apple-tools-mcp 2.0.10 → 2.1.1

package/README.md

@@ -77,7 +77,7 @@ Write tools drive Mail, Messages, Calendar, and Contacts through AppleScript. ma
 
 #### First install and upgrade: `apple-tools-mcp permissions`
 
-Run this **after first global install** and **after upgrade** when write surfaces are present or change. It probes **`process.execPath`** (the `node` running the command) so macOS can pop **Allow** dialogs for Contacts, Calendar, Mail, and Messages in one sitting. You click **Allow**; the command cannot grant silently. Already-granted surfaces report OK without another click. Missing grants print a report and the process **exits non-zero** (fail closed).
+Run this **after first global install** and **after upgrade** when write surfaces are present or change. It probes **`process.execPath`** (the `node` running the command) so macOS can pop **Allow** dialogs for Contacts, Calendar, Mail, Messages, and System Events in one sitting. You click **Allow**; the command cannot grant silently. Already-granted surfaces report OK without another click. Missing grants print a report and the process **exits non-zero** (fail closed).
 
 Use the **same `node` the product uses** — not the MCP host app. Always invoke so **`process.execPath`** is that node. A bare `apple-tools-mcp` (or a path like `~/.nvm/versions/node/v22.21.1/bin/apple-tools-mcp`) can have a shebang that starts a **different** node; Allow dialogs attach to `execPath`, not the CLI path you typed.
 
@@ -98,15 +98,15 @@ If the invoked CLI path and `process.execPath` differ, the command prints a **WA
 - **Mini:** `/Users/petercoates/.local/node/bin/node` (global npm / indexer LaunchAgent)
 - **MacBook:** `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node` (Claude’s nvm `node`, **not** Homebrew)
 
-**MacBook (default for `permissions`):** run from **Terminal.app**. Click **Allow** for the **printed `process.execPath`**. Confirm **System Settings → Privacy & Security → Automation** for that node → Contacts, Calendar, Mail, and Messages. Do **not** start `apple-tools-indexer` — the always-on indexer / write bridge is a **Mini** install only.
+**MacBook (default for `permissions`):** run from **Terminal.app**. Click **Allow** for the **printed `process.execPath`**. Confirm **System Settings → Privacy & Security → Automation** for that node → Contacts, Calendar, Mail, Messages, and System Events. Do **not** start `apple-tools-indexer` — the always-on indexer / write bridge is a **Mini** install only.
 
 **Mini:** use the [Mini ship-gate](#mini-ship-gate-host-setup) path (LaunchAgent-owned node / `writer.sock`). Missing-grant copy mentions the write bridge only when that socket is present.
 
-On the host UI (Mini Screen Sharing or MacBook local), open **System Settings → Privacy & Security → Automation**, then run the command. Click **Allow** for **`node`** → Contacts, Calendar, Mail, and Messages. npm `postinstall` only **prints a reminder** — it does not run the probes unattended.
+On the host UI (Mini Screen Sharing or MacBook local), open **System Settings → Privacy & Security → Automation**, then run the command. Click **Allow** for **`node`** → Contacts, Calendar, Mail, Messages, and System Events. npm `postinstall` only **prints a reminder** — it does not run the probes unattended.
 
-This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events).
+This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events). System Events is asked for its process name (nothing is typed) so the keystroke compose path can pop **Allow**.
 
-**One-pass first-run:** Allow **`node`** to control **Mail**, **Messages**, **Contacts**, and **Calendar** in the same Automation pass. Contacts or Calendar being allowed does **not** grant Mail or Messages — they are separate Apple Events targets. A denied Mail grant hangs `mail_send` / `mail_draft` / `mail_reply` / `mail_forward` until the client disconnects; `dry_run` never talks to Mail, so that deny is invisible until a real compose.
+**One-pass first-run:** Allow **`node`** to control **Mail**, **Messages**, **Contacts**, **Calendar**, and **System Events** in the same Automation pass. Contacts or Calendar being allowed does **not** grant Mail, Messages, or System Events — they are separate Apple Events targets. A denied Mail grant hangs `mail_send` / `mail_draft` / `mail_reply` / `mail_forward` until the client disconnects; `dry_run` never talks to Mail, so that deny is invisible until a real compose.
 
 **Do not add `node` via the + button in System Settings → Privacy & Security → Contacts or Calendars.** On current macOS those panes often have **no Add button**, and that instruction is not the ship-gate setup — it failed on the Mini.
 
@@ -122,7 +122,7 @@ This is the first-run flow for Mail, Messages, Contacts, and Calendar **writes**
    ```
 
    That is the ship-gate context. An embedded agent shell, IDE terminal, or MCP host app subprocess is **not** the ship-gate host unless the write bridge is up and the work executes inside launchd-owned `node`.
-3. When prompts appear, click **Allow** for **`node`** to control **Mail**, **Messages**, **Contacts**, and **Calendar**. Watch the host — Allow **`node`** (the LaunchAgent binary), not any other app. Use whatever path the LaunchAgent plist / `which node` reports — `/Users/petercoates/.local/node/bin/node` is a Mini *example* only, not a universal path. Do **not** approve the MCP client / host app that launched a short-lived stdio server.
+3. When prompts appear, click **Allow** for **`node`** to control **Mail**, **Messages**, **Contacts**, **Calendar**, and **System Events** (needed for `mail_send` / `mail_draft` keystrokes under the LaunchAgent). Watch the host — Allow **`node`** (the LaunchAgent binary), not any other app. Use whatever path the LaunchAgent plist / `which node` reports — `/Users/petercoates/.local/node/bin/node` is a Mini *example* only, not a universal path. Do **not** approve the MCP client / host app that launched a short-lived stdio server.
 4. **Keep Contacts, Mail, and Messages running** on the write host (leave the apps open; do not quit them). Cold `tell application "Contacts"` under launchd often fails with `-600` / “application isn't running” instead of auto-launching — that is **not** an Automation deny. The write path launches Contacts.app before CRUD, but write reliability still requires those three apps to stay running. **Calendar does not need to stay open** (Calendar writes go through EventKit).
 5. **Full Disk Access** on `node` is a separate grant and covers **reads** (Mail / Messages / Calendar / AddressBook databases). Write tools need the Automation / Apple Events grants to Mail.app (`mail_send`, `mail_draft`, `mail_reply`, `mail_forward`, and the other mail writes), Messages.app (`messages_send`), Contacts.app, and Calendar.app.
 6. npm Trusted Publisher / publish tokens are unrelated to TCC. Do not confuse them with this setup.
@@ -308,7 +308,7 @@ Missing `config.json` is fine — env then the 5-minute default apply.
 
 On Mini, run the **indexer daemon**, not a sleep-pipe wrapper around `apple-tools-mcp`. Claude Desktop and other clients still attach via short-lived stdio MCP (`npx -y apple-tools-mcp` or the global `apple-tools-mcp` bin).
 
-The daemon does two jobs: it refreshes the vector index, and it serves the **write bridge** at `~/.apple-tools-mcp/writer.sock` so stdio clients can perform Mail / Messages / Contacts / Calendar writes that their host app cannot be granted (see [step 2b](#2b-grant-automation-for-write-tools-first-run--ship-gate)). When macOS prompts, Allow **`node`** (the LaunchAgent binary) to control Mail.app, Messages.app, Contacts.app, and Calendar.app. Do not approve the MCP client / host app that launched a short-lived stdio server, and do not try to add `node` via **+** in the Contacts or Calendars privacy lists.
+The daemon does two jobs: it refreshes the vector index, and it serves the **write bridge** at `~/.apple-tools-mcp/writer.sock` so stdio clients can perform Mail / Messages / Contacts / Calendar writes that their host app cannot be granted (see [step 2b](#2b-grant-automation-for-write-tools-first-run--ship-gate)). When macOS prompts, Allow **`node`** (the LaunchAgent binary) to control Mail.app, Messages.app, Contacts.app, Calendar.app, **and System Events** (mail_send / mail_draft type the body via keystrokes). Do not approve the MCP client / host app that launched a short-lived stdio server, and do not try to add `node` via **+** in the Contacts or Calendars privacy lists.
 
 **Keep Contacts.app, Mail.app, and Messages.app running all the time** on the Mini (and on any MacBook that does local writes). Quitting them makes Apple Events to those apps unreliable (`-600` / “application isn't running”), which is a cold-launch miss — not a missing Automation grant. The Contacts write path launches Contacts.app before add/edit/remove, but do not rely on that instead of leaving the apps open. **Calendar.app does not need to stay open**; Calendar writes use EventKit.
 
@@ -464,19 +464,23 @@ Two arguments are available on **every** write tool:
 
 `body_format: "html"` uses the same compose path with a tag-stripped body pasted into Mail's native editor. It does **not** set Mail's `content` or `html content` — those setters cite-wrap the whole message (`>` prefixes and `<blockquote type="cite">`, same iOS purple bar). Mail may still generate its own HTML alternative from the native compose. The default is plain text.
 
-**Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then paste the body into the compose window (System Events). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected.
+**Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then type the body into the compose window (System Events keystrokes). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected (those paths still prepend via `content`; fixing reply/forward cite-wrap is out of scope for 2.1.0).
 
-Paste uses System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) in addition to Automation → Mail. That Accessibility deny is not a Mail Automation deny (`-1743` / `-10004`). Body focus uses `text area` / `scroll area` / `text field` and `UI element whose role is "AXWebArea"` — never the System Events class `web area`, which does not compile on macOS 26.x (**-2741**, “Expected class name but found identifier”). The pre-paste focus read uses `first UI element whose focused is true` and `value of attribute "AXFocusedUIElement"` — never the compound `focused UI element`, which does not compile on System Events 26.x (**-2741** on MacBook 26.1, **-2740** on Mini 26.6.2).
+Keystrokes use System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) **and** Automation → Mail **and** Automation → System Events. Run `apple-tools-mcp permissions` after first install or upgrade so **node → System Events** pops **Allow** in the same sitting as Mail / Messages / Contacts / Calendar. An Accessibility / System Events deny is not a Mail Automation deny (`-1743` / `-10004`).
 
-**Compose body focus (2.0.8).** After `make new outgoing message`, To and Subject are AppleScript properties (never paste). Cmd-V runs only after the caret leaves the header: a tall `AXWebArea` (HTML compose body), a tall `text area` (plain compose; short To/Subject fields are skipped), Subject then Tab, or a click in the lower two-thirds of the compose window. If focus is still a header field, the tool raises `BODY_FOCUS_FAILED` and does **not** paste. After paste it checks To/Cc/Bcc counts, the exact subject, and that the native body contains the intended text. A mismatch is `BODY_PASTE_MISDIRECTED`: the outgoing message is deleted and nothing is sent. Quote-prefix Sent prove and Sent/Outbox verify stay gated on this paste-focus contract — a MacBook 2.0.7 live `mail_send` with Accessibility allowed still hit `BODY_PASTE_MISDIRECTED` when Cmd-V landed in To/Subject (`ATP-207-SENT-PROVE-20260921-084048`).
+**Compose body focus (2.0.8).** After `make new outgoing message`, To and Subject are AppleScript properties (never paste). Cmd-V used to run only after an AX window walker left the header. Quote-prefix Sent prove and Sent/Outbox verify stay gated on fail-closed body/header checks — a MacBook 2.0.7 live `mail_send` with Accessibility allowed still hit `BODY_PASTE_MISDIRECTED` when Cmd-V landed in To/Subject (`ATP-207-SENT-PROVE-20260921-084048`).
 
-**macOS 26 focus compile (2.0.9).** Dual-host Sent prove on `@2.0.8` never reached paste: `atmSafeToPaste` used bare `focused UI element`, which System Events 26.x rejects at compile. The 2.0.8 fail-closed gates stay; only the focus *query* changed to the forms hosts compiled.
+**macOS 26 focus compile (2.0.9).** Dual-host Sent prove on `@2.0.8` never reached paste: `atmSafeToPaste` used bare `focused UI element`, which System Events 26.x rejects at compile.
 
-**AppleScript reserved identifiers (2.0.10).** Dual-host Sent prove on `@2.0.9` compiled past the focused-UI fix, then failed in `atmFocusMailBody`: `set {tw, th} to size of atmElem` → **-2741** Expected expression but found `th` (AppleScript reserved ordinal). Size/position lists now use `atmW`/`atmH` (hosts confirmed) and other `atm*` names — never `th`/`tw`/`st`/`nd`/`rd`/`to`/`by`/`id` in destructuring. 2.0.8/2.0.9 fail-closed paste-focus and 2.0.9 AXFocusedUIElement / `whose focused is true` are unchanged.
+**AppleScript reserved identifiers (2.0.10).** Dual-host Sent prove on `@2.0.9` compiled past the focused-UI fix, then failed in `atmFocusMailBody`: `set {tw, th} to size of atmElem` → **-2741** Expected expression but found `th` (AppleScript reserved ordinal).
 
-**mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used.
+**Keystroke compose (2.1.0).** macOS 26 System Events reports `windows of process Mail = 0`, so the AX window walker cannot focus a tall `AXWebArea`. Fresh compose **Tabs into the body** (max Tab×6 as proven on Mini) and **types the body with Return between paragraphs**. Clipboard Cmd-V is only a fallback if a *readable* AX value is still missing the body needle. Fail-closed: missing AX body focus or changed To/Cc/Bcc/subject is `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`; the outgoing message is deleted and nothing is sent. Apple events are wrapped in `with timeout`; hung `osascript` is **SIGKILL**'d so a wedge fails fast instead of sitting ~60s. If the Mini write-bridge / indexer daemon cannot drive System Events, `mail_send` returns `unsupported: true` so the stdio client falls back **in-process** — it does **not** hang with `MAIL_SEND_TIMEOUT_GUIDANCE` for a message that never sent.
 
-**Manual prove (2.0.10 on the Mac host):** AppleScript for paste-focus **compiles** (no `-2741` on `th`; no `-2741`/`-2740` on `focused UI element`). Then `mail_send` a short plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`, and the intended text must be in the native body before send. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`, no **-2741** / **-2740** on body focus). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
+**AX body-focus oracle (2.1.1).** Dual-host Mail 16 / macOS 26 showed that Mail AppleScript `content of` the outgoing message is **not** a live oracle for UI-typed/pasted text: `set content` reads back, but after Tab + keystroke/paste into the UI body `content of` stays empty (`typedSeen=false`, bodyLen 0) even when typing still produces a plain Sent `.emlx`. `@2.1.0` calibrated Tab against that property and fail-closed with `BODY_FOCUS_FAILED`. 2.1.1 Tabs until the focused AX role is a body field (`AXWebArea` / non-header `AXTextArea` via `AXFocusedUIElement` / `first UI element whose focused is true` — never `focused UI element`, never `windows of process Mail`). Cmd-V runs only when that AX **value** is readable and still missing the needle. An empty AX value is not a miss (Mail 16 WebArea); header checks still fail-closed. Ship prove that the body landed remains the Sent `.emlx` after send (2.0.7 To+subject verify). Do not “fix Tab count.”
+
+**mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used. `dry_run` / confirm-blocked writes stay `ok: false`, `planned: true`, `delivered: false`.
+
+**Manual prove (2.1.1 on the Mac host):** After `apple-tools-mcp permissions` reports System Events granted, `mail_send` a short **multiline** plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`. Inspect each Sent `.emlx`: the text/plain part must contain the intended text (newlines preserved) and must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`). On Mini, prove the production path (write-bridge with node → System Events allowed, **or** the documented in-process fallback). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
 
 Emails are addressed by their RFC822 **Message-ID**. Pass `message_id`, or pass the `file_path` from `mail_search` / `mail_recent` and the server reads the Message-ID out of the `.emlx` headers for you. `mail_archive` moves the message to its account's Archive (or All Mail) mailbox; `mail_trash` moves it to that account's Trash.
 
@@ -597,9 +601,9 @@ Ensure Node.js has Full Disk Access (see Installation step 2).
 
 The message names which process macOS was actually asking about. Work through it in this order:
 
-1. **MacBook / Terminal (`permissions` CLI):** there is **no** always-on indexer. Re-run `apple-tools-mcp permissions` from **Terminal.app**, Allow the **printed `process.execPath`**, and check System Settings → Privacy & Security → **Automation** for that node → Contacts, Calendar, Mail, and Messages. Do **not** start `apple-tools-indexer`.
+1. **MacBook / Terminal (`permissions` CLI):** there is **no** always-on indexer. Re-run `apple-tools-mcp permissions` from **Terminal.app**, Allow the **printed `process.execPath`**, and check System Settings → Privacy & Security → **Automation** for that node → Contacts, Calendar, Mail, Messages, and System Events. Do **not** start `apple-tools-indexer`.
 2. **Mini only:** `pgrep -fl apple-tools-indexer` / `~/.apple-tools-mcp/writer.sock`. If the LaunchAgent is the product host, start it so writes run under launchd-owned node (see [Mini ship-gate](#mini-ship-gate-host-setup)).
-3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, and Calendar. On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
+3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, Calendar, and **System Events**. On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
 4. **Mini: is the daemon's node binary the one with Full Disk Access?** LaunchAgents do not inherit your shell `PATH`; confirm the plist points at the same path `which node` reports.
 5. **Is it actually the write path?** Contacts or Calendar *reads* failing with `EPERM` is a Full Disk Access / attribution problem, not the entitlement gap — fix FDA for the responsible process. Contacts or Calendar *CRUD* failing with no prompt under Claude Desktop is the [documented host limitation](#reads-and-writes-are-different-mechanisms): Claude.app carries neither the addressbook nor the calendars entitlement. On Mini, start the daemon so the write goes through the bridge. On MacBook, use Terminal.app + the printed node.
 6. **"Contacts.app / Calendar.app could not be reached"** with the app clearly installed is an **Automation / responsible-process** failure, not a missing app — macOS reports a refused Apple event as `-1728` / "can't get application". On MacBook / Terminal, Allow the printed `process.execPath`. On Mini, the write bridge / LaunchAgent may apply. A Contacts `-600` / “application isn't running” is a **cold launch**, not Automation — keep Contacts, Mail, and Messages running; Calendar does not need to stay open.

package/lib/appleScript.js

@@ -170,6 +170,7 @@ export function needsHostTccAdvice(message) {
   const text = String(message || "");
   if (!text) return false;
   if (text.includes(MAIL_SEND_TIMEOUT_GUIDANCE)) return false;
+  if (text.includes(MAIL_GUI_SCRIPTING_GUIDANCE)) return false;
   if (text.includes(CONTACTS_APP_NOT_RUNNING_GUIDANCE)) return false;
   if (text.includes(MAIL_APP_NOT_RUNNING_GUIDANCE)) return false;
   if (text.includes(MESSAGES_APP_NOT_RUNNING_GUIDANCE)) return false;
@@ -339,10 +340,22 @@ export const MAIL_TCC_GUIDANCE =
  */
 export const MAIL_ACCESSIBILITY_GUIDANCE =
   "macOS denied Accessibility (System Events could not drive Mail's compose window). " +
-  "mail_send / mail_draft paste the body so Mail does not cite-wrap it (FB11734014); Mail's mailto command does not return an outgoing message on current Mini/MacBook Mail (-2753). " +
+  "mail_send / mail_draft type or paste the body so Mail does not cite-wrap it (FB11734014); Mail's mailto command does not return an outgoing message on current Mini/MacBook Mail (-2753). " +
   "Allow node in System Settings → Privacy & Security → Accessibility, and keep Automation → Mail allowed. " +
   "This is not a Mail Automation deny (-1743 / -10004).";
 
+/**
+ * System Events Apple Events / GUI scripting is missing, so the keystroke
+ * compose path cannot run. Distinct from a Mail send hang: nothing was typed
+ * or sent. Mini write-bridge should return unsupported so stdio falls back
+ * in-process rather than wedging ~60s.
+ */
+export const MAIL_GUI_SCRIPTING_GUIDANCE =
+  "System Events GUI scripting is unavailable for this process, so the body cannot be typed into Mail. " +
+  "mail_send / mail_draft use System Events keystrokes (Tab into the body, typed Returns) so Mail does not cite-wrap the Sent body (FB11734014). " +
+  "Allow node → System Events in System Settings → Privacy & Security → Automation (run apple-tools-mcp permissions after install/upgrade) in addition to node → Mail, and keep Accessibility allowed. " +
+  "This is not a Mail send timeout and not a Mail Automation deny (-1743 / -10004).";
+
 /**
  * AppleScript hung (ETIMEDOUT / -1712) while finding, opening, replying,
  * or sending. That is not -1743 / -10004, including before send.
@@ -385,7 +398,7 @@ export function tccGuidanceFor(source) {
 export function runAppleScript(script, options = {}) {
   const { timeout = DEFAULT_SCRIPT_TIMEOUT_MS, appName = null, language = null } = options;
   try {
-    const output = safeOsascript(script, { timeout, language });
+    const output = safeOsascript(script, { timeout, language, killSignal: "SIGKILL" });
     return { ok: true, output: (output || "").trim(), error: null, kind: null };
   } catch (e) {
     const message = e && e.message ? e.message : String(e);

package/lib/mailWrite.js

@@ -25,10 +25,12 @@ import {
   MAIL_TCC_GUIDANCE,
   MAIL_SEND_TIMEOUT_GUIDANCE,
   MAIL_ACCESSIBILITY_GUIDANCE,
+  MAIL_GUI_SCRIPTING_GUIDANCE,
   MAIL_APP_NOT_RUNNING_GUIDANCE,
   ATTRIBUTION_GUIDANCE,
   isHardTccDenial
 } from "./appleScript.js";
+import { isIndexerMode } from "./processMode.js";
 import {
   planWrite,
   plannedWriteResult,
@@ -156,8 +158,21 @@ export function probeMailAutomation() {
 export const ACCESSIBILITY_DENIED_SENTINEL = "ACCESSIBILITY_DENIED";
 export const BODY_PASTE_MISDIRECTED_SENTINEL = "BODY_PASTE_MISDIRECTED";
 export const BODY_FOCUS_FAILED_SENTINEL = "BODY_FOCUS_FAILED";
-/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). */
+export const GUI_SCRIPTING_UNAVAILABLE_SENTINEL = "GUI_SCRIPTING_UNAVAILABLE";
+export const SYSTEM_EVENTS_PROBE_MARKER = "ATM_SYSTEM_EVENTS_PROBE";
+/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). Used to reject short header AXTextAreas after Tab; does not walk windows. */
 export const MAIL_BODY_MIN_AX_HEIGHT = 50;
+/** Mini-proven Tab count from default compose focus into the body. */
+export const MAIL_BODY_TAB_MAX = 6;
+/** Cheap System Events Automation probe used before compose; SIGKILL if it still hangs. */
+export const MAIL_SE_PROBE_TIMEOUT_MS = 4000;
+/** First-run / upgrade permissions probe: long enough for the Allow click. */
+export const SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS = 30000;
+/** Compose osascript budget (make + keystroke + send). Far below the ~60s SE wedge. */
+export const MAIL_COMPOSE_TIMEOUT_MS = 25000;
+export const MAIL_SE_APPLEEVENT_TIMEOUT_SEC = 8;
+export const MAIL_APPLEEVENT_TIMEOUT_SEC = 15;
+export const MAIL_SE_PROBE_APPLEEVENT_TIMEOUT_SEC = 3;
 
 /**
  * AppleScript ordinal/keyword tokens that fail compile in `set {a, b}`
@@ -206,10 +221,10 @@ end atmFocusedElement`;
 }
 
 /**
- * Body text for native Mail compose (clipboard paste, not AppleScript content).
+ * Body text for native Mail compose (keystroke / paste, not AppleScript content).
  *
  * HTML is tag-stripped so a plain-looking HTML body (`<p>…</p>`) becomes
- * typed/pasted text. Never prefixes lines with `>` and never emits
+ * typed text. Never prefixes lines with `>` and never emits
  * `<blockquote>` — AppleScript `content` / `html content` cite-wrap
  * (FB11734014). Mail's `mailto` command is not used: on current Mini/MacBook
  * Mail it does not return an outgoing message (`newMessage` stays undefined,
@@ -231,36 +246,95 @@ export function composeBodyNeedle(body) {
   return needle.length > 120 ? needle.slice(0, 120) : needle;
 }
 
-const BODY_MIN_H = asInteger(MAIL_BODY_MIN_AX_HEIGHT, { min: 1, max: 500, field: "bodyMinHeight" });
+export function isSystemEventsProbeScript(script) {
+  return String(script || "").includes(SYSTEM_EVENTS_PROBE_MARKER);
+}
+
+export function buildSystemEventsProbeScript() {
+  const secs = asInteger(MAIL_SE_PROBE_APPLEEVENT_TIMEOUT_SEC, {
+    min: 1,
+    max: 15,
+    field: "seProbeTimeout"
+  });
+  return `-- ${SYSTEM_EVENTS_PROBE_MARKER}
+with timeout of ${secs} seconds
+  tell application "System Events"
+    set atmName to name
+    if atmName is "" then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    set atmUi to UI elements enabled
+  end tell
+end timeout
+if atmUi is false then error "${ACCESSIBILITY_DENIED_SENTINEL}"
+return "OK"`;
+}
+
+export function probeSystemEventsGui({ timeout = MAIL_SE_PROBE_TIMEOUT_MS } = {}) {
+  return runAppleScript(buildSystemEventsProbeScript(), {
+    timeout
+  });
+}
 
 /**
- * AppleScript handlers: focus the compose body (not To/Subject) and paste.
- * System Events needs Accessibility; Mail make/send still needs Automation.
- *
- * macOS 26.x System Events has no `web area` class (compile -2741,
- * "Expected class name but found identifier") and no compound
- * `focused UI element` (compile -2741 / -2740). Hosts compile
- * `text area` / `scroll area` / `text field`, `UI element whose role is
- * "AXWebArea"`, `first UI element whose focused is true`, and
- * `value of attribute "AXFocusedUIElement"`. Never focus the first
- * AXTextArea blindly — on MacBook Mail that is a header field, and
- * Cmd-V becomes BODY_PASTE_MISDIRECTED.
- *
- * AppleScript treats ordinal suffixes as reserved tokens (`th` as in 4th,
- * also `st`/`nd`/`rd`). Dual-host Sent prove on 2.0.9 compiled past the
- * focused-UI fix, then failed in `atmFocusMailBody`:
- * `set {tw, th} to size of atmElem` → -2741 Expected expression but found
- * `th`. Size/position lists use `atmW`/`atmH` (hosts confirmed) and other
- * `atm*` names — never `th`/`tw`/`st`/`nd`/`rd`/`to`/`by`/`id` in
- * destructuring.
+ * First-run / upgrade probe: a live System Events Apple Event that pops
+ * Automation → System Events. Does not type into the focused UI.
+ * Timeout is long enough for the operator to click Allow.
+ * @returns {{ ok: boolean, message: string, kind: string|null }}
+ */
+export function probeSystemEventsAutomation() {
+  const action = "system_events_automation_probe";
+  const summary = "ask System Events for its name (Automation / Apple Events check; nothing is typed)";
+  const result = probeSystemEventsGui({ timeout: SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS });
+  if (!result.ok) {
+    const kind = systemEventsGrantKind(result);
+    const guidance = isMailAccessibilityDenial(result)
+      ? MAIL_ACCESSIBILITY_GUIDANCE
+      : MAIL_GUI_SCRIPTING_GUIDANCE;
+    return {
+      ok: false,
+      kind,
+      message: `${action} failed — attempted to ${summary}. ${guidance}`
+    };
+  }
+  return {
+    ok: true,
+    kind: null,
+    message: writeSuccessMessage(
+      action,
+      "System Events Automation allowed (process name read; nothing was typed)"
+    )
+  };
+}
+
+function systemEventsGrantKind(result) {
+  if (!result) return "unknown";
+  if (result.kind === "timeout" || result.kind === "tcc" || result.kind === "attribution") {
+    return result.kind;
+  }
+  if (isMailGuiScriptingUnavailable(result) || isMailAccessibilityDenial(result)) {
+    return "tcc";
+  }
+  return result.kind || "unknown";
+}
+
+/**
+ * AppleScript handlers: Tab into the compose body and type it (typed Returns
+ * preserve newlines). Does not walk System Events `windows of process Mail`
+ * (macOS 26 reports 0). Calibration / verify uses the focused AX role (and
+ * AX value when it is readable) — never live Mail `content of` the outgoing
+ * message. Dual-host Mail 16 / macOS 26: `set content` reads back via
+ * `content of`, but Tab + keystroke/paste into the UI body never appears in
+ * `content of` (`typedSeen=false`, bodyLen 0) even when typing still produces
+ * a plain Sent `.emlx`. Never `set content` / `html content` (FB11734014).
  *
- * Strategies, each fail-closed unless the caret left the header:
- *   1. Click a tall AXWebArea (HTML compose body)
- *   2. Focus a tall `text area` (plain compose body), never a short header
- *   3. Click Subject then Tab into the body (stable Mini/MacBook order)
- *   4. Click the lower two-thirds of the compose window
+ * Tab count is unchanged (MAIL_BODY_TAB_MAX, Mini-proven 6). Fail-closed if
+ * AX focus is not a body role after Tab. Cmd-V only if AX value is readable
+ * and the needle is still missing. Header checks stay. System Events Apple
+ * events are wrapped in `with timeout`.
  */
 export function buildMailBodyPasteHandler() {
+  const tabMax = asInteger(MAIL_BODY_TAB_MAX, { min: 1, max: 12, field: "tabMax" });
+  const seSecs = asInteger(MAIL_SE_APPLEEVENT_TIMEOUT_SEC, { min: 1, max: 30, field: "seTimeout" });
+  const bodyMinH = asInteger(MAIL_BODY_MIN_AX_HEIGHT, { min: 1, max: 500, field: "bodyMinHeight" });
   return `${buildAtmFocusedElementHandler()}
 
 on atmSafeToPaste()
@@ -280,7 +354,7 @@ on atmSafeToPaste()
         try
           set {atmW, atmH} to size of fe
         end try
-        if r is "AXTextArea" and atmH < ${BODY_MIN_H} then return false
+        if r is "AXTextArea" and atmH > 0 and atmH < ${bodyMinH} then return false
         ignoring case
           set bits to ""
           try
@@ -296,148 +370,106 @@ on atmSafeToPaste()
         end ignoring
         if r is "AXWebArea" then return true
         if r is "AXTextArea" then return true
-        if atmH >= ${BODY_MIN_H} then return true
+        if atmH >= ${bodyMinH} then return true
       end try
       return false
     end tell
   end tell
 end atmSafeToPaste
 
-on atmFocusMailBody(expectedSubject)
+on atmAxFocusedValue()
+  tell application "System Events"
+    try
+      set fe to my atmFocusedElement()
+      if fe is missing value then return ""
+      return value of fe as string
+    end try
+  end tell
+  return ""
+end atmAxFocusedValue
+
+on atmSplitParagraphs(bodyText)
+  set atmSavedDelim to AppleScript's text item delimiters
+  set AppleScript's text item delimiters to return
+  set atmCrParts to text items of bodyText
+  set AppleScript's text item delimiters to linefeed
+  set atmNorm to atmCrParts as string
+  set atmLines to text items of atmNorm
+  set AppleScript's text item delimiters to atmSavedDelim
+  return atmLines
+end atmSplitParagraphs
+
+on atmSpacesForTabs(atmLine)
+  set atmSavedDelim to AppleScript's text item delimiters
+  set AppleScript's text item delimiters to tab
+  set atmTabParts to text items of atmLine
+  set AppleScript's text item delimiters to " "
+  set atmOut to atmTabParts as string
+  set AppleScript's text item delimiters to atmSavedDelim
+  return atmOut
+end atmSpacesForTabs
+
+on atmKeystrokeText(atmText)
+  set atmSafe to my atmSpacesForTabs(atmText)
+  set atmLen to length of atmSafe
+  if atmLen is 0 then return
+  set atmPos to 1
   tell application "System Events"
     tell process "Mail"
-      set frontmost to true
-      if (count of windows) < 1 then error "MAIL_COMPOSE_WINDOW_MISSING"
-      set w to window 1
-      if expectedSubject is not "" then
-        repeat with i from 1 to (count of windows)
-          try
-            if (name of window i as string) is expectedSubject then
-              set w to window i
-              exit repeat
-            end if
-          end try
-        end repeat
-      end if
-      try
-        perform action "AXRaise" of w
-      end try
-      try
-        click (first UI element of w whose role is "AXWebArea")
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end try
-      try
-        click (first UI element of scroll area 1 of w whose role is "AXWebArea")
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end try
-      try
-        click (first UI element of scroll area 1 of splitter group 1 of w whose role is "AXWebArea")
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end try
-      try
-        click (first UI element of scroll area 1 of group 1 of splitter group 1 of w whose role is "AXWebArea")
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end try
-      set atmTallText to missing value
-      set atmSubjectElem to missing value
-      set atmQueue to UI elements of w
-      set atmWalked to 0
-      repeat while (count of atmQueue) > 0 and atmWalked < 120
-        set atmWalked to atmWalked + 1
-        set atmElem to item 1 of atmQueue
-        if (count of atmQueue) is 1 then
-          set atmQueue to {}
-        else
-          set atmQueue to items 2 thru -1 of atmQueue
-        end if
-        try
-          if (role of atmElem as string) is "AXWebArea" then
-            set {atmW, atmH} to size of atmElem
-            if atmH >= ${BODY_MIN_H} then
-              click atmElem
-              delay 0.08
-              if my atmSafeToPaste() then return
-            end if
-          end if
-        end try
-        try
-          if (role of atmElem as string) is "AXTextArea" then
-            set {atmW, atmH} to size of atmElem
-            if atmH >= ${BODY_MIN_H} and atmTallText is missing value then set atmTallText to atmElem
-          end if
-        end try
-        try
-          set r to (role of atmElem as string)
-          if r is "AXTextField" or r is "AXTextArea" then
-            set bits to ""
-            try
-              set bits to bits & (description of atmElem as string)
-            end try
-            try
-              set bits to bits & (name of atmElem as string)
-            end try
-            ignoring case
-              if bits contains "Subject" and atmSubjectElem is missing value then set atmSubjectElem to atmElem
-            end ignoring
-          end if
-        end try
-        try
-          set atmKids to UI elements of atmElem
-          repeat with i from 1 to (count of atmKids)
-            set end of atmQueue to item i of atmKids
-          end repeat
-        end try
+      repeat while atmPos is less than or equal to atmLen
+        set atmEndPos to atmPos + 31
+        if atmEndPos > atmLen then set atmEndPos to atmLen
+        keystroke (text atmPos thru atmEndPos of atmSafe)
+        set atmPos to atmEndPos + 1
       end repeat
-      try
-        set ta to text area 1 of scroll area 1 of w
-        set {atmW, atmH} to size of ta
-        if atmH >= ${BODY_MIN_H} then
-          set focused of ta to true
-          delay 0.08
-          if my atmSafeToPaste() then return
-        end if
-      end try
-      if atmTallText is not missing value then
-        try
-          set focused of atmTallText to true
-        end try
-        try
-          click atmTallText
-        end try
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end if
-      try
-        click (first text field of w whose description contains "Subject")
-        delay 0.08
-        key code 48
-        delay 0.08
-        if my atmSafeToPaste() then return
-      end try
-      if atmSubjectElem is not missing value then
-        try
-          click atmSubjectElem
-          delay 0.08
-          key code 48
-          delay 0.08
-          if my atmSafeToPaste() then return
-        end try
-      end if
-      set {atmX, atmY} to position of w
-      set {atmWinW, atmWinH} to size of w
-      click at {(atmX + (atmWinW div 2)) as integer, (atmY + ((atmWinH * 2) div 3)) as integer}
-      delay 0.08
-      if my atmSafeToPaste() then return
-      error "${BODY_FOCUS_FAILED_SENTINEL}"
     end tell
   end tell
-end atmFocusMailBody
+end atmKeystrokeText
+
+on atmTabIntoMailBody(msg)
+  tell application "Mail" to activate
+  delay 0.25
+  with timeout of ${seSecs} seconds
+    tell application "System Events"
+      tell process "Mail" to set frontmost to true
+    end tell
+  end timeout
+  delay 0.08
+  repeat with atmN from 0 to ${tabMax}
+    if my atmSafeToPaste() then return
+    if atmN is ${tabMax} then error "${BODY_FOCUS_FAILED_SENTINEL}"
+    with timeout of ${seSecs} seconds
+      tell application "System Events"
+        tell process "Mail"
+          key code 48
+        end tell
+      end tell
+    end timeout
+    delay 0.08
+  end repeat
+  error "${BODY_FOCUS_FAILED_SENTINEL}"
+end atmTabIntoMailBody
+
+on atmTypeMailBody(bodyText)
+  set atmLines to my atmSplitParagraphs(bodyText)
+  set atmLast to count of atmLines
+  if atmLast is 0 then return
+  with timeout of ${seSecs} seconds
+    repeat with atmI from 1 to atmLast
+      set atmLine to item atmI of atmLines as string
+      my atmKeystrokeText(atmLine)
+      if atmI < atmLast then
+        tell application "System Events"
+          tell process "Mail"
+            key code 36
+          end tell
+        end tell
+      end if
+    end repeat
+  end timeout
+end atmTypeMailBody
 
-on atmPasteMailBody(bodyText, expectedSubject)
+on atmPasteMailBodyFallback(bodyText)
   set savedClip to ""
   set hadClip to false
   try
@@ -445,26 +477,47 @@ on atmPasteMailBody(bodyText, expectedSubject)
     set hadClip to true
   end try
   set the clipboard to bodyText
-  tell application "Mail" to activate
-  delay 0.4
   try
-    atmFocusMailBody(expectedSubject)
-    if atmSafeToPaste() is false then error "${BODY_FOCUS_FAILED_SENTINEL}"
-    tell application "System Events"
-      tell process "Mail"
-        keystroke "v" using command down
+    with timeout of ${seSecs} seconds
+      tell application "System Events"
+        tell process "Mail"
+          keystroke "v" using command down
+        end tell
       end tell
-    end tell
-    delay 0.2
+    end timeout
+    delay 0.15
   on error errMsg number errNum
     if hadClip then set the clipboard to savedClip
     if errMsg contains "assistive access" or errNum is -25211 then error "${ACCESSIBILITY_DENIED_SENTINEL}"
     error errMsg number errNum
   end try
   if hadClip then set the clipboard to savedClip
-end atmPasteMailBody`;
+end atmPasteMailBodyFallback
+
+on atmFillMailBody(bodyText, needle, msg)
+  try
+    atmTabIntoMailBody(msg)
+    if my atmSafeToPaste() is false then error "${BODY_FOCUS_FAILED_SENTINEL}"
+    atmTypeMailBody(bodyText)
+    delay 0.12
+    if needle is not "" then
+      set atmAxVal to my atmAxFocusedValue()
+      if atmAxVal is not "" then
+        if atmAxVal does not contain needle then
+          atmPasteMailBodyFallback(bodyText)
+        end if
+      end if
+    end if
+  on error errMsg number errNum
+    if errMsg contains "assistive access" or errNum is -25211 then error "${ACCESSIBILITY_DENIED_SENTINEL}"
+    if errMsg contains "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}" then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    error errMsg number errNum
+  end try
+end atmFillMailBody`;
 }
 
+export const buildMailBodyFillHandler = buildMailBodyPasteHandler;
+
 function composeMisdirectChecks({ to, cc = [], bcc = [], subject, body }) {
   const toCount = asInteger(to.length, { min: 1, max: 99, field: "toCount" });
   const ccCount = asInteger(cc.length, { min: 0, max: 99, field: "ccCount" });
@@ -482,31 +535,10 @@ function composeMisdirectChecks({ to, cc = [], bcc = [], subject, body }) {
     })
     .join("\n");
   const bodyCheck = needle
-    ? `    set atmGotBody to ""
-    try
-      set atmGotBody to content of newMessage as string
-    end try
-    if atmGotBody is "" then
-      try
-        save newMessage
-      end try
-      delay 0.2
-      try
-        set atmGotBody to content of newMessage as string
-      end try
-    end if
-    if atmGotBody does not contain ${asString(needle)} then
-      try
-        set atmFe to my atmFocusedElement()
-        if atmFe is not missing value then
-          tell application "System Events"
-            set atmAxVal to value of atmFe as string
-            if atmAxVal contains ${asString(needle)} then set atmGotBody to atmAxVal
-          end tell
-        end if
-      end try
-    end if
-    if atmGotBody does not contain ${asString(needle)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"`
+    ? `    set atmAxVal to my atmAxFocusedValue()
+    if atmAxVal is not "" then
+      if atmAxVal does not contain ${asString(needle)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
+    end if`
     : "";
   return `    if (count of to recipients of newMessage) is not ${toCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
     if (count of cc recipients of newMessage) is not ${ccCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
@@ -526,9 +558,13 @@ ${bodyCheck}`;
  * Do not set AppleScript `content` or `html content`: Ventura+ FB11734014
  * cite-wraps those setters (`>` prefixes + `<blockquote type="cite">`).
  * Recipients and subject are AppleScript properties (never paste). The body
- * is pasted into the compose window (native editor) via System Events only
- * after caret focus leaves the header. If paste lands in To/Subject, or the
- * body never receives the intended text, abort + delete (nothing sent).
+ * is typed into the native compose editor via System Events (Tab into body
+ * until AX focused role is a body field, typed Returns for newlines, Cmd-V
+ * only if AX value is readable and the needle is still missing). Do not walk
+ * `windows of process Mail`. Do not use Mail `content of` as the oracle that
+ * typed/pasted text landed (Mail 16 / macOS 26: that property stays empty).
+ * If AX body focus cannot be established, or headers change, abort + delete
+ * (nothing sent). Ship prove that the body landed is Sent `.emlx` after send.
  */
 export function buildComposeScript({ to, cc, bcc, subject, body, send, html = false }) {
   const recipients = [
@@ -537,9 +573,11 @@ export function buildComposeScript({ to, cc, bcc, subject, body, send, html = fa
     recipientLines(bcc, "bcc recipient")
   ].filter((block) => block.length > 0).join("\n");
 
+  const mailSecs = asInteger(MAIL_APPLEEVENT_TIMEOUT_SEC, { min: 1, max: 60, field: "mailTimeout" });
   const plainBody = composeNativeBody(body, { html });
+  const needle = composeBodyNeedle(plainBody);
   const pasteAndVerify = plainBody
-    ? `  atmPasteMailBody(${asString(plainBody)}, ${asString(subject)})
+    ? `  atmFillMailBody(${asString(plainBody)}, ${asString(needle)}, newMessage)
   tell application "Mail"
 ${composeMisdirectChecks({ to, cc, bcc, subject, body: plainBody })}
   end tell`
@@ -548,11 +586,13 @@ ${composeMisdirectChecks({ to, cc, bcc, subject, body: plainBody })}
   return `${buildMailBodyPasteHandler()}
 
 tell application "Mail"
-  set newMessage to make new outgoing message with properties {subject:${asString(subject)}, visible:true}
-  tell newMessage
+  with timeout of ${mailSecs} seconds
+    set newMessage to make new outgoing message with properties {subject:${asString(subject)}, visible:true}
+    tell newMessage
 ${recipients}
-  end tell
-  activate
+    end tell
+    activate
+  end timeout
 end tell
 try
 ${pasteAndVerify}
@@ -564,10 +604,12 @@ on error errMsg number errNum
 end try
 set atmOutgoingId to ""
 tell application "Mail"
-  try
-    set atmOutgoingId to message id of newMessage as string
-  end try
-  ${send ? "send newMessage" : "save newMessage"}
+  with timeout of ${mailSecs} seconds
+    try
+      set atmOutgoingId to message id of newMessage as string
+    end try
+    ${send ? "send newMessage" : "save newMessage"}
+  end timeout
 end tell
 if atmOutgoingId is not "" then return atmOutgoingId
 return "OK"`;
@@ -927,6 +969,14 @@ export function verifyQueuedMessage(match = {}, { attempts = SENT_VERIFY_ATTEMPT
   return last;
 }
 
+export function isMailGuiScriptingUnavailable(result) {
+  if (!result) return false;
+  const text = String(result.error || "").toLowerCase();
+  if (text.includes("gui_scripting_unavailable")) return true;
+  if (result.kind === "timeout" && text.includes("system events")) return true;
+  return false;
+}
+
 export function isMailAccessibilityDenial(result) {
   if (!result) return false;
   const text = String(result.error || "").toLowerCase();
@@ -946,6 +996,9 @@ export function isMailBodyPasteMisdirected(result) {
 
 function failure(action, summary, result, secrets) {
   const err = String((result && result.error) || "").toLowerCase();
+  if (err.includes("gui_scripting_unavailable")) {
+    return `${action} failed — attempted to ${summary}. ${MAIL_GUI_SCRIPTING_GUIDANCE}`;
+  }
   if (err.includes("body_focus_failed")) {
     return `${action} failed — attempted to ${summary}. The compose caret could not be moved into the message body; nothing was sent.`;
   }
@@ -1051,10 +1104,24 @@ function finalizeMailWrite({
   return { ok: false, delivered: false, mailbox: null, message: failure(action, summary, result, secrets) };
 }
 
+function guiScriptingUnavailableResult(action, summary, result, { indexerMode } = {}) {
+  const unsupported = Boolean(indexerMode);
+  const message = isMailAccessibilityDenial(result)
+    ? `${action} failed — attempted to ${summary}. ${MAIL_ACCESSIBILITY_GUIDANCE}`
+    : `${action} failed — attempted to ${summary}. ${MAIL_GUI_SCRIPTING_GUIDANCE}`;
+  return {
+    ok: false,
+    delivered: false,
+    mailbox: null,
+    ...(unsupported ? { unsupported: true } : {}),
+    message
+  };
+}
+
 /**
  * Compose and send (or save as draft) a new email.
  */
-export function mailCompose(args = {}, { draft = false } = {}) {
+export function mailCompose(args = {}, { draft = false, indexerMode = isIndexerMode() } = {}) {
   const action = draft ? "mail_draft" : "mail_send";
 
   const to = validateEmailList(args.to, "to");
@@ -1093,6 +1160,14 @@ export function mailCompose(args = {}, { draft = false } = {}) {
   });
   if (!plan.proceed) return plannedWriteResult(plan);
 
+  const plainBody = composeNativeBody(body.text, { html: bodyFormat === "html" });
+  if (plainBody) {
+    const se = probeSystemEventsGui();
+    if (!se.ok) {
+      return guiScriptingUnavailableResult(action, summary, se, { indexerMode });
+    }
+  }
+
   const script = buildComposeScript({
     to: to.addresses,
     cc: cc.addresses,
@@ -1103,7 +1178,14 @@ export function mailCompose(args = {}, { draft = false } = {}) {
     html: bodyFormat === "html"
   });
 
-  const result = runAppleScript(script, { timeout: 60000, appName: "Mail" });
+  const result = runAppleScript(script, { timeout: MAIL_COMPOSE_TIMEOUT_MS, appName: "Mail" });
+  if (
+    !result.ok &&
+    indexerMode &&
+    (isMailGuiScriptingUnavailable(result) || isMailAccessibilityDenial(result))
+  ) {
+    return guiScriptingUnavailableResult(action, summary, result, { indexerMode });
+  }
   return finalizeMailWrite({
     action,
     summary,

package/lib/permissions.js

@@ -1,9 +1,9 @@
 /**
  * First-run / upgrade permissions command.
  *
- * Probes Contacts, Calendar, Mail, and Messages under process.execPath so
- * macOS can pop Allow dialogs for that node binary. The user clicks Allow;
- * this command cannot grant silently.
+ * Probes Contacts, Calendar, Mail, Messages, and System Events under
+ * process.execPath so macOS can pop Allow dialogs for that node binary.
+ * The user clicks Allow; this command cannot grant silently.
  *
  * Always runs in this process (never via the write bridge): the point is to
  * attach the dialogs to process.execPath. If the invoked CLI / shebang
@@ -15,13 +15,13 @@
 import fs from "fs";
 import path from "path";
 import { classifyAppleScriptError } from "./appleScript.js";
-import { probeMailAutomation } from "./mailWrite.js";
+import { probeMailAutomation, probeSystemEventsAutomation } from "./mailWrite.js";
 import { probeMessagesAutomation } from "./messagesWrite.js";
 import { probeContactsAutomation } from "./contactsWrite.js";
 import { probeCalendarAutomation } from "./calendarWrite.js";
 import { detectLaunchAgentContext, hostAutomationAdvice } from "./writeRouting.js";
 
-export const REQUIRED_SURFACES = ["Contacts", "Calendar", "Mail", "Messages"];
+export const REQUIRED_SURFACES = ["Contacts", "Calendar", "Mail", "Messages", "System Events"];
 
 /** Mini ship-gate host example — not a universal path. */
 export const EXAMPLE_MINI_NODE = "/Users/petercoates/.local/node/bin/node";
@@ -172,6 +172,9 @@ export function classifyGrantStatus(result) {
   if (kind === "app_not_running") {
     return GRANT_ERROR;
   }
+  if (/accessibility_denied|assistive access|gui_scripting_unavailable/i.test(text)) {
+    return GRANT_MISSING;
+  }
   if (/tcc|automation deny|not authorized|not permitted|not allowed|timed out|etimedout|responsible-process|attribution/i.test(text)) {
     return GRANT_MISSING;
   }
@@ -198,7 +201,7 @@ export function exitCodeForGrants(grants) {
 
 /**
  * Advisory Full Disk Access touch. Read tools need FDA on this node; it is
- * not one of the four required Automation grants and never fails the command.
+ * not one of the required Automation grants and never fails the command.
  *
  * @returns {{ status: "readable"|"missing"|"skipped", message: string }}
  */
@@ -247,7 +250,8 @@ export function defaultPermissionsProbes() {
     Contacts: probeContactsAutomation,
     Calendar: probeCalendarAutomation,
     Mail: probeMailAutomation,
-    Messages: probeMessagesAutomation
+    Messages: probeMessagesAutomation,
+    "System Events": probeSystemEventsAutomation
   };
 }
 
@@ -267,12 +271,13 @@ function bannerLines(binary, version) {
     "dry_run of mail_send / messages_send does not count: this command uses real Apple Events.",
     "Nothing is sent to third parties. Mail composes and discards a temporary outgoing message.",
     "Messages only enumerates accounts. Contacts creates and deletes a throwaway person in-script.",
-    "Calendar lists calendars only — no events are created."
+    "Calendar lists calendars only — no events are created.",
+    "System Events is asked for its process name (mail_send keystrokes; nothing is typed)."
   ];
 }
 
 /**
- * Run the four live probes and print a grant report.
+ * Run the live Automation probes and print a grant report.
  *
  * @param {object} [options]
  * @param {string} [options.execPath]
@@ -349,7 +354,7 @@ export async function runPermissionsCommand({
 
   const code = exitCodeForGrants(grants);
   if (code === 0) {
-    log("Result: PASS — Contacts, Calendar, Mail, and Messages are granted for this node.");
+    log("Result: PASS — Contacts, Calendar, Mail, Messages, and System Events are granted for this node.");
     log("Safe to re-run; already-granted surfaces report OK without another click.");
   } else {
     log("Result: INCOMPLETE — one or more required grants are missing or errored.");

package/lib/shell.js

@@ -131,9 +131,12 @@ export function safeOsascript(script, options = {}) {
   args.push("-e", script);
 
   // Use -e with the script as an argument (never a shell string).
+  // Hung Apple Events ignore SIGTERM (Mini write-bridge ~60s wedge).
+  // Timeout must SIGKILL osascript so compose fails fast instead of hanging.
   const result = spawnSync('osascript', args, {
     encoding: 'utf-8',
     timeout,
+    killSignal: 'SIGKILL',
     shell: false
   });
 

package/lib/writeRouting.js

@@ -91,7 +91,7 @@ export function terminalAutomationAdvice(execPath = process.execPath) {
   return (
     `Run this from Terminal.app (short-lived CLI / MacBook host — no always-on indexer). ` +
     `Click Allow for the printed process.execPath${printed}. ` +
-    `Check System Settings → Privacy & Security → Automation for that node → Contacts, Calendar, Mail, and Messages. ` +
+    `Check System Settings → Privacy & Security → Automation for that node → Contacts, Calendar, Mail, Messages, and System Events. ` +
     `Do not start apple-tools-indexer.`
   );
 }
@@ -102,7 +102,7 @@ export function terminalAutomationAdvice(execPath = process.execPath) {
 export function miniLaunchAgentAdvice() {
   return (
     "This Mac has a Mini write-bridge / LaunchAgent. Grant the daemon's node Full Disk Access (reads) and " +
-    "Allow that node in System Settings → Privacy & Security → Automation for Mail.app, Messages.app, Contacts.app, and Calendar.app. " +
+    "Allow that node in System Settings → Privacy & Security → Automation for Mail.app, Messages.app, Contacts.app, Calendar.app, and System Events (mail_send / mail_draft type the body via keystrokes). " +
     "Do not add node via + in the Contacts or Calendars privacy lists."
   );
 }
@@ -127,7 +127,7 @@ export function tccFallbackAdvice({
   if (mini && bridgeAvailable) {
     return (
       "The indexer daemon was reachable but the write was still denied; grant the daemon's node binary Full Disk Access (reads) and " +
-      "Allow node in System Settings > Privacy & Security > Automation for Mail.app, Messages.app, Contacts.app, and Calendar.app. " +
+      "Allow node in System Settings > Privacy & Security > Automation for Mail.app, Messages.app, Contacts.app, Calendar.app, and System Events. " +
       "A hang or timeout on Mail compose is TCC / Automation denied, not Mail.app missing. " +
       "Do not add node via + in the Contacts or Calendars privacy lists — those panes often have no Add button."
     );

package/lib/writeTools.js

@@ -57,7 +57,7 @@ export const WRITE_TOOL_DEFINITIONS = [
         bcc: { type: "array", items: { type: "string" }, description: "BCC email addresses" },
         subject: { type: "string", description: "Subject line (required)" },
         body: { type: "string", description: "Message body (required)" },
-        body_format: { type: "string", enum: ["plain", "html"], description: "Plain text (default) or HTML. HTML is tag-stripped and pasted into Mail's compose window; AppleScript content/html content is not set because it quote-wraps the Sent body" },
+        body_format: { type: "string", enum: ["plain", "html"], description: "Plain text (default) or HTML. HTML is tag-stripped; the body is typed into Mail's compose window (System Events keystrokes). AppleScript content/html content is not set because it quote-wraps the Sent body" },
         ...CONFIRM_PROPS
       },
       required: ["to", "subject", "body"]
@@ -74,7 +74,7 @@ export const WRITE_TOOL_DEFINITIONS = [
         bcc: { type: "array", items: { type: "string" }, description: "BCC email addresses" },
         subject: { type: "string", description: "Subject line" },
         body: { type: "string", description: "Message body" },
-        body_format: { type: "string", enum: ["plain", "html"], description: "Plain text (default) or HTML. HTML is tag-stripped and pasted into Mail's compose window; AppleScript content/html content is not set because it quote-wraps the Sent body" },
+        body_format: { type: "string", enum: ["plain", "html"], description: "Plain text (default) or HTML. HTML is tag-stripped; the body is typed into Mail's compose window (System Events keystrokes). AppleScript content/html content is not set because it quote-wraps the Sent body" },
         ...CONFIRM_PROPS
       },
       required: ["to"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.0.10",
+  "version": "2.1.1",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",