davinci-resolve-mcp 4.18.1 → 4.18.2

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.18.2 — The rest of the `$` replacement bugs
+
+v4.18.1 fixed `replace()` calls that put user text in with an interpolated
+template string. Its guard only looked for that one form, so calls whose
+replacement was a variable, a function call or a conditional were missed.
+
+### Fixed
+
+- **Splitting, trimming, adding a transition, or adding a clip to a track that
+  already has clips no longer corrupts the track when a clip name contains
+  `$`** (#333, thanks @Dev-next-gen). The rewritten clip went into the track
+  as a replacement string, so `$&` or `` $` `` in a name copied other clips into
+  the track and duplicated them.
+- **`media_ops` `relink_manifest` keeps a `$` in a target path prefix as
+  typed.** Mapping `/old/vol` to `/new/Spot $$ 30s $&` produced
+  `/new/Spot $ 30s /old/vol/...`, a path that does not exist.
+- The same form, now fixed, was also in `assemble_timeline` (the timeline's
+  pool block, which holds its name, when the media extents are rewritten),
+  in the subtitle preset writer (the preset section XML), and in the agent-rule
+  generator (generated doc sections). The other changed calls only insert hex,
+  IDs or numbers; they now use replacer functions too, so a single rule holds
+  everywhere.
+
+### Changed
+
+- The guard test now splits every `replace()` / `replaceAll()` call in
+  `resolve-advanced` and `scripts/` into its arguments, and fails unless the
+  replacement is a function or a literal with no `$` in it. Literals whose
+  `$`-sequences are backreferences (`$1`, `'\\$&'`) are allowed. The
+  `editorial` source-alias rules and the `media_ops` rename rules, where `$1`
+  is part of the feature, are listed by name. Run against the v4.18.1 sources,
+  it reports 25 call sites, including all six that #333 fixed.
+
+### Validation
+
+- Advanced Node suite on Node 20 with a fresh `npm ci`: 1,227 tests, 0 failed.
+  Python suite: 4,295 tests; the only failures are the 4 `source_media_guard`
+  path checks that always fail in a scratch worktree. With #333's fix
+  reverted, its two tests fail. The new relink test
+  fails on the v4.18.1 code with the wrong path shown above.
+- Offline file writers only. No Resolve API behaviour changed.
+
 ## What's New in v4.18.1 — Names with `$` or `\` are written as typed
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.18.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.18.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(390%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.18.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.18.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(390%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.18.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.18.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.18.1"
+VERSION = "4.18.2"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.18.1",
+  "version": "4.18.2",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/resolve-advanced/server/lut-apply.mjs

@@ -42,7 +42,7 @@ export async function applyLut(ref, opts = {}) {
   const xml = ref.content != null ? ref.content : await fs.readFile(ref.drxPath, 'utf8');
   const bodyHex = extractBodyHex(xml);
   const newBodyHex = await injectNodeLut(bodyHex, nodeIndex, { lutPath: opts.lutPath, slotMeta });
-  const newXml = xml.replace(BODY_RE, `<Body>${newBodyHex}</Body>`);
+  const newXml = xml.replace(BODY_RE, () => `<Body>${newBodyHex}</Body>`);
 
   // ROUND-TRIP ASSERT: decode the patched grade and confirm the LUT ref survives.
   const parsed = await drxParser().parseDRXContent(newXml);

package/resolve-advanced/server/media-ops.mjs

@@ -107,7 +107,7 @@ export function relinkManifest(offlinePaths, pathMap = [], opts = {}) {
       continue;
     }
     const m = matches[0];
-    const target = src.replace(m.from, m.to);
+    const target = src.replace(m.from, () => m.to);
     if (opts.checkExists === false || fs.existsSync(target)) relinkable.push({ from: src, to: target, verified: opts.checkExists !== false });
     else stillOffline.push({ from: src, to: target, reason: 'target does not exist' });
   }

package/resolve-advanced/server/subtitle-timeline.mjs

@@ -61,15 +61,15 @@ export async function editSubtitleTimeline({ source, output, track = 1, inputs =
       .filter(m => m.decoded.templateId === template_id);
     if (matches.length !== 1) throw new Error('Native title reference must contain exactly one matching composition');
     const scaffold = before ?? holder(await fs.readFile(new URL('../assets/lollipop-track.xml', import.meta.url), 'utf8'));
-    chosen = { ...matches[0], text: scaffold.text.replace(scaffold.hex, matches[0].hex) };
+    chosen = { ...matches[0], text: scaffold.text.replace(scaffold.hex, () => matches[0].hex) };
   }
   if (!chosen) throw new Error('No animation preset: supply a native preset_reference DRT or apply Word Highlight through the live Effects UI');
   const patched = Object.keys(parsed.inputs).length
     ? setPresetInputs(Buffer.from(chosen.hex, 'hex'), parsed.inputs) : Buffer.from(chosen.hex, 'hex');
-  const section = freshIds(chosen.text.replace(chosen.hex, patched.toString('hex')));
+  const section = freshIds(chosen.text.replace(chosen.hex, () => patched.toString('hex')));
   let text;
-  if (before) text = target.text.replace(before.text, section);
-  else if (/<FusionCompHolderItems\s*\/>/.test(target.text)) text = target.text.replace(/<FusionCompHolderItems\s*\/>/, section);
+  if (before) text = target.text.replace(before.text, () => section);
+  else if (/<FusionCompHolderItems\s*\/>/.test(target.text)) text = target.text.replace(/<FusionCompHolderItems\s*\/>/, () => section);
   else throw new Error('Unsupported track: missing FusionCompHolderItems field');
   const xml = exported.xml.slice(0, target.offset) + text + exported.xml.slice(target.offset + target.text.length);
   // Resolve remaps timeline identity on import. Keep cross-entry sequence
@@ -142,7 +142,7 @@ export async function editCaptionTimeline({ source, output, track = 1, add = [],
   const elements = final.map((c) => {
     const s = stagedById.get(c.id);
     if (!s) return byId.get(c.id).text;
-    let text = s.fresh ? template.text.replace(template.dbId, randomUUID()) : s.base.text;
+    let text = s.fresh ? template.text.replace(template.dbId, () => randomUUID()) : s.base.text;
     if (s.fresh) text = text.replace(/<(MarkersBA|RenderCacheBA|ImportExportMetadataBA)>[\s\S]*?<\/\1>/g, '<$1/>');
     text = setTag(text, 'FieldsBlob', s.blob.toString('hex'));
     text = setTag(text, 'Name', xmlEscape(` ${s.caption.text}`));

package/resolve-advanced/server/tools/drt.mjs

@@ -475,7 +475,7 @@ export const drtTool = {
           const seqRef = dict.entries.find((e) => e.key === 'SeqRef');
           if (seqRef && remap.has(String(seqRef.value))) {
             seqRef.value = remap.get(String(seqRef.value));
-            tlNew = tlNew.replace(fbM[0], `${fbM[1]}${encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex')}${fbM[3]}`);
+            tlNew = tlNew.replace(fbM[0], () => `${fbM[1]}${encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex')}${fbM[3]}`);
           }
         }
         for (const [n, xml] of Object.entries(containers)) {

package/resolve-advanced/server/tools/drx.mjs

@@ -844,7 +844,7 @@ export const drxTool = {
       });
       // Splice the new Body into the ORIGINAL envelope (byte-lossless outside the
       // position varints — labels, keyframes, OFX, still metadata all pass through).
-      const out = xml.replace(m[0], `<Body>${r.bodyHex}</Body>`);
+      const out = xml.replace(m[0], () => `<Body>${r.bodyHex}</Body>`);
       // Guard: the rewrite must not change the node count (silent-corruption check).
       const reparsed = await drxParser().parseDRXContent(out);
       if ((reparsed.nodes || []).length !== r.nodeCount) {

package/resolve-advanced/vendor/drp-format/__tests__/literal-replacement.test.js

@@ -3,8 +3,9 @@
 // way into the XML (#332: `R2 $& $'` as a timeline name made MpFolder.xml
 // unparseable; `Spot $$ 30s` came out as `Spot $ 30s`). Interpolated
 // replacements are therefore passed as functions, which insert their result
-// literally. This file guards that rule and checks the writers that carry user
-// text.
+// literally. This file guards that rule for every replace() call (#333 found
+// forms the first guard missed: a variable, a call or a conditional as the
+// replacement) and checks the writers that carry user text.
 
