davinci-resolve-mcp 2.104.7 → 2.104.8

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.104.8
+
+More laps: the aggregation class swept to completion, and the dependency
+stack brought to zero known vulnerabilities.
+
+**Four more envelope lies fixed.** An AST sweep for per-op result lists under
+success-shaped envelopes (the class import_from_drp exposed) found four bulk
+tools whose top level ignored their rows: `bulk_set_title_text`,
+`fusion_comp.bulk_set_expressions`, and `bulk_set_inputs` returned bare
+{results, op_count} — all-failed and all-succeeded calls indistinguishable
+without reading every row — and `fusion_comp.add_mask` hard-coded
+success:true over failable input writes, so a mask whose every parameter
+failed to apply read as configured while sitting default-shaped on the clip.
+All four now report success/succeeded/failed with partial warnings, through
+one shared summarizer. Also swept and clean: flow-prescribing remediation
+texts (every named action exists), absolute-belief comments in tests and
+source, and the Python tree for further aggregation suspects (the remaining
+hits are read-only listers).
+
+**Dependency stack: 15 advisories to zero.** `npm audit fix` cleared the
+non-breaking set (hono, fast-xml-parser, fast-uri, ip-address, js-yaml and
+friends); adm-zip moved to 0.6.0; the `uuid` dependency is GONE (three call
+sites now use Node's built-in crypto.randomUUID); and sharp moved to 0.35.4,
+which clears four libvips CVEs in the image-decode paths that media QC feeds
+untrusted files into.
+
+**Node floor: >=20.9 (warn-don't-block).** sharp 0.35 requires Node 20.9+,
+and Node 18 has been end-of-life since April 2025 — on an 18.20 interpreter
+npm silently produced a BROKEN install (engines-skipped platform binding,
+"up to date", no sharp module, 57 tests gone from the count). Both
+package.json engines now say >=20.9, which warns older interpreters without
+blocking, matching the Python floor policy. CI publishes on Node 24; the
+full Node suite runs green on 20.19 (823 tests, sharp included).
+
 ## What's New in v2.104.7
 
 The DRT import thread, chased to ground by live bisection on Studio 19.1.3.7

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.104.7-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.104.8-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.104.7-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.104.8-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.104.7 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.104.8 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.104.7"
+VERSION = "2.104.8"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.104.7",
+  "version": "2.104.8",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",
@@ -66,7 +66,7 @@
     "post-production"
   ],
   "engines": {
-    "node": ">=18.17"
+    "node": ">=20.9"
   },
   "publishConfig": {
     "access": "public"

package/resolve-advanced/package.json

@@ -3,9 +3,9 @@
   "version": "0.0.0-dev",
   "private": true,
   "license": "MIT",
-  "description": "Beyond-the-API DaVinci Resolve MCP — offline .drp/.drt/.drx authoring/editing. Sibling Node server to the Python davinci-resolve-mcp. Dev-local package.json; deps promote to the repo root at packaging.",
-  "comment_commonjs": "Intentionally NO \"type\": \"module\" — the vendored libs are CommonJS (require()). The repo root is type:module, so this nested manifest scopes resolve-advanced/**/*.js back to CommonJS.",
-  "comment_exports": "Public library surface so a downstream consumer can import the codec/grading/pipeline API, not just spawn the MCP bin. `.` = the lib barrel; `./mcp` = the stdio server entry. Still private:true — publish name/registry + un-privating are a parked decision.",
+  "description": "Beyond-the-API DaVinci Resolve MCP \u2014 offline .drp/.drt/.drx authoring/editing. Sibling Node server to the Python davinci-resolve-mcp. Dev-local package.json; deps promote to the repo root at packaging.",
+  "comment_commonjs": "Intentionally NO \"type\": \"module\" \u2014 the vendored libs are CommonJS (require()). The repo root is type:module, so this nested manifest scopes resolve-advanced/**/*.js back to CommonJS.",
+  "comment_exports": "Public library surface so a downstream consumer can import the codec/grading/pipeline API, not just spawn the MCP bin. `.` = the lib barrel; `./mcp` = the stdio server entry. Still private:true \u2014 publish name/registry + un-privating are a parked decision.",
   "main": "./server/lib.mjs",
   "exports": {
     ".": "./server/lib.mjs",
@@ -20,11 +20,10 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.6.0",
     "fast-xml-parser": "^5.7.3",
     "fzstd": "^0.1.1",
     "jszip": "^3.10.1",
-    "uuid": "^9.0.0",
     "zod": "^3.25.76",
     "zstd-codec": "^0.1.5"
   },
@@ -32,10 +31,10 @@
     "better-sqlite3": "^11.10.0",
     "js-yaml": "^4.3.0",
     "pg": "^8.22.0",
-    "sharp": "^0.33.0"
+    "sharp": "^0.35.4"
   },
   "peerDependenciesMeta": {
-    "_comment": "audio (split/trim/convert) + conform frame ops need system ffmpeg/ffprobe on PATH (NOT bundled — FFmpeg binaries are GPL; this package stays MIT). Install ffmpeg yourself: brew install ffmpeg."
+    "_comment": "audio (split/trim/convert) + conform frame ops need system ffmpeg/ffprobe on PATH (NOT bundled \u2014 FFmpeg binaries are GPL; this package stays MIT). Install ffmpeg yourself: brew install ffmpeg."
   },
   "scripts": {
     "test": "node --test vendor/drp-format/__tests__/*.test.js vendor/drt-format/__tests__/*.test.js vendor/drx-codec/__tests__/*.test.js test/*.test.mjs",
@@ -43,7 +42,7 @@
     "test:server": "node --test test/*.test.mjs"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.9"
   },
   "devDependencies": {
     "prettier": "^3.9.4"

package/resolve-advanced/vendor/drx-codec/drx-generator.js

@@ -34,7 +34,7 @@ try {
 } catch {
   ZstdCodec = null;
 }
-const { v4: uuidv4 } = require('uuid');
+const { randomUUID: uuidv4 } = require('node:crypto');
 
 // Import shared DRX parameter library
 const drxParams = require('../drx-parameters');
@@ -1859,7 +1859,7 @@ async function generateMultiNodeDRX(nodes, connections, metadata = {}) {
   const bodyHex = body.toString('hex');
 
   // Generate UUIDs
-  const { v4: uuidv4 } = require('uuid');
+  const { randomUUID: uuidv4 } = require('node:crypto');
   const stillId = uuidv4();
   const clipVersionId = uuidv4();
 
@@ -1873,7 +1873,7 @@ async function generateMultiNodeDRX(nodes, connections, metadata = {}) {
  ${pTrackVerXml}`;
   } else {
     // Generate default pTrackVer body
-    const trackVersionId = require('uuid').v4();
+    const trackVersionId = require('node:crypto').randomUUID();
     const trackBodyHex = await generatePTrackVerBody(width, height);
     pTrackVerSection = `
  <pTrackVer>

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.104.7"
+VERSION = "2.104.8"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.104.7"
+VERSION = "2.104.8"
 
 import base64
 import os
@@ -5787,6 +5787,35 @@ def _timeline_set_title_text(tl, p: Dict[str, Any]) -> Dict[str, Any]:
     }
 
 
+def _summarize_bulk_results(results: List[Dict[str, Any]], op_count: int) -> Dict[str, Any]:
+    """Envelope for per-op result lists whose top level must reflect the rows.
+
+    A bare {results, op_count} envelope made all-failed and all-succeeded
+    calls indistinguishable to a caller reading only the top level (the same
+    aggregation class as import_from_drp reporting success over failed rows).
+    """
+    succeeded = sum(1 for row in results if row.get("success"))
+    failed = op_count - succeeded
+    out: Dict[str, Any] = {
+        "results": results,
+        "op_count": op_count,
+        "succeeded": succeeded,
+        "failed": failed,
+        "success": failed == 0,
+    }
+    if failed and succeeded:
+        out["partial"] = True
+        out["warning"] = (
+            f"{succeeded} of {op_count} ops succeeded; see results[].error "
+            "for the failures."
+        )
+    elif failed:
+        out["error"] = (
+            f"All {op_count} op(s) failed — see results[].error for each cause."
+        )
+    return out
+
+
 def _timeline_bulk_set_title_text(tl, p: Dict[str, Any]) -> Dict[str, Any]:
     ops = p.get("ops")
     if not isinstance(ops, list) or not ops:
@@ -5801,7 +5830,7 @@ def _timeline_bulk_set_title_text(tl, p: Dict[str, Any]) -> Dict[str, Any]:
         out = _timeline_set_title_text(tl, merged)
         out["index"] = index
         results.append(out)
-    return {"results": results, "op_count": len(ops)}
+    return _summarize_bulk_results(results, len(ops))
 
 
 _TIMELINE_CONFORM_KERNEL_ACTIONS = [
@@ -27585,7 +27614,7 @@ def _fusion_comp_bulk_set_expressions(p: Dict[str, Any]) -> Dict[str, Any]:
             results.append({"index": index, "error": error_message})
         elif keep_undo:
             results.append({"index": index, "success": True, "expression": op["expression"]})
-    return {"results": results, "op_count": len(ops)}
+    return _summarize_bulk_results(results, len(ops))
 
 
 def _fusion_probe_group_published_inputs(comp, p: Dict[str, Any]) -> Dict[str, Any]:
@@ -27710,7 +27739,7 @@ def _fusion_comp_bulk_set_inputs(p: Dict[str, Any]) -> Dict[str, Any]:
         elif keep_undo:
             results.append({"index": index, "success": True})
 
-    return {"results": results, "op_count": len(ops)}
+    return _summarize_bulk_results(results, len(ops))
 
 
 _FUSION_KERNEL_ACTIONS = [
@@ -28115,12 +28144,28 @@ def _fusion_add_mask(comp, p: Dict[str, Any]) -> Dict[str, Any]:
             rec["error"] = str(exc)
         results.append(rec)
 
+    failed_inputs = [row for row in results if not row.get("success")]
     out: Dict[str, Any] = {
-        "success": True,
+        # The tool was added either way, but success must mean "the mask that
+        # was asked for": an unconditional True over failed input rows left a
+        # default-shaped mask reading as configured.
+        "success": not failed_inputs or len(failed_inputs) < len(results),
         "tool_name": tool_name,
         "tool_type": attrs.get("TOOLS_RegID", tool_type),
         "inputs_set": results,
     }
+    if failed_inputs and len(failed_inputs) == len(results):
+        out["success"] = False
+        out["error"] = (
+            f"The {tool_name} tool was added but all {len(results)} input "
+            "write(s) failed — the mask is default-shaped; see inputs_set[].error."
+        )
+    elif failed_inputs:
+        out["partial"] = True
+        out["warning"] = (
+            f"{len(failed_inputs)} of {len(results)} mask input(s) failed to "
+            "apply; see inputs_set[].error."
+        )
 
     # Optional wiring: connect this mask into a tool's mask input.
     connect_to = p.get("connect_to")
@@ -28142,6 +28187,12 @@ def _fusion_add_mask(comp, p: Dict[str, Any]) -> Dict[str, Any]:
                 }
             except Exception as exc:
                 out["connection"] = {"success": False, "error": str(exc)}
+        if isinstance(out.get("connection"), dict) and not out["connection"].get("success"):
+            out["success"] = False
+            out.setdefault(
+                "error",
+                "The mask was added but could not be connected — see `connection`.",
+            )
     return out