davinci-resolve-mcp 4.7.0 → 4.7.2

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.2 — `overwrite="false"` no longer unlocks an install guard
+
+### Fixed
+
+- **Five install actions read `overwrite` with bare truthiness, so the string
+  `"false"` opened the guard and replaced the existing file.** ([#239](https://github.com/samuelgursky/davinci-resolve-mcp/pull/239), @Dev-next-gen)
+  `fuse_plugin install`, `dctl install`, `script_plugin install`,
+  `script_plugin safe_install_extension`, and `lut install` all refuse an existing
+  file with the same words — "Pass overwrite=true to replace it." — but `"false"` is a
+  non-empty string, so `not p.get("overwrite")` was `False` and the Fuse, DCTL, script
+  or LUT was replaced. On the LUT path the response even reported `overwritten: True`
+  against a request that said `overwrite="false"`, breaking `install_lut`'s own promise
+  that an install never silently replaces something in use. Same defect and same fix
+  as `ripple="false"` (v4.6.4): all five readings go through `coerce_bool`. Real
+  booleans and `"true"`/`"yes"`/`"1"`/`"on"` are unchanged; an unrecognised string now
+  falls to refuse-and-explain instead of destroy. Guard test:
+  `tests/test_install_overwrite_string_false.py` — six false spellings across all
+  five entry points, asserting both the refusal and that the bytes on disk are
+  unchanged; 25 subtests fail on the previous code.
+
+## What's New in v4.7.1 — a token handed back as `confirmToken` can be redeemed
+
+### Fixed
+
+- **A camelCase client could never execute a confirm-gated action.** ([#238](https://github.com/samuelgursky/davinci-resolve-mcp/pull/238), @Dev-next-gen)
+  `ConfirmTokenStore.consume` accepts the token as `confirm_token` or `confirmToken`,
+  and the twenty-eight gated compound actions treat either spelling as "the caller
+  holds a token" — but `fingerprint()` stripped only the snake_case key. A token
+  echoed back as `confirmToken` stayed in the params, the request hashed differently
+  after issuance than before, and redemption failed with
+  `CONFIRM_TOKEN_FINGERPRINT_MISMATCH`. Because the token is popped before that check
+  it was already spent, so the retry the remediation asks for reported
+  `CONFIRM_TOKEN_INVALID` instead, and re-issuing looped back to the same mismatch.
+  That was a closed loop in front of `TimelineItem.CopyGrades` and project deletion
+  on both servers, which share the store. Reproduced on `main` before merging.
+  Both spellings now live in one `TOKEN_PARAM_KEYS` tuple that `fingerprint` strips
+  and `consume` reads, so the pair cannot drift apart again. A camelCase token
+  presented against different params is still refused — stripping the key does not
+  loosen the gate. Guard tests: `tests/test_confirm_token_camel_case.py`, 5 of 6
+  failing on the previous code.
+
 ## What's New in v4.7.0 — the Resolve 21.1 transcription and timeline-item type reads are complete
 
 The read-only pick from the 21.1 tracker ([#207](https://github.com/samuelgursky/davinci-resolve-mcp/issues/207)), by @legionsound in [#237](https://github.com/samuelgursky/davinci-resolve-mcp/pull/237). Granular 387 → 389; compound unchanged at 37.

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.0-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.0 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.0"
+VERSION = "4.7.2"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.0",
+  "version": "4.7.2",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.0"
+VERSION = "4.7.2"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.0"
+VERSION = "4.7.2"
 
 import base64
 import os
@@ -31047,7 +31047,7 @@ def fuse_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[st
         d = _fuses_dir()
         os.makedirs(d, exist_ok=True)
         path = _fuse_path(name)
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"Fuse '{name}' already exists at {path}. "
                         "Pass overwrite=true to replace it.")
         try:
@@ -31292,7 +31292,7 @@ def lut(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
                 return _ok(would_install=p["name"], writable_dir=lut_files.writable_dir())
             return lut_files.install_lut(
                 p["name"], source=p.get("source"), source_path=p.get("source_path"),
-                overwrite=bool(p.get("overwrite", False)))
+                overwrite=_coerce_bool(p.get("overwrite")))
         if action == "remove":
             if not p.get("name"):
                 return _err("remove requires name")
@@ -31440,7 +31440,7 @@ def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]
         target_dir = root if sd is None else os.path.join(root, sd)
         os.makedirs(target_dir, exist_ok=True)
         path = os.path.join(target_dir, f"{name}{ext}")
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"DCTL '{name}{ext}' already exists at {path}. "
                         "Pass overwrite=true to replace it.")
         try:
@@ -31879,7 +31879,7 @@ def _safe_install_extension(p: Dict[str, Any]) -> Dict[str, Any]:
     validation = _validate_script_source(source, language)
     if validation.get("valid") is False:
         return _err(f"Script validation failed: {validation.get('errors')}")
-    return _script_install_source(name, source, category, language, p.get("overwrite", False))
+    return _script_install_source(name, source, category, language, _coerce_bool(p.get("overwrite")))
 
 
 def _safe_remove_extension(p: Dict[str, Any]) -> Dict[str, Any]:
@@ -32250,7 +32250,7 @@ def script_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[
             return _err(str(e))
         os.makedirs(target_dir, exist_ok=True)
         path = os.path.join(target_dir, f"{name}{_SCRIPT_LANG_EXT[language]}")
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"Script '{name}{_SCRIPT_LANG_EXT[language]}' already "
                         f"exists at {path}. Pass overwrite=true to replace it.")
         try:

package/src/utils/confirm_tokens.py

@@ -39,6 +39,13 @@ DEFAULT_TTL_SECONDS = 300
 PREFERENCE_KEY = "require_confirm_token"
 PREFERENCE_SECTION = "destructive"
 
+#: Both spellings a caller may hand the token back under. `consume` reads either,
+#: and every gated action in the compound server treats either as "a token is
+#: present", so `fingerprint` has to ignore both: a spelling the fingerprint does
+#: not strip is an ordinary param, and the request looks different after issuance
+#: than it did before.
+TOKEN_PARAM_KEYS = ("confirm_token", "confirmToken")
+
 
 def gate_required_from(preferences: Optional[Dict[str, Any]]) -> bool:
     """Read `destructive.require_confirm_token` out of a preferences payload.
@@ -109,9 +116,10 @@ class ConfirmTokenStore:
         payload = {"action": action, "params": params or {}}
         # Strip the token itself if the caller is echoing it back to us, so the
         # fingerprint of "the request" is the same before and after issuance.
-        if isinstance(payload["params"], dict) and "confirm_token" in payload["params"]:
+        # Both spellings, not just the snake_case one: `consume` accepts either.
+        if isinstance(payload["params"], dict):
             payload["params"] = {
-                k: v for k, v in payload["params"].items() if k != "confirm_token"
+                k: v for k, v in payload["params"].items() if k not in TOKEN_PARAM_KEYS
             }
         try:
             blob = json.dumps(payload, sort_keys=True, default=str)
@@ -181,7 +189,8 @@ class ConfirmTokenStore:
         """
         if not self.required():
             return None
-        token = (params or {}).get("confirm_token") or (params or {}).get("confirmToken")
+        supplied = params or {}
+        token = next((supplied.get(key) for key in TOKEN_PARAM_KEYS if supplied.get(key)), None)
         if not token:
             return None  # Caller is expected to call issue() in this case.
         with self.lock: