safari-mcp 2.7.1 → 2.7.3

package/README.md

@@ -1,10 +1,6 @@
 <div align="center">
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="assets/banner.svg">
-  <source media="(prefers-color-scheme: light)" srcset="assets/banner.svg">
-  <img src="assets/banner.svg" alt="Safari MCP — Native browser automation for AI agents" width="100%">
-</picture>
+<img src="social-preview.png" alt="Safari MCP Server — 80 native browser automation tools for AI agents on macOS" width="100%">
 
 <br/>
 
@@ -25,6 +21,7 @@
 
 <a href="vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code-Install_MCP_Server-0078d4?logo=visual-studio-code&logoColor=white" alt="Install in VS Code"></a>
 <a href="https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code_Insiders-Install_MCP_Server-24bfa5?logo=visual-studio-code&logoColor=white" alt="Install in VS Code Insiders"></a>
+<a href="https://paypal.me/achiyaC123"><img src="https://img.shields.io/badge/Sponsor-PayPal-blue?logo=paypal" alt="Sponsor"></a>
 
 **80 tools** · **Zero dependencies** · **~5ms per command** · **60% less CPU than Chrome**
 
@@ -533,6 +530,21 @@ The codebase is two files:
 
 ---
 
+## Sponsors
+
+Safari MCP is free and open source. If it saves you time or CPU cycles, consider supporting its development:
+
+<a href="https://paypal.me/achiyaC123"><img src="https://img.shields.io/badge/Sponsor-PayPal-blue?logo=paypal" alt="Sponsor via PayPal"></a>
+
+Your support funds:
+- 🧪 Testing across macOS versions and Safari releases
+- 🛠️ New tools and features
+- 📖 Documentation and examples
+
+[Become the first sponsor!](https://paypal.me/achiyaC123)
+
+---
+
 ## Star History
 
 If Safari MCP saved you from Chrome overhead, consider giving it a ⭐

package/extension/background.js

@@ -5,7 +5,7 @@
 const HTTP_URL = "http://127.0.0.1:9224";
 let isConnected = false;
 let pollAbort = null;
-let _targetProfile = null;   // Profile name from server (e.g. "אוטומציות")
+let _targetProfile = null;   // Profile name from server (e.g. "Automations")
 let _profileWindowId = null; // Discovered windowId for the profile
 let _enabled = true;         // Toggle from popup — when false, stops polling and rejects commands
 let _reconnectTimer = null;  // Single reconnect timer — prevents exponential growth
@@ -1735,7 +1735,7 @@ browser.tabs.onRemoved.addListener((tabId) => {
 
 // Verify this extension instance is running in the expected profile.
 // Safari extensions see only their own profile's windows/tabs.
-// If the server expects "אוטומציות" but this worker's windows don't match, we're in the wrong profile.
+// If the server expects a specific profile but this worker's windows don't match, we're in the wrong profile.
 async function _verifyProfileMatch(expectedProfile) {
   try {
     const allWindows = await browser.windows.getAll({ populate: true });

package/extension/content.js

@@ -1,6 +1,6 @@
 // Content script — runs at document_start in MAIN world (before page scripts)
 // Purpose: Monkey-patch attachShadow to capture CLOSED shadow roots.
-// Without this, Reddit 2026 and other sites using closed shadow DOM
+// Without this, Reddit and other sites using closed shadow DOM
 // are invisible to snapshot/click/fill.
 // Runs in MAIN world via manifest "world": "MAIN" — no script injection needed,
 // so CSP cannot block it.

package/extension/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "Safari MCP Bridge",
   "description": "Connects AI agents to Safari — fast JS execution, screenshots, clicks with your real cookies/logins",
-  "version": "2.4",
+  "version": "2.7.2",
   "icons": {
     "48": "images/icon-48.png",
     "96": "images/icon-96.png",

package/extension/popup/popup.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html dir="ltr">
+<html lang="en" dir="ltr">
 <head>
   <meta charset="utf-8">
   <style>

package/index.js

@@ -3,7 +3,7 @@
 // 1. Safari Web Extension (fast, ~5-20ms, keeps logins) — when extension is connected
 // 2. AppleScript + Swift daemon (~5ms, keeps logins) — always available
 //
-// Extension transport: WebSocket (Chrome) OR HTTP polling (Safari — WebSocket blocked by Apple)
+// Extension transport: HTTP polling (Safari — WebSocket blocked by Apple)
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -84,6 +84,13 @@ function _isURLOwned(url) {
         if (new URL(owned).origin === urlOrigin && urlBase.startsWith(normalize(owned))) return true;
       } catch {}
     }
+    // Broader same-origin check: if we own ANY URL on this origin, treat all same-origin URLs as owned.
+    // This handles redirects like /article/new → /article/edit/ID where path prefix doesn't match.
+    for (const owned of _ownedTabURLs) {
+      try {
+        if (new URL(owned).origin === urlOrigin) return true;
+      } catch {}
+    }
   } catch {}
   return false;
 }
@@ -386,6 +393,14 @@ try {
           const { execFile: execFileCb } = await import("node:child_process");
           const { promisify: pfy } = await import("node:util");
           const execFileAsync = pfy(execFileCb);
+          // Don't launch Safari if it's not running
+          try {
+            await execFileAsync("pgrep", ["-x", "Safari"], { timeout: 2000 });
+          } catch {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ match: false, error: "Safari is not running" }));
+            return;
+          }
           const script = `tell application "Safari"
             repeat with w in every window
               repeat with t in every tab of w
@@ -635,15 +650,19 @@ async function extensionOrFallback(extensionType, extensionPayload, fallbackFn)
   // must target an owned tab. This prevents navigating/clicking in user's tabs.
   if (!_noOwnershipCheck.has(extensionType)) {
     const currentUrl = safari.getActiveTabURL();
-    if (_ownedTabURLs.size === 0) {
+    if (_ownedTabURLs.size === 0 && _openedTabs.size === 0) {
       // No tabs opened yet — block everything except read-only ops
       const msg = `⚠️ Tab safety: no tabs opened yet. Call safari_new_tab first before "${extensionType}".`;
       console.error(`[Safari MCP] ${msg}`);
       throw new Error(msg);
     } else if (currentUrl && !_isURLOwned(currentUrl)) {
-      const msg = `⚠️ Tab safety: refusing "${extensionType}" — current tab (${currentUrl}) was not opened by this MCP session. Use safari_new_tab or safari_switch_tab to target your own tab.`;
-      console.error(`[Safari MCP] ${msg}`);
-      throw new Error(msg);
+      // about:blank tabs are owned if we have any tracked tabs (new_tab creates them at about:blank)
+      const isBlankOwned = (currentUrl === 'about:blank' || currentUrl === 'missing value') && _openedTabs.size > 0;
+      if (!isBlankOwned) {
+        const msg = `⚠️ Tab safety: refusing "${extensionType}" — current tab (${currentUrl}) was not opened by this MCP session. Use safari_new_tab or safari_switch_tab to target your own tab.`;
+        console.error(`[Safari MCP] ${msg}`);
+        throw new Error(msg);
+      }
     }
   }
   if (_extensionConnected && !_preferAppleScript) {
@@ -1203,9 +1222,13 @@ server.tool(
         const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
         const target = parsed.find(t => t.index === index);
         if (target && target.url && !_isURLOwned(target.url)) {
-          const msg = `⚠️ Tab safety: refusing switch_tab to index ${index} (${target.url}) — not opened by this MCP session. Use safari_new_tab to open your own tab.`;
-          console.error(`[Safari MCP] ${msg}`);
-          return { content: [{ type: "text", text: msg }], isError: true };
+          // about:blank / missing value tabs are owned if tracked in _openedTabs
+          const isBlankOwned = (target.url === 'about:blank' || target.url === 'missing value') && _openedTabs.has(index);
+          if (!isBlankOwned) {
+            const msg = `⚠️ Tab safety: refusing switch_tab to index ${index} (${target.url}) — not opened by this MCP session. Use safari_new_tab to open your own tab.`;
+            console.error(`[Safari MCP] ${msg}`);
+            return { content: [{ type: "text", text: msg }], isError: true };
+          }
         }
       } catch {}
     }

package/mcp-helpers.js

@@ -1,7 +1,7 @@
 // MCP Click/Interaction Helpers — injected into every page
 // This file is loaded by safari.js at startup, escaped, and injected via AppleScript `do JavaScript`.
 // It is also used by the extension's execInTab for the AppleScript fallback path.
-// IMPORTANT: Keep this file compatible with all browsers — no ES6+ modules, use var where possible.
+// IMPORTANT: Keep compatible with all browsers — no ES6+ modules, use var where possible.
 
 if (window.__mcpVersion !== 5) {
   window.__mcpVersion = 5;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.7.1",
+  "version": "2.7.3",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 80 tools via AppleScript + JavaScript.",
   "type": "module",
@@ -39,8 +39,8 @@
   "license": "MIT",
   "homepage": "https://achiya-automation.com",
   "funding": {
-    "type": "github",
-    "url": "https://github.com/sponsors/achiya-automation"
+    "type": "individual",
+    "url": "https://paypal.me/achiyaC123"
   },
   "repository": {
     "type": "git",

package/safari.js

@@ -89,6 +89,21 @@ function cleanupHelper() {
 process.on("exit", cleanupHelper);
 process.on("uncaughtException", (err) => { console.error("Uncaught:", err); cleanupHelper(); process.exit(1); });
 
+// ========== SAFARI RUNNING CHECK ==========
+// Prevent AppleScript from auto-launching Safari when it's closed
+async function isSafariRunning() {
+  try {
+    const { stdout } = await execFileAsync("pgrep", ["-x", "Safari"], { timeout: 2000 });
+    return stdout.trim().length > 0;
+  } catch {
+    return false; // pgrep exits 1 when no match
+  }
+}
+
+function safariNotRunningError() {
+  return new Error("Safari is not running. Open Safari manually before using Safari MCP tools.");
+}
+
 // ========== CLIPBOARD LOCK ==========
 // Prevents concurrent clipboard operations from clobbering the user's clipboard.
 // While locked, any new clipboard operation waits until the current one completes.
@@ -326,6 +341,7 @@ async function resolveActiveTab() {
 
 // Run AppleScript — uses execFile (safe, isolated, for complex scripts)
 async function osascript(script, { timeout = 10000 } = {}) {
+  if (!(await isSafariRunning())) throw safariNotRunningError();
   try {
     const { stdout } = await execFileAsync("osascript", ["-e", script], {
       timeout,
@@ -349,6 +365,7 @@ async function osascript(script, { timeout = 10000 } = {}) {
 
 // osascriptFast: uses persistent Swift daemon (~5ms) — 18x faster than subprocess (~90ms)
 async function osascriptFast(script, { timeout = 10000 } = {}) {
+  if (!(await isSafariRunning())) throw safariNotRunningError();
   if (!_helperProc) startHelper();
   if (_helperProc) {
     try {
@@ -659,7 +676,7 @@ export async function navigate(url) {
         const state = await runJS('document.readyState', { timeout: 5000 });
         if (state === 'complete' || state === 'interactive') {
           result = await runJS(
-            `JSON.stringify({title:document.title,url:location.href,blocked:document.title.includes('cannot open')||document.title.includes('אין אפשרות')})`,
+            `JSON.stringify({title:document.title,url:location.href,blocked:document.title.includes('cannot open')||document.title.includes('\u05D0\u05D9\u05DF \u05D0\u05E4\u05E9\u05E8\u05D5\u05EA')})`,
             { timeout: 5000 }
           );
           if (state === 'complete') break;
@@ -2069,7 +2086,7 @@ export async function uploadFile({ selector, filePath }) {
               click button "Cancel" of sheet 1 of w
             on error
               try
-                click button "ביטול" of sheet 1 of w
+                click button "\u05D1\u05D9\u05D8\u05D5\u05DC" of sheet 1 of w  -- "Cancel" in Hebrew locale
               on error
                 key code 53
               end try

package/extension/popup/popup.js

@@ -1,57 +0,0 @@
-// v6 — asks background script for real-time status, falls back to storage
-async function checkStatus() {
-  const enabled = await getVal("mcpEnabled", true);
-  document.getElementById("enableToggle").checked = enabled;
-
-  if (!enabled) {
-    setStatus("paused", "Paused", "Toggle to resume");
-    return;
-  }
-
-  // Ask background script for real-time status
-  try {
-    const resp = await browser.runtime.sendMessage({ action: "getStatus" });
-    if (resp) {
-      if (resp.connected) { setStatus("connected", "Connected", "Port 9224"); return; }
-      if (!resp.enabled) { setStatus("paused", "Paused", "Toggle to resume"); return; }
-    }
-  } catch {}
-
-  // Fallback: read from storage
-  const status = await getVal("mcpStatus", "checking");
-  switch (status) {
-    case "connected":
-      setStatus("connected", "Connected", "Port 9224");
-      break;
-    case "paused":
-      setStatus("paused", "Paused", "Toggle to resume");
-      break;
-    case "checking":
-      setStatus("checking", "Connecting...", "Trying port 9224...");
-      break;
-    default:
-      setStatus("disconnected", "Not connected", "Start the MCP server to connect");
-  }
-}
-
-function setStatus(dotClass, text, info) {
-  document.getElementById("statusDot").className = "dot " + dotClass;
-  document.getElementById("statusText").textContent = text;
-  document.getElementById("info").textContent = info;
-}
-
-document.getElementById("enableToggle").addEventListener("change", async (e) => {
-  const enabled = e.target.checked;
-  await browser.storage.local.set({ mcpEnabled: enabled });
-  try { browser.runtime.sendMessage({ action: "setEnabled", enabled }); } catch {}
-  setTimeout(checkStatus, 500);
-});
-
-async function getVal(key, defaultVal) {
-  try {
-    const data = await browser.storage.local.get(key);
-    return data[key] !== undefined ? data[key] : defaultVal;
-  } catch { return defaultVal; }
-}
-
-checkStatus();