safari-mcp 2.17.0 → 2.18.0

package/README.md

@@ -15,14 +15,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![macOS](https://img.shields.io/badge/macOS-only-blue)](https://www.apple.com/macos/)
 
-[![Glama AAA](https://img.shields.io/badge/Glama-AAA_Score-22c55e?logo=ai)](https://glama.ai/mcp/servers/@achiya-automation/safari-mcp)
-[![MCP Registry](https://img.shields.io/badge/MCP_Registry-Verified-2563eb)](https://registry.modelcontextprotocol.io/v0/servers?search=achiya-automation)
-[![Smithery](https://img.shields.io/badge/Smithery-Listed-7c3aed)](https://smithery.ai/server/@achiya-automation/safari-mcp)
-[![MCP Score](https://mcpscoreboard.com/badge/05977769-8762-4e89-aff3-a0c5776843bb.svg)](https://mcpscoreboard.com/server/05977769-8762-4e89-aff3-a0c5776843bb/)
-
-<a href="vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code-Install_Server-0078d4?logo=visual-studio-code&logoColor=white" alt="Install in VS Code"></a>
-<a href="https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code_Insiders-Install_Server-24bfa5?logo=visual-studio-code&logoColor=white" alt="Install in VS Code Insiders"></a>
-<a href="cursor://anysphere.cursor-deeplink/mcp/install?name=safari-mcp&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D"><img src="https://img.shields.io/badge/Cursor-Install_Server-f97316?logo=cursor&logoColor=white" alt="Install in Cursor"></a>
+[Install in VS Code](vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D) ·
+[VS Code Insiders](https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D) ·
+[Install in Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=safari-mcp&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D)
 
 **97 tools** · **No Chrome/Puppeteer/Playwright needed** · **~5ms per command** · **60% less CPU than Chrome**
 

package/extension/background.js

@@ -61,6 +61,30 @@ async function _bridgeFetch(url, init = {}) {
   headers.set("X-Safari-MCP-Worker", _bridgeWorkerId);
   return fetch(url, { ...init, headers });
 }
+const _CONTENT_WAKE_TOKEN_STORAGE_KEY = "mcpContentWakeTokenV1";
+const _CONTENT_WAKE_LABEL = "safari-mcp-content-wakeup-v1";
+async function _publishContentWakeToken() {
+  try {
+    const bridgeToken = await _bridgeAuthToken();
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey(
+      "raw",
+      encoder.encode(bridgeToken),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(_CONTENT_WAKE_LABEL));
+    const wakeToken = Array.from(new Uint8Array(signature), (byte) =>
+      byte.toString(16).padStart(2, "0")
+    ).join("");
+    if (!/^[0-9a-f]{64}$/.test(wakeToken)) throw new Error("invalid content wake token");
+    await browser.storage.local.set({ [_CONTENT_WAKE_TOKEN_STORAGE_KEY]: wakeToken });
+  } catch (error) {
+    await browser.storage.local.remove(_CONTENT_WAKE_TOKEN_STORAGE_KEY).catch(() => {});
+    throw error;
+  }
+}
 let _targetProfile = null;   // Profile name from server (e.g. "Automations")
 let _profileWindowId = null; // Discovered windowId for the profile (shared default)
 // Per-session profile window. One Safari profile can hold SEVERAL windows once
@@ -419,6 +443,18 @@ let _startupReady = browser.storage.local.get("mcpEnabled").then(data => {
 
 // Listen for messages from popup
 browser.runtime.onMessage.addListener((msg, sender, sendResponse) => {
+  // Safari can suspend an MV3 worker even while a content-script Port exists. A
+  // leader page therefore sends this fixed, authority-free message as a second
+  // keepalive signal. runtime.sendMessage is an extension event, so it wakes the
+  // worker on Safari versions where Port traffic alone does not. Never accept tab,
+  // URL, receipt, session, or command data through this path.
+  if (msg?.action === "mcpContentKeepalivePingV1") {
+    if (Object.keys(msg).length !== 1) return false;
+    if (!Number.isInteger(sender?.tab?.id)) return false;
+    if (!_enabled || _bridgeWorkerSuperseded || _bridgeWorkerRetiring) return false;
+    sendResponse({ ok: true });
+    return false;
+  }
   if (msg.action === "setEnabled") {
     _enabled = msg.enabled;
     if (!_enabled) {
@@ -428,6 +464,7 @@ browser.runtime.onMessage.addListener((msg, sender, sendResponse) => {
       if (_reconnectTimer) { clearTimeout(_reconnectTimer); _reconnectTimer = null; }
       _reconnectDelay = 3000;
       _stopHeartbeat();
+      _disconnectContentKeepalivePort();
       updateBadge("OFF");
     } else {
       updateBadge("");
@@ -449,9 +486,31 @@ browser.runtime.onMessage.addListener((msg, sender, sendResponse) => {
 // it into a command channel: accept only the exact name, require a real sender tab,
 // inspect only the fixed ping type, and never receive or return tab/session data.
 const _CONTENT_KEEPALIVE_PORT_NAME = "mcp-content-keepalive-v1";
+let _contentKeepalivePort = null;
+function _disconnectContentKeepalivePort() {
+  const port = _contentKeepalivePort;
+  _contentKeepalivePort = null;
+  if (port) {
+    try { port.disconnect(); } catch (_) {}
+  }
+}
 browser.runtime.onConnect.addListener((port) => {
   if (port?.name !== _CONTENT_KEEPALIVE_PORT_NAME) return;
   if (!Number.isInteger(port?.sender?.tab?.id)) return;
+  if (!_enabled || _bridgeWorkerSuperseded || _bridgeWorkerRetiring) {
+    try { port.disconnect(); } catch (_) {}
+    return;
+  }
+  // The content-side lease should already converge on one sender. Enforce the same
+  // invariant here so a brief storage-election race cannot leave many live Ports.
+  if (_contentKeepalivePort && _contentKeepalivePort !== port) {
+    try { port.disconnect(); } catch (_) {}
+    return;
+  }
+  _contentKeepalivePort = port;
+  port.onDisconnect.addListener(() => {
+    if (_contentKeepalivePort === port) _contentKeepalivePort = null;
+  });
   port.onMessage.addListener((message) => {
     if (message?.type !== "ping") return;
     // Intentionally empty: delivery of this event is the keepalive.
@@ -522,6 +581,14 @@ async function connect() {
         signal: AbortSignal.timeout(1500),
       });
       if (_restartInvalidatedConnect(pollGeneration)) return;
+      if (res.status === 423) {
+        isConnected = false;
+        updateBadge("");
+        _stopHeartbeat();
+        scheduleReconnect(3000);
+        _connecting = false;
+        return;
+      }
       if (!res.ok) continue;
 
       const data = await res.json().catch(() => ({}));
@@ -546,7 +613,7 @@ async function connect() {
             isConnected = false;
             updateBadge("");
             _stopHeartbeat();
-            scheduleReconnect();
+            scheduleReconnect(3000);
             _connecting = false;
             return;
           }
@@ -581,17 +648,22 @@ async function connect() {
   _connecting = false;
 }
 
-function scheduleReconnect() {
+function scheduleReconnect(delayOverrideMs = null) {
   if (!_enabled || _bridgeWorkerSuperseded || _bridgeWorkerRetiring) return;
   // Cancel any existing reconnect to prevent exponential growth
   if (_reconnectTimer) { clearTimeout(_reconnectTimer); _reconnectTimer = null; }
 
   // Single timer with exponential backoff (3s → 6s → 12s → ... → 60s max)
+  const delay = Number.isFinite(delayOverrideMs)
+    ? Math.max(0, Number(delayOverrideMs))
+    : _reconnectDelay;
   _reconnectTimer = setTimeout(() => {
     _reconnectTimer = null;
     connect();
-  }, _reconnectDelay);
-  _reconnectDelay = Math.min(_reconnectDelay * 2, _RECONNECT_MAX);
+  }, delay);
+  if (!Number.isFinite(delayOverrideMs)) {
+    _reconnectDelay = Math.min(_reconnectDelay * 2, _RECONNECT_MAX);
+  }
 
   // Alarm as backup — wakes terminated service worker (Safari minimum 1 minute)
   try {
@@ -622,6 +694,7 @@ async function pollForCommands(pollGeneration) {
         isConnected = false;
         updateBadge("");
         _stopHeartbeat();
+        _disconnectContentKeepalivePort();
         return;
       }
       if (res.status === 401 || res.status === 403 || res.status === 409) {
@@ -1014,11 +1087,17 @@ async function handleCommand(type, payload) {
         );
         if (!r || r.ok !== true) throw new Error((r && r.error) || "content bridge failed");
         _injectionBlockedTabs.add(evalTabId);
+        if (evalOrigin) _injectionBlockedOrigins.set(evalOrigin, Date.now() + _INJECTION_BLOCK_TTL_MS);
         return r.value;
       };
-      if (_injectionBlockedTabs.has(evalTabId)) {
+      const evalOrigin = _originKey(targetTab?.url);
+      const originBlocked = !!evalOrigin && (_injectionBlockedOrigins.get(evalOrigin) || 0) > Date.now();
+      if (_injectionBlockedTabs.has(evalTabId) || originBlocked) {
         try { return await viaBridge(); }
-        catch (_e) { _injectionBlockedTabs.delete(evalTabId); } // page changed — re-probe
+        catch (_e) { // page changed — re-probe
+          _injectionBlockedTabs.delete(evalTabId);
+          if (evalOrigin) _injectionBlockedOrigins.delete(evalOrigin);
+        }
       }
 
       // First contact with a hardened page: every execInTab strategy below will stall.
@@ -1129,14 +1208,23 @@ async function handleCommand(type, payload) {
       // If it fails, fall back to AppleScript screencapture -l (which also doesn't steal focus).
       // NEVER use browser.windows.update({ focused: true }) — it steals user's keyboard/mouse.
       let captureWindowId = _profileWindowId || null;
+      // captureVisibleTab only sees the window's selected tab, so ours must be selected for
+      // the capture — but the selection belongs to the user when they browse this window.
+      // Remember what they had selected and put it back (the AppleScript path already does
+      // this via _withTargetTabFronted; this path used to leave our tab in front).
+      let restoreTabId = null;
       if (tabId) {
         try {
           const tabInfo = await browser.tabs.get(tabId);
           captureWindowId = tabInfo.windowId;
-          // Only activate the correct tab — does NOT bring Safari window to foreground
-          await browser.tabs.update(tabId, { active: true });
+          if (!tabInfo.active) {
+            const [selected] = await browser.tabs.query({ active: true, windowId: tabInfo.windowId });
+            if (selected && selected.id !== tabId) restoreTabId = selected.id;
+            // Only selects the tab — does NOT bring the Safari window to the foreground
+            await browser.tabs.update(tabId, { active: true });
+            await new Promise(r => setTimeout(r, 150));
+          }
         } catch (_) {}
-        await new Promise(r => setTimeout(r, 150));
       }
       // Use JPEG with quality 50 to reduce size (~600KB PNG → ~60KB JPEG)
       try {
@@ -1154,6 +1242,8 @@ async function handleCommand(type, payload) {
         }
         // Any other error also falls back — better than stealing focus
         return "__SCREENSHOT_PERMISSION_DENIED__";
+      } finally {
+        if (restoreTabId !== null) browser.tabs.update(restoreTabId, { active: true }).catch(() => {});
       }
     }
 
@@ -3644,6 +3734,15 @@ const MAIN_WORLD_INJECT_MS = 3000;
 // pages fast instead of merely working. Cleared when the tab navigates or closes, so a
 // page that stops blocking injection is re-probed rather than downgraded forever.
 const _injectionBlockedTabs = new Set();
+// Same fact, keyed by origin: the per-tab set is cleared on every navigation, so a hardened
+// SPA (business.facebook.com) re-paid the ~10s probe on the first evaluate after EACH
+// navigate — 356 evaluates ≥10s in one week. An origin that blocked injection once is sent
+// straight to the bridge for a few hours; a bridge failure clears it and re-probes.
+const _injectionBlockedOrigins = new Map(); // origin → expiry (ms)
+const _INJECTION_BLOCK_TTL_MS = 6 * 60 * 60 * 1000;
+function _originKey(url) {
+  try { return new URL(String(url || "")).origin; } catch { return ""; }
+}
 function _withInjectionDeadline(promise, ms = MAIN_WORLD_INJECT_MS) {
   let timer;
   return Promise.race([
@@ -4284,6 +4383,7 @@ console.log("Safari MCP Bridge: service worker started");
 updateBadge("");
 // Wait for storage to load before connecting (prevents race condition with _enabled)
 _startupReady.then(() => {
+  _publishContentWakeToken().catch(() => {});
   if (_enabled) connect();
   else updateBadge("OFF");
 }).catch(() => connect());