safari-mcp 2.21.14 → 2.22.0

package/extension/background.js

@@ -1144,146 +1144,20 @@ async function handleCommand(type, payload) {
       }, [payload.maxLength || 200000], tabId);
     }
 
-    // --- JavaScript Execution — multi-strategy to handle CSP restrictions ---
-    // Strategy 1: indirect eval (fast, works when CSP allows unsafe-eval)
-    // Strategy 2: script element injection (bypasses CSP in MAIN world context)
+    // --- JavaScript Execution — see _evaluateOnce and _evalRunner ---
     case "list_frames": {
       return await listFrames(tabId);
     }
 
     case "evaluate": {
-      // Strategy 0: pages that stall injection outright. Every strategy below reaches
-      // the page through scripting.executeScript, which on business.facebook.com never
-      // resolves — so all three died on the caller's timeout and evaluate was simply
-      // unavailable there. The content-script bridge needs no injection at all, so try
-      // it FIRST once a tab is known to block injection, and fall back to it below
-      // when a fresh tab turns out to block it too.
       const evalTabId = tabId || (await getActiveTab()).id;
-      // A frame selector short-circuits every strategy below: those all target the
-      // main frame, which is exactly what makes an embedded app unreachable.
+      // A frame selector short-circuits the page-level path: that one targets the main
+      // frame, which is exactly what makes an embedded app unreachable.
       if (payload.frame !== undefined && payload.frame !== null && payload.frame !== "") {
         const _fid = await resolveFrameId(evalTabId, payload.frame);
         return await evaluateInFrame(evalTabId, _fid, payload.script);
       }
-      const viaBridge = async () => {
-        const r = await sendContentCommand(
-          evalTabId, "mcp-content-eval", { source: payload.script }, 10000
-        );
-        if (!r || r.ok !== true) throw new Error((r && r.error) || "content bridge failed");
-        _injectionBlockedTabs.add(evalTabId);
-        if (evalOrigin) _injectionBlockedOrigins.set(evalOrigin, Date.now() + _INJECTION_BLOCK_TTL_MS);
-        return r.value;
-      };
-      const evalOrigin = _originKey(targetTab?.url);
-      const originBlocked = !!evalOrigin && (_injectionBlockedOrigins.get(evalOrigin) || 0) > Date.now();
-      if (_injectionBlockedTabs.has(evalTabId) || originBlocked) {
-        try { return await viaBridge(); }
-        catch (_e) { // page changed — re-probe
-          _injectionBlockedTabs.delete(evalTabId);
-          if (evalOrigin) _injectionBlockedOrigins.delete(evalOrigin);
-        }
-      }
-
-      // First contact with a hardened page: every execInTab strategy below will stall.
-      // Catch that here so it costs one bounded probe, not the caller's whole timeout.
-      const evalStrategies = async () => {
-      // Strategy 1: Direct eval via execInTab (fast, works when CSP allows unsafe-eval)
-      const evalResult = await execInTab(async (script) => {
-        try {
-          const result = await (0, eval)(script);
-          if (result === undefined || result === null) return null;
-          return typeof result === "object" ? JSON.stringify(result) : String(result);
-        } catch (e) {
-          if (e.message.includes("unsafe-eval") || e.message.includes("trusted-types") || e.message.includes("Trusted Type")) {
-            return "__CSP_BLOCKED__";
-          }
-          return "Error: " + e.message;
-        }
-      }, [payload.script], tabId);
-
-      if (evalResult !== "__CSP_BLOCKED__") return evalResult;
-
-      // Strategy 2: Script element injection (works when inline scripts are allowed)
-      const injectResult = await execInTab(async (script) => {
-        return await new Promise((resolve) => {
-          // Unpredictable key — a Date.now()-based name let a hostile page pre-seed
-          // window["__mcp_eval_<now>"] with a fabricated {done:true,v:...} result.
-          const id = "__mcp_eval_" + (crypto.randomUUID
-            ? crypto.randomUUID().replace(/-/g, "")
-            : Date.now().toString(36) + Math.random().toString(36).slice(2));
-          window[id] = { done: false };
-          const s = document.createElement("script");
-          const code = "try{var __r=(function(){" + script + "})();if(__r&&typeof __r.then==='function'){__r.then(function(v){window['" + id + "']={done:true,v:v};}).catch(function(e){window['" + id + "']={done:true,e:e.message};});}else{window['" + id + "']={done:true,v:__r};}}catch(e){window['" + id + "']={done:true,e:e.message};}";
-          // Prefer the policy pre-registered by content.js at document_start —
-          // pages that block new policy creation post-load (GSC, modern Google admin)
-          // still accept ours because it was grandfathered in before their CSP applied.
-          if (window.__mcpTrustedPolicy && typeof window.__mcpTrustedPolicy.createScript === "function") {
-            try { s.textContent = window.__mcpTrustedPolicy.createScript(code); }
-            catch (_) { s.textContent = code; }
-          } else if (window.trustedTypes && window.trustedTypes.createPolicy) {
-            try {
-              const policy = window.trustedTypes.createPolicy("mcpEval_" + Date.now(), { createScript: (s) => s });
-              s.textContent = policy.createScript(code);
-            } catch (_) { s.textContent = code; }
-          } else {
-            s.textContent = code;
-          }
-          document.documentElement.appendChild(s);
-          s.remove();
-          let attempts = 0;
-          const poll = () => {
-            const r = window[id];
-            if (r && r.done) {
-              delete window[id];
-              if (r.e) resolve("Error: " + r.e);
-              else resolve(r.v === undefined || r.v === null ? null : typeof r.v === "object" ? JSON.stringify(r.v) : String(r.v));
-              return;
-            }
-            if (++attempts > 100) { delete window[id]; resolve("Error: timeout"); return; }
-            setTimeout(poll, 50);
-          };
-          poll();
-        });
-      }, [payload.script], tabId);
-
-      // If script injection also failed due to CSP, try Worker thread (separate CSP context)
-      const isInjectCsp = injectResult && typeof injectResult === "string" && (injectResult.includes("unsafe-eval") || injectResult.includes("trusted-types") || injectResult.includes("Content Security Policy"));
-      if (!isInjectCsp) return injectResult;
-
-      // Strategy 3: Web Worker — has its own CSP context, can execute arbitrary JS.
-      // Cannot access page DOM — only for pure computations. DOM scripts fall to AppleScript.
-      // SECURITY: This is a browser automation MCP tool — executing user scripts is its core purpose.
-      const workerResult = await execInTab(async (script) => {
-        if (/\b(document|window|querySelector|getElementById|innerHTML|textContent|style|className)\b/.test(script)) {
-          return "__CSP_NEEDS_DOM__";
-        }
-        return await new Promise((resolve) => {
-          try {
-            const wSrc = 'self.onmessage=function(e){try{var r=(0,self["ev"+"al"])(e.data);self.postMessage({ok:true,r:typeof r==="object"?JSON.stringify(r):String(r!=null?r:"null")})}catch(err){self.postMessage({ok:false,e:err.message})}};';
-            const blob = new Blob([wSrc], { type: "application/javascript" });
-            const url = URL.createObjectURL(blob);
-            const w = new Worker(url);
-            const timer = setTimeout(() => { w.terminate(); URL.revokeObjectURL(url); resolve("Error: Worker timeout"); }, 10000);
-            w.onmessage = (ev) => { clearTimeout(timer); w.terminate(); URL.revokeObjectURL(url); resolve(ev.data.ok ? ev.data.r : "Error: " + ev.data.e); };
-            w.onerror = (ev) => { clearTimeout(timer); w.terminate(); URL.revokeObjectURL(url); resolve("Error: " + ev.message); };
-            w.postMessage(script);
-          } catch (e) { resolve("Error: Worker failed: " + e.message); }
-        });
-      }, [payload.script], tabId);
-
-      if (workerResult !== "__CSP_NEEDS_DOM__") return workerResult;
-      return "Error: CSP blocked all strategies (script needs DOM). Falling back to AppleScript.";
-      };
-
-      try {
-        return await evalStrategies();
-      } catch (err) {
-        // "injection stalled" means the page refuses executeScript in both worlds, so
-        // none of the strategies above can ever reach it. The bridge does not inject.
-        if (!/injection stalled/.test(err?.message || "")) throw err;
-        console.warn("Safari MCP: injection blocked on this page, using content bridge");
-        return await viaBridge();
-      }
+      return await _evaluateOnce(evalTabId, targetTab?.url, payload.script);
     }
 
