apple-tools-mcp 2.0.0 → 2.0.2

package/lib/mailWrite.js

@@ -6,12 +6,25 @@
  * property). `file_path` from mail_search / mail_recent is also accepted and
  * is resolved to a Message-ID by reading the .emlx headers, so callers never
  * have to invent an identifier.
+ *
+ * After a send/reply/forward hang, Sent (and Outbox) is checked before the
+ * tool reports failure. A message already in Sent is success — never a TCC
+ * fail. ETIMEDOUT / -1712 is a timeout (find/reply/open before send too);
+ * -1743 / -10004 is a hard deny.
  */
 
 import fs from "fs";
 import path from "path";
 import { validateEmailPath, unfoldRfc822Headers, safeMatch, stripHtmlTags } from "./validators.js";
-import { runAppleScript, asString, TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
+import {
+  runAppleScript,
+  asString,
+  MAIL_TCC_GUIDANCE,
+  MAIL_SEND_TIMEOUT_GUIDANCE,
+  MAIL_APP_NOT_RUNNING_GUIDANCE,
+  ATTRIBUTION_GUIDANCE,
+  isHardTccDenial
+} from "./appleScript.js";
 import {
   planWrite,
   validateEmailList,
@@ -98,6 +111,43 @@ function recipientLines(addresses, kind) {
     .join("\n");
 }
 
+/**
+ * Ship-gate / first-run probe: the compose verb that hangs when node → Mail
+ * Automation is denied. `tell Mail to get name` is not enough — Mini
+ * diagnosis showed that returns while `make new outgoing message` blocks.
+ * Nothing is sent; the outgoing message is deleted immediately.
+ */
+export const MAIL_AUTOMATION_PROBE_SUBJECT = "ATM Mail Automation probe";
+
+export function buildMailAutomationProbeScript() {
+  return `tell application "Mail"
+  set probe to make new outgoing message with properties {subject:${asString(MAIL_AUTOMATION_PROBE_SUBJECT)}, content:"", visible:false}
+  delete probe
+end tell
+return "OK"`;
+}
+
+/**
+ * Live Mail Apple Events check. Not a dry_run: that path never talks to Mail.
+ * @returns {{ ok: boolean, message: string }}
+ */
+export function probeMailAutomation() {
+  const action = "mail_automation_probe";
+  const summary = "compose a temporary outgoing message in Mail (Automation / Apple Events check; nothing is sent)";
+  const result = runAppleScript(buildMailAutomationProbeScript(), { timeout: 30000, appName: "Mail" });
+  if (!result.ok) {
+    return { ok: false, message: failure(action, summary, result, []), kind: result.kind };
+  }
+  return {
+    ok: true,
+    kind: null,
+    message: writeSuccessMessage(
+      action,
+      "Mail Automation allowed (composed and discarded a temporary outgoing message; nothing was sent)"
+    )
+  };
+}
+
 /**
  * Build the outgoing-message script shared by send and draft.
  *
@@ -135,13 +185,219 @@ function summarizeRecipients(to, cc, bcc) {
   return parts.join("; ");
 }
 
+export const SENT_VERIFY_FOUND = "FOUND";
+export const SENT_VERIFY_TIMEOUT_MS = 15000;
+
+/**
+ * Hard Mail Automation deny: -1743 / -10004 / "not authorized…", or
+ * classify kind `tcc`. A spawnSync hang is `timeout`, not this.
+ */
+export function isMailHardTcc(result) {
+  if (!result) return false;
+  if (result.kind === "tcc") return true;
+  return isHardTccDenial(result.error);
+}
+
+/**
+ * Find/reply/send hang (ETIMEDOUT / -1712). Not a hard TCC deny.
+ */
+export function isMailSendTimeout(result) {
+  if (!result) return false;
+  if (result.kind !== "timeout") return false;
+  return !isHardTccDenial(result.error);
+}
+
+function mailBoxesPreamble() {
+  return `  set cutoff to (current date) - (10 * minutes)
+  set boxes to {}
+  try
+    set end of boxes to sent mailbox
+  end try
+  try
+    set end of boxes to outgoing mailbox
+  end try
+  repeat with acct in accounts
+    try
+      set end of boxes to sent mailbox of acct
+    end try
+  end repeat`;
+}
+
+function appleScriptToList(addresses = []) {
+  return `{${addresses.map((address) => asString(address)).join(", ")}}`;
+}
+
+/**
+ * Look in Sent / Outbox for a reply of `messageId`.
+ * Proper Mail replies set In-Reply-To. The fallback `make new outgoing
+ * message` path does not, so also match exact "Re: " & original subject.
+ * Never treat the original itself (or a Re: that merely contains the
+ * original subject) as this send.
+ */
+export function buildFindSentByInReplyToScript(messageId) {
+  const idLit = asString(messageId);
+  const needleBare = asString(messageId);
+  const needleAngle = asString(`<${messageId}>`);
+  return `${findMessageHandler()}
+
+set origSubject to ""
+try
+  set origMsg to atmFindMessage(${idLit})
+  tell application "Mail" to set origSubject to subject of origMsg
+end try
+tell application "Mail"
+${mailBoxesPreamble()}
+  repeat with boxRef in boxes
+    try
+      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+      repeat with msg in recentMsgs
+        try
+          set candId to message id of msg
+          if candId is ${needleBare} then
+            -- The original, not the reply we just sent.
+          else
+            try
+              set src to source of msg
+              if src contains ("In-Reply-To: " & ${needleAngle}) then return "${SENT_VERIFY_FOUND}"
+              if src contains ("In-Reply-To: " & ${needleBare}) then return "${SENT_VERIFY_FOUND}"
+            end try
+            if origSubject is not "" then
+              set subj to subject of msg
+              if subj is ("Re: " & origSubject) then return "${SENT_VERIFY_FOUND}"
+            end if
+          end if
+        end try
+      end repeat
+    end try
+  end repeat
+end tell
+return "NOT_FOUND"`;
+}
+
+/**
+ * Look in Sent / Outbox for a forward of `messageId` to `toAddresses`.
+ * Mail.app forwards do not set In-Reply-To / References — those headers are
+ * replies. Require the intended recipient plus either an exact Fwd:/Fw:
+ * subject or the original Message-ID in a forwarded body. Skip the original
+ * itself, In-Reply-To hits, and unrelated Fwd: mail that only shares a To.
+ */
+export function buildFindSentForwardScript(messageId, toAddresses = []) {
+  const idLit = asString(messageId);
+  const needleBare = asString(messageId);
+  const needleAngle = asString(`<${messageId}>`);
+  const toList = appleScriptToList(toAddresses);
+  return `${findMessageHandler()}
+
+set origSubject to ""
+try
+  set origMsg to atmFindMessage(${idLit})
+  tell application "Mail" to set origSubject to subject of origMsg
+end try
+tell application "Mail"
+${mailBoxesPreamble()}
+  set wantedTos to ${toList}
+  repeat with boxRef in boxes
+    try
+      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+      repeat with msg in recentMsgs
+        try
+          set candId to message id of msg
+          if candId is ${needleBare} then
+            -- The original, not the forward we just sent.
+          else
+            set src to source of msg
+            if src contains ("In-Reply-To: " & ${needleAngle}) or src contains ("In-Reply-To: " & ${needleBare}) then
+              -- A reply to the original is not this forward.
+            else
+              set hitTo to false
+              try
+                repeat with recip in (to recipients of msg)
+                  set recipAddr to address of recip as string
+                  repeat with wanted in wantedTos
+                    if recipAddr is (wanted as string) then set hitTo to true
+                  end repeat
+                end repeat
+              end try
+              if hitTo then
+                set subj to subject of msg
+                set exactFwd to false
+                if origSubject is not "" then
+                  if subj is ("Fwd: " & origSubject) then set exactFwd to true
+                  if subj is ("Fw: " & origSubject) then set exactFwd to true
+                  if subj is ("FW: " & origSubject) then set exactFwd to true
+                  if subj is ("Forward: " & origSubject) then set exactFwd to true
+                end if
+                set looksForward to exactFwd
+                if subj starts with "Fwd:" or subj starts with "Fw:" or subj starts with "FW:" or subj starts with "Forward:" then set looksForward to true
+                if src contains "Begin forwarded message" then set looksForward to true
+                set mentionsOrigId to false
+                if src contains ${needleAngle} then set mentionsOrigId to true
+                if src contains ${needleBare} then set mentionsOrigId to true
+                if exactFwd then return "${SENT_VERIFY_FOUND}"
+                if looksForward and mentionsOrigId then return "${SENT_VERIFY_FOUND}"
+              end if
+            end if
+          end if
+        end try
+      end repeat
+    end try
+  end repeat
+end tell
+return "NOT_FOUND"`;
+}
+
+/**
+ * Look in Sent / Outbox for a compose whose subject matches exactly and
+ * was sent in the last 10 minutes.
+ */
+export function buildFindSentBySubjectScript(subject) {
+  const subj = asString(subject);
+  return `tell application "Mail"
+${mailBoxesPreamble()}
+  repeat with boxRef in boxes
+    try
+      set hits to (messages of boxRef whose subject is ${subj} and date sent > cutoff)
+      if (count of hits) > 0 then return "${SENT_VERIFY_FOUND}"
+    end try
+  end repeat
+end tell
+return "NOT_FOUND"`;
+}
+
+/**
+ * After a send hang, ask Mail whether the message is already in Sent.
+ * Returns a hit object or null. Verify failure / timeout is not success.
+ */
+export function recoverIfInSent({ inReplyTo = null, subject = null, forwardTo = null } = {}) {
+  const script = forwardTo && inReplyTo
+    ? buildFindSentForwardScript(inReplyTo, forwardTo)
+    : inReplyTo
+      ? buildFindSentByInReplyToScript(inReplyTo)
+      : subject
+        ? buildFindSentBySubjectScript(subject)
+        : null;
+  if (!script) return null;
+  const result = runAppleScript(script, { timeout: SENT_VERIFY_TIMEOUT_MS, appName: "Mail" });
+  if (!result.ok) return null;
+  const out = String(result.output || "").trim();
+  if (out === SENT_VERIFY_FOUND) return { found: true };
+  return null;
+}
+
 function failure(action, summary, result, secrets) {
-  if (result.kind === "tcc") {
-    return `${action} failed — attempted to ${summary}. ${TCC_GUIDANCE}`;
+  if (result.kind === "tcc" || isHardTccDenial(result && result.error)) {
+    return `${action} failed — attempted to ${summary}. ${MAIL_TCC_GUIDANCE}`;
+  }
+  if (result.kind === "timeout") {
+    // Allowed hang / ETIMEDOUT / -1712 is never TCC — including pre-send find/reply/open.
+    return `${action} failed — attempted to ${summary}. ${MAIL_SEND_TIMEOUT_GUIDANCE}`;
   }
   if (result.kind === "not_found") {
     return `${action} failed — attempted to ${summary}. The message could not be found in Mail. Pass a message_id from a current mail_search result.`;
   }
+  if (result.kind === "app_not_running") {
+    return `${action} failed — attempted to ${summary}. ${MAIL_APP_NOT_RUNNING_GUIDANCE}`;
+  }
   if (result.kind === "attribution") {
     return `${action} failed — attempted to ${summary}. ${ATTRIBUTION_GUIDANCE}`;
   }
@@ -151,6 +407,45 @@ function failure(action, summary, result, secrets) {
   return writeErrorMessage(action, summary, new Error(result.error || "unknown error"), secrets);
 }
 
+/**
+ * Finish a compose/reply/forward. A send hang is not labeled TCC; if Mail
+ * already delivered, return success. Hard -1743/-10004 stays a deny.
+ */
+function finalizeMailWrite({
+  action,
+  summary,
+  result,
+  secrets,
+  sendNow,
+  inReplyTo = null,
+  subject = null,
+  forwardTo = null,
+  successSummary,
+  details
+}) {
+  if (result.ok) {
+    return { ok: true, message: writeSuccessMessage(action, successSummary, details) };
+  }
+
+  if (sendNow && isMailSendTimeout(result)) {
+    const recovered = recoverIfInSent({ inReplyTo, subject, forwardTo });
+    if (recovered) {
+      return {
+        ok: true,
+        recovered: true,
+        message: writeSuccessMessage(
+          action,
+          `${successSummary} (verified in Sent after AppleScript hang)`,
+          details
+        )
+      };
+    }
+    return { ok: false, message: failure(action, summary, result, secrets) };
+  }
+
+  return { ok: false, message: failure(action, summary, result, secrets) };
+}
+
 /**
  * Compose and send (or save as draft) a new email.
  */
@@ -204,19 +499,21 @@ export function mailCompose(args = {}, { draft = false } = {}) {
   });
 
   const result = runAppleScript(script, { timeout: 60000, appName: "Mail" });
-  if (!result.ok) {
-    return { ok: false, message: failure(action, summary, result, [body.text, subject.text]) };
-  }
-
-  return {
-    ok: true,
-    message: writeSuccessMessage(action, draft ? `draft saved to Drafts` : `sent`, {
+  return finalizeMailWrite({
+    action,
+    summary,
+    result,
+    secrets: [body.text, subject.text],
+    sendNow: !draft,
+    subject: draft ? null : subject.text,
+    successSummary: draft ? "draft saved to Drafts" : "sent",
+    details: {
       to: to.addresses.join(", "),
       cc: cc.addresses.join(", ") || undefined,
       bcc: bcc.addresses.length ? `${bcc.addresses.length} recipient(s)` : undefined,
       subject: truncate(subject.text, 150)
-    })
-  };
+    }
+  });
 }
 
 export function buildReplyScript({ messageId, body, replyAll, sendNow }) {
@@ -274,15 +571,19 @@ export function mailReply(args = {}) {
     buildReplyScript({ messageId: resolved.messageId, body: body.text, replyAll, sendNow }),
     { timeout: 60000, appName: "Mail" }
   );
-  if (!result.ok) return { ok: false, message: failure(action, summary, result, [body.text]) };
-
-  return {
-    ok: true,
-    message: writeSuccessMessage(action, sendNow ? "reply sent" : "reply saved to Drafts", {
+  return finalizeMailWrite({
+    action,
+    summary,
+    result,
+    secrets: [body.text],
+    sendNow,
+    inReplyTo: sendNow ? resolved.messageId : null,
+    successSummary: sendNow ? "reply sent" : "reply saved to Drafts",
+    details: {
       message_id: resolved.messageId,
       reply_all: String(replyAll)
-    })
-  };
+    }
+  });
 }
 
 export function buildForwardScript({ messageId, to, body, sendNow }) {
@@ -333,15 +634,20 @@ export function mailForward(args = {}) {
     buildForwardScript({ messageId: resolved.messageId, to: to.addresses, body: body.text, sendNow }),
     { timeout: 60000, appName: "Mail" }
   );
-  if (!result.ok) return { ok: false, message: failure(action, summary, result, [body.text]) };
-
-  return {
-    ok: true,
-    message: writeSuccessMessage(action, sendNow ? "forwarded" : "forward saved to Drafts", {
+  return finalizeMailWrite({
+    action,
+    summary,
+    result,
+    secrets: [body.text],
+    sendNow,
+    inReplyTo: sendNow ? resolved.messageId : null,
+    forwardTo: sendNow ? to.addresses : null,
+    successSummary: sendNow ? "forwarded" : "forward saved to Drafts",
+    details: {
       message_id: resolved.messageId,
       to: to.addresses.join(", ")
-    })
-  };
+    }
+  });
 }
 
 export function buildMarkScript({ messageId, read }) {

package/lib/messagesWrite.js

@@ -14,7 +14,7 @@ import fs from "fs";
 import path from "path";
 import { safeSqlite3Json } from "./shell.js";
 import { escapeSQL } from "./validators.js";
-import { runAppleScript, asString, TCC_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
+import { runAppleScript, asString, MESSAGES_TCC_GUIDANCE, MESSAGES_APP_NOT_RUNNING_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
 import {
   planWrite,
   normalizeList,
@@ -95,6 +95,39 @@ export function validateAttachmentPath(value) {
   return { filePath: resolved, error: null };
 }
 
+/**
+ * Ship-gate / first-run probe: the Messages Apple Events used before send
+ * (enumerate accounts / service type). `messages_send` dry_run never talks
+ * to Messages. Nothing is sent.
+ */
+export function buildMessagesAutomationProbeScript() {
+  return `tell application "Messages"
+  repeat with acc in accounts
+    try
+      get service type of acc
+    end try
+  end repeat
+end tell
+return "OK"`;
+}
+
+export function probeMessagesAutomation() {
+  const action = "messages_automation_probe";
+  const summary = "enumerate Messages accounts (Automation / Apple Events check; nothing is sent)";
+  const result = runAppleScript(buildMessagesAutomationProbeScript(), { timeout: 30000, appName: "Messages" });
+  if (!result.ok) {
+    return { ok: false, message: failure(action, summary, result, []), kind: result.kind };
+  }
+  return {
+    ok: true,
+    kind: null,
+    message: writeSuccessMessage(
+      action,
+      "Messages Automation allowed (enumerated accounts; nothing was sent)"
+    )
+  };
+}
+
 function serviceHandler() {
   return `on atmService(kind)
   tell application "Messages"
@@ -159,8 +192,11 @@ return "OK"`;
 }
 
 function failure(action, summary, result, secrets) {
-  if (result.kind === "tcc") {
-    return `${action} failed — attempted to ${summary}. ${TCC_GUIDANCE}`;
+  if (result.kind === "tcc" || result.kind === "timeout") {
+    return `${action} failed — attempted to ${summary}. ${MESSAGES_TCC_GUIDANCE}`;
+  }
+  if (result.kind === "app_not_running") {
+    return `${action} failed — attempted to ${summary}. ${MESSAGES_APP_NOT_RUNNING_GUIDANCE}`;
   }
   if (result.kind === "attribution") {
     return `${action} failed — attempted to ${summary}. ${ATTRIBUTION_GUIDANCE}`;