MPVST 0.2.0

Programmable VST3 instruments and audio effects, each running its Python in
its own sidecar process. Every audioinstruments module and every
audioeffects class appears in your DAW under its own name.

Upgrading from 0.1.0 changes how your projects sound. Macros were being
overwritten at load, so every instrument and effect had been playing at
centre-position values rather than its own defaults — a limiter asked for a
−1 dB ceiling was giving you −12. That is fixed, which means a render made
with 0.2.0 will not match one made with 0.1.0. If you have projects you care
about, listen before you overwrite anything.

Install

Windows — run MPVST-0.2.0-windows-x86_64-setup.exe. It installs for the
current user, so there is no administrator prompt; the uninstaller appears
under Settings → Apps → Installed apps. Close your DAW first.

Linux — unpack MPVST-0.2.0-linux-x86_64.tar.gz and run the install.sh
inside it. It copies the bundle to ~/.vst3; --dir puts it elsewhere and
--uninstall removes it.

MPVST-0.2.0-windows-x86_64.zip is the same bundle with no installer.

Both installers run the plug-in scan for you. Then rescan plug-ins in your
host — a real rescan, not a restart; in REAPER that is Preferences →
Plug-ins → VST → Re-scan.

New: catalog.json

The bundle now ships Contents/Resources/catalog.json — every class with its
class ID, macro labels and their ranges, every patch with its MIDI values, and
the note map for each drum machine. One json.load tells a project generator
everything it needs, with no parsing of source files and no separate dump
step. See docs/generating-projects.md.

Also in this release

• An empty MPVST Script Host slot is silent, so a project wired to a
  generic class ID instead of a named instrument's is obvious rather than
  sounding like a plausible synth on every track.
• Packaging metadata (.egg-info) no longer ships inside the bundle.
• NOTE_MAP is published, so a generator can write drum parts.

Verify what you downloaded

Every file has a .sha256 beside it:

sha256sum -c MPVST-0.2.0-windows-x86_64-setup.exe.sha256

The installer is not code signed, so Windows SmartScreen will warn on
first run — "More info", then "Run anyway".

Known limitations

• REAPER is the only DAW tested.
• The editor is one generic panel; per-script panels are deferred.
• MPVST_SCRIPT_PATH is process-wide, so two developer-file instances cannot
  follow different scripts.
• Real-time playback on Linux audio hardware is unexercised.
• No macOS build.
• The application icon is a placeholder.

Security

The shipped sidecar engine is built without sockets, SSL or FFI, so a piece
you downloaded cannot reach the network whatever it contains. That is a safe
default, not a sandbox — it can still read and write your files. Only load
projects and scripts you trust.

MPVST 0.1.0

Programmable VST3 instruments and audio effects, each running its Python in
its own sidecar process. One bundle ships a whole library: every
audioinstruments module and every audioeffects class appears in the DAW's
browser under its own name and category, alongside two generic MPVST Script
Host classes that run any script you point them at.

This is the first release, and the thing it adds is that nothing has to be
built to use it. The archives carry the plug-in, the sidecar engine and the
whole instrument and effect library.

Install

Windows — run MPVST-0.1.0-windows-x86_64-setup.exe. It installs for the
current user, so there is no administrator prompt; that also means the
uninstaller appears under Settings → Apps → Installed apps, not the old
Control Panel "Programs and Features" list. Close your DAW first.

Linux — unpack MPVST-0.1.0-linux-x86_64.tar.gz and run the install.sh
inside it. It copies the bundle to ~/.vst3; --dir puts it elsewhere and
--uninstall removes it again.

MPVST-0.1.0-windows-x86_64.zip is the same bundle with no installer, for
copying into a VST3 folder by hand.

Both installers run the plug-in scan for you, so clicking Finish leaves it
finished. Then rescan plug-ins in your host — a real rescan, not a restart;
hosts cache what they found last time (in REAPER, Preferences → Plug-ins →
VST → Re-scan).

Verify what you downloaded

Every file has a .sha256 beside it:

sha256sum -c MPVST-0.1.0-windows-x86_64-setup.exe.sha256

The installer is not code signed, so Windows SmartScreen will warn on
first run — "More info", then "Run anyway". That is expected for this release
and is the reason the checksums are published.

Known limitations

• REAPER is the only DAW tested.
• The editor is one generic panel; per-script panels are deferred.
• MPVST_SCRIPT_PATH is process-wide, so two developer-file instances cannot
  follow different scripts.
• Real-time playback on Linux audio hardware is unexercised — the Linux
  testing host runs under WSLg with no audio device.
• No macOS build.
• The application icon is a deliberate placeholder.

Security

The shipped sidecar engine is a deliberately narrow interpreter: no
sockets, no SSL, no FFI. Plug-in scanning runs Python before you
consciously play anything, and people share pieces, so a hostile script has
no exfiltration channel and no route to arbitrary native code. This is a safe
default, not a sandbox — it can still read and write your files. Only load
projects and scripts you trust.

Full documentation is in the README.