davinci-resolve-mcp 4.7.0 → 4.7.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.1 — a token handed back as `confirmToken` can be redeemed
+
+### Fixed
+
+- **A camelCase client could never execute a confirm-gated action.** ([#238](https://github.com/samuelgursky/davinci-resolve-mcp/pull/238), @Dev-next-gen)
+  `ConfirmTokenStore.consume` accepts the token as `confirm_token` or `confirmToken`,
+  and the twenty-eight gated compound actions treat either spelling as "the caller
+  holds a token" — but `fingerprint()` stripped only the snake_case key. A token
+  echoed back as `confirmToken` stayed in the params, the request hashed differently
+  after issuance than before, and redemption failed with
+  `CONFIRM_TOKEN_FINGERPRINT_MISMATCH`. Because the token is popped before that check
+  it was already spent, so the retry the remediation asks for reported
+  `CONFIRM_TOKEN_INVALID` instead, and re-issuing looped back to the same mismatch.
+  That was a closed loop in front of `TimelineItem.CopyGrades` and project deletion
+  on both servers, which share the store. Reproduced on `main` before merging.
+  Both spellings now live in one `TOKEN_PARAM_KEYS` tuple that `fingerprint` strips
+  and `consume` reads, so the pair cannot drift apart again. A camelCase token
+  presented against different params is still refused — stripping the key does not
+  loosen the gate. Guard tests: `tests/test_confirm_token_camel_case.py`, 5 of 6
+  failing on the previous code.
+
 ## What's New in v4.7.0 — the Resolve 21.1 transcription and timeline-item type reads are complete
 
 The read-only pick from the 21.1 tracker ([#207](https://github.com/samuelgursky/davinci-resolve-mcp/issues/207)), by @legionsound in [#237](https://github.com/samuelgursky/davinci-resolve-mcp/pull/237). Granular 387 → 389; compound unchanged at 37.

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.0"
+VERSION = "4.7.1"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.0"
+VERSION = "4.7.1"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.0"
+VERSION = "4.7.1"
 
 import base64
 import os

package/src/utils/confirm_tokens.py

@@ -39,6 +39,13 @@ DEFAULT_TTL_SECONDS = 300
 PREFERENCE_KEY = "require_confirm_token"
 PREFERENCE_SECTION = "destructive"
 
+#: Both spellings a caller may hand the token back under. `consume` reads either,
+#: and every gated action in the compound server treats either as "a token is
+#: present", so `fingerprint` has to ignore both: a spelling the fingerprint does
+#: not strip is an ordinary param, and the request looks different after issuance
+#: than it did before.
+TOKEN_PARAM_KEYS = ("confirm_token", "confirmToken")
+
 
 def gate_required_from(preferences: Optional[Dict[str, Any]]) -> bool:
     """Read `destructive.require_confirm_token` out of a preferences payload.
@@ -109,9 +116,10 @@ class ConfirmTokenStore:
         payload = {"action": action, "params": params or {}}
         # Strip the token itself if the caller is echoing it back to us, so the
         # fingerprint of "the request" is the same before and after issuance.
-        if isinstance(payload["params"], dict) and "confirm_token" in payload["params"]:
+        # Both spellings, not just the snake_case one: `consume` accepts either.
+        if isinstance(payload["params"], dict):
             payload["params"] = {
-                k: v for k, v in payload["params"].items() if k != "confirm_token"
+                k: v for k, v in payload["params"].items() if k not in TOKEN_PARAM_KEYS
             }
         try:
             blob = json.dumps(payload, sort_keys=True, default=str)
@@ -181,7 +189,8 @@ class ConfirmTokenStore:
         """
         if not self.required():
             return None
-        token = (params or {}).get("confirm_token") or (params or {}).get("confirmToken")
+        supplied = params or {}
+        token = next((supplied.get(key) for key in TOKEN_PARAM_KEYS if supplied.get(key)), None)
         if not token:
             return None  # Caller is expected to call issue() in this case.
         with self.lock: