davinci-resolve-mcp 2.209.0 → 2.210.0

package/CHANGELOG.md

@@ -2,6 +2,92 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.210.0 — every destructive action now carries a real risk rating
+
+### Changed
+
+- **All 108 registered destructive actions are classified; 80 of them were not.**
+  Safe mode blocks established HIGH and CRITICAL, and the classifier's `else`
+  branch returns MEDIUM with `risk_established: false` — an honest "no rule
+  matched", but not something a gate can act on. So `timeline.move_clips`,
+  `timeline.ripple_insert`, `timeline.create_compound_clip`,
+  `timeline.import_into_timeline`, `graph.apply_grade_from_drx`,
+  `timeline_item_color.copy_grades`, `timeline_item_takes.finalize` and the
+  three `edit_engine` plan executors all passed a gate that was meant to stop
+  them. Safe mode now gates 35 actions where it previously gated 20.
+
+  Every rating was taken from the action's handler rather than its name, since
+  the name heuristic is the thing being replaced. Two results worth calling out:
+
+  - `timeline.move_clips` passes `delete_sources=True` to the duplicate helper,
+    so it removes the originals — it is a deletion wearing a move's name.
+  - `timeline_item.update_sidecar` is the only registered action that writes
+    **outside the project**: it rewrites the `.braw` sidecar or R3D `.RMD` file
+    next to the camera original. No Resolve undo reaches it, and it changes how
+    that media reads in every other application. Rated HIGH.
+
+  New distribution across the 108: 2 critical, 33 high, 35 medium, 38 low.
+
+- **`MEDIUM` now means something.** It was overwhelmingly the fallthrough, so an
+  assessed MEDIUM and an unrated action were indistinguishable by level alone. A
+  `_MEDIUM_RISK_ACTIONS` table makes it a finding, and `risk_established`
+  separates the two everywhere risk is reported.
+
+### Fixed
+
+- **The operator's saved `setup` defaults decided what the test suite did.**
+  `logs/media-analysis-preferences.json` holds real defaults including
+  `destructive.safe_mode`. Tests that call `setup` already overrode the path,
+  but the other three thousand read it — so with safe mode left enabled on a
+  machine, seventeen tests across `test_cut_executor`, `test_keyed_param_guards`,
+  `test_media_pool_changes`, `test_media_pool_delete_governance` and
+  `test_delete_clips_readback_retry` failed with "Safe mode blocked
+  critical-risk action". A red suite produced by a setting rather than by the
+  code, and it would have looked exactly like a regression in this release.
+
+  `tests/offline_guard` now redirects the preferences path for the whole run,
+  alongside the audit-log redirect added in v2.209.1. Pinned by a test asserting
+  the active path is never the operator's file, and by one asserting the guard
+  names the same environment variable the server reads — a mismatch there would
+  fail open and silently.
+
+### Added
+
+- **A guard test asserting no registered destructive action is unrated**, so a
+  newly registered action cannot silently rejoin the ungated set — which is how
+  the 80 accumulated. Registering an action and rating it are now one commit.
+- **A test pinning that `inspect_operation` and the safe-mode gate report the
+  same level** for all 108 actions. They read one classifier; the failure mode
+  if they ever diverge is silent.
+
+Live-validated against DaVinci Resolve Studio 19.1.3.7: the four newly-HIGH
+actions probed are refused with the timeline unchanged, the newly LOW/MEDIUM
+ones still pass, and every audit row carries `risk_established: true`.
+
+## What's New in v2.209.1 — the test suite no longer writes to the security audit log
+
+### Fixed
+
+- **Running the suite appended fabricated events to `logs/security-audit.jsonl`.**
+  The destructive-op audit log added in v2.209.0 defaults to that path, which is
+  correct for an install and wrong for a test run: any test exercising a
+  `@destructive_op`-wrapped handler wrote a genuine-looking record.
+  `tests/test_tool_argument_validation` walks every tool, so a single run added
+  24 synthetic `delete_timelines` / `reset_all_grades` / `apply_cuts` entries,
+  and repeated runs accumulated 216.
+
+  A security log is read to establish what actually happened, so synthetic rows
+  in it are worse than a missing feature — at the point someone needs to trust
+  the file they are indistinguishable from real events. `tests/offline_guard`
+  now redirects the audit path to a temp file for the whole run, covering both
+  the pytest and `python -m unittest` entry points, and only replaces the
+  *default*: a test that configures `destructive.audit_log_path` still gets its
+  own path. A regression test asserts the active path is never inside the repo.
+
+  No released behaviour changes — the default remains `logs/security-audit.jsonl`
+  for real installs. Anyone who ran the v2.209.0 suite should expect synthetic
+  rows in their local file; they carry temp-directory `project_root` values.
+
 ## What's New in v2.209.0 — safe operations policy
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.209.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.210.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.209.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.210.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.209.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.210.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.209.0"
+VERSION = "2.210.0"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.209.0",
+  "version": "2.210.0",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.209.0"
+VERSION = "2.210.0"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.209.0"
+VERSION = "2.210.0"
 
