premiere-pro-mcp 1.19.0 → 1.20.0

package/CHANGELOG.md

@@ -6,6 +6,95 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.20.0] - 2026-10-06
+
+### Added
+
+- `ripple_remove_timeline_ranges` previews and then applies a multi-range ripple removal (up to 50 sorted ranges) across unlocked, sync-locked tracks. Apply needs a single-use preview confirmation token and the `edit` capability, cuts on Premiere's own sequence timecode, and verifies every resulting clip by readback. It uses the experimental QE razor; a timeout after Premiere accepts the edit is reported as `mutationOutcome: "unknown"`. Live Premiere verification was reported by the contributor on 25.2.3 and 26.5.2; it was not re-run for this release.
+
+- `set_footage_interpretation` accepts `field_type` (0 progressive, 1 upper field first, 2 lower field first) and reads it back (#806).
+- `import_folder` accepts `target_bin` and skips `Thumbs.db`, `desktop.ini` and `.DS_Store` (#807).
+- `get_encoder_presets` accepts `limit` and `offset`; the result adds `total` and `offset` (#808).
+- `import_fcp_xml` accepts `mode: "into_open_project"` (with optional `target_bin`) to import into the open project; it succeeds only when the sequence count grew, and `project_path` is required only in the default `new_project` mode (#811).
+
+### Fixed
+
+- `import_media` no longer reports an error when an `.xml`, `.aaf`, `.edl` or `.prproj` file imports correctly. Interchange files create sequences and bins rather than an item with the file's path, so they now return `outcome: "committed_unverified"` with `interchange: true`, which stops retries from duplicating the sequence (#805).
+
+- `duplicate_clip` no longer places a copy one frame short. Premiere can snap the source out point a frame early, so on Premiere 26.5.2 a 677-frame clip was copied as 676 frames, and the tool still reported `verified` because it allowed two frames of drift. It now trims each placed copy, and its linked partner, back to the original end, reports `endCorrected`, and verifies start, end and source in-point to within half a frame.
+
+- Effect parameter reads and writes use Premiere's lossless colour API for static colour controls, returning `[alpha, red, green, blue]` instead of a packed number. CEP refuses keyframed colour operations that cannot be read or written losslessly. Effect tools now refuse repeated property names with candidate indices or accept `property_index`; this applies to parameter reads, writes, keyframe operations, colour correction and built-in property workflows that resolve names.
+
+- `razor_all_tracks` and `split_clip` cut on the requested frame in drop-frame sequences. They built a non-drop `HH:MM:SS:FF` string, which Premiere reads as drop-frame timecode on 29.97/59.94 DF sequences, so cuts landed early by the dropped-frame count (2 frames after the first minute, 28 frames at 16 minutes, measured on 25.2.3) and `razor_all_tracks` still reported `verified: true`. Both now let Premiere format the timecode in the sequence's display format, snap the cut to a frame, and verify the new boundary within half a frame; `razor_all_tracks` reports a misplaced cut as `committed_unverified`.
+- Batched ripple-range previews now cap clip samples at 50 while retaining per-track counts and a confirmation fingerprint for the complete plan. Razor track spans are computed from one initial clip snapshot; cuts use Premiere's sequence-display timecode for fractional and drop-frame rates and refuse any resulting boundary more than half a frame from the snapped range edge. Frame-exact decimal ranges no longer appear as adjustments, and mutation receipts use the shared QE undo-stack reader.
+
+- `add_audio_keyframes` and `setup_ducking` can add the first keyframe to a clip again. On Premiere 25.2.3 a property with no keyframes returns `undefined` from `getKeys()` (with `isTimeVarying()` false), which the audio and shared keyframe readers treated as unreadable storage, so both tools refused every clip without existing Volume keys. That state now reads as an empty key list; `null`, malformed lists, and `undefined` on a time-varying property still refuse.
+
+- `detect_beats` no longer snaps tempo to a coarse grid or lets the beat grid drift. It decoded audio at 200 Hz and built a 20 Hz onset envelope, so periods could only take 50 ms steps (73 BPM reported as 75, 146 as 150) and the returned beat times drifted by about 0.4 s after 30 beats. It now decodes at 4 kHz, uses a 100 Hz envelope, and refines the period to a fraction of a sample across the whole file. On 3-minute click tracks from 60 to 174 BPM, tempo is exact and every beat time is within 20 ms.
+
+- `detect_repeated_takes` no longer groups a short sentence with a much longer, different one because they share a few words. Similarity used bag-of-words containment, so on a real interview transcript "We have new city projects" (5 words) scored 0.8 against a 20-word sentence mentioning "different new city projects", and the default `keep: "last"` proposed removing 7.9 s of real content. When one sentence is under 60% of the other's length, containment now only counts a false start that matches the start of the longer sentence in order; similar-length retakes behave as before.
+
+- `map_source_ranges_to_timeline` now treats `getSpeed() === 100` as normal speed on older Premiere hosts while continuing to refuse retimed or reversed clips.
+
