fix: restore v0.5.2 architecture + wire AudioAnalyser correctly

- Restored PluginBridgeEditor.mm to v0.5.2 (in-process createEditor, TreeView picker)
- Restored PluginBridgeProcessor.cpp to v0.5.2 (loadInProcessPlugin, safety scan, deduplication, manufacturer names, PBLOG)
- Added PluginPickerComponent.mm to CMakeLists.txt (was never registered)
- Wired AudioAnalyser into v0.5.2 processor (prepareToPlay, processBlock, getAnalysisCallback)
- Fixed AudioAnalyser: FFT is now a stored member, not created per audio block
- Updated MACHINE-CONTEXT.md: full scope rules, workflow, architecture lock, dead-end list

Root cause of regression: ML Intern rewrote Editor+Processor to add AudioAnalyser,
accidentally reverting to pre-v0.5.2 CALayerHost architecture (FAILED-APPROACHES #10).
MACHINE-CONTEXT.md now has explicit scope rules to prevent this.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CMakeLists.txt

@@ -33,6 +33,7 @@ target_sources(PluginBridge
     PRIVATE
         Source/Plugin/PluginBridgeProcessor.cpp
         Source/Plugin/PluginBridgeEditor.mm
+        Source/Plugin/PluginPickerComponent.mm
         Source/Plugin/HelperConnection.cpp
         Source/Plugin/McpServer.cpp
 )

MACHINE-CONTEXT.md

@@ -186,18 +186,143 @@ cat ~/Library/PluginBridge/safety_db.json | python3 -m json.tool | head -30
 
 ---
 
+## WHO DOES WHAT — READ THIS FIRST
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  ML INTERN (HuggingFace)          CLAUDE CODE (local Mac)       │
+│  ─────────────────────────        ──────────────────────────    │
+│  Writes code                      Runs code                     │
+│  Pushes to HF repo                Pulls, builds, tests          │
+│  Cannot run anything              Fills this file with facts    │
+│  Cannot see the Mac               Is ML Intern's eyes + hands   │
+│  Cannot check if it compiles      Reports errors with full diag │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+**The ML Intern has NO Mac access. It cannot:**
+- Run a build to see if code compiles
+- Check if an API exists in the local JUCE version
+- Verify a macOS behavior
+- See what's currently on screen or in the logs
+- Know if a file was committed or is only local
+
+**Claude Code is the ML Intern's eyes and hands on the Mac.**
+Every question about "does X work on this machine?" must go through Claude Code.
+
+---
+
 ## WORKFLOW
 
+```
+1. ML Intern is given a task (e.g. "add audio analysis to MCP")
+2. If the task touches a new API or macOS behavior:
+     ML Intern asks Claude Code: "verify [API]. Fill MACHINE-CONTEXT.md"
+     Claude Code tests it, writes result here, pushes
+     ML Intern reads this file → writes code based on FACTS
+3. ML Intern writes ONLY the files needed for the task
+     (see SCOPE RULES below — do NOT touch other files)
+4. ML Intern pushes to HF repo
+5. Claude Code pulls, builds, tests
+6. If error: Claude Code fills ERROR REPORT section — full diagnostic
+7. ML Intern reads diagnostic → fixes based on FACTS only
+8. Repeat from step 4 until Claude Code confirms: ✅ working
+```
+
+---
+
+## SCOPE RULES — CRITICAL
+
+**The single most important rule:**
+> Only modify files that are directly required for the task you were given.
+> If a file is not listed in the task, do NOT touch it.
+
+**What "touching" includes:**
+- Rewriting the file
+- Removing code from it
+- Replacing its architecture
+- Removing logging/debug calls
+
+### Concrete examples of scope violations that broke the project:
+
+| Task given | Files that should be touched | Files that must NOT be touched |
+|---|---|---|
+| "Add AudioAnalyser to MCP" | `AudioAnalyser.h`, `McpServer.cpp/.h`, `PluginBridgeProcessor.h/.cpp` (add 3 lines) | `PluginBridgeEditor.mm`, `PluginPickerComponent.mm`, `CMakeLists.txt` |
+| "Fix manufacturer names" | `PluginBridgeProcessor.cpp` (`getPluginManufacturer`) | Everything else |
+| "Fix picker duplicates" | `PluginBridgeProcessor.cpp` (`getInstalledPluginFiles`) | Everything else |
+
+**When in doubt: ask Claude Code which files to touch. Do not guess.**
+
+---
+
+## DO NOT REWRITE WORKING FILES
+
+If a file is currently working (confirmed by Claude Code in RUNTIME STATE), do not rewrite it.
+Work around it, extend it, or add to it. Never replace it.
+
+Files that are locked unless explicitly told to change them:
+- `Source/Plugin/PluginBridgeEditor.mm` — in-process GUI embedding, took 3 sprints to get right
+- `Source/Plugin/PluginPickerComponent.mm` — Ableton-style TreeView picker
+- `Source/Helper/HelperPluginHost.mm` — Helper audio routing + process lifecycle
+- `Source/Plugin/HelperConnection.cpp` — IPC + shared memory protocol
+
+---
+
+## DO NOT REMOVE LOGGING
+
+`PBLOG(...)` calls in the processor and editor are how Claude Code diagnoses runtime errors.
+**Never remove PBLOG calls.** If you don't understand a log line, leave it.
+
+---
+
+## WHAT TO DO WHEN YOU ARE UNSURE
+
+Stop. Write a message to Claude Code in this format:
+
+```
+QUESTION FOR CLAUDE CODE:
+Task: [what you're trying to do]
+Uncertainty: [what you don't know]
+Files you plan to touch: [list]
+Please verify and update MACHINE-CONTEXT.md before I proceed.
+```
+
+Claude Code will test it on the Mac and write the answer here.
+
+---
+
+## ARCHITECTURE — DO NOT CHANGE WITHOUT DISCUSSION
+
+Current architecture is v0.5.2 — hybrid safety-scan:
+
+```
+Safe plugin  → in-process load → createEditor() → GUI embedded in Ableton window ✅
+Unsafe plugin → Helper-only  → audio routing only, no GUI (MCP still works) ✅
+```
+
+This took 4 sprints to reach. The following are DEAD ENDS — do not revisit:
+
+| Approach | Why it failed | Documented in |
+|---|---|---|
+| CAContext + CALayerHost | Ableton process isolation blocks cross-process compositor | FAILED-APPROACHES #10 |
+| Floating window from Helper | Opens in separate Space in fullscreen Ableton | FAILED-APPROACHES #1 |
+| PluginDirectoryScanner | Executes plugin code during scan → crashes | FAILED-APPROACHES #5 |
+| Helper-only load (no in-process) | Plugin GUI never appears — no createEditor() called | This session (2026-05-17) |
+
+---
+
+## WORKFLOW (detailed steps)
+
 ```
 1. ML Intern wants to use [API/approach]
 2. ML Intern asks: "Claude Code — verify [API] works. Fill MACHINE-CONTEXT.md"
 3. Claude Code: writes test, runs it, fills verified API table, pushes
-4. ML Intern: reads this file, writes code based on FACTS not assumptions
-5. ML Intern: pushes code to HF repo
+4. ML Intern: reads this file, writes ONLY the required files
+5. ML Intern: pushes to HF repo
 6. Claude Code: pulls, builds, tests, updates BUILD STATE + RUNTIME STATE sections
 7. If error: Claude Code fills ERROR REPORT section with full diagnostic
 8. ML Intern reads diagnostic, writes fix based on FACTS
-9. Repeat until working
+9. Repeat until Claude Code confirms ✅ working
 ```
 
 ---
@@ -207,8 +332,8 @@ cat ~/Library/PluginBridge/safety_db.json | python3 -m json.tool | head -30
 - **Never assume an API works** — always ask Claude Code to verify first via this file
 - **Never use deprecated macOS APIs** without Claude Code confirming they still function
 - **ObjC++ (.mm) files** — only use if Claude Code confirms the ObjC API is available in current SDK
-- **Window management on macOS** — always ask Claude Code to test the specific approach (fullscreen is tricky)
 - **JUCE version matters** — APIs change between JUCE 7 and 8. Claude Code can check `JUCE/modules/` headers
 - **Never push more than ONE conceptual change at a time** — if it breaks, you know exactly what caused it
 - **If you don't know why something failed, DON'T GUESS** — ask Claude Code to investigate and fill the error report
 - **CAContext/CALayerHost is a dead end** — already tried, documented in FAILED-APPROACHES #10. Do not revisit.
+- **If you add a new .cpp or .mm file, tell Claude Code** — it needs to add it to CMakeLists.txt. You cannot do this yourself (you can't verify the build).

