apple-tools-mcp 2.1.1 → 2.1.3

package/README.md

@@ -104,7 +104,7 @@ If the invoked CLI path and `process.execPath` differ, the command prints a **WA
 
 On the host UI (Mini Screen Sharing or MacBook local), open **System Settings → Privacy & Security → Automation**, then run the command. Click **Allow** for **`node`** → Contacts, Calendar, Mail, Messages, and System Events. npm `postinstall` only **prints a reminder** — it does not run the probes unattended.
 
-This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events). System Events is asked for its process name (nothing is typed) so the keystroke compose path can pop **Allow**.
+This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events). System Events is probed with **process / GUI scripting** (`tell process` + `unix id` of System Events; nothing is typed) so the keystroke compose path can pop **Allow** and verify a real Automation grant. A soft `tell application "System Events" to get name` is **not** enough — that can succeed while TCC still has node → System Events **denied**. If a prior **Don't Allow** left a sticky Deny, `permissions` reports System Events **missing** and exits non-zero: turn **System Events** on for that node in System Settings → Privacy & Security → **Automation**, then **re-run `apple-tools-mcp permissions` after Allow**.
 
 **One-pass first-run:** Allow **`node`** to control **Mail**, **Messages**, **Contacts**, **Calendar**, and **System Events** in the same Automation pass. Contacts or Calendar being allowed does **not** grant Mail, Messages, or System Events — they are separate Apple Events targets. A denied Mail grant hangs `mail_send` / `mail_draft` / `mail_reply` / `mail_forward` until the client disconnects; `dry_run` never talks to Mail, so that deny is invisible until a real compose.
 
@@ -308,7 +308,7 @@ Missing `config.json` is fine — env then the 5-minute default apply.
 
 On Mini, run the **indexer daemon**, not a sleep-pipe wrapper around `apple-tools-mcp`. Claude Desktop and other clients still attach via short-lived stdio MCP (`npx -y apple-tools-mcp` or the global `apple-tools-mcp` bin).
 
-The daemon does two jobs: it refreshes the vector index, and it serves the **write bridge** at `~/.apple-tools-mcp/writer.sock` so stdio clients can perform Mail / Messages / Contacts / Calendar writes that their host app cannot be granted (see [step 2b](#2b-grant-automation-for-write-tools-first-run--ship-gate)). When macOS prompts, Allow **`node`** (the LaunchAgent binary) to control Mail.app, Messages.app, Contacts.app, Calendar.app, **and System Events** (mail_send / mail_draft type the body via keystrokes). Do not approve the MCP client / host app that launched a short-lived stdio server, and do not try to add `node` via **+** in the Contacts or Calendars privacy lists.
+The daemon does two jobs: it refreshes the vector index, and it serves the **write bridge** at `~/.apple-tools-mcp/writer.sock` so stdio clients can perform Mail / Messages / Contacts / Calendar writes that their host app cannot be granted (see [step 2b](#2b-grant-automation-for-write-tools-first-run--ship-gate)). When macOS prompts, Allow **`node`** (the LaunchAgent binary) to control Mail.app, Messages.app, Contacts.app, Calendar.app, **and System Events** (mail_send / mail_draft fill the body via AX hit-test). Do not approve the MCP client / host app that launched a short-lived stdio server, and do not try to add `node` via **+** in the Contacts or Calendars privacy lists.
 
 **Keep Contacts.app, Mail.app, and Messages.app running all the time** on the Mini (and on any MacBook that does local writes). Quitting them makes Apple Events to those apps unreliable (`-600` / “application isn't running”), which is a cold-launch miss — not a missing Automation grant. The Contacts write path launches Contacts.app before add/edit/remove, but do not rely on that instead of leaving the apps open. **Calendar.app does not need to stay open**; Calendar writes use EventKit.
 
@@ -464,7 +464,7 @@ Two arguments are available on **every** write tool:
 
 `body_format: "html"` uses the same compose path with a tag-stripped body pasted into Mail's native editor. It does **not** set Mail's `content` or `html content` — those setters cite-wrap the whole message (`>` prefixes and `<blockquote type="cite">`, same iOS purple bar). Mail may still generate its own HTML alternative from the native compose. The default is plain text.
 
-**Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then type the body into the compose window (System Events keystrokes). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected (those paths still prepend via `content`; fixing reply/forward cite-wrap is out of scope for 2.1.0).
+**Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then fill the body into the compose window (subject title-marker + coordinate AX hit-test, then AXValue). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected (those paths still prepend via `content`; fixing reply/forward cite-wrap is out of scope for 2.1.0).
 
 Keystrokes use System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) **and** Automation → Mail **and** Automation → System Events. Run `apple-tools-mcp permissions` after first install or upgrade so **node → System Events** pops **Allow** in the same sitting as Mail / Messages / Contacts / Calendar. An Accessibility / System Events deny is not a Mail Automation deny (`-1743` / `-10004`).
 
