davinci-resolve-mcp 4.8.10 → 4.8.12

package/CHANGELOG.md

@@ -2,6 +2,118 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.8.12 — the offline suite no longer writes traces, reports or update state into `logs/`
+
+Test-harness fix only. No tool, action, or Resolve behaviour changed.
+
+### Fixed
+
+- **The offline suite wrote synthetic records into the operator's `logs/`.**
+  `logs/execution-traces.jsonl`, `logs/execution-reports/` and
+  `logs/update-check.json` are the server's defaults, and `tests/offline_guard.py`
+  did not move them the way it already moves the audit log, the operation log and
+  the media-analysis preferences. Measured with
+  `python -m unittest discover -s tests -t .` from a checkout with an empty `logs/`:
+  one run appended 1,865 tool-call records (672 KB) to the trace log, wrote an audit
+  report for a synthetic execution, and created `update-check.json`. In a main
+  checkout the trace records share a file with the real ones, and that file is
+  where `list_recent_executions` sends a reviewer.
+  - `offline_guard` now points `RESOLVE_MCP_TRACE_FILE`,
+    `RESOLVE_MCP_TRACE_REPORT_DIR` and `DAVINCI_RESOLVE_MCP_UPDATE_STATE` at a temp
+    directory for the run, unless the caller already set them, and restores them on
+    `uninstall`. It sets environment variables instead of swapping functions: the
+    server already reads these variables, `src.server` binds its own
+    `update_state_path`, and a child process inherits the environment.
+  - `tests/test_execution_trace.py` unset two of these variables with a bare
+    `os.environ.pop`, which would have removed the redirect for every later test.
+    Both classes now scope the change with `mock.patch.dict`.
+  - New tripwire `tests/test_repo_logs_isolation.py`. It fails if any of the three
+    variables is unset or points into the repo's `logs/`, if the server resolves a
+    path other than the one the guard set, or if a traced tool call and its exported
+    report reach the real `logs/`. It looks for a unique execution id, so a live
+    server appending to the same log cannot make it pass or fail.
+
+### Validation
+
+- Full offline suite from an empty `logs/`, before and after the change: 1,865 trace
+  lines, one report and `update-check.json` before; only `.gitkeep` after. 3,741
+  tests run (3 new), 84 skipped, 12 errors, the same 12 as before the change:
+  `numpy` and `requests` absent from the venv, `jszip` not installed, and one launch
+  attempt stopped by the verification tripwire described below.
+- The new tripwire against the previous guard: 4 failures. With the previous
+  `test_execution_trace.py` run first in the same process, it fails on the two
+  variables that file popped.
+- Both runs used a `sitecustomize` tripwire that stood in for `DaVinciResolveScript`
+  and blocked Resolve launches and outbound requests. It recorded 1,174
+  `scriptapp("Resolve")` calls and one `open DaVinci Resolve.app` from the granular
+  server, before and after this change.
+  [#255](https://github.com/samuelgursky/davinci-resolve-mcp/pull/255) closes that
+  gap; it is unrelated to this one. It also recorded one request to GitHub's
+  `releases/latest` endpoint, made by `test_scripting_lib_discovery` running
+  `install.py`'s update check. The state that check writes is now redirected. The
+  request itself is refused by
+  [#259](https://github.com/samuelgursky/davinci-resolve-mcp/pull/259).
+- That tripwire missed one child process. `install.verify_resolve_connection`
+  replaces `PYTHONPATH` with Resolve's `Modules` directory, so its probe child never
+  loaded the tripwire. In both runs `test_the_live_probe_agrees_with_the_summary`
+  passed instead of skipping. That child therefore loaded the real scripting module
+  and called `scriptapp("Resolve")` against the Resolve that was open, one
+  read-only probe per run. This change does not touch that path;
+  [#260](https://github.com/samuelgursky/davinci-resolve-mcp/pull/260) puts the test
+  behind `RESOLVE_VERIFY=1`.
+- Re-run for this release behind a tripwire that also refuses any child whose
+  command line imports the scripting module: 3,741 tests, 85 skipped, 14 errors.
+  The extra skip is that probe test. The two extra errors are the `test_doctor_paths`
+  probe children the stricter tripwire refuses. The error set matches v4.8.4 under
+  the same tripwire, and `logs/` held only `.gitkeep` afterwards.
