davinci-resolve-mcp 4.10.2 → 4.10.4

package/CHANGELOG.md

@@ -2,6 +2,63 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.10.4 — enrolled in Anthropic's OSS Scanner
+
+### Security
+
+- **The repository now carries an OSS Scanner build and threat model**
+  under `.oss-scanner/`. [OSS Scanner](https://github.com/anthropics/oss-scanner)
+  builds a project in an isolated VM, scans it offline, and emails findings
+  to the maintainer. Keeping both files here means they can change without a
+  pull request to the scanner's repository.
+  - `.oss-scanner/Dockerfile` mirrors CI: Python 3.11, Node 22, ffmpeg, both
+    lockfiles via `npm ci`, then the offline suites. Built with the
+    scanner's `tools/check`: Python 4027 passed (26 skipped), advanced
+    server 1113 passed (60 skipped), 0 failed. Resolve is not in the image;
+    the suite stubs it as in CI.
+  - `.oss-scanner/threat_model.md` treats every MCP tool argument as
+    untrusted (LLM context can carry attacker text), and names the
+    properties a finding would break: no caller-supplied code execution,
+    the destructive-op gate, immutable source media, and the token- and
+    Host/Origin-gated local listeners. It points at the subprocess call
+    sites and the archive/XML/SQLite parsers, cites the four published
+    advisories as examples of each class, and sets severity tiers.
+- No server code changed.
+
+## What's New in v4.10.3 — the conform-qc tests run, and run in `npm test`
+
+### Tests
+
+- **The vendored conform-qc suite was never part of `npm test`, and 20 of its
+  118 tests failed** (reported from a macOS validation run in the #273
+  thread). Three causes, all fixed:
+  - **The synthetic fixture was never committed.** `synthetic/generate.js`
+    builds a small, anonymised turnover XML, test-pattern frames and their
+    answer keys, and its own docs say the output is committed under
+    `__fixtures__/synthetic/`. It now is: 9 files, about 224 KB, every name
+    and path a `SYNTH_` placeholder, and byte-for-byte reproducible (generated
+    twice and compared). The npm packages exclude it.
+  - **Tests that need the client answer key crashed instead of skipping.**
+    `__fixtures__/sample-reel-01` is derived from client material and stays
+    out of the repository; `reelFixtureDir()` documents that its tests skip
+    when it is absent. A shared `test/_client-fixture.js` now does that.
+    Seven files whose setup is built on the key skip as a whole, with a
+    reason. In `compare`, `geometry`, `verify` and `workflow-driver` only the
+    tests that read the key skip, so their client-free tests keep running.
+  - **The runbook check had gone stale.** It expected "two surfaces" and a
+    "Cloud" surface. The runbook now says it "covers both surfaces" and that
+    the engine "ships only the local path" with other hosts composing their
+    own, and its bold markup and line wrapping broke one more pattern. The
+    patterns follow the runbook; the runbook is unchanged.
+- `resolve-advanced`'s `npm test` and `test:libs` now include
+  `vendor/conform-qc/test/*.test.js`: the advanced suite runs 1,173 tests
+  (from 1,036), 0 failed, with every skip carrying its reason.
+
+### Validation
+
+- Test and packaging changes only; no server or engine code changed. Python
+  suite green; advanced suite 1,173 / 0 failed in a clean worktree.
+
 ## What's New in v4.10.2 — place_fusion_title measured on another build; the .drp harness says when it can't run
 
 ### Documentation

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.10.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.10.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.10.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.10.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.10.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.10.4 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.10.2"
+VERSION = "4.10.4"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.10.2",
+  "version": "4.10.4",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",
@@ -38,6 +38,7 @@
     "resolve-advanced/server/**/*.mjs",
     "resolve-advanced/server/**/*.py",
     "resolve-advanced/vendor/**",
+    "!resolve-advanced/vendor/conform-qc/__fixtures__/**",
     "resolve-advanced/package.json",
     "resolve-advanced/README.md",
     "docs/**/*.md",

package/resolve-advanced/package.json

@@ -15,6 +15,7 @@
   "files": [
     "server/**/*.mjs",
     "vendor/**",
+    "!vendor/conform-qc/__fixtures__/**",
     "README.md",
     "LICENSE"
   ],
@@ -37,8 +38,8 @@
     "_comment": "audio (split/trim/convert) + conform frame ops need system ffmpeg/ffprobe on PATH (NOT bundled \u2014 FFmpeg binaries are GPL; this package stays MIT). Install ffmpeg yourself: brew install ffmpeg."
   },
   "scripts": {
-    "test": "node --test vendor/drp-format/__tests__/*.test.js vendor/drt-format/__tests__/*.test.js vendor/drx-codec/__tests__/*.test.js test/*.test.mjs",
-    "test:libs": "node --test vendor/drp-format/__tests__/*.test.js vendor/drt-format/__tests__/*.test.js vendor/drx-codec/__tests__/*.test.js",
+    "test": "node --test vendor/drp-format/__tests__/*.test.js vendor/drt-format/__tests__/*.test.js vendor/drx-codec/__tests__/*.test.js vendor/conform-qc/test/*.test.js test/*.test.mjs",
+    "test:libs": "node --test vendor/drp-format/__tests__/*.test.js vendor/drt-format/__tests__/*.test.js vendor/drx-codec/__tests__/*.test.js vendor/conform-qc/test/*.test.js",
     "test:server": "node --test test/*.test.mjs"
   },
   "engines": {

package/resolve-advanced/vendor/conform-qc/test/_client-fixture.js

@@ -0,0 +1,34 @@
+'use strict';
+
+/**
+ * The full-reel answer key (`__fixtures__/sample-reel-01/golden_oracle.json` and
+ * `golden_compare.json`) is derived from client material, so it is not in the
+ * repository; `index.js#reelFixtureDir` documents that its dependent tests skip
+ * when it is absent. The client-free synthetic fixture (`__fixtures__/synthetic/`,
+ * built by `synthetic/generate.js`) is committed and always runs.
+ *
+ * Not a test file: `node --test` only picks up `*.test.js`.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const pkg = require('../index');
+
+const DIR = pkg.reelFixtureDir();
+const REASON = 'client answer key __fixtures__/sample-reel-01 is not in the repository';
+
+function present() {
+  return ['golden_oracle.json', 'golden_compare.json'].every((f) => fs.existsSync(path.join(DIR, f)));
+}
+
+/**
+ * For a file whose every test needs the answer key: registers one skipped test
+ * that says why, and returns true so the caller can `return` before loading it.
+ */
+function skipFile(test, label) {
+  if (present()) return false;
+  test(`${label}: needs the client answer key`, { skip: REASON }, () => {});
+  return true;
+}
+
+module.exports = { present, skipFile, REASON };

package/resolve-advanced/vendor/conform-qc/test/compare.test.js

@@ -20,9 +20,14 @@ const compare = require('../compare');
 const DIR = pkg.reelFixtureDir();
 const FRAMES = path.join(DIR, 'frames');
 const HAVE_FRAMES = fs.existsSync(FRAMES) && fs.readdirSync(FRAMES).some((f) => f.endsWith('.png'));
-const SKIP = HAVE_FRAMES ? false : 'frames/ absent (git-ignored raw material) — skipping';
+const client = require('./_client-fixture');
+// The frame tests read golden_compare.json too, so they also need the client answer key.
+const SKIP = !client.present() ? client.REASON
+  : HAVE_FRAMES ? false : 'frames/ absent (git-ignored raw material) — skipping';
 
-const COMPARE = JSON.parse(fs.readFileSync(path.join(DIR, 'golden_compare.json'), 'utf8'));
+const COMPARE = client.present()
+  ? JSON.parse(fs.readFileSync(path.join(DIR, 'golden_compare.json'), 'utf8'))
+  : null;
 
 test('comparator: alignment mode is a distinct entry point (stub), content-identity is default', async () => {
   // The alignment stub throws clearly (full impl is P4.5).

package/resolve-advanced/vendor/conform-qc/test/geometry.test.js

@@ -23,7 +23,8 @@ const XML_PATH = path.join(DIR, 'turnover.xml');
 const HAVE_XML = fs.existsSync(XML_PATH);
 const SKIP = HAVE_XML ? false : 'turnover.xml absent (git-ignored raw material) — skipping';
 
-const GOLDEN = JSON.parse(fs.readFileSync(path.join(DIR, 'golden_oracle.json'), 'utf8'));
+const client = require('./_client-fixture');
+const GOLDEN = (client.present() ? JSON.parse(fs.readFileSync(path.join(DIR, 'golden_oracle.json'), 'utf8')) : null);
 
 // Parse once (only if present).
 const PARSED = HAVE_XML ? parseGeometry(fs.readFileSync(XML_PATH, 'utf8')) : null;

package/resolve-advanced/vendor/conform-qc/test/oracle.test.js

@@ -18,6 +18,7 @@ const pkg = require('../index');
 const oracle = require('../oracle');
 const resolveTarget = require('../oracle/resolve');
 
