davinci-resolve-mcp 2.210.1 → 2.212.0

package/CHANGELOG.md

@@ -2,6 +2,76 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.212.0 — graph risk follows the graph the call targets
+
+### Changed
+
+- **Every `graph` mutation now reports the blast radius of its `source`.**
+  The graph tool resolves `source` as `"timeline"` (the DEFAULT, the
+  timeline-level node graph), `"item"` (one clip), or
+  `"color_group_pre"`/`"color_group_post"` (a group's shared graph), and every
+  mutation lands on whichever graph that names. The classifier reported all
+  five graph actions as item-scoped regardless, so `reset_all_grades` on a
+  color-group graph — which wipes the grade of every clip in the group — read
+  as one item. The radius is now derived from the call: timeline, item, or
+  project for a color group, and the reasons name the target graph.
+
+- **`graph.set_lut` and `graph.apply_arri_cdl_lut` are HIGH on the timeline or a color-group graph, MEDIUM on one item.**
+  A plain `set_lut` call with no `source` restyles every clip on the timeline;
+  rating that MEDIUM under-stated it, while rating the item-scoped call HIGH
+  would over-block a one-clip LUT. Safe mode now blocks the broad cases
+  unless `allow_risky_operation=true`; the item case passes as before.
+  `reset_all_grades` and `apply_grade_from_drx` stay HIGH, `set_node_enabled`
+  stays LOW — only their reported scope changed.
+
+### Added
+
+- Tests: safe mode blocks broad LUT writes before the handler and allows
+  item-scoped ones; the classifier's LUT split; the radius of every graph
+  action across all five source values; and a medium-band matrix pinning
+  every remaining MEDIUM destructive action as recognised, destructive, not
+  confirmation-gated, and carrying its reviewed radius.
+
+- Adapted from PR #192 by @Rohitkanithi, which introduced the scope split
+  and its tests for the two LUT actions; landed with the radius generalised
+  to every graph action, since the same `source` governs them all.
+
+## What's New in v2.211.0 — dry_run on an action that cannot honour it now refuses instead of executing
+
+### Changed
+
+- **An explicit `dry_run=true` on a destructive action with no native dry-run path is refused, not executed.**
+  102 of the 108 registered destructive actions never read the flag, so
+  `timeline_markers.add` with `dry_run=true` added a real marker and
+  `timeline.delete_track` with `dry_run=true` deleted the track — and the
+  agent guidance says to prefer `dry_run` where it exists, which cannot be
+  told from outside. The destructive-operation wrapper now returns
+  `DRY_RUN_UNAVAILABLE` (`status: dry_run_unavailable`, `dry_run: true`,
+  `simulated: false`, `executed: false`, the same static risk block as
+  `inspect_operation`, and a remediation) before any archive, state lookup,
+  or handler execution. The security audit log records it as
+  `blocked` / `dry_run_unavailable`. This is a refusal, not a synthesised
+  preview — the lifecycle pipeline's original interceptor answered
+  `success: true` for calls it never ran and was removed for it.
+
+- **The six actions that do honour `dry_run` are an allowlist, `NATIVE_DRY_RUN_ACTIONS`.**
+  `media_pool.set_clip_marks`, `media_pool.clear_clip_marks`,
+  `media_pool.setup_multicam_timeline`, `timeline.apply_cuts`,
+  `timeline.ripple_insert`, `timeline_ai.create_subtitles`. A static drift
+  test pins the list to the handlers by following the params object into
+  helper calls; that is what excluded `edit_engine.execute_tighten` and
+  `execute_silence_ripple`, which call a dry_run-aware helper but hand it a
+  fresh dict without the flag. Add a native dry-run branch and the test says
+  to list it; list an action without one and the test refuses.
+
+- **The refusal is keyed on registry membership, not on `is_destructive()`**, so
+  the no-archive filters (a Notes edit) cannot let a dry-run request through to
+  a handler that would execute it.
+
+- Adapted from PR #190 by @Rohitkanithi, which introduced the refusal shape
+  as a denylist of the fourteen marker actions; landed as an allowlist so the
+  other 88 actions that ignore the flag are covered too.
+
 ## What's New in v2.210.1 — frame capture and verify_output no longer read JobStatus in English
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.210.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.210.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.210.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.212.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/docs/SKILL.md

@@ -289,12 +289,20 @@ Example trace shape returned by `resolve_control(action="get_execution_trace")`:
   availability was not determined, never that there is none; and
   `pre_state_available` separates "no project open" from "state never read".
   For an actual preview, use the action's own `dry_run` where it has one.
+  Where it has none, an explicit `dry_run=true` on a registered destructive
+  action is refused with `DRY_RUN_UNAVAILABLE` (`status: dry_run_unavailable`,
+  `simulated: false`, `executed: false`, plus the same static risk block)
+  before any archive, state lookup, or handler execution. Until v2.211.0 the
+  flag was silently ignored on those actions and the mutation ran; the
+  actions that do honour it are listed in `NATIVE_DRY_RUN_ACTIONS`
+  (`src/utils/destructive_hook.py`) and pinned to the handlers by a test.
 - **`list_lifecycle_hooks()`**: Returns active execution lifecycle pipeline hooks
   (`risk_classification`, `resolve_state_inspection`, `readback_verification`,
   `drift_detection`, `provenance_trace`). All of them observe; none replaces a
-  tool result. `dry_run` therefore always reaches the real handler — a tool
-  either implements it or does not, and nothing synthesises a preview on its
-  behalf.
+  tool result. `dry_run` is therefore never answered on a handler's behalf:
+  an action with a native dry-run path runs it, and every other registered
+  destructive action refuses the flag instead of either simulating or
+  executing.
 
 Explicit correlation is also supported per-call: pass `params={"execution_id": ...}`
 or `params={"trace_id": ...}` in any tool call to associate it with a specific trace.

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.210.1"
+VERSION = "2.212.0"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.210.1",
+  "version": "2.212.0",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.210.1"
+VERSION = "2.212.0"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.210.1"
+VERSION = "2.212.0"
 
 import base64
 import os

package/src/utils/destructive_hook.py

@@ -252,6 +252,104 @@ DRY_RUN_DEFAULT_TRUE_ACTIONS: frozenset = frozenset({
 })
 
 
+# ── Native dry-run allowlist ────────────────────────────────────────────────
+#
+# Registered destructive actions whose handler genuinely reads `dry_run` and
+# returns a plan instead of mutating. Every OTHER registered destructive action
+# ignores the flag: `timeline_markers.add` with `dry_run=true` added a real
+# marker, `timeline.delete_track` with `dry_run=true` deleted the track. An
+# agent following the guidance "prefer dry_run where it exists" cannot tell
+# the two apart from the outside, so an explicit `dry_run=true` on a registered
+# destructive action outside this set is REFUSED (DRY_RUN_UNAVAILABLE) before
+# archive, state lookup, or handler execution — nothing simulated, nothing
+# executed, and the response says so.
+#
+# This is deliberately a refusal and not a synthesised preview: the lifecycle
+# pipeline's original dry-run interceptor answered `success: true` for calls
+# it never ran and was removed for it (see
+# execution_lifecycle.LifecyclePipeline._register_default_hooks). A dry run
+# that always succeeds is worse than none, because it is trusted.
+#
+# The set is pinned by tests.test_destructive_hook against a static scan of
+# src/server.py that follows the params object into helpers: add a native
+# dry-run branch to a handler and the test tells you to list it here; list an
+# action here without one and the test refuses.
+
+NATIVE_DRY_RUN_ACTIONS: frozenset = frozenset({
+    ("media_pool", "clear_clip_marks"),
+    ("media_pool", "set_clip_marks"),
+    ("media_pool", "setup_multicam_timeline"),
+    ("timeline", "apply_cuts"),
+    ("timeline", "ripple_insert"),
+    ("timeline_ai", "create_subtitles"),
+})
+
+
+def _explicit_dry_run_requested(params: Optional[Dict[str, Any]]) -> bool:
+    if not isinstance(params, dict):
+        return False
+    if "dry_run" in params:
+        return bool(params["dry_run"])
+    if "dryRun" in params:
+        return bool(params["dryRun"])
+    return False
+
+
+def lacks_native_dry_run(
+    tool_name: str, action: str, params: Optional[Dict[str, Any]] = None,
+) -> bool:
+    """True when the caller asked for a dry run this destructive action cannot honour.
+
+    Keyed on the destructive registry rather than `is_destructive()` so the
+    no-archive filters (a Notes edit, say) cannot let a dry-run request slip
+    through to a handler that would execute it for real.
+    """
+    return (
+        _explicit_dry_run_requested(params)
+        and action in DESTRUCTIVE_ACTIONS_BY_TOOL.get(tool_name, frozenset())
+        and (tool_name, action) not in NATIVE_DRY_RUN_ACTIONS
+    )
+
+
+def _dry_run_unavailable_response(
+    *,
+    operation_id: str,
+    tool_name: str,
+    action: str,
+    assessment: RiskAssessment,
+) -> Dict[str, Any]:
+    return {
+        "success": False,
+        "status": "dry_run_unavailable",
+        "dry_run": True,
+        "simulated": False,
+        "executed": False,
+        "operation_id": operation_id,
+        "security": {
+            "risk_level": assessment.level.value,
+            "risk_established": assessment.recognised,
+            "safe_mode": _safe_mode_enabled(),
+            "blocked": True,
+            "policy": "destructive.dry_run_support",
+        },
+        "risk": assessment.to_dict(),
+        "error": {
+            "message": (
+                f"'{tool_name}.{action}' has no native dry-run path, so dry_run=true "
+                "cannot be honoured. Nothing was simulated and nothing was executed."
+            ),
+            "code": "DRY_RUN_UNAVAILABLE",
+            "category": "dry_run_unavailable",
+            "retryable": False,
+            "remediation": (
+                "Use inspect_operation for the static risk assessment, use a "
+                "probe_*/safe_* action where one exists, or call again without "
+                "dry_run once the operation has been reviewed."
+            ),
+        },
+    }
+
+
 def _payload_is_plan_only(
     tool_name: str, action: str, params: Optional[Dict[str, Any]],
 ) -> bool:
@@ -627,6 +725,29 @@ def destructive_op(tool_name: str) -> Callable[[Callable[..., Any]], Callable[..
     def decorator(fn: Callable[..., Any]) -> Callable[..., Any]:
         @functools.wraps(fn)
         def wrapper(action: str, params: Optional[Dict[str, Any]] = None, *args, **kwargs) -> Any:
+            if lacks_native_dry_run(tool_name, action, params):
+                # An explicit dry-run request this handler would silently
+                # execute for real. Refuse before archive, state lookup, or the
+                # handler itself; see NATIVE_DRY_RUN_ACTIONS.
+                operation_id = f"op_{uuid.uuid4().hex[:12]}"
+                assessment = assess_action_risk(tool_name, action, params)
+                _audit_security_event(
+                    operation_id=operation_id,
+                    tool_name=tool_name,
+                    action=action,
+                    risk_level=assessment.level.value,
+                    status="blocked",
+                    params=params,
+                    reason="dry_run_unavailable",
+                    recognised=assessment.recognised,
+                )
+                return _dry_run_unavailable_response(
+                    operation_id=operation_id,
+                    tool_name=tool_name,
+                    action=action,
+                    assessment=assessment,
+                )
+
             if not is_destructive(tool_name, action, params):
                 return fn(action, params, *args, **kwargs)
 

