I built a guard that refused to read the user's tab. Then my own cleanup code closed it.

Three days ago my browser automation tool closed one of my own tabs. Not a tab it had opened — a dashboard I had open in another window, with a page I hadn't finished reading. What makes it worth writing up isn't the bug. It's that the guard designed to prevent exactly this had already fired, correctly, ninety seconds earlier. The guard worked Safari MCP lets an AI agent drive your real, logged-in Safari. That premise means the single worst thing it can do is act on a tab you're using. So there's an identity system: every tab the tool opens gets a marker stamped into window.name , which survives navigation, redirects, and cross-origin loads. Before running anything in a tab, the tool checks the marker. I was filling in a form. The URL was a forms.gle shortlink, which 302s to docs.google.com — a cross-origin redirect that, it turns out, drops window.name . My next read came back refused: Tab tracking lost — refusing to target the user's current tab. Correct. Exactly the intended behaviour. The tool no longer knew which tab was its own, so it declined to guess. So I did the tidy thing and cleaned up my orphaned tab: safari_close_tab It closed a different tab. One of mine. The tool went from "I can't prove which tab is mine, so I won't read" to "let me close a tab" in one step, and nobody stopped it. The shape of the hole Here is the close path as it existed: if ( _st (). activeTabIndex ) { await osascript ( `... close tab ${ _st (). activeTabIndex } of ${ window } ` ); } else { await osascript ( `... close current tab of ${ window } ` ); // ← the user's tab } current tab of window is whatever the user is looking at. So the fallback for "I don't know which tab is mine" was "close theirs." That branch is only reachable when the index is unknown — which is precisely the state the guard had just announced. The two pieces of code were describing the same condition and disagreeing about what it meant. Three layers, one mistake When I went looking, the same fail-open was in