     // --- Screenshot ---
@@ -3803,20 +3677,21 @@ async function sendContentCommand(tabId, type, payload, timeoutMs = 1500) {
   }
 }
 
-// Every probe plus the content bridge must fit inside the server's 30s command
-// timeout with room to spare: helpers 3 + MAIN 3 + ISOLATED 3 + bridge 10 ≈ 19s.
-// Earlier values (8s each) added up to ~29s and the caller gave up first, so the
-// bridge never got to answer and the tab was never marked as injection-blocked.
+// Every probe must fit inside the server's 30s command timeout with room to spare:
+// helpers 3 + MAIN 3 + ISOLATED 3 ≈ 9s. Earlier values (8s each) added up to ~29s and
+// the caller gave up first. evaluate waits this long for its injection to answer before
+// bringing in the content bridge, within its own EVAL_BUDGET_MS.
 const MAIN_WORLD_INJECT_MS = 3000;
-// Tabs where BOTH injection worlds stalled. Only the first command on such a page pays
-// the probing cost; afterwards we go straight to the content bridge, which keeps these
-// pages fast instead of merely working. Cleared when the tab navigates or closes, so a
-// page that stops blocking injection is re-probed rather than downgraded forever.
+// Tabs where the injected evaluate never answered and the content bridge did. Only the
+// first evaluate on such a page pays that wait; afterwards we go straight to the bridge,
+// which keeps these pages fast instead of merely working. Cleared when the tab navigates
+// or closes, so a page that stops blocking injection is re-probed rather than downgraded
+// forever - and when the injection answers after all (the script was merely slow).
 const _injectionBlockedTabs = new Set();
 // Same fact, keyed by origin: the per-tab set is cleared on every navigation, so a hardened
 // SPA (business.facebook.com) re-paid the ~10s probe on the first evaluate after EACH
 // navigate — 356 evaluates ≥10s in one week. An origin that blocked injection once is sent
-// straight to the bridge for a few hours; a bridge failure clears it and re-probes.
+// straight to the bridge for a few hours; a tab with no bridge clears it and re-probes.
 const _injectionBlockedOrigins = new Map(); // origin → expiry (ms)
 const _INJECTION_BLOCK_TTL_MS = 6 * 60 * 60 * 1000;
 function _originKey(url) {
@@ -4307,31 +4182,264 @@ async function resolveFrameId(tabId, frame) {
   return hits[0].frameId;
 }
 
