davinci-resolve-mcp 4.18.0 → 4.18.2

package/CHANGELOG.md

@@ -2,6 +2,82 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.18.2 — The rest of the `$` replacement bugs
+
+v4.18.1 fixed `replace()` calls that put user text in with an interpolated
+template string. Its guard only looked for that one form, so calls whose
+replacement was a variable, a function call or a conditional were missed.
+
+### Fixed
+
+- **Splitting, trimming, adding a transition, or adding a clip to a track that
+  already has clips no longer corrupts the track when a clip name contains
+  `$`** (#333, thanks @Dev-next-gen). The rewritten clip went into the track
+  as a replacement string, so `$&` or `` $` `` in a name copied other clips into
+  the track and duplicated them.
+- **`media_ops` `relink_manifest` keeps a `$` in a target path prefix as
+  typed.** Mapping `/old/vol` to `/new/Spot $$ 30s $&` produced
+  `/new/Spot $ 30s /old/vol/...`, a path that does not exist.
+- The same form, now fixed, was also in `assemble_timeline` (the timeline's
+  pool block, which holds its name, when the media extents are rewritten),
+  in the subtitle preset writer (the preset section XML), and in the agent-rule
+  generator (generated doc sections). The other changed calls only insert hex,
+  IDs or numbers; they now use replacer functions too, so a single rule holds
+  everywhere.
+
+### Changed
+
+- The guard test now splits every `replace()` / `replaceAll()` call in
+  `resolve-advanced` and `scripts/` into its arguments, and fails unless the
+  replacement is a function or a literal with no `$` in it. Literals whose
+  `$`-sequences are backreferences (`$1`, `'\\$&'`) are allowed. The
+  `editorial` source-alias rules and the `media_ops` rename rules, where `$1`
+  is part of the feature, are listed by name. Run against the v4.18.1 sources,
+  it reports 25 call sites, including all six that #333 fixed.
+
+### Validation
+
+- Advanced Node suite on Node 20 with a fresh `npm ci`: 1,227 tests, 0 failed.
+  Python suite: 4,295 tests; the only failures are the 4 `source_media_guard`
+  path checks that always fail in a scratch worktree. With #333's fix
+  reverted, its two tests fail. The new relink test
+  fails on the v4.18.1 code with the wrong path shown above.
+- Offline file writers only. No Resolve API behaviour changed.
+
+## What's New in v4.18.1 — Names with `$` or `\` are written as typed
+
+### Fixed
+
+- **`drt assemble_project` no longer rewrites a merged timeline's name when it
+  contains `$`** (#332, thanks @Dev-next-gen). The name was inserted with a
+  replacement string, and JavaScript expands `$&`, `$'` and `$$` in one. A
+  second timeline named `R2 $& $'` wrote an `MpFolder.xml` that no longer
+  parsed, and `Spot $$ 30s` came out as `Spot $ 30s`, so a `folder` move then
+  failed to find the timeline.
+- **The same fix in 53 more places in the offline `.drp`/`.drt` writers.**
+  Caption text in `placeSubtitles`, generator, title and compound clip names,
+  media pool clip names and file paths, and every other value inserted into
+  the XML now goes in with a replacer function, so `$`-sequences stay literal.
+  A new guard test fails the advanced suite if a `replace()` call passes an
+  interpolated template as a string.
+- **The audio-only fallback clone in `cut-media` now XML-escapes the source
+  file name and path.** A source path containing `&`, such as
+  `Smith & Jones/clip.mov`, wrote invalid XML.
+- **Re-running media analysis on a clip no longer fails when the new analysis
+  text contains a backslash.** The managed block in the clip's metadata was
+  replaced with `re.sub` using the text as a replacement string, so a Windows
+  path raised `bad escape \F` and `\t` turned into a tab. The text is now
+  inserted as-is.
+
+### Validation
+
+- Advanced Node suite on Node 20 with a fresh `npm ci`: 1,224 tests, 0 failed.
+  With the fixes reverted, the guard and the caption, generator and title tests
+  fail.
+- Python suite: the new metadata test fails with `bad escape \F` without the
+  fix and passes with it.
+- Offline file writers only. No Resolve API behaviour changed.
+
 ## What's New in v4.18.0 — Edit captions with Resolve open
 
 ### Added

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.18.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.18.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(390%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.18.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.18.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(390%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.18.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.18.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.18.0"
+VERSION = "4.18.2"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.18.0",
+  "version": "4.18.2",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/resolve-advanced/server/lut-apply.mjs

@@ -42,7 +42,7 @@ export async function applyLut(ref, opts = {}) {
   const xml = ref.content != null ? ref.content : await fs.readFile(ref.drxPath, 'utf8');
   const bodyHex = extractBodyHex(xml);
   const newBodyHex = await injectNodeLut(bodyHex, nodeIndex, { lutPath: opts.lutPath, slotMeta });
-  const newXml = xml.replace(BODY_RE, `<Body>${newBodyHex}</Body>`);
+  const newXml = xml.replace(BODY_RE, () => `<Body>${newBodyHex}</Body>`);
 
   // ROUND-TRIP ASSERT: decode the patched grade and confirm the LUT ref survives.
   const parsed = await drxParser().parseDRXContent(newXml);

package/resolve-advanced/server/media-ops.mjs

@@ -107,7 +107,7 @@ export function relinkManifest(offlinePaths, pathMap = [], opts = {}) {
       continue;
     }
     const m = matches[0];
-    const target = src.replace(m.from, m.to);
+    const target = src.replace(m.from, () => m.to);
     if (opts.checkExists === false || fs.existsSync(target)) relinkable.push({ from: src, to: target, verified: opts.checkExists !== false });
     else stillOffline.push({ from: src, to: target, reason: 'target does not exist' });
   }

package/resolve-advanced/server/subtitle-timeline.mjs

@@ -61,15 +61,15 @@ export async function editSubtitleTimeline({ source, output, track = 1, inputs =
       .filter(m => m.decoded.templateId === template_id);
     if (matches.length !== 1) throw new Error('Native title reference must contain exactly one matching composition');
     const scaffold = before ?? holder(await fs.readFile(new URL('../assets/lollipop-track.xml', import.meta.url), 'utf8'));
-    chosen = { ...matches[0], text: scaffold.text.replace(scaffold.hex, matches[0].hex) };
+    chosen = { ...matches[0], text: scaffold.text.replace(scaffold.hex, () => matches[0].hex) };
   }
   if (!chosen) throw new Error('No animation preset: supply a native preset_reference DRT or apply Word Highlight through the live Effects UI');
   const patched = Object.keys(parsed.inputs).length
     ? setPresetInputs(Buffer.from(chosen.hex, 'hex'), parsed.inputs) : Buffer.from(chosen.hex, 'hex');
-  const section = freshIds(chosen.text.replace(chosen.hex, patched.toString('hex')));
+  const section = freshIds(chosen.text.replace(chosen.hex, () => patched.toString('hex')));
   let text;
-  if (before) text = target.text.replace(before.text, section);
-  else if (/<FusionCompHolderItems\s*\/>/.test(target.text)) text = target.text.replace(/<FusionCompHolderItems\s*\/>/, section);
+  if (before) text = target.text.replace(before.text, () => section);
+  else if (/<FusionCompHolderItems\s*\/>/.test(target.text)) text = target.text.replace(/<FusionCompHolderItems\s*\/>/, () => section);
   else throw new Error('Unsupported track: missing FusionCompHolderItems field');
   const xml = exported.xml.slice(0, target.offset) + text + exported.xml.slice(target.offset + target.text.length);
   // Resolve remaps timeline identity on import. Keep cross-entry sequence
@@ -142,7 +142,7 @@ export async function editCaptionTimeline({ source, output, track = 1, add = [],
   const elements = final.map((c) => {
     const s = stagedById.get(c.id);
     if (!s) return byId.get(c.id).text;
-    let text = s.fresh ? template.text.replace(template.dbId, randomUUID()) : s.base.text;
+    let text = s.fresh ? template.text.replace(template.dbId, () => randomUUID()) : s.base.text;
     if (s.fresh) text = text.replace(/<(MarkersBA|RenderCacheBA|ImportExportMetadataBA)>[\s\S]*?<\/\1>/g, '<$1/>');
     text = setTag(text, 'FieldsBlob', s.blob.toString('hex'));
     text = setTag(text, 'Name', xmlEscape(` ${s.caption.text}`));

