livepilot 1.10.6 → 1.10.8

package/installer/install.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const { findAbletonPaths } = require("./paths");
 
@@ -10,6 +11,60 @@ const SOURCE_DIR = path.join(ROOT, "remote_script", "LivePilot");
 // Files / dirs to skip during copy
 const SKIP = new Set(["__pycache__", ".DS_Store"]);
 
+// How many previous backups to keep on disk before auto-pruning (the upgrade
+// path renames the old LivePilot dir to LivePilot.backup-<ts>/ so the user can
+// recover a manual edit).
+const BACKUP_RETENTION = 3;
+
+/**
+ * Typed installer error. Wrappers (e.g. the --setup wizard) can catch this
+ * and decide whether to continue with later steps (recoverable) or abort the
+ * whole wizard (non-recoverable). The previous version called process.exit(1)
+ * mid-function, which silently short-circuited the setup wizard — callers
+ * had try/catch expecting exceptions, so later steps (bootstrap, M4L install,
+ * diagnostics) were skipped without warning.
+ */
+class InstallerAbort extends Error {
+  constructor(message, { recoverable = false } = {}) {
+    super(message);
+    this.name = "InstallerAbort";
+    this.recoverable = recoverable;
+  }
+}
+
+/**
+ * Validate that a user-supplied install destination is somewhere safe.
+ * Refuses to write outside of the user's home directory unless it matches
+ * one of the known Ableton Remote Scripts paths. This closes the path-
+ * traversal hole from `LIVEPILOT_INSTALL_PATH=/etc ...`.
+ */
+function _assertSafeInstallPath(resolvedPath, candidates) {
+  const home = os.homedir();
+  const allowedPrefixes = [
+    home,
+    // Systemwide Ableton install paths that live outside $HOME on some platforms
+    "/Applications/Ableton",
+    "C:\\ProgramData\\Ableton",
+  ];
+  // The detected Ableton candidate paths are always considered safe
+  for (const c of candidates) {
+    if (path.resolve(c.path).startsWith(path.resolve(resolvedPath))) {
+      return;
+    }
+    if (path.resolve(resolvedPath).startsWith(path.resolve(c.path))) {
+      return;
+    }
+  }
+  const safe = allowedPrefixes.some((p) => resolvedPath.startsWith(path.resolve(p)));
+  if (!safe) {
+    throw new InstallerAbort(
+      `LIVEPILOT_INSTALL_PATH=${resolvedPath} is outside permitted directories. ` +
+      `Refusing to install. Allowed roots: ${allowedPrefixes.join(", ")}`,
+      { recoverable: false }
+    );
+  }
+}
+
 /**
  * Recursively copy a directory, skipping __pycache__ and .DS_Store.
  */
@@ -28,22 +83,51 @@ function copyDirSync(src, dest) {
   }
 }
 
+/**
+ * Prune old LivePilot.backup-<ts>/ dirs, keeping the most recent N.
+ */
+function _pruneBackups(parentDir) {
+  try {
+    const entries = fs.readdirSync(parentDir, { withFileTypes: true });
+    const backups = entries
+      .filter((e) => e.isDirectory() && /^LivePilot\.backup-\d+$/.test(e.name))
+      .map((e) => e.name)
+      .sort();  // lexicographic — timestamps are monotonic, so this is age order
+    while (backups.length > BACKUP_RETENTION) {
+      const old = backups.shift();
+      try {
+        fs.rmSync(path.join(parentDir, old), { recursive: true, force: true });
+      } catch {
+        // best effort — don't let cleanup failure break an install
+      }
+    }
+  } catch {
+    // best effort
+  }
+}
+
 /**
  * Install the LivePilot Remote Script into Ableton's Remote Scripts folder.
+ *
+ * Throws InstallerAbort on recoverable failures (auto-detect missing) or
+ * non-recoverable ones (path-traversal attempt). Never calls process.exit.
+ * This lets the setup wizard continue with later steps on a recoverable
+ * failure.
  */
 function install() {
   const candidates = findAbletonPaths();
 
   if (candidates.length === 0) {
-    console.log("Could not auto-detect an Ableton Live Remote Scripts directory.");
-    console.log("");
-    console.log("Manual install:");
-    console.log("  1. Open Ableton Live > Preferences > File/Folder");
-    console.log("  2. Find the User Remote Scripts folder path");
-    console.log("  3. Copy the 'remote_script/LivePilot' folder into that directory");
-    console.log("  4. Restart Ableton Live");
-    console.log("  5. In Preferences > Link/Tempo/MIDI, set a Control Surface to 'LivePilot'");
-    process.exit(1);
+    throw new InstallerAbort(
+      "Could not auto-detect an Ableton Live Remote Scripts directory.\n\n" +
+      "Manual install:\n" +
+      "  1. Open Ableton Live > Preferences > File/Folder\n" +
+      "  2. Find the User Remote Scripts folder path\n" +
+      "  3. Copy the 'remote_script/LivePilot' folder into that directory\n" +
+      "  4. Restart Ableton Live\n" +
+      "  5. In Preferences > Link/Tempo/MIDI, set a Control Surface to 'LivePilot'",
+      { recoverable: true }
+    );
   }
 
   // If multiple candidates exist, let the user choose via --install-path
@@ -51,7 +135,9 @@ function install() {
   let target;
   const explicitPath = process.env.LIVEPILOT_INSTALL_PATH;
   if (explicitPath) {
-    target = { path: explicitPath, description: "explicit (LIVEPILOT_INSTALL_PATH)" };
+    const resolved = path.resolve(explicitPath);
+    _assertSafeInstallPath(resolved, candidates);
+    target = { path: resolved, description: "explicit (LIVEPILOT_INSTALL_PATH)" };
   } else if (candidates.length > 1) {
     console.log("Multiple Ableton Remote Scripts directories detected:");
     candidates.forEach((c, i) => {
@@ -73,6 +159,25 @@ function install() {
   // Ensure target base exists
   fs.mkdirSync(targetBase, { recursive: true });
 
+  // Clear-then-copy upgrade path. Overlay-copying on top of an existing
+  // install leaves stale files when a module is removed/renamed upstream.
+  // Instead, rename the previous install to a timestamped backup, copy
+  // fresh, then prune old backups. The rename (not delete) preserves any
+  // local edits the user may have made.
+  if (fs.existsSync(destDir)) {
+    const ts = new Date().toISOString().replace(/[-:T.Z]/g, "").slice(0, 14);
+    const backup = path.join(targetBase, `LivePilot.backup-${ts}`);
+    try {
+      fs.renameSync(destDir, backup);
+      console.log("Existing install backed up to: %s", backup);
+    } catch (e) {
+      throw new InstallerAbort(
+        `Could not back up previous LivePilot install at ${destDir}: ${e.message}`,
+        { recoverable: false }
+      );
+    }
+  }
+
   console.log("Installing LivePilot Remote Script...");
   console.log("  Source: %s", SOURCE_DIR);
   console.log("  Target: %s", destDir);
@@ -80,6 +185,7 @@ function install() {
   console.log("");
 
   copyDirSync(SOURCE_DIR, destDir);
+  _pruneBackups(targetBase);
 
   console.log("Done! Next steps:");
   console.log("  1. Restart Ableton Live (or press Cmd+, to open Preferences)");
@@ -111,4 +217,4 @@ function uninstall() {
   }
 }
 
-module.exports = { install, uninstall };
+module.exports = { install, uninstall, InstallerAbort };

package/m4l_device/livepilot_bridge.js

@@ -95,7 +95,7 @@ function anything() {
 function dispatch(cmd, args) {
     switch(cmd) {
         case "ping":
-            send_response({"ok": true, "version": "1.10.6"});
+            send_response({"ok": true, "version": "1.10.8"});
             break;
         case "get_params":
             cmd_get_params(args);
@@ -183,6 +183,13 @@ function dispatch(cmd, args) {
         case "get_plugin_presets":
             cmd_get_plugin_presets(args);
             break;
+        // ── BUG-A2 / A3: deep-LOM properties not on the automatable surface ──
+        case "simpler_set_warp":
+            cmd_simpler_set_warp(args);
+            break;
+        case "compressor_set_sidechain":
+            cmd_compressor_set_sidechain(args);
+            break;
         default:
             send_response({"error": "Unknown command: " + cmd});
     }
@@ -641,8 +648,13 @@ function detect_key() {
     detected_key = note_names[best_key];
     detected_scale = best_scale;
 
-    // Send to UI
-    outlet(1, "key", detected_key + " " + detected_scale);
+    // Send to UI — use abbreviated scale ("min"/"maj") so text fits in the
+    // 72-pixel presentation widget, and pass a SINGLE symbol so Max's
+    // [route] + [prepend set] chain doesn't split atoms on the internal
+    // space. Max's [comment] displays whatever the `set` message carries.
+    var scale_abbr = (detected_scale === "minor") ? "min" : "maj";
+    var display = detected_key + " " + scale_abbr;  // e.g., "D min"
+    outlet(1, "key", display);
 }
 
 function correlate(a, b) {
@@ -991,6 +1003,206 @@ function cmd_simpler_warp(args) {
     }
 }
 
+// ── BUG-A2: Simpler warping property + warp_mode ─────────────────────
+//
+// Python's Remote Script ControlSurface API only exposes automatable
+// parameters. Simpler's `warping` and `warp_mode` live on the sample
+// child object (SimplerDevice.sample.*) — unreachable from the Python
+// side. Max JS LiveAPI can step INTO the sample child, so we do the
+// property write here and surface the result to the MCP server.
+//
+// args: [track_index, device_index, warp_on (0/1), warp_mode (-1 = leave alone, 0..6)]
+//   warp_mode: 0=Beats, 1=Tones, 2=Texture, 3=Re-Pitch, 4=Complex, 6=Complex Pro
+//
+// Returns: {ok, warping, warp_mode} on success, {error} otherwise.
+function cmd_simpler_set_warp(args) {
+    var track_idx = parseInt(args[0]);
+    var device_idx = parseInt(args[1]);
+    var warp_on = parseInt(args[2]);
+    var warp_mode = args.length > 3 ? parseInt(args[3]) : -1;
+
+    var device_path = build_device_path(track_idx, device_idx);
+    cursor_a.goto(device_path);
+    if (cursor_a.id === 0) {
+        send_response({"error": "Device not found at track " + track_idx + ", device " + device_idx});
+        return;
+    }
+    if (cursor_a.get("class_name").toString() !== "OriginalSimpler") {
+        send_response({"error": "Not a Simpler device (class is " + cursor_a.get("class_name") + ")"});
+        return;
+    }
+
+    // Step into the sample child — warping + warp_mode live there, not on
+    // the device itself.
+    try {
+        cursor_a.goto(device_path + " sample");
+        if (cursor_a.id === 0) {
+            send_response({"error": "Simpler has no sample loaded (warping not applicable)"});
+            return;
+        }
+        cursor_a.set("warping", warp_on ? 1 : 0);
+        if (warp_on && warp_mode >= 0) {
+            cursor_a.set("warp_mode", warp_mode);
+        }
+        // Read back so the caller can confirm the write landed
+        var read_warping = parseInt(cursor_a.get("warping"));
+        var read_warp_mode = parseInt(cursor_a.get("warp_mode"));
+        send_response({
+            "ok": true,
+            "track_index": track_idx,
+            "device_index": device_idx,
+            "warping": read_warping,
+            "warp_mode": read_warp_mode,
+        });
+    } catch(e) {
+        send_response({"error": "simpler_set_warp failed: " + e.message});
+    }
+}
+
+// ── BUG-A3: Compressor sidechain input routing ───────────────────────
+//
+// Sidechain INPUT ROUTING is exposed as LiveAPI properties on the
+// Compressor device in Live 11+: sidechain_input_routing_type and
+// sidechain_input_routing_channel. They don't appear in the automatable
+// parameter list so the Python Remote Script can't reach them; Max JS
+// LiveAPI can.
+//
+// args: [track_index, device_index, routing_type, routing_channel]
+//   routing_type: string — e.g. "1-Audio From" / track name / "Ext. In"
+//   routing_channel: string — "Post FX" / "Pre FX" / "Post Mixer" / ...
+//
+// Returns: {ok, sidechain: {type, channel}} on success.
+// Older Live versions without these properties return a clean error.
+function cmd_compressor_set_sidechain(args) {
+    var track_idx = parseInt(args[0]);
+    var device_idx = parseInt(args[1]);
+    var routing_type = String(args[2] || "");
+    var routing_channel = String(args[3] || "");
+
+    var path = build_device_path(track_idx, device_idx);
+    cursor_a.goto(path);
+    if (cursor_a.id === 0) {
+        send_response({"error": "Device not found at track " + track_idx + ", device " + device_idx});
+        return;
+    }
+    var class_name = String(cursor_a.get("class_name"));
+    if (class_name !== "Compressor2" && class_name !== "Compressor") {
+        send_response({"error": "Not a Compressor device (class is " + class_name + ")"});
+        return;
+    }
+
+    // Helper: read a LiveAPI property that returns a JSON-serialized dict
+    // or list. Max's `get()` wraps results in a single-element array,
+    // and complex properties come back as JSON strings.
+    function read_json_prop(name) {
+        try {
+            var raw = cursor_a.get(name);
