livepilot 1.9.9 → 1.9.12

package/m4l_device/livepilot_bridge.js

@@ -34,6 +34,7 @@ var detected_scale = "";
 var capture_active = false;
 var capture_timer = null;
 var capture_filename = "";
+var capture_file_path = "";
 var current_sample_rate = 44100; // Updated by dspstate~ via inlet 1
 
 // Base64 encoding table
@@ -67,7 +68,7 @@ function anything() {
     // OSC messages arrive as messagename — strip leading / if present
     var cmd = messagename;
     if (cmd.charAt(0) === "/") cmd = cmd.substring(1);
-    var args = arrayfromargs(arguments);
+    var args = _decode_arg_strings(arrayfromargs(arguments));
 
     // Defer to low-priority thread for LiveAPI safety
     var task = new Task(function() {
@@ -83,7 +84,7 @@ function anything() {
 function dispatch(cmd, args) {
     switch(cmd) {
         case "ping":
-            send_response({"ok": true, "version": "1.9.9"});
+            send_response({"ok": true, "version": "1.9.12"});
             break;
         case "get_params":
             cmd_get_params(args);
@@ -149,7 +150,7 @@ function dispatch(cmd, args) {
             cmd_capture_stop();
             break;
         case "check_flucoma":
-            send_response({"flucoma_available": true, "version": "1.0.9"});
+            cmd_check_flucoma();
             break;
         // ── Phase 2: Clip & Display ──
         case "scrub_clip":
@@ -188,36 +189,40 @@ function cmd_get_params(args) {
     var param_count = cursor_a.getcount("parameters");
     var params = [];
 
-    // Chunked reading: 4 params per batch
-    var batch_size = 4;
+    var batch_size = 8;
     var current = 0;
 
     function read_batch() {
-        var end = Math.min(current + batch_size, param_count);
-        for (var i = current; i < end; i++) {
-            cursor_b.goto(path + " parameters " + i);
-            var p = {
-                index: i,
-                name: cursor_b.get("name").toString(),
-                value: parseFloat(cursor_b.get("value")),
-                min: parseFloat(cursor_b.get("min")),
-                max: parseFloat(cursor_b.get("max")),
-                is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
-                automation_state: parseInt(cursor_b.get("automation_state")),
-                state: parseInt(cursor_b.get("state"))
-            };
-            // state: 0=enabled, 1=disabled, 2=irrelevant
-            // automation_state: 0=none, 1=active, 2=overridden
-            params.push(p);
-        }
-        current = end;
+        try {
+            var end = Math.min(current + batch_size, param_count);
+            for (var i = current; i < end; i++) {
+                cursor_b.goto(path + " parameters " + i);
+                params.push({
+                    index: i,
+                    name: cursor_b.get("name").toString(),
+                    value: parseFloat(cursor_b.get("value")),
+                    min: parseFloat(cursor_b.get("min")),
+                    max: parseFloat(cursor_b.get("max")),
+                    is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
+                    automation_state: parseInt(cursor_b.get("automation_state")),
+                    state: parseInt(cursor_b.get("state"))
+                });
+            }
+            current = end;
 
-        if (current < param_count) {
-            // Schedule next batch in 50ms
-            var next_task = new Task(read_batch);
-            next_task.schedule(50);
-        } else {
-            send_response({"track": track_idx, "device": device_idx, "params": params});
+            if (current < param_count) {
+                var next_task = new Task(read_batch);
+                next_task.schedule(20);
+            } else {
+                send_response({"track": track_idx, "device": device_idx, "params": params});
+            }
+        } catch (e) {
+            send_response({
+                "error": "Failed reading parameter " + current + ": " + String(e),
+                "track": track_idx,
+                "device": device_idx,
+                "partial_params": params
+            });
         }
     }
 
