davinci-resolve-mcp 2.224.2 → 3.0.0

package/CHANGELOG.md

@@ -2,6 +2,137 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v3.0.0 — the server no longer executes caller-supplied code, and every plugin write is gated
+
+**A breaking release.** Two public actions are removed. The rest of the change
+is a security fix, published as [GHSA-vh75-g46q-hgcw](https://github.com/samuelgursky/davinci-resolve-mcp/security/advisories/GHSA-vh75-g46q-hgcw).
+
+### Removed (breaking)
+
+- **`script_plugin run_inline`** ran a caller's source directly. Python ran as a
+  subprocess on the host, with the user's privileges and a live Resolve handle.
+  Lua ran inside Resolve's Fusion engine with `os` and `io` in scope, so
+  `os.execute` reached the shell.
+- **`script_plugin execute`** ran an installed script. `install` accepts
+  caller-supplied source, so the two together did the same thing in two steps.
+- **`probe_script_lifecycle`'s `execute` option.** The probe now **refuses**
+  `execute=true` up front, before generating or installing anything. Skipping it
+  silently would have reported a probe as complete for a step it never ran.
+
+Both actions shipped in v2.5.0 as documented features, and the agent guidance
+recommended `run_inline` for conversational queries. They are removed under the
+maintainer's policy that this server does not execute caller-supplied code, in
+any form. Calling either now returns an error that names the removal and points
+to the replacement, rather than a bare "unknown action".
+
+### Migration
+
+- Install the script with `script_plugin install`, then run it yourself from
+  **Workspace → Scripts** inside Resolve. Python output appears in Resolve's
+  Console.
+- For queries and edits in conversation, use the typed tools.
+
+### Security
+
+- **Plugin-folder writes passed every gate as reads.** `install` and `remove`
+  on `dctl`, `fuse_plugin` and `script_plugin`, plus `safe_install_extension`
+  and `safe_remove_extension`, were in neither write table. The risk classifier
+  returned `recognised=False` — a bare `remove` misses the `remove_*` prefix
+  rule — the destructive registry had no entry, and `fuse_plugin` and
+  `script_plugin` carried no `@_destructive_op` at all. So safe mode, dry-run
+  refusal and the security audit log treated them as reads. These are the
+  actions that put files into folders Resolve and Fusion later load and run: a
+  Fuse registers on the next restart, a script runs when clicked.
+- **`run_inline` and `execute` were in the same state.** With safe mode on, the
+  setting whose whole purpose is to block dangerous operations let arbitrary
+  code execution through as a read.
+- All of this is fixed here, for every version from v2.5.0 onward, and published
+  as the advisory linked above. A read-only audit confirmed `script_plugin` was
+  the only path in the repository that ran caller-supplied code: the Node
+  advanced server spawns fixed binaries only, never with `shell: true`.
+
+### Fixed
+
+- **A dry run of `install` or `remove` wrote or deleted the file for real.**
+  Dry-run refusal only applies to registered actions, so `dry_run=true` was
+  silently ignored. It is now refused with `DRY_RUN_UNAVAILABLE`. For a genuine
+  preview, use `safe_install_extension` / `safe_remove_extension`, which honour
+  `dry_run` themselves.
+- **The lifecycle probes skipped the gate.** They called the raw `_safe_*`
+  helpers directly, and `safe_remove_extension` unlinks the file itself, so
+  their installs and cleanup deletes reached disk ungated. They now go through
+  `script_plugin(...)`, and an AST guard keeps it that way.
+- **Plugin writes would have snapshotted the open timeline.** Once registered,
+  every write falls into version-on-mutate archiving — and `dctl encrypt_native`,
+  registered in v2.224.0, already archived a timeline version on every call. A
+  new non-timeline exemption keeps these writes gated and audited but skips the
+  archive. It also never resolves the versioning context, which reaches Resolve:
+  installing a shader must neither touch the project nor launch Resolve.
+
+### Changed — risk ratings
+
+- `install` and `safe_install_extension`: **MEDIUM** — audited and dry-run-honest,
+  not blocked by safe mode, like the other create-style writes.
+- `remove` and `safe_remove_extension`: **HIGH** — blocked while safe mode is on.
+  `allow_risky_operation: true` overrides a single call.
+- Safe mode is off by default, and `confirmation_required` is informational, not
+  a token demand. So for most users the visible change is that these calls are
+  now audited, and a dry run means a dry run.
+
+### Documentation
+
+- `docs/SKILL.md`, `docs/authoring/script-plugin-authoring.md` (retitled; its
+  execution section replaced by how to run an installed script) and the
+  extension-authoring kernel map describe the gated, execution-free surface.
+  So does the agent-facing prompt guidance, which had told agents to prefer
+  `run_inline` for inspecting Resolve state.
+- Two measured facts about Resolve's Lua bridge, found while building the
+  removed `run_inline`, are kept as reference because they describe Resolve
+  itself: `fusion.Execute()` is a no-op from the Python bridge in 20.x, and
+  `fusion.RunScript()` returns before the script finishes.
+
+### Validation
+
+- Full suite green: 3,472 passed, 1 skipped. The drop from the previous run is
+  exactly the deleted execution tests, less the five new policy tests.
+- New tests pin both halves: every plugin write is a rated, recognised write; a
+  dry run on the real tools is refused rather than executed; the safe-install
+  dry run still works; plugin writes never archive or reach Resolve; safe mode
+  blocks deletes and not installs; the removed actions refuse with a migration
+  pointer; the probe refuses `execute` before any side effect; and an AST scan
+  finds no `RunScript`, `Execute`, `exec` or `eval` call anywhere in `src/`.
+- No live Resolve run. The actions that remain behave as before apart from the
+  gate, which is decorator-level and verified offline. The removed actions can
+  only be verified absent, which the tests do.
+
+## What's New in v2.224.3 — the Windows import guard covers the advanced server
+
+Contributed by @Dev-next-gen (#222). Test-only; no behaviour changed.
+
+### Changed
+
+- The static guard added in v2.224.2 fails if a dynamic `import()` is given a
+  bare filesystem path — the pattern Node's ESM loader rejects on Windows. It
+  covered only `scripts/*.mjs` and `bin/*.mjs`, so a bare-path import added
+  under `resolve-advanced/server/` would have passed it, and with CI running
+  only on Linux the Windows failure would have stayed invisible there too. It
+  now also walks `resolve-advanced/server/` recursively, since the advanced
+  server loads modules from its `tools/` subfolder as well.
+- Offenders are reported by their path from the repository root, so a hit in a
+  nested file names that file. `node_modules` is skipped.
+
+### Validation
+
+- There is nothing under `resolve-advanced/server/` to catch today — every
+  dynamic import there passes a string literal — so the widened guard was
+  verified against a planted file, reproduced independently here: a probe at
+  `resolve-advanced/server/tools/zz_bare_import_probe.mjs` containing
+  `await import(path.join(...))` fails it, naming that file and line; with the
+  probe removed it passes. Per the contributor, the original
+  `scripts/author_interchange.mjs:45` case is still caught against the
+  pre-v2.224.2 bridge.
+- Full suite green: 3,485 passed, 1 skipped.
+
 ## What's New in v2.224.2 — offline authoring works on Windows
 
 Contributed by @Dev-next-gen (#221), found and verified on Windows.

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-2.224.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-3.0.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(377%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-2.224.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-3.0.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-36%20(377%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v2.224.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v3.0.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/docs/SKILL.md

@@ -118,39 +118,47 @@ directories. They are *authoring* tools — every other tool in this server wrap
 Resolve's scripting API, while these three emit and install plugin/script
 source. Status: lifecycle-verified in DaVinci Resolve Studio 20.3.2.9 for
 MCP-marked install/read/list/remove, regular DCTL `refresh_luts`, ACES/Fuse
-restart-required classification, Python installed-script execution, and
-Python/Lua `run_inline`. Use `docs/kernels/extension-authoring-kernel.md` for the
+restart-required classification. Script execution — `execute` and `run_inline` —
+was removed in v3.0.0: this server does not run caller-supplied code. Use
+`docs/kernels/extension-authoring-kernel.md` for the
 kernel boundary map, `docs/authoring/fuse-dctl-authoring.md` for the Fuse + DCTL coverage
 matrix, and `docs/authoring/script-plugin-authoring.md` for the script DSL spec and the
-conversational-execution model. For hand-authoring `.setting` template files
+install paths. For hand-authoring `.setting` template files
 (Edit effects/transitions/titles/generators and Fusion macros) — the format,
 control catalog, thumbnail conventions, install paths, and gotchas, plus copyable
 starter templates — see `docs/authoring/setting-files/`.
 
+**Plugin writes are gated like every other write.** `install` and `remove` on all
+three tools, and `script_plugin`'s `safe_install_extension` / `safe_remove_extension`,
+are registered destructive actions. An explicit `dry_run=true` on `install` or
+`remove` is refused with `DRY_RUN_UNAVAILABLE` rather than executed — for a real
+preview use `safe_install_extension` / `safe_remove_extension`, which honour
+`dry_run` themselves. `remove` is rated HIGH and is blocked while safe mode is on
+(`allow_risky_operation: true` overrides a single call); `install` is MEDIUM.
+Every call is recorded in the security audit log, and none of them archives the
+timeline — they write plugin folders, not the project. The `probe_*_lifecycle`
+actions route their installs and cleanup deletes through the same gate.
+
 Extension Authoring kernel actions (v2.16.0+) are exposed through
 `script_plugin`:
 
 - `extension_capabilities`
 - `probe_fuse_lifecycle(name?, kind?, install?, cleanup?)`
 - `probe_dctl_lifecycle(name?, kind?, category?, install?, refresh_luts?, cleanup?)`
-- `probe_script_lifecycle(name?, language?, category?, install?, execute?, cleanup?)`
+- `probe_script_lifecycle(name?, language?, category?, install?, cleanup?)`
 - `safe_install_extension(extension_type, name, source?|kind?, dry_run?)`
 - `safe_remove_extension(extension_type, name, dry_run?)`
 - `refresh_or_restart_required(extension_type, category?)`
 - `extension_boundary_report(include_template_matrix?)`
 
 Key behavioral notes for `script_plugin`:
-- `run_inline(source, language)` runs ad-hoc Lua/Python in Resolve and returns
-  stdout + result — use this for one-off conversational queries against the
-  Resolve API instead of building+installing a script.
+- **No script execution.** `run_inline` and `execute` were removed in v3.0.0:
+  this server does not run caller-supplied code, in any form. `install` puts a
+  script in Resolve's Workspace › Scripts menu; running it is the user's action
+  inside Resolve. For conversational queries against the Resolve API, use the
+  typed tools rather than a script.
 - `language` accepts `lua`, `py`, or the human-facing aliases `python` and
   `python3`.
-- `execute(name, category, language)` runs an installed script; Python stdout
-  and stderr are captured, while installed Lua execution can return false from
-  the Python bridge even when install/read/list/remove worked.
-- Lua scripts: `fusion.Execute()` from the Python bridge is a no-op in
-  Resolve 20.x — `_run_inline_lua` works around this with `RunScript` against
-  a temp file plus completion-sentinel polling on `app:SetData/GetData`.
 - Fuse install path on macOS is `…/DaVinci Resolve/Fusion/Fuses/` (NOT
   `Support/Fusion/Fuses/` as the SDK doc lists). The MCP path helpers handle
   this; if you're staging files manually, use the path the implementation

package/docs/authoring/script-plugin-authoring.md

@@ -1,10 +1,10 @@
-# Script Plugin Authoring & Conversational Resolve Scripting
+# Script Plugin Authoring
 
-The `script_plugin` compound tool (introduced in v2.5.0) generates, installs,
-and **executes** Resolve-page Lua/Python scripts. It closes the conversational
-loop: an LLM with access to the MCP can describe a workflow, generate the
-script, install it as a Resolve menu item, and execute it — all in one turn —
-with the script's stdout streamed back into the conversation.
+The `script_plugin` compound tool (introduced in v2.5.0) generates, validates
+and installs Resolve-page Lua/Python scripts. **It does not run them.** Script
+execution — `run_inline` and `execute` — was removed in v3.0.0, because this
+server does not execute caller-supplied code. An installed script appears as a
+Resolve menu item, and running it is the user's action, inside Resolve.
 
 Unlike `fuse_plugin` (which authors Fusion image-processing tools) and `dctl`
 (which authors color-page shaders), `script_plugin` targets the
@@ -15,8 +15,8 @@ automation.
 
 | Goal | Use |
 |---|---|
-| One-off conversational query against Resolve | `script_plugin('run_inline', ...)` |
-| Custom workflow you want as a permanent menu item | `script_plugin('install', ...)` then `('execute', ...)` |
+| One-off query or change against Resolve | The typed Resolve API tools — no script, no execution |
+| Custom workflow you want as a permanent menu item | `script_plugin('install', ...)`, then the user runs it from Workspace → Scripts |
 | Image-processing node for the Fusion page | `fuse_plugin` |
 | Color-page programmable transform | `dctl` |
 | Anything the existing 28 wrapped Resolve API tools already cover | The wrapped tool — no scripting needed |
@@ -93,43 +93,24 @@ Real-world example: a script supervisor's CSV with Filename, Scene, Take,
 Camera, Lens columns. Single rule maps each clip to its row and populates
 all metadata fields plus organizes into Scene bins. Six lines of RULES.
 
-## Conversational execution: `run_inline` and `execute`
-
-The two actions that close the loop:
-
-### `run_inline(source, language, timeout?)`
-Run an ad-hoc Lua or Python snippet inside Resolve, get stdout + return
-value back. No file persistence.
-
-**Python**: writes source to a temp file with `resolve`/`project`/`mp`/
-`timeline` pre-bound, runs as subprocess, captures stdout/stderr.
-
-**Lua**: wraps source so `print()` is intercepted into a buffer, runs via
-`fusion.RunScript()`, polls a completion sentinel, reads stdout + return
-value back via `app:SetData()`/`fusion.GetData()`. (Note: `fusion.Execute()`
-from the Python bridge is a no-op in Resolve 20.x — `RunScript()` against a
-file is the only working path. The implementation handles this.)
-
-Example:
-```python
-script_plugin('run_inline', {
-    'source': '''
-print(f"Project: {project.GetName()}")
-print(f"Bins: {len(mp.GetRootFolder().GetSubFolderList() or [])}")
-''',
-    'language': 'py',
-})
-# → {success: True, stdout: "Project: My Show\nBins: 12\n", exit_code: 0}
-```
+## Running an installed script
+
+`script_plugin` installs scripts; it does not run them. v3.0.0 removed the two
+actions that did:
+
+- `run_inline` ran a caller's source directly — Python as a subprocess on the
+  host, with a live Resolve handle, or Lua inside Resolve's Fusion engine with
+  `os` and `io` in scope.
+- `execute` ran an installed script, which `install` could have just written
+  from caller-supplied source.
 
-### `execute(name, category, language, args?, timeout?)`
-Run an installed script. Same return shape as `run_inline`.
+Neither passed any of the server's safety gates, and the maintainer policy is
+that the server never executes caller-supplied code. Calling either now returns
+an error that says so and points here.
 
-**Python**: subprocess captures full stdout/stderr.
-**Lua**: `fusion.RunScript()`; print() output goes to Resolve Console
-(can't capture). For Lua scripts that need to return data, have them write
-to `app:SetData()` and the caller reads via the existing `fusion_comp`
-tooling.
+After `install`, the user runs the script from **Workspace → Scripts →
+\<category\>** inside Resolve; Python output appears in Resolve's Console. For
+queries and edits in conversation, use the typed tools.
 
 ## Install paths
 
@@ -158,32 +139,19 @@ familiar for data-heavy workflows. The same RULES table syntax works in both
 Verified on DaVinci Resolve Studio 20.3.2.9, macOS:
 
 - ✅ Scripts appear in Workspace → Scripts → \<category\> after install (no restart needed)
-- ⚠️ Installed Lua script execution via `fusion.RunScript(path)` can return
-  `False` from the Python bridge even when install/read/list/remove work. Use
-  `run_inline(language="lua")` when captured output or return values matter.
-- ✅ Python scripts execute via subprocess with full stdout/stderr capture
-- ✅ `run_inline` Lua: stdout captured (with tabs), return value captured, errors trapped with line numbers
-- ✅ `run_inline` Python: full Resolve API access, project + media-pool + timeline pre-bound
 - ✅ Both engines (Lua and Python) compile without errors
 - ✅ DSL coverage tests confirm every documented source/action/target/transform/strategy is present in both engines
 
-## Implementation notes (for maintainers)
-
-Two non-obvious behaviors of Resolve's Lua bridge surfaced during live
-testing and are encoded in the implementation:
-
-1. **`fusion.Execute(luaSource)` is a no-op** when called from the Python
-   `DaVinciResolveScript` bridge in Resolve 20.x. It returns `None` and has
-   no observable side effects. Don't use it. Use `fusion.RunScript(filepath)`
-   against a temp file instead.
+## Resolve's Lua bridge — reference
 
-2. **`fusion.RunScript()` is asynchronous.** It returns before the script
-   finishes. Reading `fusion.GetData()` immediately gives stale values. The
-   implementation polls a completion-sentinel slot (`__mcp_done__`) until
-   the wrapped Lua sets it to `"1"`, then reads results.
+Two measured facts about Resolve itself, found while building the now-removed
+`run_inline`, stay true of Resolve and are kept here for reference:
 
-These constraints are unique to the Lua side; Python's subprocess approach
-is straightforwardly synchronous.
+1. **`fusion.Execute(luaSource)` is a no-op** from the Python
+   `DaVinciResolveScript` bridge in Resolve 20.x: it returns `None` with no
+   observable side effects.
+2. **`fusion.RunScript(filepath)` is asynchronous**: it returns before the
+   script finishes, so an immediate `fusion.GetData()` reads stale values.
 
 ## Source media integrity
 

package/docs/kernels/extension-authoring-kernel.md

@@ -33,7 +33,7 @@ All kernel actions are exposed through `script_plugin`.
 | `extension_capabilities` | Report Fuse, DCTL, script paths, template kinds, MCP markers, lifecycle rules, and safety guards. |
 | `probe_fuse_lifecycle` | Generate, validate, optionally install/read/list/remove a Fuse template. |
 | `probe_dctl_lifecycle` | Generate, validate, optionally install/read/list/remove a LUT or ACES DCTL template. |
-| `probe_script_lifecycle` | Generate, validate, optionally install/read/list/execute/remove a Resolve-page script. |
+| `probe_script_lifecycle` | Generate, validate, optionally install/read/list/remove a Resolve-page script. Refuses `execute` (removed in v3.0.0). |
 | `safe_install_extension` | Install Fuse, DCTL, or script source/templates with `_mcp_` name and marker guards. |
 | `safe_remove_extension` | Remove Fuse, DCTL, or script files only when the file is MCP-marked by default. |
 | `refresh_or_restart_required` | Classify whether an extension needs LUT refresh, menu refresh, UI reload, or Resolve restart. |
@@ -47,8 +47,6 @@ All kernel actions are exposed through `script_plugin`.
 | Regular DCTL | LUT directory | `project_settings.refresh_luts` picks it up. | Not required for LUT-category DCTLs. |
 | ACES IDT/ODT DCTL | ACES Transforms IDT/ODT | Not picked up by LUT refresh. | Required. |
 | Resolve-page script | Fusion/Scripts category directory | Workspace Scripts menu refreshes when opened. | Not required. |
-| Inline Python script | Temp file subprocess | Captured synchronously. | Not required. |
-| Inline Lua script | Temp Lua file via `fusion.RunScript` | Captured through Fusion app data bridge. | Not required. |
 
 ## Supported Findings
 
@@ -59,20 +57,17 @@ All kernel actions are exposed through `script_plugin`.
 - ACES IDT DCTL template generation, install into `ACES Transforms/IDT/MCP`,
   read, list, and safe remove worked. It remains restart-required before Resolve
   can use the transform.
-- Python Resolve-page script template generation, install, read, list, execute,
-  stdout/stderr capture, and safe remove worked.
-- `script_plugin.run_inline` worked for Python with stdout capture.
-- `script_plugin.run_inline` worked for Lua with stdout and return-value capture.
+- Python Resolve-page script template generation, install, read, list, and safe
+  remove worked.
 - The template matrix generated and validated every Fuse, DCTL, and script
   template kind.
 - Safe install rejected unmarked provided source by default.
 