+- Not run under pytest, which is not installed here. `tests/conftest.py` calls the
+  same idempotent `install()`/`uninstall()`. That lifecycle was checked directly:
+  a second install is a no-op, uninstall restores the environment, and a value the
+  caller set is left alone.
+- No Resolve behaviour changed; live test not required.
+
+## What's New in v4.8.11 — the installer's live probe no longer runs in the offline suite
+
+Test-only. No tool, action or runtime code changed.
+
+### Fixed
+
+- **Every run of the offline suite connected to an open Resolve through the
+  installer probe.** `test_scripting_lib_discovery.test_the_live_probe_agrees_with_the_summary`
+  runs the real `install.verify_resolve_connection` whenever Resolve is
+  installed. The probe's child sets PYTHONPATH to Blackmagic's Modules
+  directory. So neither the offline guard's child site from v4.8.9 nor a
+  PYTHONPATH tripwire loads in it, and it imports the real module and calls
+  `scriptapp("Resolve")`, `GetProductName` and `GetVersionString`. v4.8.9 named
+  this path and left it open. In the four full runs behind v4.8.9, with Resolve
+  open, the test passed rather than skipped. It skips when the probe does not
+  answer, so each of those runs called `scriptapp("Resolve")` on the real module
+  (read-only).
+  - The test now runs only with `RESOLVE_VERIFY=1`, the switch the live harnesses
+    already use. The check happens when the test runs, not in a decorator at
+    import, so it can be tested. The installed-Resolve check still applies after
+    it.
+  - `docs/process/release-process.md` now names the command, for changes to the
+    installer's verification or summary.
+
+### Validation
+
+- New `test_the_live_test_runs_only_when_asked` runs the live test with the host
+  made to look installed, discovery pinned and the probe booby-trapped. With
+  `RESOLVE_VERIFY=1` the trap goes off once, which shows it is armed. Without it
+  the test skips, naming the switch, and never reaches the trap. With the opt-in
+  check removed, the new test fails.
+- Full suite, `python -m unittest discover -s tests -t .` and
+  `python -m unittest discover -s tests`: 3,771 tests each, 85 skipped. On v4.8.9
+  it was 84 of 3,770, and the one new skip is the live test. The 11 errors are the
+  same as on v4.8.8 in this environment (no `numpy` or `requests` in the venv, plus
+  `test_offline_fallback` and `test_lut_file_controls`).
+- The tripwire used for validation now also refuses a child that names
+  Blackmagic's module and points at the real install on its command line or
+  PYTHONPATH. That is the shape of the installer and doctor probes. It recorded no
+  `scriptapp` call, native load, launch or refused probe child in either run.
+- No Resolve behavior changed, so no live Resolve run is required. None was made.
+
 ## What's New in v4.8.10 — the offline suite no longer asks GitHub for the latest release
 
 No tool, action or runtime behaviour changed. This release changes the test

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.8.10-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.8.12-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.8.10-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.8.12-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.8.10 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.8.12 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/docs/process/release-process.md

@@ -157,6 +157,14 @@ The same rule generalises: **"the file round-trips" and "Resolve honours it" are
 different claims.** Only a live import establishes the second one. Do not write
 "verified live" in a doc unless a runnable command produced that result.
 
+**Changes to `install.py`'s verification or summary must run the installer's live
+probe.** It is the offline suite's one live test, and it is opt-in, because its
+child process reaches the open Resolve past the offline guard:
+
+```bash
+RESOLVE_VERIFY=1 venv/bin/python -m unittest tests.test_scripting_lib_discovery.SetupExitStatusTests.test_the_live_probe_agrees_with_the_summary
+```
+
 Examples:
 
 ```bash

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.8.10"
+VERSION = "4.8.12"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.8.10",
+  "version": "4.8.12",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.8.10"
+VERSION = "4.8.12"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.8.10"
+VERSION = "4.8.12"
 
 import base64
 import os