davinci-resolve-mcp 2.212.0 → 2.212.2

package/CHANGELOG.md

@@ -2,6 +2,71 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.212.2 — failed verification evidence survives the operation envelope
+
+### Fixed
+
+- **A payload that carried its own `verification` block won outright, hiding
+  contradicting evidence beside it.** `extract_verification` returned any
+  pre-shaped `verification` dict untouched, so a top-level `contradiction:
+  true`, a `readback.missing` list, or a failed check inside the block itself
+  could sit next to `status: "passed"`. Evidence now merges: the explicit
+  status, readback misses, post-state readback and property-restore failures
+  are all collected, and precedence runs contradiction > failed > partial >
+  passed > unverified. Contributed in #195 by @denoise.
+- **Bulk command counts no longer count as verification.** `succeeded` /
+  `failed` tallies record what the server sent, not what Resolve honoured; a
+  `succeeded: 3, failed: 0` result used to read `verification.status:
+  "passed"` with no readback at all. The counts still drive the envelope's
+  own `status` (`partial` when both are non-zero), but the verification block
+  stays `unverified` until real evidence — a readback — arrives.
+
+### Validation
+
+- The PR's regression tests plus two added on landing: bulk counts cannot
+  mask a failed readback, and readback evidence is what establishes a pass on
+  a bulk result. Full offline suite, the drift guards and the advanced Node
+  suite are green. No Resolve behavior changed; live test not required.
+
+## What's New in v2.212.1 — the networked transport's generated bearer token no longer lands in server.log
+
+### Fixed
+
+- **A generated transport token was written to `logs/server.log` in cleartext (CWE-532).**
+  Starting `--transport sse` or `--transport streamable-http` without pinning
+  `$DAVINCI_MCP_TOKEN` logged the fresh token verbatim. The transport logger
+  has no handler of its own, so the record propagated to the root logger,
+  which `src/server.py` points at `logs/server.log` — opened with the default
+  file mode (0644 under the usual umask), appended to forever, and never
+  cleared. That copy was strictly less protected and strictly more durable
+  than the one the code deliberately locks down: the 0600 state file under
+  the per-user private directory, deleted in `run_networked`'s `finally`. The
+  token is the transport's only access control, and the control panel's
+  sibling token was already kept out of argv and logs against exactly this
+  local-user threat. The log line now names the state file's path instead of
+  the value, and a generated token is echoed only to an interactive stderr
+  (a redirected stderr is another file). The state file remains the
+  hand-back channel the control panel already reads. Reported privately by an
+  external security researcher, with a reproduction against the real
+  `run_networked` and the server's real root-logger configuration.
+
+### Documentation
+
+- `SECURITY.md` now states the rule outright: the pidfile and the transport
+  state file are the only on-disk copies of either token, and neither is
+  written to `logs/server.log`. The `mcp_transport` module docstring no longer
+  says the token is "logged at startup".
+
+### Validation
+
+- A regression test runs the real `run_networked` (uvicorn stubbed) with a
+  root `FileHandler` configured the way `src/server.py` configures it, and
+  asserts the token is absent from the file, the state-file path is present,
+  a redirected stderr never carries it, an interactive stderr carries it
+  exactly once, and a pinned token is echoed nowhere. Against the previous
+  code the test fails with the token found in the log — the reporter's
+  finding, reproduced.
+
 ## What's New in v2.212.0 — graph risk follows the graph the call targets
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.212.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.212.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.212.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.212.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/SECURITY.md

@@ -39,7 +39,11 @@ Their posture:
 - **Secrets on disk are private.** The panel's pidfile (token + pid + URL) and
   the transport's state file (token + URL) live under
   `~/.davinci-resolve-mcp/` (0700) and are written 0600 — never in a shared
-  temp directory or `~/Documents`.
+  temp directory or `~/Documents`. Those are the only on-disk copies: neither
+  token is ever written to `logs/server.log`, which the server appends to with
+  the default file mode and never clears. The transport logs the state file's
+  path, not the token, and echoes a generated token only to an interactive
+  stderr.
 
