livepilot 1.9.9 → 1.9.11

package/SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.9.x   | Yes       |
+| < 1.9   | No        |
+
+## Architecture Security Notes
+
+LivePilot operates through three local interfaces:
+
+- **TCP 9878** — MCP server ↔ Ableton Remote Script (localhost only)
+- **UDP 9880** — M4L Analyzer → MCP server (localhost only)
+- **OSC 9881** — MCP server → M4L Analyzer (localhost only)
+
+All communication is **local only** — no ports are exposed to the network.
+The MCP server runs via stdio transport (stdin/stdout) and does not open HTTP endpoints.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **Do not** open a public issue
+2. Email **security@pilotstudio.dev** with:
+   - A description of the vulnerability
+   - Steps to reproduce
+   - Potential impact
+3. You will receive an acknowledgment within 48 hours
+4. We will work with you to understand and address the issue before any public disclosure
+
+If you don't have access to the email, you can use [GitHub's private vulnerability reporting](https://github.com/dreamrec/LivePilot/security/advisories/new).
+
+## Scope
+
+The following are in scope:
+
+- Remote code execution through MCP tool inputs
+- Path traversal in file-handling tools (MIDI I/O, sample loading)
+- Unauthorized access to Ableton session data
+- Denial of service against the MCP server or Remote Script
+
+The following are out of scope:
+
+- Issues requiring physical access to the machine
+- Issues in Ableton Live itself (report to Ableton)
+- Issues in MCP clients (report to the client maintainer)

package/bin/livepilot.js

@@ -55,6 +55,31 @@ function venvPython() {
   return path.join(VENV_DIR, isWin ? "Scripts" : "bin", isWin ? "python.exe" : "python3");
 }
 
+function findOtherLiveClient(host, port) {
+  try {
+    const out = execFileSync("lsof", ["-nP", `-iTCP:${port}`], {
+      encoding: "utf-8",
+      timeout: 3000,
+      stdio: ["pipe", "pipe", "ignore"],
+    });
+    const target = `->${host}:${port}`;
+    const lines = out.trim().split("\n").slice(1);
+    for (const line of lines) {
+      if (!line.includes(target) || !line.includes("(ESTABLISHED)")) {
+        continue;
+      }
+      const parts = line.trim().split(/\s+/);
+      const pid = parseInt(parts[1], 10);
+      if (!Number.isNaN(pid) && pid !== process.pid) {
+        return `PID ${pid} (${parts[0]})`;
+      }
+    }
+  } catch {
+    // best-effort only
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Virtual environment bootstrap
 // ---------------------------------------------------------------------------
@@ -133,6 +158,13 @@ function checkStatus() {
           if (resp.ok === true && resp.result && resp.result.pong) {
             console.log("  Ableton Live: connected on %s:%d", HOST, PORT);
             ok = true;
+          } else if (resp.ok === false && resp.error && resp.error.code === "STATE_ERROR") {
+            console.log(
+              "  Ableton Live: reachable, but another LivePilot client is already connected"
+            );
+            if (resp.error.message) {
+              console.log("    Detail: %s", resp.error.message);
+            }
           } else {
             console.log("  Ableton Live: unexpected response:", JSON.stringify(resp));
           }
@@ -145,7 +177,15 @@ function checkStatus() {
     });
 
     sock.on("timeout", () => {
-      console.log("  Ableton Live: connection timed out");
+      const otherClient = findOtherLiveClient(HOST, PORT);
+      if (otherClient) {
+        console.log(
+          "  Ableton Live: reachable, but another LivePilot client appears connected (%s)",
+          otherClient
+        );
+      } else {
+        console.log("  Ableton Live: connection timed out");
+      }
       sock.destroy();
       resolve(false);
     });

package/livepilot/.Codex-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "livepilot",
+  "version": "1.9.11",
+  "description": "Agentic production system for Ableton Live 12 — 178 tools, 17 domains, device atlas, spectral perception, technique memory, neo-Riemannian harmony, Euclidean rhythm, species counterpoint, MIDI I/O",
+  "author": {
+    "name": "Pilot Studio"
+  }
+}

package/livepilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "livepilot",
-  "version": "1.9.9",
+  "version": "1.9.11",
   "description": "Agentic production system for Ableton Live 12 — 178 tools, 17 domains, device atlas, spectral perception, technique memory, neo-Riemannian harmony, Euclidean rhythm, species counterpoint, MIDI I/O",
   "author": {
     "name": "Pilot Studio"

package/livepilot/commands/beat.md

@@ -8,11 +8,23 @@ Guide the user through creating a beat from scratch. Follow these steps:
 1. **Ask about the vibe** — genre, tempo range, mood, reference tracks
 2. **Set up the session** — `set_tempo`, create tracks for drums/bass/harmony/melody with `create_midi_track`, name and color them
 3. **Load instruments** — use `find_and_load_device` for appropriate instruments per track
-4. **Program drums first** — create a clip, add kick/snare/hat patterns with `add_notes`
-5. **Add bass** — create clip, program a bassline that locks with the kick
-6. **Add harmony** — chords or pads that set the mood
-7. **Add melody** — top-line or lead element
-8. **Mix** — balance levels with `set_track_volume` and `set_track_pan`
-9. **Fire the scene** to listen, iterate based on feedback
+4. **Verify device health** — after loading, run `get_device_info` on each loaded device. A `parameter_count` of 0 or 1 on AU/VST plugins means the plugin failed to initialize (dead plugin). If detected:
+   - Delete the dead plugin with `delete_device`
+   - Replace with a native Ableton alternative (e.g., Saturator instead of tape plugins, Operator instead of failed FM synths)
+   - Run `get_session_diagnostics` for any other issues (armed tracks, missing instruments)
+   - Inform the user which plugin failed and what replacement was used
+5. **Program drums first** — create a clip, add kick/snare/hat patterns with `add_notes`
+6. **Add bass** — create clip, program a bassline that locks with the kick
+7. **Add harmony** — chords or pads that set the mood
+8. **Add melody** — top-line or lead element
+9. **Mix** — balance levels with `set_track_volume` and `set_track_pan`
+10. **Pitch & tuning audit** — MANDATORY before firing. Run on every melodic track (skip drums):
+    - `identify_scale` on each track — verify all tracks agree on the same tonal center
+    - `analyze_harmony` on chordal tracks (pads, keys) — verify chord quality (no accidental augmented/diminished chords unless intentional)
+    - `detect_theory_issues` with `strict=true` on each track — check for out-of-key notes, parallel fifths, voice crossing
+    - **Interpret results against the intended scale**, not just C major. The analyzer only knows 7 standard modes — exotic scales (Hijaz, Hungarian minor, whole tone, etc.) will produce false "out of key" warnings. Cross-reference flagged notes against the intended scale manually.
+    - Report a clear tuning table to the user: which tracks are clean, which have issues, what the issues are
+    - Fix wrong notes with `modify_notes` before proceeding
+11. **Fire the scene** to listen, iterate based on feedback
 
 Use the livepilot-core skill for all tool calls. Verify after each step. Keep the user informed of what you're doing and why.

package/livepilot/commands/sounddesign.md

@@ -7,10 +7,11 @@ Guide the user through designing a sound. Follow these steps:
 
 1. **Ask about the target sound** — what character? (warm pad, aggressive bass, shimmering lead, atmospheric texture, etc.)
 2. **Choose an instrument** — pick the right synth for the job, load it with `find_and_load_device`
-3. **Get parameters** — `get_device_parameters` to see what's available
-4. **Shape the sound** — `set_device_parameter` or `batch_set_parameters` to dial in the character
-5. **Add effects** — load effects (reverb, delay, chorus, distortion, etc.) and tweak their parameters
-6. **Create a test pattern** — `create_clip` + `add_notes` with a simple pattern to audition
-7. **Fire the clip** to listen, iterate based on feedback
+3. **Verify device loaded** — `get_device_info` to confirm plugin initialized (AU/VST with `parameter_count` <= 1 = dead plugin — delete and replace with native alternative)
+4. **Get parameters** — `get_device_parameters` to see what's available
+5. **Shape the sound** — `set_device_parameter` or `batch_set_parameters` to dial in the character
+6. **Add effects** — load effects (reverb, delay, chorus, distortion, etc.) and tweak their parameters
+7. **Create a test pattern** — `create_clip` + `add_notes` with a simple pattern to audition
+8. **Fire the clip** to listen, iterate based on feedback
 
 Explain what each parameter does as you adjust it. Use `undo` liberally if something sounds wrong.

package/livepilot/skills/livepilot-core/SKILL.md

@@ -26,6 +26,9 @@ These layers sit on top of 178 deterministic tools across 17 domains: transport,
 9. **Tempo range 20-999 BPM** — validated before sending to Ableton
 10. **Always name your tracks and clips** — organization is part of the creative process
 11. **Respect tool speed tiers** — see below. Never call heavy tools without user consent.
+12. **ALWAYS report tool errors to the user** — if any tool call returns an error, immediately tell the user what failed, why, and what workaround you're using. Never silently swallow errors or switch strategies without explaining. Include: the tool name, the error message, and your fallback plan. This applies to all tool errors including missing M4L analyzer, dead plugins (`parameter_count` <= 1 on AU/VST), connection timeouts, and invalid parameter responses.
+13. **Verify plugin health after loading** — v1.9.11+ tools now return `health_flags`, `mcp_sound_design_ready`, and `plugin_host_status` on device load and info calls. Check `mcp_sound_design_ready` — if `false`, check `health_flags` for: `opaque_or_failed_plugin` (dead or untweakable AU/VST), `sample_dependent` (granular synth needing source audio). On failure: delete with `delete_device`, replace with native Ableton alternative, report to user.
+14. **Use `C hijaz` for Hijaz/Phrygian Dominant keys** — v1.9.11+ theory tools accept `hijaz` as a key alias. Use `key="C hijaz"` in `detect_theory_issues`, `analyze_harmony`, etc. to avoid false out-of-key warnings on Hijaz, manele, or Middle Eastern scales.
 
 ## Tool Speed Tiers
 
@@ -88,6 +91,13 @@ Never skip levels. The user's question determines the entry point, but always st
 2. **For Drum Racks: `get_rack_chains`** — confirm chains exist (an empty Drum Rack = silence). You need named chains like "Bass Drum", "Snare", etc.
 3. **For synths: `get_device_parameters`** — confirm `Volume`/`Gain` parameter is not 0. Check oscillators are on.
 4. **For effects: check `Dry/Wet` and `Drive`/key params** — a Saturator with Drive=0 or a Reverb with Dry/Wet=0 does nothing.
+5. **For AU/VST plugins: `get_device_info`** — if `parameter_count` <= 1 and `class_name` contains "PluginDevice", the plugin is dead. Delete and replace with native alternative. Report the failure.
+6. **CRITICAL — Sample-dependent instruments produce silence without source material.** These plugins load "successfully" (many parameters) but output nothing until a sample/audio source is provided. Since MCP tools CANNOT load samples into third-party plugin UIs, **NEVER use these as standalone instruments**:
+   - **Granular synths:** iDensity, Tardigrain, Koala Sampler, Burns Audio Granular
+   - **Samplers without presets:** bare Simpler, bare Sampler (always load a preset, never the empty shell)
+   - **Sample players:** AudioLayer, sEGments (need user to load samples via plugin GUI)
+   - **Instead use:** Wavetable, Operator, Drift, Analog, Meld, Collision, Tension — these are self-contained synthesizers that produce sound immediately from MIDI input alone.
+   - **If granular textures are needed:** Use Wavetable with aggressive wavetable position modulation, or Operator with FM feedback and short envelopes, or load a Simpler/Sampler **preset** (not the bare instrument) from the Sounds browser.
 
