premiere-pro-mcp 1.15.2 → 1.16.0

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.16.0] - 2026-09-16
+
+### Added
+
+- Local reaction-Shorts planners: `plan_reaction_captions` stacks overlapping
+  speaker colors without guessing unknown speakers, `plan_short_subscribe_cta`
+  places a mid-video subscribe overlay, and `plan_short_export_folder` names a
+  series folder to create before export. Different labeled speakers may now
+  overlap in a word timeline. (#543)
+- Guarded Speech-to-Text start, caption style guidance, and UXP transcription
+  language options. (#513, #515)
+- Install collision-defense identity output for `--version` and `--doctor`, plus
+  a verified npm installation guide and package-identity checks. (#516, #533,
+  #534)
+- Recorded workflow evidence and a source-linked Premiere MCP comparison. (#532)
+- Interactive cinematic landing: 3D timeline, draggable trims, a program
+  monitor, public-page styling, studio install/Name-check callout, Ahrefs
+  verification, and a female-narration advertisement. (#517–#521, #524–#531,
+  #546)
+- Bounded Fly landing events now go to PostHog as well as Google Analytics,
+  without autocapture, session replay, or person profiles. (#522)
+
+### Fixed
+
+- Host-reported tool crashes and false verification for clip markers, MOGRT JSON
+  values, first transcript import, FCP XML destination checks, and UXP tree
+  IDs. (#544)
+- Security audit findings: HTTP and filesystem work is bounded, and bridge
+  directories fail closed when ownership, symlinks, or ancestor replacement
+  rights are untrusted. (#545)
+- AME handoff tools require a saved project so Same as Project preset
+  destinations cannot resolve against a scratch folder. (#535)
+- Homepage overflow and cinematic timeline replay after the landing merge.
+  (#523)
+
+### Changed
+
+- Creating a UXP preset sequence now requires explicit confirmation. (#542)
+- The Claude Desktop bundle no longer requires a UXP token for CEP-only setups.
+- Homepage experiment assignment is exposed at first paint. (#514)
+- Removed the throwaway `uxp-spike` directory. (#520)
+
+Automated checks do not establish licensed Premiere or After Effects playback or
+rendered-output verification.
+
 ## [1.15.2] - 2026-09-14
 
 ### Fixed

package/README.md

@@ -10,9 +10,9 @@
 
 Free, MIT licensed, local-first, and published to npm as [`premiere-pro-mcp`](https://www.npmjs.com/package/premiere-pro-mcp) — the only package name that installs this project.
 
-[Website](https://premiere-pro-mcp.com/) · [Setup guides](https://premiere-pro-mcp.com/blog/how-to-set-up-premiere-pro-mcp/) · [Search tools](https://premiere-pro-mcp.com/tools/) · [Troubleshooting](https://premiere-pro-mcp.com/docs/troubleshooting/) · [Release facts](https://premiere-pro-mcp.com/facts/)
+[Website](https://premiere-pro-mcp.com/) · [Recorded demo](https://premiere-pro-mcp.com/demo/) · [Compare servers](https://premiere-pro-mcp.com/compare/) · [Setup guides](https://premiere-pro-mcp.com/blog/how-to-set-up-premiere-pro-mcp/) · [Search tools](https://premiere-pro-mcp.com/tools/) · [Troubleshooting](https://premiere-pro-mcp.com/docs/troubleshooting/) · [Release facts](https://premiere-pro-mcp.com/facts/)
 
-Development source: 369 core tools across 53 modules, 4 resources, and 17 guided workflows. A connected UXP host adds 93 capability-gated tools.
+Development source: 373 core tools across 54 modules, 4 resources, and 18 guided workflows. A connected UXP host adds 95 capability-gated tools.
 
 The [completed AE render handoff](docs/after-effects-render-handoff.md) previews and confirms importing one finished render into an existing Premiere bin, with host and file rechecks and an import receipt.
 
@@ -104,13 +104,13 @@ and repository before configuring a client. The new
 VS Code, or Codex settings that point directly to this installation. It is a
 feature included in v1.15.1 and later.
 
