safari-mcp 2.21.4 → 2.21.6

package/extension/background.js

@@ -2883,11 +2883,30 @@ function _withBrowserEpochStorageLock(operation) {
   return current;
 }
 
+/**
+ * Adopt `epoch` as the live browser-session identity. Storage is the authority, so a
+ * value that disagrees with the cache is not an error — it is a rotation, and the only
+ * correct response is to take the new one. Bumping the generation is what tells every
+ * operation that captured the previous one to abort instead of writing a record stamped
+ * with an epoch that is no longer current.
+ */
+function _adoptBrowserSessionEpoch(epoch) {
+  if (_browserSessionEpoch && _browserSessionEpoch !== epoch) _browserEpochGeneration++;
+  _browserSessionEpoch = epoch;
+  return epoch;
+}
+
 async function _ensureBrowserSessionEpoch() {
   if (!_browserSessionStorageAvailable) {
     throw new Error("Browser session storage is unavailable; refusing durable tab authority");
   }
-  if (/^[a-f0-9]{36}$/.test(_browserSessionEpoch)) return _browserSessionEpoch;
+  // Deliberately no cache short-circuit. `storage.session` is the authority and it can
+  // rotate under a worker that stays alive — a Safari session teardown clears it, and a
+  // racing worker start can replace it. Returning the cached value forever meant every
+  // receipt minted after such a rotation carried the *old* epoch, was handed to the
+  // client as valid, and was then dropped wholesale by the next cold `_hydrateOwnedTabs`,
+  // which does read storage. Re-reading here costs one local get per ownership mutation
+  // and is what makes the generation guards below reachable at all (#105).
   if (!_browserEpochInitializationPromise) {
     const generation = _browserEpochGeneration;
     _browserEpochInitializationPromise = _withBrowserEpochStorageLock(async () => {
@@ -2905,8 +2924,7 @@ async function _ensureBrowserSessionEpoch() {
         if (generation !== _browserEpochGeneration) {
           throw new Error("Browser-session identity changed during initialization");
         }
-        _browserSessionEpoch = persisted;
-        return persisted;
+        return _adoptBrowserSessionEpoch(persisted);
       }
       const epoch = _mintMcpTabMarker();
       try {
@@ -2929,8 +2947,7 @@ async function _ensureBrowserSessionEpoch() {
       if (generation !== _browserEpochGeneration) {
         throw new Error("Browser-session identity changed during initialization");
       }
-      _browserSessionEpoch = confirmedEpoch;
-      return confirmedEpoch;
+      return _adoptBrowserSessionEpoch(confirmedEpoch);
     });
   }
   const initialization = _browserEpochInitializationPromise;

package/index.js

@@ -1924,6 +1924,10 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
 
   let result;
   let usedExtension = false;
+  // The extension's evaluate ladder has a terminal state: every injection strategy was
+  // refused. It announces itself as "Falling back to AppleScript", so the caller must
+  // never be handed an empty value as if the script had simply returned nothing (#106).
+  let hardCspBlock = false;
   try {
     if (_extensionConnected && (!_preferAppleScript || _profileExtensionVerified)) {
       try {
@@ -1952,7 +1956,11 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
           if (reloadHandoff) _cancelReloadHttpWorkerHandoff(reloadHandoff);
           throw error;
         }
-        const isCspError = typeof result === 'string' && (result.includes('unsafe-eval') || result.includes('trusted-types') || result.includes('Trusted Type') || result.includes('Content Security Policy'));
+        // The ladder's own terminal marker. It was not in this list, so the fallback the
+        // marker's text promises never actually ran and its text reached the caller as
+        // the tool's value instead of as a failure (#106).
+        hardCspBlock = typeof result === 'string' && result.includes('CSP blocked all strategies');
+        const isCspError = hardCspBlock || (typeof result === 'string' && (result.includes('unsafe-eval') || result.includes('trusted-types') || result.includes('Trusted Type') || result.includes('Content Security Policy')));
         const isPermissionDenied = typeof result === 'string' && result.includes('__SCREENSHOT_PERMISSION_DENIED__');
         const isElementMiss = typeof result === 'string' && result.startsWith('Element not found');
         const isFailed = result === null || isElementMiss;
@@ -1998,6 +2006,16 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
       const t0 = Date.now();
       result = await fallbackFn();
       console.error(`[Safari MCP] ${extensionType} via AppleScript (${Date.now() - t0}ms)`);
+      // Both paths are now exhausted. An empty value here means the script never ran,
+      // which is byte-identical to a script that legitimately returned nothing — and an
+      // agent reads that as "no such element" and keeps building on it. Fail instead.
+      if (hardCspBlock && (result === undefined || result === null)) {
+        throw new Error(
+          `safari_${extensionType}: this page refused every JavaScript injection strategy (CSP), ` +
+          "and the AppleScript fallback returned nothing — the script did not run. " +
+          "Reading the page still works here: safari_read_page, safari_snapshot, safari_get_element, safari_extract_links."
+        );
+      }
     }
   } finally {
     safari.setFocusGuard(false);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "safari-mcp",
-  "version": "2.21.4",
+  "version": "2.21.6",
   "mcpName": "io.github.achiya-automation/safari-mcp",
-  "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 97 tools via AppleScript + JavaScript.",
+  "description": "Safari browser automation for AI agents \u2014 native macOS, zero Chrome overhead. 97 tools via AppleScript + JavaScript.",
   "type": "module",
   "main": "index.js",
   "bin": {