+if (require('./_client-fixture').skipFile(test, 'oracle')) return;
 const GOLDEN = JSON.parse(
   fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8'),
 );

package/resolve-advanced/vendor/conform-qc/test/p0-acceptance.test.js

@@ -21,6 +21,7 @@ const oracle = require('../oracle');
 const compare = require('../compare');
 
 const DIR = pkg.reelFixtureDir();
+if (require('./_client-fixture').skipFile(test, 'p0-acceptance')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(DIR, 'golden_oracle.json'), 'utf8'));
 const COMPARE = JSON.parse(fs.readFileSync(path.join(DIR, 'golden_compare.json'), 'utf8'));
 const CTX = { ticksPerFrame: GOLDEN.ticksPerFrame, sequenceWidth: GOLDEN.sequence.width };

package/resolve-advanced/vendor/conform-qc/test/p1-acceptance.test.js

@@ -20,6 +20,7 @@ const pkg = require('../index');
 const { verify } = require('../ops/verify');
 
 const SAMPLE = pkg.reelFixtureDir();
+if (require('./_client-fixture').skipFile(test, 'p1-acceptance')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(SAMPLE, 'golden_oracle.json'), 'utf8'));
 const COMPARE = JSON.parse(fs.readFileSync(path.join(SAMPLE, 'golden_compare.json'), 'utf8'));
 const FRAMES = path.join(SAMPLE, 'frames');

package/resolve-advanced/vendor/conform-qc/test/p45-patch-acceptance.test.js

@@ -20,6 +20,7 @@ const pkg = require('../index');
 const oracle = require('../oracle');
 const { diffTimelines, reverifyChanged, rippleUpdate } = require('../ops/patch');
 
+if (require('./_client-fixture').skipFile(test, 'p45-patch-acceptance')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8'));
 const CTX = { ticksPerFrame: GOLDEN.ticksPerFrame, sequenceWidth: GOLDEN.sequence.width };
 

package/resolve-advanced/vendor/conform-qc/test/repair-strategies.test.js

@@ -13,6 +13,7 @@ const { MediaIndex } = require('../repair/media-index');
 const { detectDupes, proposeTimeline } = require('../repair/analysis');
 const { makeRepairLadder } = require('../repair');
 
+if (require('./_client-fixture').skipFile(test, 'repair-strategies')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8'));
 const CTX = { ticksPerFrame: GOLDEN.ticksPerFrame, sequenceWidth: GOLDEN.sequence.width, sequenceHeight: GOLDEN.sequence.height, sequenceRate: GOLDEN.sequence.fps };
 

package/resolve-advanced/vendor/conform-qc/test/repair.test.js

@@ -11,6 +11,7 @@ const pkg = require('../index');
 const { makeRepairLadder, strategies } = require('../repair');
 const { ConformKnowledge } = require('../knowledge');
 
+if (require('./_client-fixture').skipFile(test, 'repair')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8'));
 const CTX = { ticksPerFrame: GOLDEN.ticksPerFrame, sequenceWidth: GOLDEN.sequence.width };
 

package/resolve-advanced/vendor/conform-qc/test/resolve-readback.test.js

@@ -23,6 +23,7 @@ const { HeadlessResolveDriver } = require('../adapters/resolve-headless-driver')
 
 const SAMPLE = pkg.reelFixtureDir();
 const XML = path.join(SAMPLE, 'turnover.xml');
+if (require('./_client-fixture').skipFile(test, 'resolve-readback')) return;
 const GOLDEN = JSON.parse(fs.readFileSync(path.join(SAMPLE, 'golden_oracle.json'), 'utf8'));
 const CTX = { ticksPerFrame: GOLDEN.ticksPerFrame, sequenceWidth: GOLDEN.sequence.width };
 

package/resolve-advanced/vendor/conform-qc/test/runbook.test.js

@@ -11,14 +11,14 @@ const DOC = fs.readFileSync(path.join(__dirname, '..', 'docs', 'runbook.md'), 'u
 
 test('runbook: documents both surfaces, tiers, package options, and the closed decisions', () => {
   const must = [
-    /two surfaces/i,
-    /Cloud/, /Local/,
+    /(two|both) surfaces/i,
+    /Other surfaces/, /Local/, // the engine ships only the local path; other hosts compose their own
     /A — burned reference/i, /B — clean ref/i, /C — no reference/i, /math-verified/,
     /no picture, no `?content-verified/i,
     /brightness/i,
     /ADVISORY ONLY/i,
     /never.*(clear a flag|flip a deterministic)/i,
-    /host-injected `?VisionValidator|supplied by the host/i, // optional vision seam, no bundled LLM
+    /host-injected\**\s*`?VisionValidator|supplied by the\s+host/i, // optional vision seam, no bundled LLM
     /SSIM ≥ 0\.90|PSNR ≥ 25/,
     /VFX alignment \*\*never\*\* auto-applies|VFX alignment never/i,
     /MediaRelationship.*→.*project override.*→.*editorialRole|resolution/i, // §10 order

package/resolve-advanced/vendor/conform-qc/test/smoke.test.js

@@ -34,7 +34,7 @@ test('package scaffold loads with planned module surface', () => {
   }
 });
 