-The current source exposes 369 core tools for supported workflow steps spanning the supported ExtendScript, QE DOM, local media and interchange analysis, revisioned project-context retrieval, safe edit-planning, project-intake preview, review handoff, connection verification, and guarded After Effects MOGRT authoring, batch, library, render-queue, inspection, and Premiere-handoff workflows. A compatible, authenticated UXP panel adds 93 documented, capability-gated tools without replacing the production CEP bridge.
+The current source exposes 373 core tools for supported workflow steps spanning the supported ExtendScript, QE DOM, local media and interchange analysis, revisioned project-context retrieval, safe edit-planning, project-intake preview, review handoff, connection verification, and guarded After Effects MOGRT authoring, batch, library, render-queue, inspection, and Premiere-handoff workflows. A compatible, authenticated UXP panel adds 95 documented, capability-gated tools without replacing the production CEP bridge.
 
 <a id="latest-release"></a>
 
-### Latest release: 1.15.2
+### Latest release: 1.16.0
 
-The published v1.15.1 npm artifact contains **369 core tools**, 367 in its default profile,
+The published v1.15.2 npm artifact contains **369 core tools**, 367 in its default profile,
 and 460 with a compatible UXP connection. The development catalog above can include
 unreleased work. See the [versioned facts and package provenance](https://premiere-pro-mcp.com/facts/).
 
@@ -160,7 +160,7 @@ if the connection is unavailable.
   local Premiere processes. See the generated [supported action catalog](docs/supported-actions.md)
   for individual capability and verification contracts.
 
-See the [v1.15.1 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.15.1)
+See the [v1.16.0 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.16.0)
 for complete details. Live installation in Premiere Pro still requires host verification.
 
 ### Current MCP protocol support
@@ -205,11 +205,33 @@ their bins, media rules, and organization rules before a facility uses one.
 
 ## Quick Start
 
+> ### Install the published package (verify the name)
+>
+> ```bash
+> npm i -g premiere-pro-mcp@1.16.0
+> ```
+>
+> This repository publishes only **`premiere-pro-mcp`**. A differently named package (`adobe-premiere-pro-mcp`) may also declare a `premiere-pro-mcp` executable. Before configuring a client, confirm:
+>
+> | Check | Expected |
+> | --- | --- |
+> | Package name | `premiere-pro-mcp` (not `adobe-premiere-pro-mcp`) |
+> | Version | `1.16.0` |
+> | Homepage / repo | https://premiere-pro-mcp.com/ · https://github.com/leancoderkavy/premiere-pro-mcp |
+>
+> ```bash
+> npm list -g premiere-pro-mcp
+> premiere-pro-mcp --version
+> npm view premiere-pro-mcp homepage repository.url
+> ```
+>
+> Then continue with `--install-cep`, `--doctor`, and the read-only `verify_premiere_connection` prompt.
+
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.15.1/premiere-pro-mcp-1.15.1.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.0/premiere-pro-mcp-1.16.0.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.15.1/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.16.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP for Adobe Premiere Pro**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -728,7 +750,7 @@ The MCP server can accept a local UXP panel connection and invoke the UXP comman
 PREMIERE_UXP_TOKEN="replace-with-a-long-random-secret" premiere-pro-mcp
 ```
 
-Enter the same token in the UXP panel. The listener binds only to `127.0.0.1:7777`, authenticates the WebSocket upgrade, requires a versioned capability handshake, correlates concurrent requests, and fails pending work on timeout or disconnect. Set `PREMIERE_UXP_PORT` to use another loopback port.
+Generate that secret yourself and enter the same value in the UXP panel (**Window → UXP Plugins**, not the CEP Connector). CEP-only setups do not use a token. The listener binds only to `127.0.0.1:7777`, authenticates the WebSocket upgrade, requires a versioned capability handshake, correlates concurrent requests, and fails pending work on timeout or disconnect. Set `PREMIERE_UXP_PORT` to use another loopback port.
 
 When enabled, MCP discovery includes 91 capability-gated UXP additions. The first expansion covers effects, deterministic timeline selection, selection batches, scene detection, proxy/ingest, relink, metadata, color conformance, read-only Premiere/After Effects environment inspection, Source Monitor audition, storage, and least-privilege workspace access. The second adds Project-panel selection, marker CRUD, single-transaction undoable beat-grid marker application, bin organization, sequence settings, imports, typed effect parameters/keyframes, track-item transforms, atomic J/L split edits, SequenceEditor timeline edits, sequence lifecycle, and AME encoding. The third wave begins with a redacted event journal, conservative AME terminal receipts, explicit host-readiness gates, safe multi-project sessions, lease-based growing-media control, namespaced workflow checkpoints, bounded media-health maintenance, caption-aware track mute state, transactional source trim/framing, guarded sequence-range updates, guarded source-media start timing, and guarded source-media frame-rate/pixel-aspect overrides documented in [the third-wave workflow matrix](docs/third-wave-uxp-workflows.md). The bounded migration surface also includes a non-ripple selected-item lift, native video-transition listing and guarded transactions, native active and explicit-GUID sequence timing inspection, opt-in installed-MOGRT directory inspection without filesystem enumeration, bounded native timeline structure inspection with opt-in source IDs, classification, and broad content category, guarded sequence display-format updates, a capped native Project-panel tree, a double-read Project-panel insertion-bin snapshot, guarded empty/default sequence creation, bounded native Project-panel schema/item-column metadata inspection, guarded direct Project-panel metadata replacements with exact state/readback guards, guarded typed Project metadata schema-field creation with non-field-level readback, guarded direct updates to three named application preferences, guarded transcript JSON replacement for one exact source clip, direct active-track-item identity readback, guarded source-only slips, guarded contiguous three-item slides, guarded append-only timeline duplicates, guarded contiguous same-track ripple deletes, guarded source-project-item color labels resolved from one timeline coordinate, guarded explicit-sequence preview-frame rectangle updates, explicit opt-in source-media provenance paths with bounded double resolution, bounded source-proxy readiness with an explicit attached-path disclosure, guarded static effect-parameter PointF x/y updates, bounded effect-parameter descriptor catalogs, bounded project/sequence Object Mask audits, native FrameRate/TickTime frame-alignment inspection with caller-owned inputs and tick readback, and native TickTime arithmetic over caller-owned canonical tick strings; it does not claim direct empty-track create/delete, global redo support, playback proof, Object Mask counts or visual validity, an atomic Project-panel metadata compare-and-set, app-preference Undo, installed-template availability or compatibility, imported transcript persistence, override-presence/clear semantics, path existence, source lineage or rights, proxy compatibility, general or keyframed effect-parameter value readback, rendered-frame correctness, linked-item sync, or licensed-host validation. A separate [hybrid benchmark gate](docs/uxp-hybrid-benchmark.md) keeps native acceleration disabled until reproducible cross-platform evidence exists. See also [the first stable workflow matrix](docs/uxp-stable-workflows.md), [the next-ten workflow matrix](docs/uxp-next-ten-workflows.md), [the guarded-slip workflow notes](docs/uxp-slip-workflows.md), [the guarded-slide workflow notes](docs/uxp-slide-workflows.md), [the guarded-duplicate workflow notes](docs/uxp-clone-workflows.md), and [the guarded-ripple-delete workflow notes](docs/uxp-ripple-delete-workflows.md). Commands are advertised only while the authenticated local UXP bridge is connected; the host capability handshake remains the authority for support in the running Premiere build. A failed UXP command is never silently retried through CEP because the first operation may have partially succeeded.
 
@@ -837,11 +859,11 @@ reports revision-bound notes, VFX state, change impact and turnover exceptions.
 It performs local inspection; host edits and exports use separate guarded tools.
 See [usage, example and remaining execution adapters](docs/film-editorial-workflows.md).
 
-## Tools (369 core total; 367 under the default profile; 460 with a connected UXP bridge)
+## Tools (373 core total; 371 under the default profile; 466 with a connected UXP bridge)
 
 The [complete supported-actions catalog](docs/supported-actions.md) lists every
 registered core tool, the two tools restricted behind explicit `unsafe-script`
-authority, and all 91 authenticated UXP additions with their current action or mode
+authority, and all 95 authenticated UXP additions with their current action or mode
 values. It is generated from the same MCP registration surface returned to clients;
 the tables below are a shorter workflow-oriented overview.
 
@@ -1058,6 +1080,14 @@ than presenting UI-only operations as available tools.
 | `build_caption_artifact` | Word-grouped SRT/VTT captions with karaoke timestamps, emphasis markup, speaker prefixes, and style presets, written inside an approved workspace |
 | `check_caption_safe_zone` | Overlap check for caption and graphic rectangles against approximate platform UI zones, with a suggested clear position |
 
+### Reaction Shorts (3)
+
+| Tool | Description |
+| :--- | :---------- |
+| `plan_reaction_captions` | Stacked speaker-colored caption plan from a word timeline and explicit palette; flash words merge, overlaps stack, unknown speakers stay uncolored |
+| `plan_short_subscribe_cta` | Brief subscribe overlay placed about two-thirds through a Short, after an optional hook, with brand-safe styling notes |
+| `plan_short_export_folder` | Series-named export path under an approved Shorts root; create the folder when it is missing and keep Cafe and Watch Club assets separate |
+
 ### Transcript Word Edits (4)
 
 | Tool | Description |
@@ -1233,6 +1263,10 @@ user/device authorization are implemented.
 | `MCP_MAX_REQUESTS_PER_SOCKET` | Requests permitted on one keep-alive socket | `100` |
 | `MCP_MAX_CONCURRENT_REQUESTS` | In-flight authenticated MCP request ceiling | `8` |
 | `MCP_MAX_CONCURRENT_STREAMS` | Open authenticated SSE stream ceiling; isolated from operation capacity | `32` |
+| `MCP_MAX_CONCURRENT_LANDING_DOCUMENTS` | Concurrent HTML reads, nonce injection and asynchronous compression; excess work returns `503` | `4` |
+| `MCP_LANDING_MAX_HTML_BYTES` | Maximum source HTML document bytes | `4194304` (4 MiB) |
+| `MCP_LANDING_HTML_CACHE_BYTES` | Source HTML cache memory budget; must be at least the document byte limit | `16777216` (16 MiB) |
+| `PREMIERE_MCP_PROJECT_BACKUP_MAX_BYTES` | Positive integer byte budget for one project backup | `2147483648` (2 GiB) |
 | `MCP_RATE_LIMIT_PER_MINUTE` | Per-credential token-bucket refill rate | `120` |
 | `MCP_RATE_LIMIT_BURST` | Per-credential short burst allowance | `30` |
 | `MCP_MAX_RATE_LIMIT_KEYS` | In-memory rate-limit identity ceiling | `2048` |