package/src/utils/execution_lifecycle.py

@@ -287,13 +287,42 @@ class RiskClassificationHook(LifecycleHook):
         ("timeline_item_color", "smart_reframe"),
         ("timeline_item_color", "create_magic_mask"),
         ("timeline_item_color", "regenerate_magic_mask"),
-        ("graph", "set_lut"),
-        ("graph", "apply_arri_cdl_lut"),
         # Importing or switching the active comp changes what renders.
         ("timeline_item_fusion", "import_comp"),
         ("timeline_item_fusion", "load_comp"),
     }
 
+    #: Raw graph LUT writes. Their level follows the graph they target (see
+    #: `_graph_scope`): MEDIUM on one item, HIGH on the timeline graph (the
+    #: tool's DEFAULT) or a color-group graph, where one call restyles every
+    #: clip on the timeline or in the group. Adapted from PR #192.
+    _GRAPH_LUT_ACTIONS: Set[Tuple[str, str]] = {
+        ("graph", "set_lut"),
+        ("graph", "apply_arri_cdl_lut"),
+    }
+
+    @staticmethod
+    def _graph_scope(params: Dict[str, Any]) -> Tuple["BlastRadius", str]:
+        """Blast radius of a `graph` tool call, from its `source` param.
+
+        The graph tool resolves `source` as "timeline" (default) ->
+        Timeline.GetNodeGraph(), "item" -> TimelineItem.GetNodeGraph(), and
+        "color_group_pre"/"color_group_post" -> the group's pre/post clip
+        graph. Every graph mutation — LUT, DRX apply, reset, node toggle —
+        lands on whichever graph that names, so the scope is a property of
+        the call, not of the action, and a rating that says "item" for a
+        reset of a color-group graph is wrong by the size of the group.
+        """
+        source = str(params.get("source") or "timeline")
+        if source == "item":
+            return BlastRadius.ITEM, "one timeline item's graph"
+        if source in {"color_group_pre", "color_group_post"}:
+            return (
+                BlastRadius.PROJECT,
+                f"a color group's {source} graph (every clip in the group)",
+            )
+        return BlastRadius.TIMELINE, "the timeline node graph (every clip on the timeline)"
+
     _READ_ONLY_PREFIXES = ("get_", "list_", "query_", "probe_", "inspect_", "export_", "check_")
 
     @classmethod
@@ -319,14 +348,31 @@ class RiskClassificationHook(LifecycleHook):
             if params.get("ripple", False):
                 radius = BlastRadius.TIMELINE
                 reasons.append("Ripple mode alters downstream timeline synchronization")
+            elif tool_name == "graph":
+                radius, scope = cls._graph_scope(params)
+                reasons.append(f"Graph target: {scope}")
             else:
                 radius = BlastRadius.ITEM
             conf_required = True
             reasons.append(f"Destructive timeline edit: {action}")
+        elif pair in cls._GRAPH_LUT_ACTIONS:
+            destructive = True
+            radius, scope = cls._graph_scope(params)
+            if radius is BlastRadius.ITEM:
+                level = RiskLevel.MEDIUM
+                reasons.append(f"Raw graph LUT write '{action}' is scoped to {scope}")
+            else:
+                level = RiskLevel.HIGH
+                conf_required = True
+                reasons.append(f"Raw graph LUT write '{action}' targets {scope}")
         elif pair in cls._LOW_RISK_ACTIONS:
             level = RiskLevel.LOW
             destructive = True
-            radius = BlastRadius.ITEM
+            if tool_name == "graph":
+                radius, scope = cls._graph_scope(params)
+                reasons.append(f"Graph target: {scope}")
+            else:
+                radius = BlastRadius.ITEM
             reasons.append(f"Bounded reversible edit: {action}")
         elif pair in cls._MEDIUM_RISK_ACTIONS:
             level = RiskLevel.MEDIUM