apple-tools-mcp 2.0.5 → 2.0.7

package/README.md

@@ -446,6 +446,7 @@ Two arguments are available on **every** write tool:
 - **Deletes always need `confirm: true`** — `mail_trash`, `calendar_remove`, `contacts_remove`, and `contacts_edit` when it clears every email or phone. Without it the call returns a `CONFIRMATION REQUIRED` preview and changes nothing. There is no bulk delete tool and no silent mass delete: one id per call.
 - **Multi-recipient sends always need `confirm: true`** — `mail_send` / `mail_forward` when `to` + `cc` + `bcc` total more than one address, `mail_reply` with `reply_all: true`, and `messages_send` to multiple handles or to a group chat. A single-recipient send runs on the first call.
 - **`mail_draft` is exempt from the recipient rule** because a draft is never delivered.
+- **`dry_run` and confirm-blocked calls are not deliveries.** Planned writes return `ok: false`, `planned: true`, `delivered: false`, and MCP sets `isError: true`, so a client that only checks `isError` cannot treat a preview as sent. The text is `DRY RUN` / `CONFIRMATION REQUIRED` and never `verified in Sent`. Re-run with `dry_run=false` (and `confirm=true` when required) to actually send.
 - Responses name what happened (tool, ids, recipients, titles) and never echo message bodies — including on the error path.
 - Writes never invent data. A missing or malformed `message_id`, `event_id`, `contact_id`, `chat_id`, or recipient is refused with a message saying so. Calendar times must be explicit local datetimes (`YYYY-MM-DD HH:MM`); natural language such as "next Tuesday" is rejected for writes.
 
@@ -465,13 +466,15 @@ Two arguments are available on **every** write tool:
 
 **Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then paste the body into the compose window (System Events). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected.
 
-Paste uses System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) in addition to Automation → Mail. That Accessibility deny is not a Mail Automation deny (`-1743` / `-10004`).
+Paste uses System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) in addition to Automation → Mail. That Accessibility deny is not a Mail Automation deny (`-1743` / `-10004`). Body focus uses `text area` / `scroll area` and `UI element whose role is "AXWebArea"` — never the System Events class `web area`, which does not compile on macOS 26.x (**-2741**, “Expected class name but found identifier”).
 
-**Manual prove (2.0.5 on the Mac host):** `mail_send` a short plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`).
+**mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used.
+
+**Manual prove (2.0.6 on the Mac host):** `mail_send` a short plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`, no **-2741** on body focus). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
 
 Emails are addressed by their RFC822 **Message-ID**. Pass `message_id`, or pass the `file_path` from `mail_search` / `mail_recent` and the server reads the Message-ID out of the `.emlx` headers for you. `mail_archive` moves the message to its account's Archive (or All Mail) mailbox; `mail_trash` moves it to that account's Trash.
 
-**Send timeout vs TCC — check Sent before retrying.** `mail_send` / `mail_reply` / `mail_forward` can hang after Mail has already put the message in Sent. That hang is a **timeout** (`ETIMEDOUT` / `-1712` / AppleEvent timed out), not a TCC deny. The same hang-vs-TCC split applies to **find / reply / open before send** — an Allowed `ETIMEDOUT` there is never `MAIL_TCC_GUIDANCE`. Real Mail Automation denials report **`-1743`**, **`-10004`**, or “not authorized to send Apple events”. After a send hang the tool looks in Sent (and Outbox) and returns **success** if the message is there — never label a delivered send as TCC fail or timeout. Replies match `In-Reply-To` or an exact recent `Re:` + original subject (the fallback compose does not set reply headers). Forwards match the intended recipient plus an exact `Fwd:` subject or the original Message-ID in a forwarded body — not `In-Reply-To`, and not an unrelated `Fwd:` that only shares a To. Neither scan treats the original itself as this send. If Sent-verify misses, the error tells you it was a hang and to check Sent. **Clients must Sent-check before retrying a timed-out send**; retrying a message that already landed sends a second copy. This is not a silent TCC grant.
+**Send timeout vs TCC — check Sent before retrying.** `mail_send` / `mail_reply` / `mail_forward` can hang after Mail has already put the message in Sent. That hang is a **timeout** (`ETIMEDOUT` / `-1712` / AppleEvent timed out), not a TCC deny. The same hang-vs-TCC split applies to **find / reply / open before send** — an Allowed `ETIMEDOUT` there is never `MAIL_TCC_GUIDANCE`. Real Mail Automation denials report **`-1743`**, **`-10004`**, or “not authorized to send Apple events”. After a send hang the tool looks in Sent (and Outbox) and returns **success** if the message is there — never label a delivered send as TCC fail or timeout. Replies match `In-Reply-To` or an exact recent `Re:` + original subject (the fallback compose does not set reply headers). Forwards match the intended recipient plus an exact `Fwd:` subject or the original Message-ID in a forwarded body — not `In-Reply-To`, and not an unrelated `Fwd:` that only shares a To. Compose (`mail_send`) matches the intended **To plus exact subject** (and Message-ID when available), never subject alone. Neither scan treats the original itself as this send. A real send that returns without throw is also verified the same way before success. If Sent-verify misses, the error tells you it was a hang (or a verify-miss after send returned) and to check Sent. **Clients must Sent-check before retrying a timed-out send**; retrying a message that already landed sends a second copy. This is not a silent TCC grant.
 
 ### Messages write tool
 

package/index.js

@@ -27,7 +27,8 @@ import {
   WRITE_TOOL_DEFINITIONS,
   isWriteTool,
   dispatchWriteTool,
-  executeWriteToolLocally
+  executeWriteToolLocally,
+  mcpWriteResult
 } from "./lib/writeTools.js";
 import { startWriteBridgeServer, defaultSocketPath } from "./lib/writeBridge.js";
 import { closeEventKitSession, ensureEventKitSession } from "./lib/eventKitSession.js";
@@ -1373,10 +1374,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         socketPath: WRITE_SOCKET_PATH,
         log: (msg) => console.error(msg)
       });
-      return {
-        content: [{ type: "text", text: writeResult.message }],
-        ...(writeResult.ok === false ? { isError: true } : {})
-      };
+      return mcpWriteResult(writeResult);
     }
 
     switch (name) {

package/lib/appleScript.js

@@ -353,7 +353,7 @@ export const MAIL_SEND_TIMEOUT_GUIDANCE =
   "Mail AppleScript timed out (ETIMEDOUT / -1712 / AppleEvent timed out) — this is a find/reply/send hang (including find/reply/open before send), not a TCC / Automation deny. " +
   "Real Mail Automation denials report -1743, -10004, or \"not authorized to send Apple events\". " +
   "A timeout can happen after Mail already delivered the message. Check Sent (and Outbox) for this send before retrying; a retry after a successful delivery sends a second copy. " +
-  "This tool verifies Sent when a send hangs; if nothing is there yet, wait and look again rather than immediately resending.";
+  "This tool verifies Sent/Outbox when a send hangs (To + subject, Message-ID when available — never subject alone); if nothing is there yet, wait and look again rather than immediately resending.";
 
 /**
  * Messages writes are a separate Automation target from Mail / Contacts / Calendar.

package/lib/calendarWrite.js

@@ -22,6 +22,7 @@ import {
 } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   validateEventId,
   validateEventKitId,
   validateCalendarName,
@@ -772,7 +773,7 @@ export function calendarAdd(args = {}) {
     `${alerts.minutes.length ? ` with alerts ${alerts.minutes.join(", ")} min before` : ""}`;
 
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   // Non-recurring creates MUST go through EventKit. Mini 8be6cd5: EventKit
   // add failed (likely writeOnly cannot list calendars) and we silently
@@ -1037,7 +1038,7 @@ export function calendarEdit(args = {}) {
 
   const summary = `update event ${eventId}: ${changed.join(", ")}`;
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const preferEventKit = Boolean(eventKitId) || eventId.includes(":");
   if (preferEventKit && !recurrence.rule) {
@@ -1219,7 +1220,7 @@ export function calendarRemove(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   // writeOnly cannot re-query; prefer the EventKit session that cached
   // the EKEvent from create. One-shot lookup is a full-access fallback.
@@ -1339,7 +1340,7 @@ export function calendarRsvp(args = {}) {
 
   const summary = `RSVP ${responseRaw} to event ${eventId}`;
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildRsvpScript({ eventId, status: RSVP_STATUS[responseRaw], attendeeEmail }),

package/lib/contactsWrite.js

@@ -20,6 +20,7 @@ import {
 import { safeOpenApp } from "./shell.js";
 import {
   planWrite,
+  plannedWriteResult,
   normalizeList,
   isEmailAddress,
   isPhoneNumber,
@@ -254,7 +255,7 @@ export function contactsAdd(args = {}, deps = {}) {
     `${phones.phones.length ? ` and ${phones.phones.length} phone number(s)` : ""}`;
 
