io.github.TMHSDigital/screencast-mcp

### Security

- Network and device paths are refused in every path argument: a UNC (`\\host\share`), `//host/share`, WebDAV (`\\host@SSL@443\...`), `\\?\UNC\` or `\\.\` path is rejected before anything opens it, because opening one sends the user's NTLM credentials to that host. The check runs once per tool call, before the handler, including paths nested in `pipeline` steps.
- Input paths are confined like outputs: once the client sends workspace roots or `SCREENCAST_ALLOWED_DIRS` is set, files to read must sit inside `SCREENCAST_HOME`, the roots, or those folders (a whisper model and a font file are exempt).
- A client whose `roots/list` request fails now gets `SCREENCAST_HOME` and `SCREENCAST_ALLOWED_DIRS` only, instead of no confinement.
- With no confinement configured, replacing an existing file outside `SCREENCAST_HOME` is refused even with `overwrite: true`; list its folder in `SCREENCAST_ALLOWED_DIRS` to allow it.
- `index_recording` masks secret-shaped screen text before writing the index, and `search_recording` matches the masked text, so hit counts cannot confirm a secret. Retention also removes old `*.index.json` sidecars under `SCREENCAST_HOME` (#266).

### Added

- `screencast-mcp setup` (#267): one command for first-run setup. It runs the `doctor` checks as a checklist, offers `winget install Gyan.FFmpeg` when FFmpeg 8 is missing, and merges the server into Claude Desktop, Cursor, and VS Code configs (each backed up first) and Claude Code (`claude mcp add`). `--dry-run` prints the changes, `--yes` skips prompts, `--test` records a 3 s GIF.
- The GitHub Action (#268): `comment: true` keeps one sticky PR comment per job with the exit code, how the recording ended, OCR'd error lines, and a link to the evidence artifact. The CLI gains `--ocr-errors`.
- The Action gains `max-duration`, `end-reason`, `artifact-name`, and `artifact-url`; the CLI gains `--command-env NAME` (#257).

### Fixed

- `redact_region` and `pipeline` `style: "blur"` failed on FFmpeg 8.1.3 and newer for small or thin regions (a 4x4 box, a 16 px text line): boxblur now requires a radius strictly under half the region's side, and the radius is chosen that way.

- `pipeline` recipes: `redact`, `crop`, and `cursor` overrides now run first (after any trim), in source pixels and time. Before, a redact added to `social_reel` landed after the cut and the 9:16 reframe and missed the secret, and on the other recipes a redact or cursor override failed to plan (#251).
- Overlapping `pause_recording`, `resume_recording`, and `stop_recording` calls on one session now run one at a time: a second resume no longer starts an untracked ffmpeg, a stop during a pause no longer force-kills the segment it is finalizing, and a segment ffprobe cannot read is kept with an estimated length instead of dropped (#252).
- `encoder: "auto"` skips hardware encoders the frame is too large for (NVENC 4096 px, QSV/AMF 4096x2304), and a hardware encoder that fails at start is retried once with x264, with an `encoderNote` (#253).
- `narrate` and OCR batches pass their data through a temp file instead of the command line, so long scripts no longer fail with ENAMETOOLONG (#254).
- `index_recording` rebuilds an index made without OCR once OCR is available; sidecars are named after the full file name (`demo.mp4.index.json`, reading the old name only when it belongs to the same recording); `search_recording` refuses an index of another recording and queries with no letters or digits (#255).
- `pipeline` and `narrate` no longer overwrite an existing `.srt` without `overwrite: true`, and the pipeline's sidecar is re-timed through speed and cut steps after the captions (#256).
- The CLI and Action: `evidence.json` records `status` and `endReason` and the run warns when the recording ended before the command; `--max-duration` must be a whole number in range; commands with quotes and `&` survive cmd.exe; the default artifact name is unique per job and matrix leg; and the Action runs the npm