 ## Boundaries
 
-- Installed Lua script execution through `fusion.RunScript(path)` returned
-  `success=False` in the release probe, even though install/read/list/remove
-  worked and inline Lua execution worked. Use `run_inline(language="lua")` when
-  captured output/return values matter.
+- **No script execution.** `run_inline` and `execute` were removed in v3.0.0:
+  the server does not execute caller-supplied code, and the probes no longer run
+  scripts. Installed scripts are run by the user from Workspace → Scripts.
 - New Fuses still require a Resolve restart to appear as registered Fusion
   tools. The MCP can install/remove files but cannot force Fusion to register a
   new Fuse in-process.
@@ -93,8 +88,8 @@ python3.11 tests/live_extension_authoring_validation.py --output-dir /tmp/extens
 ```
 
 The harness creates a disposable `_mcp_` project, installs and removes a
-generated Fuse, regular DCTL, ACES DCTL, Python script, and Lua script, probes
-inline Python/Lua execution, writes JSON and Markdown reports, deletes the
+generated Fuse, regular DCTL, ACES DCTL, Python script, and Lua script, writes
+JSON and Markdown reports, deletes the
 project, and removes its temp work directory.
 
 Use `--keep-open` only when you intentionally want to inspect the disposable

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.224.2"
+VERSION = "3.0.0"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.224.2",
+  "version": "3.0.0",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -87,7 +87,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.224.2"
+VERSION = "3.0.0"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "2.224.2"
+VERSION = "3.0.0"
 
 import base64
 import os
@@ -411,8 +411,8 @@ Editorial improvements + versioning (C6 — always on for destructive timeline o
 - Read-only inspection (list, get_current, get_property, etc.) bypasses versioning entirely — no setup needed.
 - Inspect history via `timeline_versioning(action="get_history", timeline_name=…)`, `list_versions`, `diff_versions(from_version, to_version)`, or `list_runs`. Roll back via `timeline_versioning(action="rollback", timeline_name=…, version=…)`.
 
-For one-off scripting:
-- Prefer script_plugin(action="run_inline") over arbitrary persistent code changes. Use it to inspect Resolve state, then move durable behavior into guarded compound actions when it proves valuable.
+For one-off queries:
+- Do not reach for scripts to inspect or change Resolve state: this server does not execute caller-supplied code (script_plugin execution was removed in v3.0.0). Use the typed tools, and move durable behavior into guarded compound actions.
 """
 
 
@@ -30871,6 +30871,7 @@ def _validate_glsl_minimal(source: str) -> Dict[str, Any]:
 
 @mcp.tool()
 @_guard_missing_params
+@_destructive_op("fuse_plugin")
 def fuse_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """Author and install Fusion Fuse plugins (.fuse files).
 
@@ -31413,244 +31414,6 @@ def _validate_script_source(source: str, language: str) -> Dict[str, Any]:
     return _validate_lua_syntax(source)
 
 
-# ─── Script execution ─────────────────────────────────────────────────────────
-
-def _python_env_for_resolve() -> Dict[str, str]:
-    """Build env vars so a Python subprocess can import DaVinciResolveScript."""
-    env = os.environ.copy()
-    env["RESOLVE_SCRIPT_API"] = RESOLVE_API_PATH
-    env["RESOLVE_SCRIPT_LIB"] = RESOLVE_LIB_PATH
-    # The child writes its stdout into a pipe, so Python picks the locale
-    # codepage rather than the console's — cp1252 on a default Windows install.
-    # A script that prints a non-Latin-1 character then dies with
-    # UnicodeEncodeError instead of returning its output, and the failure is
-    # attributed to the script rather than to the pipe it was handed (#153).
-    env["PYTHONIOENCODING"] = "utf-8"
-    pp = env.get("PYTHONPATH", "")
-    if RESOLVE_MODULES_PATH not in pp:
-        env["PYTHONPATH"] = (RESOLVE_MODULES_PATH +
-                             (os.pathsep + pp if pp else ""))
-    return env
-
-
-# fusionscript's RemoteApp thread keeps dispatching packets from Resolve while
-# the interpreter tears down at exit, and can SIGSEGV *after* the script has
-# finished — turning a successful run into exit code -11 / success:false.
-# Run the script via runpy and hard-exit before teardown so the exit code is
-# truthful. SystemExit must be caught here: uncaught, a plain sys.exit(0) at
-# the end of a script would take the normal teardown path and reopen the
-# segfault window. sys.path[0] is pointed at the script's directory to mimic
-# `python script.py` (under -c it points at the server's cwd, which both
-# breaks sibling imports and lets stray files there shadow real modules).
-# Cost of os._exit: atexit handlers never run and non-daemon threads are not
-# joined — documented in script_plugin's execute action.
-_PY_SCRIPT_EXIT_GUARD = (
-    "import os, runpy, sys, traceback\n"
-    "sys.argv = sys.argv[1:]\n"
-    "sys.path[0] = os.path.dirname(os.path.abspath(sys.argv[0]))\n"
-    "code = 0\n"
-    "try:\n"
-    "    runpy.run_path(sys.argv[0], run_name='__main__')\n"
-    "except SystemExit as e:\n"
-    "    if isinstance(e.code, int):\n"
-    "        code = e.code\n"
-    "    elif e.code is not None:\n"
-    "        print(e.code, file=sys.stderr)\n"
-    "        code = 1\n"
-    "except BaseException:\n"
-    "    traceback.print_exc()\n"
-    "    code = 1\n"
-    "sys.stdout.flush()\n"
-    "sys.stderr.flush()\n"
-    "os._exit(code)\n"
-)
-
-
-def _execute_python_script(path: str, args: List[str],
-                            timeout: int) -> Dict[str, Any]:
-    # Ensure Resolve is running so the script can connect.
-    get_resolve()
-    cmd = [sys.executable, "-c", _PY_SCRIPT_EXIT_GUARD, path] + [str(a) for a in args]
-    try:
-        result = safe_run(cmd, env=_python_env_for_resolve(),
-                          capture_output=True, text=True, encoding="utf-8",
-                          errors="replace", timeout=timeout)
-    except subprocess.TimeoutExpired as e:
-        return _err(f"Script timed out after {timeout}s. "
-                    f"Partial stdout: {(e.stdout or '')[:1000]}")
-    except OSError as e:
-        return _err(f"Failed to launch Python subprocess: {e}")
-    return {
-        "success": result.returncode == 0,
-        "stdout": result.stdout,
-        "stderr": result.stderr,
-        "exit_code": result.returncode,
-        "language": "py",
-    }
-
-
-def _execute_lua_script(path: str) -> Dict[str, Any]:
-    r = get_resolve()
-    if r is None:
-        return _not_connected_error()
-    fusion = r.Fusion()
-    if fusion is None:
-        return _err("handle.Fusion() returned None — cannot run Lua scripts.")
-    try:
-        success = bool(fusion.RunScript(path))
-    except Exception as e:
-        return _err(f"Lua RunScript failed: {e}")
-    return {
-        "success": success,
-        "language": "lua",
-        "output_note": ("Lua print() output goes to Resolve's "
-                        "Workspace → Console → Lua tab. The MCP cannot capture "
-                        "Lua stdout. Use the Console to see what the script printed."),
-    }
-
-
-def _run_inline_python(source: str, timeout: int) -> Dict[str, Any]:
-    """Write source to a temp file, run it, return captured output.
-
-    Prepends a boilerplate header that connects to Resolve and exposes
-    `resolve`, `project`, `mp`, `timeline` as globals — same shape as the
-    scaffold template, so inline snippets feel like a REPL.
-    """
-    boilerplate = (
-        "import sys\n"
-        "import DaVinciResolveScript as dvr_script\n"