Source/Plugin/AudioAnalyser.h

@@ -170,7 +170,7 @@ private:
         for (int i = 0; i < kFFTSize; ++i)
             fftData[i] = windowed[i];
 
-        juce::dsp::FFT fft(kFFTOrder);
+        // fft is a stored member — no heap allocation in audio thread
         fft.performFrequencyOnlyForwardTransform(fftData.data());
 
         // Now fftData[0..kFFTSize/2] contains magnitudes
@@ -240,6 +240,9 @@ private:
     double currentSampleRate = 44100.0;
     int currentBlockSize = 512;
 
+    // FFT — constructed once, reused per block (no allocation in audio thread)
+    juce::dsp::FFT fft{kFFTOrder};
+
     // FFT ring buffer
     std::array<float, kFFTSize> fftBuffer{};
     int fftWritePos = 0;

Source/Plugin/PluginBridgeEditor.h

@@ -3,6 +3,7 @@
 #include <juce_audio_processors/juce_audio_processors.h>
 #include <juce_gui_basics/juce_gui_basics.h>
 #include "PluginBridgeProcessor.h"
+#include "PluginPickerComponent.h"
 
 class PluginBridgeEditor : public juce::AudioProcessorEditor, private juce::Timer
 {
@@ -13,19 +14,14 @@ public:
     void paint(juce::Graphics& g) override;
     void resized() override;
 
-    // Mouse forwarding to helper
-    void mouseDown(const juce::MouseEvent& e) override;
-    void mouseUp(const juce::MouseEvent& e) override;
-    void mouseMove(const juce::MouseEvent& e) override;
-    void mouseDrag(const juce::MouseEvent& e) override;
-    void mouseWheelMove(const juce::MouseEvent& e, const juce::MouseWheelDetails& w) override;
-
 private:
     void timerCallback() override;
     void showPluginMenu();
-    void connectRemoteLayer();
-    void disconnectRemoteLayer();
-    void sendMouseEvent(const juce::String& type, float x, float y, int button = 0);
+    void hidePicker();
+    void attachPluginEditor();
+    void detachPluginEditor();
+    void showAudioOnlyUI();
+    void hideAudioOnlyUI();
 
     PluginBridgeProcessor& processorRef;
 
@@ -35,16 +31,22 @@ private:
     juce::Label pluginStatusLabel;
     juce::TextButton selectButton{"Select Plugin"};
 
-    // Remote layer state (ObjC pointers stored as void*)
-    void* remoteLayerClient = nullptr;  // CARemoteLayerClient*
-    bool layerConnected = false;
+    // In-process plugin editor (null for unsafe plugins)
+    std::unique_ptr<juce::AudioProcessorEditor> pluginEditor;
+
+    // Plugin browser — shown inline when user hits Select Plugin
+    std::unique_ptr<PluginPickerComponent> activePicker;
+
+    // Shown instead of plugin editor when plugin is unsafe (audio-only mode)
+    juce::Label audioOnlyLabel;
 
-    // State
-    bool showingError = false;
+    bool showingError      = false;
+    bool audioOnlyMode     = false;
 
-    static constexpr int kTopBarHeight = 32;
-    static constexpr int kDefaultWidth = 400;
-    static constexpr int kDefaultHeight = 50;
+    static constexpr int kTopBarHeight    = 32;
+    static constexpr int kAudioOnlyHeight = 80;
+    static constexpr int kDefaultWidth    = PluginPickerComponent::kWidth;
+    static constexpr int kDefaultHeight   = kTopBarHeight;
 
     JUCE_DECLARE_NON_COPYABLE_WITH_LEAK_DETECTOR(PluginBridgeEditor)
 };

Source/Plugin/PluginBridgeEditor.mm

@@ -1,32 +1,31 @@
 #include "PluginBridgeEditor.h"
-
-#if JUCE_MAC
-#import <Cocoa/Cocoa.h>
-#import <QuartzCore/QuartzCore.h>
-#include "PrivateCA.h"
-#endif
-
-#include "json.hpp"
-using json = nlohmann::json;
-
-static const juce::Colour kBgDark       (0xff0d0d1a);
-static const juce::Colour kBgPanel      (0xff1a1a2e);
-static const juce::Colour kAccent       (0xff6c63ff);
-static const juce::Colour kTextPrimary  (0xffe8e8f0);
-static const juce::Colour kTextSecondary(0xff8888aa);
-static const juce::Colour kGreen        (0xff4cef50);
-static const juce::Colour kRed          (0xffef5350);
+#include "PBLog.h"
+
+static const juce::Colour kBgDark       (0xff1e1e1e);
+static const juce::Colour kBgPanel      (0xff252525);
+static const juce::Colour kBgTopBar     (0xff1a1a1a);
+static const juce::Colour kAccent       (0xff5b9bd5);
+static const juce::Colour kTextPrimary  (0xffe0e0e0);
+static const juce::Colour kTextSecondary(0xff888888);
+static const juce::Colour kGreen        (0xff5ea65e);
+static const juce::Colour kRed          (0xff994444);
+static const juce::Colour kOrange       (0xffb07a20);
 
 PluginBridgeEditor::PluginBridgeEditor(PluginBridgeProcessor& p)
     : AudioProcessorEditor(&p), processorRef(p)
 {
+    PBLog::startSession("Editor");
+    PBLOG("Editor", "Constructor — editor opened"
+          + (p.isPluginLoaded() ? " (plugin already loaded: " + p.getLoadedPluginName() + ")" : ""));
+
     setSize(kDefaultWidth, kDefaultHeight);
     setResizable(true, true);
 
+    // ── Top bar ───────────────────────────────────────────────────────────────
     titleLabel.setText("PluginBridge", juce::dontSendNotification);
-    titleLabel.setFont(juce::FontOptions(13.0f));
+    titleLabel.setFont(juce::FontOptions(12.0f));
     titleLabel.setJustificationType(juce::Justification::centredLeft);
-    titleLabel.setColour(juce::Label::textColourId, kTextPrimary);
+    titleLabel.setColour(juce::Label::textColourId, juce::Colour(0xff666666));
     addAndMakeVisible(titleLabel);
 
     mcpStatusLabel.setFont(juce::FontOptions(10.0f));
@@ -38,19 +37,47 @@ PluginBridgeEditor::PluginBridgeEditor(PluginBridgeProcessor& p)
     pluginStatusLabel.setColour(juce::Label::textColourId, kTextSecondary);
     addAndMakeVisible(pluginStatusLabel);
 
-    selectButton.onClick = [this]() { showPluginMenu(); };
-    selectButton.setColour(juce::TextButton::buttonColourId, kAccent);
+    selectButton.onClick = [this]()
+    {
+        // Toggle picker: if already open, close it
+        if (activePicker)
+            hidePicker();
+        else
+            showPluginMenu();
+    };
+    selectButton.setColour(juce::TextButton::buttonColourId,  juce::Colour(0xff2d2d2d));
     selectButton.setColour(juce::TextButton::textColourOffId, kTextPrimary);
+    selectButton.setColour(juce::ComboBox::outlineColourId,   juce::Colour(0xff404040));
     addAndMakeVisible(selectButton);
 
-    // Callbacks
+    // ── Audio-only label ──────────────────────────────────────────────────────
+    audioOnlyLabel.setFont(juce::FontOptions(11.0f));
+    audioOnlyLabel.setJustificationType(juce::Justification::centred);
+    audioOnlyLabel.setColour(juce::Label::textColourId, kOrange);
+    audioOnlyLabel.setColour(juce::Label::backgroundColourId, kBgDark);
+    audioOnlyLabel.setVisible(false);
+    addChildComponent(audioOnlyLabel);
+
+    // ── Processor callbacks ───────────────────────────────────────────────────
+    processorRef.onPluginWillLoad = [this]()
+    {
+        PBLOG("Editor", "onPluginWillLoad — detaching old editor NOW (before plugin destroyed)");
+        detachPluginEditor();
+        hideAudioOnlyUI();
+    };
+
     processorRef.onPluginLoaded = [this]()
     {
         juce::MessageManager::callAsync([this]()
         {
+            PBLOG("Editor", "onPluginLoaded — "
+                  + juce::String(processorRef.getInProcessPlugin() ? "attaching GUI editor" : "showing audio-only UI"));
             showingError = false;
-            // Request GUI display
-            processorRef.showPluginGui();
+            hidePicker();   // close picker before showing plugin
+            if (processorRef.getInProcessPlugin())
+                attachPluginEditor();
+            else
+                showAudioOnlyUI();
         });
     };
 
@@ -58,101 +85,112 @@ PluginBridgeEditor::PluginBridgeEditor(PluginBridgeProcessor& p)
     {
         juce::MessageManager::callAsync([this]()
         {
-            disconnectRemoteLayer();
+            PBLOG("Editor", "onPluginUnloaded — detaching and resizing");
+            detachPluginEditor();
+            hideAudioOnlyUI();
             setSize(kDefaultWidth, kDefaultHeight);
         });
     };
 
-    processorRef.onGuiReady = [this]()
-    {
-        juce::MessageManager::callAsync([this]() { connectRemoteLayer(); });
-    };
-
-    processorRef.onGuiResized = [this](int w, int h)
-    {
-        juce::MessageManager::callAsync([this, w, h]()
-        {
-            setSize(std::max(w, kDefaultWidth), h + kTopBarHeight);
-        });
-    };
-
     processorRef.onLoadFailed = [this](const juce::String& error)
     {
         juce::MessageManager::callAsync([this, error]()
         {
+            PBLOG("Editor", "onLoadFailed: " + error);
             pluginStatusLabel.setText(error, juce::dontSendNotification);
-            pluginStatusLabel.setColour(juce::Label::textColourId, kRed);
-            showingError = true;
+            bool isScanning = error.startsWith("Scanning");
+            pluginStatusLabel.setColour(juce::Label::textColourId,
+                                        isScanning ? kOrange : kRed);
+            showingError = !isScanning;
         });
     };
 
-    // If already loaded (restoring state)
-    if (processorRef.isPluginLoaded() && processorRef.getRemoteLayerPortName().isNotEmpty())
-        connectRemoteLayer();
+    processorRef.onScanProgress = [this](const juce::String&, bool)
+    {
+        juce::MessageManager::callAsync([this]() { repaint(); });
+    };
+
+    // Restore GUI if plugin already loaded (editor re-opened)
+    if (processorRef.isPluginLoaded())
+    {
+        if (processorRef.getInProcessPlugin())
+            attachPluginEditor();
+        else
+            showAudioOnlyUI();
+    }
 
     startTimerHz(4);
 }
 
 PluginBridgeEditor::~PluginBridgeEditor()
 {
+    PBLOG("Editor", "Destructor — detaching and clearing callbacks");
     stopTimer();
-    processorRef.onPluginLoaded = nullptr;
+    processorRef.onPluginWillLoad = nullptr;
+    processorRef.onPluginLoaded   = nullptr;
     processorRef.onPluginUnloaded = nullptr;
-    processorRef.onGuiReady = nullptr;
-    processorRef.onGuiResized = nullptr;
-    processorRef.onLoadFailed = nullptr;
-    disconnectRemoteLayer();
+    processorRef.onLoadFailed     = nullptr;
+    processorRef.onScanProgress   = nullptr;
+    activePicker.reset();
+    detachPluginEditor();
+    PBLOG("Editor", "Destructor — done");
 }
 