@@ -478,9 +478,11 @@ Keystrokes use System Events, so **node needs Accessibility** (Privacy & Securit
 
 **AX body-focus oracle (2.1.1).** Dual-host Mail 16 / macOS 26 showed that Mail AppleScript `content of` the outgoing message is **not** a live oracle for UI-typed/pasted text: `set content` reads back, but after Tab + keystroke/paste into the UI body `content of` stays empty (`typedSeen=false`, bodyLen 0) even when typing still produces a plain Sent `.emlx`. `@2.1.0` calibrated Tab against that property and fail-closed with `BODY_FOCUS_FAILED`. 2.1.1 Tabs until the focused AX role is a body field (`AXWebArea` / non-header `AXTextArea` via `AXFocusedUIElement` / `first UI element whose focused is true` — never `focused UI element`, never `windows of process Mail`). Cmd-V runs only when that AX **value** is readable and still missing the needle. An empty AX value is not a miss (Mail 16 WebArea); header checks still fail-closed. Ship prove that the body landed remains the Sent `.emlx` after send (2.0.7 To+subject verify). Do not “fix Tab count.”
 
+**Compose body hit-test (2.1.3).** Mini host: `AXFocusedUIElement` role coerce fails (**-1700**); `windows of process Mail` is empty; a deep `UI elements` tree walk (the `app_ax_find` class of walk) **truncates after ~23 header/toolbar nodes** and never reaches compose `AXWebArea`. Subject-anchored clipboard read-back is refuted on Mini. The proven path: identify the compose window by the **subject title** among **top-level** System Events UI elements, then **coordinate AX hit-test** (`AXUIElementCopyElementAtPosition`) into the body region. The hit must be `AXWebArea` **"message body"**; a short `AXTextField` is fail-closed (`BODY_FOCUS_FAILED`). Focus + `AXValue` produced a **plain** Sent `.emlx` (cite=0) — no AppleScript `content` setter, no physical mouse click. Typed Returns / Cmd-V run only if a readable AX value is still missing the needle. System Events permissions probe is unchanged from 2.1.2.
+
 **mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used. `dry_run` / confirm-blocked writes stay `ok: false`, `planned: true`, `delivered: false`.
 
-**Manual prove (2.1.1 on the Mac host):** After `apple-tools-mcp permissions` reports System Events granted, `mail_send` a short **multiline** plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`. Inspect each Sent `.emlx`: the text/plain part must contain the intended text (newlines preserved) and must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`). On Mini, prove the production path (write-bridge with node → System Events allowed, **or** the documented in-process fallback). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
+**Manual prove (2.1.3 on the Mini host):** After `apple-tools-mcp permissions` reports System Events granted, `mail_send` a short **multiline** plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The body must land via title-marker + hit-test (not Tab / focused-role): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`. Inspect each Sent `.emlx`: the text/plain part must contain the intended text (newlines preserved) and must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`). Prove the production path (write-bridge with node → System Events allowed, **or** the documented in-process fallback). That quote-prefix Mini Sent prove is a separate bar from the 2.0.7 verify contract.
 
 Emails are addressed by their RFC822 **Message-ID**. Pass `message_id`, or pass the `file_path` from `mail_search` / `mail_recent` and the server reads the Message-ID out of the `.emlx` headers for you. `mail_archive` moves the message to its account's Archive (or All Mail) mailbox; `mail_trash` moves it to that account's Trash.
 
@@ -603,7 +605,7 @@ The message names which process macOS was actually asking about. Work through it
 
 1. **MacBook / Terminal (`permissions` CLI):** there is **no** always-on indexer. Re-run `apple-tools-mcp permissions` from **Terminal.app**, Allow the **printed `process.execPath`**, and check System Settings → Privacy & Security → **Automation** for that node → Contacts, Calendar, Mail, Messages, and System Events. Do **not** start `apple-tools-indexer`.
 2. **Mini only:** `pgrep -fl apple-tools-indexer` / `~/.apple-tools-mcp/writer.sock`. If the LaunchAgent is the product host, start it so writes run under launchd-owned node (see [Mini ship-gate](#mini-ship-gate-host-setup)).
-3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, Calendar, and **System Events**. On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
+3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, Calendar, and **System Events**. A prior **Don't Allow** for System Events is a sticky Deny — the Allow dialog will not appear again; turn **System Events** on for that node, then re-run `permissions` (it must not report granted from a soft name check). On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
 4. **Mini: is the daemon's node binary the one with Full Disk Access?** LaunchAgents do not inherit your shell `PATH`; confirm the plist points at the same path `which node` reports.
 5. **Is it actually the write path?** Contacts or Calendar *reads* failing with `EPERM` is a Full Disk Access / attribution problem, not the entitlement gap — fix FDA for the responsible process. Contacts or Calendar *CRUD* failing with no prompt under Claude Desktop is the [documented host limitation](#reads-and-writes-are-different-mechanisms): Claude.app carries neither the addressbook nor the calendars entitlement. On Mini, start the daemon so the write goes through the bridge. On MacBook, use Terminal.app + the printed node.
 6. **"Contacts.app / Calendar.app could not be reached"** with the app clearly installed is an **Automation / responsible-process** failure, not a missing app — macOS reports a refused Apple event as `-1728` / "can't get application". On MacBook / Terminal, Allow the printed `process.execPath`. On Mini, the write bridge / LaunchAgent may apply. A Contacts `-600` / “application isn't running” is a **cold launch**, not Automation — keep Contacts, Mail, and Messages running; Calendar does not need to stay open.