-        "resolve = dvr_script.scriptapp('Resolve')\n"
-        "project = (resolve.GetProjectManager().GetCurrentProject()\n"
-        "           if resolve else None)\n"
-        "mp = project.GetMediaPool() if project else None\n"
-        "timeline = project.GetCurrentTimeline() if project else None\n"
-        "\n"
-    )
-    with tempfile.NamedTemporaryFile(mode='w', suffix='.py',
-                                      delete=False, encoding='utf-8') as f:
-        f.write(boilerplate)
-        f.write(source)
-        tmp = f.name
-    try:
-        return _execute_python_script(tmp, [], timeout)
-    finally:
-        try:
-            os.unlink(tmp)
-        except OSError:
-            pass
-
-
-def _run_inline_lua(source: str) -> Dict[str, Any]:
-    """Run a Lua snippet inside Resolve's Fusion engine.
-
-    Implementation note: Fusion's `Execute()` is effectively a no-op from the
-    Python bridge in Resolve 20.x — it runs without propagating return values
-    or side effects observable from Python. `RunScript()` against a file path
-    DOES work and gives the script full access to the standard Lua context
-    (`fu`, `fusion`, `app`, `bmd`, `io`, `os`, ...). We bridge results back
-    via `app:SetData(key, value)` which IS visible from Python's
-    `fusion.GetData(key)`.
-
-    The wrapper captures `print()` output into a string and stores stdout,
-    return value, and any pcall error in three Fusion-app SetData slots that
-    the Python side reads after RunScript returns.
-    """
-    r = get_resolve()
-    if r is None:
-        return _not_connected_error()
-    fusion = r.Fusion()
-    if fusion is None:
-        return _err("handle.Fusion() returned None — cannot run inline Lua.")
-
-    wrapped = (
-        'local _mcp_stdout = {}\n'
-        'local _mcp_orig_print = print\n'
-        'print = function(...)\n'
-        '    local args = {...}\n'
-        '    local parts = {}\n'
-        '    for i, v in ipairs(args) do parts[i] = tostring(v) end\n'
-        '    table.insert(_mcp_stdout, table.concat(parts, "\\t"))\n'
-        'end\n'
-        'local _mcp_ok, _mcp_result = pcall(function()\n'
-        + source + '\n'
-        'end)\n'
-        'print = _mcp_orig_print\n'
-        'local _mcp_app = fu or fusion or app\n'
-        'if _mcp_app then\n'
-        '    _mcp_app:SetData("__mcp_stdout__", table.concat(_mcp_stdout, "\\n"))\n'
-        '    if _mcp_ok then\n'
-        '        _mcp_app:SetData("__mcp_result__",\n'
-        '            _mcp_result ~= nil and tostring(_mcp_result) or "")\n'
-        '        _mcp_app:SetData("__mcp_error__", "")\n'
-        '    else\n'
-        '        _mcp_app:SetData("__mcp_result__", "")\n'
-        '        _mcp_app:SetData("__mcp_error__", tostring(_mcp_result))\n'
-        '    end\n'
-        '    _mcp_app:SetData("__mcp_done__", "1")\n'  # completion sentinel
-        'end\n'
-    )
-
-    # Clear prior slots so we can detect if RunScript silently did nothing.
-    # SetData goes through the Lua bridge and returns nil whether or not it
-    # took, so the return is not evidence -- but GetData is. The __mcp_done__
-    # slot is the one that matters: a stale "1" left by the previous run makes
-    # the poll below exit immediately and return the PREVIOUS run's stdout,
-    # result and error as this run's.
-    for slot in ("__mcp_done__", "__mcp_stdout__", "__mcp_result__", "__mcp_error__"):
-        fusion.SetData(slot, "")
-    stale = fusion.GetData("__mcp_done__")
-    if stale not in ("", None):
-        return _err(
-            "Could not clear the Fusion completion sentinel before running.",
-            code="FUSION_SENTINEL_NOT_CLEARED", category="api_error", retryable=True,
-            reason=f"__mcp_done__ still reads {stale!r} after SetData. The poll would "
-                   "exit immediately and hand back the previous run's output as this "
-                   "run's.",
-            remediation="Retry; if it persists, restart Resolve to clear the Fusion "
-                        "app's data slots.",
-        )
-
-    with tempfile.NamedTemporaryFile(mode='w', suffix='.lua',
-                                      prefix='mcp-lua-inline-',
-                                      delete=False, encoding='utf-8') as tf:
-        tf.write(wrapped)
-        tmp = tf.name
-
-    try:
-        try:
-            fusion.RunScript(tmp)
-        except Exception as e:
-            return _err(f"Lua RunScript failed: {e}")
-
-        # RunScript is async — poll the completion sentinel until set.
-        deadline = time.time() + 60
-        while fusion.GetData("__mcp_done__") != "1":
-            if time.time() > deadline:
-                return _err("Lua run_inline timed out after 60s waiting for "
-                            "the script to complete.")
-            time.sleep(0.1)
-    finally:
-        try:
-            os.unlink(tmp)
-        except OSError:
-            pass
-
-    stdout = fusion.GetData("__mcp_stdout__") or ""
-    result = fusion.GetData("__mcp_result__") or ""
-    error = fusion.GetData("__mcp_error__") or ""
-
-    response: Dict[str, Any] = {
-        "success": not error,
-        "stdout": stdout + ("\n" if stdout and not stdout.endswith("\n") else ""),
-        "language": "lua",
-    }
-    if result:
-        response["result"] = result
-    if error:
-        response["error"] = error
-    return response
-
-
 _EXTENSION_KERNEL_ACTIONS = [
     "extension_capabilities",
     "probe_fuse_lifecycle",
@@ -31989,7 +31752,7 @@ def _probe_fuse_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
     if p.get("include_template_matrix"):
         out["template_matrix"] = _extension_template_matrix()["fuse"]
     if p.get("install"):
-        install = _safe_install_extension({
+        install = script_plugin("safe_install_extension", {
             "extension_type": "fuse",
             "name": name,
             "source": source,
@@ -31999,7 +31762,7 @@ def _probe_fuse_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
         out["read"] = fuse_plugin("read", {"name": name}) if install.get("success") else None
         out["list"] = fuse_plugin("list")
         if p.get("cleanup", True):
-            out["remove"] = _safe_remove_extension({"extension_type": "fuse", "name": name})
+            out["remove"] = script_plugin("safe_remove_extension", {"extension_type": "fuse", "name": name})
     return out
 
 
@@ -32026,7 +31789,7 @@ def _probe_dctl_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
     if p.get("include_template_matrix"):
         out["template_matrix"] = _extension_template_matrix()["dctl"]
     if p.get("install"):
-        install = _safe_install_extension({
+        install = script_plugin("safe_install_extension", {
             "extension_type": "dctl",
             "name": name,
             "source": source,
@@ -32040,11 +31803,19 @@ def _probe_dctl_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
         if p.get("refresh_luts") and category == "lut":
             out["refresh_luts"] = project_settings("refresh_luts")
         if p.get("cleanup", True):
-            out["remove"] = _safe_remove_extension({"extension_type": "dctl", "name": name, "category": category, "subdir": subdir})
+            out["remove"] = script_plugin("safe_remove_extension", {"extension_type": "dctl", "name": name, "category": category, "subdir": subdir})
     return out
 
 
 def _probe_script_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
+    if p.get("execute"):
+        # Refused rather than ignored: silently skipping it would report a
+        # lifecycle probe as complete for a step it never ran.
+        return _err(
+            "probe_script_lifecycle no longer executes scripts: script execution was "
+            "removed in v3.0.0. Drop `execute`; the probe still generates, validates, "
+            "installs, reads, lists and removes."
+        )
     name = p.get("name", "_mcp_script_lifecycle_probe")
     kind = p.get("kind", "scaffold")
     language = _normalize_script_language(p.get("language", "py"))
@@ -32070,7 +31841,7 @@ def _probe_script_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
     if p.get("include_template_matrix"):
         out["template_matrix"] = _extension_template_matrix()["script"]
     if p.get("install"):
-        install = _safe_install_extension({
+        install = script_plugin("safe_install_extension", {
             "extension_type": "script",
             "name": name,
             "source": source,
@@ -32081,15 +31852,8 @@ def _probe_script_lifecycle(p: Dict[str, Any]) -> Dict[str, Any]:
         out["install"] = install
         out["read"] = script_plugin("read", {"name": name, "category": category, "language": language}) if install.get("success") else None
         out["list"] = script_plugin("list", {"category": category, "language": language})
-        if p.get("execute") and install.get("success"):
-            out["execute"] = script_plugin("execute", {
-                "name": name,
-                "category": category,
-                "language": language,
-                "timeout": p.get("timeout", 120),
-            })
         if p.get("cleanup", True):
-            out["remove"] = _safe_remove_extension({
+            out["remove"] = script_plugin("safe_remove_extension", {
                 "extension_type": "script",
                 "name": name,
                 "category": category,
@@ -32120,8 +31884,19 @@ def _extension_boundary_report(p: Dict[str, Any]) -> Dict[str, Any]:
     }
 
 
+#: Removed in v3.0.0 (maintainer policy: the server does not execute
+#: caller-supplied code). `run_inline` ran a caller's Python as a subprocess on
+#: the host, or Lua inside Resolve's Fusion engine with `os` and `io` in scope;
+#: `execute` ran an installed script. Neither passed any gate. Kept as a named
+#: set so a stale caller gets a migration pointer rather than "unknown action",
+#: and so the action-list drift guard, which reads literal comparisons, does not
+#: count them as live actions.
+_REMOVED_SCRIPT_ACTIONS = frozenset({"execute", "run_inline"})
+
+
 @mcp.tool()
 @_guard_missing_params
+@_destructive_op("script_plugin")
 def script_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """Author and install Resolve-page Lua/Python scripts (Workspace → Scripts menu).
 
@@ -32157,25 +31932,12 @@ def script_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[
         — kind: 'scaffold' | 'media_rules'
         — options: {language: 'lua'|'py', ...kind-specific}
       list_templates() -> {kinds}
-      execute(name, category, language, args?, timeout?) -> {success, stdout?, stderr?, exit_code?}
-        — Python: subprocess with stdout/stderr captured.
-        — Lua: fusion.RunScript(); print() output goes to Resolve Console.
-        — args: list of CLI args for the Python subprocess (Python only).
-        — timeout: seconds (default 120 for execute, 60 for run_inline).
-        — Auto-launches Resolve if not running.
-        — Python scripts hard-exit after the script body (guards against
-          fusionscript's segfault-at-exit race), so atexit handlers do not
-          run and non-daemon threads are not joined. Do cleanup inline or
-          in try/finally, not in atexit.
-      run_inline(source, language, timeout?) -> {success, stdout?, stderr?, result?}
-        — Python: writes to temp file with `resolve`/`project`/`mp`/`timeline`
-          pre-bound, runs as subprocess, captures stdout/stderr.
-        — Lua: fusion.Execute(source); return value comes back as `result`.
-        — Use this for ad-hoc one-shot queries without persisting a file.
+      execute / run_inline — REMOVED in v3.0.0. This server does not execute
+        caller-supplied code; install a script and run it from Workspace > Scripts.
       extension_capabilities() -> {paths, templates, lifecycle, safe_guards}
       probe_fuse_lifecycle(name?, kind?, install?, cleanup?) -> {template, validation, install?, remove?}
       probe_dctl_lifecycle(name?, kind?, category?, install?, refresh_luts?, cleanup?) -> {template, validation, install?, remove?}
-      probe_script_lifecycle(name?, language?, category?, install?, execute?, cleanup?) -> {template, validation, install?, execute?, remove?}
+      probe_script_lifecycle(name?, language?, category?, install?, cleanup?) -> {template, validation, install?, remove?}
       safe_install_extension(extension_type, name, source?|kind?, dry_run?) -> {success}
       safe_remove_extension(extension_type, name, dry_run?) -> {success}
       refresh_or_restart_required(extension_type, category?) -> {refresh_luts, restart_required}
@@ -32377,49 +32139,16 @@ def script_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[
         return {"source": source, "kind": kind, "name": name,
                 "language": language}
 
-    if action == "execute":
-        name = p.get("name", "")
-        invalid = _validate_script_name(name)
-        if invalid:
-            return invalid
-        category = p.get("category")
-        if not category:
-            return _err("execute requires a 'category'.")
-        language = _normalize_script_language(p.get("language", "lua"))
-        invalid = _validate_script_language(language)
-        if invalid:
-            return invalid
-        timeout = int(p.get("timeout", 120))
-        try:
-            target = _script_path(name, category, language)
-        except ValueError as e:
-            return _err(str(e))
-        if not os.path.isfile(target):
-            return _err(f"No script named '{name}{_SCRIPT_LANG_EXT[language]}' "
-                        f"at {target}")
-        if language == "py":
-            args = p.get("args", [])
-            if not isinstance(args, list):
-                return _err("'args' must be a list of strings.")
-            return _execute_python_script(target, args, timeout)
-        return _execute_lua_script(target)
-
-    if action == "run_inline":
-        source = p.get("source")
-        if not isinstance(source, str) or not source.strip():
-            return _err("run_inline requires a non-empty 'source' string.")
-        language = _normalize_script_language(p.get("language", "lua"))
-        invalid = _validate_script_language(language)
-        if invalid:
-            return invalid
-        timeout = int(p.get("timeout", 60))
-        if language == "py":
-            return _run_inline_python(source, timeout)
-        return _run_inline_lua(source)
+    if action in _REMOVED_SCRIPT_ACTIONS:
+        return _err(
+            f"script_plugin.{action} was removed in v3.0.0: this server does not "
+            "execute caller-supplied code. Install the script with `install`, then "
+            "run it yourself from Resolve's Workspace > Scripts menu."
+        )
 
     return _unknown(action, ["path", "categories", "list", "install", "remove",
                              "read", "validate", "template", "list_templates",
-                             "execute", "run_inline", *_EXTENSION_KERNEL_ACTIONS])
+                             *_EXTENSION_KERNEL_ACTIONS])
 
 
 # ═══════════════════════════════════════════════════════════════════════════════

package/src/utils/destructive_hook.py

@@ -63,7 +63,20 @@ SAFE_MODE_BLOCKED_RISK_LEVELS: FrozenSet[str] = frozenset({
 # replace_clip/link_*). The test_destructive_registry_drift guard asserts every
 # string here is a real handler so this can't regress.
 DESTRUCTIVE_ACTIONS_BY_TOOL: Dict[str, FrozenSet[str]] = {
-    "dctl": frozenset({"encrypt_native"}),
+    # Plugin-folder writes. These create, replace and delete files that Resolve
+    # and Fusion later load and run: a Fuse registers on the next restart, a
+    # Resolve-page script runs when clicked. Until they were listed here every
+    # gate treated them as reads, and a dry run of `install` wrote the file for
+    # real. They never mutate the timeline, so NON_TIMELINE_WRITE_TOOLS keeps
+    # them out of timeline archiving while every gate still sees them.
+    "dctl": frozenset({"encrypt_native", "install", "remove"}),
+    "fuse_plugin": frozenset({"install", "remove"}),
+    "script_plugin": frozenset({
+        "install",
+        "remove",
+        "safe_install_extension",
+        "safe_remove_extension",
+    }),
     "media_pool": frozenset({
         "delete_clips",
         "delete_folders",
@@ -235,6 +248,19 @@ NO_ARCHIVE_ON_KEYS: Dict[Tuple[str, str], frozenset] = {
 }
 
 
+# ── Non-timeline write tools ────────────────────────────────────────────────
+#
+# Tools whose registered actions write the filesystem, not the timeline. Every
+# gate applies to them — safe mode, dry-run refusal, the audit log — but they
+# skip version-on-mutate archiving, and skip resolving the versioning context
+# at all: that goes through the project-root provider, which reaches Resolve,
+# and installing a shader must neither snapshot the open timeline nor touch
+# Resolve. `media_pool` has its own branch for the same reason; these differ in
+# that there is no project state to log.
+
+NON_TIMELINE_WRITE_TOOLS: frozenset = frozenset({"dctl", "fuse_plugin", "script_plugin"})
+
+
 # ── Strict-mode allowlist ───────────────────────────────────────────────────
 #
 # Actions in this set REFUSE to run if the version-on-mutate archive fails. For
@@ -299,6 +325,8 @@ NATIVE_DRY_RUN_ACTIONS: frozenset = frozenset({
     ("timeline", "apply_cuts"),
     ("timeline", "ripple_insert"),
     ("timeline_ai", "create_subtitles"),
+    ("script_plugin", "safe_install_extension"),
+    ("script_plugin", "safe_remove_extension"),
 })
 
 
@@ -791,6 +819,31 @@ def destructive_op(tool_name: str) -> Callable[[Callable[..., Any]], Callable[..
                     recognised=risk_recognised,
                 )
 
+            if tool_name in NON_TIMELINE_WRITE_TOOLS:
+                result = fn(action, params, *args, **kwargs)
+                _audit_security_event(
+                    operation_id=operation_id,
+                    tool_name=tool_name,
+                    action=action,
+                    risk_level=risk_level,
+                    status="allowed",
+                    params=params,
+                    reason="not_a_timeline_mutation",
+                    recognised=risk_recognised,
+                )
+                if isinstance(result, dict):
+                    result.setdefault("_versioning", {
+                        "analysis_run_id": None,
+                        "archived": False,
+                        "skipped_reason": "not_a_timeline_mutation",
+                    })
+                return _annotate_security(
+                    result,
+                    operation_id=operation_id,
+                    risk_level=risk_level,
+                    recognised=risk_recognised,
+                )
+
             # F4 — token-issuance calls don't mutate; skip the archive entirely
             # so that token preview/cancel paths don't litter the version chain.
             # The wrapper still annotates `_versioning` on the result so callers

package/src/utils/execution_lifecycle.py

@@ -132,6 +132,14 @@ class RiskClassificationHook(LifecycleHook):
     }
 
     _HIGH_RISK_ACTIONS: Set[Tuple[str, str]] = {
+        # Plugin-folder deletes. A bare `remove` misses the `remove_` prefix
+        # rule below, so these were unrecognised and every gate read them as
+        # reads. `safe_remove_extension` unlinks directly rather than through
+        # the per-tool `remove`, so it needs its own entry.
+        ("dctl", "remove"),
+        ("fuse_plugin", "remove"),
+        ("script_plugin", "remove"),
+        ("script_plugin", "safe_remove_extension"),
         ("timeline", "delete_clips"),
         ("timeline", "delete_clip_by_id"),
         ("timeline", "delete_markers"),
@@ -248,6 +256,14 @@ class RiskClassificationHook(LifecycleHook):
     #: MEDIUM was overwhelmingly the `else` fallthrough, which made an assessed
     #: MEDIUM and an unrated action indistinguishable by level alone.
     _MEDIUM_RISK_ACTIONS: Set[Tuple[str, str]] = {
+        # Plugin-folder installs: a new file, or a replaced one with
+        # overwrite=true, that Resolve or Fusion will later load and run.
+        # MEDIUM, not HIGH: audited and dry-run-honest, but not blocked by
+        # safe mode, in line with the other create-style writes.
+        ("dctl", "install"),
+        ("fuse_plugin", "install"),
+        ("script_plugin", "install"),
+        ("script_plugin", "safe_install_extension"),
         # Additive edits that place content into an existing timeline. Nothing
         # is deleted (`overwrite_range`, which does delete, is HIGH), but the
         # timeline is no longer what it was.

package/src/utils/extension_authoring_live_probe.py

@@ -191,7 +191,6 @@ def run_probe(server, output_dir: Path, keep_open: bool = False) -> Dict[str, An
             "language": "py",
             "category": "Utility",
             "install": True,
-            "execute": True,
             "cleanup": True,
             "overwrite": True,
             "timeout": 120,
@@ -199,9 +198,9 @@ def run_probe(server, output_dir: Path, keep_open: bool = False) -> Dict[str, An
         _record_nested_success(
             recorder,
             "script",
-            "probe_script_python_lifecycle_install_execute_remove",
+            "probe_script_python_lifecycle_install_remove",
             script_py_probe,
-            ["install", "read", "list", "execute", "remove"],
+            ["install", "read", "list", "remove"],
         )
 
         script_lua_probe = server.script_plugin("probe_script_lifecycle", {
@@ -210,7 +209,6 @@ def run_probe(server, output_dir: Path, keep_open: bool = False) -> Dict[str, An
             "language": "lua",
             "category": "Utility",
             "install": True,
-            "execute": True,
             "cleanup": True,
             "overwrite": True,
             "timeout": 120,
@@ -218,23 +216,11 @@ def run_probe(server, output_dir: Path, keep_open: bool = False) -> Dict[str, An
         _record_nested_success(
             recorder,
             "script",
-            "probe_script_lua_lifecycle_install_execute_remove",
+            "probe_script_lua_lifecycle_install_remove",
             script_lua_probe,
-            ["install", "read", "list", "execute", "remove"],
+            ["install", "read", "list", "remove"],
         )
 
-        _record_tool_result(
-            recorder,
-            "script",
-            "run_inline_python_stdout",
-            server.script_plugin("run_inline", {"language": "py", "source": "print('extension inline py ok')", "timeout": 60}),
-        )
-        _record_tool_result(
-            recorder,
-            "script",
-            "run_inline_lua_stdout_result",
-            server.script_plugin("run_inline", {"language": "lua", "source": "print('extension inline lua ok')\nreturn 'lua-result'", "timeout": 60}),
-        )
         _record_tool_result(
             recorder,
             "guards",