apple-tools-mcp 2.0.0 → 2.0.1

package/lib/contactsWrite.js

@@ -76,7 +76,7 @@ function childLines(items, kind, personVar) {
 }
 
 function failure(action, summary, result, secrets = []) {
-  if (result.kind === "tcc") {
+  if (result.kind === "tcc" || result.kind === "timeout") {
     return `${action} failed — attempted to ${summary}. ${CONTACTS_TCC_GUIDANCE}`;
   }
   const raw = String(result.error || "");

package/lib/eventKitSession.js

@@ -0,0 +1,369 @@
+/**
+ * Long-lived EventKit JXA worker.
+ *
+ * writeOnly (EKAuthorizationStatus = 4) can create an EKEvent and read
+ * identifiers off that in-memory object, but cannot re-query via
+ * eventWithIdentifier / calendarItemsWithExternalIdentifier — Mini 2cdf44d
+ * failed add on a post-save lookup even though create returned ids.
+ *
+ * The indexer daemon therefore keeps one osascript process around and
+ * caches the EKEvent objects from create so edit/remove can call
+ * saveEvent / removeEvent without a fetch.
+ *
+ * stdin/stdout: one JSON object per line. Never interpolates commands
+ * into a shell (`spawn`, `shell: false`).
+ */
+
+import { spawn } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+let singleton = null;
+
+export function setEventKitSession(session) {
+  singleton = session || null;
+}
+
+export function getEventKitSession() {
+  return singleton;
+}
+
+export function shouldStartEventKitSession({
+  platform = process.platform,
+  env = process.env
+} = {}) {
+  if (platform !== "darwin") return false;
+  if (env.VITEST) return false;
+  if (env.APPLE_TOOLS_EVENTKIT_SESSION === "0") return false;
+  return true;
+}
+
+/**
+ * JXA worker: create caches the EKEvent; update/remove use the cache.
+ * create does not call findEventByIds.
+ */
+export function sessionPaths(home = process.env.HOME || "") {
+  const root = home ? path.join(home, ".apple-tools-mcp") : path.join(os.tmpdir(), "atm-eventkit");
+  const dir = path.join(root, "eventkit-session");
+  return {
+    root,
+    dir,
+    scriptPath: path.join(root, "eventkit-worker.jxa"),
+    cmdPath: path.join(dir, "cmd.json"),
+    rspPath: path.join(dir, "rsp.json")
+  };
+}
+
+export function buildEventKitWorkerScript(helpers, paths = {}) {
+  const cmdPath = JSON.stringify(paths.cmdPath || "");
+  const rspPath = JSON.stringify(paths.rspPath || "");
+  return `ObjC.import("EventKit");
+ObjC.import("Foundation");
+${helpers}
+
+var store = $.EKEventStore.alloc.init;
+var cache = {};
+
+function remember(ev) {
+  if (!ev) return;
+  var keys = [
+    jsString(ev.eventIdentifier),
+    jsString(ev.calendarItemIdentifier),
+    jsString(ev.calendarItemExternalIdentifier)
+  ];
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i]) cache[keys[i]] = ev;
+  }
+}
+
+function forget(ev) {
+  var keys = [];
+  for (var k in cache) keys.push(k);
+  for (var i = 0; i < keys.length; i++) {
+    if (cache[keys[i]] === ev) delete cache[keys[i]];
+  }
+}
+
+function resolve(ids) {
+  if (!ids) return null;
+  for (var i = 0; i < ids.length; i++) {
+    var id = ids[i];
+    if (id && cache[id]) return cache[id];
+  }
+  return findEventByIds(store, ids);
+}
+
+var cmdPath = ${cmdPath};
+var rspPath = ${rspPath};
+
