davinci-resolve-mcp 2.212.2 → 2.212.4

package/CHANGELOG.md

@@ -2,6 +2,82 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.212.4 — both dependency manifests move together again
+
+### Changed
+
+- **The root `package.json` had lagged `resolve-advanced/package.json` since
+  July.** The advanced manifest was brought to zero advisories on 2026-08-30;
+  the root one still carried the SDK at 1.27, adm-zip 0.5, sharp 0.33, zod 3
+  and uuid 9, so `npm audit` on the root read nine advisories (five high)
+  while the advanced package read one. Both manifests now agree:
+  `@modelcontextprotocol/sdk` 1.30, `fast-xml-parser` 5.11, `adm-zip` 0.6,
+  `sharp` 0.35, `zod` 4, `js-yaml` 4.3, `pg` 8.23, `better-sqlite3` held on
+  the 11.x line. Contributed in #193 by @federicosada-pixel.
+- **`uuid` is gone from the root manifest.** Nothing under `bin/`, `src/` or
+  `scripts/` imports it — the code uses `crypto.randomUUID` — so rather than
+  carry the bump to 14.x it was removed on landing.
+- **Python floor for the MCP SDK is now `mcp[cli]>=1.30,<2`** in
+  `requirements.txt` and the installer; the `<2` pin stays because the 2.x
+  SDK dropped `mcp.server.fastmcp`. `pyaaf2` floor moves to 1.7.1.
+
+### What was checked
+
+- **zod 3 → 4 is a major bump the advanced server takes directly.** Its two
+  single-argument `z.record()` sites (a documented zod 4 removal) were probed
+  on zod 4.5.4 for both parsing and JSON-schema conversion, and a real stdio
+  `tools/list` returns the same 18 tools before and after.
+- **The five remaining root advisories are all transitive under the MCP
+  SDK** — hono, @hono/node-server, ajv → fast-uri, express-rate-limit →
+  ip-address, express → qs — and `npm audit fix --dry-run` reports the same
+  five, so they clear only when the SDK bumps its own dependencies.
+- The Python suite was also run with the 1.30.0 SDK wheel shadowing the venv
+  before the venv itself was upgraded.
+
+### Validation
+
+- Full offline Python suite, the drift guards (including the lockfile-sync
+  guard), `npm ci` from both lockfiles, the advanced Node suite, the CLI
+  smoke and pack checks, and pip-audit on the upgraded venv. No Resolve
+  behavior changed; live test not required.
+
+## What's New in v2.212.3 — a cached update prompt is re-judged against the version actually running
+
+### Fixed
+
+- **A persisted "update available" outlived the upgrade it recommended.** The
+  update checker caches its last verdict (in memory and in
+  `logs/update-check.json`) and serves it without network for the throttle
+  interval. That verdict was stored as a *status*, not as a comparison, so
+  after upgrading from the version it was computed for — 2.135.0 → 2.210.0,
+  say — a server now running 2.212.1 kept prompting to update to 2.210.0.
+  Every cached path (in-memory, persisted, and the throttled branch of
+  `check_for_updates`) now re-compares the cached `latest_version` against
+  the running version and reclassifies to `update_available` /
+  `up_to_date` / `current_ahead`; `error` and `disabled` results are left
+  as they were. Contributed in #194 by @diesdaas.
+
+### Documentation
+
+- **The READMEs said there was no beat detection; there has been for some
+  time.** Both the English and Simplified Chinese "not supported" tables
+  claimed "no beat or downbeat detection yet" — twenty lines below an
+  optional-extras table listing `pip install librosa` for exactly that. The
+  row now describes what actually exists: optional `librosa` beat detection
+  and beat / bar / phrase cut-point plans, downbeats inferred from the first
+  beat with `beat_offset` for pickups, and cut *points* rather than a finished
+  music edit. Speech-silence tools remain the wrong instrument for music.
+
+### Validation
+
+- Four regression tests from the PR cover the persisted, in-memory and
+  throttled cache paths plus the preserved error/disabled states. On landing,
+  the update-check tests gained a `setUp` that resets the module-wide cache
+  around every test, so a seeded verdict cannot leak into another module's
+  cached-status read later in the run. Full offline suite, drift guards and
+  the advanced Node suite are green. No Resolve behavior changed; live test
+  not required.
+
 ## What's New in v2.212.2 — failed verification evidence survives the operation envelope
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.212.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#server-modes)
@@ -339,7 +339,7 @@ cheaper to read it here than to discover it mid-project.
 | Not supported | Why, and what you get instead |
 |---|---|
 | **Choosing the best take** | Performance is most of what makes a take right, and none of it is measurable from a waveform or a transcript. `rank_takes` ranks *fluency* — fillers, restarts, script coverage — and says so in every response. The take that plays is regularly the least fluent one, because the hesitation is often the acting. Use it to find the clean safety take, not to choose the read. |
-| **Cutting to music** | No beat or downbeat detection yet. Speech-driven tools will read a music bed as one long region and are the wrong instrument for it. |
+| **Automatic music editing** | Optional `librosa` support provides beat detection and beat/bar/phrase cut-point plans, not a finished assembly. Downbeats are inferred from the first beat; use `beat_offset` for pickups. Speech-silence tools are unsuitable for finding musical edit points. |
 | **Judging a cut** | Nothing here has an opinion about whether an edit is good. Every destructive action is plan → review → confirm for that reason. |
 | **Replacing an editor** | The output is a first-pass assembly, in the assistant-editor sense: ingest, sync, organize, string out, flag problems. It is a starting point you cut, not a finished cut. Defaults are deliberately **generous** — a first assembly is supposed to run long, because trimming is fast and visible while recovering discarded material is slow and invisible. |
 | **Modifying your source media** | By design and without exception — see below. |