+- `set_sequence_frame_rate` sets exact NTSC timebases. It divided by the rounded decimal (`TICKS_PER_SECOND / 29.97`), giving 8475675676 ticks per frame for 29.97 and 10594594595 for 23.976, which are near-NTSC rates that drift against camera media and differ from Premiere's own presets (8475667200 and 10594584000). Requests within 0.005 fps of 23.976, 29.97, 47.952, 59.94 or 119.88 now use the exact `nominal × 1000/1001` timebase, and the receipt reports `ntsc` and `exactFrameRate`.
+
+- Timeline edits for playhead, clip placement/duration/trim, sequence marks and sequence markers snap requested times to the active sequence frame grid, verify stored boundaries within 1/1000 frame, and report changed requested/applied values.
+
+- `navigate_playhead` now reports timecode using Premiere's sequence display format, including drop-frame punctuation.
+
+- Transition receipts distinguish verified placement from handle-limited duration, mark each deviating placement, and count duration deviations. Premiere-built title copies report their application-support location and are documented as user-managed files that must not be removed while any project references them.
+- Filler-removal guidance explains that hesitation sounds require transcripts that preserve disfluencies; Whisper's default output omits them.
+
+- FCP XML export receipts parse Premiere's BOM-prefixed Translation Report issue lines, bound effect details while reporting truncation, and wait for the XML size and modification time to stabilize before reporting its size.
+- CEP command timeouts cancel still-unclaimed work when another recent busy marker or connector heartbeat shows Premiere is blocked; mutating commands report `not_applied`, while claimed work with a fresh busy marker continues waiting.
+
+- `paste_clip_attributes` and `copy_effect_values` copy colour parameters (such as Lumetri White Balance) with `getColorValue()` / `setColorValue()`. `getValue()` returns these as one packed number above 2^53, so writing it back stored a different colour. On Premiere 25.2.3 a grey white balance came back as transparent blue. Keyframed colour parameters are reported as not copied instead of being written.
+- `copy_effect_values` matches properties by position, then by unique display name. Lumetri Color repeats names such as Saturation and Intensity across sections, and the first-name match wrote values into the wrong controls. On 25.2.3 this left a correctly graded clip with the wrong Saturation and Intensity. Values that already match and unreadable section headers are no longer rewritten, and a failed copy now names the properties it skipped or could not verify.
+
+- `copy_effects_between_clips` now copies and reads back effect parameter values and keyframes, updates an existing target effect instead of stacking a default instance, and refuses when the requested source effect is missing.
+
+- Corrected the still-capture guidance from #771. Premiere's QE PNG stills are not wrong about keyframes. They are RGBA with straight alpha, so a fading clip keeps its colours and carries the fade only in alpha. On Premiere 26.5.2 macOS, stills composited over black matched an actual H.264 export (58.0 against 58.4 YAVG at mid-fade), and linear, hold and bezier gave different alpha (168, 255 and 189) at the same instant. The earlier "QE stills hold opacity" note came from measuring stills without their alpha channel. `export_frame` and `capture_frame` now report `hasAlpha` from the PNG header with a compositing note, and the client instructions, skills, interpolation receipts and review-frame scopes say to composite stills over black before comparing them with a video export.
+
+- UXP tools on Premiere 26.5.2, found live on macOS:
+  - **Project-item IDs.** The project root and some folders return no `getId` until cast with `ProjectItem.cast`. `inspect_project_tree_uxp` and `inspect_unique_object_identity_uxp` failed, and bin listings reported empty IDs. The advanced-workflow and unique-identity helpers now cast, as the other helpers already did.
+  - **Slip, slide and split edits.** Premiere 26.5 applies TrackItem start/end and in/out actions like trims, so each edge action also moves its source point.
+    - `slip_track_item_uxp` landed as a move. It now restores the timeline position with a second, measured move (two undo steps).
+    - `slide_track_item_uxp` trimmed both neighbours twice. It now sends only the edge actions and writes source points afterwards only when they did not follow.
+    - `make_split_edit_uxp` extended the audio twice, and it never checked whether the extension was free. An L-cut into the next audio clip left two items over the same range, and Premiere crashed (heap corruption) while drawing them. It now refuses when the extension would overlap another item on the same track, and it applies the source point only when needed.
+  - **`ripple_delete_track_item_uxp`** deleted without rippling when another track had an item over the deleted range, such as a linked audio partner or a spanning adjustment layer. It now refuses before any change and names those items.
+  - **Snapshots.** Slip, slide, ripple-delete and duplicate `inspect` results now include a snake_case `expected_snapshot` that `apply` accepts unchanged. Previously the camelCase inspect output was rejected by the apply schema.
+  - **Capabilities.** The bridge re-reads the panel's live capabilities before refusing a command that the connect-time handshake marked unsupported, and `get_uxp_capabilities` reports the live list. A panel that connected before a project was open or a workspace was approved hid 25 of 192 commands for the session.
+  - **Markers.** `manage_markers_uxp` `add` now forwards and applies `color_index` and verifies every requested field. Previously the colour was dropped while the add reported verified.
+  - **Frame export.** `export_frame_uxp` retries with the file extension when Premiere rejects an extension-less name ("File Format is not supported"). It also waits up to 15 s for the PNG, which 26.5.2 writes after the call returns, and it checks for the file by walking the approved workspace folder: a plugin with request-only file access cannot open arbitrary `file:` URLs, so the old check reported a written frame as missing.
+  - **Media health.** `maintain_media_health_uxp` treats a single `project_item_id` as a one-item list for inspect, refresh and set_offline.
+
+### Changed
+
+- Long-host receipts detect FCP Translation Report modals and report written XML/OMF as committed_unverified after host timeout; export preflight reports composite black/dead-air intervals within sequence In/Out with optional paged per-track details; media, ripple, and marker readbacks include generated-no-file classification, 1-based track labels, marker GUID and color. Queued commands now cancel atomically behind a fresh busy operation when possible, distinguishing not_applied from unknown mutation outcomes.
+
+## [1.19.1] - 2026-10-04
+
+### Fixed
+
+- Sequence inspection reads now return bounded clip/gap pages, track counts and continuation offsets, with track/time filters and a response budget (#769).
+- Transcription start tolerates unavailable optional ClipProjectItem identity access while preserving target resolution and replay guards (#772).
+- CEP/UXP interpolation and still-capture receipts separate stored values and file existence from temporal animation. The 26.5.2 Windows capture report remains unresolved; contributor 25.2.3 macOS evidence distinguishes a QE still artifact from correctly encoded video curves (#771).
+- Save As refuses unverified destination existence without overwrite confirmation. Committed duplicate, slide and slip edits retain replayable partial receipts when readback fails.
+- Transcript import permits host-attached empty transcripts, creates TextSegments inside lockedAccess and compares full canonical JSON content when Adobe reformats the export. Nonempty transcript overwrite remains refused (#773).
+- Transition duration arguments use frame-grid timecode. Direct MOGRT import refuses malformed ZIP/JSON templates before host dispatch (#773).
+
+- `clear_item_in_out` verifies a cleared Out mark against the item's `MediaDuration` and `MediaTimebase` (frames for video, samples for audio), so audio items verify too, and reports the In and Out results separately. Live on Premiere 25.2.3: a cleared Out reads the full media length, and `MediaTimebase` is `48000 Hz` for audio and `25.00 fps` for video. (#696)
+- An empty Source Monitor returns `undefined`, not `null`, on Premiere 25.2.3. The close and playback tools now treat a getter that returns `null` or `undefined` without throwing as an empty monitor; only a throwing getter is unreadable. Previously `close_all_source_clips` reported a genuinely empty monitor as `committed_unverified`. (#694)
+- `add_to_timeline` counts only clips that match the inserted source and start at the insertion time as inserted, and reports split remainders separately (`splitRemainders`). A same-source mid-clip insert on 25.2.3 previously reported `insertedTrackItems: 2` for one inserted clip. (#680)
+- Mutating bridge commands that time out after Premiere accepts them can report `mutationOutcome: unknown` and `timelineChanged: null`, with guidance to inspect before retrying.
+- `encode_project_item`, `encode_file`, and `manage_proxies` `create` no longer call `app.encoder.startBatch()` after queueing. That API starts every ready Adobe Media Encoder job, including unrelated jobs already in the queue. Batch start is now opt-in with `start_batch: true`, matching `add_to_render_queue`. Use `start_batch_encode` to start the queue later.
+- `ripple_delete`, ripple removal in `remove_from_timeline`, and rippling `apply_edit_plan` removals shift clips with `TrackItem.move()` and single-pass per-track lookups. The contributor measured one pause cut on Premiere 25.2.3 macOS dropping from about 31 minutes to about 3 on a 2-hour, 1,490-clip podcast sequence. Ripples that would move more than 400 clips refuse before mutation with a count and time estimate unless `allow_large_ripple` is set, host waits scale with the work without shortening a longer configured timeout, and an edit that times out after Premiere accepted it reports an unknown timeline state instead of a plain failure.
+- `trim_clip`, `set_clip_duration`, `slip_edit`, `roll_edit`, and `slide_edit` no longer refuse every unlinked clip by default. On Premiere 25.2.3 `getLinkedItems()` returns `null` (without throwing) for a clip with no linked partner, which these tools treated as unreadable linkage; it now means "no partners", while throwing or malformed collections still refuse. `roll_edit` and `slide_edit` also accept the numeric `0` that `isSpeedReversed()` returns for a forward clip on that host (`1`/`true` still refuse), so they no longer refuse every clip there.
+
+### Added
+
+- `ripple_remove_timeline_ranges` previews up to 50 frame-snapped pause ranges, then removes them in one guarded pass across unlocked sync-locked tracks, shifting each surviving clip once with a verified receipt.
+
 ## [1.19.0] - 2026-10-02
 
