davinci-resolve-mcp 2.54.3 → 2.54.5

package/CHANGELOG.md

@@ -2,6 +2,58 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v2.54.5
+
+Reliability + security hardening from the exhaustive reliability audit (Wave A).
+
+- **Security** `apply_spec` hooks no longer run with `shell=True`. A spec's hook
+  command is now `shlex`-split and executed without a shell, so a hook string
+  can't inject arbitrary shell (`; rm -rf …`, pipes, expansion). Hooks needing
+  shell features must invoke an interpreter explicitly (e.g. `bash -c "…"`).
+- **Fixed** the confirm-token table (`_CONFIRM_TOKENS`) is now guarded by a lock.
+  The control panel is threaded, so issue/consume/GC ran concurrently; validate-
+  then-pop is now atomic and GC can't race a write.
+- **Fixed** negative item indices are rejected instead of silently returning the
+  wrong item (Python reverse-indexing): `_get_item`, the audio item resolver, and
+  the two timeline-matte helpers now require `0 <= index < len`.
+- **Fixed** history queries clamp `limit` to `[1, 1000]`. SQLite treats a negative
+  `LIMIT` as "no limit", so a negative value could silently fetch the entire table
+  (`get_brain_edit_history`, `list_runs`, `get_media_pool_change_history`).
+  `timeline_versioning` version/limit/keep_n params are now validated (no unhandled
+  `ValueError`; `rollback` rejects negative versions before archiving). `max_files`
+  /`max_seconds` in the relink file search are clamped positive.
+- **Fixed** the server-reachable ffmpeg probes (render, audio, review) now pass
+  `timeout=120` so a hung ffmpeg can't block the server indefinitely.
+
+(Deferred to a live-validated follow-up: confirm-token gating + archiving for
+catastrophic media-pool/take/fusion deletes, and temp-directory lifecycle cleanup.)
+
+## What's New in v2.54.4
+
+Persistence-safety hardening (generalizes issue #71 to the analysis state
+stores). A multi-agent audit found several state files whose **readers** swallow a
+`JSONDecodeError` and reset to an empty default — so a later read-modify-write
+writes back only the new field, silently wiping prior data. Atomic writes don't
+help, because the loss happens at *read* time.
+
+- **Fixed** read-modify-write paths now read strictly and **refuse to overwrite**
+  a corrupt existing file (via a shared `ConfigParseError` + `_read_json_strict`),
+  rather than clobbering it:
+  - media-analysis **preferences** — 5 write paths (set-defaults, timed-marker
+    default, sampling-mode default, AI governance, caps preset)
+  - **update-state** — configure/clear update settings (3 paths), now also written
+    atomically (temp + `os.replace`)
+  - per-clip **corrections** (human edit history — the highest-value store) —
+    update and revert paths
+- **Fixed** non-atomic writes that a crash mid-write could truncate: the bin
+  summary markdown and Fusion `.setting` files now write to a temp file and
+  `os.replace`.
+- **Fixed** a read-modify-write race on `analysis.json` under the threaded control
+  panel: transcript regeneration is now serialized under the existing state lock,
+  so a concurrent regen/batch write can't drop the other's updates.
+- Read-only callers keep their forgiving behavior (they fall back to defaults and
+  never write). New tests in `tests/test_persistence_safety.py`.
+
 ## What's New in v2.54.3
 
 Follow-up to the v2.54.2 config-merge fix (#71): the JSONC sanitizer's

package/README.md

@@ -1,6 +1,6 @@
 # DaVinci Resolve MCP Server
 
-[![Version](https://img.shields.io/badge/version-2.54.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-2.54.5-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-34%20(341%20full)-blue.svg)](#server-modes)

package/install.py

@@ -35,7 +35,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "2.54.3"
+VERSION = "2.54.5"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "2.54.3",
+  "version": "2.54.5",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/analysis_dashboard.py

@@ -15176,14 +15176,20 @@ class Handler(BaseHTTPRequestHandler):
                 self._json({"success": False, "error": "Transcript regeneration is loopback-only."}, HTTPStatus.FORBIDDEN)
                 return
             clip_id = path.split("/")[3]
-            self._json(regenerate_clip_transcript(
-                self.state.project_root,
-                clip_id,
-                with_words=bool(body.get("with_words", True)),
-                backend=body.get("backend") or None,
-                language=body.get("language") or None,
-                model=body.get("model") or None,
-            ))
+            # Serialize the analysis.json read-modify-write: this server is
+            # threaded, so concurrent regenerations (or a regen racing a batch
+            # job's report write) would interleave and the last writer would drop
+            # the other's updates (PS9).
+            with self.state.lock:
+                result = regenerate_clip_transcript(
+                    self.state.project_root,
+                    clip_id,
+                    with_words=bool(body.get("with_words", True)),
+                    backend=body.get("backend") or None,
+                    language=body.get("language") or None,
+                    model=body.get("model") or None,
+                )
+            self._json(result)
             return
         if path.startswith("/api/clips/") and path.endswith("/transcript/corrections"):
             if not _request_is_loopback(self):

package/src/granular/common.py

@@ -80,7 +80,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "2.54.3"
+VERSION = "2.54.5"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/granular/media_pool.py

@@ -574,7 +574,7 @@ def get_timeline_matte_list(item_index: int = 0, track_type: str = "video", trac
     if not tl:
         return {"error": "No current timeline"}
     items = tl.GetItemListInTrack(track_type, track_index)
-    if not items or item_index >= len(items):
+    if not items or item_index < 0 or item_index >= len(items):  # reject negatives (EX5)
         return {"error": f"No item at index {item_index}"}
     mattes = mp.GetTimelineMatteList(items[item_index])
     return {"mattes": mattes if mattes else []}

package/src/granular/media_storage.py

@@ -171,7 +171,7 @@ def add_timeline_mattes_to_media_pool(timeline_item_index: int, matte_paths: Lis
         return {"error": "No current timeline"}
 
     items = timeline.GetItemListInTrack(track_type, track_index)
-    if not items or timeline_item_index >= len(items):
+    if not items or timeline_item_index < 0 or timeline_item_index >= len(items):  # reject negatives (EX5)
         return {"error": f"Timeline item at index {timeline_item_index} not found"}
 
     item = items[timeline_item_index]

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 341-tool granular server instead
 """
 
-VERSION = "2.54.3"
+VERSION = "2.54.5"
 
 import base64
 import os
@@ -1006,6 +1006,10 @@ import uuid as _uuid
 
 
 _CONFIRM_TOKENS: Dict[str, Dict[str, Any]] = {}
+# The control panel runs on a threaded HTTP server, so issue/consume/gc of the
+# token table run on concurrent threads. Guard every access so a GC iteration
+# can't race a write and validate-then-pop stays atomic (EX4).
+_CONFIRM_TOKENS_LOCK = threading.RLock()
 _CONFIRM_TTL_SECONDS = 300
 
 
@@ -1023,11 +1027,13 @@ def _confirm_token_fingerprint(action: str, params: Optional[Dict[str, Any]]) ->
 
 
 def _confirm_token_gc():
-    """Drop expired tokens; called on every issue/validate."""
+    """Drop expired tokens; called on every issue/validate. Caller may already
+    hold _CONFIRM_TOKENS_LOCK (RLock makes re-entry safe)."""
     now = _time.time()
-    expired = [t for t, rec in _CONFIRM_TOKENS.items() if rec.get("expires_at", 0) < now]
-    for t in expired:
-        _CONFIRM_TOKENS.pop(t, None)
+    with _CONFIRM_TOKENS_LOCK:
+        expired = [t for t, rec in _CONFIRM_TOKENS.items() if rec.get("expires_at", 0) < now]
+        for t in expired:
+            _CONFIRM_TOKENS.pop(t, None)
 
 
 def _confirm_token_required() -> bool:
@@ -1045,16 +1051,17 @@ def _confirm_token_required() -> bool:
 
 def _issue_confirm_token(*, action: str, params: Optional[Dict[str, Any]], preview: Dict[str, Any]) -> Dict[str, Any]:
     """Mint a token. Returns the pending_user_decision response shape."""
-    _confirm_token_gc()
     token = _uuid.uuid4().hex
     fp = _confirm_token_fingerprint(action, params)
     expires_at = _time.time() + _CONFIRM_TTL_SECONDS
-    _CONFIRM_TOKENS[token] = {
-        "action": action,
-        "fingerprint": fp,
-        "expires_at": expires_at,
-        "issued_at": _time.time(),
-    }
+    with _CONFIRM_TOKENS_LOCK:
+        _confirm_token_gc()
+        _CONFIRM_TOKENS[token] = {
+            "action": action,
+            "fingerprint": fp,
+            "expires_at": expires_at,
+            "issued_at": _time.time(),
+        }
     body = _err(
         f"This action is destructive. Re-call with confirm_token to proceed.",
         code="CONFIRMATION_REQUIRED",
@@ -1082,8 +1089,9 @@ def _consume_confirm_token(*, action: str, params: Optional[Dict[str, Any]]) ->
     token = (params or {}).get("confirm_token") or (params or {}).get("confirmToken")
     if not token:
         return None  # Caller is expected to call _issue_confirm_token in this case.
-    _confirm_token_gc()
-    rec = _CONFIRM_TOKENS.pop(token, None)  # one-time use
+    with _CONFIRM_TOKENS_LOCK:
+        _confirm_token_gc()
+        rec = _CONFIRM_TOKENS.pop(token, None)  # one-time use, atomic with gc
     if rec is None:
         return _err(
             "confirm_token is invalid, expired, or was issued by a different "
@@ -1855,7 +1863,9 @@ def _get_item(p):
     track_index = p.get("track_index", 1)
     item_index = p.get("item_index", 0)
     items = tl.GetItemListInTrack(track_type, track_index)
-    if not items or item_index >= len(items):
+    # Reject negatives explicitly: Python's reverse-indexing would otherwise
+    # silently return the wrong item for item_index < 0 (EX5).
+    if not items or not isinstance(item_index, int) or item_index < 0 or item_index >= len(items):
         return tl, None, _err(
             f"No item at index {item_index} on {track_type} track {track_index}",
             code="ITEM_INDEX_OUT_OF_RANGE", category="invalid_input",
@@ -5494,8 +5504,10 @@ def _bounded_basename_matches(
     p: Dict[str, Any],
 ) -> Tuple[List[str], Dict[str, Any]]:
     started = time.monotonic()
-    max_seconds = float(p.get("max_seconds", p.get("timeout_seconds", 20)) or 20)
-    max_files = int(p.get("max_files_scanned", p.get("maxFilesScanned", 50000)) or 50000)
+    # Clamp to positive: a negative max_seconds/max_files would trip the
+    # >= guards on the first iteration and silently return no results (EX8).
+    max_seconds = max(0.1, float(p.get("max_seconds", p.get("timeout_seconds", 20)) or 20))
+    max_files = max(1, int(p.get("max_files_scanned", p.get("maxFilesScanned", 50000)) or 50000))
     max_depth_raw = p.get("max_depth", p.get("maxDepth"))
     max_depth = int(max_depth_raw) if max_depth_raw is not None else None
     all_matches = bool(p.get("all_matches", False))
@@ -5704,7 +5716,7 @@ def _audio_item_from_params(tl, p: Dict[str, Any]):
     track_index = int(p.get("track_index", 1))
     item_index = int(p.get("item_index", 0))
     items = tl.GetItemListInTrack(track_type, track_index) or []
-    if item_index >= len(items):
+    if item_index < 0 or item_index >= len(items):  # reject negatives (EX5)
         return None, _err(f"No item at index {item_index} on {track_type} track {track_index}")
     return items[item_index], None
 
@@ -7273,6 +7285,39 @@ def _media_analysis_preferences_path() -> str:
     return os.path.join(project_dir, "logs", "media-analysis-preferences.json")
 
 
+class ConfigParseError(Exception):
+    """A persisted state/config file exists but its contents could not be read.
+
+    Read-modify-write callers MUST refuse to overwrite when this is raised — a
+    transient/corrupt read returning a default, followed by a write, silently
+    wipes the user's prior data. This is the issue-#71 bug class generalized to
+    the analysis state stores (see local gameplan Phase 5 / PS1–PS3).
+    """
+
+
+def _read_json_strict(path: str) -> Dict[str, Any]:
+    """Read JSON for a read-modify-write cycle.
+
+    Returns ``{}`` only when the file is absent or empty (safe to create). Raises
+    :class:`ConfigParseError` when the file exists but cannot be read/parsed, so
+    the caller can refuse to overwrite and avoid clobbering prior contents.
+    """
+    try:
+        with open(path, "r", encoding="utf-8") as handle:
+            raw = handle.read()
+    except FileNotFoundError:
+        return {}
+    except OSError as exc:
+        raise ConfigParseError(f"{path}: {exc}") from exc
+    if not raw.strip():
+        return {}
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ConfigParseError(f"{path}: {exc}") from exc
+    return payload if isinstance(payload, dict) else {}
+
+
 def _read_media_analysis_preferences() -> Dict[str, Any]:
     path = _media_analysis_preferences_path()
     try:
@@ -7283,6 +7328,12 @@ def _read_media_analysis_preferences() -> Dict[str, Any]:
         return {}
 