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const properties = {};
   if (firstName.text) properties["first name"] = firstName.text;
@@ -357,7 +358,7 @@ export function contactsEdit(args = {}, deps = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const ready = ensureContactsAppReady(deps);
   if (!ready.ok) return { ok: false, message: failure(action, summary, ready) };
@@ -413,7 +414,7 @@ export function contactsRemove(args = {}, deps = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const ready = ensureContactsAppReady(deps);
   if (!ready.ok) return { ok: false, message: failure(action, summary, ready) };

package/lib/mailWrite.js

@@ -7,10 +7,12 @@
  * is resolved to a Message-ID by reading the .emlx headers, so callers never
  * have to invent an identifier.
  *
- * After a send/reply/forward hang, Sent (and Outbox) is checked before the
- * tool reports failure. A message already in Sent is success — never a TCC
- * fail. ETIMEDOUT / -1712 is a timeout (find/reply/open before send too);
- * -1743 / -10004 is a hard deny.
+ * After a real send (and after a send/reply/forward hang), Sent and Outbox
+ * are checked before the tool reports success. AppleScript `send` returning
+ * without throw is not enough. A message already in Sent or still in Outbox
+ * is success — never a TCC fail. Hang recover matches To + subject (and
+ * Message-ID when available), never subject alone. ETIMEDOUT / -1712 is a
+ * timeout (find/reply/open before send too); -1743 / -10004 is a hard deny.
  */
 
 import fs from "fs";
@@ -29,6 +31,7 @@ import {
 } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   validateEmailList,
   validateBody,
   validateSubject,
@@ -171,6 +174,10 @@ export function composeNativeBody(body, { html = false } = {}) {
 /**
  * AppleScript handlers: focus the compose body (not To) and paste.
  * System Events needs Accessibility; Mail make/send still needs Automation.
+ *
+ * macOS 26.x System Events has no `web area` class (compile -2741,
+ * "Expected class name but found identifier"). Hosts compile
+ * `text area` / `scroll area` and `UI element whose role is "AXWebArea"`.
  */
 export function buildMailBodyPasteHandler() {
   return `on atmFocusMailBody()
@@ -184,21 +191,58 @@ export function buildMailBodyPasteHandler() {
         return
       end try
       try
-        click (first web area of w)
+        set focused of text area 1 of w to true
+        return
+      end try
+      try
+        set focused of (first UI element of w whose role is "AXTextArea") to true
+        return
+      end try
+      try
+        click (first UI element of w whose role is "AXWebArea")
         return
       end try
       try
-        click (first web area of scroll area 1 of w)
+        click (first UI element of scroll area 1 of w whose role is "AXWebArea")
         return
       end try
       try
-        click (first web area of scroll area 1 of splitter group 1 of w)
+        click (first UI element of scroll area 1 of splitter group 1 of w whose role is "AXWebArea")
         return
       end try
       try
-        click (first web area of scroll area 1 of group 1 of splitter group 1 of w)
+        click (first UI element of scroll area 1 of group 1 of splitter group 1 of w whose role is "AXWebArea")
         return
       end try
+      set atmQueue to UI elements of w
+      set atmWalked to 0
+      repeat while (count of atmQueue) > 0 and atmWalked < 80
+        set atmWalked to atmWalked + 1
+        set atmElem to item 1 of atmQueue
+        if (count of atmQueue) is 1 then
+          set atmQueue to {}
+        else
+          set atmQueue to items 2 thru -1 of atmQueue
+        end if
+        try
+          if (role of atmElem as string) is "AXWebArea" then
+            click atmElem
+            return
+          end if
+        end try
+        try
+          if (role of atmElem as string) is "AXTextArea" then
+            set focused of atmElem to true
+            return
+          end if
+        end try
+        try
+          set atmKids to UI elements of atmElem
+          repeat with i from 1 to (count of atmKids)
+            set end of atmQueue to item i of atmKids
+          end repeat
+        end try
+      end repeat
       set {wx, wy} to position of w
       set {ww, wh} to size of w
       click at {(wx + (ww div 2)) as integer, (wy + ((wh * 2) div 3)) as integer}
@@ -295,9 +339,14 @@ on error errMsg number errNum
   end try
   error errMsg number errNum
 end try
+set atmOutgoingId to ""
 tell application "Mail"
+  try
+    set atmOutgoingId to message id of newMessage as string
+  end try
   ${send ? "send newMessage" : "save newMessage"}
 end tell
+if atmOutgoingId is not "" then return atmOutgoingId
 return "OK"`;
 }
 
@@ -309,8 +358,31 @@ function summarizeRecipients(to, cc, bcc) {
   return parts.join("; ");
 }
 
+export const SENT_VERIFY_SENT = "SENT";
+export const SENT_VERIFY_OUTBOX = "OUTBOX";
+export const SENT_VERIFY_NOT_FOUND = "NOT_FOUND";
+/** Older hang-recovery scripts returned FOUND to mean Sent. Still accepted. */
 export const SENT_VERIFY_FOUND = "FOUND";
 export const SENT_VERIFY_TIMEOUT_MS = 15000;
+export const SENT_VERIFY_ATTEMPTS = 3;
+export const SENT_VERIFY_RETRY_MS = 400;
+
+export const MAIL_VERIFY_MISS_GUIDANCE =
+  "Mail reported the send call succeeded, but the message was not found in Sent or Outbox. Do not assume it was delivered.";
+
+function defaultSentVerifySleep(ms) {
+  if (!ms || ms <= 0) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Test hook: skip the retry delay without changing attempt count. */
+export const sentVerifyClock = {
+  sleep: defaultSentVerifySleep
+};
+
+export function resetSentVerifyClock() {
+  sentVerifyClock.sleep = defaultSentVerifySleep;
+}
 
 /**
  * Hard Mail Automation deny: -1743 / -10004 / "not authorized…", or
@@ -335,10 +407,10 @@ function mailBoxesPreamble() {
   return `  set cutoff to (current date) - (10 * minutes)
   set boxes to {}
   try
-    set end of boxes to sent mailbox
+    set end of boxes to outgoing mailbox
   end try
   try
-    set end of boxes to outgoing mailbox
+    set end of boxes to sent mailbox
   end try
   repeat with acct in accounts
     try
@@ -351,6 +423,48 @@ function appleScriptToList(addresses = []) {
   return `{${addresses.map((address) => asString(address)).join(", ")}}`;
 }
 
+function loadMailboxMessagesSnippet() {
+  return `      set recentMsgs to {}
+      set scanAll to false
+      try
+        if boxRef is outgoing mailbox then set scanAll to true
+      end try
+      try
+        set nm to name of boxRef as string
+        if nm contains "Outbox" then set scanAll to true
+        if nm contains "Outgoing" then set scanAll to true
+      end try
+      if scanAll then
+        set recentMsgs to messages of boxRef
+      else
+        set recentMsgs to (messages of boxRef whose date sent > cutoff)
+      end if`;
+}
+
+function verifyHitReturn() {
+  return `              try
+                if boxRef is outgoing mailbox then return "${SENT_VERIFY_OUTBOX}"
+              end try
+              try
+                set nm to name of boxRef as string
+                if nm contains "Outbox" then return "${SENT_VERIFY_OUTBOX}"
+                if nm contains "Outgoing" then return "${SENT_VERIFY_OUTBOX}"
+              end try
+              return "${SENT_VERIFY_SENT}"`;
+}
+
+function recipientHitSnippet() {
+  return `            set hitTo to false
+            try
+              repeat with recip in (to recipients of msg)
+                set recipAddr to address of recip as string
+                repeat with wanted in wantedTos
+                  if recipAddr is (wanted as string) then set hitTo to true
+                end repeat
+              end repeat
+            end try`;
+}
+
 /**
  * Look in Sent / Outbox for a reply of `messageId`.
  * Proper Mail replies set In-Reply-To. The fallback `make new outgoing
@@ -373,7 +487,7 @@ tell application "Mail"
 ${mailBoxesPreamble()}
   repeat with boxRef in boxes
     try
-      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+${loadMailboxMessagesSnippet()}
       repeat with msg in recentMsgs
         try
           set candId to message id of msg
@@ -382,12 +496,18 @@ ${mailBoxesPreamble()}
           else
             try
               set src to source of msg
-              if src contains ("In-Reply-To: " & ${needleAngle}) then return "${SENT_VERIFY_FOUND}"
-              if src contains ("In-Reply-To: " & ${needleBare}) then return "${SENT_VERIFY_FOUND}"
+              if src contains ("In-Reply-To: " & ${needleAngle}) then
+${verifyHitReturn()}
+              end if
+              if src contains ("In-Reply-To: " & ${needleBare}) then
+${verifyHitReturn()}
+              end if
             end try
             if origSubject is not "" then
               set subj to subject of msg
-              if subj is ("Re: " & origSubject) then return "${SENT_VERIFY_FOUND}"
+              if subj is ("Re: " & origSubject) then
+${verifyHitReturn()}
+              end if
             end if
           end if
         end try
@@ -395,7 +515,7 @@ ${mailBoxesPreamble()}
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
@@ -422,7 +542,7 @@ ${mailBoxesPreamble()}
   set wantedTos to ${toList}
   repeat with boxRef in boxes
     try
-      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+${loadMailboxMessagesSnippet()}
       repeat with msg in recentMsgs
         try
           set candId to message id of msg
@@ -433,15 +553,7 @@ ${mailBoxesPreamble()}
             if src contains ("In-Reply-To: " & ${needleAngle}) or src contains ("In-Reply-To: " & ${needleBare}) then
               -- A reply to the original is not this forward.
             else
-              set hitTo to false
-              try
-                repeat with recip in (to recipients of msg)
-                  set recipAddr to address of recip as string
-                  repeat with wanted in wantedTos
-                    if recipAddr is (wanted as string) then set hitTo to true
-                  end repeat
-                end repeat
-              end try
+${recipientHitSnippet()}
               if hitTo then
                 set subj to subject of msg
                 set exactFwd to false
@@ -457,8 +569,12 @@ ${mailBoxesPreamble()}
                 set mentionsOrigId to false
                 if src contains ${needleAngle} then set mentionsOrigId to true
                 if src contains ${needleBare} then set mentionsOrigId to true
-                if exactFwd then return "${SENT_VERIFY_FOUND}"
-                if looksForward and mentionsOrigId then return "${SENT_VERIFY_FOUND}"
+                if exactFwd then
+${verifyHitReturn()}
+                end if
+                if looksForward and mentionsOrigId then
+${verifyHitReturn()}
+                end if
               end if
             end if
           end if
@@ -467,45 +583,125 @@ ${mailBoxesPreamble()}
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
- * Look in Sent / Outbox for a compose whose subject matches exactly and
- * was sent in the last 10 minutes.
+ * Look in Sent / Outbox for a compose matching To + subject.
+ * Never matches subject alone — short subjects like "test" are unsafe.
+ * When `messageId` is present, prefer that id together with To.
  */
-export function buildFindSentBySubjectScript(subject) {
-  const subj = asString(subject);
+export function buildFindSentByRecipientAndSubjectScript(subject, toAddresses = [], messageId = null) {
+  const toList = appleScriptToList(toAddresses);
+  const subj = asString(subject || "");
+  const idLit = messageId ? asString(messageId) : null;
+  const matchBody = idLit
+    ? `${recipientHitSnippet()}
+            set candId to message id of msg
+            set hitId to false
+            try
+              if candId is ${idLit} then set hitId to true
+            end try
+            if hitId and hitTo then
+${verifyHitReturn()}
+            end if
+            if hitTo then
+              set subj to subject of msg
+              if subj is ${subj} then
+${verifyHitReturn()}
+              end if
+            end if`
+    : `${recipientHitSnippet()}
+            if hitTo then
+              set subj to subject of msg
+              if subj is ${subj} then
+${verifyHitReturn()}
+              end if
+            end if`;
+
   return `tell application "Mail"
 ${mailBoxesPreamble()}
+  set wantedTos to ${toList}
   repeat with boxRef in boxes
     try
-      set hits to (messages of boxRef whose subject is ${subj} and date sent > cutoff)
-      if (count of hits) > 0 then return "${SENT_VERIFY_FOUND}"
+${loadMailboxMessagesSnippet()}
+      repeat with msg in recentMsgs
+        try
+${matchBody}
+        end try
+      end repeat
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
- * After a send hang, ask Mail whether the message is already in Sent.
- * Returns a hit object or null. Verify failure / timeout is not success.
+ * @deprecated Subject-only matching is unsafe. Requires To as the second
+ * argument; without recipients the scan cannot hit.
  */
-export function recoverIfInSent({ inReplyTo = null, subject = null, forwardTo = null } = {}) {
-  const script = forwardTo && inReplyTo
-    ? buildFindSentForwardScript(inReplyTo, forwardTo)
-    : inReplyTo
-      ? buildFindSentByInReplyToScript(inReplyTo)
-      : subject
-        ? buildFindSentBySubjectScript(subject)
-        : null;
+export function buildFindSentBySubjectScript(subject, toAddresses = []) {
+  return buildFindSentByRecipientAndSubjectScript(subject, toAddresses);
+}
+
+export function parseSentVerifyOutput(output) {
+  const out = String(output || "").trim();
+  if (out === SENT_VERIFY_SENT || out === SENT_VERIFY_FOUND) {
+    return { found: true, mailbox: "sent" };
+  }
+  if (out === SENT_VERIFY_OUTBOX) {
+    return { found: true, mailbox: "outbox" };
+  }
+  return null;
+}
+
+export function parseOutgoingMessageId(output) {
+  const raw = String(output || "").trim();
+  if (!raw || raw === "OK") return null;
+  return validateMessageId(raw);
+}
+
+function pickSentVerifyScript({
+  inReplyTo = null,
+  subject = null,
+  forwardTo = null,
+  to = null,
+  messageId = null
+} = {}) {
+  if (forwardTo && inReplyTo) return buildFindSentForwardScript(inReplyTo, forwardTo);
+  if (inReplyTo) return buildFindSentByInReplyToScript(inReplyTo);
+  const toList = Array.isArray(to) ? to : [];
+  if (toList.length > 0 && (subject || messageId)) {
+    return buildFindSentByRecipientAndSubjectScript(subject || "", toList, messageId);
+  }
+  return null;
+}
+
+/**
+ * After a send hang, ask Mail whether the message is already in Sent/Outbox.
+ * Compose matches require To + subject (Message-ID when available) — never
+ * subject alone. Returns a hit object or null. Verify failure is not success.
+ */
+export function recoverIfInSent(match = {}) {
+  const script = pickSentVerifyScript(match);
   if (!script) return null;
   const result = runAppleScript(script, { timeout: SENT_VERIFY_TIMEOUT_MS, appName: "Mail" });
   if (!result.ok) return null;
-  const out = String(result.output || "").trim();
-  if (out === SENT_VERIFY_FOUND) return { found: true };
-  return null;
+  return parseSentVerifyOutput(result.output);
+}
+
+/**
+ * Poll Sent/Outbox after a send that returned without throw.
+ */
+export function verifyQueuedMessage(match = {}, { attempts = SENT_VERIFY_ATTEMPTS, retryMs = SENT_VERIFY_RETRY_MS } = {}) {
+  let last = null;
+  const n = Math.max(1, attempts);
+  for (let i = 0; i < n; i++) {
+    last = recoverIfInSent(match);
+    if (last) return last;
+    if (i < n - 1) sentVerifyClock.sleep(retryMs);
+  }
+  return last;
 }
 