 ### Added

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-# MCP for Adobe Premiere Pro
+# MCP for Adobe Premiere Pro — local MCP server
 
 <!-- mcp-name: io.github.leancoderkavy/premiere-pro -->
 
@@ -14,7 +14,7 @@ Free, MIT licensed, local-first, and published to npm as [`premiere-pro-mcp`](ht
 
 [Website](https://premiere-pro-mcp.com/) · [Recorded demo](https://premiere-pro-mcp.com/demo/) · [Compare servers](https://premiere-pro-mcp.com/compare/) · [Setup guides](https://premiere-pro-mcp.com/blog/how-to-set-up-premiere-pro-mcp/) · [Search tools](https://premiere-pro-mcp.com/tools/) · [Troubleshooting](https://premiere-pro-mcp.com/docs/troubleshooting/) · [Release facts](https://premiere-pro-mcp.com/facts/)
 
-Development source: 386 core tools across 57 modules, 4 resources, and 19 guided workflows. A connected UXP host adds 96 capability-gated tools.
+Development source: 393 core tools across 60 modules, 4 resources, and 24 guided workflows. A connected UXP host adds 96 capability-gated tools.
 
 The [completed AE render handoff](docs/after-effects-render-handoff.md) previews and confirms importing one finished render into an existing Premiere bin, with host and file rechecks and an import receipt.
 
@@ -74,6 +74,25 @@ The [completed AE render handoff](docs/after-effects-render-handoff.md) previews
 
 ## What is this?
 
+**MCP for Adobe Premiere Pro** is the independent, MIT-licensed local MCP server
+published as `premiere-pro-mcp` by
+[leancoderkavy/premiere-pro-mcp](https://github.com/leancoderkavy/premiere-pro-mcp).
+Install this package and its separate Premiere connector to connect a compatible
+AI assistant to supported project inspection, timeline editing, and export tools.
+Start with `verify_premiere_connection` and make no changes until the bridge works.
+
+### Find the right Adobe Premiere Pro MCP guide
+
+| Goal | Guide |
+| --- | --- |
+| Understand the local server and connector | [What is Adobe Premiere Pro MCP?](https://premiere-pro-mcp.com/what-is-premiere-pro-mcp/) |
+| Connect Claude Desktop, Cursor, or Codex | [Claude Desktop](https://premiere-pro-mcp.com/blog/claude-desktop-premiere-pro-mcp-setup/) · [Cursor](https://premiere-pro-mcp.com/blog/cursor-premiere-pro-mcp-setup/) · [Codex](https://premiere-pro-mcp.com/blog/codex-premiere-pro-mcp-setup/) |
+| Choose between similarly named projects | [Source-linked server comparison](https://premiere-pro-mcp.com/compare/) |
+| Match a repeatable task to a tool and verification step | [Adobe Premiere Pro automation guide](https://premiere-pro-mcp.com/blog/premiere-pro-workflow-automation/) |
+| Check a tool before planning an edit | [Published tool catalog](https://premiere-pro-mcp.com/tools/) |
+| Confirm released version and provenance | [Published package facts](https://premiere-pro-mcp.com/facts/) |
+
+
 An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that lets AI assistants like **Claude**, **Windsurf**, **Cursor**, **GitHub Copilot**, or any MCP-compatible client directly control Adobe Premiere Pro — importing media, editing timelines, applying effects, managing keyframes, exporting, and more.
 
 ```text
@@ -106,16 +125,19 @@ and repository before configuring a client. The new
 VS Code, or Codex settings that point directly to this installation. It is a
 feature included in v1.15.1 and later.
 
-The current source exposes 386 core tools for supported workflow steps spanning the supported ExtendScript, QE DOM, local media and interchange analysis, revisioned project-context retrieval, safe edit-planning, project-intake preview, review handoff, connection verification, and guarded After Effects MOGRT authoring, batch, library, render-queue, inspection, and Premiere-handoff workflows. A compatible, authenticated UXP panel adds 96 documented, capability-gated tools without replacing the production CEP bridge.
+The current source exposes 393 core tools for supported workflow steps spanning the supported ExtendScript, QE DOM, local media and interchange analysis, revisioned project-context retrieval, safe edit-planning, project-intake preview, review handoff, connection verification, and guarded After Effects MOGRT authoring, batch, library, render-queue, inspection, and Premiere-handoff workflows. A compatible, authenticated UXP panel adds 96 documented, capability-gated tools without replacing the production CEP bridge.
 
 <a id="latest-release"></a>
 
-### Latest release: 1.19.0
+### Latest release: 1.20.0
 
-The published v1.19.0 npm artifact contains **386 core tools**, 384 in its default profile,
-and 480 with a compatible UXP connection. The development catalog above can include
+The published v1.20.0 npm artifact contains **393 core tools**, 391 in its default profile,
+and 487 with a compatible UXP connection. The development catalog above can include
 unreleased work. See the [versioned facts and package provenance](https://premiere-pro-mcp.com/facts/).
 
+GitHub releases use `v<SemVer>` for both title and tag, such as `v1.20.0`.
+See [release naming and version conventions](docs/release-conventions.md).
+
 ### Try a bounded workflow
 
 Choose a setup guide: [Claude Desktop](https://premiere-pro-mcp.com/blog/claude-desktop-premiere-pro-mcp-setup/),
@@ -132,6 +154,13 @@ if the connection is unavailable.
 
