apple-mail-mcp 2.10.25 → 2.10.26

package/README.md

@@ -824,6 +824,11 @@ List attachments on a message.
 
 Save a message attachment to disk.
 
+The destination must not already exist: `save-attachment` fails closed instead
+of overwriting an existing file. AppleScript and MIME fallback paths stage the
+bytes privately, commit with an exclusive create, and leave the saved file
+owner-readable/writable (`0600`).
+
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
 | `id` | string | Yes | Message ID |

package/build/index.js

@@ -77516,6 +77516,8 @@ var StdioServerTransport = class {
 // src/services/appleMailManager.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import {
+  constants as fsConstants,
+  chmodSync,
   existsSync as existsSync3,
   writeFileSync as writeFileSync3,
   readFileSync as readFileSync2,
@@ -78375,8 +78377,11 @@ function resolveAttachmentSaveTarget(savePath, attachmentName) {
   if (!isPathWithinAllowedRoots(savedPath)) {
     throw new Error(`Output path "${savedPath}" is outside allowed directories`);
   }
-  if (existsSync3(savedPath) && lstatSync(savedPath).isSymbolicLink()) {
-    throw new Error(`Refusing to overwrite symbolic link "${savedPath}"`);
+  if (existsSync3(savedPath)) {
+    if (lstatSync(savedPath).isSymbolicLink()) {
+      throw new Error(`Refusing to overwrite symbolic link "${savedPath}"`);
+    }
+    throw new Error(`Refusing to overwrite existing file "${savedPath}"`);
   }
   return { saveDirectory, savedPath };
 }
@@ -81162,7 +81167,21 @@ ${this.errorEmit("              ")}
       return false;
     }
     const safeName = escapeForAppleScript(attachmentName);
-    const safePath = escapeForAppleScript(target.saveDirectory);
+    let temporaryDirectory;
+    try {
+      temporaryDirectory = mkdtempSync2(join4(target.saveDirectory, ".apple-mail-mcp-"));
+    } catch (error2) {
+      console.error(`Failed to create attachment staging directory: ${error2}`);
+      return false;
+    }
+    const temporaryPath = join4(temporaryDirectory, "attachment");
+    const safeTemporaryPath = escapeForAppleScript(temporaryPath);
+    const cleanupTemporaryDirectory = () => {
+      try {
+        rmSync2(temporaryDirectory, { recursive: true, force: true });
+      } catch {
+      }
+    };
     const numericId = Number(id);
     const script = buildAppLevelScript(`
       try
@@ -81174,7 +81193,7 @@ ${this.errorEmit("              ")}
                 set msg to item 1 of matchingMsgs
                 repeat with att in mail attachments of msg
                   if name of att is "${safeName}" then
-                    set savePath to POSIX file "${safePath}/${safeName}"
+                    set savePath to POSIX file "${safeTemporaryPath}"
                     save att in savePath
                     return "ok"
                   end if
@@ -81191,8 +81210,18 @@ ${this.errorEmit("              ")}
     `);
     const result = executeAppleScript(script, { timeoutMs: 6e4 });
     if (result.success && result.output === "ok") {
-      return true;
+      try {
+        copyFileSync(temporaryPath, target.savedPath, fsConstants.COPYFILE_EXCL);
+        chmodSync(target.savedPath, 384);
+        cleanupTemporaryDirectory();
+        return true;
+      } catch (err) {
+        cleanupTemporaryDirectory();
+        console.error(`Failed to commit attachment to disk: ${err}`);
+        return false;
+      }
     }
+    cleanupTemporaryDirectory();
     const rawSource = this.getRawSource(id);
     if (!rawSource) {
       console.error(`Failed to save attachment: could not retrieve message source`);
@@ -81203,12 +81232,24 @@ ${this.errorEmit("              ")}
       console.error(`Failed to save attachment: "${attachmentName}" not found in MIME source`);
       return false;
     }
+    let mimeTemporaryDirectory;
     try {
-      writeFileSync3(target.savedPath, attachment.data);
+      mimeTemporaryDirectory = mkdtempSync2(join4(target.saveDirectory, ".apple-mail-mcp-"));
+      const mimeTemporaryPath = join4(mimeTemporaryDirectory, "attachment");
+      writeFileSync3(mimeTemporaryPath, attachment.data, { flag: "wx", mode: 384 });
+      copyFileSync(mimeTemporaryPath, target.savedPath, fsConstants.COPYFILE_EXCL);
+      chmodSync(target.savedPath, 384);
       return true;
     } catch (err) {
       console.error(`Failed to write attachment to disk: ${err}`);
       return false;
+    } finally {
+      if (mimeTemporaryDirectory) {
+        try {
+          rmSync2(mimeTemporaryDirectory, { recursive: true, force: true });
+        } catch {
+        }
+      }
     }
   }
   /**
@@ -85676,7 +85717,7 @@ registerTool(
       if (!r.success || !r.base64) {
         return errorResponse(r.error || `Failed to fetch attachment "${attachmentName}"`);
       }
-      writeFileSync4(target.savedPath, Buffer.from(r.base64, "base64"));
+      writeFileSync4(target.savedPath, Buffer.from(r.base64, "base64"), { flag: "wx", mode: 384 });
       return successResponse(`Attachment "${attachmentName}" saved to ${savePath}`, {
         ok: true,
         attachmentName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-mail-mcp",
-  "version": "2.10.25",
+  "version": "2.10.26",
   "description": "MCP server for Apple Mail - read, search, send, and manage emails via Claude and other AI assistants",
   "type": "module",
   "main": "build/index.js",