 const test = require('node:test');
 const assert = require('node:assert');
@@ -16,12 +17,15 @@ const { createEmptyProject } = require('../author-project');
 const { placeSubtitles } = require('../place-subtitles');
 const { placeGenerator } = require('../place-generator');
 const { placeFusionTitle } = require('../place-fusion-title');
+const { splitClip, trimClip, trimClipHead } = require('../splice-clips');
+const { placeTransition } = require('../place-transition');
 
 const ROOT = path.resolve(__dirname, '..', '..', '..');
 const TRICKY = "Spot $$ 30s $& $' $` end";
 
 function sourceFiles(dir) {
   const out = [];
+  if (!fs.existsSync(dir)) return out;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     if (entry.name === 'node_modules' || entry.name === '__tests__') continue;
     const full = path.join(dir, entry.name);
@@ -31,38 +35,134 @@ function sourceFiles(dir) {
   return out;
 }
 
-// `.replace(<string or regex literal>, `...${...}...`)` on one line. A template
-// that uses a $-backreference ($1, $&, $<name>) needs the string form and is allowed.
-const STRING_REPLACEMENT = /\.replace\(\s*(?:'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|\/(?:[^/\\\n]|\\.)+\/[a-z]*)\s*,\s*`((?:[^`\\]|\\.)*)`/g;
+// A small scanner, enough to split each replace() call into its arguments: it
+// skips strings, templates, regex literals and comments, and matches brackets.
+const REGEX_CAN_FOLLOW = '(,=:[!&|?{};+-*%<>~^';
+function prevSignificant(s, i) {
+  let j = i - 1;
+  while (j >= 0 && /\s/.test(s[j])) j -= 1;
+  return j >= 0 ? s[j] : '';
+}
+function skipString(s, i) {
+  const q = s[i];
+  i += 1;
+  while (s[i] !== q) i += s[i] === '\\' ? 2 : 1;
+  return i + 1;
+}
+function skipTemplate(s, i) {
+  i += 1;
+  while (s[i] !== '`') {
+    if (s[i] === '\\') i += 2;
+    else if (s.startsWith('${', i)) i = skipBracketed(s, i + 1);
+    else i += 1;
+  }
+  return i + 1;
+}
+function skipRegex(s, i) {
+  let inClass = false;
+  for (i += 1; ; i += 1) {
+    const c = s[i];
+    if (c === '\\') { i += 1; continue; }
+    if (c === '\n' || c === undefined) return -1;
+    if (c === '[') inClass = true;
+    else if (c === ']') inClass = false;
+    else if (c === '/' && !inClass) break;
+  }
+  i += 1;
+  while (/[a-z]/.test(s[i] || '')) i += 1;
+  return i;
+}
+// Skip a string, template, comment or regex literal at i; return the index after
+// it, or -1 when none starts there.
+function skipAtom(s, i) {
+  const c = s[i];
+  if (c === "'" || c === '"') return skipString(s, i);
+  if (c === '`') return skipTemplate(s, i);
+  if (c === '/' && s[i + 1] === '/') return s.indexOf('\n', i);
+  if (c === '/' && s[i + 1] === '*') return s.indexOf('*/', i) + 2;
+  if (c === '/' && REGEX_CAN_FOLLOW.includes(prevSignificant(s, i))) return skipRegex(s, i);
+  return -1;
+}
+function skipBracketed(s, i) {
+  let depth = 0;
+  while (i < s.length) {
+    const next = skipAtom(s, i);
+    if (next > i) { i = next; continue; }
+    if ('([{'.includes(s[i])) depth += 1;
+    else if (')]}'.includes(s[i]) && --depth === 0) return i + 1;
+    i += 1;
+  }
+  return s.length;
+}
+function callArguments(s, open) {
+  const close = skipBracketed(s, open) - 1;
+  const args = [];
+  let start = open + 1;
+  for (let i = start; i < close; ) {
+    const next = skipAtom(s, i);
+    if (next > i) { i = next; continue; }
+    if ('([{'.includes(s[i])) { i = skipBracketed(s, i); continue; }
+    if (s[i] === ',') { args.push(s.slice(start, i).trim()); start = i + 1; }
+    i += 1;
+  }
+  args.push(s.slice(start, close).trim());
+  return args;
+}
+
 const BACKREF = /\$(?:[0-9&'`]|<[A-Za-z_]\w*>)/;
+// Replacements that are rules a caller writes, where $1 and $& are the feature.
+const INTENDED = new Set([
+  'server/editorial.mjs: a.replace',
+  "server/media-ops.mjs: rule.replace ?? ''",
+]);
 
