# Free4AllHub music studio, based on BeepBox 4.2.2

Mature upstream app by John Nesky and contributors. Original core and the bundled imperative-html dependency are MIT; full notices are included, with conservative SFXR filter attribution. This is not miniPaint and contains no miniPaint code. Visitor compositions retain their own rights.

The pinned official BeepBox release ZIP digest is verified by build-music.py. Its unminified prebuilt editor is adapted without installing or executing a build toolchain. All 49 upstream source-map files and both imperative-html sources were independently matched to the pinned release/package. This is source-map provenance, not proof that a new compiler run produces identical bytes.

## Local-only changes

An opaque-origin iframe runs the editor with scripts and downloads only. It cannot read the Hub origin's browser storage or parent document. App storage references are replaced with two private in-memory maps, and song URL/history mode is disabled. Remote fonts, root-scoped service workers, URL shortening/sharing/player menus, MP3 loader and MIDI permission requests are removed. WAV, JSON and MIDI exports remain. Imports are limited to BeepBox JSON (2 MB maximum), parsed into a temporary song before active work is replaced; MIDI import is removed. Visible inline errors replace blocked sandbox alerts. No microphone/camera, account, API or upload backend is used.

The child CSP permits only its exact script hash plus unsafe-eval needed by upstream's generated synthesis functions. It denies connect requests, remote fonts, workers, nested frames and form submissions. The broader Hub does not receive unsafe-eval. Browser sandbox/CSP are defenses, not a comprehensive security audit. The application payload is inert encoded data outside the sandbox, not a directly navigable unsandboxed app.

Closing/reloading loses the song, settings and undo history. Export editable JSON and reopen it to confirm. WAV is rendered sound, not an editable project. Browser memory limits can occur below any nominal song capacity. Start small. Only use music you have rights to use.

## Build and source

In the containing Hub checkout, run python scripts/build-music.py. The source ZIP includes original release, pinned upstream source, notices, adapter, wrapper and build script. To rebuild independently, put this ZIP's files under music-studio/ in a new folder, move scripts/build-music.py to that folder's scripts/ directory, then run it. No Node/npm install is necessary. The output is dist/tools/music/.

patch-manifest.json records exact upstream identity and bounded string patches with match-count assertions. The build stops if the pinned artifact differs. All changes are delivered as source. Free4AllHub's original adapter/wrapper/build code is MIT under the notice appended to THIRD-PARTY-NOTICES.txt.

## Verification

Static qualification is in UPSTREAM-REVIEW.md. Actual workflow checks, independent review, test counts and limitations are recorded in the containing Hub release and verification/music/. No physical-mobile, screen-reader, beginner, maximum-memory or comprehensive security validation is claimed. No exact parity with FL Studio, general DAW replacement or realized savings is claimed.

## Upstream reference archive warning

The original, unmodified release/source archives are supplied for provenance and modification. Their HTML pages retain upstream remote fonts, sharing widgets, service workers and other original network features. Do not deploy those reference pages as the local edition. Only built dist/tools/music is hardened.

A one-way export bridge accepts at most 100 MB of JSON/WAV/MIDI data only from this exact opaque iframe. It validates MIME type, extension, source window and opaque origin, sanitizes the filename, and creates a user-clicked download link. It never evaluates exported content or uploads it. The next export replaces the prior link.

## Checked workflow, 7 November 2026

Cloud Chromium desktop: composed four notes, downloaded JSON, reopened it in a fresh tab and exported semantically identical JSON. Changed the instrument and exported again with every pattern retained. Invalid JSON was visibly rejected and the next export remained byte-identical. Actual default/supersaw and picked-string WAV downloads decoded as 48 kHz, stereo, 16-bit PCM with nonzero samples. Playback UI was checked for FM and picked-string sounds; listening quality is not claimed. 31 independent adapter/static tests and 97 aggregate Hub tests passed.

The wrapper's JSON chooser is enabled only after the isolated editor signals readiness. New invalid selections cancel pending older imports. The same temporary-song validator handles both upstream and wrapper imports. No complete runtime network capture was available; the network statement rests on source inspection and enforced sandbox/CSP, not packet-level certification. Instrument clipboard shortcuts may be unavailable in the sandbox; use JSON song downloads.