 
+def _read_media_analysis_preferences_strict() -> Dict[str, Any]:
+    """Strict prefs read for read-modify-write paths — raises ConfigParseError on
+    a corrupt existing file so the caller refuses to overwrite (PS1)."""
+    return _read_json_strict(_media_analysis_preferences_path())
+
+
 def _write_media_analysis_preferences(preferences: Dict[str, Any]) -> None:
     # Atomic replace: a crash mid-write must not truncate the file, because the
     # reader resets to {} on corruption and the next save would then wipe every
@@ -7435,6 +7486,23 @@ def _setup_positive_int(value: Any, default: int, min_value: int = 0, max_value:
     return max(min_value, min(parsed, max_value))
 
 
+def _safe_int(value: Any, default: int, *, minimum: Optional[int] = None, maximum: Optional[int] = None) -> int:
+    """Coerce a tool param to int without throwing; clamp to [minimum, maximum].
+
+    Used by action handlers so a non-numeric or out-of-range numeric param yields
+    a sane value instead of an unhandled ValueError or a SQLite "negative LIMIT =
+    no limit" full-table fetch (EX8)."""
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError):
+        parsed = default
+    if minimum is not None:
+        parsed = max(minimum, parsed)
+    if maximum is not None:
+        parsed = min(parsed, maximum)
+    return parsed
+
+
 def _setup_marker_limit(value: Any, default: int = 12) -> int:
     if isinstance(value, str) and _setup_text_key(value) in {"unlimited", "no_limit", "nolimit", "all"}:
         return 0
@@ -7669,6 +7737,12 @@ def _media_analysis_timed_marker_decision(p: Dict[str, Any]) -> Dict[str, Any]:
 
     if choice in {"default_yes", "default_no"}:
         saved = "yes" if choice == "default_yes" else "no"
+        # Strict re-read before writing: a corrupt prefs file must refuse, not
+        # clobber every saved preference (PS1).
+        try:
+            preferences = _read_media_analysis_preferences_strict()
+        except ConfigParseError as exc:
+            return _err(f"Refusing to save timed-marker default: {exc}. The preferences file exists but is unparseable; fix or delete it to avoid wiping saved settings.")
         preferences["timed_markers_default"] = saved
         preferences["timed_markers_default_updated_at"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
         _write_media_analysis_preferences(preferences)
@@ -7833,6 +7907,10 @@ def _media_analysis_sampling_mode_decision(p: Dict[str, Any]) -> Dict[str, Any]:
         source = "explicit"
         if save_default:
             saved = mode
+            try:
+                preferences = _read_media_analysis_preferences_strict()
+            except ConfigParseError as exc:
+                return _err(f"Refusing to save sampling-mode default: {exc}. The preferences file exists but is unparseable; fix or delete it to avoid wiping saved settings.")
             preferences["sampling_mode_default"] = mode
             preferences["sampling_mode_default_updated_at"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
             _write_media_analysis_preferences(preferences)
@@ -11040,6 +11118,31 @@ def _setup_update_state() -> Dict[str, Any]:
         return {}
 
 
+def _setup_update_state_strict() -> Dict[str, Any]:
+    """Strict update-state read for read-modify-write paths — raises
+    ConfigParseError on a corrupt existing file so the caller refuses to
+    overwrite and wipe saved update prefs (PS2)."""
+    return _read_json_strict(str(update_state_path(project_dir)))
+
+
+def _write_setup_update_state(state: Dict[str, Any]) -> None:
+    """Atomically persist update state (temp + os.replace), so a crash mid-write
+    can't truncate the file that _setup_update_state then resets to {} (PS2)."""
+    path = str(update_state_path(project_dir))
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    tmp_path = f"{path}.tmp-{os.getpid()}-{threading.get_ident()}-{time.time_ns()}"
+    try:
+        with open(tmp_path, "w", encoding="utf-8") as handle:
+            json.dump(state, handle, indent=2, sort_keys=True)
+            handle.write("\n")
+        os.replace(tmp_path, path)
+    finally:
+        try:
+            os.remove(tmp_path)
+        except OSError:
+            pass
+
+
 def _setup_update_env() -> Dict[str, str]:
     env = dict(os.environ)
     state = _setup_update_state()
@@ -11263,7 +11366,13 @@ def _setup_set_media_analysis_defaults(media_defaults: Dict[str, Any], dry_run:
     if not requested:
         return {"changed": False, "recognized": False}
 
-    preferences = _read_media_analysis_preferences()
+    # Strict read: this is a read-modify-write of the prefs file, so a corrupt
+    # existing file must refuse rather than seed the write from {} and wipe every
+    # saved preference (PS1).
+    try:
+        preferences = _read_media_analysis_preferences_strict()
+    except ConfigParseError as exc:
+        return _err(f"Refusing to update media-analysis defaults: {exc}. The preferences file exists but is unparseable; fix or delete it to avoid wiping saved settings.")
     before = _media_analysis_effective_preferences()
     next_preferences = dict(preferences)
     updates: Dict[str, Dict[str, Any]] = {}
@@ -11519,9 +11628,18 @@ def _setup_set_updates_defaults(update_defaults: Dict[str, Any], dry_run: bool)
     if dry_run:
         return {"changed": True, "recognized": True, "updates": updates, "before": before, "dry_run": True}
 
+    # Strict re-read before mutating: a corrupt update-state file must refuse,
+    # not seed the write from {} and wipe saved update prefs (PS2).
+    try:
+        state = _setup_update_state_strict()
+    except ConfigParseError as exc:
+        return _err(f"Refusing to update settings: {exc}. The update-state file exists but is unparseable; fix or delete it to avoid wiping saved update preferences.")
     if "mode" in updates:
         set_update_mode(project_dir, updates["mode"]["after"], env=_setup_update_env())
-        state = _setup_update_state()
+        try:
+            state = _setup_update_state_strict()
+        except ConfigParseError as exc:
+            return _err(f"Refusing to update settings: {exc}. The update-state file became unparseable; fix or delete it to avoid wiping saved update preferences.")
     updated_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
     if "check_interval_hours" in updates:
         state["check_interval_hours"] = updates["check_interval_hours"]["after"]
@@ -11529,9 +11647,7 @@ def _setup_set_updates_defaults(update_defaults: Dict[str, Any], dry_run: bool)
         state["snooze_hours"] = updates["snooze_hours"]["after"]
     if updates:
         state["setup_defaults_updated_at"] = updated_at
-        with open(update_state_path(project_dir), "w", encoding="utf-8") as handle:
-            json.dump(state, handle, indent=2, sort_keys=True)
-            handle.write("\n")
+        _write_setup_update_state(state)
     return {
         "changed": bool(updates),
         "recognized": True,
@@ -11602,26 +11718,28 @@ def _setup_clear_defaults(keys: Any, dry_run: bool) -> Dict[str, Any]:
         result["cleared"].append("updates.mode")
 
     if clear_all or normalized_keys & {"updates.check_interval_hours", "check_interval_hours", "update_interval_hours"}:
-        state = _setup_update_state()
         if dry_run:
             result["update_check_interval_hours"] = {"changed": True, "dry_run": True}
         else:
+            try:
+                state = _setup_update_state_strict()
+            except ConfigParseError as exc:
+                return _err(f"Refusing to clear update interval: {exc}. The update-state file exists but is unparseable; fix or delete it to avoid wiping saved update preferences.")
             state.pop("check_interval_hours", None)
-            with open(update_state_path(project_dir), "w", encoding="utf-8") as handle:
-                json.dump(state, handle, indent=2, sort_keys=True)
-                handle.write("\n")
+            _write_setup_update_state(state)
             result["update_check_interval_hours"] = {"changed": True, "state_path": str(update_state_path(project_dir))}
         result["cleared"].append("updates.check_interval_hours")
 
     if clear_all or normalized_keys & {"updates.snooze_hours", "snooze_hours", "update_snooze_hours"}:
-        state = _setup_update_state()
         if dry_run:
             result["update_snooze_hours"] = {"changed": True, "dry_run": True}
         else:
+            try:
+                state = _setup_update_state_strict()
+            except ConfigParseError as exc:
+                return _err(f"Refusing to clear snooze: {exc}. The update-state file exists but is unparseable; fix or delete it to avoid wiping saved update preferences.")
             state.pop("snooze_hours", None)
-            with open(update_state_path(project_dir), "w", encoding="utf-8") as handle:
-                json.dump(state, handle, indent=2, sort_keys=True)
-                handle.write("\n")
+            _write_setup_update_state(state)
             result["update_snooze_hours"] = {"changed": True, "state_path": str(update_state_path(project_dir))}
         result["cleared"].append("updates.snooze_hours")
 
@@ -11988,7 +12106,7 @@ def _v2_corrections_path_for_clip(project_root: str, clip_dir: Optional[str], cl
     return None
 
 
-def _v2_read_corrections(path: str) -> Dict[str, Any]:
+def _v2_read_corrections(path: str, *, strict: bool = False) -> Dict[str, Any]:
     if not os.path.isfile(path):
         return {"schema_version": "2.0", "current": {}, "changelog": []}
     try:
@@ -12001,7 +12119,12 @@ def _v2_read_corrections(path: str) -> Dict[str, Any]:
         data.setdefault("current", {})
         data.setdefault("changelog", [])
         return data
-    except (OSError, json.JSONDecodeError):
+    except (OSError, json.JSONDecodeError) as exc:
+        # strict=True is for read-modify-write callers: an existing-but-corrupt
+        # corrections file must refuse, not reset to empty and then erase the
+        # user's human edit history on the next write (PS3, issue #71 class).
+        if strict:
+            raise ConfigParseError(f"{path}: {exc}") from exc
         return {"schema_version": "2.0", "current": {}, "changelog": []}
 
 
@@ -12049,7 +12172,10 @@ def _v2_update_field(project_root: str, p: Dict[str, Any], *, entity_type: str)
     if not path:
         return _err(f"Could not locate clip directory for clip_id={clip_id} under {project_root}/clips/. Pass clip_dir explicitly if the clip directory is non-standard.")
 
-    data = _v2_read_corrections(path)
+    try:
+        data = _v2_read_corrections(path, strict=True)
+    except ConfigParseError as exc:
+        return _err(f"Refusing to write correction: {exc}. The corrections file exists but is unparseable; fix or remove it to avoid wiping the human edit history.")
     if clip_id and "clip_id" not in data:
         data["clip_id"] = str(clip_id)
 
@@ -12149,7 +12275,10 @@ def _v2_revert_field(project_root: str, p: Dict[str, Any]) -> Dict[str, Any]:
     path = _v2_corrections_path_for_clip(project_root, clip_dir, clip_id)
     if not path or not os.path.isfile(path):
         return _err("No corrections file exists for this clip; nothing to revert.")
-    data = _v2_read_corrections(path)
+    try:
+        data = _v2_read_corrections(path, strict=True)
+    except ConfigParseError as exc:
+        return _err(f"Refusing to revert: {exc}. The corrections file exists but is unparseable; fix or remove it to avoid wiping the human edit history.")
     key = f"{entity_type}:{entity_uuid}:{field_path}"
     if key not in data.get("current", {}):
         return _err(f"No current correction for {key}; nothing to revert.")
@@ -13573,14 +13702,29 @@ class _SpecLiveExecutor:
 
 
 def _make_spec_hook_runner(timeout: float = 120.0):
-    """Return a callable that runs a Hook's shell command (opt-in only)."""
+    """Return a callable that runs a Hook's command (opt-in only).
+
+    The command is split with shlex and run WITHOUT a shell, so a spec's hook
+    string cannot inject arbitrary shell (`; rm -rf …`, pipes, expansion). A
+    hook that needs shell features must invoke an explicit interpreter
+    (e.g. ``bash -c "…"``) as its own argv, making the intent visible (EX1).
+    """
+    import shlex
     import subprocess
 