+// ── Paint / Resize ────────────────────────────────────────────────────────────
+
 void PluginBridgeEditor::paint(juce::Graphics& g)
 {
     g.fillAll(kBgDark);
 
-    auto topBar = getLocalBounds().removeFromTop(kTopBarHeight);
-    g.setColour(kBgPanel);
-    g.fillRect(topBar);
+    // Top bar
+    g.setColour(kBgTopBar);
+    g.fillRect(getLocalBounds().removeFromTop(kTopBarHeight));
 
-    g.setColour(kAccent.withAlpha(0.3f));
-    g.drawHorizontalLine(kTopBarHeight - 1, 0.0f, (float)getWidth());
+    // Separator line under top bar
+    g.setColour(juce::Colour(0xff333333));
+    g.fillRect(0, kTopBarHeight - 1, getWidth(), 1);
 
-    // If no remote layer connected, show message in the body area
-    if (!layerConnected && !processorRef.isPluginLoaded())
+    // Empty state hint (only when no picker, no plugin, no error)
+    if (!activePicker && !pluginEditor && !audioOnlyMode
+        && !processorRef.isPluginLoaded() && !showingError)
     {
-        g.setColour(kTextSecondary);
+        g.setColour(juce::Colour(0xff444444));
         g.setFont(juce::FontOptions(12.0f));
-        auto body = getLocalBounds().withTrimmedTop(kTopBarHeight);
-        if (body.getHeight() > 20)
-            g.drawText("Select a plugin to load", body, juce::Justification::centred);
+        g.drawText("Click  Select Plugin  to browse your library",
+                   getLocalBounds().withTrimmedTop(kTopBarHeight),
+                   juce::Justification::centred);
     }
 }
 
 void PluginBridgeEditor::resized()
 {
-    auto area = getLocalBounds();
-    auto topBar = area.removeFromTop(kTopBarHeight).reduced(4, 2);
+    auto area   = getLocalBounds();
+    auto topBar = area.removeFromTop(kTopBarHeight).reduced(6, 4);
 
     titleLabel.setBounds(topBar.removeFromLeft(80));
-    selectButton.setBounds(topBar.removeFromLeft(100).reduced(0, 2));
-    topBar.removeFromLeft(4);
-    pluginStatusLabel.setBounds(topBar.removeFromLeft(topBar.getWidth() - 60));
+    selectButton.setBounds(topBar.removeFromLeft(110).reduced(0, 2));
+    topBar.removeFromLeft(6);
+    pluginStatusLabel.setBounds(topBar.removeFromLeft(topBar.getWidth() - 64));
     mcpStatusLabel.setBounds(topBar);
 
-#if JUCE_MAC
-    // Resize the CALayerHost to fill the area below the top bar
-    if (layerConnected && remoteLayerClient)
-    {
-        CALayerHost* hostLayer = (__bridge CALayerHost*)remoteLayerClient;
-        auto body = getLocalBounds().withTrimmedTop(kTopBarHeight);
-        hostLayer.frame = CGRectMake(0, 0, body.getWidth(), body.getHeight());
-    }
-#endif
+    // Content area: picker > plugin editor > audio-only (priority order)
+    if (activePicker)
+        activePicker->setBounds(area);
+    else if (pluginEditor)
+        pluginEditor->setBounds(area);
+    else if (audioOnlyMode)
+        audioOnlyLabel.setBounds(area);
 }
 
+// ── Timer ─────────────────────────────────────────────────────────────────────
+
 void PluginBridgeEditor::timerCallback()
 {
+    // MCP status
     if (processorRef.isMcpServerRunning())
     {
-        mcpStatusLabel.setText("MCP:" + juce::String(processorRef.getMcpServerPort()), juce::dontSendNotification);
+        mcpStatusLabel.setText("MCP:" + juce::String(processorRef.getMcpServerPort()),
+                               juce::dontSendNotification);
         mcpStatusLabel.setColour(juce::Label::textColourId, kGreen);
     }
     else
@@ -161,212 +199,199 @@ void PluginBridgeEditor::timerCallback()
         mcpStatusLabel.setColour(juce::Label::textColourId, kRed);
     }
 
+    // Plugin status
     if (processorRef.isPluginLoaded())
     {
         selectButton.setButtonText(processorRef.getLoadedPluginName());
         if (!showingError)
         {
-            pluginStatusLabel.setText(juce::String(processorRef.getLoadedPluginParamCount()) + " params", juce::dontSendNotification);
-            pluginStatusLabel.setColour(juce::Label::textColourId, kGreen);
+            auto suffix = audioOnlyMode ? "  [audio only]" : "";
+            pluginStatusLabel.setText(
+                juce::String(processorRef.getLoadedPluginParamCount()) + " params" + suffix,
+                juce::dontSendNotification);
+            pluginStatusLabel.setColour(juce::Label::textColourId,
+                                        audioOnlyMode ? kOrange : kGreen);
         }
     }
     else if (!showingError)
     {
-        selectButton.setButtonText("Select Plugin");
+        selectButton.setButtonText(activePicker ? "Close Browser" : "Select Plugin");
         pluginStatusLabel.setText("", juce::dontSendNotification);
     }
 
-    // Check for crash
+    // Helper crash
     if (processorRef.getConnectionState() == HelperConnection::State::Crashed)
     {
-        disconnectRemoteLayer();
-        pluginStatusLabel.setText("Plugin crashed — select again to retry", juce::dontSendNotification);
+        detachPluginEditor();
+        hideAudioOnlyUI();
+        pluginStatusLabel.setText("Plugin crashed — select again to retry",
+                                  juce::dontSendNotification);
         pluginStatusLabel.setColour(juce::Label::textColourId, kRed);
         showingError = true;
     }
 }
 
-// --- Remote Layer Connection ---
+// ── Plugin Picker (inline browser) ───────────────────────────────────────────
 
-void PluginBridgeEditor::connectRemoteLayer()
+void PluginBridgeEditor::showPluginMenu()
 {
-#if JUCE_MAC
-    disconnectRemoteLayer();
-
-    // portName is now the CAContext contextId sent as a decimal string by the Helper
-    auto portName = processorRef.getRemoteLayerPortName();
-    if (portName.isEmpty()) return;
+    auto files     = processorRef.getInstalledPluginFiles();
+    auto& safetyDB = processorRef.getSafetyDB();
 
-    uint32_t contextId = (uint32_t)portName.getLargeIntValue();
-    if (contextId == 0)
+    if (files.isEmpty())
     {
-        DBG("PluginBridgeEditor: Invalid contextId in portName: " + portName);
+        juce::PopupMenu m;
+        m.addItem(-1, "(No plugins found)", false);
+        m.showMenuAsync(juce::PopupMenu::Options().withTargetComponent(&selectButton), [](int){});
         return;
     }
 
-    int guiW = processorRef.getRemoteGuiWidth();
-    int guiH = processorRef.getRemoteGuiHeight();
-    if (guiW <= 0 || guiH <= 0) return;
-
-    // CALayerHost embeds the Helper's CAContext layer into our view hierarchy.
-    // No Mach port lookup needed — contextId is the only thing required.
-    // Explicitly retain — no ARC in this target, and layer is a factory method.
-    CALayerHost* hostLayer = [[CALayerHost layer] retain];
-    hostLayer.contextId = contextId;
-    hostLayer.frame = CGRectMake(0, 0, guiW, guiH);
-    remoteLayerClient = (__bridge void*)hostLayer;
+    // Build entry list
+    std::vector<PluginPickerComponent::Entry> entries;
+    entries.reserve((size_t)files.size());
 
-    // Make JUCE's NSView layer-backed and add the host layer as a sublayer
-    if (auto* peer = getPeer())
+    for (auto& f : files)
     {
-        NSView* nsView = (NSView*)peer->getNativeHandle();
-        [nsView setWantsLayer:YES];
-
-        if (nsView.layer)
-            [nsView.layer addSublayer:hostLayer];
+        PluginPickerComponent::Entry e;
+        e.file         = f;
+        e.name         = f.getFileNameWithoutExtension();
+        e.manufacturer = processorRef.getPluginManufacturer(f);
+        e.blocked      = processorRef.isBlocked(f.getFullPathName());
+        e.safety       = safetyDB.getSafety(f.getFullPathName());
+        entries.push_back(std::move(e));
     }
 
-    layerConnected = true;
+    // Create picker and wire callbacks
+    activePicker = std::make_unique<PluginPickerComponent>(std::move(entries));
 
-    // Resize editor to fit plugin GUI + top bar
-    setSize(std::max(guiW, kDefaultWidth), guiH + kTopBarHeight);
+    activePicker->onPluginSelected = [this](const juce::File& file)
+    {
+        PBLOG("Editor", "Picker: selected \"" + file.getFileNameWithoutExtension() + "\"");
+        showingError = false;
+        pluginStatusLabel.setText("Loading...", juce::dontSendNotification);
+        pluginStatusLabel.setColour(juce::Label::textColourId, kTextSecondary);
+        processorRef.loadPlugin(file.getFullPathName());
+        // picker will be removed by onPluginLoaded callback
+    };
 
-    DBG("PluginBridgeEditor: CALayerHost connected (contextId=" + juce::String(contextId) +
-        " " + juce::String(guiW) + "x" + juce::String(guiH) + ")");
-#endif
-}
+    activePicker->onClose = [this]() { hidePicker(); };
 
-void PluginBridgeEditor::disconnectRemoteLayer()
-{
-#if JUCE_MAC
-    if (remoteLayerClient)
+    activePicker->onClearBlocklist = [this]()
     {
-        CALayerHost* hostLayer = (__bridge CALayerHost*)remoteLayerClient;
-        [hostLayer removeFromSuperlayer];
-        [hostLayer release];
-        remoteLayerClient = nullptr;
-    }
-    layerConnected = false;
-#endif
-}
+        PBLOG("Editor", "Picker: clearing blocklist");
+        processorRef.getBlocklist().clear();
+    };
 
-// --- Mouse Event Forwarding ---
+    activePicker->onClearSafetyCache = [this]()
+    {
+        PBLOG("Editor", "Picker: clearing safety cache — re-scanning all plugins");
+        auto& db = processorRef.getSafetyDB();
+        for (auto& f : processorRef.getInstalledPluginFiles())
+            db.setSafety(f.getFullPathName(), PluginSafetyDB::Safety::Unknown);
+        processorRef.startBackgroundScan();
+    };
 
-void PluginBridgeEditor::sendMouseEvent(const juce::String& type, float x, float y, int button)
-{
-    // Adjust Y for top bar offset
-    float adjustedY = y - kTopBarHeight;
-    if (adjustedY < 0) return; // Click is in top bar, not plugin area
+    // Hide plugin editor / audio-only during browse (they'll come back on load)
+    if (pluginEditor)      pluginEditor->setVisible(false);
+    if (audioOnlyMode)     audioOnlyLabel.setVisible(false);
 
-    json cmd = {{"cmd", "mouse"}, {"type", type.toStdString()},
-                {"x", x}, {"y", adjustedY}, {"button", button}};
-    processorRef.getHelperConnection().sendCommand(cmd.dump());
-}
+    addAndMakeVisible(activePicker.get());
 
-void PluginBridgeEditor::mouseDown(const juce::MouseEvent& e)
-{
-    if (e.y >= kTopBarHeight && layerConnected)
-        sendMouseEvent("down", (float)e.x, (float)e.y, e.mods.isLeftButtonDown() ? 0 : 1);
-    else
-        juce::AudioProcessorEditor::mouseDown(e);
-}
+    // Resize editor to show the picker
+    int newW = std::max(getWidth(),  PluginPickerComponent::kWidth);
+    int newH = kTopBarHeight + PluginPickerComponent::kHeight;
+    setSize(newW, newH);
 
-void PluginBridgeEditor::mouseUp(const juce::MouseEvent& e)
-{
-    if (e.y >= kTopBarHeight && layerConnected)
-        sendMouseEvent("up", (float)e.x, (float)e.y, 0);
-    else
-        juce::AudioProcessorEditor::mouseUp(e);
+    PBLOG("Editor", "showPluginMenu: picker opened");
 }
 
-void PluginBridgeEditor::mouseMove(const juce::MouseEvent& e)
+void PluginBridgeEditor::hidePicker()
 {
-    if (e.y >= kTopBarHeight && layerConnected)
-        sendMouseEvent("move", (float)e.x, (float)e.y);
-    else
-        juce::AudioProcessorEditor::mouseMove(e);
-}
+    if (!activePicker) return;
 
-void PluginBridgeEditor::mouseDrag(const juce::MouseEvent& e)
-{
-    if (e.y >= kTopBarHeight && layerConnected)
-        sendMouseEvent("drag", (float)e.x, (float)e.y, 0);
-    else
-        juce::AudioProcessorEditor::mouseDrag(e);
-}
+    PBLOG("Editor", "hidePicker: closing browser");
+    removeChildComponent(activePicker.get());
+    activePicker.reset();
 
-void PluginBridgeEditor::mouseWheelMove(const juce::MouseEvent& e, const juce::MouseWheelDetails& w)
-{
-    if (e.y >= kTopBarHeight && layerConnected)
+    // Restore whatever was visible before
+    if (pluginEditor)
     {
-        json cmd = {{"cmd", "mouse"}, {"type", "scroll"},
-                    {"x", (float)e.x}, {"y", (float)(e.y - kTopBarHeight)},
-                    {"dx", w.deltaX}, {"dy", w.deltaY}};
-        processorRef.getHelperConnection().sendCommand(cmd.dump());
+        pluginEditor->setVisible(true);
+        setSize(std::max(pluginEditor->getWidth(), kDefaultWidth),
+                pluginEditor->getHeight() + kTopBarHeight);
+    }
+    else if (audioOnlyMode)
+    {
+        audioOnlyLabel.setVisible(true);
+        setSize(kDefaultWidth, kTopBarHeight + kAudioOnlyHeight);
     }
     else
     {
-        juce::AudioProcessorEditor::mouseWheelMove(e, w);
+        setSize(kDefaultWidth, kDefaultHeight);
     }
+
+    repaint();
 }
 
-// --- Plugin Menu ---
+// ── In-process plugin editor ──────────────────────────────────────────────────
 
-void PluginBridgeEditor::showPluginMenu()
+void PluginBridgeEditor::attachPluginEditor()
 {
-    auto files = processorRef.getInstalledPluginFiles();
-
-    juce::PopupMenu menu;
+    PBLOG("Editor", "attachPluginEditor: start");
+    detachPluginEditor();
+    hideAudioOnlyUI();
 
-    if (files.isEmpty())
+    auto* plugin = processorRef.getInProcessPlugin();
+    if (!plugin || !plugin->hasEditor())
     {
-        menu.addItem(-1, "(No plugins found)", false);
-        menu.showMenuAsync(juce::PopupMenu::Options().withTargetComponent(&selectButton), [](int) {});
+        PBLOG("Editor", "attachPluginEditor: no plugin or no editor — abort");
         return;
     }
 
-    juce::PopupMenu vst3Menu;
-    juce::PopupMenu auMenu;
-    int itemId = 1;
-
-    for (int i = 0; i < files.size(); ++i)
+    PBLOG("Editor", "attachPluginEditor: calling createEditor() on \"" + plugin->getName() + "\"");
+    pluginEditor.reset(plugin->createEditor());
+    if (!pluginEditor)
     {
-        const auto& file = files[i];
-        auto name = file.getFileNameWithoutExtension();
-        auto path = file.getFullPathName();
-        bool blocked = processorRef.isBlocked(path);
+        PBLOG("Editor", "attachPluginEditor: createEditor() returned null");
+        return;
+    }
 
-        if (file.getFileExtension() == ".vst3")
-            vst3Menu.addItem(itemId, blocked ? name + " (not compatible)" : name, !blocked);
-        else
-            auMenu.addItem(itemId, blocked ? name + " (not compatible)" : name, !blocked);
+    addAndMakeVisible(pluginEditor.get());
+    int w = std::max(pluginEditor->getWidth(), kDefaultWidth);
+    int h = pluginEditor->getHeight() + kTopBarHeight;
+    PBLOG("Editor", "attachPluginEditor: SUCCESS — size " + juce::String(w) + "x" + juce::String(h));
+    setSize(w, h);
+}
 
-        itemId++;
+void PluginBridgeEditor::detachPluginEditor()
+{
+    if (pluginEditor)
+    {
+        PBLOG("Editor", "detachPluginEditor: removing editor component");
+        removeChildComponent(pluginEditor.get());
+        pluginEditor.reset();
+        PBLOG("Editor", "detachPluginEditor: done");
     }
+}
 
-    if (vst3Menu.getNumItems() > 0)
-        menu.addSubMenu("VST3", vst3Menu);
-    if (auMenu.getNumItems() > 0)
-        menu.addSubMenu("Audio Units", auMenu);
+// ── Audio-only fallback UI ────────────────────────────────────────────────────
 
-    menu.addSeparator();
-    menu.addItem(9999, "Clear blocklist");
+void PluginBridgeEditor::showAudioOnlyUI()
+{
+    detachPluginEditor();
+    audioOnlyMode = true;
+
+    auto name = processorRef.getLoadedPluginName();
+    audioOnlyLabel.setText(
+        name + "\n\nGUI unavailable — plugin failed safety scan.\n"
+               "Audio processing active. Use MCP or automation for parameters.",
+        juce::dontSendNotification);
+    audioOnlyLabel.setVisible(true);
+    setSize(kDefaultWidth, kTopBarHeight + kAudioOnlyHeight);
+}
 
-    menu.showMenuAsync(juce::PopupMenu::Options().withTargetComponent(&selectButton),
-        [this, files](int result)
-        {
-            if (result == 9999)
-            {
-                processorRef.getBlocklist().clear();
-                return;
-            }
-
-            if (result > 0 && result <= files.size())
-            {
-                showingError = false;
-                pluginStatusLabel.setText("Loading...", juce::dontSendNotification);
-                pluginStatusLabel.setColour(juce::Label::textColourId, kTextSecondary);
-                processorRef.loadPlugin(files[result - 1].getFullPathName());
-            }
-        });
+void PluginBridgeEditor::hideAudioOnlyUI()
+{
+    audioOnlyMode = false;
+    audioOnlyLabel.setVisible(false);
 }

Source/Plugin/PluginBridgeProcessor.cpp

@@ -1,6 +1,16 @@
 #include "PluginBridgeProcessor.h"
 #include "PluginBridgeEditor.h"
 #include "IPCProtocol.h"
+#include "PBLog.h"
+
+#include <sys/wait.h>
+#include <spawn.h>
+#include <signal.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <chrono>
+
+extern char** environ;
 
 #include "json.hpp"
 using json = nlohmann::json;
@@ -11,44 +21,62 @@ PluginBridgeProcessor::PluginBridgeProcessor()
                          .withOutput("Output", juce::AudioChannelSet::stereo(), true)),
       mcpServer(std::make_unique<McpServer>(PluginBridgeConstants::kDefaultMcpPort, helper))
 {
+    PBLog::startSession("Processor");
+    PBLOG("Processor", "Constructor — PluginBridgeProcessor created");
+
+    inProcessFormatManager.addFormat(new juce::VST3PluginFormat());
+    inProcessFormatManager.addFormat(new juce::AudioUnitPluginFormat());
+
     helper.onHelperCrashed = [this]()
     {
+        PBLOG("Processor", "⚠️  Helper crashed — clearing plugin state");
+
+        // Mark the crashing plugin as unsafe so it loads audio-only next time
+        // instead of respawning a Helper that will crash again.
+        if (pluginPath.isNotEmpty())
+        {
+            PBLOG("Processor", "⚠️  Marking \"" + pluginName + "\" as UNSAFE (Helper crash)");
+            safetyDB.setSafety(pluginPath, PluginSafetyDB::Safety::Unsafe);
+        }
+
         pluginLoaded = false;
         pluginName.clear();
         pluginParamCount = 0;
-        remoteLayerPortName.clear();
-        remoteGuiWidth = 0;
-        remoteGuiHeight = 0;
+        unloadInProcessPlugin();
         DBG("PluginBridgeProcessor: Helper crashed");
     };
 
-    helper.onGuiReady = [this](const juce::String& portName, int width, int height)
-    {
-        remoteLayerPortName = portName;
-        remoteGuiWidth = width;
-        remoteGuiHeight = height;
-        if (onGuiReady)
-            juce::MessageManager::callAsync([this]() { if (onGuiReady) onGuiReady(); });
-    };
-
-    helper.onGuiResized = [this](int width, int height)
+    helper.onParamChanged = [this](int idx, float val)
     {
-        remoteGuiWidth = width;
-        remoteGuiHeight = height;
-        if (onGuiResized)
-            juce::MessageManager::callAsync([this, width, height]() { if (onGuiResized) onGuiResized(width, height); });
+        if (!inProcessPlugin) return;
+        auto& params = inProcessPlugin->getParameters();
+        if (idx < 0 || idx >= params.size()) return;
+        suppressParamSync.store(true);
+        juce::MessageManager::callAsync([this, idx, val]()
+        {
+            if (!inProcessPlugin) return;
+            auto& p = inProcessPlugin->getParameters();
+            if (idx < p.size())
+                p[idx]->setValueNotifyingHost(juce::jlimit(0.0f, 1.0f, val));
+            suppressParamSync.store(false);
+        });
     };
 
     // Wire audio analysis to MCP get_analysis tool
     mcpServer->getAnalysisCallback = [this]() { return analyser.getCompactAnalysis(); };
 
     mcpServer->start();
+    startBackgroundScan();
 }
 
 PluginBridgeProcessor::~PluginBridgeProcessor()
 {
+    PBLOG("Processor", "Destructor — tearing down");
+    stopBackgroundScan();
     mcpServer->stop();
+    unloadInProcessPlugin();
     helper.killHelper();
+    PBLOG("Processor", "Destructor — done");
 }
 
 void PluginBridgeProcessor::prepareToPlay(double sampleRate, int samplesPerBlock)
@@ -56,7 +84,6 @@ void PluginBridgeProcessor::prepareToPlay(double sampleRate, int samplesPerBlock
     currentSampleRate = sampleRate;
     currentBlockSize = samplesPerBlock;
 
-    // Prepare audio analyser
     analyser.prepareToPlay(sampleRate, samplesPerBlock);
 
     if (helper.isHelperRunning())
@@ -83,19 +110,16 @@ void PluginBridgeProcessor::processBlock(juce::AudioBuffer<float>& buffer, juce:
 {
     juce::ScopedNoDenormals noDenormals;
 
-    auto totalNumInputChannels = getTotalNumInputChannels();
-    auto totalNumOutputChannels = getTotalNumOutputChannels();
-    for (auto i = totalNumInputChannels; i < totalNumOutputChannels; ++i)
+    for (auto i = getTotalNumInputChannels(); i < getTotalNumOutputChannels(); ++i)
         buffer.clear(i, 0, buffer.getNumSamples());
 
-    if (!pluginLoaded || !helper.isHelperRunning())
-        return;
+    if (!pluginLoaded || !helper.isHelperRunning()) return;
 
     auto& shm = helper.getSharedAudio();
     if (!shm.isValid()) return;
 
     int numChannels = buffer.getNumChannels();
-    int numSamples = buffer.getNumSamples();
+    int numSamples  = buffer.getNumSamples();
 
     const float* inputPtrs[2] = {
         buffer.getReadPointer(0),
@@ -118,8 +142,6 @@ void PluginBridgeProcessor::processBlock(juce::AudioBuffer<float>& buffer, juce:
         };
         shm.readOutput(outputPtrs, numChannels, numSamples);
         header->state.store(kStateIdle);
-
-        // Analyse the output audio (post-plugin processing)
         analyser.processBlock(buffer);
     }
 }
@@ -129,75 +151,228 @@ juce::AudioProcessorEditor* PluginBridgeProcessor::createEditor()
     return new PluginBridgeEditor(*this);
 }
 
-// --- Plugin Loading ---
+// ── In-process plugin (GUI instance) ─────────────────────────────────────────
+
+void PluginBridgeProcessor::loadInProcessPlugin(const juce::String& path)
+{
+    PBLOG("Processor", "loadInProcessPlugin: " + juce::File(path).getFileName());
+    unloadInProcessPlugin();
+
+    juce::File pluginFile(path);
+    if (!pluginFile.exists())
+    {
+        PBLOG("Processor", "loadInProcessPlugin: file not found — abort");
+        return;
+    }
+
+    juce::OwnedArray<juce::PluginDescription> typesFound;
+    for (int i = 0; i < inProcessFormatManager.getNumFormats(); ++i)
+    {
+        auto* format = inProcessFormatManager.getFormat(i);
+        bool isVST3 = pluginFile.getFileExtension() == ".vst3";
+        bool isAU   = pluginFile.getFileExtension() == ".component";
+        if (isVST3 && format->getName() != "VST3")      continue;
+        if (isAU   && format->getName() != "AudioUnit")  continue;
+        format->findAllTypesForFile(typesFound, pluginFile.getFullPathName());
+        if (typesFound.size() > 0) break;
+    }
+
+    if (typesFound.isEmpty())
+    {
+        PBLOG("Processor", "loadInProcessPlugin: no types found");
+        return;
+    }
+
+    PBLOG("Processor", "loadInProcessPlugin: creating instance \"" + typesFound[0]->name + "\"");
+    juce::String err;
+    inProcessPlugin = inProcessFormatManager.createPluginInstance(
+        *typesFound[0], currentSampleRate, currentBlockSize, err);
+
+    if (!inProcessPlugin)
+    {
+        PBLOG("Processor", "loadInProcessPlugin: createPluginInstance FAILED — " + err);
+        DBG("PluginBridgeProcessor: in-process load failed: " + err);
+        return;
+    }
+
+    // Bus layout — needed so the plugin knows its I/O configuration for GUI display.
+    // We do NOT call prepareToPlay() — the in-process plugin is GUI-only and never
+    // processes audio. Calling prepareToPlay() causes some plugins (iZotope Neutron,
+    // inter-plugin comms plugins) to spin up internal audio threads that then race
+    // with unloadInProcessPlugin() and crash the audio thread.
+    inProcessPlugin->enableAllBuses();
+    auto layout = juce::AudioProcessor::BusesLayout();
+    layout.inputBuses.add(juce::AudioChannelSet::stereo());
+    layout.outputBuses.add(juce::AudioChannelSet::stereo());
+    if (inProcessPlugin->checkBusesLayoutSupported(layout))
+        inProcessPlugin->setBusesLayout(layout);
+
+    auto response = helper.sendCommand("{\"cmd\":\"get_state\"}");
+    try {
+        auto j = json::parse(response);
+        if (j.value("ok", false))
+        {
+            auto stateB64 = juce::String(j["state"].get<std::string>());
+            if (stateB64.isNotEmpty())
+            {
+                juce::MemoryBlock stateData;
+                if (stateData.fromBase64Encoding(stateB64))
+                    inProcessPlugin->setStateInformation(stateData.getData(), (int)stateData.getSize());
+            }
+        }
+    } catch (...) {}
+
+    inProcessPlugin->addListener(this);
+    PBLOG("Processor", "loadInProcessPlugin: SUCCESS — \"" + inProcessPlugin->getName() + "\"");
+    DBG("PluginBridgeProcessor: in-process plugin loaded for GUI: " + inProcessPlugin->getName());
+}
+
+void PluginBridgeProcessor::unloadInProcessPlugin()
+{
+    if (inProcessPlugin)
+    {
+        PBLOG("Processor", "unloadInProcessPlugin: removing \"" + inProcessPlugin->getName() + "\"");
+        inProcessPlugin->removeListener(this);
+        inProcessPlugin->releaseResources();
+        inProcessPlugin.reset();
+        PBLOG("Processor", "unloadInProcessPlugin: done");
+    }
+    else
+    {
+        PBLOG("Processor", "unloadInProcessPlugin: nothing to unload");
+    }
+}
+
+void PluginBridgeProcessor::audioProcessorParameterChanged(juce::AudioProcessor*, int paramIdx, float value)
+{
+    if (suppressParamSync.load()) return;
+    if (!helper.isHelperRunning()) return;
+
+    auto cmdStr = json({{"cmd","set_params"},{"values",{{std::to_string(paramIdx), value}}}}).dump();
+    std::thread([this, cmdStr]() { helper.sendCommand(cmdStr); }).detach();
+}
+
+// ── Plugin Loading ────────────────────────────────────────────────────────────
 
 void PluginBridgeProcessor::loadPlugin(const juce::String& path)
 {
+    PBLOG("Processor", "loadPlugin: " + juce::File(path).getFileName()
+          + "  (currently loaded: " + (pluginLoaded ? pluginName : "none") + ")");
+
     if (blocklist.isBlocked(path))
     {
-        if (onLoadFailed)
-            onLoadFailed("Not compatible (crashed previously)");
+        PBLOG("Processor", "loadPlugin: BLOCKED — skipping");
+        if (onLoadFailed) onLoadFailed("Not compatible (crashed previously)");
         return;
     }
 
+    // ── Safety check ──────────────────────────────────────────────────────────
+    auto safety = safetyDB.getSafety(path);
+    PBLOG("Processor", juce::String("loadPlugin: safety = ")
+          + (safety == PluginSafetyDB::Safety::Safe    ? "SAFE"
+           : safety == PluginSafetyDB::Safety::Unsafe  ? "UNSAFE"
+                                                        : "UNKNOWN"));
+
+    if (safety == PluginSafetyDB::Safety::Unknown)
+    {
+        if (onLoadFailed) onLoadFailed("Scanning plugin...");
+        std::thread([this, path]()
+        {
+            bool safe = runPluginScan(path);
+            safetyDB.setSafety(path, safe ? PluginSafetyDB::Safety::Safe
+                                          : PluginSafetyDB::Safety::Unsafe);
+            juce::MessageManager::callAsync([this, path]() { loadPlugin(path); });
+        }).detach();
+        return;
+    }
+
+    // ── Notify editor to detach BEFORE we tear down the old plugin ────────────
+    // This prevents use-after-free when switching between plugins.
+    if (onPluginWillLoad)
+    {
+        PBLOG("Processor", "loadPlugin: firing onPluginWillLoad → editor will detach old GUI");
+        onPluginWillLoad();
+    }
+
+    // ── Start Helper ──────────────────────────────────────────────────────────
     if (!helper.isHelperRunning())
     {
+        PBLOG("Processor", "loadPlugin: Helper not running — spawning");
         if (!helper.spawnHelper())
         {
-            DBG("PluginBridgeProcessor: Failed to spawn helper");
-            if (onLoadFailed)
-                onLoadFailed("Failed to start helper process");
+            PBLOG("Processor", "loadPlugin: ❌ spawnHelper FAILED");
+            if (onLoadFailed) onLoadFailed("Failed to start helper process");
             return;
         }
+        PBLOG("Processor", "loadPlugin: Helper spawned OK");
 
-        json configCmd = {{"cmd", "configure"},
-                          {"sampleRate", currentSampleRate},
-                          {"blockSize", currentBlockSize},
-                          {"channels", 2}};
+        json configCmd = {{"cmd","configure"},{"sampleRate",currentSampleRate},
+                          {"blockSize",currentBlockSize},{"channels",2}};
         helper.sendCommand(configCmd.dump());
     }
 
-    json loadCmd = {{"cmd", "load"},
-                    {"path", path.toStdString()},
-                    {"sampleRate", currentSampleRate},
-                    {"blockSize", currentBlockSize}};
-
+    PBLOG("Processor", "loadPlugin: sending load cmd to Helper...");
+    json loadCmd = {{"cmd","load"},{"path",path.toStdString()},
+                    {"sampleRate",currentSampleRate},{"blockSize",currentBlockSize}};
     auto response = helper.sendCommand(loadCmd.dump());
+    PBLOG("Processor", "loadPlugin: Helper response: " + juce::String(response));
 
     try
     {
         auto j = json::parse(response);
         if (j.value("ok", false))
         {
-            pluginLoaded = true;
-            pluginName = juce::String(j["name"].get<std::string>());
+            pluginLoaded     = true;
+            pluginName       = juce::String(j["name"].get<std::string>());
             pluginParamCount = j.value("params", 0);
-            pluginPath = path;
-            DBG("PluginBridgeProcessor: Loaded " + pluginName);
+            pluginPath       = path;
+            PBLOG("Processor", "loadPlugin: Helper loaded \"" + pluginName
+                  + "\" (" + juce::String(pluginParamCount) + " params)");
 
-            if (onPluginLoaded)
-                juce::MessageManager::callAsync([this]() { if (onPluginLoaded) onPluginLoaded(); });
+            if (safety == PluginSafetyDB::Safety::Safe)
+            {
+                juce::MessageManager::callAsync([this, path]()
+                {
+                    PBLOG("Processor", "loadPlugin: [msg thread] calling loadInProcessPlugin");
+                    loadInProcessPlugin(path);
+                    PBLOG("Processor", "loadPlugin: [msg thread] firing onPluginLoaded");
+                    if (onPluginLoaded) onPluginLoaded();
+                });
+            }
+            else
+            {
+                PBLOG("Processor", "loadPlugin: UNSAFE — skipping in-process load, audio-only mode");
+                juce::MessageManager::callAsync([this]()
+                {
+                    if (onPluginLoaded) onPluginLoaded();
+                });
+            }
         }
         else
         {
+            PBLOG("Processor", "loadPlugin: ❌ Helper refused load: "
+                  + juce::String(j.value("error", "unknown")));
             pluginLoaded = false;
-            auto error = juce::String(j.value("error", "unknown"));
+            pluginPath.clear();   // prevent onHelperCrashed stamping the wrong plugin
             blocklist.addBlocked(path);
             if (onLoadFailed)
-                onLoadFailed("Not compatible: " + error);
+                onLoadFailed("Not compatible: " + juce::String(j.value("error", "unknown")));
         }
     }
     catch (...)
     {
+        PBLOG("Processor", "loadPlugin: ❌ exception parsing Helper response");
         pluginLoaded = false;
+        pluginPath.clear();       // prevent onHelperCrashed stamping the wrong plugin
         blocklist.addBlocked(path);
-        if (onLoadFailed)
-            onLoadFailed("Helper communication error");
+        if (onLoadFailed) onLoadFailed("Helper communication error");
     }
 }
 
 void PluginBridgeProcessor::unloadPlugin()
 {
+    PBLOG("Processor", "unloadPlugin: \"" + pluginName + "\"");
+
     if (helper.isHelperRunning())
         helper.sendCommand("{\"cmd\":\"unload\"}");
 
@@ -205,49 +380,271 @@ void PluginBridgeProcessor::unloadPlugin()
     pluginName.clear();
     pluginPath.clear();
     pluginParamCount = 0;
-    remoteLayerPortName.clear();
-    remoteGuiWidth = 0;
-    remoteGuiHeight = 0;
+
+    unloadInProcessPlugin();
+    PBLOG("Processor", "unloadPlugin: done");
 
     if (onPluginUnloaded)
         juce::MessageManager::callAsync([this]() { if (onPluginUnloaded) onPluginUnloaded(); });
 }
 
-void PluginBridgeProcessor::showPluginGui()
+// ── Plugin Scanner ────────────────────────────────────────────────────────────
+// Spawns Helper with --scan <path> in an isolated subprocess.
+// stderr is piped back so we capture every step the scanner logged.
+// If the plugin crashes the subprocess, waitpid() catches WTERMSIG. Ableton is safe.
+
+static juce::String signalName(int sig)
 {
-    if (helper.isHelperRunning())
-        helper.sendCommand("{\"cmd\":\"show_gui\"}");
+    switch (sig)
+    {
+        case SIGSEGV: return "SIGSEGV (segmentation fault)";
+        case SIGABRT: return "SIGABRT (abort)";
+        case SIGBUS:  return "SIGBUS (bus error)";
+        case SIGILL:  return "SIGILL (illegal instruction)";
+        case SIGFPE:  return "SIGFPE (floating point exception)";
+        case SIGKILL: return "SIGKILL (killed — timeout)";
+        default:      return "signal " + juce::String(sig);
+    }
 }
 
-void PluginBridgeProcessor::hidePluginGui()
+static void writeScanLog(const juce::String& pluginPath,
+                         bool safe,
+                         const juce::String& reason,
+                         const juce::String& captured)
 {
-    if (helper.isHelperRunning())
-        helper.sendCommand("{\"cmd\":\"hide_gui\"}");
+    auto logFile = juce::File::getSpecialLocation(juce::File::userApplicationDataDirectory)
+                       .getChildFile("PluginBridge")
+                       .getChildFile("scan.log");
+    logFile.getParentDirectory().createDirectory();
+
+    auto ts   = juce::Time::getCurrentTime().formatted("%Y-%m-%d %H:%M:%S");
+    auto name = juce::File(pluginPath).getFileName();
+
+    juce::String entry;
+    entry << "────────────────────────────────────────\n"
+          << ts << "  " << name << "\n"
+          << "Path   : " << pluginPath << "\n"
+          << "Result : " << (safe ? "SAFE ✓" : "UNSAFE ✗") << "\n";
+
+    if (!reason.isEmpty())
+        entry << "Reason : " << reason << "\n";
+
+    if (captured.isNotEmpty())
+    {
+        entry << "Scanner output:\n";
+        for (auto& line : juce::StringArray::fromLines(captured))
+            if (line.isNotEmpty())
+                entry << "  " << line << "\n";
+    }
+
+    entry << "\n";
+    logFile.appendText(entry);
 }
 
-// --- Plugin List ---
+bool PluginBridgeProcessor::runPluginScan(const juce::String& path)
+{
+    // Resolve Helper binary (same logic as HelperConnection::spawnHelper)
+    auto helperApp = juce::File::getSpecialLocation(juce::File::currentExecutableFile)
+                         .getParentDirectory()
+                         .getParentDirectory()
+                         .getChildFile("Resources")
+                         .getChildFile("PluginBridgeHelper.app")
+                         .getChildFile("Contents")
+                         .getChildFile("MacOS")
+                         .getChildFile(PluginBridgeConstants::kHelperBinaryName);
+
+    if (!helperApp.exists())
+    {
+        helperApp = juce::File::getSpecialLocation(juce::File::currentExecutableFile)
+                        .getParentDirectory()
+                        .getParentDirectory()
+                        .getChildFile("Resources")
+                        .getChildFile(PluginBridgeConstants::kHelperBinaryName);
+    }
+
+    if (!helperApp.exists())
+    {
+        writeScanLog(path, false, "Helper binary not found", {});
+        return false;
+    }
+
+    // Create pipe to capture scanner's stderr
+    int pipeFd[2];
+    if (pipe(pipeFd) != 0)
+    {
+        writeScanLog(path, false, "pipe() failed", {});
+        return false;
+    }
+    // Make read end non-blocking so we can drain it safely
+    fcntl(pipeFd[0], F_SETFL, O_NONBLOCK);
+
+    auto helperPathStr = helperApp.getFullPathName().toStdString();
+    auto pluginPathStr = path.toStdString();
+
+    // Redirect child stderr → pipe write end
+    posix_spawn_file_actions_t actions;
+    posix_spawn_file_actions_init(&actions);
+    posix_spawn_file_actions_adddup2(&actions, pipeFd[1], STDERR_FILENO);
+    posix_spawn_file_actions_addclose(&actions, pipeFd[0]);
+
+    pid_t pid;
+    char* argv[] = {
+        (char*)helperPathStr.c_str(),
+        (char*)"--scan",
+        (char*)pluginPathStr.c_str(),
+        nullptr
+    };
+
+    int spawnResult = posix_spawn(&pid, helperPathStr.c_str(), &actions, nullptr, argv, environ);
+    posix_spawn_file_actions_destroy(&actions);
+    close(pipeFd[1]); // Parent never writes
+
+    if (spawnResult != 0)
+    {
+        close(pipeFd[0]);
+        writeScanLog(path, false, "posix_spawn failed: " + juce::String(strerror(spawnResult)), {});
+        return false;
+    }
+
+    // Poll with 10s timeout
+    bool timedOut = true;
+    int  finalStatus = 0;
+
+    auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (std::chrono::steady_clock::now() < deadline)
+    {
+        pid_t result = waitpid(pid, &finalStatus, WNOHANG);
+        if (result == pid) { timedOut = false; break; }
+        std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    }
+
+    if (timedOut)
+    {
+        kill(pid, SIGKILL);
+        waitpid(pid, &finalStatus, 0);
+    }
+
+    // Drain pipe — read whatever the scanner managed to write before dying
+    juce::String captured;
+    {
+        char buf[8192];
+        ssize_t n;
+        while ((n = read(pipeFd[0], buf, sizeof(buf) - 1)) > 0)
+        {
+            buf[n] = '\0';
+            captured += buf;
+        }
+    }
+    close(pipeFd[0]);
+
+    // Interpret result
+    bool safe = false;
+    juce::String reason;
+
+    if (timedOut)
+    {
+        reason = "Timed out after 10s (hung on load or init)";
+    }
+    else if (WIFEXITED(finalStatus))
+    {
+        int code = WEXITSTATUS(finalStatus);
+        safe   = (code == 0);
+        reason = safe ? "" : "Exited with code " + juce::String(code);
+    }
+    else if (WIFSIGNALED(finalStatus))
+    {
+        reason = "Crashed: " + signalName(WTERMSIG(finalStatus));
+    }
+
+    writeScanLog(path, safe, reason, captured);
+    DBG("runPluginScan: " + juce::File(path).getFileName()
+        + (safe ? " → SAFE" : " → UNSAFE") + (reason.isEmpty() ? "" : " (" + reason + ")"));
+
+    return safe;
+}
+
+// ── Background Scanner ────────────────────────────────────────────────────────
+// Scans all installed plugins whose safety is Unknown, one at a time.
+// Results are stored in safetyDB and broadcast via onScanProgress.
+
+void PluginBridgeProcessor::startBackgroundScan()
+{
+    if (scanRunning.load()) return;
+    scanRunning.store(true);
+
+    scanThread = std::thread([this]()
+    {
+        auto files = getInstalledPluginFiles();
+
+        for (int i = 0; i < files.size() && scanRunning.load(); ++i)
+        {
+            auto path = files[i].getFullPathName();
+            if (safetyDB.getSafety(path) != PluginSafetyDB::Safety::Unknown)
+                continue;
+
+            // CRITICAL: wait while the Helper is actively running a plugin.
+            // The scan subprocess and the live Helper share the same shared-memory
+            // name. Running both simultaneously causes the scan to crash →
+            // valid plugins get wrongly stamped UNSAFE.
+            while (helper.isHelperRunning() && scanRunning.load())
+                std::this_thread::sleep_for(std::chrono::milliseconds(500));
+
+            if (!scanRunning.load()) break;
+
+            bool safe = runPluginScan(path);
+            safetyDB.setSafety(path, safe ? PluginSafetyDB::Safety::Safe
+                                          : PluginSafetyDB::Safety::Unsafe);
+
+            if (onScanProgress)
+            {
+                juce::MessageManager::callAsync([this, path, safe]()
+                {
+                    if (onScanProgress) onScanProgress(path, safe);
+                });
+            }
+        }
+
+        scanRunning.store(false);
+        DBG("PluginBridgeProcessor: background scan complete");
+    });
+}
+
+void PluginBridgeProcessor::stopBackgroundScan()
+{
+    scanRunning.store(false);
+    if (scanThread.joinable())
+        scanThread.join();
+}
+
+// ── Plugin List ───────────────────────────────────────────────────────────────
 
 juce::Array<juce::File> PluginBridgeProcessor::getInstalledPluginFiles() const
 {
     juce::Array<juce::File> results;
-
-    juce::Array<juce::File> dirs = {
-        juce::File("/Library/Audio/Plug-Ins/VST3"),
-        juce::File::getSpecialLocation(juce::File::userHomeDirectory)
-            .getChildFile("Library/Audio/Plug-Ins/VST3"),
-        juce::File("/Library/Audio/Plug-Ins/Components"),
-        juce::File::getSpecialLocation(juce::File::userHomeDirectory)
-            .getChildFile("Library/Audio/Plug-Ins/Components")
+    std::set<std::string> seen; // deduplicate by stem name — VST3 wins over AU
+
+    // Priority order: system VST3 → user VST3 → system AU → user AU.
+    // System paths match the existing safety DB entries, so VST3 is preferred
+    // and same-named AU duplicates are automatically skipped.
+    struct DirSpec { juce::File dir; const char* pattern; };
+    std::vector<DirSpec> specs = {
+        { juce::File("/Library/Audio/Plug-Ins/VST3"),              "*.vst3"      },
+        { juce::File::getSpecialLocation(juce::File::userHomeDirectory)
+              .getChildFile("Library/Audio/Plug-Ins/VST3"),       "*.vst3"      },
+        { juce::File("/Library/Audio/Plug-Ins/Components"),        "*.component" },
+        { juce::File::getSpecialLocation(juce::File::userHomeDirectory)
+              .getChildFile("Library/Audio/Plug-Ins/Components"),  "*.component" }
     };
 
-    for (auto& dir : dirs)
+    for (auto& spec : specs)
     {
-        if (dir.isDirectory())
+        if (!spec.dir.isDirectory()) continue;
+        auto files = spec.dir.findChildFiles(juce::File::findDirectories, false, spec.pattern);
+        for (auto& f : files)
         {
-            auto vst3s = dir.findChildFiles(juce::File::findDirectories, false, "*.vst3");
-            auto aus = dir.findChildFiles(juce::File::findDirectories, false, "*.component");
-            results.addArray(vst3s);
-            results.addArray(aus);
+            auto stem = f.getFileNameWithoutExtension().toStdString();
+            if (seen.insert(stem).second)   // first time we see this name → keep it
+                results.add(f);
         }
     }
 
@@ -260,7 +657,154 @@ bool PluginBridgeProcessor::isBlocked(const juce::String& path) const
     return blocklist.isBlocked(path);
 }
 
-// --- State ---
+// ── Manufacturer name ─────────────────────────────────────────────────────────
+// Fast: reads VST3 Info.plist (no plugin loading). Cached after first call.
+
+// Strip copyright preamble and return the actual company name.
+// Handles: "Copyright © 2002-2025 FabFilter"  → "FabFilter"
+//          "Copyright (C) 2017-2021 Soundtheory" → "Soundtheory"
+//          "16.7.33.200" (version as vendor)    → "" (trigger fallback)
+static juce::String cleanManufacturer(const juce::String& raw)
+{
+    auto s = raw.trim();
+    if (s.isEmpty()) return {};
+
+    // Pure version number used as vendor (e.g. "16.7.33.200") → reject
+    if (s.containsOnly("0123456789.")) return {};
+
+    auto lower = s.toLowerCase();
+    if (lower.startsWith("copyright"))
+    {
+        // Skip the word "Copyright"
+        auto rest = s.substring(9).trim();
+        // Skip "(C)", "(c)"
+        if (rest.startsWithIgnoreCase("(c)"))
+            rest = rest.substring(3).trim();
+        // Skip "©" (UTF-8 0xC2 0xA9, or the Unicode character directly)
+        else if (rest.startsWith(juce::String::fromUTF8("\xc2\xa9")))
+            rest = rest.substring(juce::String::fromUTF8("\xc2\xa9").length()).trim();
+        else if (rest.startsWith(juce::CharPointer_UTF8("\xc2\xa9")))
+            rest = rest.substring(1).trim();
+        // Skip year token(s): "2025" or "2002-2025"
+        auto spacePos = rest.indexOfChar(' ');
+        if (spacePos > 0)
+            rest = rest.substring(spacePos + 1).trim();
+        if (rest.isNotEmpty()) return rest;
+        return {};
+    }
+
+    return s;
+}
+
+// Extract the plist <string> value for a given key from raw plist XML text.
+static juce::String plistValue(const juce::String& text, const juce::String& key)
+{
+    auto pos = text.fromFirstOccurrenceOf(key, false, true);
+    if (pos.isEmpty()) return {};
+    return pos.fromFirstOccurrenceOf("<string>", false, false)
+              .upToFirstOccurrenceOf("</string>", false, false)
+              .trim();
+}
+
+juce::String PluginBridgeProcessor::getPluginManufacturer(const juce::File& f) const
+{
+    auto pathKey = f.getFullPathName().toStdString();
+
+    {
+        std::lock_guard<std::mutex> lock(manufacturerCacheMutex);
+        auto it = manufacturerCache.find(pathKey);
+        if (it != manufacturerCache.end())
+            return juce::String(it->second);
+    }
+
+    juce::String mfr;
+
+    // ── VST3: Info.plist fields (no plugin loading needed) ───────────────────
+    if (f.getFileExtension().toLowerCase() == ".vst3")
+    {
+        auto infoPlist = f.getChildFile("Contents").getChildFile("Info.plist");
+        if (infoPlist.existsAsFile())
+        {
+            auto text = infoPlist.loadFileAsString();
+
+            // 1) NSHumanReadableCopyright  → "Copyright © 2002-2025 FabFilter" → "FabFilter"
+            auto copyright = plistValue(text, "NSHumanReadableCopyright");
+            mfr = cleanManufacturer(copyright);
+
+            // 2) CFBundleGetInfoString → "FabFilter Pro-Q 4.02, Copyright © …"
+            //    Take the part before the comma (= "FabFilter Pro-Q 4.02"),
+            //    then its first space-delimited word (= "FabFilter")
+            if (mfr.isEmpty())
+            {
+                auto infoStr = plistValue(text, "CFBundleGetInfoString");
+                if (infoStr.contains(","))
+                {
+                    auto beforeComma = infoStr.upToFirstOccurrenceOf(",", false, false).trim();
+                    // First word of "FabFilter Pro-Q 4.02" is "FabFilter"
+                    auto first = beforeComma.upToFirstOccurrenceOf(" ", false, false).trim();
+                    if (first.isNotEmpty() && !first.containsOnly("0123456789."))
+                        mfr = first;
+                }
+                if (mfr.isEmpty())
+                    mfr = cleanManufacturer(infoStr);
+            }
+
+            // 3) CFBundleIdentifier → "com.fabfilter.Pro-Q.4" → second segment
+            if (mfr.isEmpty())
+            {
+                auto bid = plistValue(text, "CFBundleIdentifier");
+                // "com.fabfilter.Pro-Q.4" → segments: com | fabfilter | …
+                auto segs = juce::StringArray::fromTokens(bid, ".", "");
+                if (segs.size() >= 2)
+                {
+                    // segment[1] is usually the company slug — capitalise it
+                    auto slug = segs[1].trim();
+                    if (slug.isNotEmpty() && slug != "apple" && slug != "com")
+                    {
+                        slug = slug.substring(0, 1).toUpperCase() + slug.substring(1);
+                        mfr = slug;
+                    }
+                }
+            }
+        }
+
+        // 4) moduleinfo.json "vendor" (VST3 SDK 3.7+) — clean copyright if needed
+        if (mfr.isEmpty())
+        {
+            auto moduleInfo = f.getChildFile("Contents").getChildFile("moduleinfo.json");
+            if (moduleInfo.existsAsFile())
+            {
+                try
+                {
+                    auto j = json::parse(moduleInfo.loadFileAsString().toStdString());
+                    auto vendor = cleanManufacturer(juce::String(j.value("vendor", "")));
+                    if (vendor.isNotEmpty()) mfr = vendor;
+                }
+                catch (...) {}
+            }
+        }
+    }
+
+    // ── Filename heuristic (AU or VST3 fallback) ──────────────────────────────
+    // "FabFilter Pro-Q 4" → "FabFilter",  "ValhallaDelay" → "ValhallaDelay"
+    if (mfr.isEmpty())
+    {
+        auto name = f.getFileNameWithoutExtension();
+        auto first = name.upToFirstOccurrenceOf(" ", false, false);
+        if (first.isNotEmpty() && !first.containsOnly("0123456789."))
+            mfr = first;
+        else
+            mfr = name;
+    }
+
+    if (mfr.isEmpty()) mfr = "Other";
+
+    std::lock_guard<std::mutex> lock(manufacturerCacheMutex);
+    manufacturerCache[pathKey] = mfr.toStdString();
+    return mfr;
+}
+
+// ── State ─────────────────────────────────────────────────────────────────────
 