-function offenders(text) {
+// The replacement of every .replace()/.replaceAll() call must be a function, or a
+// literal with no $ in it. A literal whose $-sequences are backreferences ($1,
+// $&) is deliberate and allowed; anything else (a variable, a call, an
+// interpolated template) may carry a $ and is reported.
+function offenders(text, file = '') {
   const found = [];
-  for (const m of text.matchAll(STRING_REPLACEMENT)) {
-    const template = m[1];
-    if (!template.includes('${')) continue;
-    if (BACKREF.test(template.replace(/\$\{[^}]*\}/g, ''))) continue;
-    found.push(m[0].slice(0, 120));
+  for (const m of text.matchAll(/\.(?:replace|replaceAll)\(/g)) {
+    const args = callArguments(text, m.index + m[0].length - 1);
+    if (args.length < 2) continue;
+    const rep = args[1];
+    if (/^(async\s+)?(\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|^function\b/.test(rep)) continue;
+    const literal = /^(['"`])[\s\S]*\1$/.test(rep);
+    if (literal && !rep.includes('$')) continue;
+    if (literal && BACKREF.test(rep.replace(/\$\{[^}]*\}/g, ''))) continue;
+    if (INTENDED.has(`${file}: ${rep}`)) continue;
+    found.push(`${file}: .replace(${args[0].slice(0, 40)}, ${rep.slice(0, 60)})`);
   }
   return found;
 }
 
-test('no interpolated replace() replacement is passed as a string', () => {
-  const files = [...sourceFiles(path.join(ROOT, 'server')), ...sourceFiles(path.join(ROOT, 'vendor'))];
+test('every replace() replacement is a function or a $-free literal', () => {
+  const dirs = ['server', 'vendor', 'bin', '../scripts', '../bin'].map((d) => path.join(ROOT, d));
+  const files = dirs.flatMap(sourceFiles);
   assert.ok(files.length > 50, `scanned ${files.length} files`);
-  const bad = [];
-  for (const file of files) {
-    for (const hit of offenders(fs.readFileSync(file, 'utf8'))) bad.push(`${path.relative(ROOT, file)}: ${hit}`);
-  }
-  assert.deepStrictEqual(bad, [], 'pass the replacement as () => `...` so $-sequences stay literal');
+  const bad = files.flatMap((file) => offenders(fs.readFileSync(file, 'utf8'), path.relative(ROOT, file).split(path.sep).join('/')));
+  assert.deepStrictEqual(bad, [], 'pass the replacement as () => ... so $-sequences in it stay literal');
 });
 