@@ -1265,7 +1299,7 @@ premiere-pro-mcp/
 ├── src/
 │   ├── index.ts                 # Entry point — stdio transport setup
 │   ├── http-server.ts           # Entry point — HTTP/SSE transport (Fly.io / remote)
-│   ├── server.ts                # MCP server — registers 369 tools, filtered by authority profile
+│   ├── server.ts                # MCP server — registers 373 tools, filtered by authority profile
 │   ├── bridge/
 │   │   ├── file-bridge.ts       # File-based IPC (write .jsx, poll .json)
 │   │   └── script-builder.ts    # ExtendScript generator with ES3 helpers
@@ -1350,9 +1384,36 @@ by default. Enable them only by setting
   upstream rate limit and request-size limit too; process-local counters do not protect a multi-machine deployment.
 - **The landing CSP uses a per-response nonce for scripts**, and its static assets use explicit cache policies.
   Keep the server in front of the exported landing so those controls are not bypassed by a separate static host.
-- The bridge temp directory is created private to your user (mode `0700`), and the server
-  refuses to use one owned by another user — relevant on shared machines, where the CEP
-  panel would otherwise execute any `cmd_*.jsx` staged there.
+  Source HTML is cached as immutable build output; restart the HTTP process after replacing
+  an export. Each response still gets a fresh nonce. HEAD requests skip body rendering.
+- **Media scans yield between asynchronous filesystem operations** and bound total traversal:
+  25,000 entries, 5,000 matching files, 2,000 directories, depth 32, a 1,000-directory
+  pending queue, and a cooperative five-second budget. A stalled OS call can exceed that
+  elapsed budget. Inspect `scan_incomplete` and `scan_limit_reasons` before treating a
+  watch baseline as complete; import previews also report `incomplete`.
+- **Project backups stream their copy and checksum work** with a configurable byte budget.
+  Only one backup runs per process; concurrent requests fail promptly. Failed or cancelled
+  copies are removed without replacing an existing backup.
+- **The Docker runner uses the unprivileged `node` user (UID 1000).** Custom bridge or
+  context volume mounts must be writable by that user and private to the operator.
+  The default context directory is under `/home/node/.local/state/premiere-pro-mcp`.
+- Dependency audits run in CI for both lockfiles. Keep local `.env*`, `.npmrc`, and
+  private key/certificate files out of commits and Docker build contexts; only
+  placeholder `.env.example` and `.env.template` files are eligible for Git tracking.
+- Both CEP panels validate the bridge directory before writing a heartbeat or polling
+  commands. Symlinks and directories owned by another user are refused. On POSIX,
+  directories writable by group/other users are refused by both the server and panels;
+  tightening permissions alone cannot make previously staged commands trustworthy.
+  On Windows, only the current user, SYSTEM and Administrators may have write access,
+  including inherited grants. ACL inspection failures also stop startup. Ancestors must
+  also prevent other users from replacing the bridge path; a private child inside a
+  broadly writable parent is insufficient (POSIX sticky temp directories are supported).
+  Choose a new directory under a private user-owned location if the connector rejects
+  a shared temp folder, and configure the same path on the server and panel. Do not
+  copy pending commands from the rejected folder into the new one.
+  Windows checks invoke PowerShell synchronously before publishing commands, with a
+  five-second timeout and 64 KiB output cap; this adds command latency rather than
+  caching a permission decision that could become stale.
 - There is a 500 KB script size limit, and a small regex check that rejects `eval()`,
   `new Function()`, and `System.callSystem()` in tool-generated scripts. **This is a guard
   rail, not a sandbox** — it is trivially bypassable and is not a security boundary. Do not

package/after-effects-cep-plugin/CSXS/manifest.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.15.2" ExtensionBundleName="MCP for Adobe After Effects">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.16.0" ExtensionBundleName="MCP for Adobe After Effects">
   <ExtensionList>
-    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.15.2"/>
+    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.16.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/after-effects-cep-plugin/bridge-directory-security.cjs

@@ -0,0 +1,233 @@
+(function (root, factory) {
+  var api = factory();
+  if (typeof module !== "undefined" && module.exports) module.exports = api;
+  root.MCPBridgeDirectorySecurity = api;
+}(typeof globalThis !== "undefined" ? globalThis : this, function () {
+  "use strict";
+
+  var WINDOWS_ACL_SCRIPT = [
+    '$ErrorActionPreference = "Stop"',
+    '$path = [Environment]::GetEnvironmentVariable("PREMIERE_MCP_ACL_PATH", "Process")',
+    'if ([string]::IsNullOrWhiteSpace($path)) { throw "Bridge path environment variable is missing" }',
+    '$acl = [System.IO.Directory]::GetAccessControl($path)',
+    '$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value',
+    '$initialize = [Environment]::GetEnvironmentVariable("PREMIERE_MCP_ACL_INITIALIZE", "Process") -eq "1"',
+    '$trustedAncestors = @($current, "S-1-5-18", "S-1-5-32-544", "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464")',
+    '$replacement = [System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles -bor [System.Security.AccessControl.FileSystemRights]::Delete -bor [System.Security.AccessControl.FileSystemRights]::ChangePermissions -bor [System.Security.AccessControl.FileSystemRights]::TakeOwnership',
+    '$unsafeAncestors = @()',
+    '$ancestor = (New-Object System.IO.DirectoryInfo($path)).Parent',
+    'while ($null -ne $ancestor) {',
+    '  $ancestorAttributes = [System.IO.File]::GetAttributes($ancestor.FullName)',
+    '  if (($ancestorAttributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { $unsafeAncestors += [pscustomobject]@{ sid = ""; path = $ancestor.FullName; reason = "reparse_point" } }',
+    '  $ancestorAcl = [System.IO.Directory]::GetAccessControl($ancestor.FullName)',
+    '  $ancestorOwner = $ancestorAcl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value',
+    '  if ($ancestorOwner -notin $trustedAncestors) { $unsafeAncestors += [pscustomobject]@{ sid = $ancestorOwner; path = $ancestor.FullName; reason = "owner" } }',
+    '  $unsafeAncestors += @($ancestorAcl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | Where-Object {',
+    '    $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and (($_.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -eq 0) -and (($_.FileSystemRights -band $replacement) -ne 0) -and $_.IdentityReference.Value -notin $trustedAncestors',
+    '  } | ForEach-Object { [pscustomobject]@{ sid = $_.IdentityReference.Value; path = $ancestor.FullName; reason = "replacement_rights" } })',
+    '  $ancestor = $ancestor.Parent',
+    '}',
+    'if ($initialize) {',
+    '  if ($unsafeAncestors.Count -ne 0) { throw "Bridge directory ancestry is unsafe" }',
+    '  $acl.SetAccessRuleProtection($true, $false)',
+    '  $inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit',
+    '  $propagation = [System.Security.AccessControl.PropagationFlags]::None',
+    '  foreach ($sid in @($current, "S-1-5-18", "S-1-5-32-544")) {',
+    '    $identity = New-Object System.Security.Principal.SecurityIdentifier($sid)',
+    '    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($identity, [System.Security.AccessControl.FileSystemRights]::FullControl, $inheritance, $propagation, [System.Security.AccessControl.AccessControlType]::Allow)',
+    '    [void]$acl.AddAccessRule($rule)',
+    '  }',
+    '  [System.IO.Directory]::SetAccessControl($path, $acl)',
+    '  $acl = [System.IO.Directory]::GetAccessControl($path)',
+    '}',
+    '$owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value',
+    '$mutating = [System.Security.AccessControl.FileSystemRights]::WriteData -bor [System.Security.AccessControl.FileSystemRights]::AppendData -bor [System.Security.AccessControl.FileSystemRights]::WriteExtendedAttributes -bor [System.Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles -bor [System.Security.AccessControl.FileSystemRights]::WriteAttributes -bor [System.Security.AccessControl.FileSystemRights]::Delete -bor [System.Security.AccessControl.FileSystemRights]::ChangePermissions -bor [System.Security.AccessControl.FileSystemRights]::TakeOwnership',
+    '$trusted = @($current, "S-1-5-18", "S-1-5-32-544")',
+    '$unsafe = @($acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | Where-Object {',
+    '  $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and (($_.FileSystemRights -band $mutating) -ne 0)',
+    '} | ForEach-Object {',
+    '  if ($_.IdentityReference.Value -notin $trusted) { [pscustomobject]@{ sid = $_.IdentityReference.Value; isInherited = [bool]$_.IsInherited } }',
+    '})',
+    '[pscustomobject]@{ ownerSid = $owner; currentUserSid = $current; unsafeWriteAces = $unsafe; unsafeAncestorEntries = $unsafeAncestors } | ConvertTo-Json -Compress',
+  ].join("\n");
+
+  function createBridgeDirectorySecurity(runtime) {
+    if (!runtime || !runtime.fs || !runtime.path) {
+      throw new Error("Bridge directory security requires filesystem and path runtimes");
+    }
+    var fs = runtime.fs;
