Soundbox v0.4.1

Added

• Device tools for agents. soundbox.add_device, soundbox.set_device
  and soundbox.remove_device put a device on a story track, turn its knobs or
  bypass it, and take it off, with the same eight kinds, knobs and ranges as the
  studio's rack. Over-range values land at the end of the knob and are reported;
  unknown knobs are an error. An open studio shows the change as it lands.
  soundbox.get_story now returns each track's chain. Devices are still heard
  on the timeline only; export_story mixes dry.

• Docker images publish with each release. When a release is tagged,
  ghcr.io/hamsanders/soundbox:<version> and :<version>-cuda are built and
  pushed automatically; a full release also moves latest and cuda.

• A download page on the site. /download links the latest release's
  installers directly, picks the visitor's OS, plays the 30-second Soundbox
  film and shows live GitHub stars, downloads and forks. Every Download CTA on
  the site points at it.

• Prebuilt Docker images. ghcr.io/hamsanders/soundbox is published per
  release (:vX.Y.Z, :vX.Y.Z-cuda, plus :latest and :cuda) by a manual
  docker-publish workflow. docker compose up -d now pulls the image instead
  of building; to build from the checkout, add -f docker-compose.build.yml
  (see docs/INSTALL.md). amd64 only.

• SOUNDBOX_LOG_LEVEL. Sets the server's log level (debug, info,
  warning, error, critical) when --log-level isn't given. Unlike the
  flag, it reaches npm run dev, Docker and the desktop app. The startup banner
  shows the level in force, and an unknown value warns instead of being
  silently ignored. debug now logs each request to the prompt assistant,
  artwork and custom endpoints (URL, status, timing; never keys or prompts).
  Before this there were no debug lines at all, so --log-level debug showed
  nothing extra. (#22)

• Press kit on the website. /press/ collects quotable descriptions, a
  fact sheet, the launch films with direct MP4 downloads, screenshots, GIFs
  and the mark for anyone writing or filming about Soundbox, and the landing
  page footer links to it.

Changed

• Device racks are stored with the story. Each track's chain is saved on
  the server next to its name, mute, solo and volume
  (PATCH /api/stories/:id/tracks/:n takes devices), instead of in the
  browser's localStorage, so it reaches other windows and machines and follows
  its lane when a lane below it is removed. A rack saved by 0.4 is moved up the
  first time its story is opened. A dial sweep is saved once the dial settles,
  not on every step.

Security

• Dependency updates for the open Dependabot alerts. Vite, the MCP SDK,
  Fastify, Hono, js-yaml, brace-expansion, proxy-addr, source-map-js,
  postcss-selector-parser and the app's react-router move to patched releases.
  The server's zod moves to 4.6.7 (the 3.x line has no fix for the
  oversized-collection memory issue).
• Code-scanning fixes. The MCP endpoint's trailing-slash trim no longer
  backtracks on a long run of slashes, profile ids are checked before they are
  joined into a path that delete can remove recursively, HTML-tag stripping in
  the docs search and heading plugin repeats until nothing is left, and the
  release scripts escape every regular-expression character.

Fixed

• macOS: the server starts again. The ad-hoc signed app gave its bundled
  Node the hardened runtime without the JIT entitlements, so Node died with a
  trace trap before writing a log and the app said the server did not start in
  time (0.3.0 and 0.4.0). Ad-hoc builds now leave the hardened runtime off, and
  every build embeds Node's entitlements for when a Developer ID build turns it
  on. (#71)

• Soundbox starts again on libraries from the voice-profiles era. Their old
  voice_samples table stopped the server with "no such column: voice_id"
  before it could write a log. The table is now renamed to
  voice_samples_legacy and kept, not dropped.

• Prompt assistant and artwork base URLs ending in /v1. Soundbox added
  /v1/chat/completions or /v1/images/generations to the base URL as typed,
  so the …/v1 form most servers document became /v1/v1/… and a 404. The
  path is now joined without doubling, so a root, …/v1, …/sdapi/v1 or the
  full endpoint all work. Errors name the full URL tried, and a 404 explains
  what to check. (#22)

• Studio assistant: add a device, then set it. A plan that added a device
  and then turned its knobs applied the second step to the rack as it was
  before the plan, which wrote the new device back out again.

Installers are not yet signed. Windows shows a SmartScreen prompt (More info → Run anyway); macOS asks you to allow the app in System Settings → Privacy & Security. docs/DESKTOP.md has the details.