package/resolve-advanced/server/tools/drt.mjs

@@ -467,7 +467,7 @@ export const drtTool = {
           } catch { return whole; }
         });
         // pool clip: uuid remap + keyed SeqRef patch + fresh numeric IDs
-        let tlNew = applyBlobs(apply(tlEl)).replace(/<ID>\d+<\/ID>/g, `<ID>${nextPoolId}<\/ID>`.replace('<\/ID>', '</ID>'));
+        let tlNew = applyBlobs(apply(tlEl)).replace(/<ID>\d+<\/ID>/g, () => `<ID>${nextPoolId}<\/ID>`.replace('<\/ID>', '</ID>'));
         nextPoolId += 1;
         const fbM = tlNew.match(/(<Sm2Sequence DbId="[^"]+">\s*<FieldsBlob>)([0-9a-fA-F]+)(<\/FieldsBlob>)/);
         if (fbM) {
@@ -475,7 +475,7 @@ export const drtTool = {
           const seqRef = dict.entries.find((e) => e.key === 'SeqRef');
           if (seqRef && remap.has(String(seqRef.value))) {
             seqRef.value = remap.get(String(seqRef.value));
-            tlNew = tlNew.replace(fbM[0], `${fbM[1]}${encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex')}${fbM[3]}`);
+            tlNew = tlNew.replace(fbM[0], () => `${fbM[1]}${encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex')}${fbM[3]}`);
           }
         }
         for (const [n, xml] of Object.entries(containers)) {
@@ -486,14 +486,14 @@ export const drtTool = {
         // Children live INSIDE <MediaVec> — an element appended after its
         // close parses fine and is silently invisible (measured: the whole
         // REEL_02 subtree vanished while every id chain checked out).
-        mpXml = mpXml.replace('</MediaVec>', `${tlNew}\n</MediaVec>`);
+        mpXml = mpXml.replace('</MediaVec>', () => `${tlNew}\n</MediaVec>`);
         for (const el of mediaEls) {
           const id = el.match(/DbId="([^"]+)"/)[1];
-          if (!mpXml.includes(`DbId="${id}"`)) mpXml = mpXml.replace('</MediaVec>', `${el}\n</MediaVec>`);
+          if (!mpXml.includes(`DbId="${id}"`)) mpXml = mpXml.replace('</MediaVec>', () => `${el}\n</MediaVec>`);
         }
         const pj2 = await zip.file('project.xml').async('string');
         for (const blob of pj2.match(/<Element>\s*<Sm2(?:Sequence|TiItem)LockableBlob DbId="[^"]+">[\s\S]*?<\/Sm2(?:Sequence|TiItem)LockableBlob>\s*<\/Element>/g) || []) {
-          pjXml = pjXml.replace('</LocableBlobSet>', `${apply(blob)}</LocableBlobSet>`);
+          pjXml = pjXml.replace('</LocableBlobSet>', () => `${apply(blob)}</LocableBlobSet>`);
         }
         // THE timeline registry (found the hard way — two invisible merges):
         // project.xml's <TimelineHandleVec> lists each pool clip's embedded
@@ -503,7 +503,7 @@ export const drtTool = {
         const vec2 = pj2.match(/<TimelineHandleVec>([\s\S]*?)<\/TimelineHandleVec>/);
         if (vec2) {
           for (const h of vec2[1].match(/<Element>[^<]*<\/Element>/g) || []) {
-            pjXml = pjXml.replace('</TimelineHandleVec>', ` ${apply(h)}\n </TimelineHandleVec>`);
+            pjXml = pjXml.replace('</TimelineHandleVec>', () => ` ${apply(h)}\n </TimelineHandleVec>`);
           }
         }
         // future merges must not collide with THIS timeline's fresh ids either
@@ -534,7 +534,7 @@ export const drtTool = {
           const hit = mpXml.match(tlRe);
           if (!hit) throw new Error(`assemble_project: could not locate pool clip for timeline ${names[i]} to move into folder ${folder}`);
           mpXml = mpXml.replace(hit[0], '');
-          bin.clips.push(hit[0].replace(/<MpFolder>[^<]*<\/MpFolder>/, `<MpFolder>${bin.id}</MpFolder>`));
+          bin.clips.push(hit[0].replace(/<MpFolder>[^<]*<\/MpFolder>/, () => `<MpFolder>${bin.id}</MpFolder>`));
         }
         // Register the bins in Master's FieldsBlob — the parent folder blob
         // is the SUBFOLDER registry (measured: with it blanked, a bin's

package/resolve-advanced/server/tools/drx.mjs

@@ -844,7 +844,7 @@ export const drxTool = {
       });
       // Splice the new Body into the ORIGINAL envelope (byte-lossless outside the
       // position varints — labels, keyframes, OFX, still metadata all pass through).
-      const out = xml.replace(m[0], `<Body>${r.bodyHex}</Body>`);
+      const out = xml.replace(m[0], () => `<Body>${r.bodyHex}</Body>`);
       // Guard: the rewrite must not change the node count (silent-corruption check).
       const reparsed = await drxParser().parseDRXContent(out);
       if ((reparsed.nodes || []).length !== r.nodeCount) {

package/resolve-advanced/vendor/audio/format-converter.js

@@ -213,7 +213,7 @@ async function convert(inputPath, outputPath, options = {}) {
   // Auto-generate output path if not provided
   if (!outputPath) {
     const ext = CONTAINER_EXTENSIONS[preset.container] || '.wav';
-    outputPath = inputPath.replace(/\.[^.]+$/, `_${presetName}${ext}`);
+    outputPath = inputPath.replace(/\.[^.]+$/, () => `_${presetName}${ext}`);
   }
 
   onProgress(10);

package/resolve-advanced/vendor/drp-format/__tests__/literal-replacement.test.js

@@ -0,0 +1,226 @@
+// A string passed as the replacement to String.prototype.replace expands `$&`,
+// `$'`, `` $` `` and `$$`, so a name or caption carrying them is rewritten on its
+// way into the XML (#332: `R2 $& $'` as a timeline name made MpFolder.xml
+// unparseable; `Spot $$ 30s` came out as `Spot $ 30s`). Interpolated
+// replacements are therefore passed as functions, which insert their result
+// literally. This file guards that rule for every replace() call (#333 found
+// forms the first guard missed: a variable, a call or a conditional as the
+// replacement) and checks the writers that carry user text.
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const JSZip = require('jszip');
+const { escapeXml } = require('../xml-builder');
+const { createEmptyProject } = require('../author-project');
+const { placeSubtitles } = require('../place-subtitles');
+const { placeGenerator } = require('../place-generator');
+const { placeFusionTitle } = require('../place-fusion-title');
+const { splitClip, trimClip, trimClipHead } = require('../splice-clips');
+const { placeTransition } = require('../place-transition');
+
+const ROOT = path.resolve(__dirname, '..', '..', '..');
+const TRICKY = "Spot $$ 30s $& $' $` end";
+
+function sourceFiles(dir) {
+  const out = [];
+  if (!fs.existsSync(dir)) return out;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === '__tests__') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...sourceFiles(full));
+    else if (/\.(m?js)$/.test(entry.name)) out.push(full);
+  }
+  return out;
+}
+
+// A small scanner, enough to split each replace() call into its arguments: it
+// skips strings, templates, regex literals and comments, and matches brackets.
+const REGEX_CAN_FOLLOW = '(,=:[!&|?{};+-*%<>~^';
+function prevSignificant(s, i) {
+  let j = i - 1;
+  while (j >= 0 && /\s/.test(s[j])) j -= 1;
+  return j >= 0 ? s[j] : '';
+}
+function skipString(s, i) {
+  const q = s[i];
+  i += 1;
+  while (s[i] !== q) i += s[i] === '\\' ? 2 : 1;
+  return i + 1;
+}
+function skipTemplate(s, i) {
+  i += 1;
+  while (s[i] !== '`') {
+    if (s[i] === '\\') i += 2;
+    else if (s.startsWith('${', i)) i = skipBracketed(s, i + 1);
+    else i += 1;
+  }
+  return i + 1;
+}
+function skipRegex(s, i) {
+  let inClass = false;
+  for (i += 1; ; i += 1) {
+    const c = s[i];
+    if (c === '\\') { i += 1; continue; }
+    if (c === '\n' || c === undefined) return -1;
+    if (c === '[') inClass = true;
+    else if (c === ']') inClass = false;
+    else if (c === '/' && !inClass) break;
+  }
+  i += 1;
+  while (/[a-z]/.test(s[i] || '')) i += 1;
+  return i;
+}
+// Skip a string, template, comment or regex literal at i; return the index after
+// it, or -1 when none starts there.
+function skipAtom(s, i) {
+  const c = s[i];
+  if (c === "'" || c === '"') return skipString(s, i);
+  if (c === '`') return skipTemplate(s, i);
+  if (c === '/' && s[i + 1] === '/') return s.indexOf('\n', i);
+  if (c === '/' && s[i + 1] === '*') return s.indexOf('*/', i) + 2;
+  if (c === '/' && REGEX_CAN_FOLLOW.includes(prevSignificant(s, i))) return skipRegex(s, i);
+  return -1;
+}
+function skipBracketed(s, i) {
+  let depth = 0;
+  while (i < s.length) {
+    const next = skipAtom(s, i);
+    if (next > i) { i = next; continue; }
+    if ('([{'.includes(s[i])) depth += 1;
+    else if (')]}'.includes(s[i]) && --depth === 0) return i + 1;
+    i += 1;
+  }
+  return s.length;
+}
+function callArguments(s, open) {
+  const close = skipBracketed(s, open) - 1;
+  const args = [];
+  let start = open + 1;
+  for (let i = start; i < close; ) {
+    const next = skipAtom(s, i);
+    if (next > i) { i = next; continue; }
+    if ('([{'.includes(s[i])) { i = skipBracketed(s, i); continue; }
+    if (s[i] === ',') { args.push(s.slice(start, i).trim()); start = i + 1; }
+    i += 1;
+  }
+  args.push(s.slice(start, close).trim());
+  return args;
+}
+
+const BACKREF = /\$(?:[0-9&'`]|<[A-Za-z_]\w*>)/;
+// Replacements that are rules a caller writes, where $1 and $& are the feature.
+const INTENDED = new Set([
+  'server/editorial.mjs: a.replace',
+  "server/media-ops.mjs: rule.replace ?? ''",
+]);
+
+// The replacement of every .replace()/.replaceAll() call must be a function, or a
+// literal with no $ in it. A literal whose $-sequences are backreferences ($1,
+// $&) is deliberate and allowed; anything else (a variable, a call, an
+// interpolated template) may carry a $ and is reported.
+function offenders(text, file = '') {
+  const found = [];
+  for (const m of text.matchAll(/\.(?:replace|replaceAll)\(/g)) {
+    const args = callArguments(text, m.index + m[0].length - 1);
+    if (args.length < 2) continue;
+    const rep = args[1];
+    if (/^(async\s+)?(\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|^function\b/.test(rep)) continue;
+    const literal = /^(['"`])[\s\S]*\1$/.test(rep);
+    if (literal && !rep.includes('$')) continue;
+    if (literal && BACKREF.test(rep.replace(/\$\{[^}]*\}/g, ''))) continue;
+    if (INTENDED.has(`${file}: ${rep}`)) continue;
+    found.push(`${file}: .replace(${args[0].slice(0, 40)}, ${rep.slice(0, 60)})`);
+  }
+  return found;
+}
+
+test('every replace() replacement is a function or a $-free literal', () => {
+  const dirs = ['server', 'vendor', 'bin', '../scripts', '../bin'].map((d) => path.join(ROOT, d));
+  const files = dirs.flatMap(sourceFiles);
+  assert.ok(files.length > 50, `scanned ${files.length} files`);
+  const bad = files.flatMap((file) => offenders(fs.readFileSync(file, 'utf8'), path.relative(ROOT, file).split(path.sep).join('/')));
+  assert.deepStrictEqual(bad, [], 'pass the replacement as () => ... so $-sequences in it stay literal');
+});
+
+test('the guard catches each string form and allows the safe ones', () => {
+  const caught = [
+    "x.replace('</MediaVec>', `${el}\\n</MediaVec>`)", // #332
+    'x.replace(/<Name>[^<]*<\\/Name>/, `<Name>${n}</Name>`)',
+    'out.replace(c, nc)', // #333
+    'items.replace(target, setClipDuration(target, d))',
+    'x.replace(/<Items>[\\s\\S]*?<\\/Items>/, body ? `<Items>${body}</Items>` : "<Items/>")',
+    'x.replaceAll(a, b)',
+  ];
+  for (const code of caught) assert.strictEqual(offenders(code).length, 1, code);
+  const allowed = [
+    "x.replace('</MediaVec>', () => `${el}\\n</MediaVec>`)",
+    'x.replace(/(<a>)<b\\/>/, `$1<b>${hex}</b>`)',
+    "x.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')",
+    "x.replace('a', 'b')",
+    'x.replace(re, (m, g) => g.toUpperCase())',
+    "x.replace(re, function (m) { return m + ', '; })",
+  ];
+  for (const code of allowed) assert.strictEqual(offenders(code).length, 0, code);
+});
+
+async function sequenceXml(buffer) {
+  const zip = await JSZip.loadAsync(buffer);
+  const parts = [];
+  for (const name of Object.keys(zip.files)) {
+    if (/SeqContainer\/[^/]+\.xml$|SeqContainer\d*\.xml$/.test(name)) parts.push(await zip.files[name].async('string'));
+  }
+  return parts.join('\n');
+}
+
+test('placeSubtitles keeps $-sequences in caption text', async () => {
+  const { buffer, startFrame } = await createEmptyProject({ timelineName: 'Subs' });
+  const res = await placeSubtitles(buffer, { subtitles: [{ startFrame, durationFrames: 48, text: TRICKY }] });
+  assert.ok((await sequenceXml(res.buffer)).includes(`<Name>${escapeXml(TRICKY)}</Name>`));
+});
+
+test('placeGenerator keeps $-sequences in the generator name', async () => {
+  const { buffer, startFrame } = await createEmptyProject({ timelineName: 'Gen' });
+  const res = await placeGenerator(buffer, { generatorName: TRICKY, trackIndex: 2, startFrame, durationFrames: 24 });
+  const xml = await sequenceXml(res.buffer);
+  assert.ok(xml.includes(`<PrettyType>${escapeXml(TRICKY)}</PrettyType>`));
+  assert.ok(xml.includes(`<Name>${escapeXml(TRICKY)}</Name>`));
+});
+
+test('placeFusionTitle keeps $-sequences in the clip name', async () => {
+  const { buffer, startFrame } = await createEmptyProject({ timelineName: 'Title' });
+  const res = await placeFusionTitle(buffer, { trackIndex: 2, startFrame, durationFrames: 24, name: TRICKY });
+  assert.ok((await sequenceXml(res.buffer)).includes(`<Name>${escapeXml(TRICKY)}</Name>`));
+});
+
+// A second clip on a track goes through the populated-track branch of
+// setItemsInner, and splitClip/placeTransition rewrite the clip in place. A
+// string replacement there copies the matched <Items> block ($&) and the text
+// around it ($`, $') into the track, duplicating clips.
+const nameCount = (xml) => xml.split(`<Name>${escapeXml(TRICKY)}</Name>`).length - 1;
+
+async function titledTrack() {
+  const { buffer, startFrame } = await createEmptyProject({ timelineName: 'Track' });
+  const first = await placeFusionTitle(buffer, { trackIndex: 2, startFrame, durationFrames: 24, name: TRICKY });
+  const second = await placeFusionTitle(first.buffer, { trackIndex: 2, startFrame: startFrame + 24, durationFrames: 24, name: 'Next' });
+  return { buffer: second.buffer, startFrame };
+}
+
+test('a clip added to a populated track leaves the clip already there intact', async () => {
+  const xml = await sequenceXml((await titledTrack()).buffer);
+  assert.strictEqual(nameCount(xml), 1);
+  assert.strictEqual(xml.split('<Name>Next</Name>').length - 1, 1);
+});
+
+test('splitClip, trimClip, trimClipHead and placeTransition keep $-sequences in the clip name', async () => {
+  const { buffer, startFrame } = await titledTrack();
+  for (const trim of [trimClip, trimClipHead]) {
+    const res = await trim(buffer, { track: 2, clipIndex: 0, newDuration: 12, frames: 6, ripple: true });
+    assert.strictEqual(nameCount(await sequenceXml(res.buffer)), 1);
+  }
+  const split = await splitClip(buffer, { track: 2, at: startFrame + 12 });
+  assert.strictEqual(nameCount(await sequenceXml(split.buffer)), 2);
+  const res = await placeTransition(buffer, { track: 2, atFrame: startFrame + 24 });
+  assert.strictEqual(nameCount(await sequenceXml(res.buffer)), 1);
+});

package/resolve-advanced/vendor/drp-format/assemble-timeline.js

@@ -247,7 +247,7 @@ async function assembleTimeline(spec = {}) {
         if (!hit) throw new Error(`assembleTimeline: item markers — no ${kind} clip starting at ${cut.startFrame} on track ${cut.track ?? 1}`);
         const blob = encodeTimelineMarkersBlob(cut.markers);
         const el = `<Element>\n     <Sm2TiItemLockableBlob DbId="${randomUUID()}">\n      <FieldsBlob>${blob.toString('hex')}</FieldsBlob>\n      <BlobOwner>${hit[1]}</BlobOwner>\n      <DbSavedTime>0</DbSavedTime>\n     </Sm2TiItemLockableBlob>\n    </Element>\n   `;
-        pj = pj.replace('</LocableBlobSet>', `${el}</LocableBlobSet>`);
+        pj = pj.replace('</LocableBlobSet>', () => `${el}</LocableBlobSet>`);
       }
       zipIM.file('project.xml', pj);
       buffer = await zipIM.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
@@ -417,7 +417,7 @@ async function assembleTimeline(spec = {}) {
     const setM = pjX.match(/<LocableBlobSet>[\s\S]*?<\/LocableBlobSet>/);
     if (!setM) throw new Error('assembleTimeline: project.xml has no LocableBlobSet to hold markers');
     const el = `<Element>\n     <Sm2SequenceLockableBlob DbId="${randomUUID()}">\n      <FieldsBlob>${blob.toString('hex')}</FieldsBlob>\n      <BlobOwner>${seqIdM}</BlobOwner>\n      <DbSavedTime>0</DbSavedTime>\n     </Sm2SequenceLockableBlob>\n    </Element>\n   `;
-    pjX = pjX.replace('</LocableBlobSet>', `${el}</LocableBlobSet>`);
+    pjX = pjX.replace('</LocableBlobSet>', () => `${el}</LocableBlobSet>`);
     zipM.file('project.xml', pjX);
     buffer = await zipM.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
   }
@@ -438,7 +438,7 @@ async function assembleTimeline(spec = {}) {
     const me = Buffer.alloc(16);
     me.writeDoubleLE(originFrame / 24, 0);
     me.writeDoubleLE((maxEnd - originFrame) / 24, 8);
-    mpF = mpF.replace(tlBlock, tlBlock.replace(meM[0], `<MediaExtents>${me.toString('hex')}</MediaExtents>`));
+    mpF = mpF.replace(tlBlock, () => tlBlock.replace(meM[0], () => `<MediaExtents>${me.toString('hex')}</MediaExtents>`));
     zipF.file(mpP, mpF);
     buffer = await zipF.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
   }

package/resolve-advanced/vendor/drp-format/cut-media.js

@@ -27,6 +27,7 @@ const {
   emptyTrackClone,
 } = require('./seq-surgery');
 const { clipDbId, setClipStart, setClipDuration, setClipIn, setClipInEmpty } = require('./splice-clips');
+const { escapeXml } = require('./xml-builder');
 
