notes-poke 0.1.0 → 0.1.1

package/dist/appleScript.js

@@ -1,4 +1,18 @@
 import { spawn } from "node:child_process";
+export class AppleScriptError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = "AppleScriptError";
+        this.kind = kind;
+    }
+}
+const notAuthorizedHelp = "macOS Automation permission is missing or was denied for the notes-poke daemon. " +
+    "Open System Settings > Privacy & Security > Automation, find \"notes-poke-node\" (or \"node\"), and enable Notes. " +
+    "Then rerun `notes-poke install`. If no toggle appears, run `tccutil reset AppleEvents` in Terminal and rerun install.";
+function isNotAuthorized(stderr) {
+    return stderr.includes("-1743") || stderr.includes("Not authorized to send Apple events");
+}
 export async function runAppleScript(script, options = {}) {
     const timeoutMs = options.timeoutMs ?? 20_000;
     return await new Promise((resolve, reject) => {
@@ -9,7 +23,7 @@ export async function runAppleScript(script, options = {}) {
         let stderr = "";
         const timer = setTimeout(() => {
             child.kill("SIGKILL");
-            reject(new Error(`AppleScript timed out after ${timeoutMs}ms`));
+            reject(new AppleScriptError("timeout", `AppleScript timed out after ${timeoutMs}ms. If a macOS permission dialog is waiting for approval, click Allow and retry; if dialogs keep appearing, rerun \`notes-poke install\`.`));
         }, timeoutMs);
         child.stdout.setEncoding("utf8");
         child.stderr.setEncoding("utf8");
@@ -29,7 +43,11 @@ export async function runAppleScript(script, options = {}) {
                 resolve(stdout.trim());
                 return;
             }
-            reject(new Error(stderr.trim() || `osascript exited with code ${code}`));
+            if (isNotAuthorized(stderr)) {
+                reject(new AppleScriptError("not-authorized", notAuthorizedHelp));
+                return;
+            }
+            reject(new AppleScriptError("script-error", stderr.trim() || `osascript exited with code ${code}`));
         });
         child.stdin.end(script);
     });

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { execFile, spawn } from "node:child_process";
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, chmod, copyFile, mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -24,9 +24,79 @@ async function runSetup(options) {
         const version = await getVersion();
         console.log(`OK Apple Notes responded: ${version}`);
     }
-    else {
-        console.log("Tip: run `notes-poke setup --touch-notes` to request/check macOS Automation permission.");
+}
+async function ensureDedicatedNode() {
+    const binDir = join(stateDir, "bin");
+    const binPath = join(binDir, "notes-poke-node");
+    const sourcePath = await realpath(process.execPath);
+    const smokeTest = async () => {
+        const result = await execFileAsync(binPath, ["--version"], { rejectOnError: false });
+        return result.code === 0;
+    };
+    try {
+        await access(binPath, constants.X_OK);
+        if (await smokeTest()) {
+            return binPath;
+        }
+        await rm(binPath, { force: true });
+    }
+    catch {
+        // No usable copy yet.
     }
+    await mkdir(binDir, { recursive: true });
+    await copyFile(sourcePath, binPath);
+    await chmod(binPath, 0o755);
+    if (await smokeTest()) {
+        console.log(`OK dedicated runtime at ${binPath}`);
+        return binPath;
+    }
+    await rm(binPath, { force: true });
+    console.warn(`Warning: your node binary (${sourcePath}) is not relocatable; using it directly. Upgrading node may require rerunning \`notes-poke install\`.`);
+    return sourcePath;
+}
+async function waitForServer(port) {
+    const deadline = Date.now() + 15_000;
+    while (Date.now() < deadline) {
+        try {
+            const response = await fetch(`http://127.0.0.1:${port}/`, { signal: AbortSignal.timeout(2_000) });
+            if (response.ok) {
+                return;
+            }
+        }
+        catch {
+            // Server not up yet.
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    throw new Error(`Server did not respond on port ${port} within 15s. Check logs in ${logDir}.`);
+}
+async function authorizeAutomation(port) {
+    console.log("");
+    console.log("Requesting macOS Automation permission for the background service...");
+    console.log("macOS will show a dialog: \"notes-poke-node\" wants access to control \"Notes\". Click Allow.");
+    console.log("Waiting up to 2 minutes...");
+    let result;
+    try {
+        const response = await fetch(`http://127.0.0.1:${port}/health/automation?timeoutMs=120000`, {
+            signal: AbortSignal.timeout(130_000),
+        });
+        result = (await response.json());
+    }
+    catch (error) {
+        result = { status: "error", message: error instanceof Error ? error.message : String(error) };
+    }
+    if (result.status === "granted") {
+        console.log(`OK Automation permission granted (Notes ${result.appVersion}). You will not be asked again.`);
+        return true;
+    }
+    console.error("");
+    console.error(`Automation permission was not granted (${result.status}).`);
+    if (result.message) {
+        console.error(result.message);
+    }
+    console.error("To fix: open System Settings > Privacy & Security > Automation, enable Notes under \"notes-poke-node\", then rerun `notes-poke install`.");
+    console.error("If no toggle appears there, run `tccutil reset AppleEvents` and rerun `notes-poke install`.");
+    return false;
 }
 function xmlEscape(value) {
     return value
@@ -124,12 +194,13 @@ ${envEntries ? `\n${envEntries}` : ""}
 `;
 }
 async function installServices(options) {
-    await runSetup({ touchNotes: options.touchNotes ?? true });
+    await runSetup({ touchNotes: false });
     if (options.tunnel) {
         await ensurePokeLogin();
     }
     await mkdir(logDir, { recursive: true });
     await mkdir(launchAgentsDir, { recursive: true });
+    const nodeBin = await ensureDedicatedNode();
     const serverPlistPath = join(launchAgentsDir, `${serverLabel}.plist`);
     const tunnelPlistPath = join(launchAgentsDir, `${tunnelLabel}.plist`);
     const url = `http://localhost:${options.port}/mcp`;
@@ -143,12 +214,19 @@ async function installServices(options) {
         shellQuote(options.name),
         ...(options.recipe ? ["--recipe"] : []),
     ].join(" ");
-    await writeLaunchAgent(serverPlistPath, plist(serverLabel, [process.execPath, cliPath, "start", "--host", options.host, "--port", options.port], join(logDir, "server.log"), join(logDir, "server.error.log"), {
+    await writeLaunchAgent(serverPlistPath, plist(serverLabel, [nodeBin, cliPath, "start", "--host", options.host, "--port", options.port], join(logDir, "server.log"), join(logDir, "server.error.log"), {
         NOTES_POKE_HOST: options.host,
         NOTES_POKE_PORT: options.port,
     }));
     await bootstrap(serverLabel, serverPlistPath);
     console.log(`OK installed and started ${serverLabel}`);
+    await waitForServer(options.port);
+    const authorized = await authorizeAutomation(options.port);
+    if (!authorized) {
+        console.error("Skipping tunnel setup until Automation permission is granted.");
+        process.exitCode = 1;
+        return;
+    }
     if (options.tunnel) {
         await writeLaunchAgent(tunnelPlistPath, plist(tunnelLabel, ["/bin/zsh", "-lc", tunnelCommand], join(logDir, "tunnel.log"), join(logDir, "tunnel.error.log")));
         await bootstrap(tunnelLabel, tunnelPlistPath);
@@ -192,7 +270,7 @@ async function status() {
 program
     .name("notes-poke")
     .description("Local Apple Notes MCP server for Poke")
-    .version("0.1.0");
+    .version("0.1.1");
 program
     .command("setup")
     .description("Check local prerequisites for running the Apple Notes MCP server")
@@ -244,7 +322,6 @@ program
     .option("--port <port>", "Port to bind", process.env.NOTES_POKE_PORT ?? "8766")
     .option("--recipe", "Ask Poke CLI to create a shareable recipe link from the tunnel")
     .option("--no-tunnel", "Only install the local MCP server; do not start the Poke tunnel")
-    .option("--no-touch-notes", "Do not touch Apple Notes during setup")
     .action((options) => installServices(options));
 program
     .command("uninstall")

package/dist/notes.js

@@ -140,12 +140,12 @@ on noteJson(n, includeBody)
   end tell
 end noteJson
 `;
-export async function getVersion() {
+export async function getVersion(options = {}) {
     return await runAppleScript(`
 tell application "Notes"
   return version
 end tell
-`);
+`, options);
 }
 export async function getAccounts() {
     const output = await runAppleScript(`

package/dist/server.js

@@ -1,6 +1,8 @@
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { AppleScriptError } from "./appleScript.js";
 import { createNotesPokeMcpServer } from "./mcp.js";
+import { getVersion } from "./notes.js";
 function bearerAuth(token) {
     return (req, res, next) => {
         if (!token) {
@@ -25,6 +27,28 @@ function bearerAuth(token) {
 function isMcpPath(path) {
     return path === "/mcp" || path.endsWith("/mcp");
 }
+let automationCheck = null;
+function checkAutomation(timeoutMs) {
+    if (automationCheck) {
+        return automationCheck;
+    }
+    automationCheck = getVersion({ timeoutMs })
+        .then((appVersion) => ({ status: "granted", appVersion }))
+        .catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        if (error instanceof AppleScriptError && error.kind === "not-authorized") {
+            return { status: "denied", message };
+        }
+        if (error instanceof AppleScriptError && error.kind === "timeout") {
+            return { status: "timeout", message };
+        }
+        return { status: "error", message };
+    })
+        .finally(() => {
+        automationCheck = null;
+    });
+    return automationCheck;
+}
 const mcpRoutePattern = /^(?:\/[^/]+)*\/mcp$/;
 export function startServer(options = {}) {
     const host = options.host ?? process.env.NOTES_POKE_HOST ?? "127.0.0.1";
@@ -40,6 +64,12 @@ export function startServer(options = {}) {
             auth: apiToken ? "bearer" : "none",
         });
     });
+    app.get("/health/automation", async (req, res) => {
+        const requested = Number.parseInt(String(req.query.timeoutMs ?? ""), 10);
+        const timeoutMs = Math.min(Number.isFinite(requested) && requested > 0 ? requested : 120_000, 180_000);
+        const result = await checkAutomation(timeoutMs);
+        res.json(result);
+    });
     app.use((req, res, next) => {
         if (!isMcpPath(req.path)) {
             next();
@@ -97,6 +127,16 @@ export function startServer(options = {}) {
     const httpServer = app.listen(port, host, () => {
         console.log(`notes-poke MCP server listening at http://${host}:${port}/mcp`);
         console.log(apiToken ? "Bearer auth enabled via NOTES_POKE_API_TOKEN" : "Bearer auth disabled for localhost development");
+        checkAutomation(120_000)
+            .then((result) => {
+            if (result.status === "granted") {
+                console.log(`Automation permission OK (Notes ${result.appVersion})`);
+            }
+            else {
+                console.error(`Automation permission check: ${result.status}. ${result.message ?? ""}`);
+            }
+        })
+            .catch(() => undefined);
     });
     return httpServer;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notes-poke",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local Apple Notes MCP server for Poke",
   "type": "module",
   "main": "dist/index.js",