FX engine overhaul (4.7.0)

.github/workflows/ci.yml

@@ -36,7 +36,9 @@ jobs:
           cd App/Loopbacker
           swift build -c release
 
+      # Release: the factory-preset matrix runs 51 voice-chain passes and is skipped in
+      # unoptimized builds. Swift's bounds and overflow checks stay on at -O.
       - name: Test Swift app
         run: |
           cd App/Loopbacker
-          swift test
+          swift test -c release

.github/workflows/codeql.yml

@@ -0,0 +1,73 @@
+# Replaces GitHub's default CodeQL setup. Default setup builds Swift with an unbounded
+# `swift build` under Rosetta; since the app links ~1,500 vendored C/C++ files that build
+# wedged the macOS runner (3 runs, none finished). It also can't skip vendored code.
+# Categories match the old default setup so existing alerts and dismissals carry over.
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "17 6 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            runner: ubuntu-latest
+            build-mode: none
+          - language: python
+            runner: ubuntu-latest
+            build-mode: none
+          - language: c-cpp
+            runner: ubuntu-latest
+            build-mode: none
+          - language: swift
+            runner: macos-26
+            build-mode: manual
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config: |
+            paths-ignore:
+              - App/Loopbacker/CAirwindows
+              - App/Loopbacker/CRNNoise
+              - App/Loopbacker/CWebRTCAEC
+              - App/Loopbacker/CYSFX
+
+      # Fewer parallel compiles than the default, to keep the Rosetta-traced build light.
+      - name: Build Swift app
+        if: matrix.language == 'swift'
+        working-directory: App/Loopbacker
+        run: swift build -j 2
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/release.yml

@@ -57,10 +57,15 @@ jobs:
           cmake -B build -DCMAKE_BUILD_TYPE=Release
           cmake --build build
 
+      # The const-values flags feed scripts/extract-app-intents.sh (Shortcuts metadata); the
+      # native build system doesn't emit them on its own.
       - name: Build Swift app
         run: |
           cd App/Loopbacker
-          swift build -c release
+          swift build -c release \
+            -Xswiftc -emit-const-values-path -Xswiftc "$RUNNER_TEMP/Loopbacker.swiftconstvalues" \
+            -Xswiftc -Xfrontend -Xswiftc -const-gather-protocols-file \
+            -Xswiftc -Xfrontend -Xswiftc "$GITHUB_WORKSPACE/scripts/app-intents-const-protocols.json"
 
       # ── Package .app bundle ──────────────────────────────────────
       - name: Create .app bundle
@@ -77,12 +82,18 @@ jobs:
           cp App/Loopbacker/Resources/DPDFNet-LICENSE.txt Loopbacker.app/Contents/Resources/
           cp App/Loopbacker/Resources/RNNoise-LICENSE.txt Loopbacker.app/Contents/Resources/
           cp App/Loopbacker/Resources/FastEnhancer-LICENSE.txt Loopbacker.app/Contents/Resources/
+          cp App/Loopbacker/Resources/Airwindows-LICENSE.txt Loopbacker.app/Contents/Resources/
+          cp App/Loopbacker/Resources/YSFX-LICENSE.txt Loopbacker.app/Contents/Resources/
+          cp App/Loopbacker/Resources/WDL-LICENSE.txt Loopbacker.app/Contents/Resources/
+          cp App/Loopbacker/CWebRTCAEC/LICENSE-webrtc-audio-processing.txt Loopbacker.app/Contents/Resources/
+          cp App/Loopbacker/CWebRTCAEC/LICENSE-abseil.txt Loopbacker.app/Contents/Resources/
           cp -R Driver/build/Loopbacker.driver          Loopbacker.app/Contents/Resources/
           cp -R App/Loopbacker/.build/artifacts/sparkle/Sparkle/Sparkle.xcframework/macos-arm64_x86_64/Sparkle.framework \
             Loopbacker.app/Contents/Frameworks/
           xcrun actool App/Loopbacker/Resources/Assets.xcassets --compile Loopbacker.app/Contents/Resources \
             --platform macosx --minimum-deployment-target 26.0 --accent-color AccentColor \
             --output-partial-info-plist "$RUNNER_TEMP/assets-partial.plist" >/dev/null
+          LB_CONST_VALUES="$RUNNER_TEMP/Loopbacker.swiftconstvalues" scripts/extract-app-intents.sh Loopbacker.app
 
       # ── Code Signing ─────────────────────────────────────────────
       - name: Import signing certificate
@@ -120,13 +131,14 @@ jobs:
       - name: Code sign (Developer ID)
         if: steps.secrets.outputs.has_cert == 'true'
         run: |
-          codesign --force --options runtime \
+          codesign --force --options runtime --timestamp \
             --sign "$SIGNING_IDENTITY" \
             Loopbacker.app/Contents/Resources/Loopbacker.driver
 
           scripts/sign-sparkle.sh Loopbacker.app "$SIGNING_IDENTITY" --hardened
 
-          codesign --force --options runtime \
+          codesign --force --options runtime --timestamp \
+            --entitlements App/Loopbacker/Resources/Loopbacker.entitlements \
             --sign "$SIGNING_IDENTITY" \
             Loopbacker.app
 
@@ -137,7 +149,9 @@ jobs:
           codesign --force --sign - \
             Loopbacker.app/Contents/Resources/Loopbacker.driver
           scripts/sign-sparkle.sh Loopbacker.app -
-          codesign --force --sign - \
+          codesign --force --options runtime \
+            --entitlements App/Loopbacker/Resources/Loopbacker.entitlements \
+            --sign - \
             Loopbacker.app
 
       # ── Notarization ─────────────────────────────────────────────

.gitignore

@@ -36,3 +36,6 @@ DerivedData/
 .vscode/
 *.swp
 *~
+
+# Vendored abseil keeps headers in internal/ directories; never let a global ignore drop them.
+!App/Loopbacker/CWebRTCAEC/**/internal/

AGENTS.md

@@ -7,9 +7,11 @@ audio path, and `PRODUCT.md` / `DESIGN.md` before touching UI.
 ## Build and test
 
 ```bash
-make bundle                            # driver + app → build/Loopbacker.app
-cd App/Loopbacker && swift test        # DSP tests (noise suppression, meters); CI runs these
+make bundle                                    # driver + app → build/Loopbacker.app
+cd App/Loopbacker && swift test                # fast; skips the factory-preset matrix
+cd App/Loopbacker && swift test -c release     # everything; what CI runs
 cd App/Loopbacker && swift build -c release
+LOOPBACKER_RENDER_SNAPSHOTS=1 swift test --filter EffectsRenderTests  # Effects page PNGs in /tmp
 ```
 
 - Code that runs in a CoreAudio IO callback must not allocate, lock, call Objective-C, or block.