 ### Release highlights
 
+- **1.20.0 verified range removal:** `ripple_remove_timeline_ranges` previews, then applies a multi-range ripple removal with a single-use confirmation token and clip-level readback (QE razor; experimental).
+- **1.20.0 effect safety:** effect colours read and write losslessly, ambiguous property names (for example repeated Lumetri controls) are refused unless `property_index` is given, and `duplicate_clip` copies keep the original length.
+- **1.20.0 import and metadata additions:** `import_fcp_xml` can import into the open project, `import_folder` accepts `target_bin`, `get_encoder_presets` pages with `limit`/`offset`, `set_footage_interpretation` sets `field_type`, and XML/AAF/EDL imports through `import_media` no longer report a false error.
+- **1.19.1 timeline fixes:** bounded sequence pages with continuation, measured unlinked-clip compatibility, and faster ripple movement with a large-edit opt-in and scaled host waits.
+- **1.19.1 safer handoffs:** AME queue-wide start requires explicit opt-in, malformed MOGRT files refuse before host import, and uncertain committed edits retain inspection guidance.
+- **1.19.1 transcript and capture fixes:** empty host-attached transcripts can accept guarded imports; stored values and still files do not establish temporal animation. A short actual video export is needed to assess keyframe curves.
+
 - **Editorial planning:** film evidence, transcript cleanup, caption authoring, shorts and chapter planning, rhythm and speaker layouts, timeline QA, and platform delivery plans.
 - **Cross-app handoff:** capability-aware workflow routes and guarded After Effects render-to-Premiere handoff.
 - **Editing correctness:** verified readback and explicit capability or committed-but-unverified failures across transition, import, effects, source identity, and track operations. Insert edits ripple QE sync-locked tracks instead of silently desyncing neighbours.
@@ -162,7 +191,7 @@ if the connection is unavailable.
   local Premiere processes. See the generated [supported action catalog](docs/supported-actions.md)
   for individual capability and verification contracts.
 
-See the [v1.19.0 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.19.0)
+See the [v1.20.0 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.20.0)
 for complete details. Live installation in Premiere Pro still requires host verification.
 
 ### Current MCP protocol support
@@ -210,7 +239,7 @@ their bins, media rules, and organization rules before a facility uses one.
 > ### Install the published package (verify the name)
 >
 > ```bash
-> npm i -g premiere-pro-mcp@1.19.0
+> npm i -g premiere-pro-mcp@1.20.0
 > ```
 >
 > This repository publishes only **`premiere-pro-mcp`**. A differently named package (`adobe-premiere-pro-mcp`) may also declare a `premiere-pro-mcp` executable. Before configuring a client, confirm:
@@ -218,7 +247,7 @@ their bins, media rules, and organization rules before a facility uses one.
 > | Check | Expected |
 > | --- | --- |
 > | Package name | `premiere-pro-mcp` (not `adobe-premiere-pro-mcp`) |
-> | Version | `1.19.0` |
+> | Version | `1.20.0` |
 > | Homepage / repo | https://premiere-pro-mcp.com/ · https://github.com/leancoderkavy/premiere-pro-mcp |
 >
 > ```bash
@@ -231,9 +260,9 @@ their bins, media rules, and organization rules before a facility uses one.
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.19.0/premiere-pro-mcp-1.19.0.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.20.0/premiere-pro-mcp-1.20.0.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.19.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.20.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP for Adobe Premiere Pro**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -537,11 +566,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.19.0 --install-cep
+npx -y premiere-pro-mcp@1.20.0 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.19.0` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.20.0` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -579,7 +608,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.19.0 --install-cep
+npx -y premiere-pro-mcp@1.20.0 --install-cep
 ```
 
