safari-mcp 2.22.11 → 2.22.13

package/extension/background.js

@@ -125,7 +125,10 @@ function _safeTabUrl(rawUrl) {
 
 function _receiptOrigin(rawUrl) {
   const raw = String(rawUrl || "");
-  if (raw === "about:blank") return raw;
+  // Safari leaves `url` off a blank tab (measured 7.10.26). Read as no origin at all, the
+  // about:blank receipt of a fresh safari_new_tab() was refused on its first command, and
+  // getReceipt could not rotate it: the tab could be neither used nor closed.
+  if (!raw || raw === "about:blank") return "about:blank";
   try {
     const parsed = new URL(raw);
     return /^https?:$/.test(parsed.protocol) ? parsed.origin : "";
@@ -914,7 +917,11 @@ async function handleCommand(type, payload) {
   const suppliedReceipt = (type === "new_tab" || type === "list_tabs")
     ? ""
     : _receiptTokenFromPayload(payload);
-  const allowReceiptOriginChange = type === "get_tab_receipt";
+  // getReceipt and close_tab use a receipt only to find its tab; neither runs anything in the
+  // page. close_tab was held to the receipt's origin, so a tab a redirect or login bounce had
+  // moved could be closed only after a getReceipt rotation, and a page with no http(s) origin
+  // never gets one: the tab stayed open with nothing able to close it (geo-audit, 6.10.26).
+  const allowReceiptOriginChange = type === "get_tab_receipt" || type === "close_tab";
   let receiptResolved = false;
   // new_tab CREATES its target, so a failure to resolve an existing one must not stop
   // it. Once a profile holds several windows, resolution legitimately fails with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.22.11",
+  "version": "2.22.13",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 98 tools via AppleScript + JavaScript.",
   "type": "module",