package/lib/appleScript.js

@@ -340,20 +340,24 @@ export const MAIL_TCC_GUIDANCE =
  */
 export const MAIL_ACCESSIBILITY_GUIDANCE =
   "macOS denied Accessibility (System Events could not drive Mail's compose window). " +
-  "mail_send / mail_draft type or paste the body so Mail does not cite-wrap it (FB11734014); Mail's mailto command does not return an outgoing message on current Mini/MacBook Mail (-2753). " +
+  "mail_send / mail_draft fill the body via AX hit-test so Mail does not cite-wrap it (FB11734014); Mail's mailto command does not return an outgoing message on current Mini/MacBook Mail (-2753). " +
   "Allow node in System Settings → Privacy & Security → Accessibility, and keep Automation → Mail allowed. " +
   "This is not a Mail Automation deny (-1743 / -10004).";
 
 /**
- * System Events Apple Events / GUI scripting is missing, so the keystroke
- * compose path cannot run. Distinct from a Mail send hang: nothing was typed
- * or sent. Mini write-bridge should return unsupported so stdio falls back
- * in-process rather than wedging ~60s.
+ * Sticky Don't Allow for node → System Events: the Allow dialog will not
+ * reappear. Operators must flip the Automation row and re-run permissions.
  */
+export const SYSTEM_EVENTS_STICKY_DENY_GUIDANCE =
+  "A prior Don't Allow for node → System Events is a sticky Deny: the Allow dialog will not appear again. " +
+  "Turn System Events on for this node in System Settings → Privacy & Security → Automation, then re-run apple-tools-mcp permissions after Allow.";
+
+/** System Events GUI scripting missing — not a Mail send hang. */
 export const MAIL_GUI_SCRIPTING_GUIDANCE =
   "System Events GUI scripting is unavailable for this process, so the body cannot be typed into Mail. " +
-  "mail_send / mail_draft use System Events keystrokes (Tab into the body, typed Returns) so Mail does not cite-wrap the Sent body (FB11734014). " +
+  "mail_send / mail_draft locate the compose body via System Events (title-marker + AX hit-test) so Mail does not cite-wrap the Sent body (FB11734014). " +
   "Allow node → System Events in System Settings → Privacy & Security → Automation (run apple-tools-mcp permissions after install/upgrade) in addition to node → Mail, and keep Accessibility allowed. " +
+  SYSTEM_EVENTS_STICKY_DENY_GUIDANCE + " " +
   "This is not a Mail send timeout and not a Mail Automation deny (-1743 / -10004).";
 
 /**

package/lib/mailWrite.js

@@ -160,11 +160,19 @@ export const BODY_PASTE_MISDIRECTED_SENTINEL = "BODY_PASTE_MISDIRECTED";
 export const BODY_FOCUS_FAILED_SENTINEL = "BODY_FOCUS_FAILED";
 export const GUI_SCRIPTING_UNAVAILABLE_SENTINEL = "GUI_SCRIPTING_UNAVAILABLE";
 export const SYSTEM_EVENTS_PROBE_MARKER = "ATM_SYSTEM_EVENTS_PROBE";
-/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). Used to reject short header AXTextAreas after Tab; does not walk windows. */
+/** Permissions-only marker: process / GUI scripting, not application `name`. */
+export const SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER = "ATM_SYSTEM_EVENTS_AUTOMATION_PROBE";
+/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). Used to reject short header AXTextAreas; does not walk windows. */
 export const MAIL_BODY_MIN_AX_HEIGHT = 50;
-/** Mini-proven Tab count from default compose focus into the body. */
+/** Historical Mini Tab count. 2.1.3 finds the body via title-marker + AX hit-test, not Tab. */
 export const MAIL_BODY_TAB_MAX = 6;
-/** Cheap System Events Automation probe used before compose; SIGKILL if it still hangs. */
+/** Mail window titles may truncate; match this many leading subject characters. */
+export const MAIL_COMPOSE_TITLE_MARKER_MAX = 60;
+/** Top-level `UI elements` of process Mail only — never a deep tree walk. */
+export const MAIL_COMPOSE_TOP_UI_MAX = 48;
+/** Marker inside the JXA hit-test so tests can pin the proven Mini path. */
+export const ATM_AX_HIT_TEST_MARKER = "ATM_AX_HIT_TEST";
+/** Cheap pre-compose System Events check; SIGKILL if it still hangs. Not the permissions grant. */
 export const MAIL_SE_PROBE_TIMEOUT_MS = 4000;
 /** First-run / upgrade permissions probe: long enough for the Allow click. */
 export const SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS = 30000;
@@ -246,10 +254,110 @@ export function composeBodyNeedle(body) {
   return needle.length > 120 ? needle.slice(0, 120) : needle;
 }
 