@@ -226,8 +231,7 @@ function cmd_get_params(args) {
 
 function cmd_get_hidden_params(args) {
     // Returns ALL parameters including hidden ones not in ControlSurface API
-    // Same as get_params but also includes value_string and whether it's
-    // accessible from the standard API
+    // Includes value_string (human-readable) via str_for_value where safe
     var track_idx = parseInt(args[0]);
     var device_idx = parseInt(args[1]);
     var path = build_device_path(track_idx, device_idx);
@@ -235,39 +239,51 @@ function cmd_get_hidden_params(args) {
     cursor_a.goto(path);
     var param_count = cursor_a.getcount("parameters");
     var device_name = cursor_a.get("name").toString();
+    var device_class = cursor_a.get("class_name").toString();
     var params = [];
     var current = 0;
-    var batch_size = 4;
+    var batch_size = 8;
 
     function read_batch() {
-        var end = Math.min(current + batch_size, param_count);
-        for (var i = current; i < end; i++) {
-            cursor_b.goto(path + " parameters " + i);
-            params.push({
-                index: i,
-                name: cursor_b.get("name").toString(),
-                value: parseFloat(cursor_b.get("value")),
-                min: parseFloat(cursor_b.get("min")),
-                max: parseFloat(cursor_b.get("max")),
-                default_value: parseFloat(cursor_b.get("default_value")),
-                is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
-                value_string: String(cursor_b.call("str_for_value", parseFloat(cursor_b.get("value")))),
-                automation_state: parseInt(cursor_b.get("automation_state")),
-                state: parseInt(cursor_b.get("state"))
-            });
-        }
-        current = end;
-
-        if (current < param_count) {
-            var next_task = new Task(read_batch);
-            next_task.schedule(50);
-        } else {
+        try {
+            var end = Math.min(current + batch_size, param_count);
+            for (var i = current; i < end; i++) {
+                cursor_b.goto(path + " parameters " + i);
+                var val = parseFloat(cursor_b.get("value"));
+                params.push({
+                    index: i,
+                    name: cursor_b.get("name").toString(),
+                    value: val,
+                    value_string: _safe_display_string(cursor_b, val, device_class),
+                    min: parseFloat(cursor_b.get("min")),
+                    max: parseFloat(cursor_b.get("max")),
+                    default_value: parseFloat(cursor_b.get("default_value")),
+                    is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
+                    automation_state: parseInt(cursor_b.get("automation_state")),
+                    state: parseInt(cursor_b.get("state"))
+                });
+            }
+            current = end;
+
+            if (current < param_count) {
+                var next_task = new Task(read_batch);
+                next_task.schedule(20);
+            } else {
+                send_response({
+                    "track": track_idx,
+                    "device": device_idx,
+                    "device_name": device_name,
+                    "total_params": param_count,
+                    "params": params
+                });
+            }
+        } catch (e) {
             send_response({
+                "error": "Failed reading parameter " + current + ": " + String(e),
                 "track": track_idx,
                 "device": device_idx,
                 "device_name": device_name,
-                "total_params": param_count,
-                "params": params
+                "partial_params": params
             });
         }
     }
@@ -285,31 +301,40 @@ function cmd_get_auto_state(args) {
     var param_count = cursor_a.getcount("parameters");
     var results = [];
     var current = 0;
-    var batch_size = 4;
+    var batch_size = 8;
 
     function read_batch() {
-        var end = Math.min(current + batch_size, param_count);
-        for (var i = current; i < end; i++) {
-            cursor_b.goto(path + " parameters " + i);
-            var state = parseInt(cursor_b.get("automation_state"));
-            // Only include params that HAVE automation (skip state=0)
-            if (state > 0) {
-                results.push({
-                    index: i,
-                    name: cursor_b.get("name").toString(),
-                    automation_state: state,
-                    // 1 = automation active, 2 = automation overridden (user moved knob)
-                    state_label: state === 1 ? "active" : "overridden"
+        try {
+            var end = Math.min(current + batch_size, param_count);
+            for (var i = current; i < end; i++) {
+                cursor_b.goto(path + " parameters " + i);
+                var state = parseInt(cursor_b.get("automation_state"));
+                if (state > 0) {
+                    results.push({
+                        index: i,
+                        name: cursor_b.get("name").toString(),
+                        automation_state: state,
+                        state_label: state === 1 ? "active" : "overridden"
+                    });
+                }
+            }
+            current = end;
+
+            if (current < param_count) {
+                var next_task = new Task(read_batch);
+                next_task.schedule(20);
+            } else {
+                send_response({
+                    "track": track_idx,
+                    "device": device_idx,
+                    "total_params": param_count,
+                    "automated_params": results,
+                    "automated_count": results.length
                 });
             }
-        }
-        current = end;
-
-        if (current < param_count) {
-            var next_task = new Task(read_batch);
-            next_task.schedule(50);
-        } else {
+        } catch (e) {
             send_response({
+                "error": "Failed reading automation state at param " + current + ": " + String(e),
                 "track": track_idx,
                 "device": device_idx,
                 "total_params": param_count,
@@ -391,62 +416,89 @@ function walk_device(path, depth) {
 }
 
 function cmd_get_chains_deep(args) {
-    // Get detailed chain info including all devices in each chain
     var track_idx = parseInt(args[0]);
     var device_idx = parseInt(args[1]);
     var path = build_device_path(track_idx, device_idx);
 
-    cursor_a.goto(path);
-    var chain_count = cursor_a.getcount("chains");
-    var chains = [];
-
-    for (var c = 0; c < chain_count; c++) {
-        var chain_path = path + " chains " + c;
-        cursor_b.goto(chain_path);
-        var chain = {
-            index: c,
-            name: cursor_b.get("name").toString(),
-            volume: parseFloat(cursor_b.get("volume")),
-            panning: parseFloat(cursor_b.get("panning")),
-            mute: parseInt(cursor_b.get("mute")) === 1,
-            solo: parseInt(cursor_b.get("solo")) === 1,
-            devices: []
-        };
+    try {
+        cursor_a.goto(path);
+        var chain_count = cursor_a.getcount("chains");
+        var chains = [];
 
-        var dev_count = cursor_b.getcount("devices");
-        for (var d = 0; d < dev_count; d++) {
-            cursor_a.goto(chain_path + " devices " + d);
-            chain.devices.push({
-                index: d,
-                name: cursor_a.get("name").toString(),
-                class_name: cursor_a.get("class_name").toString(),
-                is_active: parseInt(cursor_a.get("is_active")) === 1,
-                param_count: cursor_a.getcount("parameters")
-            });
+        for (var c = 0; c < chain_count; c++) {
+            var chain_path = path + " chains " + c;
+            cursor_b.goto(chain_path);
+            var chain = {
+                index: c,
+                name: cursor_b.get("name").toString(),
+                volume: parseFloat(cursor_b.get("volume")),
+                panning: parseFloat(cursor_b.get("panning")),
+                mute: parseInt(cursor_b.get("mute")) === 1,
+                solo: parseInt(cursor_b.get("solo")) === 1,
+                devices: []
+            };
+
+            var dev_count = cursor_b.getcount("devices");
+            for (var d = 0; d < dev_count; d++) {
+                cursor_a.goto(chain_path + " devices " + d);
+                chain.devices.push({
+                    index: d,
+                    name: cursor_a.get("name").toString(),
+                    class_name: cursor_a.get("class_name").toString(),
+                    is_active: parseInt(cursor_a.get("is_active")) === 1,
+                    param_count: cursor_a.getcount("parameters")
+                });
+            }
+            chains.push(chain);
         }
-        chains.push(chain);
+
+        send_response({"track": track_idx, "device": device_idx, "chains": chains});
+    } catch (e) {
+        send_response({"error": "Failed reading chains: " + String(e), "track": track_idx, "device": device_idx});
     }
+}
 
-    send_response({"track": track_idx, "device": device_idx, "chains": chains});
+function cmd_check_flucoma() {
+    // Check if FluCoMa externals are installed.
+    // Max JS cannot reliably probe the object search path at runtime,
+    // so we check if the FluCoMa package folder exists on disk.
+    try {
+        var pkg_path = max.appsupportpath + "/Packages/FluidCorpusManipulation";
+        var f = new Folder(pkg_path);
+        var available = !f.end;  // end === true means folder not found
+        f.close();
+        send_response({"flucoma_available": available});
+    } catch (e) {
+        // Can't probe — report unknown rather than lying
+        send_response({"flucoma_available": false, "probe_error": String(e)});
+    }
 }
 
 function cmd_get_track_cpu(args) {
-    // Get CPU performance impact per track
-    var results = [];
-    cursor_a.goto("live_set");
-    var track_count = cursor_a.getcount("tracks");
-
-    for (var t = 0; t < track_count; t++) {
-        cursor_b.goto("live_set tracks " + t);
-        results.push({
-            index: t,
-            name: cursor_b.get("name").toString(),
-            // performance_impact is 0.0-1.0 representing CPU load
-            cpu: parseFloat(cursor_b.get("performance_impact") || 0)
-        });
-    }
+    try {
+        var results = [];
+        cursor_a.goto("live_set");
+        var track_count = cursor_a.getcount("tracks");
 
-    send_response({"tracks": results, "count": track_count});
+        for (var t = 0; t < track_count; t++) {
+            cursor_b.goto("live_set tracks " + t);
+            var cpu = 0;
+            try {
+                cpu = parseFloat(cursor_b.get("performance_impact") || 0);
+            } catch (e) {
+                cpu = -1;
+            }
+            results.push({
+                index: t,
+                name: cursor_b.get("name").toString(),
+                cpu: cpu
+            });
+        }
+
+        send_response({"tracks": results, "count": track_count});
+    } catch (e) {
+        send_response({"error": "Failed reading track CPU: " + String(e)});
+    }
 }
 
 function cmd_get_selected() {
@@ -475,6 +527,25 @@ function cmd_get_selected() {
                 break;
             }
         }
+        // Check return tracks if not found in main tracks
+        if (result.selected_track === -1) {
+            cursor_a.goto("live_set");
+            var rtc = cursor_a.getcount("return_tracks");
+            for (var j = 0; j < rtc; j++) {
+                cursor_a.goto("live_set return_tracks " + j);
+                if (cursor_a.get("name").toString() === result.selected_track_name) {
+                    result.selected_track = -(j + 1);  // -1, -2, ... convention
+                    break;
+                }
+            }
+        }
+        // Check master track if still not found
+        if (result.selected_track === -1) {
+            cursor_a.goto("live_set master_track");
+            if (cursor_a.get("name").toString() === result.selected_track_name) {
+                result.selected_track = -1000;  // master convention
+            }
+        }
     } catch(e) {}
 
     // Selected scene
@@ -599,12 +670,12 @@ function send_response(obj) {
 }
 
 function base64_encode(str) {
-    var result = "";
-    var bytes = [];
-    for (var i = 0; i < str.length; i++) {
-        bytes.push(str.charCodeAt(i) & 0xFF);
-    }
+    // UTF-8 encode first, then base64 encode the byte sequence.
+    // This preserves non-ASCII characters (accented names, CJK, emoji)
+    // that would otherwise be truncated by charCodeAt & 0xFF.
+    var bytes = _utf8_encode(str);
 
+    var result = "";
     for (var i = 0; i < bytes.length; i += 3) {
         var b0 = bytes[i];
         var b1 = (i + 1 < bytes.length) ? bytes[i + 1] : 0;
@@ -623,6 +694,130 @@ function base64_encode(str) {
     return result;
 }
 
