davinci-resolve-mcp 4.7.7 → 4.7.8

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.8 — `allow_non_mcp_name="false"` no longer lifts the `_mcp_` name guard
+
+### Fixed
+
+- **The opt-in that lifts the `_mcp_` name guard was read with bare truthiness inside
+  both guard helpers, so a stringified `"false"` stood the guard down.** ([#246](https://github.com/samuelgursky/davinci-resolve-mcp/pull/246), @Dev-next-gen)
+  `_require_disposable_project_name` and `_extension_safe_name` both opened with
+  `if allow_non_mcp_name:`, and the eight call sites pass the raw value through, which
+  is why the #240 search for `not p.get("<flag>")` at the guard missed it. From a client
+  that stringifies its JSON scalars, `safe_project_delete` with
+  `allow_non_mcp_name="false"` called `DeleteProject` on a project the MCP never
+  created (as long as it was not the open one), and `safe_install_extension` /
+  `safe_remove_extension` accepted a user-owned Fuse, DCTL or script name; the same
+  reading covered `safe_project_create`, `_export`, `_import`, `_archive` and
+  `_restore`. Both helpers now read the flag through `coerce_bool`. Real booleans and
+  the true spellings are unchanged; a false or unrecognised string keeps the guard up
+  and returns the refusal that already existed. Guard test:
+  `tests/test_allow_non_mcp_name_string_false.py` — both helpers over six false and six
+  true spellings, `safe_project_delete` against a stub asserting `DeleteProject` never
+  ran, and `safe_install_extension` in `dry_run`; 24 of 24 false-spelling subtests
+  fail on the previous code.
+
 ## What's New in v4.7.7 — the offline test bootstrap holds under `unittest discover` too
 
 Test-harness fix only. No tool, action, or Resolve behaviour changed.

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.7-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.8-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.7-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.8-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.7 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.8 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.7"
+VERSION = "4.7.8"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.7",
+  "version": "4.7.8",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.7"
+VERSION = "4.7.8"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.7"
+VERSION = "4.7.8"
 
 import base64
 import os
@@ -18251,9 +18251,9 @@ def _require_disposable_project_name(
     name: Any,
     *,
     field: str = "name",
-    allow_non_mcp_name: bool = False,
+    allow_non_mcp_name: Any = False,
 ) -> Optional[Dict[str, Any]]:
-    if allow_non_mcp_name:
+    if _coerce_bool(allow_non_mcp_name):
         if isinstance(name, str) and name:
             return None
         return _err(f"{field} must be a non-empty string")
@@ -31640,8 +31640,8 @@ _EXTENSION_KERNEL_ACTIONS = [
 _EXTENSION_TYPES = ("fuse", "dctl", "script")
 
 
-def _extension_safe_name(name: Any, *, allow_non_mcp_name: bool = False) -> Optional[Dict[str, Any]]:
-    if allow_non_mcp_name:
+def _extension_safe_name(name: Any, *, allow_non_mcp_name: Any = False) -> Optional[Dict[str, Any]]:
+    if _coerce_bool(allow_non_mcp_name):
         if isinstance(name, str) and name:
             return None
         return _err("name must be a non-empty string")