apple-notes-mcp 2.15.16 → 2.15.18

package/README.md

@@ -2444,6 +2444,13 @@ after it finishes. The result carries `verifiedBy: "database"`. Without Full
 Disk Access a PDF attach reports "insertion outcome uncertain"; read the note
 before retrying, because the attachment was probably created.
 
+Notes.app's AppleScript insertion places every new attachment in the note body
+twice (#321): one attachment, shown two times. The tool removes the extra copy
+in the same AppleScript call and checks that the note lists the attachment once.
+A PDF on macOS 27 cannot be listed, so its extra copy cannot be removed; when the
+database shows the PDF twice, the tool returns an error naming the attachment.
+Delete the extra copy in Notes.app and do not attach the file again.
+
 ---
 
 #### `create-note-with-attachment`

package/build/index.js

@@ -45558,7 +45558,7 @@ function visit(schema, fnOrHandlers) {
   return run(schema);
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -48573,7 +48573,7 @@ function date4(params) {
   return _coercedDate(ZodDate2, params);
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -50104,7 +50104,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -51393,7 +51393,7 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -51435,7 +51435,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -52412,7 +52412,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -52480,7 +52480,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -52693,7 +52693,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -52728,7 +52728,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -53099,7 +53099,7 @@ var Server = class extends Protocol {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -53113,7 +53113,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/uriTemplate.js
 var MAX_TEMPLATE_LENGTH = 1e6;
 var MAX_VARIABLE_LENGTH = 1e6;
 var MAX_TEMPLATE_EXPRESSIONS = 1e4;
@@ -53335,7 +53335,7 @@ var UriTemplate = class _UriTemplate {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -53393,7 +53393,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 var ExperimentalMcpServerTasks = class {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -53408,7 +53408,7 @@ var ExperimentalMcpServerTasks = class {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 function toolInputElementCount(value, max) {
   let count = 0;
   const stack = [value];
@@ -53457,6 +53457,15 @@ var McpServer = class {
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
     this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
+    if (options?.capabilities?.tools) {
+      this.setToolRequestHandlers();
+    }
+    if (options?.capabilities?.resources) {
+      this.setResourceRequestHandlers();
+    }
+    if (options?.capabilities?.prompts) {
+      this.setPromptRequestHandlers();
+    }
   }
   /**
    * Access experimental features.
@@ -54264,10 +54273,10 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "node:process";
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
   constructor(options) {
@@ -54304,7 +54313,7 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.2_zod@4.6.7/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
   constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
@@ -57545,25 +57554,35 @@ function parseAttachmentRows(json3) {
   }
   return rows.sort((a, b) => a.pk - b.pk);
 }
-function attachmentOrderFromNoteData(hex5) {
+function attachmentRunsFromNoteData(hex5) {
   if (!hex5 || !/^[0-9a-f]+$/i.test(hex5)) return null;
   try {
     const data = gunzipSync5(Buffer.from(hex5, "hex"), { maxOutputLength: MAX_BODY_BYTES });
     const wrapper = embeddedMessage(getField(decodeMessage(data), 2));
     const body = wrapper && embeddedMessage(getField(wrapper, 3));
     if (!body) return null;
-    const ids = [];
+    const refs = [];
     for (const run of getFields(body, 5)) {
       const fields = embeddedMessage(run);
       const info = fields && embeddedMessage(getField(fields, 12));
       const id2 = info && stringValue(getField(info, 1));
-      if (id2 && !ids.some((seen) => seen.toLowerCase() === id2.toLowerCase())) ids.push(id2);
+      if (!id2) continue;
+      const length = varintValue(getField(fields, 1)) ?? 1;
+      for (let i = 0; i < Math.min(Math.max(length, 1), 64); i++) refs.push(id2);
     }
-    return ids;
+    return refs;
   } catch {
     return null;
   }
 }
+function attachmentOrderFromNoteData(hex5) {
+  const refs = attachmentRunsFromNoteData(hex5);
+  if (!refs) return null;
+  const ids = [];
+  for (const id2 of refs)
+    if (!ids.some((seen) => seen.toLowerCase() === id2.toLowerCase())) ids.push(id2);
+  return ids;
+}
 function readNoteAttachmentRows(noteId3, dbPath2 = join9(NOTES_CONTAINER_DIR, "NoteStore.sqlite")) {
   const { pk } = parseNoteId2(noteId3);
   const columnList = runSqlite3(
@@ -57587,7 +57606,8 @@ function readNoteAttachmentRows(noteId3, dbPath2 = join9(NOTES_CONTAINER_DIR, "N
   } catch {
     throw new AttachmentStoreError("Attachment rows could not be parsed", "query_error");