     def _run(hook) -> bool:
+        try:
+            argv = shlex.split(hook.command or "")
+        except ValueError as exc:
+            logger.warning("spec hook '%s' has an unparseable command: %s", hook.name or hook.command, exc)
+            return False
+        if not argv:
+            logger.warning("spec hook '%s' has an empty command", hook.name or "")
+            return False
         try:
             proc = subprocess.run(
-                hook.command,
-                shell=True,
+                argv,
+                shell=False,
                 timeout=timeout,
                 stdin=subprocess.DEVNULL,
                 capture_output=True,
@@ -15865,7 +16009,7 @@ async def media_analysis(action: str, params: Optional[Dict[str, Any]] = None, c
             _r, _proj, project_root, _name = vctx
             session_only = bool(p.get("session_only", False))
             session_id = _AI_LEDGER_SESSION_ID if session_only else None
-            limit = int(p.get("limit", 50))
+            limit = _safe_int(p.get("limit"), 50, minimum=1, maximum=1000)
             return {
                 "success": True,
                 "session_id": _AI_LEDGER_SESSION_ID,
@@ -15896,7 +16040,10 @@ async def media_analysis(action: str, params: Optional[Dict[str, Any]] = None, c
             return _err(f"unknown tier '{preset}'. Valid: {sorted(_resolve_ai_governance.VALID_TIERS)}")
         if mode and mode not in _AI_GOVERNANCE_MODES:
             return _err(f"unknown mode '{mode}'. Valid: {list(_AI_GOVERNANCE_MODES)}")
-        prefs = _read_media_analysis_preferences()
+        try:
+            prefs = _read_media_analysis_preferences_strict()
+        except ConfigParseError as exc:
+            return _err(f"Refusing to save AI governance: {exc}. The preferences file exists but is unparseable; fix or delete it to avoid wiping saved settings.")
         if preset:
             prefs["resolve_ai_governance_preset"] = preset
         if mode:
@@ -15916,7 +16063,10 @@ async def media_analysis(action: str, params: Optional[Dict[str, Any]] = None, c
         if preset not in _ac.VALID_PRESETS:
             return _err(f"unknown preset '{preset}'. Valid: {sorted(_ac.VALID_PRESETS)}")
         # Update preference file directly (same pattern as set_defaults).
-        prefs = _read_media_analysis_preferences()
+        try:
+            prefs = _read_media_analysis_preferences_strict()
+        except ConfigParseError as exc:
+            return _err(f"Refusing to save caps preset: {exc}. The preferences file exists but is unparseable; fix or delete it to avoid wiping saved settings.")
         prefs["analysis_caps_preset"] = preset
         if isinstance(p.get("overrides"), dict):
             prefs["analysis_caps_overrides"] = p["overrides"]
@@ -16715,7 +16865,7 @@ def timeline_versioning(action: str, params: Optional[Dict[str, Any]] = None) ->
     if action == "list_runs":
         return {
             "success": True,
-            "runs": _analysis_runs.list_runs(project_root, limit=int(p.get("limit", 50))),
+            "runs": _analysis_runs.list_runs(project_root, limit=_safe_int(p.get("limit"), 50, minimum=1, maximum=1000)),
         }
     if action == "archive_current":
         return _timeline_versioning.archive_current_timeline(
@@ -16736,13 +16886,18 @@ def timeline_versioning(action: str, params: Optional[Dict[str, Any]] = None) ->
     if action == "diff_versions":
         if not p.get("timeline_name") or "from_version" not in p or "to_version" not in p:
             return _err("timeline_name, from_version, to_version required")
+        try:
+            from_version = int(p["from_version"])
+            to_version = int(p["to_version"])
+        except (TypeError, ValueError):
+            return _err("from_version and to_version must be integers")
         return {
             "success": True,
             **_timeline_versioning.diff_versions(
                 project_root=project_root,
                 timeline_name=str(p["timeline_name"]),
-                from_version=int(p["from_version"]),
-                to_version=int(p["to_version"]),
+                from_version=from_version,
+                to_version=to_version,
             ),
         }
     if action == "diff_timelines":
@@ -16758,18 +16913,24 @@ def timeline_versioning(action: str, params: Optional[Dict[str, Any]] = None) ->
             project_root=project_root,
             timeline_name=p.get("timeline_name"),
             analysis_run_id=p.get("analysis_run_id"),
-            limit=int(p.get("limit", 50)),
+            limit=_safe_int(p.get("limit"), 50, minimum=1, maximum=1000),
         )
         return {"success": True, "edits": rows}
     if action == "rollback":
         if not p.get("timeline_name") or "version" not in p:
             return _err("timeline_name and version required")
+        try:
+            version = int(p["version"])
+        except (TypeError, ValueError):
+            return _err("version must be an integer")
+        if version < 0:
+            return _err("version must be >= 0")
         return _timeline_versioning.rollback_to_version(
             resolve=resolve_h,
             project=project_h,
             project_root=project_root,
             timeline_name=str(p["timeline_name"]),
-            version=int(p["version"]),
+            version=version,
             analysis_run_id=p.get("analysis_run_id"),
         )
     if action == "prune":
@@ -16780,7 +16941,7 @@ def timeline_versioning(action: str, params: Optional[Dict[str, Any]] = None) ->
             project=project_h,
             project_root=project_root,
             timeline_name=str(p["timeline_name"]),
-            keep_n=int(p.get("keep_n", 10)),
+            keep_n=_safe_int(p.get("keep_n"), 10, minimum=1, maximum=1000),
         )
     if action == "registry":
         return {"success": True, **_brain_edits.read_brain_edits_registry(project_root)}
@@ -16791,7 +16952,7 @@ def timeline_versioning(action: str, params: Optional[Dict[str, Any]] = None) ->
                 project_root=project_root,
                 analysis_run_id=p.get("analysis_run_id"),
                 action=p.get("media_pool_action"),
-                limit=int(p.get("limit", 50)),
+                limit=_safe_int(p.get("limit"), 50, minimum=1, maximum=1000),
             ),
         }
     return _err(f"Unknown action: {action}")

package/src/utils/analysis_memory.py

@@ -358,9 +358,13 @@ def regenerate_bin_summary_from_manifest(
         lines.append("\n")
 