+function _utf8_encode(str) {
+    // Convert a JavaScript string to a UTF-8 byte array.
+    // Handles codepoints U+0000..U+FFFF (BMP) which covers all
+    // characters Max JS can produce from LiveAPI get() calls.
+    var bytes = [];
+    for (var i = 0; i < str.length; i++) {
+        var c = str.charCodeAt(i);
+        if (c < 0x80) {
+            bytes.push(c);
+        } else if (c < 0x800) {
+            bytes.push(0xC0 | (c >> 6));
+            bytes.push(0x80 | (c & 0x3F));
+        } else {
+            bytes.push(0xE0 | (c >> 12));
+            bytes.push(0x80 | ((c >> 6) & 0x3F));
+            bytes.push(0x80 | (c & 0x3F));
+        }
+    }
+    return bytes;
+}
+
+function base64_decode(str) {
+    var clean = String(str || "").replace(/=/g, "");
+    var bytes = [];
+
+    for (var i = 0; i < clean.length; i += 4) {
+        var c0 = B64.indexOf(clean.charAt(i));
+        var c1 = B64.indexOf(clean.charAt(i + 1));
+        var c2 = (i + 2 < clean.length) ? B64.indexOf(clean.charAt(i + 2)) : -1;
+        var c3 = (i + 3 < clean.length) ? B64.indexOf(clean.charAt(i + 3)) : -1;
+
+        if (c0 < 0 || c1 < 0 || (c2 < 0 && i + 2 < clean.length) || (c3 < 0 && i + 3 < clean.length)) {
+            throw new Error("Invalid base64 input");
+        }
+
+        bytes.push(((c0 << 2) | (c1 >> 4)) & 0xFF);
+        if (c2 !== -1) {
+            bytes.push((((c1 & 15) << 4) | (c2 >> 2)) & 0xFF);
+        }
+        if (c3 !== -1) {
+            bytes.push((((c2 & 3) << 6) | c3) & 0xFF);
+        }
+    }
+
+    return bytes;
+}
+
+function _utf8_decode(bytes) {
+    // Convert a UTF-8 byte array back to a JavaScript string.
+    // Handles BMP codepoints which covers the text LivePilot exchanges.
+    var result = "";
+    for (var i = 0; i < bytes.length;) {
+        var b0 = bytes[i];
+        if (b0 < 0x80) {
+            result += String.fromCharCode(b0);
+            i += 1;
+        } else if ((b0 & 0xE0) === 0xC0 && i + 1 < bytes.length) {
+            var b1 = bytes[i + 1];
+            result += String.fromCharCode(((b0 & 0x1F) << 6) | (b1 & 0x3F));
+            i += 2;
+        } else if (i + 2 < bytes.length) {
+            var b2 = bytes[i + 1];
+            var b3 = bytes[i + 2];
+            result += String.fromCharCode(
+                ((b0 & 0x0F) << 12) |
+                ((b2 & 0x3F) << 6) |
+                (b3 & 0x3F)
+            );
+            i += 3;
+        } else {
+            break;
+        }
+    }
+    return result;
+}
+
+function _decode_b64_arg(arg) {
+    if (arg === null || arg === undefined) {
+        return arg;
+    }
+    var text = String(arg);
+    if (text.indexOf("b64:") !== 0) {
+        return arg;
+    }
+    try {
+        return _utf8_decode(base64_decode(text.substring(4)));
+    } catch (e) {
+        return arg;
+    }
+}
+
+function _decode_arg_strings(args) {
+    var decoded = [];
+    for (var i = 0; i < args.length; i++) {
+        decoded.push(_decode_b64_arg(args[i]));
+    }
+    return decoded;
+}
+
+function _to_posix_path(path) {
+    if (!path || path.length < 2) return path;
+
+    // Keep Windows-style drive paths unchanged.
+    if (path.length >= 3 && path.charAt(1) === ":" &&
+        (path.charAt(2) === "/" || path.charAt(2) === "\\")) {
+        return path;
+    }
+
+    var colon = path.indexOf(":");
+    var slash = path.indexOf("/");
+    if (colon <= 0 || (slash !== -1 && colon > slash)) {
+        return path;
+    }
+
+    var rest = path.substring(colon + 1);
+    if (rest.indexOf(":") !== -1) {
+        rest = rest.replace(/:/g, "/");
+    }
+    if (rest.charAt(0) !== "/") {
+        rest = "/" + rest.replace(/^[/\\]+/, "");
+    }
+    return rest;
+}
+
 // ── Phase 2: Sample Operations ────────────────────────────────────────
 