 The Claude Code package lives in
@@ -903,7 +932,9 @@ reports revision-bound notes, VFX state, change impact and turnover exceptions.
 It performs local inspection; host edits and exports use separate guarded tools.
 See [usage, example and remaining execution adapters](docs/film-editorial-workflows.md).
 
-## Tools (386 core total; 384 under the default profile; 480 with a connected UXP bridge)
+Reviewed assistant-editing tools now provide dialogue candidate decisions, quote paper-edit CSV, batch copy previews, sync-evidence triage, and owned-footage B-roll review. These are local evidence reviews, not new host engines. See [review workflow contracts](docs/editorial-review-workflows.md).
+
+## Tools (393 core total; 391 under the default profile; 487 with a connected UXP bridge)
 
 The [complete supported-actions catalog](docs/supported-actions.md) lists every
 registered core tool, the two tools restricted behind explicit `unsafe-script`
@@ -1342,7 +1373,7 @@ user/device authorization are implemented.
 | `PREMIERE_MCP_CAPABILITIES` | Comma-separated authority profile; add `unsafe-script` only when raw scripting is required | `inspect,edit,export,filesystem` |
 | `PREMIERE_MCP_DEBUG` | Set to `1` (or `true`) to emit verbose server diagnostics to stderr | unset |
 | `PREMIERE_CONTEXT_BACKEND` | Local project-context store: `auto`, `sqlite`, `json`, or `memory` | `auto` |
-| `PREMIERE_CONTEXT_DIR` | Override the local project-context storage directory | OS application-data directory |
+| `PREMIERE_CONTEXT_DIR` | Override local context storage; unsafe existing ownership/permissions/links are rejected, safe POSIX directories/files tightened to 0700/0600 | OS application-data directory |
 | `PORT` | HTTP port (HTTP/SSE transport only) | `3000` |
 | `MCP_AUTH_TOKEN` | Operator bearer token for controlled HTTP deployments; mutually exclusive with OAuth mode | unset |
 | `MCP_OAUTH_ISSUER` | Exact trusted OAuth/OIDC token issuer URL | unset |
@@ -1392,7 +1423,7 @@ premiere-pro-mcp/
 ├── src/
 │   ├── index.ts                 # Entry point — stdio transport setup
 │   ├── http-server.ts           # Entry point — HTTP/SSE transport (Fly.io / remote)
-│   ├── server.ts                # MCP server — registers 386 tools, filtered by authority profile
+│   ├── server.ts                # MCP server — registers 393 tools, filtered by authority profile
 │   ├── bridge/
 │   │   ├── file-bridge.ts       # File-based IPC (write .jsx, poll .json)
 │   │   └── script-builder.ts    # ExtendScript generator with ES3 helpers
@@ -1462,6 +1493,8 @@ All generated scripts use **ES3 syntax** (`var`, manual `for` loops, no arrow fu
 
 ### Security
 
+Metadata privacy: CEP `get_metadata` and `get_xmp_metadata` now default to bounded parsed fields with GPS, serial, author and contact values omitted. Raw packets require explicit packet flags and `include_sensitive: true`; source media paths require `include_media_path: true`. Existing callers expecting raw XML must opt in. Disk context can retain names, transcripts and notes; select `PREMIERE_CONTEXT_BACKEND=memory` to avoid persistence.
+
 Understand the trust model before deploying this: **any client that can reach the MCP
 server can control Premiere Pro.** `execute_extendscript` and `evaluate_expression` are
 arbitrary-code-execution tools by design and are omitted from discovery and denied at call time
@@ -1568,6 +1601,33 @@ No. This is an independent MIT-licensed project, not an Adobe product and not Ad
 native AI Assistant. It is also distinct from other MCP servers for Premiere Pro;
 `premiere-pro-mcp` is the only npm package published from this repository.
 
+**Does local-first mean my AI assistant sends no data to a cloud service?**
+The recommended Premiere bridge runs locally. Your AI client's handling of prompts
+and tool results still applies. Review its settings before sharing sensitive project
+information; local-first is not a universal no-upload guarantee.
+
+**Is every action previewed, undoable, and host-verified?**
+Tool contracts differ. Review action modes and approval requirements before calling
+an edit. Readback-confirmed results are `verified`; `committed_unverified` means the
+host accepted a change but verification is incomplete. Inspect Premiere before
+retrying an uncertain mutation. Save a duplicate project for evaluation and confirm
+rendered output separately.
+
+**Which Adobe Premiere Pro tasks are good first automation candidates?**
+Start with a read-only project and timeline inventory. Then evaluate one bounded
+workflow on a duplicate project: approved media imports, bin organization, marker
+preparation, or review-frame exports. The [automation guide](https://premiere-pro-mcp.com/blog/premiere-pro-workflow-automation/)
+links exact tool contracts and explains what evidence to check. A still-frame export
+does not prove playback or audio; a local delivery QC scan does not prove every
+platform requirement.
+
+**Where can search engines and AI assistants find current product facts?**
+Use the website's [facts page](https://premiere-pro-mcp.com/facts/) and
+[generated AI reference](https://premiere-pro-mcp.com/llms.txt), which describe the
+integrity-verified published npm artifact. The source counts in this README can
+include changes not yet published. Neither catalog counts nor unit tests establish
+that an operation succeeded on a particular Premiere host.
+
 **Is it free?**
 Yes. The server, the CEP connector, and the documentation are MIT licensed and free
 to use.