 If you find a route that can be reached without the token, or a way to satisfy
 the Host/Origin checks from a non-loopback page, that is a security bug — please

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.212.0"
+VERSION = "2.212.2"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.212.0",
+  "version": "2.212.2",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.212.0"
+VERSION = "2.212.2"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.212.0"
+VERSION = "2.212.2"
 
 import base64
 import os

package/src/utils/mcp_transport.py

@@ -3,9 +3,13 @@
 stdio remains the default. The `sse` and `streamable-http` modes bind to
 loopback (127.0.0.1) by default and REQUIRE a bearer token on every request, so
 turning networking on never silently exposes Resolve. The token comes from
-``$DAVINCI_MCP_TOKEN`` or is generated and logged at startup. A small state file
-(0600, under the per-user private state dir — never a shared tempdir) lets the
-control panel show the live connection URL + token.
+``$DAVINCI_MCP_TOKEN`` or is generated at startup. A small state file (0600,
+under the per-user private state dir — never a shared tempdir) lets the control
+panel show the live connection URL + token; that file is the only place a
+generated token is written. It is never logged: the server's root logger
+appends to ``logs/server.log`` with the default file mode and never truncates
+it, so a logged token would outlive the session in a file the state file's
+0600 was chosen to avoid. An interactive operator sees it once on stderr.
 
 Security posture:
 - Default host is loopback; a non-loopback bind logs a loud warning.
@@ -17,6 +21,7 @@ import json
 import logging
 import os
 import secrets
+import sys
 import time
 
 from src.utils.private_state import private_state_dir, write_private_json
@@ -102,6 +107,14 @@ def read_transport_state():
     return state
 
 
+def _stderr_is_interactive() -> bool:
+    """True only when stderr is a terminal a person is looking at."""
+    try:
+        return bool(sys.stderr and sys.stderr.isatty())
+    except (AttributeError, ValueError):
+        return False
+
+
 def run_networked(mcp, transport):
     """Serve `mcp` over an authenticated HTTP transport ('sse'|'streamable-http')."""
     import uvicorn
@@ -124,7 +137,20 @@ def run_networked(mcp, transport):
     logger.info("MCP %s transport: http://%s:%s (bearer token required)",
                 transport, host, port)
     if generated:
-        logger.info("Generated bearer token (set $DAVINCI_MCP_TOKEN to pin it): %s", token)
+        # The token is the transport's only access control. Log WHERE it is,
+        # never WHAT it is: this record propagates to the root logger, which
+        # src/server.py points at logs/server.log — default file mode, appended
+        # forever, no cleanup in our finally: — whereas the state file is 0600
+        # and cleared at shutdown. The console gets the value only when a person
+        # is watching it (a TTY); a redirected stderr is just another file.
+        logger.info(
+            "Generated a bearer token; it is recorded in %s (0600). "
+            "Set $DAVINCI_MCP_TOKEN to pin your own.",
+            TRANSPORT_STATE_PATH,
+        )
+        if _stderr_is_interactive():
+            print(f"davinci-resolve-mcp: bearer token for this session: {token}",
+                  file=sys.stderr, flush=True)
 
     write_transport_state(transport, host, port, token)
     try:

package/src/utils/operation_result.py

@@ -166,75 +166,57 @@ def extract_verification(raw: Any) -> Dict[str, Any]:
     if not isinstance(raw, dict):
         return unverified
 
-    # An impl that already speaks this shape wins outright.
     existing = raw.get("verification")
-    if isinstance(existing, dict) and existing:
-        merged = dict(existing)
-        merged.setdefault(
-            "status", "passed" if existing.get("verified") else "unverified")
-        merged.setdefault("checks", [])
-        merged.setdefault("contradiction", False)
-        return merged
-
-    checks: List[Dict[str, Any]] = []
-    status = "unverified"
-    contradiction = False
+    existing = existing if isinstance(existing, dict) else {}
+    checks = list(existing.get("checks") or [])
+    statuses = []
+    existing_status = existing.get("status")
+    if existing_status in {"passed", "failed", "partial", "contradiction"}:
+        statuses.append(existing_status)
+    elif existing.get("verified") is True:
+        statuses.append("passed")
+    elif existing.get("verified") is False:
+        statuses.append("failed")
+    contradiction = existing.get("contradiction") is True or raw.get("contradiction") is True
 
     readback = raw.get("readback")
-    if isinstance(readback, dict):
-        missing = readback.get("missing")
-        if isinstance(missing, list):
-            checks.append({
-                "check": "readback_verification",
-                "passed": not missing,
-                "missing_items": len(missing),
-            })
-            status = "passed" if not missing else "failed"
-
-    # verify_by_readback's own shape: a mutation that reported success while the
-    # post-state disagrees is a contradiction, this repo's single most valuable
-    # reliability signal — it must not be flattened into a plain failure.
-    if "verified" in raw:
-        verified = bool(raw["verified"])
-        contradiction = bool(raw.get("contradiction"))
-        checks.append({
-            "check": "readback_post_state",
-            "passed": verified,
-            "contradiction": contradiction,
-            "observed": raw.get("observed"),
-        })
-        status = "contradiction" if contradiction else ("passed" if verified else "failed")
+    if isinstance(readback, dict) and isinstance(readback.get("missing"), list):
+        missing = readback["missing"]
+        checks.append({"check": "readback_verification", "passed": not missing,
+                       "missing_items": len(missing)})
+        statuses.append("failed" if missing else "passed")
+
+    if type(raw.get("verified")) is bool:
+        checks.append({"check": "readback_post_state", "passed": raw["verified"],
+                       "contradiction": contradiction, "observed": raw.get("observed")})
+        statuses.append("passed" if raw["verified"] else "failed")
 
     if "property_restore_failures" in raw:
         failures = _as_int(raw.get("property_restore_failures"))
-        checks.append({
-            "check": "property_restore",
-            "passed": failures == 0,
-            "restored_items": _as_int(raw.get("properties_restored_items")),
-            "failures": failures,
-        })
-        if failures and status in ("passed", "unverified"):
-            status = "partial"
-
-    succeeded, failed = raw.get("succeeded"), raw.get("failed")
-    if isinstance(succeeded, int) and isinstance(failed, int):
-        checks.append({
-            "check": "bulk_operations",
-            "passed": failed == 0,
-            "succeeded": succeeded,
-            "failed": failed,
-        })
-        if status == "unverified":
-            if failed == 0 and succeeded > 0:
-                status = "passed"
-            elif succeeded > 0:
-                status = "partial"
-            elif failed > 0:
-                status = "failed"
-
-    if not checks:
-        return unverified
-    return {"status": status, "checks": checks, "contradiction": contradiction}
+        checks.append({"check": "property_restore", "passed": failures == 0,
+                       "restored_items": _as_int(raw.get("properties_restored_items")),
+                       "failures": failures})
+        if failures:
+            statuses.append("partial")
+
+    for check in checks:
+        if isinstance(check, dict):
+            contradiction = contradiction or check.get("contradiction") is True
+            if check.get("passed") is False:
+                statuses.append("partial" if check.get("check") == "property_restore" else "failed")
+    # Command counts are not evidence that Resolve honored those commands.
+    if contradiction or "contradiction" in statuses:
+        status = "contradiction"
+        contradiction = True
+    elif "failed" in statuses:
+        status = "failed"
+    elif "partial" in statuses:
+        status = "partial"
+    elif "passed" in statuses:
+        status = "passed"
+    else:
+        status = "unverified"
+    return {**existing, "status": status, "checks": checks, "contradiction": contradiction}
 
 
 # ─── Changes ─────────────────────────────────────────────────────────────────