 /**
  * @param {Buffer|string} drpInput
@@ -96,7 +97,7 @@ async function cutSourceIntoClips(drpInput, opts = {}) {
     if (cut.mediaRef) {
       // Multi-source: point this cut at ITS source's transplanted pool
       // element instead of the donor's.
-      c = c.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/, `<MediaRef>${cut.mediaRef}</MediaRef>`);
+      c = c.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/, () => `<MediaRef>${cut.mediaRef}</MediaRef>`);
     }
     if (cut.srcMeta && !native && cut.audioOnly) {
       // Every clone must carry ITS OWN source identity — a donor clone
@@ -106,15 +107,15 @@ async function cutSourceIntoClips(drpInput, opts = {}) {
       // A1 (measured, E15), and a TC-bearing video source fails the whole
       // render with "Full resolution media not found" (measured, E31).
       const { name, mediaFilePath, fps, frameCount } = cut.srcMeta;
-      c = c.replace(/<Name>[\s\S]*?<\/Name>/, `<Name>${name}</Name>`);
-      c = c.replace(/<MediaFilePath>[\s\S]*?<\/MediaFilePath>/, `<MediaFilePath>${mediaFilePath}</MediaFilePath>`);
+      c = c.replace(/<Name>[\s\S]*?<\/Name>/, () => `<Name>${escapeXml(name)}</Name>`);
+      c = c.replace(/<MediaFilePath>[\s\S]*?<\/MediaFilePath>/, () => `<MediaFilePath>${escapeXml(mediaFilePath)}</MediaFilePath>`);
       const rate = Buffer.alloc(16);
       rate.writeDoubleLE(fps, 0);
-      c = c.replace(/<MediaFrameRate>[0-9a-fA-F]*<\/MediaFrameRate>/, `<MediaFrameRate>${rate.toString('hex')}</MediaFrameRate>`);
+      c = c.replace(/<MediaFrameRate>[0-9a-fA-F]*<\/MediaFrameRate>/, () => `<MediaFrameRate>${rate.toString('hex')}</MediaFrameRate>`);
       const idm = Buffer.alloc(9);
       idm.writeUInt8(0x02, 0);
       idm.writeDoubleBE((frameCount - 1) / fps, 1);
-      c = c.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, `<MediaTimemapBA>${idm.toString('hex')}</MediaTimemapBA>`);
+      c = c.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, () => `<MediaTimemapBA>${idm.toString('hex')}</MediaTimemapBA>`);
       if (cut.audioOnly) {
         // Generic audio-clip FieldsBlob, verbatim from the live A2 harvest.
         // (Video clones keep their blob — repointClipBlobsInXml owns it.)
@@ -125,13 +126,13 @@ async function cutSourceIntoClips(drpInput, opts = {}) {
       // Embedded source timecode base, in SECONDS (harvested with the media
       // template). Donor default 0 makes Resolve seek the wrong TC and fail
       // the render with "Full resolution media not found at <TC>".
-      c = c.replace(/<MediaStartTime>[\s\S]*?<\/MediaStartTime>/, `<MediaStartTime>${cut.mediaStartTime}</MediaStartTime>`);
+      c = c.replace(/<MediaStartTime>[\s\S]*?<\/MediaStartTime>/, () => `<MediaStartTime>${cut.mediaStartTime}</MediaStartTime>`);
     }
     if (cut.timemap) {
       // Constant-speed retime: swap the identity MediaTimemapBA for the
       // caller-built Sm2TimeMap (r19 keyed form render/readback-verified;
       // the clip's <In>/<Duration> are RECORD-domain, measured live).
-      c = c.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, `<MediaTimemapBA>${cut.timemap}</MediaTimemapBA>`);
+      c = c.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, () => `<MediaTimemapBA>${cut.timemap}</MediaTimemapBA>`);
     }
     return c;
   };

package/resolve-advanced/vendor/drp-format/inject-grades.js

@@ -105,7 +105,7 @@ function replaceBodyForClip(seqXml, targetDbId, newBodyHex) {
   if (bodyAt < 0) return null;
   let newClipRange = clipRange.replace(
     bodyRe,
-    `<Body>${newBodyHex}</Body>`,
+    () => `<Body>${newBodyHex}</Body>`,
   );
 
   // 4. Mark the owning version as corrected. Resolve keeps a per-version

package/resolve-advanced/vendor/drp-format/media-template-cache.js

@@ -59,11 +59,11 @@ function transplantMediaElement(mpXml, seqXmls, { poolElement, mediaRef }) {
   const folderId = (mpXml.slice(start, end).match(/<MpFolder>([0-9a-f-]{36})<\/MpFolder>/) || [])[1];
   let element = poolElement;
   if (folderId) {
-    element = element.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, `<MpFolder>${folderId}</MpFolder>`);
+    element = element.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, () => `<MpFolder>${folderId}</MpFolder>`);
   }
   const outMp = mpXml.slice(0, start) + element + mpXml.slice(end);
   const outSeqs = seqXmls.map((seq) =>
-    seq.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/g, `<MediaRef>${mediaRef}</MediaRef>`),
+    seq.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/g, () => `<MediaRef>${mediaRef}</MediaRef>`),
   );
   return { mpXml: outMp, seqXmls: outSeqs };
 }
@@ -75,7 +75,7 @@ function insertMediaElement(mpXml, poolElement) {
   const folderId = (mpXml.match(/<Sm2MpVideoClip[^>]*>[\s\S]*?<MpFolder>([0-9a-f-]{36})<\/MpFolder>/) || [])[1];
   let element = poolElement;
   if (folderId) {
-    element = element.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, `<MpFolder>${folderId}</MpFolder>`);
+    element = element.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, () => `<MpFolder>${folderId}</MpFolder>`);
   }
   return mpXml.slice(0, close) + element + mpXml.slice(close);
 }

package/resolve-advanced/vendor/drp-format/place-compound.js

@@ -72,22 +72,22 @@ async function placeCompound(drpInput, opts = {}) {
   //    the cuts machinery, 0-based frames).
   let inner = fs.readFileSync(T('compound-inner-r19.xml'), 'utf8');
   inner = freshDbIds(inner);
-  inner = inner.replace(/<Sm2SequenceContainer DbId="[^"]+"/, `<Sm2SequenceContainer DbId="${innerContainerId}"`);
-  inner = inner.replace(/<Sequence>[0-9a-f-]{36}<\/Sequence>/g, `<Sequence>${innerSequenceId}</Sequence>`);
+  inner = inner.replace(/<Sm2SequenceContainer DbId="[^"]+"/, () => `<Sm2SequenceContainer DbId="${innerContainerId}"`);
+  inner = inner.replace(/<Sequence>[0-9a-f-]{36}<\/Sequence>/g, () => `<Sequence>${innerSequenceId}</Sequence>`);
   inner = inner.replace(/<Items>[\s\S]*?<\/Items>/g, '<Items/>');
   zip.file(`SeqContainer/${innerContainerId}.xml`, inner);
 
   // 2) Pool compound element: fresh identities + blob SeqRef patch.
   let pool = fs.readFileSync(T('compound-pool-r19.xml'), 'utf8');
-  pool = pool.replace(/<Sm2MpCompoundClip DbId="[^"]+"/, `<Sm2MpCompoundClip DbId="${compoundId}"`);
-  pool = pool.replace(/<Sm2Sequence DbId="[^"]+"/, `<Sm2Sequence DbId="${innerSequenceId}"`);
-  pool = pool.replace(/<UniqueSequenceId>[^<]*<\/UniqueSequenceId>/, `<UniqueSequenceId>${crypto.randomUUID()}</UniqueSequenceId>`);
-  pool = pool.replace(/<UniqueMediaPoolItemId>[^<]*<\/UniqueMediaPoolItemId>/, `<UniqueMediaPoolItemId>${crypto.randomUUID()}</UniqueMediaPoolItemId>`);
-  pool = pool.replace(/<SmPTZRPreset DbId="[^"]+"/, `<SmPTZRPreset DbId="${crypto.randomUUID()}"`);
+  pool = pool.replace(/<Sm2MpCompoundClip DbId="[^"]+"/, () => `<Sm2MpCompoundClip DbId="${compoundId}"`);
+  pool = pool.replace(/<Sm2Sequence DbId="[^"]+"/, () => `<Sm2Sequence DbId="${innerSequenceId}"`);
+  pool = pool.replace(/<UniqueSequenceId>[^<]*<\/UniqueSequenceId>/, () => `<UniqueSequenceId>${crypto.randomUUID()}</UniqueSequenceId>`);
+  pool = pool.replace(/<UniqueMediaPoolItemId>[^<]*<\/UniqueMediaPoolItemId>/, () => `<UniqueMediaPoolItemId>${crypto.randomUUID()}</UniqueMediaPoolItemId>`);
+  pool = pool.replace(/<SmPTZRPreset DbId="[^"]+"/, () => `<SmPTZRPreset DbId="${crypto.randomUUID()}"`);
   // The embedded sequence's <Parent> points BACK at the compound's own id —
   // the reference sweep found it as the one un-rewired link (a dangling
   // Parent is presumably as fatal as the dangling MpFolder/SeqRef were).
-  pool = pool.replace(/<Parent>[0-9a-f-]{36}<\/Parent>/, `<Parent>${compoundId}</Parent>`);
+  pool = pool.replace(/<Parent>[0-9a-f-]{36}<\/Parent>/, () => `<Parent>${compoundId}</Parent>`);
   {
     const fbM = pool.match(/(<Sm2Sequence DbId="[^"]+">\s*<FieldsBlob>)([0-9a-fA-F]+)(<\/FieldsBlob>)/);
     if (!fbM) throw new Error('placeCompound: embedded Sm2Sequence FieldsBlob not found');
@@ -96,14 +96,14 @@ async function placeCompound(drpInput, opts = {}) {
     if (!seqRef) throw new Error('placeCompound: embedded blob has no SeqRef entry — schema drift, refusing to author a crasher');
     seqRef.value = innerContainerId;
     const patched = encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex');
-    pool = pool.replace(fbM[0], `${fbM[1]}${patched}${fbM[3]}`);
+    pool = pool.replace(fbM[0], () => `${fbM[1]}${patched}${fbM[3]}`);
   }
-  pool = pool.replace(/<Name>[^<]*<\/Name>/, `<Name>${escapeXml(name)}</Name>`);
+  pool = pool.replace(/<Name>[^<]*<\/Name>/, () => `<Name>${escapeXml(name)}</Name>`);
   // MediaExtents = [startSec, durationSec] LE doubles; inner starts at 0.
   const me = Buffer.alloc(16);
   me.writeDoubleLE(0, 0);
   me.writeDoubleLE(durationFrames / fps, 8);
-  pool = pool.replace(/<MediaExtents>[0-9a-fA-F]*<\/MediaExtents>/, `<MediaExtents>${me.toString('hex')}</MediaExtents>`);
+  pool = pool.replace(/<MediaExtents>[0-9a-fA-F]*<\/MediaExtents>/, () => `<MediaExtents>${me.toString('hex')}</MediaExtents>`);
   // Attach to the primary MediaPool folder — and point the element's
   // <MpFolder> at THAT folder's DbId (the template's value references the
   // harvest project's folder; a dangling folder ref CRASHES Resolve on
@@ -112,22 +112,22 @@ async function placeCompound(drpInput, opts = {}) {
   let mpXml = await zip.file(mpPath).async('string');
   const folderId = (mpXml.match(/<Sm2MpFolder DbId="([^"]+)"/) || [])[1];
   if (!folderId) throw new Error('placeCompound: target MpFolder has no Sm2MpFolder DbId');
-  pool = pool.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, `<MpFolder>${folderId}</MpFolder>`);
-  mpXml = mpXml.replace('</MediaVec>', `${pool}\n  </MediaVec>`);
+  pool = pool.replace(/<MpFolder>[0-9a-f-]{36}<\/MpFolder>/, () => `<MpFolder>${folderId}</MpFolder>`);
+  mpXml = mpXml.replace('</MediaVec>', () => `${pool}\n  </MediaVec>`);
   zip.file(mpPath, mpXml);
 
   // 3) Parent item: template clone → fresh id, name, placement, MediaRef,
   //    identity timemap over the inner content ((frames − 0.5)/fps, measured).
   let item = fs.readFileSync(T('compound-item-r19.xml'), 'utf8').trim();
   item = freshDbIds(item);
-  item = item.replace(/<Name>[^<]*<\/Name>/, `<Name>${escapeXml(name)}</Name>`);
-  item = item.replace(/<Start>\d+<\/Start>/, `<Start>${startFrame}</Start>`);
-  item = item.replace(/<Duration>\d+<\/Duration>/, `<Duration>${durationFrames}</Duration>`);
-  item = item.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/, `<MediaRef>${compoundId}</MediaRef>`);
+  item = item.replace(/<Name>[^<]*<\/Name>/, () => `<Name>${escapeXml(name)}</Name>`);
+  item = item.replace(/<Start>\d+<\/Start>/, () => `<Start>${startFrame}</Start>`);
+  item = item.replace(/<Duration>\d+<\/Duration>/, () => `<Duration>${durationFrames}</Duration>`);
+  item = item.replace(/<MediaRef>[0-9a-f-]{36}<\/MediaRef>/, () => `<MediaRef>${compoundId}</MediaRef>`);
   const tm = Buffer.alloc(9);
   tm.writeUInt8(0x02, 0);
   tm.writeDoubleBE((durationFrames - 0.5) / fps, 1);
-  item = item.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, `<MediaTimemapBA>${tm.toString('hex')}</MediaTimemapBA>`);
+  item = item.replace(/<MediaTimemapBA>[0-9a-fA-F]*<\/MediaTimemapBA>/, () => `<MediaTimemapBA>${tm.toString('hex')}</MediaTimemapBA>`);
 
   const { match: vec, tracks } = getTrackVec(parentXml, 'video');
   if (track > tracks.length) throw new Error(`placeCompound: parent video track ${track} does not exist (${tracks.length})`);

package/resolve-advanced/vendor/drp-format/place-fusion-title.js

@@ -96,14 +96,14 @@ async function placeFusionTitle(drpInput, opts = {}) {
     throw new Error('placeFusionTitle: template is not a Fusion Title clip');
   }
   clip = freshDbIds(clip);
-  clip = clip.replace(/<Start>\d+<\/Start>/, `<Start>${startFrame}</Start>`);
-  clip = clip.replace(/<Duration>\d+<\/Duration>/, `<Duration>${durationFrames}</Duration>`);
-  if (name) clip = clip.replace(/<Name>[\s\S]*?<\/Name>/, `<Name>${escapeXml(name)}</Name>`);
+  clip = clip.replace(/<Start>\d+<\/Start>/, () => `<Start>${startFrame}</Start>`);
+  clip = clip.replace(/<Duration>\d+<\/Duration>/, () => `<Duration>${durationFrames}</Duration>`);
+  if (name) clip = clip.replace(/<Name>[\s\S]*?<\/Name>/, () => `<Name>${escapeXml(name)}</Name>`);
   const titleInputs = { text, font, style, size, vJustify, hJustify, color };
   if (Object.values(titleInputs).some((v) => v !== undefined && v !== null)) {
     const m = clip.match(/<CompositionBA>([0-9a-fA-F]*)<\/CompositionBA>/);
     if (!m || !m[1]) throw new Error('placeFusionTitle: template has no CompositionBA to style');
-    clip = clip.replace(m[0], `<CompositionBA>${setTitleInputs(m[1], titleInputs)}</CompositionBA>`);
+    clip = clip.replace(m[0], () => `<CompositionBA>${setTitleInputs(m[1], titleInputs)}</CompositionBA>`);
   }
 
   // Locate VideoTrackVec and split into track elements.

package/resolve-advanced/vendor/drp-format/place-generator.js

@@ -75,17 +75,17 @@ async function placeGenerator(drpInput, opts = {}) {
 
   let gen = fs.readFileSync(snippetPathFor(templateVersion), 'utf8').trim();
   gen = freshDbIds(gen);
-  gen = gen.replace(/<PrettyType>[\s\S]*?<\/PrettyType>/, `<PrettyType>${escapeXml(generatorName)}</PrettyType>`);
-  gen = gen.replace(/<Name>[\s\S]*?<\/Name>/, `<Name>${escapeXml(generatorName)}</Name>`);
-  gen = gen.replace(/<Start>\d+<\/Start>/, `<Start>${startFrame}</Start>`);
-  gen = gen.replace(/<Duration>\d+<\/Duration>/, `<Duration>${durationFrames}</Duration>`);
+  gen = gen.replace(/<PrettyType>[\s\S]*?<\/PrettyType>/, () => `<PrettyType>${escapeXml(generatorName)}</PrettyType>`);
+  gen = gen.replace(/<Name>[\s\S]*?<\/Name>/, () => `<Name>${escapeXml(generatorName)}</Name>`);
+  gen = gen.replace(/<Start>\d+<\/Start>/, () => `<Start>${startFrame}</Start>`);
+  gen = gen.replace(/<Duration>\d+<\/Duration>/, () => `<Duration>${durationFrames}</Duration>`);
   const colorNorm = color != null ? normalizeColor(color) : null;
   if (colorNorm) {
     const blob = solidColorEffectBlob(colorNorm);
     if (!/<EffectFiltersBA\s*\/>|<EffectFiltersBA>\s*<\/EffectFiltersBA>/.test(gen)) {
       throw new Error('placeGenerator: template carries no empty <EffectFiltersBA/> to populate with the colour');
     }
-    gen = gen.replace(/<EffectFiltersBA\s*\/>|<EffectFiltersBA>\s*<\/EffectFiltersBA>/, `<EffectFiltersBA>${blob}</EffectFiltersBA>`);
+    gen = gen.replace(/<EffectFiltersBA\s*\/>|<EffectFiltersBA>\s*<\/EffectFiltersBA>/, () => `<EffectFiltersBA>${blob}</EffectFiltersBA>`);
   }
 
   const { match: vtv, tracks } = getTrackVec(seqXml, 'video');

package/resolve-advanced/vendor/drp-format/place-subtitles.js

@@ -94,9 +94,9 @@ async function placeSubtitles(drpInput, opts = {}) {
     '    <UserDefinedName/>\n    <LayersVec/>\n   </Sm2TiTrack>\n  </Element>\n ';
   let xml;
   if (/<SubtitleTrackVec\/>/.test(seqXml)) {
-    xml = seqXml.replace('<SubtitleTrackVec/>', `<SubtitleTrackVec>${track}</SubtitleTrackVec>`);
+    xml = seqXml.replace('<SubtitleTrackVec/>', () => `<SubtitleTrackVec>${track}</SubtitleTrackVec>`);
   } else if (/<SubtitleTrackVec>/.test(seqXml)) {
-    xml = seqXml.replace('</SubtitleTrackVec>', `${track}</SubtitleTrackVec>`);
+    xml = seqXml.replace('</SubtitleTrackVec>', () => `${track}</SubtitleTrackVec>`);
   } else {
     throw new Error('placeSubtitles: timeline has no SubtitleTrackVec');
   }

package/resolve-advanced/vendor/drp-format/place-transition.js

@@ -115,9 +115,9 @@ async function placeTransition(drpInput, opts = {}) {
   let trans = fs.readFileSync(trackType === 'audio' ? AUDIO_TEMPLATE_PATH : TEMPLATE_PATH, 'utf8').trim();
   trans = freshDbIds(trans);
   if (type === 'wipe') {
-    trans = trans.replace(/<FieldsBlob>[0-9a-fA-F]*<\/FieldsBlob>/, `<FieldsBlob>${WIPE_FIELDS_BLOB}</FieldsBlob>`);
+    trans = trans.replace(/<FieldsBlob>[0-9a-fA-F]*<\/FieldsBlob>/, () => `<FieldsBlob>${WIPE_FIELDS_BLOB}</FieldsBlob>`);
   } else if (STYLE_PRETTY_TYPES[type]) {
-    trans = trans.replace(/<PrettyType>Cross Dissolve<\/PrettyType>/, `<PrettyType>${STYLE_PRETTY_TYPES[type]}</PrettyType>`);
+    trans = trans.replace(/<PrettyType>Cross Dissolve<\/PrettyType>/, () => `<PrettyType>${STYLE_PRETTY_TYPES[type]}</PrettyType>`);
   }
   // Span geometry follows <Start>/<Duration>, NOT AlignmentType (the E61
   // harvest of Resolve's own EDL import carries AlignmentType 2 with the
@@ -132,12 +132,12 @@ async function placeTransition(drpInput, opts = {}) {
     }
   }
   const start = spanStart !== undefined ? spanStart : atFrame - Math.floor(durationFrames / 2);
-  trans = trans.replace(/<Start>\d+<\/Start>/, `<Start>${start}</Start>`);
-  trans = trans.replace(/<Duration>\d+<\/Duration>/, `<Duration>${durationFrames}</Duration>`);
+  trans = trans.replace(/<Start>\d+<\/Start>/, () => `<Start>${start}</Start>`);
+  trans = trans.replace(/<Duration>\d+<\/Duration>/, () => `<Duration>${durationFrames}</Duration>`);
   const transitionDbId = (trans.match(/<Sm2TiTransition DbId="([^"]+)"/) || [])[1] || null;
 
   // Insert the transition <Element> immediately after the left clip's <Element> in <Items>.
-  const newItems = items.replace(clips[leftIdx], `${clips[leftIdx]}${trans}`);
+  const newItems = items.replace(clips[leftIdx], () => `${clips[leftIdx]}${trans}`);
   tracks[track - 1] = setItemsInner(tracks[track - 1], newItems);
 
   const xml = replaceTrackVec(seqXml, trackType, vec, tracks);

package/resolve-advanced/vendor/drp-format/seq-surgery.js

@@ -89,9 +89,9 @@ function getItemsInner(trackElement) {
 function setItemsInner(trackElement, inner) {
   const body = inner && inner.trim() ? inner : null;
   if (/<Items\s*\/>/.test(trackElement)) {
-    return body ? trackElement.replace(/<Items\s*\/>/, `<Items>${body}</Items>`) : trackElement;
+    return body ? trackElement.replace(/<Items\s*\/>/, () => `<Items>${body}</Items>`) : trackElement;
   }
-  return trackElement.replace(/<Items>[\s\S]*?<\/Items>/, body ? `<Items>${body}</Items>` : '<Items/>');
+  return trackElement.replace(/<Items>[\s\S]*?<\/Items>/, () => (body ? `<Items>${body}</Items>` : '<Items/>'));
 }
 
 function insertClipIntoTrack(trackElement, clipElement) {

package/resolve-advanced/vendor/drp-format/splice-clips.js

@@ -37,10 +37,10 @@ function clipDuration(clipXml) {
   return m ? parseInt(m[1], 10) : null;
 }
 function setClipStart(clipXml, v) {
-  return clipXml.replace(/<Start>\d+<\/Start>/, `<Start>${v}</Start>`);
+  return clipXml.replace(/<Start>\d+<\/Start>/, () => `<Start>${v}</Start>`);
 }
 function setClipDuration(clipXml, v) {
-  return clipXml.replace(/<Duration>\d+<\/Duration>/, `<Duration>${v}</Duration>`);
+  return clipXml.replace(/<Duration>\d+<\/Duration>/, () => `<Duration>${v}</Duration>`);
 }
 // The source IN-point lives in <In> as `<framePos>|<LE-double of framePos*0.001>`, where framePos
 // is in TIMELINE frames (verified live: Resolve appended a clip with source-in 600 media-frames @29.97
@@ -57,8 +57,8 @@ function clipIn(clipXml) {
 }
 function setClipIn(clipXml, framePos) {
   const enc = `<In>${encodeSourceIn(framePos)}</In>`;
-  if (/<In\s*\/>/.test(clipXml)) return clipXml.replace(/<In\s*\/>/, enc);
-  if (/<In>[^<]*<\/In>/.test(clipXml)) return clipXml.replace(/<In>[^<]*<\/In>/, enc);
+  if (/<In\s*\/>/.test(clipXml)) return clipXml.replace(/<In\s*\/>/, () => enc);
+  if (/<In>[^<]*<\/In>/.test(clipXml)) return clipXml.replace(/<In>[^<]*<\/In>/, () => enc);
   return clipXml; // no In element to set
 }
 // A FROZEN clip carries an EMPTY <In/> (harvested live from an EDL M2 000.0
@@ -77,7 +77,7 @@ function mapClipsOnTrack(trackElement, fn) {
   let out = inner;
   for (const c of splitClipElements(inner)) {
     const nc = fn(c);
-    if (nc !== c) out = out.replace(c, nc);
+    if (nc !== c) out = out.replace(c, () => nc);
   }
   return setItemsInner(trackElement, out);
 }
@@ -143,7 +143,7 @@ async function moveClip(drpInput, opts = {}) {
   // Optionally retime.
   if (toStart !== undefined && toStart !== null) {
     if (!Number.isInteger(toStart)) throw new TypeError('moveClip: toStart must be an integer');
-    clip = clip.replace(/<Start>\d+<\/Start>/, `<Start>${toStart}</Start>`);
+    clip = clip.replace(/<Start>\d+<\/Start>/, () => `<Start>${toStart}</Start>`);
   }
 
   // Grow to the destination track with empty clones, then insert.
@@ -263,7 +263,7 @@ async function trimClip(drpInput, opts = {}) {
   const tStart = clipStart(target);
   const trimmedClipDbId = clipDbId(target);
 
-  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, setClipDuration(target, newDuration)));
+  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => setClipDuration(target, newDuration)));
   if (ripple && oldDuration !== null && tStart !== null) {
     const delta = newDuration - oldDuration;
     const tEnd = tStart + oldDuration;
@@ -335,7 +335,7 @@ async function trimClipHead(drpInput, opts = {}) {
   edited = setClipDuration(edited, newDur);
   edited = setClipStart(edited, newStart);
 
-  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, edited));
+  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => edited));
   if (ripple) {
     track = mapClipsOnTrack(track, (c) => {
       const s = clipStart(c);
@@ -399,7 +399,7 @@ async function splitClip(drpInput, opts = {}) {
   right = setClipDuration(right, rightDur);
   right = setClipIn(right, leftIn + leftDur); // source continues where left ended
 
-  const track = setItemsInner(tracks[trackIdx - 1], items.replace(target, `${left}${right}`));
+  const track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => `${left}${right}`));
   tracks[trackIdx - 1] = track;
 
   const xml = replaceTrackVec(seqXml, trackType, vtv, tracks);

package/resolve-advanced/vendor/drt-format/resolve-versions.js

@@ -70,7 +70,7 @@ function restampVersions(xmlStr, src, target) {
   return xmlStr
     .split(`DbAppVer="${src.dbAppVer}"`).join(`DbAppVer="${target.dbAppVer}"`)
     .split(`DbPrjVer="${src.dbPrjVer}"`).join(`DbPrjVer="${target.dbPrjVer}"`)
-    .replace(PROJECT_VERSION_RE, `<ProjectVersion>${target.dbPrjVer}</ProjectVersion>`);
+    .replace(PROJECT_VERSION_RE, () => `<ProjectVersion>${target.dbPrjVer}</ProjectVersion>`);
 }
 
 /**

package/resolve-advanced/vendor/drx-codec/color-nlp-parser.js

@@ -88,7 +88,7 @@ function expandSynonyms(text, synonyms) {
       const regex = new RegExp(`\\b${alt}\\b`, 'gi');
       if (regex.test(expanded)) {
         // Don't replace, just note the canonical form
-        expanded = expanded.replace(regex, canonical);
+        expanded = expanded.replace(regex, () => canonical);
       }
     }
   }

package/src/granular/common.py

@@ -92,7 +92,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.18.0"
+VERSION = "4.18.2"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.18.0"
+VERSION = "4.18.2"
 
 import base64
 import os
@@ -13357,7 +13357,9 @@ def _media_analysis_replace_owned_block(existing: Any, body: Any) -> str:
         + re.escape(_MCP_METADATA_BLOCK_END)
     )
     if re.search(pattern, existing_text, flags=re.DOTALL):
-        return re.sub(pattern, block, existing_text, flags=re.DOTALL).strip()
+        # A function replacement inserts the block literally: as a string, a
+        # backslash in the analysis text (a Windows path) is read as an escape.
+        return re.sub(pattern, lambda _match: block, existing_text, flags=re.DOTALL).strip()
     return f"{existing_text}\n\n{block}".strip() if existing_text else block