safari-mcp 2.22.3 → 2.22.5

package/extension/background.js

@@ -1114,6 +1114,22 @@ async function handleCommand(type, payload) {
       };
     }
 
+    // Puts the MCP session's identity marker on its tab. The server's AppleScript side knows tabs
+    // only by their position in a window, so it acts only on the tab that carries the session's
+    // marker, and a tab this extension opened or picked gets it here, where the tab is known by
+    // its id. Like any write, it reaches only a tab this session owns or a receipt names (the
+    // ownership guard above), never merely the tab in front. A fixed function, unlike evaluate,
+    // so no page CSP can refuse it.
+    case "mark_tab": {
+      const marker = String(payload.marker || "");
+      if (!tabId || !/^MCP_[A-Za-z0-9_]+$/.test(marker)) throw new Error("mark_tab requires a tab and an MCP_ marker");
+      return await execInTab((m) => {
+        window.name = m;
+        window.__mcpTabMarker = m;
+        return window.name === m;
+      }, [marker], tabId);
+    }
+
     case "get_title": {
       return targetTab.title;
     }

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.10.25",
+  "version": "2.10.26",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/index.js

@@ -17,7 +17,7 @@ import {
   _openedTabs, _ownedTabURLs,
   _isURLOwned, _markBlankTabOpened, _addOwnedURL, _removeOwnedURL, _trackTab, _untrackTab,
   _sessionTabs, _trackedAtIndex,
-  allowUserTabs, _adoptUserTab, _isAdoptedURL,
+  allowUserTabs,
 } from "./ownership-state.js";
 import { WebSocketServer } from "ws";
 import { createServer } from "node:http";
@@ -170,16 +170,6 @@ const WEBKIT_MEMORY_LIMIT_MB = parseInt(process.env.MCP_WEBKIT_LIMIT_MB || "3000
 // _removeOwnedURL, _trackTab, _untrackTab, BLANK_TAB_SENTINEL) are imported from
 // ownership-state.js at the top of this file.
 
-// Resolve a tab we recorded earlier to its CURRENT index, proving identity by the marker
-// stamped on it. Returns null when the tab carries no marker we can find — the caller then
-// leaves it alone. Never matches by URL: the tab navigates after we open it, and the user
-// can have a tab of their own on the URL we recorded, so a URL match closed THEIR tab
-// (#112). A stray MCP tab left open costs nothing; a closed user tab costs their work.
-async function _verifiedTabIndex(info) {
-  if (!info?.marker) return null;
-  try { return await safari.findTabByMarker(info.marker); } catch { return null; }
-}
-
 // Close one tab this process opened, found by the identity recorded when it was opened:
 // the receipt the extension minted for it, or the AppleScript marker. Never by position.
 // The tab cap used to close the index recorded at opening, and the close also carried the
@@ -213,14 +203,16 @@ async function _closeTrackedTab(info) {
       return msg.includes("Tab safety:") ? "lost" : "failed";
     }
   }
-  // Opened through AppleScript: prove it by its marker. A named profile never closes a tab
-  // through AppleScript.
+  // Opened through AppleScript: prove it by its marker, in the script that closes it. Never by
+  // URL: the tab navigates after we open it, and the user can have a tab of their own on the URL
+  // we recorded, so a URL match closed THEIR tab (#112). Nor by an index an earlier script found:
+  // a close in between renumbered the window, and a stray MCP tab left open costs nothing next
+  // to a closed user tab. A named profile never closes a tab through AppleScript.
+  // A tab blanked instead of closed (its window's last) is open still, but no marker names it any
+  // more: it counts as lost, not as closed.
   if (process.env.SAFARI_PROFILE) return "lost";
-  const idx = await _verifiedTabIndex(info);
-  if (!idx) return "lost";
   try {
-    await safari.closeTab(idx);
-    return "closed";
+    return (await safari.closeTabByMarker(info?.marker)) === "closed" ? "closed" : "lost";
   } catch {
     return "failed";
   }
@@ -237,8 +229,13 @@ async function _evictOldestTab(sessionId) {
   for (const [key, info] of mine) {
     if (open < MAX_TABS) break;
     const outcome = await _closeTrackedTab(info);
-    // It may still be open: keep counting it, retry it at the next new tab, close the next.
-    if (outcome === "failed") continue;
+    // It may still be open: keep counting it and retry it at the next new tab. Close the next
+    // only through the extension, which fails fast: an AppleScript close that failed, a page that
+    // never answers the marker check, would cost every tracked tab its own timeout.
+    if (outcome === "failed") {
+      if (!_receiptToken(info.receipt)) break;
+      continue;
+    }
     _untrackTab(key);
     open--;
     if (outcome === "closed") {
@@ -270,6 +267,18 @@ function _untrackClosedTab({ receipt = "", marker = "" }) {
   }
 }
 
+// Only the extension can tell which tab a receipt names: AppleScript proves a tab by the
+// marker stamped on it (#112), and a tab the extension opened carries none. A close or switch
+// by receipt whose extension attempt failed fell back to the session's current tab instead,
+// closing it, or claiming a tab with no index at all.
+function _receiptNeedsExtension(tool) {
+  return new Error(
+    "Tab safety: this call names its tab by a receipt (the one passed, or the current tab's), and only " +
+    "the Safari extension can resolve a receipt. It could not take the call, so AppleScript touched no tab. " +
+    `Retry safari_${tool} once safari_doctor shows the extension connected.`
+  );
+}
+
 // Close all MCP-opened tabs on process exit
 async function _cleanupTabs() {
   if (_openedTabs.size === 0) return;
@@ -282,14 +291,12 @@ async function _cleanupTabs() {
     return;
   }
   console.error(`[Safari MCP] Cleanup: closing ${_openedTabs.size} MCP-opened tabs`);
-  // Resolve each tab by its identity marker right before closing it — indices shift after
-  // every closure, and the marker is the only coordinate that survives navigation. Name the
-  // index explicitly: it was just proven ours, and closeTab's own ownership check covers
-  // only this session's active tab (#68).
+  // Find each tab by its identity marker in the script that closes it — indices shift after
+  // every closure, and the marker is the only coordinate that survives navigation. closeTab()
+  // with no index would close only this session's active tab (#68).
   for (const info of [..._openedTabs.values()]) {
     try {
-      const idx = await _verifiedTabIndex(info);
-      if (idx) await safari.closeTab(idx);
+      await safari.closeTabByMarker(info.marker);
     } catch {}
   }
   _openedTabs.clear();
@@ -1544,7 +1551,7 @@ function _handleExtensionResponse(msg, respondingWorkerId = "") {
 const _THERMAL_FILE = process.env.SAFARI_MCP_THERMAL_FILE || "";
 const _THERMAL_MAX = parseFloat(process.env.SAFARI_MCP_THERMAL_MAX || "80");
 const _THERMAL_WAIT_MS = parseInt(process.env.SAFARI_MCP_THERMAL_WAIT_MS || "20000", 10);
-const _THERMAL_FREE = new Set(["close_tab", "list_tabs", "get_tab_receipt", "get_tab_locus", "switch_tab", "reload_extension"]);
+const _THERMAL_FREE = new Set(["close_tab", "list_tabs", "get_tab_receipt", "get_tab_locus", "mark_tab", "switch_tab", "reload_extension"]);
 
 function _chipTemp() {
   try {
@@ -1735,7 +1742,9 @@ const _noOwnershipCheck = new Set([
 ]);
 
 // run_script action names (camelCase) that don't require an owned tab — strictly
-// read-only steps, plus newTab/switchTab/listTabs which mirror _noOwnershipCheck.
+// read-only steps, plus newTab/switchTab/listTabs which mirror _noOwnershipCheck
+// (switchTab still has to prove its tab: by the session's marker in safari.js switchTab(),
+// or through the extension, which knows the tabs it opened by their id).
 // Everything that can change page or tab state (navigate, evaluate, reload, goBack,
 // closeTab, ...) is asserted PER STEP while the batch runs (see the run_script
 // handler): a batch can change the active tab mid-run, so a single pre-flight
@@ -1827,6 +1836,11 @@ function _receiptToken(value) {
 function _explicitReceipt(args) {
   const token = _receiptToken(args?.receipt || "");
   if (!token) return {};
+  // A receipt that names another tab makes that tab the current one, so safari.js has to follow.
+  // Otherwise its AppleScript fallback ran in the tab the session had before, or, for a session
+  // re-initialised after a reconnect (no tab of its own yet), in the front document: the tab the
+  // user is looking at. The extension marks the receipt's tab when AppleScript first needs it.
+  if (token !== _getActiveReceipt()) safari.setActiveTabFromExtension(null, null);
   _setActiveReceipt(token);
   return { receipt: token };
 }
@@ -1938,6 +1952,9 @@ async function _runExtensionBatchAction(action, args = {}) {
       } else {
         _markBlankTabOpened();
       }
+      // safari.js still holds the marker of the last tab AppleScript opened; its fallback
+      // would go back there.
+      if (!viaAppleScript) safari.setActiveTabFromExtension(value?.tabIndex, trackUrl);
       return value;
     }
 
@@ -1953,14 +1970,23 @@ async function _runExtensionBatchAction(action, args = {}) {
       if (index !== undefined && (!Number.isInteger(index) || index < 1)) {
         throw new Error("switchTab index must be a positive integer when provided");
       }
+      let viaAppleScript = false;
       const raw = await extensionOrFallback(
         "switch_tab",
         receipt ? { ...(index ? { index } : {}), receipt } : { index },
-        () => safari.switchTab(index)
+        () => {
+          if (receipt) throw _receiptNeedsExtension("switch_tab");
+          viaAppleScript = true;
+          return safari.switchTab(index);
+        }
       );
       const value = _sanitizeTabResult(raw);
       const resolvedIndex = value?.tabIndex || index;
       if (resolvedIndex) safari.setActiveTabIndex(resolvedIndex);
+      // Point the AppleScript fallback at this tab, not the last one AppleScript claimed. Its
+      // URL is left unknown rather than set to the reported one: this path never registered
+      // that URL, so the ownership guard would start refusing the steps after it.
+      if (!viaAppleScript && value && typeof value === "object") safari.setActiveTabFromExtension(resolvedIndex, null);
       // A switch by index that returns no receipt still makes that tab the current one.
       // Keeping the previous tab's receipt sent every later step back to the previous tab.
       if (value && typeof value === "object") _setActiveReceipt(value.receipt || receipt);
@@ -1979,7 +2005,9 @@ async function _runExtensionBatchAction(action, args = {}) {
         () => { throw new Error("getReceipt requires the verified Safari extension"); }
       ));
       const safeValue = _sanitizeTabResult(value);
-      if (safeValue?.index) safari.setActiveTabIndex(safeValue.index);
+      // The rotated tab is now the current one. Its URL stays unknown in safari.js: a receipt
+      // is rotated because the tab left the origin this session registered.
+      if (safeValue?.index) safari.setActiveTabFromExtension(safeValue.index, null);
       if (safeValue?.receipt) {
         // Rotation retires the old token. Keep it resolving to the new one, as navigate does,
         // so the tab stays reachable — and closable by the tab cap — by the name it was opened with.
@@ -1990,12 +2018,24 @@ async function _runExtensionBatchAction(action, args = {}) {
     }
 
     case "closeTab": {
-      const index = args.index === undefined ? undefined : Number(args.index);
-      const receipt = _receiptToken(args.receipt || args.receiptUrl || args.url || "") || _getActiveReceipt();
+      const index = args.index == null ? undefined : Number(args.index);
+      // An index that is not a tab number (0, -1, 1.5, "abc") was dropped here or ignored by the
+      // extension, and the close took the current tab. switchTab refuses one, as closeOwnTab does
+      // without a profile.
+      if (index !== undefined && (!Number.isInteger(index) || index < 1)) {
+        throw new Error("Tab safety: closeTab index must be a positive integer when provided");
+      }
+      // As in safari_close_tab: a receipt that is not one is refused, not read as the current tab's.
+      const supplied = args.receipt || args.receiptUrl || args.url || "";
+      const receipt = supplied ? _receiptToken(supplied) : _getActiveReceipt();
+      if (supplied && !receipt) throw new Error("Tab safety: closeTab requires an extension-issued receipt");
       const closesCurrent = !receipt || receipt === _getActiveReceipt();
       const raw = await extensionOrFallback(
         "close_tab", { ...(index ? { index } : {}), ...(receipt ? { receipt } : {}) },
-        () => safari.closeTab(index)
+        () => {
+          if (receipt) throw _receiptNeedsExtension("close_tab");
+          return safari.closeOwnTab(index);
+        }
       );
       if (/^Tab not found/.test(String(raw))) return normalize(raw);
       // A named profile closes through the extension only: the tab that closed is the receipt's.
@@ -2181,7 +2221,9 @@ function _assertTabOwnership(opType, extensionPayload = {}) {
   // Closing is the one op the opt-in never unlocks (#92, condition 2). Adoption makes a
   // user's tab writable, not disposable — a wrong close costs work that cannot be undone
   // (#68). Checked before every early return so the batch action and the tool share it.
-  if (opType === "close_tab" && _isAdoptedURL(safari.getActiveTabURL())) {
+  // The session's marker on the tab says it was adopted, not its URL: the tab keeps that
+  // marker wherever it navigates, and another tab on the same URL does not carry it.
+  if (opType === "close_tab" && safari.isActiveTabAdopted()) {
     const msg = `⚠️ Tab safety: refusing "close_tab" — this tab was adopted from you via SAFARI_MCP_ALLOW_USER_TABS, not opened by this MCP session. Close it yourself, or open your own tab with safari_new_tab.`;
     console.error(`[Safari MCP] ${msg}`);
     throw new Error(msg);
@@ -2192,7 +2234,7 @@ function _assertTabOwnership(opType, extensionPayload = {}) {
   if (_preferAppleScript && _receiptToken(extensionPayload.receipt || _getActiveReceipt())) return;
   const currentUrl = safari.getActiveTabURL();
   // An adopted tab (#92) is the session's target even though the session opened nothing.
-  if (_isAdoptedURL(currentUrl)) {
+  if (safari.isActiveTabAdopted()) {
     console.error(`[Safari MCP] "${opType}" on ${_safeUrlForOutput(currentUrl)} (user tab, opted-in)`);
     return;
   }
@@ -2363,6 +2405,32 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
 // working (geo-audit, 2026-09-20). The fallback safari.js hands us is its original runJS.
 safari.setPageJSRunner((script, fallback) => extensionOrFallback("evaluate", { script }, fallback));
 
+// safari.js lets AppleScript act only on a tab that carries this session's identity marker. A tab
+// the extension opened or picked has none, and its index or URL does not say which tab it is now
+// (a tab the user closed or dragged, another front window, their own tab on the same site), so
+// the extension, which knows the tab by its id, writes a fresh marker there: safari.js asks when
+// AppleScript first needs the tab, and again once a cross-site load has cleared window.name.
+// mark_tab writes it from a fixed function, which no page CSP can refuse; an extension built
+// before mark_tab can only use evaluate, which a strict CSP (github.com) does refuse.
+safari.setExtensionTabMarker(async (marker) => {
+  if ((!_extensionConnected && !_primaryHasExtension) || (_preferAppleScript && !_profileExtensionVerified)) return false;
+  // No current tab — it was closed — so nothing to mark.
+  if (!_activeReceipts.has(_receiptSessionKey())) return false;
+  const receipt = _getActiveReceipt();
+  const target = { ...(receipt ? { receipt } : {}), sessionId: `${SESSION_ID}:${currentSessionId()}` };
+  try {
+    return (await sendToExtension("mark_tab", { ...target, marker }, _commandTimeouts.evaluate)) === true;
+  } catch (err) {
+    if (!/Unknown command/.test(String(err?.message || err))) return false;
+  }
+  try {
+    const script = `(window.name=window.__mcpTabMarker=${JSON.stringify(marker)},'1')`;
+    return (await sendToExtension("evaluate", { ...target, script }, _commandTimeouts.evaluate)) === "1";
+  } catch {
+    return false;
+  }
+});
+
 // Read version from package.json to avoid hardcoded mismatch
 const _pkgVersion = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), 'package.json'), 'utf8')).version;
 // Factory so each MCP session (in HTTP mode) gets its own McpServer — McpServer is single-connection.
@@ -3068,6 +3136,9 @@ server.tool(
       _addOwnedURL(trackUrl);
     }
     if (!requestedUrl) _markBlankTabOpened();
+    // safari.js still holds the marker (and, for a blank tab, the URL) of the previous tab;
+    // its AppleScript fallback would go back there.
+    if (!viaAppleScript) safari.setActiveTabFromExtension(safeResult?.tabIndex, requestedUrl);
     // The eviction used to be stderr-only, so a session learned about its closed tab from
     // the next "receipt … stale" error. Say it in the response instead.
     const out = evicted && safeResult && typeof safeResult === "object"
@@ -3086,7 +3157,10 @@ server.tool(
   },
   async ({ receipt, url }) => {
     const supplied = receipt || url || "";
-    const token = _receiptToken(supplied) || _getActiveReceipt();
+    // Only a close that names no receipt closes the current tab. One the server cannot parse
+    // ("<old receipt>", a token cut below 24 characters, a page URL) fell through to the current
+    // tab's receipt, and the tab the caller was still working in closed instead of the one it named.
+    const token = supplied ? _receiptToken(supplied) : _getActiveReceipt();
     if (supplied && !token) return errorResult("Tab safety: invalid tab receipt");
     const closesCurrent = !token || token === _getActiveReceipt();
     const marker = safari.getActiveTabMarker();
@@ -3094,12 +3168,23 @@ server.tool(
     const result = await extensionOrFallback(
       "close_tab",
       token ? { receipt: token } : {},
-      () => { viaAppleScript = true; return safari.closeTab(); }
+      () => {
+        if (token) throw _receiptNeedsExtension("close_tab");
+        viaAppleScript = true;
+        return safari.closeTab();
+      }
     );
-    // AppleScript closed the tab carrying the session's marker; the extension, the receipt's.
+    // The extension closed the receipt's tab; AppleScript, the tab carrying the session's marker.
     _untrackClosedTab(viaAppleScript ? { marker } : { receipt: token });
     // Closing another tab by its receipt leaves the current one current.
     if (viaAppleScript || closesCurrent) _clearActiveReceipt();
+    // AppleScript's closeTab() forgets the tab it closed. After the extension's close, safari.js
+    // still tracked the closed tab by index and URL, and that index now names whichever tab
+    // shifted into it.
+    if (!viaAppleScript && closesCurrent) {
+      safari.setActiveTabIndex(null);
+      safari.setActiveTabURL(null);
+    }
     return textResult(result);
   }
 );
@@ -3128,7 +3213,6 @@ server.tool(
     }
 
     // Tab ownership check: verify target tab is one we opened
-    let adopted = false;
     // `_ownedTabURLs.size > 0` alone skipped this whole lookup for a session that had opened
     // nothing — fine while switch_tab could only reach owned tabs, but adoption (#92) has to
     // work from a cold session, which is precisely the "read the article in my current tab"
@@ -3153,35 +3237,51 @@ server.tool(
           // user's tab. Require BOTH — the index we opened AND the origin we
           // opened it on. That mirrors the origin
           // boundary the extension keeps on its own receipts, so nothing that
-          // would survive the extension's check is lost here, and the AppleScript
-          // fallback (which has no ownership check of its own) stays guarded.
+          // would survive the extension's check is lost here. A URL still proves
+          // nothing about WHICH tab this is, so the AppleScript fallback also needs
+          // the session's marker on the tab (safari.js switchTab()).
           const trackedOrigin = _originOf(_trackedAtIndex(index)?.url);
           const isTrackedRedirect = !!trackedOrigin && trackedOrigin === _originOf(target.url);
-          if (!isBlankOwned && !isTrackedRedirect && allowUserTabs()) {
-            // The opt-in turns this refusal into a deliberate, named adoption (#92). Both
-            // spellings of the URL go in: the tool layer hands callers the query-stripped
-            // form and later compares against it, while list_tabs reported the raw one.
-            _adoptUserTab(target.url);
-            _adoptUserTab(_safeUrlForOutput(target.url));
-            adopted = true;
-            console.error(`[Safari MCP] switch_tab adopted ${_safeUrlForOutput(target.url)} (user tab, opted-in via SAFARI_MCP_ALLOW_USER_TABS)`);
-          } else if (!isBlankOwned && !isTrackedRedirect) {
+          if (!isBlankOwned && !isTrackedRedirect && !allowUserTabs()) {
             const msg = `⚠️ Tab safety: refusing switch_tab to index ${index} (${_safeUrlForOutput(target.url)}) — not opened by this MCP session. Use safari_new_tab to open your own tab, or set SAFARI_MCP_ALLOW_USER_TABS=1 to let switch_tab adopt a tab you already had open.`;
             console.error(`[Safari MCP] ${msg}`);
             return errorResult(msg);
           }
+          // With the opt-in the switch goes ahead, and the AppleScript fallback below adopts the tab (#92).
         }
       } catch {}
     }
+    let viaAppleScript = false;
     const result = await extensionOrFallback(
       "switch_tab", token ? { ...(index ? { index } : {}), receipt: token } : { index },
-      () => safari.switchTab(index)
+      async () => {
+        if (token) throw _receiptNeedsExtension("switch_tab");
+        viaAppleScript = true;
+        try {
+          return await safari.switchTab(index);
+        } catch (err) {
+          // switchTab() claims only a tab carrying a marker of this session. With the opt-in, any
+          // other tab is adopted instead (#92): it gets the session's adoption marker, which it
+          // keeps wherever it navigates, and which no close accepts. The URL check above passes
+          // the user's tab on a URL the session owns, so only this marker tells it apart.
+          if (!err?.unproven || !allowUserTabs()) throw err;
+        }
+        const claimed = await safari.switchTab(index, { adopt: true });
+        console.error(`[Safari MCP] switch_tab adopted ${_safeUrlForOutput(safari.getActiveTabURL())} (user tab, opted-in via SAFARI_MCP_ALLOW_USER_TABS)`);
+        return claimed;
+      }
     );
+    // Adopted just now, or earlier: switchTab() keeps an adopted tab's marker.
+    const adopted = viaAppleScript && safari.isActiveTabAdopted();
     const safeResult = _sanitizeTabResult(result);
     // Sync safari.js state so AppleScript fallback targets the correct tab
     const resolvedIndex = safeResult?.tabIndex || index;
     if (resolvedIndex) safari.setActiveTabIndex(resolvedIndex);
     if (safeResult?.safeUrl) safari.setActiveTabURL(safeResult.safeUrl);
+    // …including the marker, which still names the last tab AppleScript claimed.
+    if (!viaAppleScript && safeResult && typeof safeResult === "object") {
+      safari.setActiveTabFromExtension(resolvedIndex, safeResult.safeUrl);
+    }
     if (safeResult?.receipt || token) _setActiveReceipt(safeResult?.receipt || token);
     // A switch by INDEX gets no receipt back, and the session was still holding the one it
     // minted for the PREVIOUS tab. Every later command auto-attaches that receipt, so the
@@ -3226,56 +3326,87 @@ server.tool(
   },
   async ({ timeout, urlContains }) => {
     const timeoutMs = timeout || 10000;
+    // Every listing says where it came from. AppleScript lists one window, the one its first
+    // listing read (`win`), and a claim through AppleScript goes to that window: listings of
+    // whichever window was in front made a tab of the user's other window look new, and the
+    // claim stamped the session's own marker on it. A listing from the other source starts the
+    // comparison over instead of comparing tabs across them.
+    let win = null;
+    const list = async () => {
+      let via = "extension";
+      const raw = await extensionOrFallback("list_tabs", {}, async () => {
+        via = "applescript";
+        const listed = await safari.listWindowTabs(win);
+        win = listed.win;
+        return listed.tabs;
+      });
+      return { via, tabs: typeof raw === "string" ? JSON.parse(raw) : raw };
+    };
     // Switch to the new tab and own it for THIS session, else the next interaction trips the
     // tab-safety guard. Its marker names it only if AppleScript made the switch (and stamped
-    // it); the extension answers with the tab's receipt instead.
-    const adopt = async (t) => {
+    // it); the extension answers with the tab's receipt instead. AppleScript claims only a tab
+    // its own listing of the pinned window saw: an index the extension listed is a position in
+    // the extension's window, not in the one AppleScript would stamp.
+    const adopt = async (t, via) => {
       let viaAppleScript = false;
       const switched = _sanitizeTabResult(await extensionOrFallback(
         "switch_tab", { index: t.index },
-        () => { viaAppleScript = true; return safari.switchTab(t.index); }
+        () => {
+          viaAppleScript = true;
+          if (via !== "applescript" || !win) {
+            throw new Error("Tab safety: the new tab was seen by the Safari extension, which could not switch to it, and AppleScript cannot tell which tab of its own window that is. Retry safari_wait_for_new_tab.");
+          }
+          return safari.switchTab(t.index, { claim: true, win });
+        }
       ));
       safari.setActiveTabIndex(t.index);
       safari.setActiveTabURL(t.url);
-      _trackTab(t.index, t.url, `${SESSION_ID}:${currentSessionId()}`, viaAppleScript ? safari.getActiveTabMarker() : "", switched?.receipt);
+      if (!viaAppleScript) safari.setActiveTabFromExtension(t.index, t.url);
+      // A "new" tab can be one adopted from the user that moved or navigated while this waited.
+      // It stays adopted, and recording it among the tabs this session opened would hand it to
+      // the tab cap and the shutdown cleanup, which close those.
+      if (!safari.isActiveTabAdopted()) {
+        _trackTab(t.index, t.url, `${SESSION_ID}:${currentSessionId()}`, viaAppleScript ? safari.getActiveTabMarker() : "", switched?.receipt);
+      }
       _setActiveReceipt(switched?.receipt);
       return { content: [{ type: "text", text: `Found new tab: ${t.title} (${t.url})` }] };
     };
     // Get current tab list
-    const beforeRaw = await extensionOrFallback("list_tabs", {}, () => safari.listTabs());
-    const beforeTabs = typeof beforeRaw === 'string' ? JSON.parse(beforeRaw) : beforeRaw;
-    const beforeIds = new Set(beforeTabs.map(t => `${t.index}:${t.url}`));
-    const beforeCount = beforeTabs.length;
+    let before = await list();
+    let beforeIds = new Set(before.tabs.map(t => `${t.index}:${t.url}`));
 