package/after-effects-cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.19.0" ExtensionBundleName="MCP for Adobe After Effects">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.aftereffects.bridge" ExtensionBundleVersion="1.20.0" ExtensionBundleName="MCP for Adobe After Effects">
   <ExtensionList>
-    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.19.0"/>
-    <Extension Id="com.mcp.aftereffects.bridge.headless" Version="1.19.0"/>
+    <Extension Id="com.mcp.aftereffects.bridge.panel" Version="1.20.0"/>
+    <Extension Id="com.mcp.aftereffects.bridge.headless" Version="1.20.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/after-effects-cep-plugin/bridge-directory-security.cjs

@@ -29,6 +29,7 @@
     '}',
     'if ($initialize) {',
     '  if ($unsafeAncestors.Count -ne 0) { throw ("Bridge directory ancestry is unsafe: " + (($unsafeAncestors | ForEach-Object { "{0} ({1}: {2})" -f $_.path, $_.reason, $_.sid }) -join "; ")) }',
+    '  $acl.SetOwner((New-Object System.Security.Principal.SecurityIdentifier($current)))',
     '  $acl.SetAccessRuleProtection($true, $false)',
     '  $inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit',
     '  $propagation = [System.Security.AccessControl.PropagationFlags]::None',

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.19.0" ExtensionBundleName="MCP for Adobe Premiere Pro">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.20.0" ExtensionBundleName="MCP for Adobe Premiere Pro">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.19.0"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.19.0"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.20.0"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.20.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/bridge-directory-security.cjs

@@ -29,6 +29,7 @@
     '}',
     'if ($initialize) {',
     '  if ($unsafeAncestors.Count -ne 0) { throw ("Bridge directory ancestry is unsafe: " + (($unsafeAncestors | ForEach-Object { "{0} ({1}: {2})" -f $_.path, $_.reason, $_.sid }) -join "; ")) }',
+    '  $acl.SetOwner((New-Object System.Security.Principal.SecurityIdentifier($current)))',
     '  $acl.SetAccessRuleProtection($true, $false)',
     '  $inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit',
     '  $propagation = [System.Security.AccessControl.PropagationFlags]::None',

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">MCP updates</span>
-        <strong id="updateTitle">Version 1.19.0</strong>
+        <strong id="updateTitle">Version 1.20.0</strong>
         <span id="updateDetail">Checking the global MCP server and connector release…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" aria-describedby="updateDetail" disabled>

package/cep-plugin/main.js

@@ -321,6 +321,9 @@ function processOneCommand(cmdFileName) {
 
   // While evalScript is in flight, heartbeat a busy file so the MCP server can
   // tell "script still running (modal dialog?)" apart from "plugin not running".
+  // This setInterval runs on CEP's own event loop. A host call that blocks that
+  // loop (as long exports or a modal can) also stalls the heartbeat; absence of
+  // a fresh marker is therefore not proof that Premiere is idle.
   // Only starts after 2s, so fast commands never touch the extra file.
   var busyFilePath = path.join(tempDir, "busy_" + id + ".json");
   var startedAt = new Date().getTime();

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.19.0";
+  var CURRENT_VERSION = "1.20.0";
   var PACKAGE_NAME = "premiere-pro-mcp";
   var LATEST_PACKAGE_API = "https://registry.npmjs.org/" + PACKAGE_NAME;
   var LATEST_RELEASE_API =