 void PluginBridgeProcessor::getStateInformation(juce::MemoryBlock& destData)
 {
@@ -273,7 +817,8 @@ void PluginBridgeProcessor::getStateInformation(juce::MemoryBlock& destData)
         try {
             auto j = json::parse(response);
             if (j.value("ok", false))
-                state.setProperty("pluginState", juce::String(j["state"].get<std::string>()), nullptr);
+                state.setProperty("pluginState",
+                    juce::String(j["state"].get<std::string>()), nullptr);
         } catch (...) {}
     }
 
@@ -284,34 +829,25 @@ void PluginBridgeProcessor::getStateInformation(juce::MemoryBlock& destData)
 void PluginBridgeProcessor::setStateInformation(const void* data, int sizeInBytes)
 {
     auto state = juce::ValueTree::readFromData(data, (size_t)sizeInBytes);
-    if (state.isValid())
-    {
-        auto path = state.getProperty("pluginPath").toString();
-        if (path.isNotEmpty())
-        {
-            loadPlugin(path);
+    if (!state.isValid()) return;
 
-            auto pluginState = state.getProperty("pluginState").toString();
-            if (pluginState.isNotEmpty() && helper.isHelperRunning())
-            {
-                json cmd = {{"cmd", "set_state"}, {"state", pluginState.toStdString()}};
-                helper.sendCommand(cmd.dump());
-            }
-        }
-    }
-}
+    auto path = state.getProperty("pluginPath").toString();
+    if (path.isEmpty()) return;
 
-// --- MCP ---
+    loadPlugin(path);
 
-bool PluginBridgeProcessor::isMcpServerRunning() const
-{
-    return mcpServer && mcpServer->isRunning();
+    auto pluginState = state.getProperty("pluginState").toString();
+    if (pluginState.isNotEmpty() && helper.isHelperRunning())
+    {
+        json cmd = {{"cmd","set_state"},{"state",pluginState.toStdString()}};
+        helper.sendCommand(cmd.dump());
+    }
 }
 
-int PluginBridgeProcessor::getMcpServerPort() const
-{
-    return mcpServer ? mcpServer->getPort() : 0;
-}
+// ── MCP ───────────────────────────────────────────────────────────────────────
+
+bool PluginBridgeProcessor::isMcpServerRunning() const { return mcpServer && mcpServer->isRunning(); }
+int  PluginBridgeProcessor::getMcpServerPort()   const { return mcpServer ? mcpServer->getPort() : 0; }
 
 juce::AudioProcessor* JUCE_CALLTYPE createPluginFilter()
 {

Source/Plugin/PluginBridgeProcessor.h

@@ -5,10 +5,15 @@
 #include "HelperConnection.h"
 #include "McpServer.h"
 #include "Blocklist.h"
+#include "PluginSafetyDB.h"
 #include "AudioAnalyser.h"
 #include "Constants.h"
+#include <map>
+#include <mutex>
+#include <set>
 
-class PluginBridgeProcessor : public juce::AudioProcessor
+class PluginBridgeProcessor : public juce::AudioProcessor,
+                               private juce::AudioProcessorListener
 {
 public:
     PluginBridgeProcessor();
@@ -40,11 +45,9 @@ public:
     int getMcpServerPort() const;
     HelperConnection& getHelperConnection() { return helper; }
 
-    // Plugin lifecycle (via Helper)
+    // Plugin lifecycle
     void loadPlugin(const juce::String& pluginPath);
     void unloadPlugin();
-    void showPluginGui();
-    void hidePluginGui();
 
     bool isPluginLoaded() const { return pluginLoaded; }
     juce::String getLoadedPluginName() const { return pluginName; }
@@ -52,46 +55,73 @@ public:
     HelperConnection::State getConnectionState() const { return helper.getState(); }
     juce::String getLastPluginPath() const { return pluginPath; }
 
+    // In-process plugin instance (GUI only — null when plugin is unsafe)
+    juce::AudioPluginInstance* getInProcessPlugin() const { return inProcessPlugin.get(); }
+
     // Plugin list
     juce::Array<juce::File> getInstalledPluginFiles() const;
 
+    // Manufacturer name for a plugin file (reads moduleinfo.json for VST3, heuristic for AU)
+    // Fast — no plugin loading. Results cached in memory.
+    juce::String getPluginManufacturer(const juce::File& pluginFile) const;
+
     // Blocklist
     bool isBlocked(const juce::String& path) const;
     Blocklist& getBlocklist() { return blocklist; }
 
+    // Safety DB
+    PluginSafetyDB& getSafetyDB() { return safetyDB; }
+    void startBackgroundScan();
+    void stopBackgroundScan();
+
     // Audio analysis (for MCP get_analysis)
     std::string getAnalysis() const { return analyser.getCompactAnalysis(); }
 
-    // Remote GUI info (from Helper via IPC)
-    juce::String getRemoteLayerPortName() const { return remoteLayerPortName; }
-    int getRemoteGuiWidth() const { return remoteGuiWidth; }
-    int getRemoteGuiHeight() const { return remoteGuiHeight; }
-
     // Callbacks for editor
+    std::function<void()> onPluginWillLoad;   // fired BEFORE old plugin/editor torn down
     std::function<void()> onPluginLoaded;
     std::function<void()> onPluginUnloaded;
-    std::function<void()> onGuiReady;
-    std::function<void(int, int)> onGuiResized;
     std::function<void(const juce::String&)> onLoadFailed;
+    std::function<void(const juce::String&, bool)> onScanProgress; // path, safe
 
 private:
+    void loadInProcessPlugin(const juce::String& path);
+    void unloadInProcessPlugin();
+
+    // Spawns Helper with --scan <path>, waits up to 10s, returns true if safe.
+    // Safe to call from any thread. Never crashes Ableton on plugin crash.
+    bool runPluginScan(const juce::String& path);
+
+    // AudioProcessorListener — forwards in-process param changes to Helper
+    void audioProcessorParameterChanged(juce::AudioProcessor*, int paramIdx, float value) override;
+    void audioProcessorChanged(juce::AudioProcessor*, const ChangeDetails&) override {}
+
     HelperConnection helper;
     std::unique_ptr<McpServer> mcpServer;
-    Blocklist blocklist;
+    Blocklist    blocklist;
+    PluginSafetyDB safetyDB;
     AudioAnalyser analyser;
 
+    // In-process plugin (GUI instance — nullptr for unsafe plugins)
+    juce::AudioPluginFormatManager inProcessFormatManager;
+    std::unique_ptr<juce::AudioPluginInstance> inProcessPlugin;
+    std::atomic<bool> suppressParamSync{false};
+
     bool pluginLoaded = false;
     juce::String pluginName;
     juce::String pluginPath;
     int pluginParamCount = 0;
 
-    // Remote GUI state
-    juce::String remoteLayerPortName;
-    int remoteGuiWidth = 0;
-    int remoteGuiHeight = 0;
-
     double currentSampleRate = 44100.0;
     int currentBlockSize = 512;
 
+    // Background scanner
+    std::thread scanThread;
+    std::atomic<bool> scanRunning{false};
+
+    // Manufacturer name cache (path → manufacturer)
+    mutable std::map<std::string, std::string> manufacturerCache;
+    mutable std::mutex manufacturerCacheMutex;
+
     JUCE_DECLARE_NON_COPYABLE_WITH_LEAK_DETECTOR(PluginBridgeProcessor)
 };