 import base64
 import os

package/src/utils/execution_lifecycle.py

@@ -145,12 +145,48 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline", "overwrite_range"),
         ("timeline", "apply_cuts"),
         ("graph", "reset_all_grades"),
+        # Plan execution: each rebuilds the timeline from the plan's lifts and
+        # keep_ranges. Same shape as execute_selects and ripple_trim above.
+        ("edit_engine", "execute_tighten"),
+        ("edit_engine", "execute_swap"),
+        ("edit_engine", "execute_silence_ripple"),
+        # Restructuring. move_clips passes delete_sources=True, so the originals
+        # are removed; ripple_insert shifts everything downstream of the insert;
+        # compound/fusion clips replace the selected items with a container and
+        # rewire what the timeline points at.
+        ("timeline", "move_clips"),
+        ("timeline", "ripple_insert"),
+        ("timeline", "create_compound_clip"),
+        ("timeline", "create_fusion_clip"),
+        # ImportIntoTimeline lays an external edit over the timeline;
+        # ConvertTimelineToStereo rewrites the audio track layout and has no
+        # inverse; DetectSceneCuts cuts every clip it decides to cut.
+        ("timeline", "import_into_timeline"),
+        ("timeline", "convert_to_stereo"),
+        ("timeline_ai", "detect_scene_cuts"),
+        # Grades that are replaced wholesale. apply_grade_from_drx documents
+        # itself as replacing the entire node graph with no append mode;
+        # CopyGrades overwrites each target's grade.
+        ("graph", "apply_grade_from_drx"),
+        ("timeline_item_color", "copy_grades"),
+        # Takes. delete removes one; finalize collapses the item to the selected
+        # take and discards the rest.
+        ("timeline_item_takes", "delete"),
+        ("timeline_item_takes", "finalize"),
+        # The only action here that writes OUTSIDE the project: UpdateSidecar
+        # rewrites the .braw sidecar or R3D .RMD file next to the camera
+        # original. No Resolve undo reaches it, and it changes how that media
+        # is interpreted by every other application that reads it.
+        ("timeline_item", "update_sidecar"),
     }
 
-    #: Mutating, but bounded and trivially reversible — a marker or a clip
-    #: colour. Without this table the name heuristic files them under MEDIUM
-    #: and flags them unrecognised, i.e. it warns that the risk is unestablished
-    #: for the actions whose risk is the best established of any we dispatch.
+    #: Mutating, but bounded and trivially reversible — a marker, a clip colour,
+    #: a toggle, or a newly created empty container. Nothing that already exists
+    #: is altered or removed, and the inverse is a single action.
+    #:
+    #: Without this table the name heuristic files them under MEDIUM and flags
+    #: them unrecognised, i.e. it warns that the risk is unestablished for the
+    #: actions whose risk is the best established of any we dispatch.
     _LOW_RISK_ACTIONS: Set[Tuple[str, str]] = {
         ("timeline_markers", "add"),
         ("timeline_markers", "update_custom_data"),
@@ -159,6 +195,103 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline_item_markers", "clear_flags"),
         ("timeline_item_markers", "set_clip_color"),
         ("timeline_item_markers", "clear_clip_color"),
+        ("timeline_item_markers", "update_custom_data"),
+        # Marks and flags: metadata on a clip, no frames touched.
+        ("timeline", "set_mark_in_out"),
+        ("timeline", "clear_mark_in_out"),
+        ("media_pool", "set_clip_marks"),
+        ("media_pool", "clear_clip_marks"),
+        # Track-level toggles and labels. SetTrackEnable/SetTrackLock/SetTrackName
+        # change no content; add_track creates an empty container.
+        ("timeline", "add_track"),
+        ("timeline", "set_track_enable"),
+        ("timeline", "set_track_lock"),
+        ("timeline", "set_track_name"),
+        ("timeline", "set_clips_linked"),
+        ("timeline", "set_title_text"),
+        # DuplicateTimeline writes a new timeline; the original is untouched.
+        ("timeline", "duplicate"),
+        # CreateEmptyTimeline / CreateStereoClip only add. `create_timeline`'s
+        # if_exists policy is version/reuse/fail — it has no overwrite path, so
+        # it cannot replace an existing timeline.
+        ("media_pool", "create_timeline"),
+        ("media_pool", "create_timeline_from_clips"),
+        ("media_pool", "create_stereo_clip"),
+        # Per-item display properties: set them back and the item is as it was.
+        ("timeline_item", "set_clip_enabled"),
+        ("timeline_item", "set_name"),
+        ("timeline_item", "set_crop"),
+        ("timeline_item", "set_transform"),
+        ("timeline_item", "set_composite"),
+        ("timeline_item", "set_audio"),
+        # Cache toggles and node *labels* — not grades.
+        ("timeline_item_color", "set_color_cache"),
+        ("timeline_item_color", "set_fusion_cache"),
+        ("timeline_item_color", "reset_all_node_colors"),
+        ("timeline_item_color", "rename_version"),
+        ("timeline_item_fusion", "add_comp"),
+        ("timeline_item_fusion", "rename_comp"),
+        ("timeline_item_takes", "add"),
+        ("timeline_item_takes", "select"),
+        ("graph", "set_node_enabled"),
+    }
+
+    #: A real assessment landing between LOW and HIGH: existing content or
+    #: settings are altered, recovery is possible but is not one trivial
+    #: inverse. This table exists so that MEDIUM can mean something — before it,
+    #: MEDIUM was overwhelmingly the `else` fallthrough, which made an assessed
+    #: MEDIUM and an unrated action indistinguishable by level alone.
+    _MEDIUM_RISK_ACTIONS: Set[Tuple[str, str]] = {
+        # Additive edits that place content into an existing timeline. Nothing
+        # is deleted (`overwrite_range`, which does delete, is HIGH), but the
+        # timeline is no longer what it was.
+        ("timeline", "copy_clips"),
+        ("timeline", "duplicate_clips"),
+        ("timeline", "copy_range"),
+        ("timeline", "duplicate_range"),
+        ("timeline", "insert_generator"),
+        ("timeline", "insert_title"),
+        ("timeline", "insert_fusion_generator"),
+        ("timeline", "insert_fusion_title"),
+        ("timeline", "insert_fusion_composition"),
+        ("timeline", "insert_ofx_generator"),
+        ("media_pool", "append_to_timeline"),
+        # Timeline-wide settings. No content lost, but a wrong start timecode
+        # silently invalidates every conform and reference built against it.
+        ("timeline", "set_setting"),
+        ("timeline", "set_start_timecode"),
+        ("timeline", "set_voice_isolation_state"),
+        ("timeline_item", "set_voice_isolation_state"),
+        # `set_property` takes an arbitrary key/value, so its blast radius is
+        # whatever the caller passed; `set_retime` changes duration and sync.
+        ("timeline_item", "set_property"),
+        ("timeline_item", "set_retime"),
+        # Pool reorganisation: clips and bins move, nothing is destroyed, but
+        # paths other work depends on change underneath it.
+        ("media_pool", "move_clips"),
+        ("media_pool", "move_folders"),
+        ("media_pool", "auto_sync_audio"),
+        ("media_pool", "setup_multicam_timeline"),
+        # Analysis passes that write their results back onto the timeline.
+        ("timeline_ai", "create_subtitles"),
+        ("timeline_ai", "analyze_dolby_vision"),
+        # Grade state that is replaced rather than removed. AddVersion also
+        # switches the active version, so a later graph write lands on the new
+        # one — the reason a "pre-change" backup version can end up holding the
+        # post-change grade.
+        ("timeline_item_color", "add_version"),
+        ("timeline_item_color", "load_version"),
+        ("timeline_item_color", "set_cdl"),
+        ("timeline_item_color", "assign_color_group"),
+        ("timeline_item_color", "stabilize"),
+        ("timeline_item_color", "smart_reframe"),
+        ("timeline_item_color", "create_magic_mask"),
+        ("timeline_item_color", "regenerate_magic_mask"),
+        ("graph", "set_lut"),
+        ("graph", "apply_arri_cdl_lut"),
+        # Importing or switching the active comp changes what renders.
+        ("timeline_item_fusion", "import_comp"),
+        ("timeline_item_fusion", "load_comp"),
     }
 
     _READ_ONLY_PREFIXES = ("get_", "list_", "query_", "probe_", "inspect_", "export_", "check_")
@@ -195,6 +328,17 @@ class RiskClassificationHook(LifecycleHook):
             destructive = True
             radius = BlastRadius.ITEM
             reasons.append(f"Bounded reversible edit: {action}")
+        elif pair in cls._MEDIUM_RISK_ACTIONS:
+            level = RiskLevel.MEDIUM
+            destructive = True
+            # Scope follows the tool: the timeline and pool tools act on the
+            # timeline or the pool as a whole, the per-item tools on one item.
+            radius = (
+                BlastRadius.TIMELINE
+                if tool_name in {"timeline", "timeline_ai", "edit_engine", "media_pool"}
+                else BlastRadius.ITEM
+            )
+            reasons.append(f"Recoverable edit to existing state: {action}")
         elif any(action.startswith(p) for p in cls._READ_ONLY_PREFIXES) or action in {"read", "status", "info"}:
             level = RiskLevel.LOW
             destructive = False