 ### After programming notes:
 1. **`fire_clip` or `fire_scene`** — always listen. If the track has notes but the instrument has no samples/chains, you're playing silence.
@@ -100,11 +110,15 @@ Never skip levels. The user's question determines the entry point, but always st
 
 ### Quick health check pattern:
 ```
-1. get_track_info(track_index)          → has devices? has clips?
-2. get_rack_chains (if Drum Rack)       → has chains with samples?
-3. get_device_parameters                → volume > 0? key params set?
-4. Check mixer.volume > 0              → track is audible?
-5. fire_clip / fire_scene              → sound comes out?
+1. get_device_info(track, device)       → class_name? parameter_count?
+   - PluginDevice with param_count<=1?  → DEAD PLUGIN. Delete + replace.
+   - Is it a sample-dependent plugin?   → SILENT. Replace with self-contained synth.
+2. get_track_info(track_index)          → has devices? has clips?
+3. get_rack_chains (if Drum Rack)       → has chains with samples?
+4. get_device_parameters                → volume > 0? key params set?
+5. Check mixer.volume > 0              → track is audible?
+6. fire_clip / fire_scene              → sound comes out?
+7. REPORT any issues to the user        → never silently work around failures.
 ```
 
 ### Red flags (things that produce silence):
@@ -116,6 +130,8 @@ Never skip levels. The user's question determines the entry point, but always st
 - Master volume at 0
 - MIDI track with no instrument loaded
 - Notes programmed but clip not fired
+- **Dead AU/VST plugin** — `parameter_count` <= 1 on a PluginDevice (plugin shell loaded, DSP engine crashed)
+- **Sample-dependent plugin with no sample** — granular synths, bare samplers, and sample players load "successfully" with many parameters but produce zero audio without source material. The sneakiest silent failure because `get_device_info` looks healthy.
 
 ## Tool Domains (178 total)
 
@@ -246,8 +262,15 @@ MIDI file import/export — works with standard .mid files on disk.
 6. `create_clip` — create clips on each track (4 beats = 1 bar at 4/4)
 7. `add_notes` — program MIDI patterns. Each note needs `pitch`, `start_time`, `duration`
 8. **HEALTH CHECK per track:** `get_track_info` → confirm device loaded, mixer volume > 0, not muted
-9. `fire_scene` or `fire_clip` — listen to your work
-10. Iterate: `get_notes` → `modify_notes` / `transpose_notes` → listen again
+9. **PITCH & TUNING AUDIT (MANDATORY before firing):**
+   - `identify_scale` on every melodic track — verify all tracks share the same tonal center
+   - `analyze_harmony` on chordal tracks — verify chord quality (no accidental augmented/diminished)
+   - `detect_theory_issues` with `strict=true` — check out-of-key notes, parallel fifths, voice crossing
+   - **Interpret against intended scale:** The analyzer only knows 7 standard modes. Exotic scales (Hijaz, Hungarian minor, whole tone, etc.) produce false "out of key" warnings. Cross-reference flagged pitches against the intended scale manually.
+   - Report a clear tuning table to the user before proceeding
+   - Fix wrong notes with `modify_notes` before firing
+10. `fire_scene` or `fire_clip` — listen to your work
+11. Iterate: `get_notes` → `modify_notes` / `transpose_notes` → listen again
 
 ## Workflow: Sound Design
 

package/livepilot/skills/livepilot-core/references/overview.md

@@ -1,4 +1,4 @@
-# LivePilot v1.9.9 — Architecture & Tool Reference
+# LivePilot v1.9.11 — Architecture & Tool Reference
 
 Agentic production system for Ableton Live 12. 178 tools across 17 domains. Device atlas (280+ devices), spectral perception (M4L analyzer), technique memory, automation intelligence (16 curve types, 15 recipes), music theory (Krumhansl-Schmuckler, species counterpoint), generative algorithms (Euclidean rhythm, tintinnabuli, phase shift, additive process), neo-Riemannian harmony (PRL transforms, Tonnetz), MIDI file I/O.
 

package/livepilot/skills/livepilot-release/SKILL.md

@@ -12,7 +12,8 @@ Run this checklist EVERY time the user says "update everything", "push", "releas
 - [ ] `package.json` → `"version"`
 - [ ] `package-lock.json` → `"version"` (run `npm install --package-lock-only` if stale)
 - [ ] `server.json` → `"version"` (TWO locations: top-level and package)
-- [ ] `livepilot/.claude-plugin/plugin.json` → `"version"`
+- [ ] `livepilot/.Codex-plugin/plugin.json` → `"version"` (primary Codex manifest)
+- [ ] `livepilot/.claude-plugin/plugin.json` → `"version"` (must match Codex plugin)
 - [ ] `.claude-plugin/marketplace.json` → `"version"` in plugins array
 - [ ] `mcp_server/__init__.py` → `__version__`
 - [ ] `remote_script/LivePilot/__init__.py` → `__version__` (log message auto-uses it)
@@ -23,7 +24,7 @@ Run this checklist EVERY time the user says "update everything", "push", "releas
 - [ ] `docs/social-banner.html` → version display
 - [ ] `docs/M4L_BRIDGE.md` → ping response example
 
-**How to check:** `grep -rn "1\.[0-9]\.[0-9]" package.json server.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json mcp_server/__init__.py remote_script/LivePilot/__init__.py m4l_device/livepilot_bridge.js CHANGELOG.md CLAUDE.md livepilot/skills/livepilot-core/references/overview.md docs/social-banner.html docs/M4L_BRIDGE.md`
+**How to check:** `grep -rn "1\.[0-9]\.[0-9]" package.json server.json livepilot/.Codex-plugin/plugin.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json mcp_server/__init__.py remote_script/LivePilot/__init__.py m4l_device/livepilot_bridge.js CHANGELOG.md CLAUDE.md livepilot/skills/livepilot-core/references/overview.md docs/social-banner.html docs/M4L_BRIDGE.md`
 
 ## 2. Tool Count (must ALL match)
 
@@ -36,7 +37,8 @@ Files that reference tool count:
 - [ ] `README.md` — header, PERCEPTION section ("139 core...29 analyzer"), Analyzer table header "(29)", Perception table header "(4)"
 - [ ] `package.json` → `"description"` (178 tools, 17 domains)
 - [ ] `server.json` → `"description"`
-- [ ] `livepilot/.claude-plugin/plugin.json` → `"description"`
+- [ ] `livepilot/.Codex-plugin/plugin.json` → `"description"` (primary Codex manifest)
+- [ ] `livepilot/.claude-plugin/plugin.json` → `"description"` (must match Codex plugin)
 - [ ] `.claude-plugin/marketplace.json` → `"description"`
 - [ ] `CLAUDE.md` → "178 tools across 17 domains"
 - [ ] `livepilot/skills/livepilot-core/SKILL.md` — "178 tools across 17 domains", Analyzer (29), Perception (4)
@@ -75,6 +77,7 @@ Current: **17 domains**: transport, tracks, clips, notes, devices, scenes, mixin
 
 - [ ] `~/.claude/plugins/cache/dreamrec-LivePilot/livepilot/` has current version directory
 - [ ] Old version directories removed
+- [ ] `~/.claude/plugins/installed_plugins.json` → `livepilot@dreamrec-LivePilot` entry: update `version`, `installPath`, `gitCommitSha`, `lastUpdated`
 
 ## 7. Social/Promotional Assets
 
@@ -105,5 +108,5 @@ Current: **17 domains**: transport, tracks, clips, notes, devices, scenes, mixin
 ## Quick Verify Command
 
 ```bash
-echo "=== Versions ===" && grep -h '"version"' package.json server.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json | head -6 && grep __version__ mcp_server/__init__.py remote_script/LivePilot/__init__.py && echo "=== Tool count ===" && grep -rc "@mcp.tool" mcp_server/tools/ | grep -v ":0" | awk -F: '{sum+=$2} END{print "Total:", sum}' && echo "=== Tests ===" && python3 -m pytest tests/ -q 2>&1 | tail -1
+echo "=== Versions ===" && grep -h '"version"' package.json server.json livepilot/.Codex-plugin/plugin.json livepilot/.claude-plugin/plugin.json .claude-plugin/marketplace.json | head -7 && grep __version__ mcp_server/__init__.py remote_script/LivePilot/__init__.py && echo "=== Tool count ===" && grep -rc "@mcp.tool" mcp_server/tools/ | grep -v ":0" | awk -F: '{sum+=$2} END{print "Total:", sum}' && echo "=== Tests ===" && python3 -m pytest tests/ -q 2>&1 | tail -1
 ```