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.212.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.212.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(353%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.212.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v2.212.4 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 
@@ -207,7 +207,7 @@ DRX 调色写入**针对 Resolve Studio 做过实机校准**：调色参数默
 | 不支持 | 原因，以及你能得到什么 |
 |---|---|
 | **挑选最佳条次** | 表演是决定一条好坏的大头，而这些从波形或转写里都量不出来。`rank_takes` 排的是*流畅度*——填充词、重来、稿子覆盖率——并在每次响应里说明这一点。最终用的那条常常是最不流畅的一条，因为迟疑往往正是表演。用它找干净的保底条，别用它挑读法。 |
-| **跟音乐剪辑** | 还没有节拍/强拍检测。语音驱动的工具会把音乐床读成一整个长区域，用错了工具。 |
+| **自动音乐剪辑** | 可选的 `librosa` 支持节拍检测和按节拍、小节、乐句规划剪切点，但不会生成完整剪辑。强拍从第一个节拍推断；遇到弱起时用 `beat_offset` 调整。语音静音检测工具不适合寻找音乐剪切点。 |
 | **评判剪辑好坏** | 这里没有任何东西对"这一刀剪得好不好"持有观点。正因如此，一切破坏性操作都走 计划 → 审阅 → 确认。 |
 | **取代剪辑师** | 输出是助理剪辑意义上的初剪：摄入、同步、整理、串片、标记问题。它是给你继续剪的起点，不是成片。默认参数刻意**宽松**——初剪本来就该偏长，因为往下修快且看得见，而找回已丢弃的素材慢且看不见。 |
 | **修改你的源媒体** | 设计如此，无例外——见下文。 |

