achiya-automation/safari-mcp

Fixed

Two paths could run caller-supplied JavaScript on a tab this session does not own.

The atomic identity guard — the only check that does not depend on how the tab index was resolved — was built at a single call site instead of where the script is assembled. Two targeted paths went without it:

• runJS's ghost-recovery retry dropped the prefix. That retry fires after the index has already proven wrong, which made the least trustworthy path the only unchecked one.
• runJSLarge never carried it at all — that is safari_upload_file and safari_paste_image, the largest payloads in the toolset.

The guard now lives in _tabIdentityGuard() and every tab-targeted path uses it. runJSLarge fails closed instead of retrying: re-running a file payload on a freshly re-resolved tab is the exact guess the guard exists to prevent. (#64)

Security

Transitive dependency bumps clearing the production audit gate — fast-uri 3.1.4 (2× high, host confusion), hono 4.12.31, @hono/node-server 1.19.14.