davinci-resolve-mcp 4.7.1 → 4.7.3

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.3 — a false spelling no longer grants permission on six opt-in flags
+
+### Fixed
+
+- **Six opt-in permission flags were read with bare truthiness, so a client sending
+  `"false"` was granted the permission it was declining.** ([#240](https://github.com/samuelgursky/davinci-resolve-mcp/pull/240), @Dev-next-gen)
+  These open in the opposite direction from `overwrite` (v4.7.2): they default to off,
+  so the string does not perform the act, it *grants* it. On the previous code:
+  `allow_media_archive="false"` let `ArchiveProject` run with source media on (the
+  21.1.0.14 crash `archive_guard` measures); `acknowledge_trap="false"` stood the crash
+  refusal down on both archive paths and stood the trap guard in
+  `destructive_hook._trap_acknowledged` down in front of `TimelineItem.CopyGrades`;
+  `close_current="false"` closed and deleted the open project; `allow_generate`,
+  `allow_render` and `allow_switch` ran `CreateSubtitlesFromAudio`,
+  `RenderWithQuickExport` and `SetCurrentDatabase`. Nine readings in all now go through
+  `coerce_bool`. Real booleans and the true spellings are unchanged; a false or
+  unrecognised string now yields the documented refusal with its `retry_with` payload.
+  The neighbouring `dry_run` reads are deliberately untouched (a stringified `"false"`
+  there keeps the call in preview, which fails safe), and the granular tools already
+  type these as booleans. Guard test: `tests/test_permission_flags_string_false.py` —
+  one test per flag over six false spellings, asserting the effect did not happen
+  before checking the envelope; 54 of 54 subtests fail on the previous code, every one
+  on the effect. One bare opt-in read remains by choice, `allow_timeline_mismatch` on
+  `apply_trace_plan`, which gates a name mismatch rather than a destructive act.
+
+## What's New in v4.7.2 — `overwrite="false"` no longer unlocks an install guard
+
+### Fixed
+
+- **Five install actions read `overwrite` with bare truthiness, so the string
+  `"false"` opened the guard and replaced the existing file.** ([#239](https://github.com/samuelgursky/davinci-resolve-mcp/pull/239), @Dev-next-gen)
+  `fuse_plugin install`, `dctl install`, `script_plugin install`,
+  `script_plugin safe_install_extension`, and `lut install` all refuse an existing
+  file with the same words — "Pass overwrite=true to replace it." — but `"false"` is a
+  non-empty string, so `not p.get("overwrite")` was `False` and the Fuse, DCTL, script
+  or LUT was replaced. On the LUT path the response even reported `overwritten: True`
+  against a request that said `overwrite="false"`, breaking `install_lut`'s own promise
+  that an install never silently replaces something in use. Same defect and same fix
+  as `ripple="false"` (v4.6.4): all five readings go through `coerce_bool`. Real
+  booleans and `"true"`/`"yes"`/`"1"`/`"on"` are unchanged; an unrecognised string now
+  falls to refuse-and-explain instead of destroy. Guard test:
+  `tests/test_install_overwrite_string_false.py` — six false spellings across all
+  five entry points, asserting both the refusal and that the bytes on disk are
+  unchanged; 25 subtests fail on the previous code.
+
 ## What's New in v4.7.1 — a token handed back as `confirmToken` can be redeemed
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.1-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.1 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.3 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.1"
+VERSION = "4.7.3"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.1",
+  "version": "4.7.3",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.1"
+VERSION = "4.7.3"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.1"
+VERSION = "4.7.3"
 
 import base64
 import os
@@ -9298,7 +9298,7 @@ def _transcription_capabilities(mp, p: Dict[str, Any]):
 
 def _subtitle_generation_probe(tl, p: Dict[str, Any]):
     settings, ignored = _normalize_auto_caption_settings(p.get("settings"), get_resolve())
-    if not p.get("allow_generate", False):
+    if not _coerce_bool(p.get("allow_generate")):
         return _ok(would_generate=True, settings=settings, ignored_settings=ignored,
                    note="Pass allow_generate=True to call CreateSubtitlesFromAudio.")
     if not _has_method(tl, "CreateSubtitlesFromAudio"):
@@ -18550,10 +18550,10 @@ def _safe_project_archive(pm, p: Dict[str, Any]) -> Dict[str, Any]:
         return _err(flag_err, code="INVALID_ARCHIVE_FLAG", category="invalid_input")
     src_media, render_cache, proxy_media = (flags["src_media"], flags["render_cache"],
                                             flags["proxy_media"])
-    if (src_media or render_cache or proxy_media) and not p.get("allow_media_archive", False):
+    if (src_media or render_cache or proxy_media) and not _coerce_bool(p.get("allow_media_archive")):
         return _err("Archive media/cache/proxy flags must stay false unless allow_media_archive=True")
     # allow_media_archive guards size; this guards the crash. Both are required.
-    if not p.get("acknowledge_trap"):
+    if not _coerce_bool(p.get("acknowledge_trap")):
         refused = archive_guard.crash_refusal("project_manager", "safe_project_archive", flags)
         if refused:
             return refused
@@ -18600,7 +18600,7 @@ def _safe_project_delete(pm, p: Dict[str, Any]) -> Dict[str, Any]:
     from src.utils.project_cleanup import delete_project_safely
     current_name = current.GetName() if current and _has_method(current, "GetName") else None
     if current_name == name:
-        if not p.get("close_current", False):
+        if not _coerce_bool(p.get("close_current")):
             return _err("Refusing to delete the currently open project; pass close_current=True")
         saved = bool(pm.SaveProject()) if p.get("save_current", True) else None
         closed = bool(pm.CloseProject(current))
@@ -18646,7 +18646,7 @@ def _safe_set_current_database(pm, p: Dict[str, Any]) -> Dict[str, Any]:
     if not isinstance(db_info, dict) or not db_info.get("DbType") or not db_info.get("DbName"):
         return _err("db_info must include DbType and DbName")
     current = _ser(pm.GetCurrentDatabase()) if _has_method(pm, "GetCurrentDatabase") else None
-    dry_run = p.get("dry_run", True) or not p.get("allow_switch", False)
+    dry_run = p.get("dry_run", True) or not _coerce_bool(p.get("allow_switch"))
     if dry_run:
         return _ok(
             would_switch=True,
@@ -19233,7 +19233,7 @@ def project_manager(action: str, params: Optional[Dict[str, Any]] = None) -> Dic
             _open_name = _open.GetName() if _open else None
         except Exception:
             _open_name = None
-        if _open_name == p["name"] and not p.get("close_current", False):
+        if _open_name == p["name"] and not _coerce_bool(p.get("close_current")):
             return _err("Refusing to delete the currently open project; pass close_current=True")
         from src.utils.project_cleanup import delete_project_safely
         deleted = delete_project_safely(pm, p["name"])
@@ -19262,7 +19262,7 @@ def project_manager(action: str, params: Optional[Dict[str, Any]] = None) -> Dic
         flags, flag_err = archive_guard.read_flags(p)
         if flag_err:
             return _err(flag_err, code="INVALID_ARCHIVE_FLAG", category="invalid_input")
-        if not p.get("acknowledge_trap"):
+        if not _coerce_bool(p.get("acknowledge_trap")):
             refused = archive_guard.crash_refusal("project_manager", "archive", flags)
             if refused:
                 return refused
@@ -20354,7 +20354,7 @@ def _safe_quick_export(proj, p: Dict[str, Any]):
         return err
     if not validation["valid"]:
         return {"success": False, "validation": validation}
-    if p.get("dry_run") or not p.get("allow_render", False):
+    if p.get("dry_run") or not _coerce_bool(p.get("allow_render")):
         return _ok(would_render=False, preset=preset, params=params, validation=validation)
     before = set()
     if target_dir and os.path.isdir(target_dir):
@@ -31047,7 +31047,7 @@ def fuse_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[st
         d = _fuses_dir()
         os.makedirs(d, exist_ok=True)
         path = _fuse_path(name)
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"Fuse '{name}' already exists at {path}. "
                         "Pass overwrite=true to replace it.")
         try:
@@ -31292,7 +31292,7 @@ def lut(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
                 return _ok(would_install=p["name"], writable_dir=lut_files.writable_dir())
             return lut_files.install_lut(
                 p["name"], source=p.get("source"), source_path=p.get("source_path"),
-                overwrite=bool(p.get("overwrite", False)))
+                overwrite=_coerce_bool(p.get("overwrite")))
         if action == "remove":
             if not p.get("name"):
                 return _err("remove requires name")
@@ -31440,7 +31440,7 @@ def dctl(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]
         target_dir = root if sd is None else os.path.join(root, sd)
         os.makedirs(target_dir, exist_ok=True)
         path = os.path.join(target_dir, f"{name}{ext}")
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"DCTL '{name}{ext}' already exists at {path}. "
                         "Pass overwrite=true to replace it.")
         try:
@@ -31879,7 +31879,7 @@ def _safe_install_extension(p: Dict[str, Any]) -> Dict[str, Any]:
     validation = _validate_script_source(source, language)
     if validation.get("valid") is False:
         return _err(f"Script validation failed: {validation.get('errors')}")
-    return _script_install_source(name, source, category, language, p.get("overwrite", False))
+    return _script_install_source(name, source, category, language, _coerce_bool(p.get("overwrite")))
 
 
 def _safe_remove_extension(p: Dict[str, Any]) -> Dict[str, Any]:
@@ -32250,7 +32250,7 @@ def script_plugin(action: str, params: Optional[Dict[str, Any]] = None) -> Dict[
             return _err(str(e))
         os.makedirs(target_dir, exist_ok=True)
         path = os.path.join(target_dir, f"{name}{_SCRIPT_LANG_EXT[language]}")
-        if os.path.exists(path) and not p.get("overwrite", False):
+        if os.path.exists(path) and not _coerce_bool(p.get("overwrite")):
             return _err(f"Script '{name}{_SCRIPT_LANG_EXT[language]}' already "
                         f"exists at {path}. Pass overwrite=true to replace it.")
         try:

package/src/utils/destructive_hook.py

@@ -833,7 +833,7 @@ TRAP_REFUSAL_EXEMPT_ACTIONS: FrozenSet[Tuple[str, str]] = frozenset({
 
 def _trap_acknowledged(params: Optional[Dict[str, Any]]) -> bool:
     """Did the caller explicitly accept a known-destructive behaviour?"""
-    return bool(isinstance(params, dict) and params.get("acknowledge_trap"))
+    return isinstance(params, dict) and coerce_bool(params.get("acknowledge_trap"))
 
 
 def _trap_block_response(