davinci-resolve-mcp 2.54.0 → 2.54.2

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.54.2
+
+A destructive-overwrite bug in the installer (issue #71): the MCP client setup
+step could wipe a user's entire editor settings file instead of merging into it.
+
+- **Fixed** `install.py` silently destroyed existing client config files whose
+  contents weren't strict JSON. `read_json` swallowed `JSONDecodeError` and
+  returned `{}`, so the subsequent "merge" wrote a file containing *only* the
+  `davinci-resolve` server entry — wiping themes, terminal env vars, LSP
+  settings, keybindings, everything else. Zed was the reported victim because
+  its `settings.json` ships with `//` comments (JSONC), but the same latent
+  risk existed for **every** supported client — VS Code and Continue also accept
+  JSONC. The fix is centralized in the single read/merge path so all clients are
+  covered:
+  - `read_json` now best-effort strips JSONC `//` and `/* */` comments and
+    trailing commas (string-aware, so comment markers inside string values are
+    preserved), letting commented configs merge cleanly instead of being lost.
+  - When a config file exists but still can't be parsed after that, the
+    installer **refuses to overwrite it** and tells the user to add the entry
+    manually — rather than silently replacing their settings.
+- **Added** regression tests covering JSONC merge, plain-JSON merge,
+  refuse-to-overwrite on unparseable files, fresh-file creation, and
+  string-aware comment stripping.
+
+## What's New in v2.54.1
+
+One more instance of the enum-keyed silent-failure class (issue #70), plus a
+guard so the next one can't ship unnoticed.
+
+- **Fixed** the raw `timeline.export` action passed `type`/`subtype` straight to
+  `Timeline.Export`, which needs resolved `resolve.EXPORT_*` enum *values* — a
+  JSON/MCP caller can't pass a live enum, so the action silently wrote nothing
+  for every caller. It now resolves friendly format names (and `EXPORT_*`
+  constant names) via the same `_timeline_export_spec` resolver that
+  `export_timeline_checked` uses, and reports the resolved `export_type`/
+  `export_subtype`.
+- **Fixed** `export_timeline_checked` resolved enum constants against the module
+  global `resolve` (which can be `None` and silently degrade the `EXPORT_*` args
+  to strings); it now uses `get_resolve()`, matching the issue-#70 lesson.
+- **Added** an `api_truth` ↔ mitigation guard test: every `enum`-tagged catalog
+  entry must declare a `mitigation` (the resolver/wrapper functions), each of
+  which must exist in `src.server`. The next raw enum passthrough — a documented
+  symbol with no real resolver, or a renamed/removed resolver — now fails CI.
+  Added a `Timeline.Export` catalog entry and wired `mitigation` onto the
+  `AutoSyncAudio`, `CreateSubtitlesFromAudio`, and CloudProject entries.
+
 ## What's New in v2.54.0
 
 Hardens the rest of the enum-keyed settings APIs against the same silent-failure

package/README.md

@@ -1,6 +1,6 @@
 # DaVinci Resolve MCP Server
 
-[![Version](https://img.shields.io/badge/version-2.54.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.54.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-34%20(341%20full)-blue.svg)](#server-modes)

package/install.py

@@ -17,6 +17,7 @@ import argparse
 import json
 import os
 import platform
+import re
 import shutil
 import subprocess
 import sys
@@ -35,7 +36,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.54.0"
+VERSION = "2.54.2"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds
@@ -458,14 +459,91 @@ def build_zed_entry(python_path, server_path, api_path, lib_path, system=SYSTEM,
 
 # ─── Config File Operations ──────────────────────────────────────────────────
 
+class ConfigParseError(Exception):
+    """Existing config file has content but could not be parsed.
+
+    Callers must NOT overwrite such a file -- doing so destroys the user's
+    settings (issue #71).
+    """
+
+
+def _strip_jsonc(text):
+    """Best-effort strip of // and /* */ comments and trailing commas.
+
+    Zed's ``settings.json`` (and several other clients) accept JSON-with-comments.
+    Python's ``json`` module rejects those, so we strip them before parsing.
+    The walk is string-aware, so a ``//`` or ``/*`` sequence inside a JSON
+    string value is preserved.
+    """
+    out = []
+    i = 0
+    n = len(text)
+    in_string = False
+    escape = False
+    while i < n:
+        ch = text[i]
+        if in_string:
+            out.append(ch)
+            if escape:
+                escape = False
+            elif ch == "\\":
+                escape = True
+            elif ch == '"':
+                in_string = False
+            i += 1
+            continue
+        if ch == '"':
+            in_string = True
+            out.append(ch)
+            i += 1
+            continue
+        if ch == "/" and i + 1 < n and text[i + 1] == "/":
+            i += 2
+            while i < n and text[i] not in "\r\n":
+                i += 1
+            continue
+        if ch == "/" and i + 1 < n and text[i + 1] == "*":
+            i += 2
+            while i + 1 < n and not (text[i] == "*" and text[i + 1] == "/"):
+                i += 1
+            i += 2
+            continue
+        out.append(ch)
+        i += 1
+    stripped = "".join(out)
+    # Drop trailing commas before a closing brace/bracket.
+    stripped = re.sub(r",(\s*[}\]])", r"\1", stripped)
+    return stripped
+
+
 def read_json(path):
-    """Read a JSON file, return empty dict if missing or invalid."""
+    """Read a JSON/JSONC config file.
+
+    Returns an empty dict when the file is absent or empty (safe to create).
+    Raises :class:`ConfigParseError` when the file has content that cannot be
+    parsed even after stripping JSONC comments and trailing commas -- callers
+    must refuse to overwrite such a file, or they would wipe the user's
+    existing settings (issue #71: Zed's settings.json ships with comments).
+    """
     try:
         with open(path, "r") as f:
-            return json.load(f)
-    except (FileNotFoundError, json.JSONDecodeError):
+            raw = f.read()
+    except FileNotFoundError:
         return {}
 
+    if not raw.strip():
+        return {}
+
+    try:
+        return json.loads(raw)
+    except json.JSONDecodeError:
+        pass
+
+    try:
+        return json.loads(_strip_jsonc(raw))
+    except json.JSONDecodeError as exc:
+        raise ConfigParseError(str(exc)) from exc
+
 
 def write_json(path, data):
     """Write JSON to file, creating parent directories."""
@@ -501,8 +579,18 @@ def write_client_config(client, python_path, server_path, api_path, lib_path, dr
         preview = {config_key: {"davinci-resolve": server_entry}}
         return True, f"Would write to {config_path}:\n{json.dumps(preview, indent=2)}"
 
-    # Read existing config and merge
-    existing = read_json(config_path)
+    # Read existing config and merge. If the file exists but cannot be parsed,
+    # refuse to overwrite it -- silently replacing it would wipe the user's
+    # settings (issue #71, especially Zed's commented settings.json).
+    try:
+        existing = read_json(config_path)
+    except ConfigParseError as exc:
+        return False, (
+            f"{config_path} exists but could not be parsed ({exc}). "
+            f"Refusing to overwrite to avoid data loss. Add the "
+            f'"{config_key}" entry manually using the manual config output '
+            f"(run with --manual)."
+        )
 
     if config_key not in existing:
         existing[config_key] = {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.54.0",
+  "version": "2.54.2",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -80,7 +80,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.54.0"
+VERSION = "2.54.2"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 341-tool granular server instead
 """
 
-VERSION = "2.54.0"
+VERSION = "2.54.2"
 
 import base64
 import os
@@ -5042,7 +5042,10 @@ def _export_timeline_checked(tl, p: Dict[str, Any]):
     folder = os.path.dirname(os.path.abspath(path))
     if folder:
         os.makedirs(folder, exist_ok=True)
-    spec = _timeline_export_spec(p, resolve)
+    # Resolve enum constants via get_resolve(), not the module global `resolve`
+    # (which can be None and silently degrade the EXPORT_* args to strings — the
+    # same failure class as issue #70).
+    spec = _timeline_export_spec(p, get_resolve())
     if p.get("dry_run"):
         return _ok(path=path, would_export=True, spec={k: v for k, v in spec.items() if k != "export_type"})
     with long_resolve_op("timeline.export_timeline_checked"):
@@ -17851,8 +17854,18 @@ def timeline(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str,
     elif action == "import_into_timeline":
         return {"success": bool(tl.ImportIntoTimeline(p["path"], p.get("options", {})))}
     elif action == "export":
+        # Timeline.Export needs resolved resolve.EXPORT_* enum *values*, which a
+        # JSON/MCP caller cannot pass — handing it a string silently fails. Resolve
+        # friendly type/subtype names (or EXPORT_* constant names) the same way
+        # export_timeline_checked does. This raw action keeps no path sandbox.
+        spec = _timeline_export_spec(p, get_resolve())
         with long_resolve_op("timeline.export"):
-            return {"success": bool(tl.Export(p["path"], p["type"], p.get("subtype", "")))}
+            success = bool(tl.Export(p["path"], spec["export_type"], spec["export_subtype"]))
+        return {
+            "success": success,
+            "export_type": spec["export_type_name"],
+            "export_subtype": spec["export_subtype_name"],
+        }
     elif action == "get_setting":
         return {"settings": _ser(tl.GetSetting(p.get("name", "")))}
     elif action == "set_setting":

package/src/utils/api_truth.py

@@ -28,6 +28,7 @@ API_TRUTH: List[Dict[str, Any]] = [
                        "resolve handle, and verify by reading each clip's "
                        "'Synced Audio' property (see verify_by_readback).",
         "tags": ["unreliable-return", "silent-failure", "audio", "enum"],
+        "mitigation": ["_normalize_auto_sync_settings", "_safe_auto_sync_audio"],
     },
     {
         "symbol": "Timeline.CreateSubtitlesFromAudio",
@@ -43,6 +44,7 @@ API_TRUTH: List[Dict[str, Any]] = [
                        "and verify by reading the timeline's subtitle track count "
                        "before/after (server._safe_create_subtitles).",
         "tags": ["unreliable-return", "silent-failure", "subtitle", "enum"],
+        "mitigation": ["_normalize_auto_caption_settings", "_safe_create_subtitles"],
     },
     {
         "symbol": "ProjectManager CloudProject family (Create/Load/Import/RestoreCloudProject)",
@@ -57,6 +59,23 @@ API_TRUTH: List[Dict[str, Any]] = [
                        "before calling, and treat the bool return from "
                        "Import/RestoreCloudProject as advisory.",
         "tags": ["silent-failure", "project", "cloud", "enum"],
+        "mitigation": ["_normalize_cloud_settings"],
+    },
+    {
+        "symbol": "Timeline.Export",
+        "object": "Timeline",
+        "signature": "(fileName, exportType, exportSubtype) -> bool",
+        "reality": "exportType/exportSubtype must be resolve.EXPORT_* enum *values* "
+                   "resolved from the live handle. A JSON/MCP caller cannot pass a "
+                   "live enum, and a plain string ('fcpxml', or even the constant "
+                   "name 'EXPORT_FCPXML_1_10') is silently rejected with no file "
+                   "written.",
+        "recommended": "Map a friendly format/subtype to the EXPORT_* constant and "
+                       "resolve it against the live handle "
+                       "(server._timeline_export_spec) before calling; verify the "
+                       "output file exists afterward.",
+        "tags": ["silent-failure", "timeline", "export", "enum"],
+        "mitigation": ["_timeline_export_spec", "_timeline_export_value"],
     },
     {
         "symbol": "Composition.Paste",