false;
+  if (_mcpKeepaliveEnabled) {
+    _considerMcpKeepaliveLeadership(stored[_MCP_KEEPALIVE_LEASE_KEY]);
+  }
+}
 
-browser.runtime.onMessage.addListener((message, _sender, sendResponse) => {
-  if (!message) return false;
-  if (message.type === "mcp-content-click") {
-    sendResponse(handleClick(message.payload || {}));
-    return true;
+async function _onMcpKeepaliveStorageChanged(changes, areaName) {
+  if (_mcpKeepaliveDisposed || areaName !== "local") return;
+  if (changes.mcpEnabled) {
+    _mcpKeepaliveEnabledRevision += 1;
+    _mcpKeepaliveEnabled = changes.mcpEnabled.newValue !== false;
+    if (!_mcpKeepaliveEnabled) {
+      _stopMcpKeepaliveLeadership();
+      return;
+    }
   }
-  if (message.type === "mcp-content-fill") {
-    sendResponse(handleFill(message.payload || {}));
-    return true;
+  if (changes[_MCP_KEEPALIVE_LEASE_KEY]) {
+    const next = _validMcpKeepaliveLease(changes[_MCP_KEEPALIVE_LEASE_KEY].newValue);
+    if (_mcpKeepaliveLeader && next?.id !== _mcpKeepaliveInstanceId) {
+      _stopMcpKeepaliveLeadership();
+    }
+    _considerMcpKeepaliveLeadership(next);
+    return;
   }
-  // Last-resort path for evaluate. On hardened SPAs (business.facebook.com) BOTH
-  // scripting.executeScript worlds hang forever instead of rejecting, while this
-  // already-injected listener keeps answering — clicks kept working there the whole
-  // time. Nothing is injected here, so there is no injection to stall on.
-  if (message.type === "mcp-content-eval") {
-    // The relayed function is often async (the evaluate handler awaits inside it), so
-    // this must resolve before answering — returning the promise itself serialised to
-    // "{}" and silently produced an empty result.
-    handleEval(message.payload || {}).then(sendResponse);
-    return true;
+  if (changes.mcpEnabled && _mcpKeepaliveEnabled) {
+    const stored = await browser.storage.local.get(_MCP_KEEPALIVE_LEASE_KEY).catch(() => ({}));
+    if (_mcpKeepaliveDisposed || !_mcpKeepaliveEnabled) return;
+    _considerMcpKeepaliveLeadership(stored?.[_MCP_KEEPALIVE_LEASE_KEY]);
   }
-  return false;
-});
+}
+
+function _cleanupMcpKeepalive() {
+  _mcpKeepaliveDisposed = true;
+  _mcpKeepaliveEnabled = false;
+  _stopMcpKeepaliveLeadership();
+  document.removeEventListener("visibilitychange", _onMcpKeepaliveVisibilityChange);
+  try { browser.storage.onChanged.removeListener(_onMcpKeepaliveStorageChanged); } catch (_) {}
+}
+
+globalThis.__mcpKeepaliveState = {
+  leaseId: _mcpKeepaliveInstanceId,
+  cleanup: _cleanupMcpKeepalive,
+};
+_initializeMcpKeepalive();
+})();
+
+(() => {
+  const previousCommandState = globalThis.__mcpContentCommandState;
+  const commandEvent = browser.runtime.onMessage;
+  const commandState = {
+    active: true,
+    event: commandEvent,
+    listener: null,
+    cleanup() {
+      this.active = false;
+      try { this.event.removeListener(this.listener); } catch (_) {}
+    },
+  };
+
+  const listener = (message, _sender, sendResponse) => {
+    if (!commandState.active || globalThis.__mcpContentCommandState !== commandState) return false;
+    if (!message) return false;
+    if (message.type === "mcp-content-click") {
+      sendResponse(handleClick(message.payload || {}));
+      return true;
+    }
+    if (message.type === "mcp-content-fill") {
+      sendResponse(handleFill(message.payload || {}));
+      return true;
+    }
+    // Last-resort path for evaluate. On hardened SPAs (business.facebook.com) BOTH
+    // scripting.executeScript worlds hang forever instead of rejecting, while this
+    // already-injected listener keeps answering — clicks kept working there the whole
+    // time. Nothing is injected here, so there is no injection to stall on.
+    if (message.type === "mcp-content-eval") {
+      // The relayed function is often async (the evaluate handler awaits inside it), so
+      // this must resolve before answering — returning the promise itself serialised to
+      // "{}" and silently produced an empty result.
+      handleEval(message.payload || {}).then(sendResponse);
+      return true;
+    }
+    return false;
+  };
+
+  commandState.listener = listener;
+  browser.runtime.onMessage.addListener(listener);
+  globalThis.__mcpContentCommandState = commandState;
+  if (previousCommandState && previousCommandState !== commandState) {
+    previousCommandState.cleanup?.();
+  }
+})();
 
 // We are in the ISOLATED world: we can talk to the background, but the PAGE's CSP
 // governs eval here, and a hardened page (business.facebook.com) forbids it — an
@@ -217,31 +479,31 @@ function handleClick(payload) {
     let el = null;
 
     if (ref) {
-      el = document.querySelector('[data-mcp-ref="' + cssString(ref) + '"]');
+      el = deepQuery('[data-mcp-ref="' + cssString(ref) + '"]');
     } else if (selector) {
-      try { el = document.querySelector(selector); } catch (_) {}
+      el = deepQuery(selector);
     } else if (text) {
-      const candidates = document.querySelectorAll(
-        "button,a,[role='button'],[role='link'],[role='tab'],[role='combobox'],input[type='submit'],input[type='button']"
+      el = deepFind(
+        "button,a,[role='button'],[role='link'],[role='tab'],[role='combobox'],input[type='submit'],input[type='button']",
+        (candidate) => isVisible(candidate) && (candidate.innerText || candidate.textContent || "").trim() === text
       );
-      for (const candidate of candidates) {
-        if (isVisible(candidate) && (candidate.innerText || candidate.textContent || "").trim() === text) {
-          el = candidate;
-          break;
-        }
-      }
       if (!el) {
-        const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
-        while (walker.nextNode()) {
-          const value = (walker.currentNode.textContent || "").trim();
-          if (value === text && isVisible(walker.currentNode.parentElement)) {
-            el = walker.currentNode.parentElement;
-            break;
+        for (const root of rootsIncludingOpenShadow()) {
+          const treeRoot = root === document ? document.body : root;
+          if (!treeRoot) continue;
+          const walker = document.createTreeWalker(treeRoot, NodeFilter.SHOW_TEXT);
+          while (walker.nextNode()) {
+            const value = (walker.currentNode.textContent || "").trim();
+            if (value === text && isVisible(walker.currentNode.parentElement)) {
+              el = walker.currentNode.parentElement;
+              break;
+            }
           }
+          if (el) break;
         }
       }
     } else if (x !== undefined && y !== undefined) {
-      el = document.elementFromPoint(Number(x), Number(y));
+      el = deepElementFromPoint(Number(x), Number(y));
     }
 
     if (!el) return { ok: false, result: "Element not found" };
@@ -254,7 +516,7 @@ function handleClick(payload) {
     const rect = el.getBoundingClientRect();
     const cx = rect.left + rect.width / 2;
     const cy = rect.top + rect.height / 2;
-    let from = document.elementFromPoint(cx, cy);
+    let from = deepElementFromPoint(cx, cy);
     if (!from || !(from === el || el.contains(from))) from = el;
 
     const anchor = el.closest ? el.closest("a[href]") : null;
@@ -315,6 +577,57 @@ function cssString(value) {
   return String(value).replace(/["\\]/g, "\\$&");
 }
 
+function rootsIncludingOpenShadow(root = document, roots = []) {
+  roots.push(root);
+  let descendants = [];
+  try { descendants = root.querySelectorAll("*"); } catch (_) {}
+  for (const descendant of descendants) {
+    let shadow = null;
+    try { shadow = descendant.shadowRoot; } catch (_) {}
+    if (shadow) rootsIncludingOpenShadow(shadow, roots);
+  }
+  return roots;
+}
+
+function deepQuery(selector) {
+  return deepFind(selector, () => true);
+}
+
+function deepFind(selector, predicate, root = document) {
+  let candidates;
+  try { candidates = root.querySelectorAll(selector); }
+  catch (_) { return null; }
+  for (const candidate of candidates) {
+    if (predicate(candidate)) return candidate;
+  }
+  let descendants = [];
+  try { descendants = root.querySelectorAll("*"); } catch (_) {}
+  for (const descendant of descendants) {
+    let shadow = null;
+    try { shadow = descendant.shadowRoot; } catch (_) {}
+    if (!shadow) continue;
+    const nested = deepFind(selector, predicate, shadow);
+    if (nested) return nested;
+  }
+  return null;
+}
+
+function deepElementFromPoint(x, y) {
+  let root = document;
+  let deepest = null;
+  for (let depth = 0; depth < 32; depth += 1) {
+    let hit = null;
+    try { hit = root.elementFromPoint(x, y); } catch (_) {}
+    if (!hit || hit === deepest) break;
+    deepest = hit;
+    let shadow = null;
+    try { shadow = hit.shadowRoot; } catch (_) {}
+    if (!shadow || typeof shadow.elementFromPoint !== "function") break;
+    root = shadow;
+  }
+  return deepest;
+}
+
 function isVisible(el) {
   if (!el) return false;
   const style = getComputedStyle(el);

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/index.js

@@ -2371,8 +2371,8 @@ server.tool(
           // tracked index is not proof either: `_openedTabs` is keyed by INDEX
           // and Safari renumbers every index whenever any tab closes, so a stale
           // key can point straight at a user's tab. Require BOTH — the index we
-          // opened AND the origin we opened it on. That is the same second factor
-          // the extension enforces in _canAdoptMarkedOwnedTab, so nothing that
+          // opened AND the origin we opened it on. That mirrors the origin
+          // boundary the extension keeps on its own receipts, so nothing that
           // would survive the extension's check is lost here, and the AppleScript
           // fallback (which has no ownership check of its own) stays guarded.
           const trackedOrigin = _originOf(_openedTabs.get(index)?.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 97 tools via AppleScript + JavaScript.",
   "type": "module",