+/**
+ * Subject fragment used to identify the compose window among top-level
+ * System Events UI elements. Mail's window title is the subject after
+ * `make new outgoing message`; empty drafts show "New Message".
+ */
+export function composeTitleMarker(subject) {
+  const text = subject === undefined || subject === null ? "" : String(subject).trim();
+  if (!text) return "New Message";
+  return text.length > MAIL_COMPOSE_TITLE_MARKER_MAX
+    ? text.slice(0, MAIL_COMPOSE_TITLE_MARKER_MAX)
+    : text;
+}
+
+/**
+ * JXA AX hit-test: `AXUIElementCopyElementAtPosition` at compose-body
+ * coordinates, then AXFocused + AXValue on the `AXWebArea` "message body".
+ * Mini-proven (computer-use): deep UI-element walks truncate before the
+ * WebArea; a coordinate hit-test does not. No mouse click.
+ */
+export function buildAtmAxHitTestJxa() {
+  return `ObjC.import("ApplicationServices");
+ObjC.import("Foundation");
+function axStr(el, attr) {
+  var out = Ref();
+  if ($.AXUIElementCopyAttributeValue(el, attr, out) !== 0) return "";
+  if (out[0] == null) return "";
+  try { return ObjC.unwrap(out[0]).toString(); } catch (e) { return ""; }
+}
+function axHeight(el) {
+  var out = Ref();
+  if ($.AXUIElementCopyAttributeValue(el, "AXSize", out) !== 0 || out[0] == null) return 0;
+  try {
+    var u = ObjC.unwrap(out[0]);
+    if (u && typeof u.height === "number") return u.height;
+    if (u && u.Height != null) return Number(u.Height);
+    if (u && u[1] != null) return Number(u[1]);
+  } catch (e) {}
+  return 0;
+}
+function axBits(el) {
+  return [axStr(el, "AXDescription"), axStr(el, "AXTitle"), axStr(el, "AXRoleDescription")].join(" ");
+}
+function isHeaderHit(role, bits, height, minH) {
+  if (role === "AXTextField" || role === "AXComboBox" || role === "AXButton" || role === "AXMenuButton" || role === "AXPopUpButton" || role === "AXWindow") return true;
+  if (role === "AXTextArea" && height > 0 && height < minH) return true;
+  var lower = bits.toLowerCase();
+  if (lower.indexOf("to:") !== -1) return true;
+  if (lower.indexOf("cc:") !== -1) return true;
+  if (lower.indexOf("bcc:") !== -1) return true;
+  if (lower.indexOf("subject") !== -1 && lower.indexOf("message body") === -1) return true;
+  return false;
+}
+function isMailBodyHit(role, bits) {
+  if (role !== "AXWebArea") return false;
+  return bits.toLowerCase().indexOf("message body") !== -1;
+}
+function run(argv) {
+  // ${ATM_AX_HIT_TEST_MARKER}
+  var pid = parseInt(argv[0], 10);
+  var body = String(argv[1] || "");
+  var needle = String(argv[2] || "");
+  var pointStr = String(argv[3] || "");
+  var minH = parseInt(argv[4], 10);
+  if (!minH) minH = 50;
+  if (!pid) return "BODY_FOCUS_FAILED";
+  var app = $.AXUIElementCreateApplication(pid);
+  var points = pointStr.split(";");
+  var chosen = null;
+  for (var i = 0; i < points.length; i++) {
+    var xy = points[i].split(",");
+    var x = parseFloat(xy[0]);
+    var y = parseFloat(xy[1]);
+    if (!isFinite(x) || !isFinite(y)) continue;
+    var hit = Ref();
+    var err = $.AXUIElementCopyElementAtPosition(app, x, y, hit);
+    if (err !== 0 || hit[0] == null) continue;
+    var el = hit[0];
+    var role = axStr(el, "AXRole");
+    var bits = axBits(el);
+    var height = axHeight(el);
+    if (isHeaderHit(role, bits, height, minH)) continue;
+    if (isMailBodyHit(role, bits)) {
+      chosen = el;
+      break;
+    }
+  }
+  if (!chosen) return "BODY_FOCUS_FAILED";
+  try { $.AXUIElementSetAttributeValue(chosen, "AXFocused", true); } catch (e) {}
+  try { $.AXUIElementSetAttributeValue(chosen, "AXValue", body); } catch (e) {}
+  var val = axStr(chosen, "AXValue");
+  if (val !== "" && needle !== "" && val.indexOf(needle) === -1) return "VALUE_MISS";
+  return "OK";
+}`;
+}
+
 export function isSystemEventsProbeScript(script) {
   return String(script || "").includes(SYSTEM_EVENTS_PROBE_MARKER);
 }
 
+export function isSystemEventsAutomationProbeScript(script) {
+  return String(script || "").includes(SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER);
+}
+
+/** Cheap pre-compose check. Do not use for `permissions` — `get name` can soft-pass. */
 export function buildSystemEventsProbeScript() {
   const secs = asInteger(MAIL_SE_PROBE_APPLEEVENT_TIMEOUT_SEC, {
     min: 1,
@@ -275,15 +383,41 @@ export function probeSystemEventsGui({ timeout = MAIL_SE_PROBE_TIMEOUT_MS } = {}
 }
 
 /**
- * First-run / upgrade probe: a live System Events Apple Event that pops
- * Automation → System Events. Does not type into the focused UI.
- * Timeout is long enough for the operator to click Allow.
+ * First-run / upgrade probe. Soft `tell application "System Events" to get
+ * name` is not enough — Mini @2.1.1 reported granted while TCC auth_value=0
+ * for node → com.apple.systemevents. Process / GUI scripting (`tell process`)
+ * is the grant mail_send actually needs. Does not type into the focused UI.
+ * Timeout is long enough for the operator to click Allow. No short inner
+ * AppleEvent timeout (same as the Mail compose-and-discard probe).
+ */
+export function buildSystemEventsAutomationProbeScript() {
+  return `-- ${SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER}
+tell application "System Events"
+  tell process "System Events"
+    set atmPid to unix id
+    set atmShown to name
+    if atmShown is "" then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    if atmPid is missing value then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    if (atmPid as integer) is less than or equal to 0 then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    count of UI elements
+  end tell
+  set atmUi to UI elements enabled
+end tell
+if atmUi is false then error "${ACCESSIBILITY_DENIED_SENTINEL}"
+return "OK"`;
+}
+
+/**
+ * First-run / upgrade probe: a live System Events GUI-scripting Apple Event
+ * that creates or verifies Automation → System Events. Does not type.
  * @returns {{ ok: boolean, message: string, kind: string|null }}
  */
 export function probeSystemEventsAutomation() {
   const action = "system_events_automation_probe";
-  const summary = "ask System Events for its name (Automation / Apple Events check; nothing is typed)";
-  const result = probeSystemEventsGui({ timeout: SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS });
+  const summary = "verify System Events process / GUI scripting (Automation / Apple Events grant; nothing is typed)";
+  const result = runAppleScript(buildSystemEventsAutomationProbeScript(), {
+    timeout: SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS
+  });
   if (!result.ok) {
     const kind = systemEventsGrantKind(result);
     const guidance = isMailAccessibilityDenial(result)
@@ -300,7 +434,7 @@ export function probeSystemEventsAutomation() {
     kind: null,
     message: writeSuccessMessage(
       action,
-      "System Events Automation allowed (process name read; nothing was typed)"
+      "System Events Automation allowed (process GUI scripting verified; nothing was typed)"
     )
   };
 }
@@ -317,66 +451,28 @@ function systemEventsGrantKind(result) {
 }
 
 /**
- * AppleScript handlers: Tab into the compose body and type it (typed Returns
- * preserve newlines). Does not walk System Events `windows of process Mail`
- * (macOS 26 reports 0). Calibration / verify uses the focused AX role (and
- * AX value when it is readable) — never live Mail `content of` the outgoing
- * message. Dual-host Mail 16 / macOS 26: `set content` reads back via
- * `content of`, but Tab + keystroke/paste into the UI body never appears in
- * `content of` (`typedSeen=false`, bodyLen 0) even when typing still produces
- * a plain Sent `.emlx`. Never `set content` / `html content` (FB11734014).
+ * AppleScript handlers: find the compose window by subject title among
+ * top-level System Events UI elements (macOS 26 `windows of process Mail`
+ * is 0), then coordinate AX hit-test (`AXUIElementCopyElementAtPosition`)
+ * to the `AXWebArea` "message body". Mini computer-use: deep UI-element
+ * walks truncate after ~23 header/toolbar nodes and never reach the body;
+ * AXFocusedUIElement role coerce fails (-1700). No mouse click. No
+ * `entire contents`. Never live Mail `content of` (Mail 16 stays empty
+ * after UI fill). Never `set content` / `html content` (FB11734014).
  *
- * Tab count is unchanged (MAIL_BODY_TAB_MAX, Mini-proven 6). Fail-closed if
- * AX focus is not a body role after Tab. Cmd-V only if AX value is readable
- * and the needle is still missing. Header checks stay. System Events Apple
- * events are wrapped in `with timeout`.
+ * Hit must be AXWebArea "message body"; a short AXTextField is fail-closed
+ * (BODY_FOCUS_FAILED). Focus + AXValue (Mini: plain Sent .emlx, cite=0).
+ * Typed Returns / Cmd-V only if a readable AX value is still missing the
+ * needle. Header checks stay. System Events Apple events are wrapped in
+ * `with timeout`.
  */
 export function buildMailBodyPasteHandler() {
-  const tabMax = asInteger(MAIL_BODY_TAB_MAX, { min: 1, max: 12, field: "tabMax" });
   const seSecs = asInteger(MAIL_SE_APPLEEVENT_TIMEOUT_SEC, { min: 1, max: 30, field: "seTimeout" });
   const bodyMinH = asInteger(MAIL_BODY_MIN_AX_HEIGHT, { min: 1, max: 500, field: "bodyMinHeight" });
+  const topMax = asInteger(MAIL_COMPOSE_TOP_UI_MAX, { min: 1, max: 64, field: "topUiMax" });
+  const jxaLit = asString(buildAtmAxHitTestJxa());
   return `${buildAtmFocusedElementHandler()}
 
