Clean release snapshot

.github/workflows/sandbox.yml

@@ -0,0 +1,158 @@
+name: Sandbox IPC tests
+
+# Lightweight, fast-iterating job for the out-of-process plugin sandbox IPC
+# layer (src/audio/Sandbox). Deliberately separate from the heavyweight Build
+# matrix (build.yml): it needs only JUCE + a C++20 compiler — no cmake-js,
+# node-addon-api, ONNX, Python, or electron-builder — so it can run on every
+# push / PR that touches the sandbox without the full release toolchain.
+#
+# This is the iteration loop for the macOS sandbox port (issue #264): a
+# Linux-only developer pushes a branch and gets the macOS compiler + test
+# results they can't produce locally. The POSIX backend is shared between Linux
+# and macOS, so Linux gives fast signal and macOS confirms the Darwin-specific
+# paths (POSIX_SPAWN_CLOEXEC_DEFAULT, SO_NOSIGPIPE, the macOS shm/sem caveats).
+#
+# The TSan run on the threaded audio loopback is the highest-value artifact:
+# it validates the release/acquire memory ordering on arm64 (macos-14) that a
+# Linux-only dev cannot otherwise exercise.
+
+on:
+  push:
+    paths:
+      - 'src/audio/Sandbox/**'
+      - 'src/vst-host/**'
+      - 'tests/sandbox/**'
+      - '.github/workflows/sandbox.yml'
+  pull_request:
+    paths:
+      - 'src/audio/Sandbox/**'
+      - 'src/vst-host/**'
+      - 'tests/sandbox/**'
+      - '.github/workflows/sandbox.yml'
+  workflow_dispatch:
+
+# Least privilege: these jobs only check out code and upload artifacts.
+# actions/checkout needs contents:read; upload-artifact uses its own runtime
+# token. Everything else defaults to none.
+permissions:
+  contents: read
+
+jobs:
+  sandbox-tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+          - os: macos-14
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive   # JUCE
+
+      # JUCE on Linux needs the usual X11/ALSA dev headers even for juce_core's
+      # transitive config; install the minimal set. (No-op on macOS.)
+      - name: Install Linux deps
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            ninja-build libasound2-dev libx11-dev libxext-dev libxinerama-dev \
+            libxrandr-dev libxcursor-dev libfreetype6-dev libfontconfig1-dev
+
+      - name: Install Ninja (macOS)
+        if: runner.os == 'macOS'
+        run: brew install ninja
+
+      # Build + run three ways: plain (Debug), ASan, TSan. Each is a fresh
+      # configure of the JUCE-only standalone harness, then ctest.
+      - name: Build + test (plain, ASan, TSan)
+        shell: bash
+        run: |
+          set -euo pipefail
+          for variant in plain address thread; do
+            echo "::group::$variant"
+            args=(-S tests/sandbox/standalone -B "build/sbx-$variant" -G Ninja \
+                  -DCMAKE_BUILD_TYPE=Debug)
+            if [[ "$variant" != "plain" ]]; then
+              args+=(-DSLOPSMITH_SANITIZE="$variant")
+            fi
+            cmake "${args[@]}"
+            cmake --build "build/sbx-$variant"
+            # TSAN/ASAN: fail the job on any sanitizer diagnostic.
+            TSAN_OPTIONS="halt_on_error=1" ASAN_OPTIONS="halt_on_error=1" \
+              ctest --test-dir "build/sbx-$variant" --output-on-failure
+            echo "::endgroup::"
+          done
+
+      - name: Upload sandbox child log on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: sandbox-logs-${{ matrix.os }}
+          path: |
+            build/sbx-*/Testing/**/*.log
+          if-no-files-found: ignore
+
+  # Heavier end-to-end job: builds a passthrough VST3 + the real
+  # slopsmith-vst-host, spawns it from a host-side driver, and round-trips audio
+  # over the shm ring (posix_spawn + fd inheritance + handshake + process +
+  # state + shutdown). Separate from the unit job because it pulls in
+  # juce_audio_processors / juce_gui_basics / the VST3 plugin client.
+  sandbox-e2e:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+          - os: macos-14
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      # Full JUCE Linux GUI/audio dep set (gui_basics + audio_processors).
+      - name: Install Linux deps
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            ninja-build xvfb \
+            libasound2-dev libjack-jackd2-dev libfreetype6-dev libfontconfig1-dev \
+            libx11-dev libxcomposite-dev libxcursor-dev libxext-dev \
+            libxinerama-dev libxrandr-dev libxrender-dev libglu1-mesa-dev \
+            mesa-common-dev libcurl4-openssl-dev libwebkit2gtk-4.1-dev
+
+      - name: Install Ninja (macOS)
+        if: runner.os == 'macOS'
+        run: brew install ninja
+
+      - name: Build e2e harness
+        run: |
+          cmake -S tests/sandbox/e2e -B build/e2e -G Ninja -DCMAKE_BUILD_TYPE=Debug
+          cmake --build build/e2e
+
+      # The vst-host loads a no-editor VST3, so no display is strictly needed;
+      # run under xvfb on Linux anyway as insurance against any X11 touch in
+      # juce_gui_basics init. macOS has a window server.
+      - name: Run e2e (Linux, xvfb)
+        if: runner.os == 'Linux'
+        run: xvfb-run -a ctest --test-dir build/e2e --output-on-failure
+
+      - name: Run e2e (macOS)
+        if: runner.os == 'macOS'
+        run: ctest --test-dir build/e2e --output-on-failure
+
+      - name: Upload vst-host log on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: sandbox-e2e-logs-${{ matrix.os }}
+          path: |
+            ${{ runner.temp }}/slopsmith-vst-host-*.log
+            /tmp/slopsmith-vst-host-*.log
+          if-no-files-found: ignore
+          retention-days: 7