apple-tools-mcp 2.0.0 → 2.0.2

package/lib/calendarWrite.js

@@ -15,11 +15,15 @@ import {
   parseWriteDateTime,
   DATE_HANDLER,
   CALENDAR_TCC_GUIDANCE,
-  ATTRIBUTION_GUIDANCE
+  CALENDAR_APP_NOT_RUNNING_GUIDANCE,
+  ATTRIBUTION_GUIDANCE,
+  formatOsascriptDiagnostic,
+  isHardTccDenial
 } from "./appleScript.js";
 import {
   planWrite,
   validateEventId,
+  validateEventKitId,
   validateCalendarName,
   validateBody,
   validateSubject,
@@ -29,6 +33,11 @@ import {
   normalizeList,
   truncate
 } from "./writeGuards.js";
+import {
+  ensureEventKitSession,
+  getEventKitSession,
+  setEventKitSession
+} from "./eventKitSession.js";
 
 export const RECURRENCE_FREQUENCIES = ["daily", "weekly", "monthly", "yearly"];
 export const RECURRENCE_DAYS = ["MO", "TU", "WE", "TH", "FR", "SA", "SU"];
@@ -176,16 +185,19 @@ function alarmLines(minutes, eventVar) {
 }
 
 function failure(action, summary, result, secrets = []) {
-  if (result.kind === "tcc") {
+  if (result.kind === "tcc" || result.kind === "timeout") {
     return `${action} failed — attempted to ${summary}. ${CALENDAR_TCC_GUIDANCE}`;
   }
   const raw = String(result.error || "");
   if (raw.includes("CALENDAR_NOT_FOUND")) {
     return `${action} failed — attempted to ${summary}. That calendar does not exist; call calendar_list_calendars first.`;
   }
-  if (raw.includes("EVENT_NOT_FOUND")) {
+  if (result.kind === "not_found" || raw.includes("EVENT_NOT_FOUND")) {
     return `${action} failed — attempted to ${summary}. No event with that id was found; use the Event ID from calendar_date.`;
   }
+  if (result.kind === "app_not_running") {
+    return `${action} failed — attempted to ${summary}. ${CALENDAR_APP_NOT_RUNNING_GUIDANCE}`;
+  }
   if (result.kind === "attribution") {
     return `${action} failed — attempted to ${summary}. ${ATTRIBUTION_GUIDANCE}`;
   }
@@ -195,6 +207,435 @@ function failure(action, summary, result, secrets = []) {
   return writeErrorMessage(action, summary, new Error(raw || "unknown error"), secrets);
 }
 