     // Poll for new tab — detect by count increase + new entries (handles about:blank tabs)
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       await new Promise(r => setTimeout(r, 500));
-      const nowRaw = await extensionOrFallback("list_tabs", {}, () => safari.listTabs());
-      const nowTabs = typeof nowRaw === 'string' ? JSON.parse(nowRaw) : nowRaw;
-      if (nowTabs.length > beforeCount) {
+      const now = await list();
+      if (now.via !== before.via) {
+        before = now;
+        beforeIds = new Set(now.tabs.map(t => `${t.index}:${t.url}`));
+        continue;
+      }
+      if (now.tabs.length > before.tabs.length) {
         // Find the new tab(s) — could be about:blank initially (OAuth popups)
-        for (const tab of nowTabs) {
+        for (const tab of now.tabs) {
           if (!beforeIds.has(`${tab.index}:${tab.url}`)) {
             // Wait for about:blank to resolve to actual URL — dynamic polling instead of fixed delay
             if (tab.url === 'about:blank') {
               let resolved = null;
               for (let attempt = 0; attempt < 10; attempt++) {
                 await new Promise(r => setTimeout(r, 300)); // 300ms intervals, max 3s total
-                const refreshed = await extensionOrFallback("list_tabs", {}, () => safari.listTabs());
-                const refreshedTabs = typeof refreshed === 'string' ? JSON.parse(refreshed) : refreshed;
-                resolved = refreshedTabs.find(t => t.index === tab.index);
+                const refreshed = await list();
+                resolved = refreshed.via === now.via ? refreshed.tabs.find(t => t.index === tab.index) : null;
                 if (resolved && resolved.url !== 'about:blank') break;
                 resolved = null;
               }
               if (resolved && resolved.url !== 'about:blank') {
                 if (urlContains && !resolved.url.includes(urlContains)) continue;
-                return await adopt(resolved);
+                return await adopt(resolved, now.via);
               }
               continue;
             }
             if (urlContains && !tab.url.includes(urlContains)) continue;
-            return await adopt(tab);
+            return await adopt(tab, now.via);
           }
         }
       }
@@ -3558,7 +3689,7 @@ server.tool(
 
 server.tool(
   "safari_run_script",
-  "Batch Safari actions in one MCP session. Named profiles use the verified extension and support: newTab, switchTab, getReceipt, listTabs, closeTab, navigate, navigateAndRead, readPage, snapshot, getElementInfo, querySelectorAll, waitFor, waitForTime, click, clickAndOpenPopup, fill, fillForm, clearField, typeText, selectOption, pressKey, scroll, scrollTo, scrollToElement, hover, evaluate, reload, goBack, goForward. switchTab accepts an index or an opaque receipt; a valid receipt recovers the exact owned tab across Safari windows without focusing one. clickAndOpenPopup takes exactly one selector or snapshot ref, targets one exact frame, performs one click, captures a blocked HTTP(S) window.open, and opens it as a background tab without focusing Safari; it refuses CAPTCHA/challenge targets and never returns URL query/hash data. Non-profile mode retains the legacy action set. Use getReceipt after a cross-origin redirect.",
+  "Batch Safari actions in one MCP session. Named profiles use the verified extension and support: newTab, switchTab, getReceipt, listTabs, closeTab, navigate, navigateAndRead, readPage, snapshot, getElementInfo, querySelectorAll, waitFor, waitForTime, click, clickAndOpenPopup, fill, fillForm, clearField, typeText, selectOption, pressKey, scroll, scrollTo, scrollToElement, hover, evaluate, reload, goBack, goForward. switchTab accepts an index or an opaque receipt; a valid receipt recovers the exact owned tab across Safari windows without focusing one. clickAndOpenPopup takes exactly one selector or snapshot ref, targets one exact frame, performs one click, captures a blocked HTTP(S) window.open, and opens it as a background tab without focusing Safari; it refuses CAPTCHA/challenge targets and never returns URL query/hash data. Non-profile mode retains the legacy action set; there, closeTab and switchTab take a tab index, not a receipt. Use getReceipt after a cross-origin redirect.",
   {
     steps: z.array(z.object({
       action: z.string().describe("Action name (e.g. 'navigate', 'click', 'fill')"),
@@ -3582,9 +3713,41 @@ server.tool(
           }
           return;
         }
-        if (!_RUNSCRIPT_OWNERSHIP_EXEMPT.has(action)) _assertTabOwnership(`run_script:${action}`);
+        // These steps run through AppleScript here, which cannot tell which tab a receipt names:
+        // closeTab closed the session's current tab in its place, and switchTab claimed a tab
+        // with no index at all.
+        if ((action === "closeTab" || action === "switchTab") &&
+            (stepArgs?.receipt || stepArgs?.receiptUrl || stepArgs?.url)) {
+          throw new Error(
+            `Tab safety: without SAFARI_PROFILE, run_script's ${action} runs through AppleScript, which ` +
+            `cannot tell which tab a receipt names. Pass the receipt to safari_${action === "closeTab" ? "close_tab" : "switch_tab"} instead.`
+          );
+        }
+        // A switch that cannot happen stops the batch: the steps after it were meant for the tab
+        // it names, and would run in the current one instead.
+        if (action === "switchTab") {
+          const idx = Number(stepArgs?.index);
+          if (!Number.isInteger(idx) || idx < 1) {
+            throw new Error("Tab safety: run_script's switchTab needs the tab's index (a positive integer).");
+          }
+        }
+        // A closeTab step is a close_tab, so every refusal that belongs to closing applies to it,
+        // the one for a tab adopted from the user included (#92, condition 2).
+        if (!_RUNSCRIPT_OWNERSHIP_EXEMPT.has(action)) {
+          _assertTabOwnership(action === "closeTab" ? "close_tab" : `run_script:${action}`);
+        }
+      };
+      // A tab the extension opened carries a marker only once AppleScript has needed it as the
+      // current tab, so switchTab() cannot prove the others. The extension can, by the tab's id.
+      const switchTab = async ({ index }) => {
+        try {
+          return await safari.switchTab(index);
+        } catch (err) {
+          if (!err?.unproven || !_extensionConnected) throw err;
+          return _runExtensionBatchAction("switchTab", { index: Number(index) });
+        }
       };
-      return textResult(await safari.runScript({ steps, onStep }));
+      return textResult(await safari.runScript({ steps, onStep, actions: { switchTab } }));
     }
 
     // Keep every step in one MCP request/session and route it through

package/ownership-state.js

@@ -62,10 +62,6 @@ export function _saveOwnershipFile(urls, removed = []) {
     const mergedTs = new Map();
     for (const e of _loadOwnershipFile()) mergedTs.set(e.url, e.ts);
     for (const url of urls) {
-      // Adopted user tabs (#92) are session-local by construction — see _adoptUserTab. This
-      // is the one place that writes the file, so the exclusion belongs here rather than at
-      // each caller: _pruneExpiredOwnership() also saves, and it does not know about adoption.
-      if (_adoptedTabURLs.has(url)) continue;
       const localTs = _ownedTabTimestamps.get(url) ?? now;
       mergedTs.set(url, Math.max(localTs, mergedTs.get(url) ?? 0));
     }
@@ -160,39 +156,16 @@ export function _markBlankTabOpened() {
 // opt-in safe, and an ambient op landing on whatever tab is frontmost is the exact failure
 // the guards were built against. Read from the environment on each call so a host can flip
 // it without a restart and so tests need no module reload.
+//
+// Nothing here records an adoption. A URL cannot tell the adopted tab from another tab on
+// the same page, and the adopted tab can navigate to a URL the session owns. safari.js marks
+// the tab itself instead, with the session's adoption marker (isActiveTabAdopted()), in the
+// per-session state: nothing reaches the shared ownership file or another session.
 export function allowUserTabs() {
   const v = String(process.env.SAFARI_MCP_ALLOW_USER_TABS || "").trim().toLowerCase();
   return v === "1" || v === "true" || v === "yes" || v === "on";
 }
 
-// URLs adopted from the user, as opposed to opened by this session. Two rules ride on this
-// set: closing is refused for every member (#68 — a wrong close costs the user work that a
-// wrong read never does), and nothing in it is ever written to the shared ownership file.
-export const _adoptedTabURLs = new Set();
-
-// Adoption is in-memory ONLY. owned-tabs.json is shared by every safari-mcp process on the
-// machine and outlives this session, so a persisted adoption would hand the user's tab to
-// the next process — one that has no _adoptedTabURLs entry and would therefore let
-// close_tab through. Session-local is also the honest lifetime: the opt-in is "act on the
-// tab I pointed you at", not "own it from now on".
-export function _adoptUserTab(url) {
-  if (!allowUserTabs()) return false;
-  if (!url || url === "about:blank" || url === "missing value" || url === "favorites://") return false;
-  _adoptedTabURLs.add(url);
-  if (!_ownedTabTimestamps.has(url)) _ownedTabTimestamps.set(url, Date.now());
-  _ownedTabURLs.add(url);
-  return true;
-}
-
-export function _isAdoptedURL(url) {
-  if (!url) return false;
-  if (_adoptedTabURLs.has(url)) return true;
-  // The caller may hold the query-stripped form of the URL (origin+pathname) that the tool
-  // layer hands back, while adoption recorded the raw one, or the reverse. Both name the
-  // same adopted document, and only a refusal hangs off this answer.
-  return findOwnedMatch(url, _adoptedTabURLs) !== null;
-}
-
 export function _addOwnedURL(url) {
   if (url && url !== "about:blank" && url !== "favorites://") {
     if (!_ownedTabTimestamps.has(url)) _ownedTabTimestamps.set(url, Date.now());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.22.3",
+  "version": "2.22.5",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 98 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari-helper.swift

@@ -781,7 +781,7 @@ func handleLine(_ line: String) {
   }
 
   // Handle window-scoped AX press
-  // {"axpressWindow": {"window": "בננה בוק", "title": "Save"}}
+  // {"axpressWindow": {"window": "Example Window", "title": "Save"}}
   if let apw = json["axpressWindow"] as? [String: Any],
      let wm = apw["window"] as? String, let title = apw["title"] as? String {
     if let denied = ensurePostEventAccess() { respond(denied); return }