+    var path = runtime.path;
+    var platform = runtime.platform || (runtime.process && runtime.process.platform) || "";
+
+    function inspectWindowsAcl(directory, initialize) {
+      if (typeof runtime.inspectWindowsAcl === "function") {
+        return runtime.inspectWindowsAcl(directory, initialize);
+      }
+      if (!runtime.childProcess || typeof runtime.childProcess.execFileSync !== "function") {
+        throw new Error("Windows ACL inspection is unavailable");
+      }
+      if (!runtime.Buffer || typeof runtime.Buffer.from !== "function") {
+        throw new Error("Windows ACL command encoding is unavailable");
+      }
+      var commandEnvironment = {};
+      var sourceEnvironment = runtime.process && runtime.process.env ? runtime.process.env : {};
+      Object.keys(sourceEnvironment).forEach(function (key) {
+        commandEnvironment[key] = sourceEnvironment[key];
+      });
+      commandEnvironment.PREMIERE_MCP_ACL_PATH = directory;
+      commandEnvironment.PREMIERE_MCP_ACL_INITIALIZE = initialize ? "1" : "0";
+      var encodedCommand = runtime.Buffer.from(WINDOWS_ACL_SCRIPT, "utf16le").toString("base64");
+      var raw = runtime.childProcess.execFileSync(
+        "powershell.exe",
+        ["-NoProfile", "-NonInteractive", "-EncodedCommand", encodedCommand],
+        {
+          encoding: "utf8",
+          windowsHide: true,
+          stdio: ["ignore", "pipe", "pipe"],
+          timeout: 5000,
+          maxBuffer: 64 * 1024,
+          env: commandEnvironment,
+        }
+      );
+      return JSON.parse(String(raw).trim());
+    }
+
+    function currentUid() {
+      if (typeof runtime.currentUid === "number") return runtime.currentUid;
+      if (runtime.process && typeof runtime.process.getuid === "function") {
+        return runtime.process.getuid();
+      }
+      return null;
+    }
+
+    function validateDirectoryStatus(directory, entry) {
+      if (!entry || typeof entry.isSymbolicLink !== "function" || typeof entry.isDirectory !== "function") {
+        throw new Error("Bridge directory metadata could not be verified");
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error("Bridge directory must not be a symbolic link or junction: " + directory);
+      }
+      if (!entry.isDirectory()) {
+        throw new Error("Bridge path is not a directory: " + directory);
+      }
+    }
+
+    function validatePosixAncestors(directory, uid) {
+      if (typeof path.dirname !== "function") {
+        throw new Error("Bridge directory ancestry could not be verified");
+      }
+      var paths = [directory];
+      if (typeof fs.realpathSync === "function") {
+        var canonical = fs.realpathSync(directory);
+        if (canonical !== directory) paths.push(canonical);
+      }
+      var checked = {};
+      paths.forEach(function (candidate) {
+        var ancestor = path.dirname(candidate);
+        while (ancestor && !checked[ancestor]) {
+          checked[ancestor] = true;
+          var entry = fs.lstatSync(ancestor);
+          if (entry.uid !== 0 && entry.uid !== uid) {
+            throw new Error("Bridge path has an untrusted replaceable ancestor " + ancestor);
+          }
+          if (!entry.isSymbolicLink()) {
+            if (!entry.isDirectory()) throw new Error("Bridge ancestor is not a directory: " + ancestor);
+            var groupReplaceable = (entry.mode & 0o030) === 0o030;
+            var otherReplaceable = (entry.mode & 0o003) === 0o003;
+            var sticky = (entry.mode & 0o1000) !== 0;
+            if ((groupReplaceable || otherReplaceable) && !sticky) {
+              throw new Error("Bridge path has a replaceable ancestor " + ancestor);
+            }
+          }
+          var parent = path.dirname(ancestor);
+          if (parent === ancestor) break;
+          ancestor = parent;
+        }
+      });
+    }
+
+    function ensurePrivateBridgeDirectory(directory) {
+      if (typeof directory !== "string" || !directory.trim()) {
+        throw new Error("Bridge directory must be a non-empty path");
+      }
+      var resolved = path.resolve(directory.trim());
+      var createdPath = fs.mkdirSync(resolved, { recursive: true, mode: 0o700 });
+      var newlyCreated = typeof createdPath === "string";
+
+      var entry = fs.lstatSync(resolved);
+      validateDirectoryStatus(resolved, entry);
+
+      if (platform === "win32") {
+        var acl;
+        try {
+          acl = inspectWindowsAcl(resolved, newlyCreated);
+        } catch (error) {
+          throw new Error(
+            "Could not verify the Windows ACL for bridge directory " + resolved + ": " +
+            (error && error.message ? error.message : String(error))
+          );
+        }