-test('golden_oracle.json — committed answer key for the Oracle (327 clips)', () => {
+test('golden_oracle.json — committed answer key for the Oracle (327 clips)', { skip: require('./_client-fixture').present() ? false : require('./_client-fixture').REASON }, () => {
   const g = JSON.parse(fs.readFileSync(ORACLE, 'utf8'));
   assert.equal(g.clipCount, 327, 'clipCount must be 327');
   assert.equal(g.clips.length, 327, 'clips array must hold 327 entries');
@@ -53,7 +53,7 @@ test('golden_oracle.json — committed answer key for the Oracle (327 clips)', (
   }
 });
 
-test('golden_compare.json — committed answer key for the comparator (4 verdicts)', () => {
+test('golden_compare.json — committed answer key for the comparator (4 verdicts)', { skip: require('./_client-fixture').present() ? false : require('./_client-fixture').REASON }, () => {
   const g = JSON.parse(fs.readFileSync(COMPARE, 'utf8'));
   assert.ok(Array.isArray(g.cases) && g.cases.length === 4);
   const byLabel = Object.fromEntries(g.cases.map((c) => [c.label, c]));

package/resolve-advanced/vendor/conform-qc/test/verify.test.js

@@ -12,13 +12,16 @@ const { verify } = require('../ops/verify');
 const { FakeVisionValidator } = require('../adapters/vision-validator');
 
 const SAMPLE = pkg.reelFixtureDir();
-const GOLDEN = JSON.parse(fs.readFileSync(path.join(SAMPLE, 'golden_oracle.json'), 'utf8'));
+const client = require('./_client-fixture');
+const GOLDEN = client.present()
+  ? JSON.parse(fs.readFileSync(path.join(SAMPLE, 'golden_oracle.json'), 'utf8'))
+  : null;
 
 const SYNTH_DIR = path.join(__dirname, '..', '__fixtures__', 'synthetic');
 const SYNTH = JSON.parse(fs.readFileSync(path.join(SYNTH_DIR, 'golden_oracle.synth.json'), 'utf8'));
 const SF = (name) => path.join(SYNTH_DIR, 'frames', name);
 
-test('verify: Tier C (no reference) — all 327 SAMPLE clips MATH-VERIFIED, read-only', async () => {
+test('verify: Tier C (no reference) — all 327 SAMPLE clips MATH-VERIFIED, read-only', { skip: GOLDEN ? false : client.REASON }, async () => {
   const rep = await verify(GOLDEN, {});
   assert.equal(rep.perCut.length, 327);
   assert.equal(rep.summary.mathVerified, 327);

package/resolve-advanced/vendor/conform-qc/test/workflow-driver.test.js

@@ -12,7 +12,8 @@ const { ResolveDriver, FakeResolveDriver, isResolveDriver } = require('../adapte
 const { conformQcActivity, conformQcWorkflow } = require('../ops/workflow');
 const { verify } = require('../ops/verify');
 
-const GOLDEN = JSON.parse(fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8'));
+const client = require('./_client-fixture');
+const GOLDEN = (client.present() ? JSON.parse(fs.readFileSync(path.join(pkg.reelFixtureDir(), 'golden_oracle.json'), 'utf8')) : null);
 
 test('ResolveDriver: interface throws until implemented; fake conforms + reads back', async () => {
   const base = new ResolveDriver();
@@ -25,7 +26,7 @@ test('ResolveDriver: interface throws until implemented; fake conforms + reads b
   assert.equal(isResolveDriver(fake), true);
 });
 
-test('conformQcWorkflow: activity is unit-invokable and equals a direct verify()', async () => {
+test('conformQcWorkflow: activity is unit-invokable and equals a direct verify()', { skip: GOLDEN ? false : client.REASON }, async () => {
   // The activity (heavy work) over the Tier-C golden reel.
   const direct = await verify(GOLDEN, {});
   const viaActivity = await conformQcActivity(GOLDEN, {});

package/src/granular/common.py

@@ -91,7 +91,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.10.2"
+VERSION = "4.10.4"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.10.2"
+VERSION = "4.10.4"
 
 import base64
 import os