 export function isMailAccessibilityDenial(result) {
@@ -545,9 +741,41 @@ function failure(action, summary, result, secrets) {
 }
 
 /**
- * Finish a compose/reply/forward. A send hang is not labeled TCC; if Mail
- * already delivered, return success. Hard -1743/-10004 stays a deny.
+ * Finish a compose/reply/forward. A real send is not success until Sent or
+ * Outbox verify hits. A send hang is not labeled TCC; if Mail already
+ * delivered, return success. Hard -1743/-10004 stays a deny.
  */
+function deliverySummary(successSummary, mailbox, recovered) {
+  if (mailbox === "outbox") {
+    return recovered
+      ? "queued in Outbox (still sending; verified after AppleScript hang)"
+      : "queued in Outbox (still sending)";
+  }
+  return recovered
+    ? `${successSummary} (verified in Sent after AppleScript hang)`
+    : `${successSummary} (verified in Sent)`;
+}
+
+function sendVerifiedSuccess({ action, successSummary, details, verified, recovered }) {
+  const mailbox = verified.mailbox;
+  const delivered = mailbox === "sent";
+  return {
+    ok: true,
+    delivered,
+    mailbox,
+    recovered: recovered || undefined,
+    message: writeSuccessMessage(action, deliverySummary(successSummary, mailbox, recovered), {
+      ...details,
+      mailbox,
+      delivery: delivered ? "sent" : "outbox"
+    })
+  };
+}
+
+function verifyMissMessage(action, summary) {
+  return `${action} failed — attempted to ${summary}. ${MAIL_VERIFY_MISS_GUIDANCE}`;
+}
+
 function finalizeMailWrite({
   action,
   summary,
@@ -557,30 +785,33 @@ function finalizeMailWrite({
   inReplyTo = null,
   subject = null,
   forwardTo = null,
+  to = null,
+  messageId = null,
   successSummary,
   details
 }) {
+  const match = { inReplyTo, subject, forwardTo, to, messageId };
+
   if (result.ok) {
-    return { ok: true, message: writeSuccessMessage(action, successSummary, details) };
+    if (!sendNow) {
+      return { ok: true, delivered: false, mailbox: null, message: writeSuccessMessage(action, successSummary, details) };
+    }
+    const verified = verifyQueuedMessage(match);
+    if (!verified) {
+      return { ok: false, delivered: false, mailbox: null, message: verifyMissMessage(action, summary) };
+    }
+    return sendVerifiedSuccess({ action, successSummary, details, verified, recovered: false });
   }
 
   if (sendNow && isMailSendTimeout(result)) {
-    const recovered = recoverIfInSent({ inReplyTo, subject, forwardTo });
+    const recovered = recoverIfInSent(match);
     if (recovered) {
-      return {
-        ok: true,
-        recovered: true,
-        message: writeSuccessMessage(
-          action,
-          `${successSummary} (verified in Sent after AppleScript hang)`,
-          details
-        )
-      };
+      return sendVerifiedSuccess({ action, successSummary, details, verified: recovered, recovered: true });
     }
-    return { ok: false, message: failure(action, summary, result, secrets) };
+    return { ok: false, delivered: false, mailbox: null, message: failure(action, summary, result, secrets) };
   }
 
-  return { ok: false, message: failure(action, summary, result, secrets) };
+  return { ok: false, delivered: false, mailbox: null, message: failure(action, summary, result, secrets) };
 }
 
 /**
@@ -623,7 +854,7 @@ export function mailCompose(args = {}, { draft = false } = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const script = buildComposeScript({
     to: to.addresses,
@@ -643,6 +874,8 @@ export function mailCompose(args = {}, { draft = false } = {}) {
     secrets: [body.text, subject.text],
     sendNow: !draft,
     subject: draft ? null : subject.text,
+    to: draft ? null : to.addresses,
+    messageId: draft ? null : parseOutgoingMessageId(result.output),
     successSummary: draft ? "draft saved to Drafts" : "sent",
     details: {
       to: to.addresses.join(", "),
@@ -702,7 +935,7 @@ export function mailReply(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildReplyScript({ messageId: resolved.messageId, body: body.text, replyAll, sendNow }),
@@ -765,7 +998,7 @@ export function mailForward(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildForwardScript({ messageId: resolved.messageId, to: to.addresses, body: body.text, sendNow }),
@@ -813,7 +1046,7 @@ export function mailMark(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(buildMarkScript({ messageId: resolved.messageId, read: status === "read" }), { appName: "Mail" });
   if (!result.ok) return { ok: false, message: failure(action, summary, result, []) };
@@ -858,7 +1091,7 @@ export function mailArchive(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildMoveScript({
@@ -891,7 +1124,7 @@ export function mailTrash(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildMoveScript({

package/lib/messagesWrite.js

@@ -17,6 +17,7 @@ import { escapeSQL } from "./validators.js";
 import { runAppleScript, asString, MESSAGES_TCC_GUIDANCE, MESSAGES_APP_NOT_RUNNING_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   normalizeList,
   isMessagesHandle,
   validateChatGuid,
@@ -261,7 +262,7 @@ export function messagesSend(args = {}, deps = {}) {
       dryRun,
       confirm
     });
-    if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+    if (!plan.proceed) return plannedWriteResult(plan);
 
     const result = runAppleScript(
       buildSendToChatScript({ chatGuid: guid, text: body.text, attachmentPath: attachment.filePath }),
@@ -293,7 +294,7 @@ export function messagesSend(args = {}, deps = {}) {
 
   const summary = `send a message to ${handles.join(", ")} over ${serviceRaw}${attachment.filePath ? " with an attachment" : ""}`;
   const plan = planWrite({ action, summary, recipientCount: handles.length, dryRun, confirm });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildSendToHandlesScript({

package/lib/writeGuards.js

@@ -215,6 +215,24 @@ export function planWrite({
   return { decision: "execute", proceed: true, requiresConfirm, message: null };
 }
 
+/**
+ * Planned / dry_run / confirm-blocked results are not deliveries.
+ *
+ * MCP CallTool only surfaces `message` plus optional `isError`. Clients that
+ * treat a missing `isError` as success would read `ok: true` planned results
+ * as delivered. Planned writes therefore return `ok: false` with
+ * `planned: true` and `delivered: false`.
+ */
+export function plannedWriteResult(plan) {
+  return {
+    ok: false,
+    planned: true,
+    delivered: false,
+    mailbox: null,
+    message: plan && plan.message ? plan.message : "Nothing was changed."
+  };
+}
+
 export function truncate(text, max = 200) {
   if (typeof text !== "string") return "";
   const oneLine = text.replace(/\s+/g, " ").trim();

package/lib/writeTools.js

@@ -48,7 +48,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   // ============ MAIL WRITES ============
   {
     name: "mail_send",
-    description: "Send an email through Mail.app. Sending to more than one recipient in total (to + cc + bcc) requires confirm=true. Use dry_run=true to preview. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Send an email through Mail.app. Success means the message was verified in Sent or is still in Outbox (still sending) — AppleScript send returning is not enough. Sending to more than one recipient in total (to + cc + bcc) requires confirm=true. dry_run and unconfirmed multi-recipient calls are not deliveries (MCP isError). A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover matches To+subject (Message-ID when available), never subject alone. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -82,7 +82,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   },
   {
     name: "mail_reply",
-    description: "Reply to an existing email. reply_all=true fans out to every original recipient and requires confirm=true. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Reply to an existing email. reply_all=true fans out to every original recipient and requires confirm=true. A real send is verified in Sent/Outbox before success. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover uses In-Reply-To. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -97,7 +97,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   },
   {
     name: "mail_forward",
-    description: "Forward an existing email to new recipients. More than one recipient requires confirm=true. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Forward an existing email to new recipients. More than one recipient requires confirm=true. A real send is verified in Sent/Outbox before success. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover matches intended To plus Fwd: subject or original Message-ID. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -343,6 +343,23 @@ export function isWriteTool(name) {
   return Object.prototype.hasOwnProperty.call(WRITE_TOOL_HANDLERS, name);
 }
 
+/**
+ * MCP CallTool payload for a write. Planned / dry_run / confirm-blocked
+ * results set isError so clients that only check isError cannot treat them
+ * as delivered. Verified sends (ok: true) do not set isError.
+ *
+ * @param {{ ok?: boolean, planned?: boolean, message?: string }} writeResult
+ */
+export function mcpWriteResult(writeResult) {
+  const message = writeResult && writeResult.message ? writeResult.message : "write failed";
+  const planned = Boolean(writeResult && writeResult.planned);
+  const failed = !writeResult || writeResult.ok === false;
+  return {
+    content: [{ type: "text", text: message }],
+    ...((failed || planned) ? { isError: true } : {})
+  };
+}
+
 /**
  * Run a write in this process.
  * @returns {{ ok: boolean, message: string }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",

package/scripts/smoke-writes.js

@@ -233,8 +233,9 @@ function line(label, value) {
 }
 
 function step(name, result, severity = "error") {
-  const failed = result.ok === false;
-  const status = failed ? (severity === "warning" ? "WARN" : "FAIL") : result.planned ? "PLANNED" : "OK";
+  const planned = result && result.planned === true;
+  const failed = result && result.ok === false && !planned;
+  const status = planned ? "PLANNED" : failed ? (severity === "warning" ? "WARN" : "FAIL") : "OK";
   console.log(`\n[${status}] ${name}`);
   console.log(`  ${result.message}`);
   return result;
@@ -348,7 +349,7 @@ async function main() {
   }));
   results.push(created);
 
-  if (created.ok !== false) {
+  if (created.ok !== false || created.planned) {
     const contactId = apply ? extractContactId(created.message) : "ABCD1234-SMOKE:ABPerson";
     if (apply && !contactId) {
       console.log("  contacts_add reported success but returned no contact id; skipping edit/delete.");
@@ -405,7 +406,7 @@ async function main() {
   }));
   results.push(eventCreated);
 
-  if (eventCreated.ok !== false) {
+  if (eventCreated.ok !== false || eventCreated.planned) {
     const eventId = apply ? extractEventId(eventCreated.message) : "ATM-SMOKE-EVENT-UID";
     const extractedKitId = apply ? extractEventKitId(eventCreated.message) : "EK-SMOKE";
     const eventKitId = extractedKitId || (eventId && eventId.includes(":") ? eventId : null);
@@ -451,7 +452,7 @@ async function main() {
     }
   }
 
-  const failed = results.some((r) => r && r.ok === false);
+  const failed = results.some((r) => r && r.ok === false && !r.planned);
   console.log("\n" + "=".repeat(60));
   if (failed) {
     console.log("Result: FAILED - see the messages above.");