     path = bin_summary_path(project_root)
+    # Atomic write (temp + os.replace): a crash mid-write must not truncate the
+    # bin summary that session_start_context reads at startup (PS4).
+    tmp_path = path + ".tmp"
     try:
-        with open(path, "w", encoding="utf-8") as handle:
+        with open(tmp_path, "w", encoding="utf-8") as handle:
             handle.writelines(lines)
+        os.replace(tmp_path, path)
         return {
             "success": True,
             "path": path,
@@ -376,6 +380,11 @@ def regenerate_bin_summary_from_manifest(
             },
         }
     except OSError as exc:
+        if os.path.isfile(tmp_path):
+            try:
+                os.remove(tmp_path)
+            except OSError:
+                pass
         return {"success": False, "error": f"{type(exc).__name__}: {exc}"}
 
 

package/src/utils/analysis_runs.py

@@ -234,6 +234,11 @@ def get_run(project_root: str, analysis_run_id: str) -> Optional[Dict[str, Any]]
 
 
 def list_runs(project_root: str, *, limit: int = 50) -> List[Dict[str, Any]]:
+    # SQLite treats a negative LIMIT as "no limit"; clamp (EX8).
+    try:
+        limit = max(1, min(1000, int(limit)))
+    except (TypeError, ValueError):
+        limit = 50
     conn = timeline_brain_db.connect(project_root)
     rows = conn.execute(
         """

package/src/utils/audio_fairlight_live_probe.py

@@ -47,7 +47,7 @@ def _record_tool_result(
 
 
 def _run_ffmpeg(args: list[str]) -> None:
-    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True)
+    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True, timeout=120)
 
 
 def _make_synthetic_media(work_dir: Path) -> Dict[str, Path]:

package/src/utils/brain_edits.py

@@ -278,6 +278,12 @@ def get_brain_edit_history(
     limit: int = 50,
 ) -> List[Dict[str, Any]]:
     """Return brain_edit rows, optionally filtered by timeline or run, newest first."""
+    # SQLite treats a negative LIMIT as "no limit"; clamp so a negative/huge
+    # limit can't silently fetch the whole table (EX8).
+    try:
+        limit = max(1, min(1000, int(limit)))
+    except (TypeError, ValueError):
+        limit = 50
     conn = timeline_brain_db.connect(project_root)
     clauses: List[str] = []
     args: List[Any] = []

package/src/utils/fusion_group_settings.py

@@ -304,8 +304,19 @@ def splice_inputs_block(
     after_inputs = parse_instance_input_block(new_inner)
 
     os.makedirs(os.path.dirname(os.path.abspath(dest_path)) or ".", exist_ok=True)
-    with open(dest_path, "w", encoding="utf-8", newline="\n") as handle:
-        handle.write(new_content)
+    # Atomic write (temp + os.replace): a crash mid-write must not truncate the
+    # Fusion .setting file and leave the GroupOperator config uneditable (PS5).
+    tmp_path = f"{dest_path}.tmp-{os.getpid()}"
+    try:
+        with open(tmp_path, "w", encoding="utf-8", newline="\n") as handle:
+            handle.write(new_content)
+        os.replace(tmp_path, dest_path)
+    finally:
+        if os.path.isfile(tmp_path):
+            try:
+                os.remove(tmp_path)
+            except OSError:
+                pass
 
     return {
         "source_path": os.path.abspath(source_path),

package/src/utils/media_pool_changes.py

@@ -84,6 +84,11 @@ def get_media_pool_change_history(
     action: Optional[str] = None,
     limit: int = 50,
 ) -> List[Dict[str, Any]]:
+    # SQLite treats a negative LIMIT as "no limit"; clamp (EX8).
+    try:
+        limit = max(1, min(1000, int(limit)))
+    except (TypeError, ValueError):
+        limit = 50
     conn = timeline_brain_db.connect(project_root)
     clauses: List[str] = []
     args: List[Any] = []

package/src/utils/render_deliver_live_probe.py

@@ -59,7 +59,7 @@ def _record_tool_result(
 
 
 def _run_ffmpeg(args: list[str]) -> None:
-    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True)
+    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True, timeout=120)
 
 
 def _make_synthetic_video(work_dir: Path) -> Path:

package/src/utils/review_annotation_live_probe.py

@@ -59,7 +59,7 @@ def _record_tool_result(
 
 
 def _run_ffmpeg(args: list[str]) -> None:
-    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True)
+    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", *args], check=True, timeout=120)
 
 
 def _make_synthetic_video(work_dir: Path) -> Path: