safari-mcp 2.22.16 → 2.22.18

package/README.md

@@ -752,8 +752,10 @@ xcodebuild -project "xcode/Safari MCP/Safari MCP.xcodeproj" \
 APP_PATH=$(find ~/Library/Developer/Xcode/DerivedData/Safari_MCP-*/Build/Products/Release -name "Safari MCP.app" -maxdepth 2 | head -1)
 
 # 4. Re-sign safari-helper with the Apple Events entitlement
-# (helps macOS surface the TCC Automation prompt reliably)
-codesign --sign - --force --entitlements safari-helper.entitlements safari-helper
+# (helps macOS surface the TCC Automation prompt reliably).
+# Keep the stable identifier: macOS keys the Accessibility grant to it.
+codesign --sign - --force --identifier com.achiya-automation.safari-mcp \
+  --entitlements safari-helper.entitlements safari-helper
 
 # 5. Open the app (needed once so Safari registers the extension)
 open "$APP_PATH"

package/extension/background.js

@@ -62,7 +62,14 @@ async function _bridgeFetch(url, init = {}) {
   const headers = new Headers(init.headers || {});
   headers.set("X-Safari-MCP-Token", await _bridgeAuthToken());
   headers.set("X-Safari-MCP-Worker", _bridgeWorkerId);
-  return fetch(url, { ...init, headers });
+  const response = await fetch(url, { ...init, headers });
+  // The daemon names the browser session on every authenticated response (#143). Adopt it
+  // before the caller acts on the body, so a command never resolves a receipt under an
+  // epoch that this response has already replaced.
+  try {
+    await _noteBrowserEpochHint(response.headers.get("X-Safari-MCP-Browser-Epoch"));
+  } catch {} // a failure here must never take the bridge down; the old epoch stays in force
+  return response;
 }
 const _CONTENT_WAKE_TOKEN_STORAGE_KEY = "mcpContentWakeTokenV1";
 const _CONTENT_WAKE_LABEL = "safari-mcp-content-wakeup-v1";
@@ -601,7 +608,7 @@ async function connect() {
       const connectHeaders = reloadHandoffToken
         ? { "X-Safari-MCP-Reload-Handoff": reloadHandoffToken }
         : {};
-      const res = await _bridgeFetch(`${HTTP_URL}/connect?verifier=existing-tab-v1&protocol=popup-opener-lease-v2`, {
+      const res = await _bridgeFetch(`${HTTP_URL}/connect?verifier=existing-tab-v1&protocol=popup-opener-lease-v2&build=${_EXTENSION_BUILD}`, {
         method: "POST",
         headers: connectHeaders,
         signal: AbortSignal.timeout(1500),
@@ -2686,7 +2693,7 @@ const MAX_SESSIONS = 50; // Hard cap on session cache size
 const _sessionOwnedTabs = new Map(); // sessionId → Set<tabId>
 // Mirror of the above in storage.local. storage.session is absent on Safari, so it is
 // the only place ownership actually survives a worker suspend.
-const _OWNED_TABS_LOCAL_KEY = "mcpOwnedTabsLocal";
+const _OWNED_TABS_LOCAL_KEY = "mcpOwnedTabsLocalV2";
 // Long enough to span a working session, short enough that tab ids from a previous
 // browser run have expired rather than being reused by unrelated tabs.
 const _OWNED_TABS_TTL_MS = 6 * 60 * 60 * 1000;
@@ -2697,8 +2704,15 @@ const _OWNED_TABS_TTL_MS = 6 * 60 * 60 * 1000;
 // "no tabs owned yet" compatibility path then silently allowed write commands
 // on ANY tab, including the user's.
 const _OWNED_TABS_KEY = "mcpSessionOwnedTabs";
-const _TAB_RECEIPTS_KEY = "mcpOwnedTabReceiptsV3";
-const _TAB_RECEIPTS_VERSION = 3;
+// V4/V2: earlier builds keep writing "mcpOwnedTabReceiptsV3"/"mcpOwnedTabsLocal" for as long as Safari
+// keeps one of their contexts alive after an app update, under an epoch of their own, over
+// whatever this build stored. Reading and writing other keys keeps that out of this build's
+// state (#143).
+const _TAB_RECEIPTS_KEY = "mcpOwnedTabReceiptsV4";
+const _TAB_RECEIPTS_VERSION = 4;
+// Announced on /connect. The daemon reloads a lease holder that announces none (worker-upgrade.js).
+// Must equal EXTENSION_BUILD in worker-upgrade.js.
+const _EXTENSION_BUILD = "isolated-envelopes-1";
 const _BROWSER_SESSION_EPOCH_KEY = "mcpBrowserSessionEpochV1";
 // The prefix of `_bridgeWorkerId` that the daemon log prints for this worker. Every
 // ownership envelope written to storage.local carries it, so the on-disk history shows
@@ -2785,7 +2799,78 @@ function _adoptBrowserSessionEpoch(epoch) {
   return epoch;
 }
 
+// ---- The daemon names the browser session (#143) ----
+// Safari gives every worker instance its own `storage.session`, so an epoch minted there
+// rotated with each worker succession and differed between instances alive together. The
+// next tab removal then rewrote the shared receipt envelope under another epoch and dropped
+// every receipt the previous one held. The daemon knows which Safari process is running and
+// sends its identity ("<pid>:<start time>") on every authenticated response: the same for
+// every instance, changing only when Safari itself restarts, which is exactly when tab ids
+// stop meaning anything. The epoch is derived from it; `storage.session` stays the fallback
+// for a daemon that sends none.
+const _SERVER_EPOCH_KEY = "mcpServerBrowserEpochV1";
+// A stored copy older than this is not trusted by a cold worker: Safari has probably been
+// relaunched since, and the daemon has not yet said so.
+const _SERVER_EPOCH_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+const _SERVER_EPOCH_REFRESH_MS = 60 * 60 * 1000;
+let _serverBrowserEpoch = "";
+let _serverEpochStoredAt = 0;
+let _serverEpochRestorePromise = null;
+
+async function _deriveServerEpoch(hint) {
+  const bytes = new TextEncoder().encode(`safari-mcp-browser-session-v1:${hint}`);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 36);
+}
+
+async function _storeServerEpoch(epoch) {
+  try {
+    await browser.storage.local.set({ [_SERVER_EPOCH_KEY]: { epoch, at: Date.now() } });
+    _serverEpochStoredAt = Date.now();
+  } catch {} // best effort: the next response names it again
+}
+
+// A cold worker starts with the identity the previous worker last stored, so that a tab
+// event delivered before its first bridge response is not read under a made-up epoch. The
+// first response replaces it if Safari has restarted since.
+function _restoreServerEpoch() {
+  if (_serverBrowserEpoch) return Promise.resolve();
+  if (!_serverEpochRestorePromise) {
+    _serverEpochRestorePromise = (async () => {
+      try {
+        const stored = (await browser.storage.local.get(_SERVER_EPOCH_KEY))?.[_SERVER_EPOCH_KEY];
+        if (!_serverBrowserEpoch && stored && /^[a-f0-9]{36}$/.test(String(stored.epoch || "")) &&
+          typeof stored.at === "number" && (Date.now() - stored.at) < _SERVER_EPOCH_MAX_AGE_MS) {
+          _serverBrowserEpoch = stored.epoch;
+          _serverEpochStoredAt = stored.at;
+        }
+      } catch {}
+    })();
+  }
+  return _serverEpochRestorePromise;
+}
+
+async function _noteBrowserEpochHint(hint) {
+  const text = String(hint || "");
+  if (!/^\d{1,8}:[ -~]{8,40}$/.test(text)) return;
+  const epoch = await _deriveServerEpoch(text);
+  if (epoch === _serverBrowserEpoch) {
+    if (Date.now() - _serverEpochStoredAt > _SERVER_EPOCH_REFRESH_MS) await _storeServerEpoch(epoch);
+    return;
+  }
+  _serverBrowserEpoch = epoch;
+  await _storeServerEpoch(epoch);
+  if (_browserSessionEpoch !== epoch) {
+    // Bumps the generation, so work stamped with the previous epoch aborts instead of
+    // writing, and forces the next hydration to read storage under the new one.
+    _adoptBrowserSessionEpoch(epoch);
+    _ownedTabsHydrated = false;
+  }
+}
+
 async function _ensureBrowserSessionEpoch() {
+  await _restoreServerEpoch();
+  if (_serverBrowserEpoch) return _adoptBrowserSessionEpoch(_serverBrowserEpoch);
   if (!_browserSessionStorageAvailable) {
     throw new Error("Browser session storage is unavailable; refusing durable tab authority");
   }
@@ -2974,7 +3059,23 @@ async function _hydrateOwnedTabs() {
     if (_ownedTabsHydrationPromise === hydration) _ownedTabsHydrationPromise = null;
   }
 }
+// Only the worker that holds the daemon's lease writes the shared envelopes. A superseded or
+// disconnected instance still gets tab events and still holds the maps from when it last
+// hydrated; letting it write replaced the live worker's receipts with its stale view (#143).
+// A command running here (a durable write) is the lease holder by construction, unless it
+// has been superseded.
+function _mayPersistOwnership(requireDurableReceipt) {
+  if (requireDurableReceipt) return !_bridgeWorkerSuperseded;
+  return isConnected && _enabled && !_bridgeWorkerSuperseded && !_bridgeWorkerRetiring;
+}
+
 async function _persistOwnedTabs(requireDurableReceipt = false) {
+  if (!_mayPersistOwnership(requireDurableReceipt)) {
+    if (requireDurableReceipt) {
+      throw new Error("Could not persist tab receipt: this worker no longer holds the bridge lease");
+    }
+    return [];
+  }
   const browserEpoch = await _ensureBrowserSessionEpoch();
   const generation = _browserEpochGeneration;
   const owners = {};
@@ -3151,6 +3252,16 @@ async function _refreshAllReceiptIdentities() {
 async function _resolveReceiptTab(token, { allowOriginChange = false } = {}) {
   return _withReceiptMutationLock(async () => {
     const normalized = String(token || "");
+    if (!_receiptByToken.has(normalized) && /^[A-Za-z0-9_-]{24,}$/.test(normalized)) {
+      // Another worker instance may have minted it after this one hydrated: read the
+      // shared envelope again before refusing (#143). Every mutation persists before it
+      // returns, so nothing in memory is lost by rebuilding the maps from storage.
+      await (async () => {
+        if (_ownedTabsHydrationPromise) await _ownedTabsHydrationPromise.catch(() => {});
+        _ownedTabsHydrated = false;
+        await _hydrateOwnedTabs();
+      })().catch(() => {});
+    }
     const record = _receiptByToken.get(normalized);
     if (!/^[A-Za-z0-9_-]{24,}$/.test(normalized) || !_isValidReceiptRecord(normalized, record)) {
       throw new Error("Tab safety: this extension has no record of that receipt. It was never issued by this extension instance, or it ended when its tab closed, when getReceipt replaced it, or when Safari or the extension restarted. Open the tab again with safari_new_tab.");

package/index.js

@@ -21,13 +21,15 @@ import {
 } from "./ownership-state.js";
 import { WebSocketServer } from "ws";
 import { createServer } from "node:http";
-import { randomUUID, randomBytes, timingSafeEqual, createHmac } from "node:crypto";
+import { randomUUID, randomBytes, timingSafeEqual, createHmac, createHash } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, renameSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { jpegSize } from "./image-size.js";
+import { createSafariSessionHintReader } from "./safari-session-hint.js";
+import { createStaleWorkerPolicy, leaseBuildVerdict, LEASE_BUILD_PREFERENCE_MS, HOME_CONTEXT_ALIVE_MS } from "./worker-upgrade.js";
 import {
   createLedger as createWorkerLedger,
   noteConnect as ledgerNoteConnect,
@@ -630,6 +632,93 @@ function _isAllowedWebSocketOrigin(origin) {
 let _extensionWs = null;
 let _extensionConnected = false;
 let _activeHttpWorkerId = "";
+// The build the lease holder announced on /connect ("" for a context from an older app).
+let _activeHttpWorkerBuild = "";
+// Which extension origin the lease holder's requests came from (a short hash), for the log.
+let _activeHttpWorkerOrigin = "";
+// The identity of the running Safari process, sent on every authenticated bridge response so
+// the extension can name its browser session the same way from every worker instance (#143).
+const _safariSessionHint = createSafariSessionHintReader();
+
+// Safari keeps the extension context of every app generation it ever loaded alive (measured
+// 13.10.26: its process had resources of a dozen builds mapped, the deleted ones included), and
+// each wakes every minute and verifies. The ones from before the isolated envelopes announce no
+// build, so while a current one has verified recently they may not take the lease, and a current
+// one takes it from them at once (see worker-upgrade.js).
+let _currentBuildWorkerSeenAt = 0;
+function _noteCurrentBuildWorker(build) {
+  if (build) _currentBuildWorkerSeenAt = Date.now();
+}
+function _currentBuildWorkerSeenRecently(now = Date.now()) {
+  return _currentBuildWorkerSeenAt > 0 && now - _currentBuildWorkerSeenAt <= LEASE_BUILD_PREFERENCE_MS;
+}
+// Current contexts can be several as well, each with tab ids of its own: a receipt resolves only in
+// the context that minted it (see worker-upgrade.js). The first current context to lead is the home
+// context, and no instance of another origin leads while the home context is alive.
+let _homeOrigin = "";
+let _homeOriginSeenAt = 0;
+function _homeContextAlive(now = Date.now()) {
+  return !!_homeOrigin && now - _homeOriginSeenAt <= HOME_CONTEXT_ALIVE_MS;
+}
+function _noteHomeContext(build, origin) {
+  if (build && origin && origin === _homeOrigin) _homeOriginSeenAt = Date.now();
+}
+function _pinHomeContext(build, origin) {
+  if (!build || !origin || origin === "none") return;
+  if (origin !== _homeOrigin) console.error(`[Safari MCP] home context: ${_homeOrigin || "none"} -> ${origin}`);
+  _homeOrigin = origin;
+  _homeOriginSeenAt = Date.now();
+}
+const _contextRefusedLoggedAt = new Map();
+function _logContextRefused(workerId, origin) {
+  const now = Date.now();
+  if (now - (_contextRefusedLoggedAt.get(origin) || 0) < 5 * 60_000) return;
+  if (_contextRefusedLoggedAt.size >= 64) _contextRefusedLoggedAt.clear();
+  _contextRefusedLoggedAt.set(origin, now);
+  console.error(`[Safari MCP] lease: worker ${workerId.slice(0, 8)} of context ${origin} waits, context ${_homeOrigin} leads`);
+}
+function _extensionOriginId(origin) {
+  return typeof origin === "string" && origin ? createHash("sha256").update(origin).digest("hex").slice(0, 6) : "none";
+}
+function _logLeaseChange(fromWorkerId, toWorkerId, toBuild, toOrigin) {
+  const from = fromWorkerId ? `${fromWorkerId.slice(0, 8)} (${_activeHttpWorkerBuild || "no build"}, origin ${_activeHttpWorkerOrigin || "?"})` : "nobody";
+  console.error(`[Safari MCP] lease: ${from} -> ${toWorkerId.slice(0, 8)} (${toBuild || "no build"}, origin ${toOrigin || "?"})`);
+}
+
+// When no current context is around, a lease holder that announced no build is reloaded
+// instead, once (see worker-upgrade.js). SAFARI_MCP_NO_AUTO_UPGRADE=1 turns this off.
+const _staleWorkerPolicy = createStaleWorkerPolicy();
+let _staleReloadInFlight = false;
+async function _reloadStaleWorker(workerId) {
+  if (process.env.SAFARI_MCP_NO_AUTO_UPGRADE === "1" || _staleReloadInFlight) return;
+  if (workerId !== _activeHttpWorkerId || _activeHttpWorkerBuild) return;
+  // A current context is about to replace this one, and reloading restarts the same old one.
+  if (_currentBuildWorkerSeenRecently()) return;
+  // Asked on every poll of the lease holder until it has been reloaded: a command in flight or a
+  // reload a moment ago only delays it, so a context that verified at a busy moment cannot stay
+  // the lease holder for good.
+  const verdict = _staleWorkerPolicy.check({
+    build: _activeHttpWorkerBuild,
+    active: true,
+    busy: _pendingRequests.size > 0,
+  });
+  if (!verdict.reload) return;
+  _staleReloadInFlight = true;
+  _staleWorkerPolicy.commit();
+  console.error(`[Safari MCP] worker ${workerId.slice(0, 8)} announced no extension build (a context Safari kept from an older app); reloading it`);
+  // The reload needs the same handoff as safari_reload_extension (see /proxy-command): it is
+  // what lets the replacement worker take the lease from this one.
+  let handoff = null;
+  try {
+    handoff = _prepareReloadHttpWorkerHandoff();
+    await sendToExtension("reload_extension", { reloadHandoff: handoff.token }, 30000);
+  } catch (error) {
+    if (handoff) _cancelReloadHttpWorkerHandoff(handoff);
+    console.error(`[Safari MCP] reloading worker ${workerId.slice(0, 8)} failed: ${error.message}`);
+  } finally {
+    _staleReloadInFlight = false;
+  }
+}
 const _connectingHttpWorkers = new Map();
 const _HTTP_WORKER_TTL_MS = 60 * 1000;
 const _HTTP_RELOAD_HANDOFF_TTL_MS = 30 * 1000;
@@ -653,12 +742,12 @@ function _reloadHandoffToken(req) {
   return typeof value === "string" && /^[A-Za-z0-9_-]{24,}$/.test(value) ? value : "";
 }
 
-function _rememberConnectingHttpWorker(workerId, reloadHandoffToken = "") {
+function _rememberConnectingHttpWorker(workerId, reloadHandoffToken = "", build = "", origin = "") {
   const now = Date.now();
   for (const [id, record] of _connectingHttpWorkers) {
     if (now - record.connectedAt > _HTTP_WORKER_TTL_MS) _connectingHttpWorkers.delete(id);
   }
-  _connectingHttpWorkers.set(workerId, { connectedAt: now, reloadHandoffToken });
+  _connectingHttpWorkers.set(workerId, { connectedAt: now, reloadHandoffToken, build, origin });
 }
 
 function _connectingHttpWorker(workerId) {
@@ -734,8 +823,19 @@ function _activeHttpWorkerHasDispatchedRequest() {
   );
 }
 
-function _mayReplaceActiveHttpWorker(workerId, presentedToken, now = Date.now()) {
-  if (!_activeHttpWorkerId || workerId === _activeHttpWorkerId) return true;
+function _mayReplaceActiveHttpWorker(workerId, presentedToken, now = Date.now(), build = "", origin = "") {
+  if (workerId === _activeHttpWorkerId) return true;
+  const preference = leaseBuildVerdict({
+    candidateBuild: build,
+    holderBuild: _activeHttpWorkerBuild,
+    hasHolder: !!_activeHttpWorkerId,
+    currentSeenRecently: _currentBuildWorkerSeenRecently(now),
+    candidateOrigin: origin,
+    homeOrigin: _homeOrigin,
+    homeAlive: _homeContextAlive(now),
+  });
+  if (preference === "deny") return false;
+  if (!_activeHttpWorkerId) return true;
   // No successor capability may bypass a mutation already delivered to the
   // active worker. A reload result removes its pending fence before arming the
   // exact handoff, so the intended reload path remains available.
@@ -759,7 +859,7 @@ function _mayReplaceActiveHttpWorker(workerId, presentedToken, now = Date.now())
     // to the ordinary healthy-worker lease instead of leaving a permanent blockade.
     if (_reloadHttpWorkerHandoff === handoff) _reloadHttpWorkerHandoff = null;
   }
-  return !_activeHttpWorkerIsFresh(now);
+  return preference === "take" || !_activeHttpWorkerIsFresh(now);
 }
 
 function _requireActiveHttpWorker(req, res) {
@@ -1034,6 +1134,13 @@ try {
       res.end("Unauthorized");
       return;
     }
+    if (extensionBridgeEndpoint) {
+      const sessionHint = _safariSessionHint();
+      if (sessionHint) {
+        res.setHeader("X-Safari-MCP-Browser-Epoch", sessionHint);
+        res.setHeader("Access-Control-Expose-Headers", "X-Safari-MCP-Browser-Epoch");
+      }
+    }
 
     // GET /poll — extension asks for next command (long-poll, up to 5s)
     if (req.method === "GET" && req.url === "/poll") {
@@ -1048,6 +1155,8 @@ try {
         return;
       }
       _extensionLastPollTime = Date.now(); // Keep connection alive — critical for stale detection
+      _noteHomeContext(_activeHttpWorkerBuild, _activeHttpWorkerOrigin);
+      _reloadStaleWorker(pollingWorkerId);
       if (!_extensionConnected) {
         _extensionConnected = true;
         console.error("[Safari MCP] Extension reconnected via poll");
@@ -1146,21 +1255,31 @@ try {
       // Only an accepted code generation may proceed to /verify-profile and
       // /extension-verified. Remembering rejected workers would let a stale process
       // skip the protocol gate by posting the second handshake step directly.
-      _rememberConnectingHttpWorker(workerId, _reloadHandoffToken(req));
+      const announcedBuild = String(connectUrl.searchParams.get("build") || "");
+      const build = /^[A-Za-z0-9._-]{1,40}$/.test(announcedBuild) ? announcedBuild : "";
+      const originId = _extensionOriginId(req.headers.origin);
+      _rememberConnectingHttpWorker(workerId, _reloadHandoffToken(req), build, originId);
       ledgerNoteConnect(_workerLedger, workerId);
       _noteUnverifiedWorker(workerId);
       // When SAFARI_PROFILE is set, don't mark as connected until profile is verified.
       // A personal-profile extension connecting first would incorrectly set the flag.
       if (!process.env.SAFARI_PROFILE) {
         const reloadHandoffToken = _reloadHandoffToken(req);
-        if (!_mayReplaceActiveHttpWorker(workerId, reloadHandoffToken)) {
+        _noteCurrentBuildWorker(build);
+        _noteHomeContext(build, originId);
+        if (!_mayReplaceActiveHttpWorker(workerId, reloadHandoffToken, Date.now(), build, originId)) {
+          if (build) _logContextRefused(workerId, originId);
           _connectingHttpWorkers.delete(workerId);
           res.writeHead(423, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ status: "worker_lease_held" }));
           return;
         }
         const workerChanged = workerId !== _activeHttpWorkerId;
+        if (workerChanged) _logLeaseChange(_activeHttpWorkerId, workerId, build, originId);
+        _pinHomeContext(build, originId);
         _activeHttpWorkerId = workerId;
+        _activeHttpWorkerBuild = build;
+        _activeHttpWorkerOrigin = originId;
         _connectingHttpWorkers.delete(workerId);
         if (workerChanged) {
           _adoptReloadHandoff(workerId);
@@ -1216,14 +1335,21 @@ try {
         res.end("Unverified worker");
         return;
       }
-      if (!_mayReplaceActiveHttpWorker(workerId, connectingWorker.reloadHandoffToken)) {
+      _noteCurrentBuildWorker(connectingWorker.build);
+      _noteHomeContext(connectingWorker.build, connectingWorker.origin);
+      if (!_mayReplaceActiveHttpWorker(workerId, connectingWorker.reloadHandoffToken, Date.now(), connectingWorker.build || "", connectingWorker.origin || "")) {
+        if (connectingWorker.build) _logContextRefused(workerId, connectingWorker.origin);
         _connectingHttpWorkers.delete(workerId);
         res.writeHead(423, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ status: "worker_lease_held" }));
         return;
       }
       const workerChanged = workerId !== _activeHttpWorkerId;
+      if (workerChanged) _logLeaseChange(_activeHttpWorkerId, workerId, connectingWorker.build, connectingWorker.origin);
+      _pinHomeContext(connectingWorker.build, connectingWorker.origin);
       _activeHttpWorkerId = workerId;
+      _activeHttpWorkerBuild = connectingWorker.build || "";
+      _activeHttpWorkerOrigin = connectingWorker.origin || "";
       _connectingHttpWorkers.delete(workerId);
       if (workerChanged) {
         _adoptReloadHandoff(workerId);
@@ -1989,6 +2115,18 @@ function _sanitizeTabResult(value) {
   };
 }
 
+// After a navigation, the session's current page is the URL it asked for. safari.navigate() records
+// one for the AppleScript path, but a navigation the extension served left safari.js holding the URL
+// the tab had left, which the tool then released: without SAFARI_PROFILE every later write of that
+// client was judged by a URL it no longer owned, and refused (#172). The requested URL, not the one
+// the page reports: extensionOrFallback has already claimed it, while a redirect target is the
+// site's choice (see run_script's newTab). Skipped when a call alongside has made another tab the
+// session's current one: the navigated page is not that tab's.
+function _pinNavigatedUrl(url, usedReceipt) {
+  if ((usedReceipt || "") !== (_getActiveReceipt() || "")) return;
+  safari.setActiveTabURL(url);
+}
+
 // A receipt is bound to the origin it was minted on, so a cross-origin navigation the
 // caller itself asked for used to strand every following call ("not valid for this
 // origin", ~80×/week). The caller chose the destination, so rotating here is safe —
@@ -2630,6 +2768,7 @@ server.tool(
     );
     // Tab kept its identity, just changed URL — drop the stale old URL from ownership.
     if (oldUrl && oldUrl !== url && oldUrl !== 'about:blank') _removeOwnedURL(oldUrl);
+    _pinNavigatedUrl(url, usedReceipt);
     return textResult(await _rotateReceiptAfterNavigate(result, usedReceipt, oldUrl));
   }
 );
@@ -2733,6 +2872,7 @@ server.tool(
       }
     );
     if (oldUrl && oldUrl !== url && oldUrl !== 'about:blank') _removeOwnedURL(oldUrl);
+    _pinNavigatedUrl(url, usedReceipt);
     return textResult(await _rotateReceiptAfterNavigate(result, usedReceipt, oldUrl));
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.22.16",
+  "version": "2.22.18",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 98 tools via AppleScript + JavaScript.",
   "type": "module",
@@ -71,6 +71,8 @@
     "ownership-state.js",
     "image-size.js",
     "worker-ledger.js",
+    "safari-session-hint.js",
+    "worker-upgrade.js",
     "node-compat.js",
     "mcp-helpers.js",
     "injected-validators.js",

package/safari-session-hint.js

@@ -0,0 +1,68 @@
+/**
+ * The identity of the running Safari process, as the daemon sees it.
+ *
+ * A tab receipt is valid for one browser session: Safari hands out tab ids afresh after a
+ * restart, so a receipt minted before one must never be taken for a tab after it. The
+ * extension used to name the session itself, with a value kept in `storage.session`. Safari
+ * gives every extension worker instance its own `storage.session`, so that value rotated
+ * with each worker succession (and differed between instances alive together), and the next
+ * tab removal rewrote the shared receipt envelope under a different epoch and dropped every
+ * receipt the previous one held (#143).
+ *
+ * The daemon names the session instead. "<pid>:<start time>" of the Safari process is the
+ * same for every worker, survives every worker restart, and changes exactly when Safari
+ * itself restarts. The extension derives its epoch from it.
+ */
+import { execFileSync } from "node:child_process";
+
+const HINT_RE = /^\d{1,8}:[ -~]{8,40}$/;
+
+/**
+ * "<pid>:<lstart>" when both are well formed, otherwise "" (the caller sends no hint).
+ * @param {unknown} pid
+ * @param {unknown} lstart
+ */
+export function formatSafariSessionHint(pid, lstart) {
+  const id = String(pid ?? "").trim();
+  const started = String(lstart ?? "").trim().replace(/\s+/g, " ");
+  const hint = `${id}:${started}`;
+  return /^\d{1,8}$/.test(id) && HINT_RE.test(hint) ? hint : "";
+}
+
+/**
+ * The oldest process named exactly `Safari`; helper processes carry other names.
+ * @param {(file: string, args: string[], options?: object) => string | Buffer} [run]
+ */
+export function readSafariSessionHintSync(run = /** @type {any} */ (execFileSync)) {
+  try {
+    const pid = String(run("/usr/bin/pgrep", ["-o", "-x", "Safari"], { encoding: "utf8", timeout: 2000 }))
+      .trim().split("\n")[0];
+    if (!/^\d+$/.test(pid)) return "";
+    const lstart = run("/bin/ps", ["-o", "lstart=", "-p", pid], { encoding: "utf8", timeout: 2000 });
+    return formatSafariSessionHint(pid, lstart);
+  } catch {
+    return ""; // pgrep exits 1 when Safari is not running
+  }
+}
+
+/**
+ * A reader that re-asks at most once per `ttlMs`. Polls from many workers arrive every few
+ * seconds; the process table is read once a second at most, synchronously, so that the
+ * first response after Safari relaunches already carries the new identity.
+ */
+export function createSafariSessionHintReader({
+  ttlMs = 1000,
+  read = readSafariSessionHintSync,
+  now = Date.now,
+} = {}) {
+  let value = "";
+  let at = -Infinity;
+  return function currentSafariSessionHint() {
+    const t = now();
+    if (t - at >= ttlMs) {
+      value = read();
+      at = t;
+    }
+    return value;
+  };
+}

package/worker-upgrade.js

@@ -0,0 +1,94 @@
+/**
+ * Contexts that still run an older build (#143).
+ *
+ * Replacing the extension app does not stop the contexts Safari had already started, and Safari
+ * keeps the context of every app generation it ever loaded (13.10.26: its process had the
+ * resources of a dozen builds mapped, among them deleted ones). Each wakes every minute, verifies
+ * and becomes the daemon's lease holder, each with its own in-memory receipts, so a lease that
+ * moves between an old context and a new one loses the receipts the other minted.
+ *
+ * Reloading an old context does not remove it: it restarts the same old generation, so the stream
+ * of old contexts never ends (45 reloads in 90 minutes). What the daemon controls is who leads.
+ * A worker that announced no build never takes the lease while a current one has verified within
+ * `LEASE_BUILD_PREFERENCE_MS`, and a current one takes it from an old holder at once. Reloading
+ * is the fallback for when no current context is around at all: the reload restarts the context
+ * from the app now on disk, and the replacement announces the build.
+ *
+ * A worker that announces any build is never reloaded here, so a newer extension talking to an
+ * older daemon is left alone. The rate limit bounds the damage if a reload ever fails to change
+ * the code the worker runs.
+ */
+
+/** Sent by the extension on `/connect` (`&build=`). Absent on every older build. */
+export const EXTENSION_BUILD = "isolated-envelopes-1";
+
+/** How long after a current context verified the daemon keeps older ones away from the lease. */
+export const LEASE_BUILD_PREFERENCE_MS = 15 * 60_000;
+
+/**
+ * How long the context that leads (the home context) may stay silent before another current
+ * context may lead. Its instances wake on a one-minute alarm, so this is a little over one cycle.
+ */
+export const HOME_CONTEXT_ALIVE_MS = 100_000;
+
+/**
+ * Whether the builds and contexts alone settle who may lead. The caller still applies its other
+ * rules (a command in flight, a reload handoff) before acting on "take".
+ *   deny      an older context while a current one is around, or a current context while another
+ *             current one (the home context, by extension origin) is alive: it never leads
+ *   take      a current context against a holder from an older app: replace it, even while it polls
+ *   ordinary  the usual rule decides (the holder has been quiet for a while)
+ *
+ * Several current contexts can be alive at once as well, and each has tab ids of its own: a receipt
+ * resolves only in the context that minted it, and a write from another context erased it from the
+ * shared envelope (13.10.26). Their requests carry different extension origins, so the first current
+ * context to lead stays the one that leads while it is alive.
+ * @param {{ candidateBuild: string, holderBuild: string, hasHolder: boolean, currentSeenRecently: boolean,
+ *   candidateOrigin?: string, homeOrigin?: string, homeAlive?: boolean }} s
+ * @returns {"deny" | "take" | "ordinary"}
+ */
+export function leaseBuildVerdict({
+  candidateBuild, holderBuild, hasHolder, currentSeenRecently,
+  candidateOrigin = "", homeOrigin = "", homeAlive = false,
+}) {
+  if (!candidateBuild && currentSeenRecently) return "deny";
+  if (candidateBuild && homeAlive && homeOrigin && candidateOrigin !== homeOrigin) return "deny";
+  if (candidateBuild && hasHolder && !holderBuild) return "take";
+  return "ordinary";
+}
+
+/**
+ * `check` decides without recording anything; `commit` records an attempt once the reload is
+ * really about to be sent. A "no" for busy or too soon is only for now: the daemon asks again on
+ * every poll of the lease holder, which is what keeps a context that verified at a busy moment
+ * from staying the lease holder for good.
+ * @param {{ now?: () => number, minGapMs?: number, windowMs?: number, maxPerWindow?: number }} [options]
+ * @returns {{ check: (worker: { build: string, active: boolean, busy: boolean }) => { reload: boolean, reason: string }, commit: () => void }}
+ */
+export function createStaleWorkerPolicy({
+  now = Date.now,
+  minGapMs = 20_000,
+  windowMs = 10 * 60_000,
+  maxPerWindow = 10,
+} = {}) {
+  /** @type {number[]} */
+  const attempts = [];
+  const prune = (t) => { while (attempts.length && t - attempts[0] > windowMs) attempts.shift(); };
+  return {
+    check({ build, active, busy }) {
+      if (build) return { reload: false, reason: "announced a build" };
+      if (!active) return { reload: false, reason: "not the lease holder" };
+      const t = now();
+      prune(t);
+      if (attempts.length >= maxPerWindow) return { reload: false, reason: "reload limit reached" };
+      if (busy) return { reload: false, reason: "a command is in flight" };
+      if (attempts.length && t - attempts[attempts.length - 1] < minGapMs) return { reload: false, reason: "reloaded one a moment ago" };
+      return { reload: true, reason: "no build announced" };
+    },
+    commit() {
+      const t = now();
+      prune(t);
+      attempts.push(t);
+    },
+  };
+}