   }
-  return { rows, bodyOrder: attachmentOrderFromNoteData(lines[2]?.trim()) };
+  const bodyRefs = attachmentRunsFromNoteData(lines[2]?.trim());
+  return { rows, bodyOrder: attachmentOrderFromNoteData(lines[2]?.trim()), bodyRefs };
 }
 function safeComponent(value) {
   if (typeof value !== "string" || !value || value.length > 255) return null;
@@ -57750,13 +57770,16 @@ function assetPathsFor(accountDir, row, onStale) {
     add(file2);
   return found;
 }
-function assembleAttachmentAssets(allRows, bodyOrder, containerDir = NOTES_CONTAINER_DIR) {
+function assembleAttachmentAssets(allRows, bodyOrder, containerDir = NOTES_CONTAINER_DIR, bodyRefs = null) {
   const rows = allRows.filter((r) => !r.parentDeleted);
   const byPk = new Map(rows.map((r) => [r.pk, r]));
   const roots = rows.filter((r) => r.parentPk === null || !byPk.has(r.parentPk));
   const bodyIndex = /* @__PURE__ */ new Map();
   (bodyOrder ?? []).forEach((id2, index) => bodyIndex.set(id2.toLowerCase(), index));
   const indexOf = (r) => bodyIndex.get(r.identifier.toLowerCase()) ?? null;
+  const refCount = /* @__PURE__ */ new Map();
+  for (const id2 of bodyRefs ?? [])
+    refCount.set(id2.toLowerCase(), (refCount.get(id2.toLowerCase()) ?? 0) + 1);
   const inBody = roots.filter((r) => indexOf(r) !== null);
   const orderSource = inBody.length > 0 ? "body" : "creation";
   const orderedRoots = [
@@ -57790,6 +57813,7 @@ function assembleAttachmentAssets(allRows, bodyOrder, containerDir = NOTES_CONTA
       parentIdentifier: parent?.identifier ?? null,
       filename: row.filename ?? row.mediaFilename,
       bodyIndex: parent ? null : indexOf(row),
+      ...!parent && (refCount.get(row.identifier.toLowerCase()) ?? 0) > 1 ? { bodyReferences: refCount.get(row.identifier.toLowerCase()) } : {},
       assetPaths,
       ...fallbackStale ? { fallbackStale: true } : {},
       previewPath,
@@ -60082,7 +60106,17 @@ var AppleNotesManager = class {
     if (!result.success) throw new Error(result.error || "Could not check folder existence");
     return result.output.trim() === "true";
   }
-  /** Insert one file into an unchanged exact note and return Notes' attachment ID. */
+  /**
+   * Insert one file into an unchanged exact note and return Notes' attachment ID.
+   *
+   * Notes.app's `make new attachment` writes the new attachment into the note
+   * body twice (#321): one attachment object, two body references, so the file
+   * shows twice. Every form of the command does it (`at n`, `at end of
+   * attachments of n`, `tell n to make`, an alias), and `every attachment of n`
+   * then lists the same id twice. Deleting the extra entries by index removes
+   * only their body references; the attachment object and its file stay. The
+   * cleanup runs in the same AppleScript so no other edit can interleave.
+   */
   addAttachmentById(id2, expectedBody, filePath) {
     if (!/^x-coredata:\/\/[0-9a-f-]+\/ICNote\/p\d+$/i.test(id2))
       throw new Error("Exact note ID required");
@@ -60094,7 +60128,16 @@ var AppleNotesManager = class {
         if body of n is not ${quote(expectedBody)} and body of n is not (${quote(expectedBody)} & linefeed) then error "Note changed before attachment insertion"
       end considering
       set a to make new attachment at n with data (POSIX file ${quote(filePath)})
-      return id of a
+      set newId to id of a
+      set hits to {}
+      set attachmentIds to id of every attachment of n
+      repeat with i from 1 to count of attachmentIds
+        if item i of attachmentIds is newId then set end of hits to i
+      end repeat
+      repeat with j from (count of hits) to 2 by -1
+        delete attachment (item j of hits) of n
+      end repeat
+      return newId
     end tell`);
     if (!result.success)
       throw new Error(
@@ -60102,6 +60145,27 @@ var AppleNotesManager = class {
       );
     return result.output.trim();
   }
+  /**
+   * How many entries Notes' `every attachment` holds for one attachment id
+   * (#321). Read-only. Notes on macOS 27 does not list PDF attachments, so a PDF
+   * counts 0 here; the NoteStore database is the check for those.
+   */
+  countAttachmentEntriesById(noteId3, attachmentId) {
+    if (!/^x-coredata:\/\/[0-9a-f-]+\/ICAttachment\/p\d+$/i.test(attachmentId))
+      throw new Error("Exact attachment ID required");
+    const result = executeAppleScript(`tell application "Notes"
+      set attachmentIds to id of every attachment of note id "${sanitizeId(noteId3)}"
+      set hits to 0
+      repeat with i from 1 to count of attachmentIds
+        if item i of attachmentIds is "${attachmentId}" then set hits to hits + 1
+      end repeat
+      return hits as text
+    end tell`);
+    if (!result.success) throw new Error(result.error || "Could not count attachment entries");
+    const hits = Number(result.output.trim());
+    if (!Number.isInteger(hits) || hits < 0) throw new Error("Unexpected attachment count");
+    return hits;
+  }
   /**
    * Lists all folders in an account with full hierarchical paths.
    *
@@ -61115,8 +61179,8 @@ var AppleNotesManager = class {
    * @throws AttachmentStoreError (`no_fda`, `invalid_id`, `not_found`, `query_error`)
    */
   getAttachmentAssetsById(noteId3) {
-    const { rows, bodyOrder } = readNoteAttachmentRows(noteId3);
-    return assembleAttachmentAssets(rows, bodyOrder);
+    const { rows, bodyOrder, bodyRefs } = readNoteAttachmentRows(noteId3);
+    return assembleAttachmentAssets(rows, bodyOrder, void 0, bodyRefs);
   }
   /**
    * The note's lead visual: the first image in body order (even when its asset
@@ -71253,7 +71317,7 @@ function registerDirectOperations(server2, manager) {
   };
   tool(
     "add-attachment",
-    "Use when: adding one local file to an exact note without replacing its body.\nReturns: the new attachment id, byte count, attachment name, and post-write content hash after exact byte verification.\nDo not use when: reading or exporting an existing attachment.\nSafety: reads only a regular file in home, temp or /Volumes, refusing hidden paths (~/.ssh, .env) and ~/Library outside iCloud Drive and CloudStorage unless the server sets APPLE_NOTES_MCP_ALLOW_PRIVATE_CONTENT_PATHS=1; requires a fresh rich revision, copies at most 64 MiB through a private temporary file, never retries insertion, and verifies existing content plus fetched bytes. On macOS 27 Notes' AppleScript does not list PDF attachments; with Full Disk Access the new attachment is verified through the read-only NoteStore database instead (verifiedBy: database), otherwise the outcome is reported as uncertain.",
+    "Use when: adding one local file to an exact note without replacing its body.\nReturns: the new attachment id, byte count, attachment name, and post-write content hash after exact byte verification.\nDo not use when: reading or exporting an existing attachment.\nSafety: reads only a regular file in home, temp or /Volumes, refusing hidden paths (~/.ssh, .env) and ~/Library outside iCloud Drive and CloudStorage unless the server sets APPLE_NOTES_MCP_ALLOW_PRIVATE_CONTENT_PATHS=1; requires a fresh rich revision, copies at most 64 MiB through a private temporary file, never retries insertion, removes the duplicate copy Notes.app's AppleScript inserts (#321), and verifies existing content plus fetched bytes. On macOS 27 Notes' AppleScript does not list PDF attachments; with Full Disk Access the new attachment is verified through the read-only NoteStore database instead (verifiedBy: database), otherwise the outcome is reported as uncertain. A PDF that Notes shows twice cannot be cleaned up and is reported as an error: delete the extra copy in Notes.app.",
     { id: noteId, expectedContentHash: revision, ...attachmentInput },
     (args) => attachFile(manager, args)
   );
@@ -71392,6 +71456,7 @@ function attachmentName(path10, filename) {
   return filename;
 }
 var UNCERTAIN = "Attachment insertion outcome uncertain; read the exact note before retrying";
+var duplicated = (attachmentId, copies) => `Notes.app put new attachment ${attachmentId} into this note ${copies} times and the extra ${copies === 2 ? "copy" : "copies"} could not be removed automatically; ask the user to delete the extra ${copies === 2 ? "copy" : "copies"} in Notes.app, and do not attach the file again`;
 var pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 var sha256 = (data) => createHash4("sha256").update(data).digest("hex");
 function storedAttachmentIds(manager, id2) {
@@ -71447,6 +71512,7 @@ function storedInsertion(manager, id2, before, bytes, name, returnedId) {
     throw new Error(
       `Notes' database shows new attachment ${attachmentId} on this note, but the note body does not reference it; read the exact note and do not attach the file again`
     );
+  if ((row.bodyReferences ?? 1) > 1) throw new Error(duplicated(attachmentId, row.bodyReferences));
   const expected = sha256(bytes);
   const matches = row.assetPaths.some((path10) => fileMatches(path10, bytes.length, expected));
   if (!matches)
@@ -71497,6 +71563,8 @@ function attachFile(manager, args, checked, progress = { insertionStarted: false
       const saved = manager.saveAttachmentById(id2, attachmentId, verifyPath);
       if (!saved.success || !fileMatches(saved.savedPath ?? verifyPath, bytes.length, sha256(bytes)))
         throw new Error("Attachment bytes were not verified; read the exact note before retrying");
+      const copies = manager.countAttachmentEntriesById(id2, attachmentId);
+      if (copies > 1) throw new Error(duplicated(attachmentId, copies));
     } else {
       const stored = inserted.length === 0 && beforeStored ? storedInsertion(manager, id2, beforeStored, bytes, name, returnedId) : null;
       if (!stored)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-notes-mcp",
-  "version": "2.15.16",
+  "version": "2.15.18",
   "description": "MCP server for Apple Notes - read, search, create, edit, organize, and export notes on macOS via Claude and other AI assistants",
   "type": "module",
   "main": "build/index.js",