 function cmd_get_clip_file_path(args) {
@@ -641,7 +836,7 @@ function cmd_get_clip_file_path(args) {
         send_response({
             "track": track_idx,
             "clip": clip_idx,
-            "file_path": sample_path,
+            "file_path": _to_posix_path(sample_path),
             "length": parseFloat(cursor_a.get("length")),
             "name": cursor_a.get("name").toString()
         });
@@ -653,7 +848,8 @@ function cmd_get_clip_file_path(args) {
 function cmd_replace_simpler_sample(args) {
     var track_idx = parseInt(args[0]);
     var device_idx = parseInt(args[1]);
-    // Reconstruct file path — spaces in path split into multiple OSC args
+    // Keep the join for backward compatibility with older clients.
+    // Current clients send file paths as a single decoded b64: arg.
     var parts = [];
     for (var i = 2; i < args.length; i++) parts.push(args[i].toString());
     var file_path = parts.join(" ");
@@ -906,6 +1102,10 @@ function cmd_stop_scrub(args) {
     var path = build_track_path(track_idx) + " clip_slots " + clip_idx + " clip";
 
     cursor_a.goto(path);
+    if (cursor_a.id === 0) {
+        send_response({"error": "No clip at track " + track_idx + " slot " + clip_idx});
+        return;
+    }
     try {
         cursor_a.call("stop_scrub");
         send_response({"ok": true});
@@ -914,6 +1114,28 @@ function cmd_stop_scrub(args) {
     }
 }
 
+// Device classes where str_for_value freezes Max JS (uncatchable hang).
+// Auto Filter is the confirmed case; others may exist.
+var STR_FOR_VALUE_BLACKLIST = ["AutoFilter"];
+
+function _safe_display_string(cursor, val, device_class) {
+    // Return the human-readable UI string for a parameter value.
+    // Falls back to raw value string for blacklisted device classes
+    // where str_for_value hangs Max's JS engine.
+    if (STR_FOR_VALUE_BLACKLIST.indexOf(device_class) !== -1) {
+        return String(val);
+    }
+    try {
+        var result = cursor.call("str_for_value", val);
+        if (result !== undefined && result !== null && String(result) !== "") {
+            return String(result);
+        }
+    } catch(e) {
+        // str_for_value not available on this parameter
+    }
+    return String(val);
+}
+
 function cmd_get_display_values(args) {
     var track_idx = parseInt(args[0]);
     var device_idx = parseInt(args[1]);
@@ -922,34 +1144,46 @@ function cmd_get_display_values(args) {
     cursor_a.goto(path);
     var param_count = cursor_a.getcount("parameters");
     var device_name = cursor_a.get("name").toString();
+    var device_class = cursor_a.get("class_name").toString();
     var params = [];
     var current = 0;
-    var batch_size = 4;
+    var batch_size = 8;
 
     function read_batch() {
-        var end = Math.min(current + batch_size, param_count);
-        for (var i = current; i < end; i++) {
-            cursor_b.goto(path + " parameters " + i);
-            var state = parseInt(cursor_b.get("state"));
-            if (state !== 2) {
-                params.push({
-                    index: i,
-                    name: cursor_b.get("name").toString(),
-                    display_value: String(cursor_b.call("str_for_value", parseFloat(cursor_b.get("value")))),
-                    value: parseFloat(cursor_b.get("value"))
+        try {
+            var end = Math.min(current + batch_size, param_count);
+            for (var i = current; i < end; i++) {
+                cursor_b.goto(path + " parameters " + i);
+                var state = parseInt(cursor_b.get("state"));
+                if (state !== 2) {
+                    var val = parseFloat(cursor_b.get("value"));
+                    params.push({
+                        index: i,
+                        name: cursor_b.get("name").toString(),
+                        display_value: _safe_display_string(cursor_b, val, device_class),
+                        value: val
+                    });
+                }
+            }
+            current = end;
+            if (current < param_count) {
+                var next_task = new Task(read_batch);
+                next_task.schedule(20);
+            } else {
+                send_response({
+                    "track": track_idx,
+                    "device": device_idx,
+                    "device_name": device_name,
+                    "params": params
                 });
             }
-        }
-        current = end;
-        if (current < param_count) {
-            var next_task = new Task(read_batch);
-            next_task.schedule(50);
-        } else {
+        } catch (e) {
             send_response({
+                "error": "Failed reading parameter " + current + ": " + String(e),
                 "track": track_idx,
                 "device": device_idx,
                 "device_name": device_name,
-                "params": params
+                "partial_params": params
             });
         }
     }
@@ -970,6 +1204,15 @@ function cmd_capture_audio(args) {
     var duration_ms = parseInt(args[0]) || 10000;
     var requested_name = args[1] ? args[1].toString().trim() : "";
 
+    // Sanitize filename — strip any directory components (defense-in-depth)
+    if (requested_name.length > 0) {
+        requested_name = _safe_filename(requested_name);
+        if (!requested_name || requested_name.length === 0) {
+            send_response({"error": "Invalid capture filename (path traversal blocked)"});
+            return;
+        }
+    }
+
     // Generate a timestamped filename if none provided
     var d = new Date();
     var ts = d.getFullYear() + "_"
@@ -977,16 +1220,16 @@ function cmd_capture_audio(args) {
         + pad2(d.getDate()) + "_"
         + pad2(d.getHours()) + pad2(d.getMinutes()) + pad2(d.getSeconds());
     capture_filename = requested_name.length > 0 ? requested_name : ("capture_" + ts + ".wav");
+    capture_file_path = _join_path(_get_captures_dir(), capture_filename);
 
     // Calculate sample count from duration and current sample rate
     var num_samples = Math.ceil((duration_ms / 1000.0) * current_sample_rate);
 
     capture_active = true;
 
-    // Tell the Max patch to start recording into buffer~ via outlet 1.
-    // The patch is expected to connect outlet 1 to a buffer~ / record~ rig.
-    // Message: "capture_start <filename> <num_samples>"
-    outlet(1, "capture_start", capture_filename, num_samples);
+    // Tell the Max patch to start recording the incoming stereo signal.
+    // Message: "capture_start <absolute_path> <num_samples>"
+    outlet(1, "capture_start", capture_file_path, num_samples);
 
     // Set a timer to call cmd_capture_write_done after duration_ms.
     // If the buffer~ fires its bang first (via a connected message), that
@@ -1008,12 +1251,18 @@ function cmd_capture_write_done() {
     }
 
     var written = capture_filename;
+    var written_path = capture_file_path;
     capture_filename = "";
+    capture_file_path = "";
+
+    // Stop the recorder before reporting completion so the file is flushed.
+    outlet(1, "capture_stop");
 
     // Send /capture_complete back to the MCP server via outlet 0.
     var encoded = base64_encode(JSON.stringify({
         "ok": true,
         "file": written,
+        "file_path": _to_posix_path(written_path),
         "sample_rate": current_sample_rate
     }));
     outlet(0, "/capture_complete", encoded);
@@ -1036,9 +1285,11 @@ function cmd_capture_stop() {
 
     capture_active = false;
     var written = capture_filename;
+    var written_path = capture_file_path;
     capture_filename = "";
+    capture_file_path = "";
 
-    send_response({"ok": true, "stopped": true, "file": written});
+    send_response({"ok": true, "stopped": true, "file": written, "file_path": _to_posix_path(written_path)});
 }
 
 function pad2(n) {
@@ -1069,37 +1320,48 @@ function cmd_get_plugin_params(args) {
     var param_count = cursor_a.getcount("parameters");
     var params = [];
     var current = 0;
-    var batch_size = 4;
+    var batch_size = 8;
 
     function read_batch() {
-        var end = Math.min(current + batch_size, param_count);
-        for (var i = current; i < end; i++) {
-            cursor_b.goto(path + " parameters " + i);
-            params.push({
-                index: i,
-                name: cursor_b.get("name").toString(),
-                value: parseFloat(cursor_b.get("value")),
-                min: parseFloat(cursor_b.get("min")),
-                max: parseFloat(cursor_b.get("max")),
-                default_value: parseFloat(cursor_b.get("default_value")),
-                is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
-                value_string: String(cursor_b.call("str_for_value", parseFloat(cursor_b.get("value"))))
-            });
-        }
-        current = end;
-
-        if (current < param_count) {
-            var next_task = new Task(read_batch);
-            next_task.schedule(50);
-        } else {
+        try {
+            var end = Math.min(current + batch_size, param_count);
+            for (var i = current; i < end; i++) {
+                cursor_b.goto(path + " parameters " + i);
+                var val = parseFloat(cursor_b.get("value"));
+                params.push({
+                    index: i,
+                    name: cursor_b.get("name").toString(),
+                    value: val,
+                    min: parseFloat(cursor_b.get("min")),
+                    max: parseFloat(cursor_b.get("max")),
+                    default_value: parseFloat(cursor_b.get("default_value")),
+                    is_quantized: parseInt(cursor_b.get("is_quantized")) === 1,
+                    value_string: String(val)
+                });
+            }
+            current = end;
+
+            if (current < param_count) {
+                var next_task = new Task(read_batch);
+                next_task.schedule(20);
+            } else {
+                send_response({
+                    "track": track_idx,
+                    "device": device_idx,
+                    "name": device_name,
+                    "class_name": class_name,
+                    "is_plugin": true,
+                    "parameter_count": param_count,
+                    "parameters": params
+                });
+            }
+        } catch (e) {
             send_response({
+                "error": "Failed reading plugin param " + current + ": " + String(e),
                 "track": track_idx,
                 "device": device_idx,
                 "name": device_name,
-                "class_name": class_name,
-                "is_plugin": true,
-                "parameter_count": param_count,
-                "parameters": params
+                "partial_params": params
             });
         }
     }
@@ -1133,13 +1395,10 @@ function cmd_map_plugin_param(args) {
         return;
     }
 
-    // Navigate to the parameter and read its name
-    cursor_b.goto(path + " parameters " + param_idx);
-    var param_name = cursor_b.get("name").toString();
-
-    // Select the parameter — this is how Ableton's Configure mode works
-    // via LiveAPI. The parameter becomes visible in the device's macro panel.
     try {
+        cursor_b.goto(path + " parameters " + param_idx);
+        var param_name = cursor_b.get("name").toString();
+
         cursor_a.set("selected_parameter", param_idx);
         cursor_a.call("store_chosen_bank");
         send_response({
@@ -1149,9 +1408,8 @@ function cmd_map_plugin_param(args) {
         });
     } catch(e) {
         send_response({
-            "error": "Failed to map parameter: " + e.message,
-            "parameter_index": param_idx,
-            "parameter_name": param_name
+            "error": "Failed to map parameter: " + String(e),
+            "parameter_index": param_idx
         });
     }
 }
@@ -1227,3 +1485,48 @@ function build_device_path(track_idx, device_idx) {
         return "live_set tracks " + track_idx + " devices " + device_idx;
     }
 }
+
+function _get_captures_dir() {
+    // Stable captures directory: ~/Documents/LivePilot/captures/
+    // max.appsupportpath = "/Users/<name>/Library/Application Support/Cycling '74"
+    // Walk up to get home directory
+    try {
+        var support = max.appsupportpath;
+        var parts = support.split("/");
+        // /Users/<name>/Library/... → first 3 parts = /Users/<name>
+        var home = parts.slice(0, 3).join("/");
+        return home + "/Documents/LivePilot/captures/";
+    } catch (e) {
+        // Fallback to patcher directory if home detection fails
+        return _get_patcher_dir();
+    }
+}
+
+function _get_patcher_dir() {
+    try {
+        var filepath = this.patcher && this.patcher.filepath ? this.patcher.filepath.toString() : "";
+        if (!filepath) return "";
+        var slash = Math.max(filepath.lastIndexOf("/"), filepath.lastIndexOf("\\"));
+        if (slash < 0) return "";
+        return filepath.substring(0, slash + 1);
+    } catch (e) {
+        return "";
+    }
+}
+
+function _safe_filename(name) {
+    // Strip directory components and reject traversal attempts.
+    // This is defense-in-depth — Python should sanitize first.
+    if (!name || name.length === 0) return name;
+    var slash = Math.max(name.lastIndexOf("/"), name.lastIndexOf("\\"));
+    if (slash >= 0) name = name.substring(slash + 1);
+    if (name === "." || name === ".." || name.length === 0) return "";
+    return name;
+}
+
+function _join_path(dir, file) {
+    if (!dir) return file;
+    var last = dir.charAt(dir.length - 1);
+    if (last !== "/" && last !== "\\") dir += "/";
+    return dir + file;
+}