-test('the guard catches the #332 form and allows the safe ones', () => {
-  assert.strictEqual(offenders("x.replace('</MediaVec>', `${el}\\n</MediaVec>`)").length, 1);
-  assert.strictEqual(offenders('x.replace(/<Name>[^<]*<\\/Name>/, `<Name>${n}</Name>`)').length, 1);
-  assert.strictEqual(offenders("x.replace('</MediaVec>', () => `${el}\\n</MediaVec>`)").length, 0);
-  assert.strictEqual(offenders('x.replace(/(<a>)<b\\/>/, `$1<b>${hex}</b>`)').length, 0);
-  assert.strictEqual(offenders("x.replace('a', 'b')").length, 0);
+test('the guard catches each string form and allows the safe ones', () => {
+  const caught = [
+    "x.replace('</MediaVec>', `${el}\\n</MediaVec>`)", // #332
+    'x.replace(/<Name>[^<]*<\\/Name>/, `<Name>${n}</Name>`)',
+    'out.replace(c, nc)', // #333
+    'items.replace(target, setClipDuration(target, d))',
+    'x.replace(/<Items>[\\s\\S]*?<\\/Items>/, body ? `<Items>${body}</Items>` : "<Items/>")',
+    'x.replaceAll(a, b)',
+  ];
+  for (const code of caught) assert.strictEqual(offenders(code).length, 1, code);
+  const allowed = [
+    "x.replace('</MediaVec>', () => `${el}\\n</MediaVec>`)",
+    'x.replace(/(<a>)<b\\/>/, `$1<b>${hex}</b>`)',
+    "x.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')",
+    "x.replace('a', 'b')",
+    'x.replace(re, (m, g) => g.toUpperCase())',
+    "x.replace(re, function (m) { return m + ', '; })",
+  ];
+  for (const code of allowed) assert.strictEqual(offenders(code).length, 0, code);
 });
 
 async function sequenceXml(buffer) {
@@ -93,3 +193,34 @@ test('placeFusionTitle keeps $-sequences in the clip name', async () => {
   const res = await placeFusionTitle(buffer, { trackIndex: 2, startFrame, durationFrames: 24, name: TRICKY });
   assert.ok((await sequenceXml(res.buffer)).includes(`<Name>${escapeXml(TRICKY)}</Name>`));
 });
+
+// A second clip on a track goes through the populated-track branch of
+// setItemsInner, and splitClip/placeTransition rewrite the clip in place. A
+// string replacement there copies the matched <Items> block ($&) and the text
+// around it ($`, $') into the track, duplicating clips.
+const nameCount = (xml) => xml.split(`<Name>${escapeXml(TRICKY)}</Name>`).length - 1;
+
+async function titledTrack() {
+  const { buffer, startFrame } = await createEmptyProject({ timelineName: 'Track' });
+  const first = await placeFusionTitle(buffer, { trackIndex: 2, startFrame, durationFrames: 24, name: TRICKY });
+  const second = await placeFusionTitle(first.buffer, { trackIndex: 2, startFrame: startFrame + 24, durationFrames: 24, name: 'Next' });
+  return { buffer: second.buffer, startFrame };
+}
+
+test('a clip added to a populated track leaves the clip already there intact', async () => {
+  const xml = await sequenceXml((await titledTrack()).buffer);
+  assert.strictEqual(nameCount(xml), 1);
+  assert.strictEqual(xml.split('<Name>Next</Name>').length - 1, 1);
+});
+
+test('splitClip, trimClip, trimClipHead and placeTransition keep $-sequences in the clip name', async () => {
+  const { buffer, startFrame } = await titledTrack();
+  for (const trim of [trimClip, trimClipHead]) {
+    const res = await trim(buffer, { track: 2, clipIndex: 0, newDuration: 12, frames: 6, ripple: true });
+    assert.strictEqual(nameCount(await sequenceXml(res.buffer)), 1);
+  }
+  const split = await splitClip(buffer, { track: 2, at: startFrame + 12 });
+  assert.strictEqual(nameCount(await sequenceXml(split.buffer)), 2);
+  const res = await placeTransition(buffer, { track: 2, atFrame: startFrame + 24 });
+  assert.strictEqual(nameCount(await sequenceXml(res.buffer)), 1);
+});

package/resolve-advanced/vendor/drp-format/assemble-timeline.js

@@ -438,7 +438,7 @@ async function assembleTimeline(spec = {}) {
     const me = Buffer.alloc(16);
     me.writeDoubleLE(originFrame / 24, 0);
     me.writeDoubleLE((maxEnd - originFrame) / 24, 8);
-    mpF = mpF.replace(tlBlock, tlBlock.replace(meM[0], `<MediaExtents>${me.toString('hex')}</MediaExtents>`));
+    mpF = mpF.replace(tlBlock, () => tlBlock.replace(meM[0], () => `<MediaExtents>${me.toString('hex')}</MediaExtents>`));
     zipF.file(mpP, mpF);
     buffer = await zipF.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
   }

package/resolve-advanced/vendor/drp-format/inject-grades.js

@@ -105,7 +105,7 @@ function replaceBodyForClip(seqXml, targetDbId, newBodyHex) {
   if (bodyAt < 0) return null;
   let newClipRange = clipRange.replace(
     bodyRe,
-    `<Body>${newBodyHex}</Body>`,
+    () => `<Body>${newBodyHex}</Body>`,
   );
 
   // 4. Mark the owning version as corrected. Resolve keeps a per-version

package/resolve-advanced/vendor/drp-format/place-compound.js

@@ -96,7 +96,7 @@ async function placeCompound(drpInput, opts = {}) {
     if (!seqRef) throw new Error('placeCompound: embedded blob has no SeqRef entry — schema drift, refusing to author a crasher');
     seqRef.value = innerContainerId;
     const patched = encodeKeyedDict({ hdr: dict.hdr, entries: dict.entries }).toString('hex');
-    pool = pool.replace(fbM[0], `${fbM[1]}${patched}${fbM[3]}`);
+    pool = pool.replace(fbM[0], () => `${fbM[1]}${patched}${fbM[3]}`);
   }
   pool = pool.replace(/<Name>[^<]*<\/Name>/, () => `<Name>${escapeXml(name)}</Name>`);
   // MediaExtents = [startSec, durationSec] LE doubles; inner starts at 0.

package/resolve-advanced/vendor/drp-format/place-fusion-title.js

@@ -103,7 +103,7 @@ async function placeFusionTitle(drpInput, opts = {}) {
   if (Object.values(titleInputs).some((v) => v !== undefined && v !== null)) {
     const m = clip.match(/<CompositionBA>([0-9a-fA-F]*)<\/CompositionBA>/);
     if (!m || !m[1]) throw new Error('placeFusionTitle: template has no CompositionBA to style');
-    clip = clip.replace(m[0], `<CompositionBA>${setTitleInputs(m[1], titleInputs)}</CompositionBA>`);
+    clip = clip.replace(m[0], () => `<CompositionBA>${setTitleInputs(m[1], titleInputs)}</CompositionBA>`);
   }
 
   // Locate VideoTrackVec and split into track elements.

package/resolve-advanced/vendor/drp-format/place-transition.js

@@ -137,7 +137,7 @@ async function placeTransition(drpInput, opts = {}) {
   const transitionDbId = (trans.match(/<Sm2TiTransition DbId="([^"]+)"/) || [])[1] || null;
 
   // Insert the transition <Element> immediately after the left clip's <Element> in <Items>.
-  const newItems = items.replace(clips[leftIdx], `${clips[leftIdx]}${trans}`);
+  const newItems = items.replace(clips[leftIdx], () => `${clips[leftIdx]}${trans}`);
   tracks[track - 1] = setItemsInner(tracks[track - 1], newItems);
 
   const xml = replaceTrackVec(seqXml, trackType, vec, tracks);

package/resolve-advanced/vendor/drp-format/seq-surgery.js

@@ -91,7 +91,7 @@ function setItemsInner(trackElement, inner) {
   if (/<Items\s*\/>/.test(trackElement)) {
     return body ? trackElement.replace(/<Items\s*\/>/, () => `<Items>${body}</Items>`) : trackElement;
   }
-  return trackElement.replace(/<Items>[\s\S]*?<\/Items>/, body ? `<Items>${body}</Items>` : '<Items/>');
+  return trackElement.replace(/<Items>[\s\S]*?<\/Items>/, () => (body ? `<Items>${body}</Items>` : '<Items/>'));
 }
 
 function insertClipIntoTrack(trackElement, clipElement) {

package/resolve-advanced/vendor/drp-format/splice-clips.js

@@ -57,8 +57,8 @@ function clipIn(clipXml) {
 }
 function setClipIn(clipXml, framePos) {
   const enc = `<In>${encodeSourceIn(framePos)}</In>`;
-  if (/<In\s*\/>/.test(clipXml)) return clipXml.replace(/<In\s*\/>/, enc);
-  if (/<In>[^<]*<\/In>/.test(clipXml)) return clipXml.replace(/<In>[^<]*<\/In>/, enc);
+  if (/<In\s*\/>/.test(clipXml)) return clipXml.replace(/<In\s*\/>/, () => enc);
+  if (/<In>[^<]*<\/In>/.test(clipXml)) return clipXml.replace(/<In>[^<]*<\/In>/, () => enc);
   return clipXml; // no In element to set
 }
 // A FROZEN clip carries an EMPTY <In/> (harvested live from an EDL M2 000.0
@@ -77,7 +77,7 @@ function mapClipsOnTrack(trackElement, fn) {
   let out = inner;
   for (const c of splitClipElements(inner)) {
     const nc = fn(c);
-    if (nc !== c) out = out.replace(c, nc);
+    if (nc !== c) out = out.replace(c, () => nc);
   }
   return setItemsInner(trackElement, out);
 }
@@ -263,7 +263,7 @@ async function trimClip(drpInput, opts = {}) {
   const tStart = clipStart(target);
   const trimmedClipDbId = clipDbId(target);
 
-  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, setClipDuration(target, newDuration)));
+  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => setClipDuration(target, newDuration)));
   if (ripple && oldDuration !== null && tStart !== null) {
     const delta = newDuration - oldDuration;
     const tEnd = tStart + oldDuration;
@@ -335,7 +335,7 @@ async function trimClipHead(drpInput, opts = {}) {
   edited = setClipDuration(edited, newDur);
   edited = setClipStart(edited, newStart);
 
-  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, edited));
+  let track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => edited));
   if (ripple) {
     track = mapClipsOnTrack(track, (c) => {
       const s = clipStart(c);
@@ -399,7 +399,7 @@ async function splitClip(drpInput, opts = {}) {
   right = setClipDuration(right, rightDur);
   right = setClipIn(right, leftIn + leftDur); // source continues where left ended
 
-  const track = setItemsInner(tracks[trackIdx - 1], items.replace(target, `${left}${right}`));
+  const track = setItemsInner(tracks[trackIdx - 1], items.replace(target, () => `${left}${right}`));
   tracks[trackIdx - 1] = track;
 
   const xml = replaceTrackVec(seqXml, trackType, vtv, tracks);

package/resolve-advanced/vendor/drt-format/resolve-versions.js

@@ -70,7 +70,7 @@ function restampVersions(xmlStr, src, target) {
   return xmlStr
     .split(`DbAppVer="${src.dbAppVer}"`).join(`DbAppVer="${target.dbAppVer}"`)
     .split(`DbPrjVer="${src.dbPrjVer}"`).join(`DbPrjVer="${target.dbPrjVer}"`)
-    .replace(PROJECT_VERSION_RE, `<ProjectVersion>${target.dbPrjVer}</ProjectVersion>`);
+    .replace(PROJECT_VERSION_RE, () => `<ProjectVersion>${target.dbPrjVer}</ProjectVersion>`);
 }
 
 /**

package/resolve-advanced/vendor/drx-codec/color-nlp-parser.js

@@ -88,7 +88,7 @@ function expandSynonyms(text, synonyms) {
       const regex = new RegExp(`\\b${alt}\\b`, 'gi');
       if (regex.test(expanded)) {
         // Don't replace, just note the canonical form
-        expanded = expanded.replace(regex, canonical);
+        expanded = expanded.replace(regex, () => canonical);
       }
     }
   }

package/src/granular/common.py

@@ -92,7 +92,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.18.1"
+VERSION = "4.18.2"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.18.1"
+VERSION = "4.18.2"
 
 import base64
 import os