+function writeReply(s) {
+  $.NSString.stringWithString(String(s) + "\\n").writeToFileAtomicallyEncodingError(rspPath, true, $.NSUTF8StringEncoding, null);
+}
+
+function fileExists(p) {
+  try { return !!$.NSFileManager.defaultManager.fileExistsAtPath(p); } catch (e) { return false; }
+}
+
+function readCmd() {
+  var str = $.NSString.stringWithContentsOfFileEncodingError(cmdPath, $.NSUTF8StringEncoding, null);
+  return jsString(str);
+}
+
+function removeCmd() {
+  try { $.NSFileManager.defaultManager.removeItemAtPathError(cmdPath, null); } catch (e) {}
+}
+
+function pickCalendar(calendarName) {
+  var defaultCal = null;
+  try { defaultCal = store.defaultCalendarForNewEvents; } catch (e) {}
+  var cals = null;
+  var count = 0;
+  try {
+    cals = store.calendarsForEntityType($.EKEntityTypeEvent);
+    count = cals ? Number(cals.count) : 0;
+  } catch (e) {}
+  var target = null;
+  var writables = [];
+  var wanted = String(calendarName || "").toLowerCase();
+  function matchesWanted(c) {
+    var t = titleOf(c).toLowerCase();
+    var id = identifierOf(c);
+    return (t && t === wanted) || (id && (id === calendarName || id.toLowerCase() === wanted));
+  }
+  for (var i = 0; i < count; i++) {
+    var c = cals.objectAtIndex(i);
+    var writable = true;
+    try { writable = !!c.allowsContentModifications; } catch (e) {}
+    if (!writable) continue;
+    writables.push(c);
+    if (matchesWanted(c)) {
+      target = c;
+      break;
+    }
+  }
+  if (!target && defaultCal && matchesWanted(defaultCal)) target = defaultCal;
+  if (!target && writables.length === 1) target = writables[0];
+  if (!target && defaultCal) target = defaultCal;
+  var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+  if (!target) {
+    throw new Error("CALENDAR_NOT_FOUND status=" + status + " eventKitCalendars=" + count + " default=" + titleOf(defaultCal) + " defaultId=" + identifierOf(defaultCal));
+  }
+  return target;
+}
+
+function createEvent(cmd) {
+  var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+  if (status === 1 || status === 2) throw new Error("EVENTKIT_DENIED status=" + status);
+  var target = pickCalendar(cmd.calendarName);
+  var event = null;
+  try { event = $.EKEvent.eventWithEventStore(store); } catch (e) {}
+  if (!event) {
+    try { event = $.EKEvent.alloc.initWithEventStore(store); } catch (e2) {}
+  }
+  if (!event) throw new Error("EVENTKIT_NO_EVENT status=" + status);
+  event.title = String(cmd.title || "");
+  event.startDate = $.NSDate.dateWithTimeIntervalSince1970(Number(cmd.startSec));
+  event.endDate = $.NSDate.dateWithTimeIntervalSince1970(Number(cmd.endSec));
+  event.allDay = !!cmd.allDay;
+  try { event.calendar = target; } catch (e) {}
+  try { if (event.setCalendar) event.setCalendar(target); } catch (e) {}
+  if (cmd.location) event.location = String(cmd.location);
+  if (cmd.notes) event.notes = String(cmd.notes);
+  var alerts = cmd.alerts || [];
+  if (alerts && alerts.length) {
+    var alarms = $.NSMutableArray.array;
+    for (var a = 0; a < alerts.length; a++) {
+      alarms.addObject($.EKAlarm.alarmWithRelativeOffset(-Number(alerts[a]) * 60));
+    }
+    event.alarms = alarms;
+  }
+  var err = Ref();
+  var ok = false;
+  try {
+    ok = store.saveEventSpanCommitError(event, $.EKSpanThisEvent, true, err);
+  } catch (e) {
+    throw new Error("EVENTKIT_SAVE_FAILED: " + String(e));
+  }
+  if (!ok) {
+    var desc = "unknown";
+    try { desc = String(err[0]); } catch (e) {}
+    throw new Error("EVENTKIT_SAVE_FAILED: " + desc + " status=" + status);
+  }
+  remember(event);
+  var externalId = "";
+  var localId = "";
+  var itemId = "";
+  try { externalId = jsString(event.calendarItemExternalIdentifier); } catch (e) {}
+  try { localId = jsString(event.eventIdentifier); } catch (e) {}
+  try { itemId = jsString(event.calendarItemIdentifier); } catch (e) {}
+  if (!externalId && !localId && !itemId) throw new Error("EVENTKIT_NO_ID status=" + status);
+  return externalId + "<<>>" + localId + "<<>>" + titleOf(target) + "<<>>" + itemId;
+}
+
+function updateEvent(cmd) {
+  var event = resolve(cmd.ids);
+  if (!event) {
+    var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+    throw new Error("EVENTKIT_NOT_FOUND status=" + status + (status === 4 ? " writeOnly" : "") + " sessionMiss tried=" + (cmd.ids || []).join(","));
+  }
+  if (cmd.title !== undefined && cmd.title !== null) event.title = String(cmd.title);
+  if (cmd.location !== undefined && cmd.location !== null) event.location = String(cmd.location);
+  if (cmd.notes !== undefined && cmd.notes !== null) event.notes = String(cmd.notes);
+  if (cmd.startSec !== undefined && cmd.startSec !== null) {
+    event.startDate = $.NSDate.dateWithTimeIntervalSince1970(Number(cmd.startSec));
+  }
+  if (cmd.endSec !== undefined && cmd.endSec !== null) {
+    event.endDate = $.NSDate.dateWithTimeIntervalSince1970(Number(cmd.endSec));
+  }
+  if (cmd.clearAlerts) {
+    try { event.alarms = $.NSMutableArray.array; } catch (e) {}
+  }
+  var alerts = cmd.alerts || [];
+  if (alerts && alerts.length) {
+    var alarms = $.NSMutableArray.array;
+    for (var a = 0; a < alerts.length; a++) {
+      alarms.addObject($.EKAlarm.alarmWithRelativeOffset(-Number(alerts[a]) * 60));
+    }
+    event.alarms = alarms;
+  }
+  var err = Ref();
+  var ok = store.saveEventSpanCommitError(event, $.EKSpanThisEvent, true, err);
+  if (!ok) {
+    var desc = "unknown";
+    try { desc = String(err[0]); } catch (e) {}
+    throw new Error("EVENTKIT_SAVE_FAILED: " + desc);
+  }
+  remember(event);
+  return jsString(event.eventIdentifier) || jsString(event.calendarItemExternalIdentifier) || "1";
+}
+
+function removeEvent(cmd) {
+  var event = resolve(cmd.ids);
+  if (!event) {
+    var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+    throw new Error("EVENTKIT_NOT_FOUND status=" + status + (status === 4 ? " writeOnly" : "") + " sessionMiss tried=" + (cmd.ids || []).join(","));
+  }
+  var err = Ref();
+  var ok = store.removeEventSpanCommitError(event, $.EKSpanThisEvent, true, err);
+  if (!ok) {
+    var desc = "unknown";
+    try { desc = String(err[0]); } catch (e) {}
+    throw new Error("EVENTKIT_REMOVE_FAILED: " + desc);
+  }
+  forget(event);
+  return "1";
+}
+
+function handle(cmd) {
+  if (!cmd || !cmd.op) throw new Error("EVENTKIT_BAD_CMD");
+  if (cmd.op === "ping") return "pong";
+  if (cmd.op === "create") return createEvent(cmd);
+  if (cmd.op === "update") return updateEvent(cmd);
+  if (cmd.op === "remove") return removeEvent(cmd);
+  if (cmd.op === "quit") return "bye";
+  throw new Error("EVENTKIT_BAD_OP");
+}
+
+while (true) {
+  if (!fileExists(cmdPath)) {
+    delay(0.05);
+    continue;
+  }
+  var line = readCmd();
+  removeCmd();
+  line = String(line || "").replace(/^\\s+|\\s+$/g, "");
+  if (!line) continue;
+  try {
+    var cmd = JSON.parse(line);
+    var output = handle(cmd);
+    writeReply(JSON.stringify({ ok: true, output: String(output == null ? "" : output) }));
+    if (cmd.op === "quit") break;
+  } catch (e) {
+    writeReply(JSON.stringify({ ok: false, error: String(e) }));
+  }
+}
+`;
+}
+
+export function workerScriptPath(home = process.env.HOME || "") {
+  return sessionPaths(home).scriptPath;
+}
+
+export function startEventKitSession({
+  helpers,
+  spawnImpl = spawn,
+  home = process.env.HOME || "",
+  timeoutMs = 30000,
+  sleep = (ms) => {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  }
+} = {}) {
+  if (!helpers) throw new Error("EventKit worker helpers are required");
+  const paths = sessionPaths(home);
+  fs.mkdirSync(paths.dir, { recursive: true, mode: 0o700 });
+  try { fs.unlinkSync(paths.cmdPath); } catch { /* ignore */ }
+  try { fs.unlinkSync(paths.rspPath); } catch { /* ignore */ }
+  fs.writeFileSync(paths.scriptPath, buildEventKitWorkerScript(helpers, paths), { mode: 0o600 });
+
+  const child = spawnImpl("osascript", ["-l", "JavaScript", paths.scriptPath], {
+    stdio: ["ignore", "ignore", "pipe"],
+    shell: false
+  });
+
+  let dead = false;
+  if (child.on) {
+    child.on("exit", () => {
+      dead = true;
+    });
+  }
+
+  function request(cmd, waitMs = timeoutMs) {
+    if (dead) throw new Error("EVENTKIT_SESSION_DEAD");
+    try { fs.unlinkSync(paths.rspPath); } catch { /* ignore */ }
+    fs.writeFileSync(paths.cmdPath, JSON.stringify(cmd), { mode: 0o600 });
+    const deadline = Date.now() + waitMs;
+    while (Date.now() < deadline) {
+      if (fs.existsSync(paths.rspPath)) {
+        const text = fs.readFileSync(paths.rspPath, "utf8").trim();
+        try { fs.unlinkSync(paths.rspPath); } catch { /* ignore */ }
+        return JSON.parse(text);
+      }
+      sleep(20);
+    }
+    throw new Error("EVENTKIT_SESSION_TIMEOUT");
+  }
+
+  const pong = request({ op: "ping" });
+  if (!pong || pong.ok !== true || pong.output !== "pong") {
+    try { child.kill(); } catch { /* ignore */ }
+    throw new Error("EVENTKIT_SESSION_HANDSHAKE");
+  }
+
+  return {
+    request,
+    close() {
+      try { request({ op: "quit" }, 2000); } catch { /* ignore */ }
+      try { child.kill(); } catch { /* ignore */ }
+      dead = true;
+    }
+  };
+}
+
+export function ensureEventKitSession(opts = {}) {
+  if (singleton) return singleton;
+  if (!shouldStartEventKitSession(opts)) return null;
+  try {
+    singleton = startEventKitSession(opts);
+    return singleton;
+  } catch {
+    singleton = null;
+    return null;
+  }
+}
+
+export function closeEventKitSession() {
+  if (!singleton) return;
+  try { singleton.close(); } catch { /* ignore */ }
+  singleton = null;
+}

package/lib/mailWrite.js

@@ -11,7 +11,7 @@
 import fs from "fs";
 import path from "path";
 import { validateEmailPath, unfoldRfc822Headers, safeMatch, stripHtmlTags } from "./validators.js";
-import { runAppleScript, asString, TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
+import { runAppleScript, asString, MAIL_TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
 import {
   planWrite,
   validateEmailList,
@@ -98,6 +98,42 @@ function recipientLines(addresses, kind) {
     .join("\n");
 }
 
+/**
+ * Ship-gate / first-run probe: the compose verb that hangs when node → Mail
+ * Automation is denied. `tell Mail to get name` is not enough — Mini
+ * diagnosis showed that returns while `make new outgoing message` blocks.
+ * Nothing is sent; the outgoing message is deleted immediately.
+ */
+export const MAIL_AUTOMATION_PROBE_SUBJECT = "ATM Mail Automation probe";
+
+export function buildMailAutomationProbeScript() {
+  return `tell application "Mail"
+  set probe to make new outgoing message with properties {subject:${asString(MAIL_AUTOMATION_PROBE_SUBJECT)}, content:"", visible:false}
+  delete probe
+end tell
+return "OK"`;
+}
+
+/**
+ * Live Mail Apple Events check. Not a dry_run: that path never talks to Mail.
+ * @returns {{ ok: boolean, message: string }}
+ */
+export function probeMailAutomation() {
+  const action = "mail_automation_probe";
+  const summary = "compose a temporary outgoing message in Mail (Automation / Apple Events check; nothing is sent)";
+  const result = runAppleScript(buildMailAutomationProbeScript(), { timeout: 30000, appName: "Mail" });
+  if (!result.ok) {
+    return { ok: false, message: failure(action, summary, result, []) };
+  }
+  return {
+    ok: true,
+    message: writeSuccessMessage(
+      action,
+      "Mail Automation allowed (composed and discarded a temporary outgoing message; nothing was sent)"
+    )
+  };
+}
+
 /**
  * Build the outgoing-message script shared by send and draft.
  *
@@ -136,8 +172,8 @@ function summarizeRecipients(to, cc, bcc) {
 }
 
 function failure(action, summary, result, secrets) {
-  if (result.kind === "tcc") {
-    return `${action} failed — attempted to ${summary}. ${TCC_GUIDANCE}`;
+  if (result.kind === "tcc" || result.kind === "timeout") {
+    return `${action} failed — attempted to ${summary}. ${MAIL_TCC_GUIDANCE}`;
   }
   if (result.kind === "not_found") {
     return `${action} failed — attempted to ${summary}. The message could not be found in Mail. Pass a message_id from a current mail_search result.`;

package/lib/messagesWrite.js

@@ -14,7 +14,7 @@ import fs from "fs";
 import path from "path";
 import { safeSqlite3Json } from "./shell.js";
 import { escapeSQL } from "./validators.js";
-import { runAppleScript, asString, TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
+import { runAppleScript, asString, MESSAGES_TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
 import {
   planWrite,
   normalizeList,
@@ -95,6 +95,38 @@ export function validateAttachmentPath(value) {
   return { filePath: resolved, error: null };
 }
 
+/**
+ * Ship-gate / first-run probe: the Messages Apple Events used before send
+ * (enumerate accounts / service type). `messages_send` dry_run never talks
+ * to Messages. Nothing is sent.
+ */
+export function buildMessagesAutomationProbeScript() {
+  return `tell application "Messages"
+  repeat with acc in accounts
+    try
+      get service type of acc
+    end try
+  end repeat
+end tell
+return "OK"`;
+}
+
+export function probeMessagesAutomation() {
+  const action = "messages_automation_probe";
+  const summary = "enumerate Messages accounts (Automation / Apple Events check; nothing is sent)";
+  const result = runAppleScript(buildMessagesAutomationProbeScript(), { timeout: 30000, appName: "Messages" });
+  if (!result.ok) {
+    return { ok: false, message: failure(action, summary, result, []) };
+  }
+  return {
+    ok: true,
+    message: writeSuccessMessage(
+      action,
+      "Messages Automation allowed (enumerated accounts; nothing was sent)"
+    )
+  };
+}
+
 function serviceHandler() {
   return `on atmService(kind)
   tell application "Messages"
@@ -159,8 +191,8 @@ return "OK"`;
 }
 
 function failure(action, summary, result, secrets) {
-  if (result.kind === "tcc") {
-    return `${action} failed — attempted to ${summary}. ${TCC_GUIDANCE}`;
+  if (result.kind === "tcc" || result.kind === "timeout") {
+    return `${action} failed — attempted to ${summary}. ${MESSAGES_TCC_GUIDANCE}`;
   }
   if (result.kind === "attribution") {
     return `${action} failed — attempted to ${summary}. ${ATTRIBUTION_GUIDANCE}`;

package/lib/shell.js

@@ -109,31 +109,49 @@ export function safeSqlite3Json(dbPath, query, options = {}) {
  * @returns {string} Output from AppleScript
  * @throws {Error} If execution fails
  */
+const OSASCRIPT_LANGUAGES = new Set(["JavaScript"]);
+
 export function safeOsascript(script, options = {}) {
   const {
-    timeout = 30000
+    timeout = 30000,
+    language = null
   } = options;
 
   if (!script || typeof script !== 'string') {
     throw new Error('AppleScript is required');
   }
 
-  // Use -e flag with the script content passed as argument
-  // This is safer than heredoc shell syntax
-  const result = spawnSync('osascript', ['-e', script], {
+  const args = [];
+  if (language) {
+    if (!OSASCRIPT_LANGUAGES.has(language)) {
+      throw new Error(`Unsupported osascript language: ${language}`);
+    }
+    args.push("-l", language);
+  }
+  args.push("-e", script);
+
+  // Use -e with the script as an argument (never a shell string).
+  const result = spawnSync('osascript', args, {
     encoding: 'utf-8',
     timeout,
     shell: false
   });
 
+  const stderr = String(result.stderr || "").trim().slice(0, 500);
+
   if (result.error) {
+    if (stderr) {
+      const wrapped = new Error(`${result.error.message}; osascript stderr: ${stderr}`);
+      wrapped.code = result.error.code;
+      throw wrapped;
+    }
     throw result.error;
   }
 
   // osascript may return non-zero for certain operations
   // Return stdout if we have it, otherwise throw
   if (result.status !== 0 && !result.stdout) {
-    const errorMsg = result.stderr || `osascript exited with code ${result.status}`;
+    const errorMsg = stderr || `osascript exited with code ${result.status}`;
     throw new Error(errorMsg);
   }
 

package/lib/writeGuards.js

@@ -44,6 +44,7 @@ const EMAIL_RE = /^[A-Za-z0-9._%+'-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{
 const PHONE_RE = /^[+(]?[0-9(][0-9 ().-]{4,24}$/;
 const MESSAGE_ID_RE = /^<?[A-Za-z0-9!#$%&'*+/=?^_{|}~.@-]{1,500}>?$/;
 const EVENT_UID_RE = /^[A-Za-z0-9._:@+-]{1,255}$/;
+const EVENTKIT_ID_RE = /^[A-Za-z0-9._:@+/=-]{1,500}$/;
 const CONTACT_ID_RE = /^[A-Za-z0-9._:-]{1,255}$/;
 const CHAT_GUID_RE = /^[A-Za-z0-9;:+._@-]{1,255}$/;
 const LABEL_RE = /^[A-Za-z][A-Za-z ]{0,19}$/;
@@ -80,6 +81,13 @@ export function validateEventId(value) {
   return EVENT_UID_RE.test(trimmed) ? trimmed : null;
 }
 
+/** EventKit `eventIdentifier` (may include /RID= for recurrences). */
+export function validateEventKitId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return EVENTKIT_ID_RE.test(trimmed) ? trimmed : null;
+}
+
 export function validateContactId(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();

package/lib/writeRouting.js

@@ -63,7 +63,7 @@ export function planAfterDelegation({ delivered, response }) {
  */
 export function tccFallbackAdvice({ bridgeAvailable }) {
   if (bridgeAvailable) {
-    return "The indexer daemon was reachable but the write was still denied; grant the daemon's node binary Full Disk Access (reads) and Allow node in System Settings > Privacy & Security > Automation for Contacts.app and Calendar.app. Do not add node via + in the Contacts or Calendars privacy lists — those panes often have no Add button.";
+    return "The indexer daemon was reachable but the write was still denied; grant the daemon's node binary Full Disk Access (reads) and Allow node in System Settings > Privacy & Security > Automation for Mail.app, Messages.app, Contacts.app, and Calendar.app. A hang or timeout on Mail compose is TCC / Automation denied, not Mail.app missing. Do not add node via + in the Contacts or Calendars privacy lists — those panes often have no Add button.";
   }
-  return "No indexer daemon is running on this Mac. Start apple-tools-indexer (the LaunchAgent) so writes execute under node, which macOS can grant Contacts/Calendar access to directly.";
+  return "No indexer daemon is running on this Mac. Start apple-tools-indexer (the LaunchAgent) so writes execute under node, which macOS can grant Mail, Messages, Contacts, and Calendar Automation to directly.";
 }

package/lib/writeTools.js

@@ -207,6 +207,7 @@ export const WRITE_TOOL_DEFINITIONS = [
       type: "object",
       properties: {
         event_id: { type: "string", description: "Event ID from calendar_date or calendar_add (required)" },
+        eventkit_id: { type: "string", description: "EventKit eventIdentifier from calendar_add (via EventKit). Prefer this over Calendar.app uid lookup." },
         title: { type: "string", description: "New title" },
         start: { type: "string", description: "New start as YYYY-MM-DD HH:MM local time" },
         end: { type: "string", description: "New end as YYYY-MM-DD HH:MM local time" },
@@ -231,7 +232,9 @@ export const WRITE_TOOL_DEFINITIONS = [
     inputSchema: {
       type: "object",
       properties: {
-        event_id: { type: "string", description: "Event ID from calendar_date (required)" },
+        event_id: { type: "string", description: "Event ID from calendar_date or calendar_add (required)" },
+        eventkit_id: { type: "string", description: "Optional EventKit eventIdentifier returned by calendar_add (via EventKit). Needed so writeOnly EventKit can delete the event it created." },
+        calendar_name: { type: "string", description: "Optional calendar from calendar_list_calendars; narrows the AppleScript delete so Calendar does not scan every calendar" },
         ...CONFIRM_PROPS
       },
       required: ["event_id"]
@@ -327,6 +330,13 @@ export const WRITE_TOOL_HANDLERS = {
   contacts_remove: contactsRemove
 };
 
+/**
+ * Smoke-only helpers, never MCP write tools. CallTool uses isWriteTool, so
+ * these names must stay off WRITE_TOOL_HANDLERS or a client can invoke them
+ * without dry_run / confirm.
+ */
+export const SMOKE_ONLY_AUTOMATION_PROBES = ["mail_automation_probe", "messages_automation_probe"];
+
 export const WRITE_TOOL_NAMES = Object.keys(WRITE_TOOL_HANDLERS);
 
 export function isWriteTool(name) {
@@ -368,7 +378,7 @@ export async function dispatchWriteTool(name, args = {}, deps = {}) {
     log = () => {}
   } = deps;
 
-  if (!isWriteTool(name)) {
+  if (SMOKE_ONLY_AUTOMATION_PROBES.includes(name) || !isWriteTool(name)) {
     return { ok: false, message: `Unknown write tool: ${name}` };
   }
 
@@ -389,7 +399,12 @@ export async function dispatchWriteTool(name, args = {}, deps = {}) {
   }
 
   const result = runLocally(name, args);
-  if (result && result.ok === false && isTccDenial(result.message)) {
+  if (
+    result &&
+    result.ok === false &&
+    result.suppressTccAdvice !== true &&
+    isTccDenial(result.message)
+  ) {
     return { ...result, message: `${result.message} ${tccFallbackAdvice({ bridgeAvailable })}` };
   }
   return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",