+/**
+ * calendar_remove must never hide the AppleEvent code behind TCC copy.
+ * Mini --apply: add/edit PASS then remove FAIL looked like a TCC deny
+ * because failure() dropped stderr when classify mapped ETIMEDOUT/-1712
+ * to tcc. Same write-bridge RPC as add/edit; not a different calendar
+ * account. Calendar.app has no `remove` / `move to trash` — only `delete`.
+ */
+export function describeCalendarRemoveFailure(action, summary, appleResult, eventKitResult = null) {
+  const parts = [`AppleScript ${formatOsascriptDiagnostic(appleResult, "osascript")}`];
+  if (eventKitResult) {
+    parts.push(`EventKit ${formatOsascriptDiagnostic(eventKitResult, "osascript")}`);
+  }
+  const diagnostics = parts.join(" ");
+  const raw = String(appleResult.error || "");
+  const hardTcc = isHardTccDenial(raw);
+  const timedOut =
+    appleResult.kind === "timeout" ||
+    /delete_timeout|etimedout|-1712|appleevent timed out|timed out after/i.test(raw);
+
+  let head;
+  if (raw.includes("CALENDAR_NOT_FOUND")) {
+    head = `${action} failed — attempted to ${summary}. That calendar does not exist; call calendar_list_calendars first.`;
+  } else if (hardTcc) {
+    head = `${action} failed — attempted to ${summary}. ${CALENDAR_TCC_GUIDANCE}`;
+  } else if (timedOut) {
+    head = `${action} failed — attempted to ${summary}. Calendar.app delete timed out. That is not a TCC / Automation deny when calendar_add/calendar_edit succeed on this host — Calendar.app has no remove or move-to-trash; iCloud/CalDAV delete can hang or wait on a confirmation dialog.`;
+  } else if (appleResult.kind === "not_found" || raw.includes("EVENT_NOT_FOUND")) {
+    head = `${action} failed — attempted to ${summary}. No event with that id was found; use the Event ID from calendar_date.`;
+  } else if (appleResult.kind === "app_not_running") {
+    head = `${action} failed — attempted to ${summary}. ${CALENDAR_APP_NOT_RUNNING_GUIDANCE}`;
+  } else if (appleResult.kind === "attribution") {
+    head = `${action} failed — attempted to ${summary}. ${ATTRIBUTION_GUIDANCE}`;
+  } else if (appleResult.kind === "app_unavailable") {
+    head = `${action} failed — attempted to ${summary}. Calendar.app could not be reached on this host.`;
+  } else {
+    head = writeErrorMessage(action, summary, new Error(raw || "unknown error"));
+  }
+
+  return {
+    ok: false,
+    message: `${head} ${diagnostics}`,
+    suppressTccAdvice: !hardTcc,
+    diagnostics
+  };
+}
+
+/**
+ * Non-recurring add must not fall through to Calendar.app: Mini writeOnly
+ * EventKit cannot delete AppleScript-created events, and Calendar.app
+ * delete hangs (ETIMEDOUT). Fail closed with the EventKit code.
+ */
+export function describeCalendarAddFailure(action, summary, eventKitResult) {
+  const diagnostics = `EventKit ${formatOsascriptDiagnostic(eventKitResult)}`;
+  const raw = String(eventKitResult && eventKitResult.error ? eventKitResult.error : "");
+  const hardTcc = isHardTccDenial(raw) || /eventkit_denied/i.test(raw);
+  let head;
+  if (raw.includes("CALENDAR_NOT_FOUND")) {
+    head = `${action} failed — attempted to ${summary}. EventKit could not target that calendar (writeOnly often cannot list calendars; we use defaultCalendarForNewEvents). Call calendar_list_calendars first.`;
+  } else if (hardTcc) {
+    head = `${action} failed — attempted to ${summary}. ${CALENDAR_TCC_GUIDANCE}`;
+  } else {
+    head = `${action} failed — attempted to ${summary}. EventKit create failed; non-recurring add does not fall back to Calendar.app because writeOnly EventKit cannot see AppleScript-created events and Calendar.app delete hangs.`;
+  }
+  return {
+    ok: false,
+    message: `${head} ${diagnostics}`,
+    suppressTccAdvice: !hardTcc,
+    diagnostics
+  };
+}
+
+export function describeEventKitWriteFailure(action, summary, eventKitResult) {
+  const diagnostics = `EventKit ${formatOsascriptDiagnostic(eventKitResult)}`;
+  const raw = String(eventKitResult && eventKitResult.error ? eventKitResult.error : "");
+  const hardTcc = isHardTccDenial(raw) || /eventkit_denied/i.test(raw);
+  const head = raw.includes("EVENTKIT_NOT_FOUND")
+    ? `${action} failed — attempted to ${summary}. writeOnly EventKit cannot re-query by id; edit/remove need the in-memory EKEvent from the same EventKit session that created it. Calendar.app uid lookup was skipped to avoid an iCloud hang.`
+    : `${action} failed — attempted to ${summary}. EventKit write failed; Calendar.app was not used because eventkit_id was provided.`;
+  return {
+    ok: false,
+    message: `${head} ${diagnostics}`,
+    suppressTccAdvice: !hardTcc,
+    diagnostics
+  };
+}
+
+/**
+ * Mini 74d304e: EventKit status=4 is writeOnly. That grant can create and
+ * delete events *this process* saved, but calendarItemsWithExternalIdentifier
+ * cannot see an event Calendar.app created via AppleScript. Align add→remove
+ * by creating through EventKit and deleting with the same identifiers
+ * (calendarItemExternalIdentifier and eventIdentifier).
+ */
+export function localUnixSeconds(parts) {
+  return Math.floor(new Date(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, 0, 0).getTime() / 1000);
+}
+
+export function parseEventKitAddOutput(output) {
+  const text = String(output || "").trim();
+  if (!text) return { eventId: null, eventKitId: null, calendar: null };
+  const [externalId, eventKitId, calendar, calendarItemId] = text.split("<<>>");
+  const ext = String(externalId || "").trim();
+  const local = String(eventKitId || "").trim();
+  const item = String(calendarItemId || "").trim();
+  return {
+    eventId: ext || local || item || null,
+    eventKitId: local || item || null,
+    calendar: String(calendar || "").trim() || null
+  };
+}
+
+export function parseEventKitCalendarList(output) {
+  return String(output || "")
+    .split("|||")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0)
+    .map((entry) => {
+      const parts = entry.split("<<>>");
+      if (parts.length < 3) return null;
+      const [name, writable, local, sourceType, source] = parts;
+      return {
+        name: name || "",
+        writable: writable !== "no",
+        local: local === "yes",
+        sourceType: sourceType === undefined || sourceType === "" ? null : Number(sourceType),
+        source: source || ""
+      };
+    })
+    .filter(Boolean);
+}
+
+/**
+ * JXA prints NSString as `[id NSTaggedPointerString]` if you `String(title)`.
+ * Mini cd74071: default=[id NSTaggedPointerString] so title match failed
+ * even though eventKitCalendars=1. Always ObjC.unwrap / .js.
+ */
+export const EVENTKIT_JXA_HELPERS = `function jsString(value) {
+  if (value === undefined || value === null) return "";
+  if (typeof value === "string") {
+    if (value.indexOf("[id ") === 0 || value === "[object Object]") return "";
+    return value;
+  }
+  try {
+    if (typeof value.js === "string") return value.js;
+  } catch (e) {}
+  try {
+    var unwrapped = ObjC.unwrap(value);
+    if (typeof unwrapped === "string") return unwrapped;
+  } catch (e) {}
+  return "";
+}
+function titleOf(c) {
+  try { return c ? jsString(c.title) : ""; } catch (e) { return ""; }
+}
+function identifierOf(c) {
+  try { return c ? jsString(c.calendarIdentifier) : ""; } catch (e) { return ""; }
+}
+function asEvent(item) {
+  if (item === undefined || item === null) return false;
+  try { if (item.isKindOfClass && item.isKindOfClass($.EKEvent)) return true; } catch (e) {}
+  try { if (jsString(item.eventIdentifier)) return true; } catch (e) {}
+  try { if (jsString(item.calendarItemExternalIdentifier)) return true; } catch (e) {}
+  try { if (jsString(item.calendarItemIdentifier)) return true; } catch (e) {}
+  return false;
+}
+function nsId(id) {
+  return $.NSString.stringWithString(String(id));
+}
+function firstMatching(items) {
+  if (!items) return null;
+  var n = 0;
+  try { n = Number(items.count); } catch (e) { n = 0; }
+  for (var j = 0; j < n; j++) {
+    var hit = null;
+    try { hit = items.objectAtIndex(j); } catch (e) {}
+    if (asEvent(hit)) return hit;
+  }
+  return null;
+}
+function lookupOne(store, raw) {
+  if (!raw) return null;
+  var bridged = nsId(raw);
+  var candidates = [bridged, raw];
+  for (var k = 0; k < candidates.length; k++) {
+    var id = candidates[k];
+    var ev = null;
+    try { ev = store.eventWithIdentifier(id); } catch (e) {}
+    if (!asEvent(ev)) {
+      try { ev = store.eventWithIdentifier_(id); } catch (e) {}
+    }
+    if (asEvent(ev)) return ev;
+    try {
+      var item = store.calendarItemWithIdentifier(id);
+      if (asEvent(item)) return item;
+    } catch (e) {}
+    try {
+      var item2 = store.calendarItemWithIdentifier_(id);
+      if (asEvent(item2)) return item2;
+    } catch (e) {}
+    try {
+      var found = firstMatching(store.calendarItemsWithExternalIdentifier(id));
+      if (found) return found;
+    } catch (e) {}
+    try {
+      var found2 = firstMatching(store.calendarItemsWithExternalIdentifier_(id));
+      if (found2) return found2;
+    } catch (e) {}
+  }
+  return null;
+}
+function findEventByIds(store, ids) {
+  try { store.refreshSourcesIfNecessary(); } catch (e) {}
+  for (var i = 0; i < ids.length; i++) {
+    var found = lookupOne(store, ids[i]);
+    if (found) return found;
+  }
+  return null;
+}
+`;
+
+/**
+ * Mini ed6d834: eventkit_id is `calendarUUID:eventUUID`. Look up the
+ * compound id and each half so eventWithIdentifier / externalIdentifier
+ * both get a usable string.
+ */
+export function eventKitLookupIds(eventId, eventKitId) {
+  const out = [];
+  const seen = new Set();
+  const add = (value) => {
+    if (typeof value !== "string") return;
+    const trimmed = value.trim();
+    if (!trimmed || seen.has(trimmed)) return;
+    seen.add(trimmed);
+    out.push(trimmed);
+  };
+  add(eventKitId);
+  add(eventId);
+  for (const value of [...out]) {
+    if (value.includes(":")) {
+      for (const part of value.split(":")) add(part);
+    }
+    if (value.includes("/")) add(value.split("/")[0]);
+  }
+  return out;
+}
+
+function eventKitSessionRequest(cmd) {
+  const session = getEventKitSession() || ensureEventKitSession({ helpers: EVENTKIT_JXA_HELPERS });
+  if (!session) return null;
+  try {
+    return session.request(cmd);
+  } catch (e) {
+    try { session.close(); } catch { /* ignore */ }
+    setEventKitSession(null);
+    return { ok: false, error: e && e.message ? e.message : String(e), sessionDead: true };
+  }
+}
+
+export function mergeCalendarSources(appleCalendars, eventKitCalendars) {
+  if (!eventKitCalendars || eventKitCalendars.length === 0) return appleCalendars || [];
+  const byName = new Map(eventKitCalendars.map((c) => [c.name, c]));
+  return (appleCalendars || []).map((c) => {
+    const ek = byName.get(c.name);
+    return {
+      ...c,
+      local: ek ? ek.local : false,
+      sourceType: ek ? ek.sourceType : null,
+      source: ek ? ek.source : null
+    };
+  });
+}
+
+export function buildEventKitListCalendarsScript() {
+  return `ObjC.import("EventKit");
+ObjC.import("Foundation");
+${EVENTKIT_JXA_HELPERS}
+var store = $.EKEventStore.alloc.init;
+var rows = [];
+var seen = {};
+function addRow(c) {
+  if (!c) return;
+  var name = titleOf(c);
+  if (!name || seen[name]) return;
+  seen[name] = true;
+  var src = null;
+  try { src = c.source; } catch (e) {}
+  var type = -1;
+  try { if (src) type = Number(src.sourceType); } catch (e) {}
+  var srcName = "";
+  try { if (src) srcName = jsString(src.title); } catch (e) {}
+  var writable = "yes";
+  try { if (c.allowsContentModifications === false) writable = "no"; } catch (e) {}
+  var local = type === 0 ? "yes" : "no";
+  rows.push(name + "<<>>" + writable + "<<>>" + local + "<<>>" + type + "<<>>" + srcName);
+}
+try {
+  var cals = store.calendarsForEntityType($.EKEntityTypeEvent);
+  for (var i = 0; i < cals.count; i++) addRow(cals.objectAtIndex(i));
+} catch (e) {}
+try { addRow(store.defaultCalendarForNewEvents); } catch (e) {}
+rows.join("|||");`;
+}
+
+export function buildEventKitAddScript({ calendarName, title, start, end, allDay, location, notes, alerts }) {
+  const startSec = localUnixSeconds(start);
+  const endSec = localUnixSeconds(end);
+  return `ObjC.import("EventKit");
+ObjC.import("Foundation");
+${EVENTKIT_JXA_HELPERS}
+var calendarName = ${JSON.stringify(calendarName)};
+var title = ${JSON.stringify(title)};
+var startSec = ${asInteger(startSec, { field: "start" })};
+var endSec = ${asInteger(endSec, { field: "end" })};
+var allDay = ${allDay ? "true" : "false"};
+var location = ${JSON.stringify(location || "")};
+var notes = ${JSON.stringify(notes || "")};
+var alerts = ${JSON.stringify(alerts || [])};
+var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+if (status === 1 || status === 2) {
+  throw new Error("EVENTKIT_DENIED status=" + status);
+}
+var store = $.EKEventStore.alloc.init;
+var defaultCal = null;
+try { defaultCal = store.defaultCalendarForNewEvents; } catch (e) {}
+var cals = null;
+var count = 0;
+try {
+  cals = store.calendarsForEntityType($.EKEntityTypeEvent);
+  count = cals ? Number(cals.count) : 0;
+} catch (e) {}
+var target = null;
+var writables = [];
+var wanted = String(calendarName || "").toLowerCase();
+function matchesWanted(c) {
+  var t = titleOf(c).toLowerCase();
+  var id = identifierOf(c);
+  return (t && t === wanted) || (id && (id === calendarName || id.toLowerCase() === wanted));
+}
+for (var i = 0; i < count; i++) {
+  var c = cals.objectAtIndex(i);
+  var writable = true;
+  try { writable = !!c.allowsContentModifications; } catch (e) {}
+  if (!writable) continue;
+  writables.push(c);
+  if (matchesWanted(c)) {
+    target = c;
+    break;
+  }
+}
+if (!target && defaultCal && matchesWanted(defaultCal)) {
+  target = defaultCal;
+}
+if (!target && writables.length === 1) {
+  target = writables[0];
+}
+if (!target && defaultCal) {
+  target = defaultCal;
+}
+if (!target) {
+  throw new Error("CALENDAR_NOT_FOUND status=" + status + " eventKitCalendars=" + count + " default=" + titleOf(defaultCal) + " defaultId=" + identifierOf(defaultCal));
+}
+var event = null;
+try { event = $.EKEvent.eventWithEventStore(store); } catch (e) {}
+if (!event) {
+  try { event = $.EKEvent.alloc.initWithEventStore(store); } catch (e2) {}
+}
+if (!event) throw new Error("EVENTKIT_NO_EVENT status=" + status);
+event.title = title;
+event.startDate = $.NSDate.dateWithTimeIntervalSince1970(startSec);
+event.endDate = $.NSDate.dateWithTimeIntervalSince1970(endSec);
+event.allDay = allDay;
+try { event.calendar = target; } catch (e) {}
+try { if (event.setCalendar) event.setCalendar(target); } catch (e) {}
+if (location) event.location = location;
+if (notes) event.notes = notes;
+if (alerts && alerts.length) {
+  var alarms = $.NSMutableArray.array;
+  for (var a = 0; a < alerts.length; a++) {
+    alarms.addObject($.EKAlarm.alarmWithRelativeOffset(-Number(alerts[a]) * 60));
+  }
+  event.alarms = alarms;
+}
+var err = Ref();
+var ok = false;
+try {
+  ok = store.saveEventSpanCommitError(event, $.EKSpanThisEvent, true, err);
+} catch (e) {
+  throw new Error("EVENTKIT_SAVE_FAILED: " + String(e));
+}
+if (!ok) {
+  var desc = "unknown";
+  try { desc = String(err[0]); } catch (e) {}
+  throw new Error("EVENTKIT_SAVE_FAILED: " + desc + " status=" + status);
+}
+var externalId = "";
+var localId = "";
+var itemId = "";
+try { externalId = jsString(event.calendarItemExternalIdentifier); } catch (e) {}
+try { localId = jsString(event.eventIdentifier); } catch (e) {}
+try { itemId = jsString(event.calendarItemIdentifier); } catch (e) {}
+if (!externalId && !localId && !itemId) throw new Error("EVENTKIT_NO_ID status=" + status);
+externalId + "<<>>" + localId + "<<>>" + titleOf(target) + "<<>>" + itemId;`;
+}
+
+export function buildEventKitRemoveScript(eventId, { eventKitId = null } = {}) {
+  const ids = eventKitLookupIds(eventId, eventKitId);
+  return `ObjC.import("EventKit");
+ObjC.import("Foundation");
+${EVENTKIT_JXA_HELPERS}
+var ids = ${JSON.stringify(ids)};
+var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+if (status === 1 || status === 2) {
+  throw new Error("EVENTKIT_DENIED status=" + status);
+}
+var store = $.EKEventStore.alloc.init;
+var found = findEventByIds(store, ids);
+if (!found) {
+  throw new Error("EVENTKIT_NOT_FOUND status=" + status + (status === 4 ? " writeOnly" : "") + " tried=" + ids.join(","));
+}
+var err = Ref();
+var ok = store.removeEventSpanCommitError(found, $.EKSpanThisEvent, true, err);
+if (!ok) {
+  var desc = "unknown";
+  try { desc = String(err[0]); } catch (e) {}
+  throw new Error("EVENTKIT_REMOVE_FAILED: " + desc);
+}
+1;`;
+}
+
 /**
  * List calendars so a caller can pick a target instead of defaulting.
  */
@@ -221,7 +662,7 @@ return outputList as string`;
     return { ok: false, message: failure(action, "list calendars", result) };
   }
 
-  const calendars = result.output
+  let calendars = result.output
     .split("|||")
     .map((entry) => entry.trim())
     .filter((entry) => entry.length > 0)
@@ -230,11 +671,26 @@ return outputList as string`;
       return { name: name || "", writable: writable !== "no" };
     });
 
+  const ekList = runAppleScript(buildEventKitListCalendarsScript(), {
+    timeout: 15000,
+    appName: "Calendar",
+    language: "JavaScript"
+  });
+  if (ekList.ok) {
+    calendars = mergeCalendarSources(calendars, parseEventKitCalendarList(ekList.output));
+  }
+
   if (calendars.length === 0) {
     return { ok: true, message: "No calendars found in Calendar.app." };
   }
 
-  const lines = calendars.map((c) => `• ${c.name}${c.writable ? "" : " (read-only)"}`);
+  const lines = calendars.map((c) => {
+    const tags = [];
+    if (!c.writable) tags.push("read-only");
+    if (c.local) tags.push("On My Mac");
+    else if (c.source) tags.push(c.source);
+    return `• ${c.name}${tags.length ? ` (${tags.join(", ")})` : ""}`;
+  });
   return {
     ok: true,
     message: `Calendars (${calendars.length}):\n${lines.join("\n")}\n\nPass one of these names as calendar_name when creating events.`,
@@ -318,6 +774,92 @@ export function calendarAdd(args = {}) {
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
   if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
 
+  // Non-recurring creates MUST go through EventKit. Mini 8be6cd5: EventKit
+  // add failed (likely writeOnly cannot list calendars) and we silently
+  // created via Calendar.app — remove then EVENTKIT_NOT_FOUND status=4 and
+  // Calendar.app delete ETIMEDOUT. No AppleScript fallback here.
+  if (!recurrence.rule) {
+    const sessionReply = eventKitSessionRequest({
+      op: "create",
+      calendarName,
+      title: title.text,
+      startSec: localUnixSeconds(start.parts),
+      endSec: localUnixSeconds(end.parts),
+      allDay,
+      location: location.text || "",
+      notes: notes.text || "",
+      alerts: alerts.minutes
+    });
+    if (sessionReply && sessionReply.ok) {
+      const ids = parseEventKitAddOutput(sessionReply.output);
+      if (ids.eventId) {
+        return {
+          ok: true,
+          message: writeSuccessMessage(action, "event created", {
+            event_id: ids.eventId,
+            eventkit_id: ids.eventKitId || ids.eventId,
+            calendar: ids.calendar || calendarName,
+            via: "EventKit",
+            title: truncate(title.text, 150),
+            start: args.start,
+            alerts: alerts.minutes.length ? alerts.minutes.join(", ") : undefined
+          })
+        };
+      }
+    }
+    if (sessionReply && !sessionReply.ok && !sessionReply.sessionDead) {
+      return describeCalendarAddFailure(action, summary, {
+        ok: false,
+        error: sessionReply.error || "EVENTKIT_SESSION_CREATE_FAILED",
+        kind: "unknown"
+      });
+    }
+
+    // One-shot: return identifiers from the saved EKEvent. Do not re-query —
+    // writeOnly status=4 cannot eventWithIdentifier after save (Mini 2cdf44d).
+    let ek;
+    try {
+      ek = runAppleScript(
+        buildEventKitAddScript({
+          calendarName,
+          title: title.text,
+          start: start.parts,
+          end: end.parts,
+          allDay,
+          location: location.text,
+          notes: notes.text,
+          alerts: alerts.minutes
+        }),
+        { timeout: 30000, appName: "Calendar", language: "JavaScript" }
+      );
+    } catch (e) {
+      ek = { ok: false, error: e && e.message ? e.message : String(e), kind: "unknown" };
+    }
+    if (ek.ok) {
+      const ids = parseEventKitAddOutput(ek.output);
+      if (ids.eventId) {
+        return {
+          ok: true,
+          message: writeSuccessMessage(action, "event created", {
+            event_id: ids.eventId,
+            eventkit_id: ids.eventKitId || ids.eventId,
+            calendar: ids.calendar || calendarName,
+            via: "EventKit",
+            title: truncate(title.text, 150),
+            start: args.start,
+            alerts: alerts.minutes.length ? alerts.minutes.join(", ") : undefined
+          })
+        };
+      }
+      return describeCalendarAddFailure(
+        action,
+        summary,
+        { ok: false, error: `EVENTKIT_NO_ID output=${truncate(ek.output, 120)}`, kind: "unknown" }
+      );
+    }
+    return describeCalendarAddFailure(action, summary, ek);
+  }
+
   let script;
   try {
     script = buildAddEventScript({
@@ -351,6 +893,58 @@ export function calendarAdd(args = {}) {
   };
 }
 
+export function buildEventKitEditScript({
+  eventId,
+  eventKitId = null,
+  updates = {},
+  start = null,
+  end = null,
+  alerts = [],
+  clearAlerts = false
+}) {
+  const ids = eventKitLookupIds(eventId, eventKitId);
+  const title = updates.summary ? JSON.stringify(updates.summary) : "null";
+  const location = updates.location !== undefined ? JSON.stringify(updates.location) : "null";
+  const notes = updates.description !== undefined ? JSON.stringify(updates.description) : "null";
+  const startSec = start ? localUnixSeconds(start) : null;
+  const endSec = end ? localUnixSeconds(end) : null;
+  return `ObjC.import("EventKit");
+ObjC.import("Foundation");
+${EVENTKIT_JXA_HELPERS}
+var ids = ${JSON.stringify(ids)};
+var status = $.EKEventStore.authorizationStatusForEntityType($.EKEntityTypeEvent);
+if (status === 1 || status === 2) {
+  throw new Error("EVENTKIT_DENIED status=" + status);
+}
+var store = $.EKEventStore.alloc.init;
+var event = findEventByIds(store, ids);
+if (!event) {
+  throw new Error("EVENTKIT_NOT_FOUND status=" + status + (status === 4 ? " writeOnly" : "") + " tried=" + ids.join(","));
+}
+var newTitle = ${title};
+var newLocation = ${location};
+var newNotes = ${notes};
+if (newTitle !== null) event.title = newTitle;
+if (newLocation !== null) event.location = newLocation;
+if (newNotes !== null) event.notes = newNotes;
+${startSec !== null ? `event.startDate = $.NSDate.dateWithTimeIntervalSince1970(${asInteger(startSec, { field: "start" })});` : ""}
+${endSec !== null ? `event.endDate = $.NSDate.dateWithTimeIntervalSince1970(${asInteger(endSec, { field: "end" })});` : ""}
+${clearAlerts ? `try { event.alarms = $.NSMutableArray.array; } catch (e) {}` : ""}
+${alerts.length ? `var alarms = $.NSMutableArray.array;
+for (var a = 0; a < ${JSON.stringify(alerts)}.length; a++) {
+  alarms.addObject($.EKAlarm.alarmWithRelativeOffset(-Number(${JSON.stringify(alerts)}[a]) * 60));
+}
+event.alarms = alarms;` : ""}
+var err = Ref();
+var ok = store.saveEventSpanCommitError(event, $.EKSpanThisEvent, true, err);
+if (!ok) {
+  var desc = "unknown";
+  try { desc = String(err[0]); } catch (e) {}
+  throw new Error("EVENTKIT_SAVE_FAILED: " + desc);
+}
+jsString(event.eventIdentifier) || jsString(event.calendarItemExternalIdentifier) || "1";`;
+}
+
 export function buildEditEventScript({ eventId, updates, start, end, rule, alerts, clearAlerts }) {
   const lines = [];
   for (const [prop, value] of Object.entries(updates)) {
@@ -384,6 +978,13 @@ export function calendarEdit(args = {}) {
     return { ok: false, message: `${action} refused: event_id is required (the "Event ID" from calendar_date or calendar_add). This tool will not guess which event you meant.` };
   }
 
+  const eventKitId = args.eventkit_id === undefined || args.eventkit_id === null || args.eventkit_id === ""
+    ? null
+    : validateEventKitId(args.eventkit_id);
+  if (args.eventkit_id && !eventKitId) {
+    return { ok: false, message: `${action} refused: eventkit_id is not a valid EventKit eventIdentifier.` };
+  }
+
   const updates = {};
   const changed = [];
 
@@ -438,6 +1039,66 @@ export function calendarEdit(args = {}) {
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
   if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
 
+  const preferEventKit = Boolean(eventKitId) || eventId.includes(":");
+  if (preferEventKit && !recurrence.rule) {
+    const sessionReply = eventKitSessionRequest({
+      op: "update",
+      ids: eventKitLookupIds(eventId, eventKitId),
+      title: updates.summary,
+      location: updates.location,
+      notes: updates.description,
+      startSec: start ? localUnixSeconds(start) : null,
+      endSec: end ? localUnixSeconds(end) : null,
+      alerts: alerts.minutes,
+      clearAlerts
+    });
+    if (sessionReply && sessionReply.ok) {
+      return {
+        ok: true,
+        message: writeSuccessMessage(action, "event updated", {
+          event_id: eventId,
+          eventkit_id: eventKitId || undefined,
+          via: "EventKit",
+          changed: changed.join(", ")
+        })
+      };
+    }
+    if (sessionReply && !sessionReply.ok && !sessionReply.sessionDead && eventKitId) {
+      return describeEventKitWriteFailure(action, summary, {
+        ok: false,
+        error: sessionReply.error || "EVENTKIT_SESSION_UPDATE_FAILED",
+        kind: "not_found"
+      });
+    }
+
+    const ek = runAppleScript(
+      buildEventKitEditScript({
+        eventId,
+        eventKitId,
+        updates,
+        start,
+        end,
+        alerts: alerts.minutes,
+        clearAlerts
+      }),
+      { timeout: 30000, appName: "Calendar", language: "JavaScript" }
+    );
+    if (ek.ok) {
+      return {
+        ok: true,
+        message: writeSuccessMessage(action, "event updated", {
+          event_id: eventId,
+          eventkit_id: eventKitId || undefined,
+          via: "EventKit",
+          changed: changed.join(", ")
+        })
+      };
+    }
+    if (eventKitId) {
+      return describeEventKitWriteFailure(action, summary, ek);
+    }
+  }
+
   let script;
   try {
     script = buildEditEventScript({
@@ -462,15 +1123,68 @@ export function calendarEdit(args = {}) {
   };
 }
 
-export function buildRemoveEventScript(eventId) {
-  return `${findEventHandler()}
-
-set theEvent to atmFindEvent(${asString(eventId)})
-tell application "Calendar"
-  set removedTitle to summary of theEvent
-  delete theEvent
+/**
+ * Delete via Calendar.app `delete` (the dictionary has no `remove` or
+ * `move to trash`) using the AppleScript event `id` inside the owning
+ * calendar. Do not `delete (every event whose uid …)` — that specifier
+ * hangs on iCloud/CalDAV and Mini's 60s spawnSync timeout was then
+ * classified as TCC. A detached `delete theEvent` after atmFindEvent
+ * is also wrong (-1728). Lookup errors are not swallowed: a failed
+ * delete must surface, then EventKit can run.
+ */
+export function buildRemoveEventScript(eventId, { calendarName = null } = {}) {
+  const uidLit = asString(eventId);
+  const scoped = calendarName
+    ? `  set targetCals to {}
+  repeat with calRef in calendars
+    try
+      set cal to contents of calRef
+      if (name of cal) is ${asString(calendarName)} then
+        set end of targetCals to cal
+        exit repeat
+      end if
+    end try
+  end repeat
+  if (count of targetCals) is 0 then error "CALENDAR_NOT_FOUND"`
+    : `  set targetCals to calendars`;
+
+  return `tell application "Calendar"
+${scoped}
+  repeat with calRef in targetCals
+    set cal to contents of calRef
+    set hits to {}
+    try
+      set hits to (every event of cal whose uid is ${uidLit})
+    end try
+    if (count of hits) > 0 then
+      set theEvent to item 1 of hits
+      set removedTitle to summary of theEvent
+      set evId to id of theEvent
+      try
+        with timeout of 20 seconds
+          delete (event id evId of cal)
+        end timeout
+      on error err1 number n1
+        if n1 is -1712 then error "DELETE_TIMEOUT: " & err1
+        try
+          with timeout of 20 seconds
+            tell cal
+              delete theEvent
+            end tell
+          end timeout
+        on error err2 number n2
+          if n2 is -1712 then error "DELETE_TIMEOUT: " & err2
+          error "DELETE_FAILED: " & err2 number n2
+        end try
+      end try
+      try
+        reload calendars
+      end try
+      return removedTitle
+    end if
+  end repeat
 end tell
-return removedTitle`;
+error "EVENT_NOT_FOUND"`;
 }
 
 export function calendarRemove(args = {}) {
@@ -481,7 +1195,23 @@ export function calendarRemove(args = {}) {
     return { ok: false, message: `${action} refused: event_id is required (the "Event ID" from calendar_date). Deletes never run on a guessed id.` };
   }
 
-  const summary = `delete calendar event ${eventId}`;
+  const calendarName = args.calendar_name === undefined || args.calendar_name === null || args.calendar_name === ""
+    ? null
+    : validateCalendarName(args.calendar_name);
+  if (args.calendar_name && !calendarName) {
+    return { ok: false, message: `${action} refused: calendar_name must match a calendar from calendar_list_calendars.` };
+  }
+
+  const eventKitId = args.eventkit_id === undefined || args.eventkit_id === null || args.eventkit_id === ""
+    ? null
+    : validateEventKitId(args.eventkit_id);
+  if (args.eventkit_id && !eventKitId) {
+    return { ok: false, message: `${action} refused: eventkit_id is not a valid EventKit eventIdentifier.` };
+  }
+
+  const summary = calendarName
+    ? `delete calendar event ${eventId} from "${calendarName}"`
+    : `delete calendar event ${eventId}`;
   const plan = planWrite({
     action,
     summary,
@@ -491,16 +1221,65 @@ export function calendarRemove(args = {}) {
   });
   if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
 
-  const result = runAppleScript(buildRemoveEventScript(eventId), { timeout: 60000, appName: "Calendar" });
-  if (!result.ok) return { ok: false, message: failure(action, summary, result) };
+  // writeOnly cannot re-query; prefer the EventKit session that cached
+  // the EKEvent from create. One-shot lookup is a full-access fallback.
+  const sessionReply = eventKitSessionRequest({
+    op: "remove",
+    ids: eventKitLookupIds(eventId, eventKitId)
+  });
+  if (sessionReply && sessionReply.ok) {
+    return {
+      ok: true,
+      message: writeSuccessMessage(action, "event deleted", {
+        event_id: eventId,
+        via: "EventKit",
+        eventkit_id: eventKitId || undefined
+      })
+    };
+  }
+  if (sessionReply && !sessionReply.ok && !sessionReply.sessionDead && eventKitId) {
+    return describeEventKitWriteFailure(action, summary, {
+      ok: false,
+      error: sessionReply.error || "EVENTKIT_SESSION_REMOVE_FAILED",
+      kind: "not_found"
+    });
+  }
 
-  return {
-    ok: true,
-    message: writeSuccessMessage(action, "event deleted", {
-      event_id: eventId,
-      title: truncate(result.output, 150) || undefined
-    })
-  };
+  const eventKitResult = runAppleScript(buildEventKitRemoveScript(eventId, { eventKitId }), {
+    timeout: 20000,
+    appName: "Calendar",
+    language: "JavaScript"
+  });
+  if (eventKitResult.ok) {
+    return {
+      ok: true,
+      message: writeSuccessMessage(action, "event deleted", {
+        event_id: eventId,
+        via: "EventKit",
+        eventkit_id: eventKitId || undefined
+      })
+    };
+  }
+
+  if (eventKitId) {
+    return describeEventKitWriteFailure(action, summary, eventKitResult);
+  }
+
+  const result = runAppleScript(buildRemoveEventScript(eventId, { calendarName }), {
+    timeout: 25000,
+    appName: "Calendar"
+  });
+  if (result.ok) {
+    return {
+      ok: true,
+      message: writeSuccessMessage(action, "event deleted", {
+        event_id: eventId,
+        title: truncate(result.output, 150) || undefined
+      })
+    };
+  }
+
+  return describeCalendarRemoveFailure(action, summary, result, eventKitResult);
 }
 
 export function buildRsvpScript({ eventId, status, attendeeEmail }) {
@@ -592,3 +1371,36 @@ export function calendarRsvp(args = {}) {
     })
   };
 }
+
+/**
+ * First-run / upgrade probe: a live Calendar.app Apple Event that pops
+ * Automation → Calendar. Listing only — no events are created, so nothing
+ * is left behind.
+ */
+export function buildCalendarAutomationProbeScript() {
+  return `tell application "Calendar"
+  get name of every calendar
+end tell
+return "OK"`;
+}
+
+/**
+ * Live Calendar Apple Events check. Not a dry_run. Does not create events.
+ * @returns {{ ok: boolean, message: string, kind: string|null }}
+ */
+export function probeCalendarAutomation() {
+  const action = "calendar_automation_probe";
+  const summary = "list calendars in Calendar.app (Automation / Apple Events check; no events created)";
+  const result = runAppleScript(buildCalendarAutomationProbeScript(), { timeout: 30000, appName: "Calendar" });
+  if (!result.ok) {
+    return { ok: false, message: failure(action, summary, result), kind: result.kind };
+  }
+  return {
+    ok: true,
+    kind: null,
+    message: writeSuccessMessage(
+      action,
+      "Calendar Automation allowed (listed calendars; no events created)"
+    )
+  };
+}