+            if (raw === null || raw === undefined) return null;
+            if (Object.prototype.toString.call(raw) === "[object Array]" && raw.length === 1) {
+                raw = raw[0];
+            }
+            if (typeof raw === "string") {
+                try { return JSON.parse(raw); } catch(e) { return raw; }
+            }
+            return raw;
+        } catch(e) {
+            return null;
+        }
+    }
+
+    function find_by_name(list, name) {
+        if (!list || !list.length || !name) return null;
+        for (var i = 0; i < list.length; i++) {
+            var entry = list[i];
+            if (!entry) continue;
+            var n = entry.display_name || entry.name;
+            if (n === name) return entry;
+        }
+        return null;
+    }
+
+    try {
+        // Enable sidechain first — Live rejects routing writes on a
+        // compressor with the sidechain disabled. Property is available
+        // on Live 10+. Try/catch for legacy builds.
+        try { cursor_a.set("sidechain_enabled", 1); } catch(e) {}
+
+        var debug = {};
+
+        // --- Routing TYPE (the source: "1-DRUMS", "Ext. In", "No Input", …)
+        if (routing_type) {
+            var types = read_json_prop("available_sidechain_input_routing_types");
+            debug.requested_type = routing_type;
+            debug.type_count = types && types.length ? types.length : 0;
+            var t_match = find_by_name(types, routing_type);
+            if (t_match && t_match.identifier !== undefined) {
+                // LOM expects a RoutingType object; Max JS accepts a
+                // JSON-encoded {identifier: N} for the `set`.
+                cursor_a.set(
+                    "sidechain_input_routing_type",
+                    JSON.stringify({identifier: t_match.identifier})
+                );
+                debug.set_type = "ok (identifier=" + t_match.identifier + ")";
+            } else {
+                debug.set_type = "FAIL: no matching type";
+                if (types) {
+                    debug.available_types = [];
+                    for (var i = 0; i < types.length; i++) {
+                        debug.available_types.push(types[i].display_name || types[i].name || "?");
+                    }
+                }
+            }
+        }
+
+        // --- Routing CHANNEL (the tap point: "Post FX", "Pre FX", …)
+        if (routing_channel) {
+            var channels = read_json_prop("available_sidechain_input_routing_channels");
+            debug.requested_channel = routing_channel;
+            debug.channel_count = channels && channels.length ? channels.length : 0;
+            var c_match = find_by_name(channels, routing_channel);
+            if (c_match && c_match.identifier !== undefined) {
+                cursor_a.set(
+                    "sidechain_input_routing_channel",
+                    JSON.stringify({identifier: c_match.identifier})
+                );
+                debug.set_channel = "ok (identifier=" + c_match.identifier + ")";
+            } else {
+                debug.set_channel = "FAIL: no matching channel";
+                if (channels) {
+                    debug.available_channels = [];
+                    for (var j = 0; j < channels.length; j++) {
+                        debug.available_channels.push(channels[j].display_name || channels[j].name || "?");
+                    }
+                }
+            }
+        }
+
+        // Read back canonical display_name for confirmation
+        var cur_type = read_json_prop("sidechain_input_routing_type");
+        var cur_channel = read_json_prop("sidechain_input_routing_channel");
+        var read_type_name = (cur_type && cur_type.display_name) || "";
+        var read_channel_name = (cur_channel && cur_channel.display_name) || "";
+
+        send_response({
+            "ok": true,
+            "track_index": track_idx,
+            "device_index": device_idx,
+            "sidechain": {
+                "type": read_type_name,
+                "channel": read_channel_name,
+                "enabled": 1
+            },
+            "debug": debug
+        });
+    } catch(e) {
+        send_response({
+            "error": "compressor_set_sidechain failed: " + e.message
+                     + " (this Live build may not expose sidechain_input_routing_* —"
+                     + " user must set routing manually)"
+        });
+    }
+}
+
 // ── Phase 2: Warp Markers ─────────────────────────────────────────────
 
 function cmd_get_warp_markers(args) {

package/mcp_server/__init__.py

@@ -1,2 +1,2 @@
 """LivePilot MCP Server — bridges MCP protocol to Ableton Live."""
-__version__ = "1.10.6"
+__version__ = "1.10.8"