-on atmSafeToPaste()
-  tell application "System Events"
-    tell process "Mail"
-      try
-        set fe to my atmFocusedElement()
-        if fe is missing value then return false
-        set r to (role of fe) as string
-        if r is "AXWindow" then return false
-        if r is "AXTextField" then return false
-        if r is "AXComboBox" then return false
-        if r is "AXButton" then return false
-        if r is "AXMenuButton" then return false
-        if r is "AXPopUpButton" then return false
-        set atmH to 0
-        try
-          set {atmW, atmH} to size of fe
-        end try
-        if r is "AXTextArea" and atmH > 0 and atmH < ${bodyMinH} then return false
-        ignoring case
-          set bits to ""
-          try
-            set bits to bits & (description of fe as string) & " "
-          end try
-          try
-            set bits to bits & (name of fe as string) & " "
-          end try
-          if bits contains "To:" then return false
-          if bits contains "Cc:" then return false
-          if bits contains "Bcc:" then return false
-          if bits contains "Subject" then return false
-        end ignoring
-        if r is "AXWebArea" then return true
-        if r is "AXTextArea" then return true
-        if atmH >= ${bodyMinH} then return true
-      end try
-      return false
-    end tell
-  end tell
-end atmSafeToPaste
-
 on atmAxFocusedValue()
   tell application "System Events"
     try
@@ -388,6 +484,101 @@ on atmAxFocusedValue()
   return ""
 end atmAxFocusedValue
 
+on atmTopElemBits(atmEl)
+  set atmBits to ""
+  try
+    set atmBits to atmBits & (name of atmEl as string) & " "
+  end try
+  try
+    set atmBits to atmBits & (title of atmEl as string) & " "
+  end try
+  try
+    set atmBits to atmBits & (description of atmEl as string) & " "
+  end try
+  try
+    set atmBits to atmBits & (value of attribute "AXTitle" of atmEl as string) & " "
+  end try
+  return atmBits
+end atmTopElemBits
+
+on atmTopElemExactTitle(atmEl, atmMarker)
+  try
+    if (name of atmEl as string) is atmMarker then return true
+  end try
+  try
+    if (title of atmEl as string) is atmMarker then return true
+  end try
+  try
+    if (value of attribute "AXTitle" of atmEl as string) is atmMarker then return true
+  end try
+  return false
+end atmTopElemExactTitle
+
+on atmComposeFrameByTitle(atmMarker)
+  with timeout of ${seSecs} seconds
+    tell application "System Events"
+      tell process "Mail"
+        set atmElems to UI elements
+        set atmCount to count of atmElems
+        if atmCount > ${topMax} then set atmCount to ${topMax}
+        repeat with atmIdx from 1 to atmCount
+          set atmEl to item atmIdx of atmElems
+          set atmRole to ""
+          try
+            set atmRole to (role of atmEl as string)
+          end try
+          if atmRole is not "AXMenuBar" then
+            if my atmTopElemExactTitle(atmEl, atmMarker) then
+              set atmPos to position of atmEl
+              set atmSz to size of atmEl
+              return {item 1 of atmPos, item 2 of atmPos, item 1 of atmSz, item 2 of atmSz}
+            end if
+          end if
+        end repeat
+        repeat with atmIdx from 1 to atmCount
+          set atmEl to item atmIdx of atmElems
+          set atmRole to ""
+          try
+            set atmRole to (role of atmEl as string)
+          end try
+          if atmRole is not "AXMenuBar" then
+            set atmBits to my atmTopElemBits(atmEl)
+            ignoring case
+              if atmBits contains atmMarker then
+                set atmPos to position of atmEl
+                set atmSz to size of atmEl
+                return {item 1 of atmPos, item 2 of atmPos, item 1 of atmSz, item 2 of atmSz}
+              end if
+            end ignoring
+          end if
+        end repeat
+      end tell
+    end tell
+  end timeout
+  error "${BODY_FOCUS_FAILED_SENTINEL}"
+end atmComposeFrameByTitle
+
+on atmBodyHitPointList(atmFrameX, atmFrameY, atmFrameW, atmFrameH)
+  set atmMidX to (atmFrameX + (atmFrameW / 2)) as integer
+  set atmHitY1 to (atmFrameY + ((atmFrameH * 2) / 3)) as integer
+  set atmHitY2 to (atmFrameY + ((atmFrameH * 3) / 4)) as integer
+  set atmHitX2 to (atmFrameX + ((atmFrameW * 2) / 5)) as integer
+  set atmHitY3 to (atmFrameY + ((atmFrameH * 7) / 10)) as integer
+  return (atmMidX as string) & "," & (atmHitY1 as string) & ";" & (atmMidX as string) & "," & (atmHitY2 as string) & ";" & (atmHitX2 as string) & "," & (atmHitY3 as string)
+end atmBodyHitPointList
+
+on atmAxHitFill(atmPid, atmBody, atmNeedle, atmPoints)
+  set atmJxa to ${jxaLit}
+  set atmOut to ""
+  try
+    set atmOut to (run script atmJxa in "JavaScript" with parameters {atmPid, atmBody, atmNeedle, atmPoints, ${bodyMinH}}) as string
+  on error errMsg number errNum
+    if errMsg contains "assistive access" or errNum is -25211 then error "${ACCESSIBILITY_DENIED_SENTINEL}"
+    error errMsg number errNum
+  end try
+  return atmOut
+end atmAxHitFill
+
 on atmSplitParagraphs(bodyText)
   set atmSavedDelim to AppleScript's text item delimiters
   set AppleScript's text item delimiters to return
@@ -426,30 +617,6 @@ on atmKeystrokeText(atmText)
   end tell
 end atmKeystrokeText
 
-on atmTabIntoMailBody(msg)
-  tell application "Mail" to activate
-  delay 0.25
-  with timeout of ${seSecs} seconds
-    tell application "System Events"
-      tell process "Mail" to set frontmost to true
-    end tell
-  end timeout
-  delay 0.08
-  repeat with atmN from 0 to ${tabMax}
-    if my atmSafeToPaste() then return
-    if atmN is ${tabMax} then error "${BODY_FOCUS_FAILED_SENTINEL}"
-    with timeout of ${seSecs} seconds
-      tell application "System Events"
-        tell process "Mail"
-          key code 48
-        end tell
-      end tell
-    end timeout
-    delay 0.08
-  end repeat
-  error "${BODY_FOCUS_FAILED_SENTINEL}"
-end atmTabIntoMailBody
-
 on atmTypeMailBody(bodyText)
   set atmLines to my atmSplitParagraphs(bodyText)
   set atmLast to count of atmLines
@@ -494,17 +661,50 @@ on atmPasteMailBodyFallback(bodyText)
   if hadClip then set the clipboard to savedClip
 end atmPasteMailBodyFallback
 
-on atmFillMailBody(bodyText, needle, msg)
+on atmFillMailBody(bodyText, needle, titleMarker, msg)
   try
-    atmTabIntoMailBody(msg)
-    if my atmSafeToPaste() is false then error "${BODY_FOCUS_FAILED_SENTINEL}"
-    atmTypeMailBody(bodyText)
-    delay 0.12
-    if needle is not "" then
-      set atmAxVal to my atmAxFocusedValue()
-      if atmAxVal is not "" then
-        if atmAxVal does not contain needle then
-          atmPasteMailBodyFallback(bodyText)
+    tell application "Mail" to activate
+    delay 0.25
+    with timeout of ${seSecs} seconds
+      tell application "System Events"
+        tell process "Mail" to set frontmost to true
+      end tell
+    end timeout
+    delay 0.08
+    set atmPid to 0
+    with timeout of ${seSecs} seconds
+      tell application "System Events"
+        tell process "Mail"
+          set atmPid to unix id
+        end tell
+      end tell
+    end timeout
+    if atmPid is 0 then error "${BODY_FOCUS_FAILED_SENTINEL}"
+    set atmFrame to my atmComposeFrameByTitle(titleMarker)
+    set atmFrameX to item 1 of atmFrame
+    set atmFrameY to item 2 of atmFrame
+    set atmFrameW to item 3 of atmFrame
+    set atmFrameH to item 4 of atmFrame
+    if atmFrameW < 40 or atmFrameH < ${bodyMinH} then error "${BODY_FOCUS_FAILED_SENTINEL}"
+    set atmPoints to my atmBodyHitPointList(atmFrameX, atmFrameY, atmFrameW, atmFrameH)
+    set atmHit to my atmAxHitFill(atmPid, bodyText, needle, atmPoints)
+    if atmHit is "${BODY_FOCUS_FAILED_SENTINEL}" then error "${BODY_FOCUS_FAILED_SENTINEL}"
+    if atmHit is "VALUE_MISS" then
+      with timeout of ${seSecs} seconds
+        tell application "System Events"
+          tell process "Mail"
+            keystroke "a" using command down
+          end tell
+        end tell
+      end timeout
+      atmTypeMailBody(bodyText)
+      delay 0.12
+      if needle is not "" then
+        set atmAxVal to my atmAxFocusedValue()
+        if atmAxVal is not "" then
+          if atmAxVal does not contain needle then
+            atmPasteMailBodyFallback(bodyText)
+          end if
         end if
       end if
     end if
@@ -558,13 +758,13 @@ ${bodyCheck}`;
  * Do not set AppleScript `content` or `html content`: Ventura+ FB11734014
  * cite-wraps those setters (`>` prefixes + `<blockquote type="cite">`).
  * Recipients and subject are AppleScript properties (never paste). The body
- * is typed into the native compose editor via System Events (Tab into body
- * until AX focused role is a body field, typed Returns for newlines, Cmd-V
- * only if AX value is readable and the needle is still missing). Do not walk
- * `windows of process Mail`. Do not use Mail `content of` as the oracle that
- * typed/pasted text landed (Mail 16 / macOS 26: that property stays empty).
- * If AX body focus cannot be established, or headers change, abort + delete
- * (nothing sent). Ship prove that the body landed is Sent `.emlx` after send.
+ * is filled via title-marker compose window + coordinate AX hit-test to the
+ * AXWebArea "message body" (AXFocused + AXValue; Mini-proven plain Sent).
+ * Do not walk `windows of process Mail`. Do not deep-walk UI elements.
+ * Do not use Mail `content of` as the oracle that text landed (Mail 16 /
+ * macOS 26: that property stays empty). If the body element is not found or
+ * is a short AXTextField, or headers change, abort + delete (nothing sent).
+ * Ship prove that the body landed is Sent `.emlx` after send.
  */
 export function buildComposeScript({ to, cc, bcc, subject, body, send, html = false }) {
   const recipients = [
@@ -576,8 +776,9 @@ export function buildComposeScript({ to, cc, bcc, subject, body, send, html = fa
   const mailSecs = asInteger(MAIL_APPLEEVENT_TIMEOUT_SEC, { min: 1, max: 60, field: "mailTimeout" });
   const plainBody = composeNativeBody(body, { html });
   const needle = composeBodyNeedle(plainBody);
+  const titleMarker = composeTitleMarker(subject);
   const pasteAndVerify = plainBody
-    ? `  atmFillMailBody(${asString(plainBody)}, ${asString(needle)}, newMessage)
+    ? `  atmFillMailBody(${asString(plainBody)}, ${asString(needle)}, ${asString(titleMarker)}, newMessage)
   tell application "Mail"
 ${composeMisdirectChecks({ to, cc, bcc, subject, body: plainBody })}
   end tell`

package/lib/permissions.js

@@ -10,11 +10,13 @@
  * points at a different node, print a WARN — Allows attach to execPath.
  * Mail and Messages use the existing live Apple Events helpers — dry_run of
  * mail_send / messages_send never talks to those apps and does not count.
+ * System Events uses process / GUI scripting (`tell process`), not a soft
+ * application `get name` — that can succeed without AppleEvents auth.
  */
 
 import fs from "fs";
 import path from "path";
-import { classifyAppleScriptError } from "./appleScript.js";
+import { classifyAppleScriptError, SYSTEM_EVENTS_STICKY_DENY_GUIDANCE } from "./appleScript.js";
 import { probeMailAutomation, probeSystemEventsAutomation } from "./mailWrite.js";
 import { probeMessagesAutomation } from "./messagesWrite.js";
 import { probeContactsAutomation } from "./contactsWrite.js";
@@ -272,7 +274,9 @@ function bannerLines(binary, version) {
     "Nothing is sent to third parties. Mail composes and discards a temporary outgoing message.",
     "Messages only enumerates accounts. Contacts creates and deletes a throwaway person in-script.",
     "Calendar lists calendars only — no events are created.",
-    "System Events is asked for its process name (mail_send keystrokes; nothing is typed)."
+    "System Events is probed with process / GUI scripting (tell process + unix id; nothing is typed).",
+    "A soft tell System Events to get name is not enough — that can succeed without AppleEvents auth.",
+    "A prior Don't Allow is a sticky Deny: turn System Events on for this node in Automation, then re-run this command."
   ];
 }
 
@@ -359,6 +363,9 @@ export async function runPermissionsCommand({
   } else {
     log("Result: INCOMPLETE — one or more required grants are missing or errored.");
     log(hostAdvice);
+    if (grants["System Events"] !== GRANT_GRANTED) {
+      log(SYSTEM_EVENTS_STICKY_DENY_GUIDANCE);
+    }
     log("Click Allow for the missing surfaces and re-run this command. Exit is non-zero (fail closed).");
   }
   return code;

package/lib/writeRouting.js

@@ -102,7 +102,7 @@ export function terminalAutomationAdvice(execPath = process.execPath) {
 export function miniLaunchAgentAdvice() {
   return (
     "This Mac has a Mini write-bridge / LaunchAgent. Grant the daemon's node Full Disk Access (reads) and " +
-    "Allow that node in System Settings → Privacy & Security → Automation for Mail.app, Messages.app, Contacts.app, Calendar.app, and System Events (mail_send / mail_draft type the body via keystrokes). " +
+    "Allow that node in System Settings → Privacy & Security → Automation for Mail.app, Messages.app, Contacts.app, Calendar.app, and System Events (mail_send / mail_draft fill the body via AX hit-test). " +
     "Do not add node via + in the Contacts or Calendars privacy lists."
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",