+        if (!acl || !acl.ownerSid || !acl.currentUserSid || acl.ownerSid !== acl.currentUserSid) {
+          throw new Error("Bridge directory is not owned by the current Windows user: " + resolved);
+        }
+        var unsafe = Array.isArray(acl.unsafeWriteAces)
+          ? acl.unsafeWriteAces
+          : acl.unsafeWriteAces
+            ? [acl.unsafeWriteAces]
+            : [];
+        if (unsafe.length > 0) {
+          var unsafeSids = unsafe.map(function (ace) { return ace && ace.sid ? ace.sid : "unknown"; });
+          throw new Error(
+            "Bridge directory grants write access to untrusted identities (" + unsafeSids.join(", ") + "): " + resolved
+          );
+        }
+        var unsafeAncestors = Array.isArray(acl.unsafeAncestorEntries)
+          ? acl.unsafeAncestorEntries
+          : acl.unsafeAncestorEntries
+            ? [acl.unsafeAncestorEntries]
+            : [];
+        if (unsafeAncestors.length > 0) {
+          throw new Error(
+            "Bridge path has a replaceable ancestor " + unsafeAncestors[0].path +
+            " (" + unsafeAncestors[0].sid + ")"
+          );
+        }
+        if (newlyCreated && fs.readdirSync(resolved).length > 0) {
+          throw new Error("Bridge directory rejected because unexpected contents appeared during creation: " + resolved);
+        }
+        return resolved;
+      }
+
+      var uid = currentUid();
+      if (uid === null || typeof entry.uid !== "number") {
+        throw new Error("Could not verify bridge directory ownership on platform " + platform);
+      }
+      if (entry.uid !== uid) {
+        throw new Error("Bridge directory is owned by another user: " + resolved);
+      }
+      if (!newlyCreated && (entry.mode & 0o022) !== 0) {
+        throw new Error("Bridge directory was writable by other users before validation: " + resolved);
+      }
+      validatePosixAncestors(resolved, uid);
+      if ((entry.mode & 0o077) !== 0) {
+        fs.chmodSync(resolved, 0o700);
+        entry = fs.lstatSync(resolved);
+        validateDirectoryStatus(resolved, entry);
+        if (entry.uid !== uid) {
+          throw new Error("Bridge directory ownership changed during validation: " + resolved);
+        }
+        if ((entry.mode & 0o077) !== 0) {
+          throw new Error("Bridge directory permissions are not owner-only: " + resolved);
+        }
+      }
+      return resolved;
+    }
+
+    return { ensurePrivateBridgeDirectory: ensurePrivateBridgeDirectory };
+  }
+
+  return {
+    createBridgeDirectorySecurity: createBridgeDirectorySecurity,
+    windowsAclScript: WINDOWS_ACL_SCRIPT,
+  };
+}));

package/after-effects-cep-plugin/index.html

@@ -22,6 +22,7 @@
     <small id="bridgeHelp">This must match AFTER_EFFECTS_MCP_TEMP_DIR when that environment variable is set for your MCP client.</small>
   </main>
   <script src="CSInterface.js"></script>
+  <script src="bridge-directory-security.cjs"></script>
   <script src="main.js"></script>
 </body>
 </html>

package/after-effects-cep-plugin/main.js

@@ -6,6 +6,16 @@
   var fs = nodeRequire("fs");
   var path = nodeRequire("path");
   var os = nodeRequire("os");
+  var nodeProcess = nodeRequire("process");
+  var childProcess = nodeRequire("child_process");
+  var bridgeDirectorySecurity = MCPBridgeDirectorySecurity.createBridgeDirectorySecurity({
+    fs: fs,
+    path: path,
+    platform: os.platform(),
+    process: nodeProcess,
+    childProcess: childProcess,
+    Buffer: Buffer,
+  });
   var pollTimer = null;
   var heartbeatTimer = null;
   var running = false;
@@ -101,8 +111,13 @@
   function start() {
     tempDir = document.getElementById("tempDir").value.trim();
     if (!tempDir) { setStatus("Set a bridge directory", false); return; }
-    try { fs.mkdirSync(tempDir, { recursive: true, mode: 0o700 }); }
-    catch (error) { setStatus("Cannot create bridge directory", false); return; }
+    try {
+      tempDir = bridgeDirectorySecurity.ensurePrivateBridgeDirectory(tempDir);
+      document.getElementById("tempDir").value = tempDir;
+    } catch (error) {
+      setStatus("Connector needs attention: " + error.message, false);
+      return;
+    }
     running = true;
     heartbeat();
     if (pollTimer) clearInterval(pollTimer);

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.15.2" ExtensionBundleName="MCP for Adobe Premiere Pro">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.16.0" ExtensionBundleName="MCP for Adobe Premiere Pro">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.15.2"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.15.2"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.16.0"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.16.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>