+// ========== EVALUATE ==========
+// One safari_evaluate starts the caller's script at most once. The old ladder bounded each
+// executeScript at 3s - a bound on the whole run, not on the injection starting - and on
+// expiry started the same script again: in the ISOLATED world, then through the content
+// bridge, whose own 4s fallback started it once more. A script that merely ran longer than
+// 3s ran up to four times, and every POST in it repeated (TOI, 22.9.26: two live duplicate
+// posts; 27.9.26: four drafts from one call). The slow script also filed its origin as
+// injection-blocked, so later calls went bridge-first, hit the bridge's 10s limit and
+// re-probed the whole ladder: more runs.
+//
+// Now the script starts once, in MAIN. Three seconds without an answer only bring in the
+// content bridge under the same runId: in MAIN it JOINS the run the injection started (on
+// business.facebook.com that executeScript answer never arrives), or starts the run when
+// the injection never began. It never starts a second one - see _evalRunner.
+const EVAL_BUDGET_MS = 25000;
+// What executeScript rejects with when it never reached the page. Any other failure may
+// come after the script started (it navigated the page, say), so it is never retried.
+const _EVAL_NOT_STARTED = /does not have access|Invalid call to scripting\.executeScript|Cannot access|Missing host permission|No tab with id/i;
+
+async function _evaluateOnce(tabId, pageUrl, script) {
+  const runId = crypto.randomUUID().replace(/-/g, "");
+  const deadline = Date.now() + EVAL_BUDGET_MS;
+  const origin = _originKey(pageUrl);
+  const setBlocked = (blocked) => {
+    if (blocked) {
+      _injectionBlockedTabs.add(tabId);
+      if (origin) _injectionBlockedOrigins.set(origin, Date.now() + _INJECTION_BLOCK_TTL_MS);
+    } else {
+      _injectionBlockedTabs.delete(tabId);
+      if (origin) _injectionBlockedOrigins.delete(origin);
+    }
+  };
+
+  // Strategy 0: a page known to stall injection goes straight to the bridge. Only a tab with
+  // no bridge listening falls through to injection: once the bridge holds the script, a
+  // failure is final, because the script may have run.
+  if (_injectionBlockedTabs.has(tabId) || (_injectionBlockedOrigins.get(origin) || 0) > Date.now()) {
+    if (await _contentBridgeListening(tabId)) {
+      return _evalOutcome(await _bridgeEval(tabId, runId, script, deadline));
+    }
+    setBlocked(false);
+  }
+
+  let mainAnswered = false;
+  const main = browser.scripting.executeScript({
+    target: { tabId },
+    world: "MAIN",
+    func: _evalRunner,
+    args: [runId, script, EVAL_BUDGET_MS + 5000],
+  }).then((results) => {
+    mainAnswered = true;
+    const first = results && results[0];
+    if (first && first.error) throw new Error(first.error);
+    // Safari hands back no result at all on some CSP pages (LinkedIn); that was, and stays, null.
+    return (first && first.result) || { ok: true, value: null };
+  });
+  const mainReply = main.then((reply) => reply, (err) => ({ failed: String((err && err.message) || err) }));
+
+  const early = await Promise.race([mainReply, sleep(MAIN_WORLD_INJECT_MS).then(() => null)]);
+  if (early && early.failed !== undefined) {
+    throw new Error((_EVAL_NOT_STARTED.test(early.failed)
+      ? "evaluate did not start: "
+      : "evaluate failed after the script may have started (it was not run again): ") + early.failed);
+  }
+  if (early && !early.notRun) return _evalOutcome(early);
+
+  // Slow, answered into the void (business.facebook.com), or never started: the bridge
+  // tells these apart by runId - it joins a run that started and starts one that did not.
+  const bridge = _bridgeEval(tabId, runId, script, deadline);
+  const outcome = await new Promise((resolve) => {
+    let open = 2;
+    const timer = setTimeout(() => resolve(null), Math.max(0, deadline - Date.now()));
+    const take = (reply, fromBridge) => {
+      if (reply && (reply.ok === true || reply.ok === false)) {
+        clearTimeout(timer);
+        resolve({ reply, fromBridge });
+      } else if (--open === 0) {
+        clearTimeout(timer);
+        resolve(null);
+      }
+    };
+    mainReply.then((reply) => take(reply, false));
+    bridge.then((reply) => take(reply, true));
+  });
+  if (outcome && outcome.fromBridge && !mainAnswered) {
+    // Filed as blocked so the next evaluate here goes bridge-first - unless the injection
+    // answers after all: then the script was just slow and the page takes injection fine.
+    setBlocked(true);
+    main.then(() => setBlocked(false), () => {});
+  }
+  if (outcome) return _evalOutcome(outcome.reply);
+  throw new Error("evaluate: the page gave no result within " + EVAL_BUDGET_MS / 1000 + "s. The script was " +
+    "started at most once and may still be running there; it was not run again - check the page before retrying.");
+}
+
+// A reply with `ok` is the script's own outcome: its value, or the error it threw. Anything
+// else means no path produced one.
+function _evalOutcome(reply) {
+  if (reply && reply.ok === true) return reply.value;
+  if (reply && reply.ok === false) {
+    return reply.csp
+      ? "Error: CSP blocked all strategies - the script did not run. Falling back to AppleScript."
+      : "Error: " + reply.error;
+  }
+  throw new Error("evaluate: the content bridge gave no result (" + ((reply && reply.error) || "no answer") +
+    "). The script may have run in the page; it was not run again - check the page before retrying.");
+}
+
+// Hands the evaluate to the content bridge (command-content.js, then content.js in MAIN)
+// under its runId and waits out the evaluate's deadline. Never throws.
+async function _bridgeEval(tabId, runId, script, deadline) {
+  const budgetMs = Math.max(0, deadline - Date.now());
+  let timer;
+  try {
+    const reply = await Promise.race([
+      browser.tabs.sendMessage(tabId, {
+        type: "mcp-content-eval-once",
+        payload: { id: runId, source: script, budgetMs, keepMs: EVAL_BUDGET_MS + 5000 },
+      }),
+      new Promise((resolve) => { timer = setTimeout(() => resolve({ pending: true }), budgetMs); }),
+    ]);
+    return reply && typeof reply === "object" ? reply : { unavailable: true };
+  } catch (err) {
+    return { unavailable: true, error: String((err && err.message) || err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// Whether this tab's command bridge answers at all. A tab opened before the extension
+// loaded has none - the one case where bridge-first may fall back to injection knowing
+// the script cannot have started.
+async function _contentBridgeListening(tabId) {
+  let timer;
+  try {
+    const answer = await Promise.race([
+      browser.tabs.sendMessage(tabId, { type: "mcp-content-ping" }),
+      new Promise((resolve) => { timer = setTimeout(resolve, 1500); }),
+    ]);
+    return answer === true;
+  } catch (_) {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// Runs one evaluate in the page's MAIN world, at most once per runId. Every path that can
+// start the script shares the runId and claims it first: this injected runner, the bridge
+// in content.js (also MAIN) and command-content.js's ISOLATED fallback. A claim is a
+// document listener cancelling the event "__mcp_claim_<runId>", so a cancelled dispatch
+// means some world already holds the run: DOM events cross the MAIN/ISOLATED boundary
+// synchronously, window properties do not. Within MAIN the run's promise also stays on
+// window for keepMs, so the bridge can join a run whose executeScript answer never
+// arrives. Self-contained: Safari serialises it into the page.
+async function _evalRunner(runId, script, keepMs) {
+  const key = "__mcp_run_" + runId;
+  if (window[key]) return window[key];
+  const claim = "__mcp_claim_" + runId;
+  if (!document.dispatchEvent(new Event(claim, { cancelable: true }))) return { notRun: true };
+  document.addEventListener(claim, (e) => e.preventDefault());
+  const text = (v) => (v === undefined || v === null ? null : typeof v === "object" ? JSON.stringify(v) : String(v));
+  const fail = (e) => ({ ok: false, error: String((e && e.message) || e) });
+  const run = (async () => {
+    // Strategy 1: indirect eval, where the page's CSP allows unsafe-eval. The "0" probe tells
+    // a refused eval (nothing ran) from a script that throws by itself: that one ran, and
+    // must not run again through a later strategy.
+    let evalAllowed = true;
+    try { (0, eval)("0"); } catch (_) { evalAllowed = false; }
+    if (evalAllowed) {
+      try { return { ok: true, value: text(await (0, eval)(script)) }; } catch (e) { return fail(e); }
+    }
+    // Strategy 2: an inline <script>, for pages that refuse eval but accept the Trusted Types
+    // policy content.js registered at document_start, or the page's own nonce: a nonce-based
+    // script-src runs nothing else (facebook.com allowed 'unsafe-eval' on 2026-08-23, no longer
+    // on 2026-09-27). An inline script runs inside appendChild, so by the next line the hook has
+    // started it, or nothing ran. It goes in as an expression first, so `document.title`
+    // answers as through eval; a statement list is a SyntaxError there, which runs nothing,
+    // and then goes in as a function body, where only `return` yields a value.
+    const hook = key + "_start";
+    let started = null;
+    window[hook] = (fn) => { started = (async () => fn())(); };
+    let policy = window.__mcpTrustedPolicy;
+    if (!(policy && typeof policy.createScript === "function") && window.trustedTypes && window.trustedTypes.createPolicy) {
+      try { policy = window.trustedTypes.createPolicy("mcpEval_" + runId, { createScript: (c) => c }); } catch (_) { policy = null; }
+    }
+    const nonced = document.querySelector("script[nonce]");
+    for (const body of ["return (" + script.replace(/[\s;]+$/, "") + "\n);", script]) {
+      try {
+        const code = "window[" + JSON.stringify(hook) + "](function(){" + body + "\n})";
+        const s = document.createElement("script");
+        try { s.textContent = policy ? policy.createScript(code) : code; } catch (_) { s.textContent = code; }
+        if (nonced && nonced.nonce) s.nonce = nonced.nonce;
+        document.documentElement.appendChild(s);
+        s.remove();
+      } catch (_) {
+        // Trusted Types refused the plain string: the script did not start.
+      }
+      if (started) break;
+    }
+    delete window[hook];
+    if (started) {
+      try { return { ok: true, value: text(await started) }; } catch (e) { return fail(e); }
+    }
+    // Strategy 3: a Worker has its own CSP context - pure computation only, no DOM. A worker
+    // that cannot start, or whose eval is refused too, ran nothing: say so ({csp}), so the
+    // caller may still try AppleScript. Its script's own errors are only reported.
+    if (/\b(document|window|querySelector|getElementById|innerHTML|textContent|style|className)\b/.test(script)) {
+      return { ok: false, csp: true };
+    }
+    return await new Promise((resolve) => {
+      try {
+        const src = 'self.onmessage=function(e){try{(0,self["ev"+"al"])("0")}catch(err){self.postMessage({csp:true});return}try{var r=(0,self["ev"+"al"])(e.data);self.postMessage({ok:true,r:typeof r==="object"?JSON.stringify(r):String(r!=null?r:"null")})}catch(err){self.postMessage({ok:false,e:err.message})}};';
+        const url = URL.createObjectURL(new Blob([src], { type: "application/javascript" }));
+        const w = new Worker(url);
+        const end = (reply) => { clearTimeout(timer); w.terminate(); URL.revokeObjectURL(url); resolve(reply); };
+        const timer = setTimeout(() => end({ ok: false, error: "Worker timeout" }), 10000);
+        w.onmessage = (ev) => end(ev.data.csp ? { ok: false, csp: true }
+          : ev.data.ok ? { ok: true, value: ev.data.r } : { ok: false, error: ev.data.e });
+        w.onerror = () => end({ ok: false, csp: true });
+        w.postMessage(script);
+      } catch (_) {
+        resolve({ ok: false, csp: true });
+      }
+    });
+  })();
+  Object.defineProperty(window, key, { value: run, configurable: true });
+  setTimeout(() => { delete window[key]; }, keepMs);
+  return run;
+}
+
 // Run one script inside a single frame. MAIN world first so the script sees the
 // page's own globals; ISOLATED as the fallback for frames whose CSP blocks eval —
 // it still reads and mutates the DOM, which is what clicking and filling need.
 async function evaluateInFrame(tabId, frameId, script) {
   const id = tabId || (await getActiveTab()).id;
   const runner = async (src) => {
+    // Only a refused eval moves on to ISOLATED: it ran nothing. A script that throws by
+    // itself - even a CSP error from an eval of its own - ran, and must not run again.
+    try { (0, eval)("0"); } catch (_) { return "__CSP_BLOCKED__"; }
     try {
       const result = await (0, eval)(src);
       if (result === undefined || result === null) return null;
       return typeof result === "object" ? JSON.stringify(result) : String(result);
     } catch (e) {
-      const m = String(e && e.message);
-      if (m.includes("unsafe-eval") || m.includes("trusted-types") || m.includes("Trusted Type")) {
-        return "__CSP_BLOCKED__";
-      }
-      return "Error: " + m;
+      return "Error: " + String(e && e.message);
     }
   };
   const run = async (world) => {
+    // Bounded by the evaluate's budget, not the 3s injection probe: a slow script is
+    // still running, and giving up on it early only invited a retry.
     const results = await _withInjectionDeadline(browser.scripting.executeScript({
       target: { tabId: id, frameIds: [frameId] },
       world,
       func: runner,
       args: [script],
-    }));
+    }), EVAL_BUDGET_MS, "evaluate in frame: no result within " + EVAL_BUDGET_MS / 1000 +
+      "s - the script may still be running; it was not run again");
     const first = results[0];
     if (first && first.error) throw new Error(first.error);
     return first && first.result;

package/extension/command-content.js

@@ -479,17 +479,24 @@ _initializeMcpKeepalive();
       sendResponse(handleFill(message.payload || {}));
       return true;
     }
-    // Last-resort path for evaluate. On hardened SPAs (business.facebook.com) BOTH
-    // scripting.executeScript worlds hang forever instead of rejecting, while this
-    // already-injected listener keeps answering — clicks kept working there the whole
-    // time. Nothing is injected here, so there is no injection to stall on.
-    if (message.type === "mcp-content-eval") {
-      // The relayed function is often async (the evaluate handler awaits inside it), so
-      // this must resolve before answering — returning the promise itself serialised to
-      // "{}" and silently produced an empty result.
+    // Last-resort path for evaluate. On hardened SPAs (business.facebook.com) the
+    // scripting.executeScript answer never arrives, while this already-injected listener
+    // keeps answering — clicks kept working there the whole time. Nothing is injected
+    // here, so there is no injection to stall on. The type is new with the runId
+    // protocol: a bridge left over from an older build must not take these, because it
+    // would start the script without checking the claim.
+    if (message.type === "mcp-content-eval-once") {
+      // The script is often async, so this must resolve before answering — returning the
+      // promise itself serialised to "{}" and silently produced an empty result.
       handleEval(message.payload || {}).then(sendResponse);
       return true;
     }
+    // Lets the background tell "no bridge in this tab" (nothing can have run) from a
+    // bridge that took an evaluate and then failed (the script may have run).
+    if (message.type === "mcp-content-ping") {
+      sendResponse(true);
+      return true;
+    }
     return false;
   };
 
@@ -505,39 +512,42 @@ _initializeMcpKeepalive();
 // governs eval here, and a hardened page (business.facebook.com) forbids it — an
 // earlier attempt with new Function() died exactly there. content.js is already in
 // MAIN world from document_start and holds a grandfathered Trusted Types policy, so
-// hand the work to it over a CustomEvent and wait for its reply.
+// hand the work to it and wait for its reply. The id is the evaluate's runId: content.js
+// joins a run the injected runner already started instead of starting it again.
 function handleEval(payload) {
   return new Promise((resolve) => {
-    const id = "b" + Math.random().toString(36).slice(2) + Date.now().toString(36);
+    const id = String(payload.id || "");
+    const source = String(payload.source || "");
     let settled = false;
     const finish = (result) => {
       if (settled) return;
       settled = true;
       window.removeEventListener("message", onReply);
-      clearTimeout(timer);
+      clearTimeout(fallback);
+      clearTimeout(bound);
       resolve(result);
     };
     function onReply(ev) {
       if (ev.source !== window) return;
       const d = ev.data;
-      if (!d || d.__mcp !== "eval_res" || d.id !== id) return;
+      if (!d || d.__mcp !== "eval_once_res" || d.id !== id) return;
       finish(d.result && typeof d.result === "object"
         ? d.result
         : { ok: false, error: "malformed bridge reply" });
     }
-    // Bounded independently of the background's own deadline, so a page that never
-    // answers cannot hold the command open. If MAIN never replies (its listener failed
-    // to install, or the page tore it out), try here: a content script is governed by
-    // the PAGE's CSP, and the pages this bridge targets do allow 'unsafe-eval'.
-    const timer = setTimeout(() => {
-      let out;
-      try {
-        out = (0, eval)(String(payload.source || ""));
-      } catch (err) {
-        finish({ ok: false, error: "eval bridge did not answer; isolated retry: " + ((err && err.message) || err) });
+    // No reply means no content.js in MAIN — the manifest leaves it out of LinkedIn, X and
+    // the Google apps — so after 4s the script runs here, under the PAGE's CSP. Unless a
+    // world already claimed the runId: that run is under way, and its answer comes from
+    // content.js or from the injected runner, never from a second start.
+    const fallback = setTimeout(() => {
+      const claim = "__mcp_claim_" + id;
+      if (!document.dispatchEvent(new Event(claim, { cancelable: true }))) return;
+      document.addEventListener(claim, (e) => e.preventDefault());
+      try { (0, eval)("0"); } catch (_) {
+        finish({ ok: false, csp: true, error: "eval is blocked by the page's CSP" });
         return;
       }
-      Promise.resolve(out).then(
+      (async () => (0, eval)(source))().then(
         (v) => {
           if (v === undefined || v === null) return finish({ ok: true, value: null });
           if (typeof v === "object") {
@@ -549,14 +559,12 @@ function handleEval(payload) {
         (err) => finish({ ok: false, error: (err && err.message) || String(err) })
       );
     }, 4000);
+    // The background has stopped waiting by now; free the listener without an answer.
+    const bound = setTimeout(() => finish({ pending: true }), (Number(payload.budgetMs) || 25000) + 1000);
     // postMessage, not CustomEvent: a CustomEvent's detail arrives as null in the MAIN
     // world, so the listener there fired with nothing to run.
     window.addEventListener("message", onReply);
-    try {
-      window.postMessage({ __mcp: "eval_req", id, source: String(payload.source || "") }, "*");
-    } catch (err) {
-      finish({ ok: false, error: (err && err.message) || String(err) });
-    }
+    window.postMessage({ __mcp: "eval_once", id, source, keepMs: payload.keepMs }, "*");
   });
 }
 

package/extension/content.js

@@ -10,16 +10,23 @@
 // so CSP cannot block it.
 
 // Last-resort evaluate path for pages that stall scripting.executeScript outright
-// (business.facebook.com: BOTH worlds hang forever instead of rejecting, so every
-// evaluate strategy above them dies on the caller's timeout).
+// (business.facebook.com: the injected evaluate never answers, so every evaluate died on
+// the caller's timeout).
 //
 // This script is ALREADY in MAIN world from document_start, so nothing has to be
 // injected to reach the page — that is the whole point. command-content.js lives in
 // the ISOLATED world where it can talk to the background but where the page's CSP
-// forbids eval; it hands the work here over a CustomEvent, and we run it through the
+// forbids eval; it hands the work here over postMessage, and we run it through the
 // same grandfathered Trusted Types policy the injected strategy uses.
-if (!window.__mcpEvalBridge) {
-  window.__mcpEvalBridge = true;
+//
+// Each request carries the evaluate's runId, and a run starts at most once per runId
+// (see _evalRunner in background.js): if the injected runner already started it in this
+// world we join its promise, if another world claimed it we stay out, else we claim it.
+// The message tags and the guard below are new with that protocol, so a listener left
+// over from an older build — which would start the script without looking — never sees
+// these requests.
+if (!window.__mcpEvalOnceBridge) {
+  window.__mcpEvalOnceBridge = true;
   // window.postMessage, not CustomEvent: a CustomEvent's `detail` does not survive the
   // ISOLATED→MAIN world boundary (it arrives as null), so the bridge received the event
   // but never the script — it simply timed out. postMessage is structured-cloned across
@@ -27,88 +34,67 @@ if (!window.__mcpEvalBridge) {
   window.addEventListener("message", function (ev) {
     if (ev.source !== window) return;                       // ignore other frames
     var d = ev.data;
-    if (!d || d.__mcp !== "eval_req" || typeof d.id !== "string") return;
+    if (!d || d.__mcp !== "eval_once" || typeof d.id !== "string") return;
     var id = d.id;
-    var outKey = "__mcp_eval_out_" + id;
-    var answered = false;
-    var reply = function (detail) {
-      if (answered) return;
-      answered = true;
-      try { delete window[outKey]; } catch (_e) {}
-      window.postMessage({ __mcp: "eval_res", id: id, result: detail }, "*");
+    var key = "__mcp_run_" + id;
+    var reply = function (result) {
+      window.postMessage({ __mcp: "eval_once_res", id: id, result: result }, "*");
     };
-    var settle = function (v) {
-      if (v === undefined || v === null) { reply({ ok: true, value: null }); return; }
-      if (typeof v === "object") {
-        try { reply({ ok: true, value: JSON.stringify(v) }); }
-        catch (_e) { reply({ ok: true, value: String(v) }); }
-      } else {
-        reply({ ok: true, value: String(v) });
-      }
+    if (window[key]) { window[key].then(reply); return; }
+    var claim = "__mcp_claim_" + id;
+    if (!document.dispatchEvent(new Event(claim, { cancelable: true }))) return;
+    document.addEventListener(claim, function (e) { e.preventDefault(); });
+    var source = String(d.source);
+    var text = function (v) {
+      return v === undefined || v === null ? null : typeof v === "object" ? JSON.stringify(v) : String(v);
     };
-
-    // Direct eval first. We are in MAIN world, so this runs under the PAGE's CSP —
-    // and business.facebook.com actually allows 'unsafe-eval'. Its script-src does
-    // carry a nonce, which is precisely what blocks the injected-<script> path below,
-    // so trying that first would fail on the very page this bridge exists for.
-    try {
-      var direct = (0, eval)(String(d.source));
-      if (direct && typeof direct.then === "function") {
-        direct.then(settle, function (e) { reply({ ok: false, error: String((e && e.message) || e) }); });
-      } else {
-        settle(direct);
+    var fail = function (e) { return { ok: false, error: String((e && e.message) || e) }; };
+    var run = (async function () {
+      // Direct eval first. We are in MAIN world, so this runs under the PAGE's CSP —
+      // and business.facebook.com actually allows 'unsafe-eval'. Its script-src does
+      // carry a nonce, which is precisely what blocks the injected-<script> path below,
+      // so trying that first would fail on the very page this bridge exists for. The
+      // "0" probe tells a refused eval (nothing ran) from a script that throws by
+      // itself: that one ran, and must not run again through the <script> path.
+      var evalAllowed = true;
+      try { (0, eval)("0"); } catch (_e) { evalAllowed = false; }
+      if (evalAllowed) {
+        try { return { ok: true, value: text(await (0, eval)(source)) }; } catch (e) { return fail(e); }
       }
-      return;
-    } catch (evalErr) {
-      var m = String((evalErr && evalErr.message) || evalErr);
-      // A real script error must surface as-is; only a CSP refusal justifies the
-      // slower injected path.
-      if (!/unsafe-eval|Content Security Policy|trusted-types|Trusted Type/i.test(m)) {
-        reply({ ok: false, error: m });
-        return;
-      }
-    }
-
-    try {
-      var code =
-        "try{var __r=(function(){" + String(d.source) + "})();" +
-        "if(__r&&typeof __r.then==='function'){__r.then(function(v){window['" + outKey + "']={done:true,v:v};}," +
-        "function(e){window['" + outKey + "']={done:true,e:String((e&&e.message)||e)};});}" +
-        "else{window['" + outKey + "']={done:true,v:__r};}}" +
-        "catch(e){window['" + outKey + "']={done:true,e:String((e&&e.message)||e)};}";
-      var s = document.createElement("script");
-      if (window.__mcpTrustedPolicy && typeof window.__mcpTrustedPolicy.createScript === "function") {
-        try { s.textContent = window.__mcpTrustedPolicy.createScript(code); }
-        catch (_e) { s.textContent = code; }
-      } else {
-        s.textContent = code;
-      }
-      document.documentElement.appendChild(s);
-      s.remove();
-      var tries = 0;
-      var poll = function () {
-        var r = window[outKey];
-        if (r && r.done) {
-          if (r.e) { reply({ ok: false, error: r.e }); return; }
-          var v = r.v;
-          if (v === undefined || v === null) { reply({ ok: true, value: null }); return; }
-          // Serialise here: a CustomEvent detail crossing into the ISOLATED world must
-          // survive structured clone, and page objects (DOM nodes, class instances) do not.
-          if (typeof v === "object") {
-            try { reply({ ok: true, value: JSON.stringify(v) }); }
-            catch (_e) { reply({ ok: true, value: String(v) }); }
+      // An inline script runs inside appendChild, so by the next line the hook has
+      // started it — or nothing ran. A nonce-based script-src (facebook.com, since it no
+      // longer allows 'unsafe-eval') takes it only with the page's nonce. It goes in as an
+      // expression first, so `document.title` answers as through eval; a statement list
+      // is a SyntaxError there, which runs nothing, and then goes in as a function body.
+      var hook = key + "_start";
+      var started = null;
+      window[hook] = function (fn) { started = (async function () { return fn(); })(); };
+      var nonced = document.querySelector("script[nonce]");
+      var bodies = ["return (" + source.replace(/[\s;]+$/, "") + "\n);", source];
+      for (var i = 0; i < bodies.length && !started; i++) {
+        try {
+          var code = "window[" + JSON.stringify(hook) + "](function(){" + bodies[i] + "\n})";
+          var s = document.createElement("script");
+          if (window.__mcpTrustedPolicy && typeof window.__mcpTrustedPolicy.createScript === "function") {
+            try { s.textContent = window.__mcpTrustedPolicy.createScript(code); }
+            catch (_e) { s.textContent = code; }
           } else {
-            reply({ ok: true, value: String(v) });
+            s.textContent = code;
           }
-          return;
+          if (nonced && nonced.nonce) s.nonce = nonced.nonce;
+          document.documentElement.appendChild(s);
+          s.remove();
+        } catch (_e) {
+          // Trusted Types refused the plain string: the script did not start.
         }
-        if (++tries > 160) { reply({ ok: false, error: "eval bridge timeout" }); return; }
-        setTimeout(poll, 50);
-      };
-      poll();
-    } catch (e) {
-      reply({ ok: false, error: String((e && e.message) || e) });
-    }
+      }
+      delete window[hook];
+      if (!started) return { ok: false, csp: true, error: "the page's CSP blocks eval and inline scripts" };
+      try { return { ok: true, value: text(await started) }; } catch (e) { return fail(e); }
+    })();
+    Object.defineProperty(window, key, { value: run, configurable: true });
+    setTimeout(function () { delete window[key]; }, d.keepMs || 30000);
+    run.then(reply);
   });
 }
 

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.24",
+  "version": "2.10.25",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/index.js

@@ -708,6 +708,14 @@ function _releaseContentWakePolls() {
   for (const finish of [..._contentWakePolls]) finish();
 }
 
+// Open GET /poll long-polls, each a check() that answers its request if it can. Woken when a
+// command is queued or the active worker changes — the 5ms setInterval they replace kept both
+// daemons at ~200 wake-ups a second while idle.
+const _httpPollWaiters = new Set();
+function _wakeHttpPolls() {
+  for (const check of [..._httpPollWaiters]) check();
+}
+
 function _setContentWakeCors(req, res) {
   const origin = typeof req.headers.origin === "string" ? req.headers.origin : "";
   res.setHeader("Access-Control-Allow-Origin", origin || "*");
@@ -893,34 +901,32 @@ try {
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(queuedCommand));
       } else {
-        // Long-poll: wait up to 5 seconds for a command
-        const timer = setTimeout(() => {
-          res.writeHead(204);
-          res.end();
-        }, 5000);
-
-        const checkInterval = setInterval(() => {
+        // Long-poll: wait up to 5 seconds for a command; _wakeHttpPolls() runs check().
+        const check = () => {
           if (pollingWorkerId !== _activeHttpWorkerId) {
-            clearTimeout(timer);
-            clearInterval(checkInterval);
+            done();
             res.writeHead(423);
             res.end("Worker superseded");
             return;
           }
           const cmd = _dequeueHttpCommand(pollingWorkerId);
           if (cmd) {
-            clearTimeout(timer);
-            clearInterval(checkInterval);
+            done();
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify(cmd));
           }
-        }, 5); // Check every 5ms (reduced from 20ms — cuts avg command delivery delay from 10ms to 2.5ms)
-
-        // Cleanup on client disconnect
-        req.on("close", () => {
+        };
+        const timer = setTimeout(() => {
+          done();
+          res.writeHead(204);
+          res.end();
+        }, 5000);
+        const done = () => {
           clearTimeout(timer);
-          clearInterval(checkInterval);
-        });
+          _httpPollWaiters.delete(check);
+        };
+        _httpPollWaiters.add(check);
+        req.on("close", done); // client went away
       }
       return;
     }
@@ -1003,6 +1009,7 @@ try {
         if (workerChanged) {
           _adoptReloadHandoff(workerId);
           _extensionConnectionGeneration += 1;
+          _wakeHttpPolls(); // the superseded worker's open poll answers 423 now
         }
         if (!_extensionConnected) {
           _extensionConnected = true;
@@ -1062,7 +1069,10 @@ try {
       const workerChanged = workerId !== _activeHttpWorkerId;
       _activeHttpWorkerId = workerId;
       _connectingHttpWorkers.delete(workerId);
-      if (workerChanged) _adoptReloadHandoff(workerId);
+      if (workerChanged) {
+        _adoptReloadHandoff(workerId);
+        _wakeHttpPolls();
+      }
       _profileExtensionVerified = true;
       ledgerNoteVerified(_workerLedger, workerId);
       if (workerChanged) _extensionConnectionGeneration += 1;
@@ -1216,7 +1226,7 @@ try {
           res.end(JSON.stringify({ result }));
         } catch (err) {
           res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: err.message }));
+          res.end(JSON.stringify({ error: err.message, dispatched: err.dispatched }));
         }
       });
       return;
@@ -1318,7 +1328,7 @@ async function _proxyToExtension(type, payload, timeoutMs = 30000) {
   });
   if (!res.ok) throw new Error(`Proxy error: ${res.status}`);
   const data = await res.json();
-  if (data.error) throw new Error(data.error);
+  if (data.error) throw Object.assign(new Error(data.error), { dispatched: data.dispatched });
   return data.result;
 }
 
@@ -1357,6 +1367,7 @@ const _staleHttpTimer = setInterval(() => {
       _activeHttpWorkerId = "";
       _connectingHttpWorkers.clear();
       _reloadHttpWorkerHandoff = null;
+      _wakeHttpPolls();
       _drainOnDisconnect("HTTP poll timeout");
       console.error("[Safari MCP] Extension disconnected (HTTP poll timeout)");
     }
@@ -1374,6 +1385,7 @@ function _dropWedgedHttpWorker(reason) {
   _activeHttpWorkerId = "";
   _connectingHttpWorkers.clear();
   _reloadHttpWorkerHandoff = null;
+  _wakeHttpPolls();
   _drainOnDisconnect(`wedged worker: ${reason}`);
   console.error(`[Safari MCP] Extension worker dropped as wedged (${reason})`);
 }
@@ -1390,10 +1402,11 @@ function _drainOnDisconnect(reason) {
     return;
   }
   // Reject all in-flight requests immediately (instead of waiting for timeout)
+  const queued = new Set(_commandQueue.map((c) => c.id));
   for (const [id, pending] of _pendingRequests) {
     clearTimeout(pending.timer);
     if (pending.reloadHandoff) _cancelReloadHttpWorkerHandoff(pending.reloadHandoff);
-    pending.reject(new Error(`Extension disconnected: ${reason}`));
+    pending.reject(Object.assign(new Error(`Extension disconnected: ${reason}`), { dispatched: !queued.has(id) }));
   }
   _pendingRequests.clear();
   // Clear queued commands that will never be picked up
@@ -1433,7 +1446,40 @@ function _handleExtensionResponse(msg, respondingWorkerId = "") {
 }
 
 // Send command to extension (via WebSocket, HTTP command queue, or proxy to primary)
+// Thermal backpressure (opt-in). With SAFARI_MCP_THERMAL_FILE naming a JSON file whose `_t` is the chip
+// temperature and `_ts` its epoch seconds (e.g. a thermal monitor's latest sample), page-work commands wait
+// while the chip is at or above SAFARI_MCP_THERMAL_MAX (default 80) — until it is 2° cooler, at most
+// SAFARI_MCP_THERMAL_WAIT_MS (default 20000) — so many agents in many tabs slow down instead of heating the
+// Mac. Closing and listing tabs never wait; a stale or missing reading holds nothing.
+const _THERMAL_FILE = process.env.SAFARI_MCP_THERMAL_FILE || "";
+const _THERMAL_MAX = parseFloat(process.env.SAFARI_MCP_THERMAL_MAX || "80");
+const _THERMAL_WAIT_MS = parseInt(process.env.SAFARI_MCP_THERMAL_WAIT_MS || "20000", 10);
+const _THERMAL_FREE = new Set(["close_tab", "list_tabs", "get_tab_receipt", "get_tab_locus", "switch_tab", "reload_extension"]);
+
+function _chipTemp() {
+  try {
+    const row = JSON.parse(readFileSync(_THERMAL_FILE, "utf8"));
+    return Date.now() / 1000 - row._ts <= 15 ? Number(row._t) || 0 : 0;
+  } catch {
+    return 0;
+  }
+}
+
+async function _thermalGate(type) {
+  if (!_THERMAL_FILE || _THERMAL_FREE.has(type) || _chipTemp() < _THERMAL_MAX) return;
+  console.error(`[Safari MCP] chip at ${Math.round(_chipTemp())}°C — holding "${type}" up to ${_THERMAL_WAIT_MS / 1000}s so the Mac can cool`);
+  const until = Date.now() + _THERMAL_WAIT_MS;
+  while (Date.now() < until && _chipTemp() >= _THERMAL_MAX - 2) {
+    await new Promise((r) => setTimeout(r, 1000));
+  }
+}
+
 function sendToExtension(type, payload = {}, timeoutMs = 30000) {
+  if (!_THERMAL_FILE || _THERMAL_FREE.has(type)) return _sendToExtension(type, payload, timeoutMs);
+  return _thermalGate(type).then(() => _sendToExtension(type, payload, timeoutMs));
+}
+
+function _sendToExtension(type, payload = {}, timeoutMs = 30000) {
   // If we're a secondary instance, proxy through primary
   if (!_isExtensionHost && _primaryHasExtension) {
     return _proxyToExtension(type, payload, timeoutMs);
@@ -1441,7 +1487,7 @@ function sendToExtension(type, payload = {}, timeoutMs = 30000) {
 
   return new Promise((resolve, reject) => {
     if (!_extensionConnected) {
-      reject(new Error("Extension not connected"));
+      reject(Object.assign(new Error("Extension not connected"), { dispatched: false }));
       return;
     }
     const reloadHandoff = type === "reload_extension" &&
@@ -1467,7 +1513,8 @@ function sendToExtension(type, payload = {}, timeoutMs = 30000) {
       // long after the caller gave up and run a stale navigate/click out of band.
       const qi = _commandQueue.findIndex(c => c.id === id);
       if (qi >= 0) _commandQueue.splice(qi, 1);
-      reject(new Error(`Extension timeout after ${timeoutMs}ms`));
+      // Still queued = never polled, so nothing ran; callers may retry elsewhere only then.
+      reject(Object.assign(new Error(`Extension timeout after ${timeoutMs}ms`), { dispatched: qi < 0 }));
       // The worker took this command and never answered, even past the hard ceiling: it is
       // wedged (see /heartbeat). Drop its lease now instead of waiting for the stale timer,
       // so a fresh worker — or Safari re-spawning this one — can connect at once.
@@ -1497,6 +1544,7 @@ function sendToExtension(type, payload = {}, timeoutMs = 30000) {
     } else {
       // Otherwise, queue for HTTP polling
       _commandQueue.push(command);
+      _wakeHttpPolls();
       _releaseContentWakePolls();
     }
   });
@@ -2098,7 +2146,9 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
         // marker's text promises never actually ran and its text reached the caller as
         // the tool's value instead of as a failure (#106).
         hardCspBlock = typeof result === 'string' && result.includes('CSP blocked all strategies');
-        const isCspError = hardCspBlock || (typeof result === 'string' && (result.includes('unsafe-eval') || result.includes('trusted-types') || result.includes('Trusted Type') || result.includes('Content Security Policy')));
+        // An evaluate reports "nothing ran" through that marker alone. Other CSP wording in
+        // its result is the script's own error: it ran, and AppleScript must not run it again.
+        const isCspError = hardCspBlock || (extensionType !== "evaluate" && typeof result === 'string' && (result.includes('unsafe-eval') || result.includes('trusted-types') || result.includes('Trusted Type') || result.includes('Content Security Policy')));
         const isPermissionDenied = typeof result === 'string' && result.includes('__SCREENSHOT_PERMISSION_DENIED__');
         const isElementMiss = typeof result === 'string' && result.startsWith('Element not found');
         const isFailed = result === null || isElementMiss;
@@ -2134,6 +2184,12 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
           throw err;
         }
         if (_preferAppleScript) throw new Error(`Safari profile extension unavailable for "${extensionType}": ${err.message}`);
+        // evaluate runs arbitrary side effects. Once the extension may have started the
+        // script — the command reached it and did not come back with "did not start" —
+        // AppleScript would run it a second time: every POST in it repeated.
+        if (extensionType === "evaluate" && err?.dispatched !== false && !/evaluate did not start/.test(err.message)) {
+          throw new Error(`safari_evaluate: ${err.message} — the script may already have run in the page, so it was not re-run through AppleScript`, { cause: err });
+        }
         console.error(`[Safari MCP] ${extensionType} extension failed: ${err.message} — falling back to AppleScript`);
       }
     }
@@ -2204,6 +2260,11 @@ server.tool(
     receipt: z.string().optional().describe("Tab receipt from safari_new_tab — pins this call to that tab (survives reconnects/subagents)"),
   },
   async ({ url, receipt }) => {
+    // The profile extension can only issue receipts for http(s) pages: after a trip to
+    // about:blank or file:// no tool could reach the tab again, not even to close it.
+    if (process.env.SAFARI_PROFILE && !/^https?:\/\//i.test(url.trim())) {
+      throw new Error(`safari_navigate only opens http(s) URLs in a Safari profile ("${url.slice(0, 40)}" would leave the tab unreachable). To free the tab, use safari_close_tab.`);
+    }
     const oldUrl = safari.getActiveTabURL();
     // Pre-register the destination as owned BEFORE navigating. We are navigating OUR
     // tab, so the target URL is ours even if navigate() throws mid-load on a slow SPA.
@@ -3158,10 +3219,15 @@ server.tool(
 server.tool(
   "safari_eval_file",
   "Execute JavaScript read from a FILE path (avoids passing huge scripts inline / manual copy). Same engine as safari_evaluate: extension-first (no focus steal), AppleScript fallback. Use to upload binary via a generated .js containing base64.",
-  { path: z.string().describe("Absolute path to a .js file whose contents are the script to execute") },
+  {
+    path: z.string().describe("Absolute path to a .js file whose contents are the script to execute"),
+    receipt: z.string().optional().describe("Opaque extension-issued tab receipt — pass the one safari_new_tab returned to keep targeting that tab after an MCP reconnect"),
+  },
   async (args) => {
     const script = readFileSync(args.path, "utf8");
-    const result = await extensionOrFallback("evaluate", { script }, () => safari.evaluate({ script }));
+    const result = await extensionOrFallback(
+      "evaluate", { script, ..._explicitReceipt(args) }, () => safari.evaluate({ script })
+    );
     return evalResult(result);
   }
 );
@@ -4057,7 +4123,9 @@ try {
 } catch { /* banner is best-effort, never block startup */ }
 }
 
-_startMemoryMonitor();
+// Under a profile the monitor can only log: _closeOldestMCPTab() refuses to touch profile tabs, and
+// its RSS reading hides compressed/swapped pages (433MB of RSS against 6.8GB of footprint, 27.9).
+if (!process.env.SAFARI_PROFILE) _startMemoryMonitor();
 
 // Runtime guard for the silent stale-identity regression (#29): postinstall re-signs the
 // helper to a stable id so the Accessibility grant persists, but `npm ci`, `--ignore-scripts`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.21.14",
+  "version": "2.22.0",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents \u2014 native macOS, zero Chrome overhead. 98 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -198,10 +198,16 @@ process.on("unhandledRejection", (reason) => {
 
 // ========== SAFARI RUNNING CHECK ==========
 // Prevent AppleScript from auto-launching Safari when it's closed
+// ponytail: a "running" answer is reused for 1s — AppleScript waits poll every 100–200ms and each
+// call spawned a pgrep. Ceiling: a Safari quit inside that second can let one script relaunch it.
+let _safariRunningUntil = 0;
 async function isSafariRunning() {
+  if (Date.now() < _safariRunningUntil) return true;
   try {
     const { stdout } = await execFileAsync("pgrep", ["-x", "Safari"], { timeout: 2000 });
-    return stdout.trim().length > 0;
+    const running = stdout.trim().length > 0;
+    if (running) _safariRunningUntil = Date.now() + 1000;
+    return running;
   } catch {
     return false; // pgrep exits 1 when no match
   }
@@ -413,14 +419,17 @@ function _maybeOpenProfileWindow() {
 
 // Background verification: periodically check that cached window ID still belongs to profile
 if (SAFARI_PROFILE) {
-  // Self-scheduling poll with exponential backoff (#81): 3s while the window is
+  // Self-scheduling poll with exponential backoff (#81): 15s while the window is
   // present (or flakily undetected), doubling per consecutive miss up to 60s
   // while it is absent — a closed profile window is a steady state, and the
   // fixed 3s cadence used to spawn an osascript subprocess per cycle, forever.
-  // The first successful detection resets to 3s, so rediscovery stays
+  // The first successful detection resets to 15s, so rediscovery stays
   // responsive: once the user opens the window, the next poll lands within 60s
-  // and everything after it is back on the 3s cadence.
-  const _POLL_BASE_MS = 3000;
+  // and everything after it is back on the 15s cadence. This poll is only the
+  // background self-heal: every AppleScript caller re-validates the window itself
+  // (refreshTargetWindow, 1s cache), so 3s cost a pgrep + an Apple Event to
+  // Safari every 3 seconds per daemon for nothing.
+  const _POLL_BASE_MS = 15000;
   const _POLL_MAX_MS = 60000;
   const _pollOnce = async () => {
     // No cached window (e.g. flaky detection at startup) — keep trying to
@@ -4114,10 +4123,12 @@ export function _buildEvalExpr(js) {
         expr = `(async function(){${js}})()`;
       }
     } else {
-      // Indirect eval yields the completion value of an arbitrary statement list;
-      // the catch re-runs the body plainly when a strict CSP blocks eval.
+      // Indirect eval yields the completion value of an arbitrary statement list. The
+      // plain body is the fallback for a strict CSP that refuses eval — probed with "0",
+      // so a script that threw by itself (it ran) is not run a second time.
       const escaped = js.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\n/g, '\\n').replace(/\r/g, '\\r');
-      expr = "(function(){ try { return (0,eval)('" + escaped + "') } catch(_e) { " + js.replace(/\n/g, ' ') + " } })()";
+      expr = "(function(){ var __mcpEvalOk = true; try { (0,eval)('0') } catch(_e) { __mcpEvalOk = false } " +
+        "if (__mcpEvalOk) return (0,eval)('" + escaped + "'); " + js.replace(/\n/g, ' ') + " })()";
     }
   }
   return { isAsync, expr };
@@ -4127,24 +4138,35 @@ export function _buildEvalExpr(js) {
 // the moment the synchronous portion finishes, handing back an unsettled Promise.
 // So the work is started fire-and-forget into a page global, then that global is
 // polled synchronously from the Node side (the same pattern navigate() uses).
+//
+// Token is identifier-safe (base36 → [0-9a-z], `_` prefix) so `window.<token>`
+// dot access needs no quoting/escaping through the AppleScript bridge.
+function _newEvalSlot() {
+  return 'window.__mcpEval_' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
+}
+
+// Page-side statement that awaits `valueJs` and records the outcome in `slot`.
+function _settleIntoSlot(slot, valueJs) {
+  return `(async function(){try{var __v=await (${valueJs});` +
+    `${slot}.val=(__v===undefined||__v===null)?null:(typeof __v==='object'?JSON.stringify(__v):String(__v));` +
+    `}catch(__e){${slot}.err=(__e&&__e.message)||String(__e);}` +
+    `finally{${slot}.done=true;}})();`;
+}
+
 async function _evaluateAsync(expr) {
-  // Token is identifier-safe (base36 → [0-9a-z], `_` prefix) so `window.<token>`
-  // dot access needs no quoting/escaping through the AppleScript bridge.
-  const token = '__mcpEval_' + Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
-  const slot = 'window.' + token;
+  const slot = _newEvalSlot();
   // A SYNC outer function installs the globals, starts the async work (NOT awaited
   // here — `do JavaScript` would not await it anyway) and returns immediately.
-  const kickoff =
-    `(function(){${slot}={done:false};(async function(){try{` +
-    `var __v=await (${expr});` +
-    `${slot}.val=(__v===undefined||__v===null)?null:(typeof __v==='object'?JSON.stringify(__v):String(__v));` +
-    `}catch(__e){${slot}.err=(__e&&__e.message)||String(__e);}` +
-    `finally{${slot}.done=true;}})();return 'ok';})()`;
+  const kickoff = `(function(){${slot}={done:false};${_settleIntoSlot(slot, expr)}return 'ok';})()`;
   const started = await runJS(kickoff, { timeout: 10000 });
   if (started !== 'ok') {
     return typeof started === 'string' && started ? started : '(no return value)';
   }
-  // Poll the result global until the async work settles (35s budget).
+  return _awaitEvalSlot(slot);
+}
+
+// Poll the result global until the async work settles (35s budget).
+async function _awaitEvalSlot(slot) {
   const pollJs =
     `(function(){var s=${slot};if(!s)return '__MCP_GONE__';` +
     `if(!s.done)return '';return JSON.stringify({v:s.val,e:s.err});})()`;
@@ -4172,25 +4194,28 @@ async function _evaluateAsync(expr) {
   }
 }
 
+// Sync: a single `do JavaScript` over one expression — `do JavaScript` only returns the
+// value of a single expression, so the whole script is one IIFE. The regex async-sniff in
+// _buildEvalExpr only catches a literal await/.then/async and misses scripts whose *value*
+// is a thenable (`Promise.resolve(5)`, an async IIFE with no inner await). Such a value is
+// awaited in place into a slot: the script already ran, and evaluating it again — as this
+// used to on "[object Promise]" — repeated every side effect in it.
+export function _buildSyncEvalJs(expr, slot) {
+  return `(function(){ try { var __r = (${expr}); ` +
+    `if (__r && typeof __r.then === 'function') { ${slot}={done:false}; ${_settleIntoSlot(slot, '__r')} return '__MCP_EVAL_PENDING__'; } ` +
+    `return __r; } catch(__mcpErr) { return 'Error: ' + __mcpErr.message; } })()`;
+}
+
 export async function evaluate({ script }) {
   const js = (script || '').trim();
   if (!js) return '(no return value)';
   const { isAsync, expr } = _buildEvalExpr(js);
   if (isAsync) return _evaluateAsync(expr);
-  // Sync: a single `do JavaScript` over one expression. `do JavaScript` only
-  // returns the value of a single expression, so the whole script is one IIFE.
-  const wrappedJs = `(function(){ try { return (${expr}); } catch(__mcpErr) { return 'Error: ' + __mcpErr.message; } })()`;
+  const slot = _newEvalSlot();
+  const wrappedJs = _buildSyncEvalJs(expr, slot);
   if (process.env.MCP_DEBUG) console.error('[evaluate] wrapped:', wrappedJs.substring(0, 300));
   const result = await runJS(wrappedJs);
-  // The regex async-sniff in _buildEvalExpr only catches a literal await/.then/async.
-  // It misses scripts whose *value* is a thenable — `Promise.resolve(5)`, an async IIFE
-  // with no inner await, any fn returning a promise. `do JavaScript` can't await those,
-  // so they come back as the literal "[object Promise]". Re-run through the async poller
-  // in that case. (Pathological: a script genuinely returning the string "[object Promise]"
-  // re-runs to the same value, so there is no downside.)
-  if (typeof result === 'string' && result.trim() === '[object Promise]') {
-    return _evaluateAsync(expr);
-  }
+  if (typeof result === 'string' && result.trim() === '__MCP_EVAL_PENDING__') return _awaitEvalSlot(slot);
   if (result === null || result === undefined || result === '') {
     return '(no return value)';
   }