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.212.2"
+VERSION = "2.212.4"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds
@@ -1385,7 +1385,7 @@ def install_dependencies(venv_path, project_dir):
     # downgrade it, and the fix does not depend on install ordering. Lift both
     # together when server.py is ported to the 2.x layout.
     subprocess.run(
-        [str(pip), "install", "-q", "mcp[cli]>=1.29,<2"],
+        [str(pip), "install", "-q", "mcp[cli]>=1.30,<2"],
         check=True, capture_output=True
     )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.212.2",
+  "version": "2.212.4",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",
@@ -18,20 +18,19 @@
     "davinci-resolve-advanced-mcp": "./bin/davinci-resolve-advanced-mcp.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "adm-zip": "^0.5.16",
-    "fast-xml-parser": "^5.7.3",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "adm-zip": "^0.6.0",
+    "fast-xml-parser": "^5.11.1",
     "fzstd": "^0.1.1",
     "jszip": "^3.10.1",
-    "uuid": "^9.0.0",
-    "zod": "^3.25.76",
+    "zod": "^4.5.4",
     "zstd-codec": "^0.1.5"
   },
   "optionalDependencies": {
-    "better-sqlite3": "^11.0.0",
-    "js-yaml": "^4.1.0",
-    "pg": "^8.11.0",
-    "sharp": "^0.33.0"
+    "better-sqlite3": "^11.10.0",
+    "js-yaml": "^4.3.2",
+    "pg": "^8.23.0",
+    "sharp": "^0.35.4"
   },
   "files": [
     "bin/",

package/resolve-advanced/package.json

@@ -19,18 +19,18 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "adm-zip": "^0.6.0",
-    "fast-xml-parser": "^5.7.3",
+    "fast-xml-parser": "^5.11.1",
     "fzstd": "^0.1.1",
     "jszip": "^3.10.1",
-    "zod": "^3.25.76",
+    "zod": "^4.5.4",
     "zstd-codec": "^0.1.5"
   },
   "optionalDependencies": {
     "better-sqlite3": "^11.10.0",
-    "js-yaml": "^4.3.0",
-    "pg": "^8.22.0",
+    "js-yaml": "^4.3.2",
+    "pg": "^8.23.0",
     "sharp": "^0.35.4"
   },
   "peerDependenciesMeta": {

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.212.2"
+VERSION = "2.212.4"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 353-tool granular server instead
 """
 
-VERSION = "2.212.2"
+VERSION = "2.212.4"
 
 import base64
 import os

package/src/utils/update_check.py

@@ -135,14 +135,13 @@ def get_cached_update_status(
     with _cached_lock:
         cached = dict(_cached_status)
     if cached.get("status") != "unknown":
-        if current_version and "current_version" not in cached:
-            cached["current_version"] = current_version
+        cached = _reclassify_cached_status(cached, current_version)
+        _set_cached_status(cached)
         return cached
 
     state = _read_state(update_state_path(project_dir, env))
     if state:
-        if current_version and "current_version" not in state:
-            state["current_version"] = current_version
+        state = _reclassify_cached_status(state, current_version)
         if "update_mode" not in state:
             state["update_mode"] = get_update_mode(project_dir, env)
         return state
@@ -193,11 +192,12 @@ def check_for_updates(
         and previous
         and checked_at - float(previous.get("checked_at", 0)) < interval_seconds
     ):
-        cached = dict(previous)
+        cached = _reclassify_cached_status(previous, current_version)
         cached["cached"] = True
         cached["update_mode"] = update_mode
         cached["next_check_at"] = float(previous.get("checked_at", 0)) + interval_seconds
         cached["next_check_at_iso"] = _format_timestamp(cached["next_check_at"])
+        _write_state(state_path, cached)
         _set_cached_status(cached)
         return cached
 
@@ -621,6 +621,27 @@ def _version_text(value: Any) -> str:
     return match.group(0) if match else str(value or "").strip()
 
 
+def _reclassify_cached_status(
+    result: Mapping[str, Any], current_version: Optional[str]
+) -> Dict[str, Any]:
+    """Refresh cached status against the version of the running MCP."""
+    refreshed = dict(result)
+    if refreshed.get("status") not in _SUCCESS_STATUSES:
+        return refreshed
+    if current_version:
+        refreshed["current_version"] = current_version
+    comparison = compare_versions(current_version, refreshed.get("latest_version"))
+    if comparison is None:
+        return refreshed
+    if comparison < 0:
+        refreshed["status"] = "update_available"
+    elif comparison > 0:
+        refreshed["status"] = "current_ahead"
+    else:
+        refreshed["status"] = "up_to_date"
+    return refreshed
+
+
 def _read_state(path: Path) -> Dict[str, Any]:
     try:
         with path.open("r", encoding="utf-8") as handle: