diff --git a/packages/cli/src/commands/preview.ts b/packages/cli/src/commands/preview.ts
index 1c297427f4..f432c44988 100644
--- a/packages/cli/src/commands/preview.ts
+++ b/packages/cli/src/commands/preview.ts
@@ -70,6 +70,7 @@ import {
   stopBackgroundPreview,
 } from "./previewLifecycle.js";
 import { resolveLocalBrowserGpuMode, type BrowserGpuMode } from "../browser/gpuPolicy.js";
+import { stopVstSidecar } from "../vst/sidecar.js";
 
 interface BrowserLaunchOptions {
   noOpen?: boolean;
@@ -896,6 +897,11 @@ function removeSymlinkOnExit(createdSymlink: boolean, symlinkPath: string): void
 function registerChildTreeShutdown(child: StudioChildProcess): void {
   const shutdown = (): void => {
     if (child.pid) killProcessTree(child.pid);
+    // The VST sidecar (packages/cli/src/vst/sidecar.ts) is started lazily by
+    // the studio's API route, not spawned here — but whichever mode ends up
+    // starting it, Ctrl-C during this preview session must still tear it
+    // down. Safe no-op if no sidecar is running.
+    stopVstSidecar();
   };
   process.once("SIGINT", shutdown);
   process.once("SIGTERM", shutdown);
@@ -1150,6 +1156,11 @@ async function runEmbeddedMode(
         const { closeThumbnailBrowser } = await import("../server/studioServer.js");
         const { drainBrowserPool, killTrackedProcesses } = await import("@hyperframes/engine");
         killTrackedProcesses();
+        // Embedded mode has no StudioChildProcess to hand to
+        // registerChildTreeShutdown (it runs an in-process Hono server, not
+        // a spawned child) — so the VST sidecar, if the API route started
+        // one during this session, is torn down directly here instead.
+        stopVstSidecar();
         await closeThumbnailBrowser().catch(() => {});
         await drainBrowserPool().catch(() => {});
       };
@@ -1169,7 +1180,10 @@ async function runEmbeddedMode(
     import("@hyperframes/engine")
       .then(({ killTrackedProcesses }) => {
         process.once("exit", () => {
-          if (!shuttingDown) killTrackedProcesses();
+          if (!shuttingDown) {
+            killTrackedProcesses();
+            stopVstSidecar();
+          }
         });
       })
       .catch(() => {});
diff --git a/packages/cli/src/server/studioServer.ts b/packages/cli/src/server/studioServer.ts
index e9d50f3cf3..afcbf1c56d 100644
--- a/packages/cli/src/server/studioServer.ts
+++ b/packages/cli/src/server/studioServer.ts
@@ -34,6 +34,10 @@ import {
 import { resolveAutoProxy } from "../utils/projectConfig.js";
 import { getElementScreenshotClip } from "@hyperframes/studio-server/screenshot-clip";
 import type { ScreenshotClip } from "@hyperframes/studio-server/screenshot-clip";
+import {
+  getVstSidecar as getVstSidecarSync,
+  startVstSidecar,
+} from "@hyperframes/studio-server/vst-sidecar";
 import type { RenderJob } from "@hyperframes/producer";
 import { seekCompositionTimeline } from "../capture/captureCompositionFrame.js";
 import {
@@ -647,6 +651,16 @@ export function createStudioServer(options: StudioServerOptions): StudioServer {
       });
       return { written: relativePaths, block: item };
     },
+
+    startVstSidecar: async () => {
+      const { port, token } = await startVstSidecar();
+      return { port, token };
+    },
+
+    getVstSidecarStatus: () => {
+      const running = getVstSidecarSync();
+      return running ? { running: true, port: running.port } : { running: false, port: null };
+    },
   };
 
   // ── Build the Hono app ─────────────────────────────────────────────────
diff --git a/packages/cli/src/vst/sidecar.ts b/packages/cli/src/vst/sidecar.ts
new file mode 100644
index 0000000000..41f52ada1c
--- /dev/null
+++ b/packages/cli/src/vst/sidecar.ts
@@ -0,0 +1,14 @@
+/**
+ * Re-export of the VST host sidecar lifecycle, relocated to
+ * `packages/studio-server/src/vstSidecar.ts` so both the CLI's embedded
+ * studio server and the Studio Vite dev server can import it without
+ * duplicating the resolver + spawn logic (studio-server has no dependency
+ * that module doesn't already need — only `node:child_process`/`node:fs`/
+ * `node:path` — and the CLI already depends on `@hyperframes/studio-server`,
+ * so this direction adds no new dependency edge).
+ *
+ * Kept as a thin re-export (rather than updating every CLI import site) so
+ * `hyperframes preview`'s existing `import { stopVstSidecar } from
+ * "../vst/sidecar.js"` continues to work unchanged.
+ */
+export * from "@hyperframes/studio-server/vst-sidecar";
diff --git a/packages/studio-server/package-subpaths.json b/packages/studio-server/package-subpaths.json
index 9157d4c1cb..a1b970cf9a 100644
--- a/packages/studio-server/package-subpaths.json
+++ b/packages/studio-server/package-subpaths.json
@@ -67,6 +67,12 @@
       "runtime": "./dist/helpers/mediaProxyPreview.js",
       "types": "./dist/helpers/mediaProxyPreview.d.ts",
       "environments": ["bun", "node"]
+    },
+    "./vst-sidecar": {
+      "source": "./src/vstSidecar.ts",
+      "runtime": "./dist/vstSidecar.js",
+      "types": "./dist/vstSidecar.d.ts",
+      "environments": ["bun", "node"]
     }
   }
 }
diff --git a/packages/studio-server/package.json b/packages/studio-server/package.json
index 0216de4ab7..8f8cc4ab73 100644
--- a/packages/studio-server/package.json
+++ b/packages/studio-server/package.json
@@ -74,6 +74,12 @@
       "node": "./dist/helpers/mediaProxyPreview.js",
       "import": "./src/helpers/mediaProxyPreview.ts",
       "types": "./src/helpers/mediaProxyPreview.ts"
+    },
+    "./vst-sidecar": {
+      "bun": "./src/vstSidecar.ts",
+      "node": "./dist/vstSidecar.js",
+      "import": "./src/vstSidecar.ts",
+      "types": "./src/vstSidecar.ts"
     }
   },
   "publishConfig": {
@@ -119,6 +125,10 @@
       "./media-proxy-preview": {
         "import": "./dist/helpers/mediaProxyPreview.js",
         "types": "./dist/helpers/mediaProxyPreview.d.ts"
+      },
+      "./vst-sidecar": {
+        "import": "./dist/vstSidecar.js",
+        "types": "./dist/vstSidecar.d.ts"
       }
     },
     "main": "./dist/index.js",
diff --git a/packages/studio-server/src/createStudioApi.ts b/packages/studio-server/src/createStudioApi.ts
index 5976ced33a..eb4638eaad 100644
--- a/packages/studio-server/src/createStudioApi.ts
+++ b/packages/studio-server/src/createStudioApi.ts
@@ -13,6 +13,7 @@ import { registerRegistryRoutes } from "./routes/registry.js";
 import { registerSelectionRoutes } from "./routes/selection.js";
 import { registerMediaRoutes } from "./routes/media.js";
 import { registerGlobalAssetRoutes } from "./routes/globalAssets.js";
+import { registerVstRoutes } from "./routes/vst.js";
 
 /**
  * Create a Hono sub-app with all studio API routes.
@@ -36,6 +37,7 @@ export function createStudioApi(adapter: StudioApiAdapter): Hono {
   registerFontRoutes(api);
   registerRegistryRoutes(api, adapter);
   registerGlobalAssetRoutes(api);
+  registerVstRoutes(api, adapter);
 
   return api;
 }
diff --git a/packages/studio-server/src/routes/vst.test.ts b/packages/studio-server/src/routes/vst.test.ts
new file mode 100644
index 0000000000..e082188421
--- /dev/null
+++ b/packages/studio-server/src/routes/vst.test.ts
@@ -0,0 +1,124 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { Hono } from "hono";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { registerVstRoutes } from "./vst";
+
+function makeApi(adapter: Record<string, unknown>): Hono {
+  const api = new Hono();
+  registerVstRoutes(api, adapter as never);
+  return api;
+}
+
+const tempDirs: string[] = [];
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+function createProjectDir(): string {
+  const projectDir = mkdtempSync(join(tmpdir(), "hf-vst-test-"));
+  tempDirs.push(projectDir);
+  return projectDir;
+}
+
+afterEach(() => {
+  delete process.env.HF_VST_HOST_CMD;
+});
+
+/** Points HF_VST_HOST_CMD at a fake sidecar shell script for the duration of a test. */
+function installFakeVstHost(projectDir: string, scriptBody: string): void {
+  const script = join(projectDir, "fake-vst.sh");
+  writeFileSync(script, scriptBody);
+  chmodSync(script, 0o755);
+  process.env.HF_VST_HOST_CMD = script;
+}
+
+function postCarve(api: Hono, body: Record<string, unknown>): Promise<Response> {
+  return api.request("/vst/carve", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+/** Builds an API that resolves `projectId: "p1"` to `projectDir` and POSTs
+ *  `/vst/carve` against it — the shared shape every carve test below needs. */
+function carveViaProjectDir(projectDir: string, body: Record<string, unknown>): Promise<Response> {
+  const api = makeApi({ resolveProject: () => Promise.resolve({ dir: projectDir }) });
+  return postCarve(api, { projectId: "p1", ...body });
+}
+
+describe("vst routes", () => {
+  it("POST /vst/start returns the sidecar port and token", async () => {
+    const api = makeApi({
+      startVstSidecar: () => Promise.resolve({ port: 9555, token: "secret-token" }),
+      getVstSidecarStatus: () => ({ running: true, port: 9555 }),
+    });
+    const res = await api.request("/vst/start", { method: "POST" });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ port: 9555, token: "secret-token" });
+  });
+
+  it("POST /vst/start returns 503 with install hint when unsupported", async () => {
+    const api = makeApi({});
+    const res = await api.request("/vst/start", { method: "POST" });
+    expect(res.status).toBe(503);
+    const body = await res.json();
+    expect(body.installHint).toContain("uv tool install");
+  });
+
+  it("GET /vst/status reflects adapter state", async () => {
+    const api = makeApi({ getVstSidecarStatus: () => ({ running: false, port: null }) });
+    const res = await api.request("/vst/status");
+    expect(await res.json()).toEqual({ running: false, port: null });
+  });
+
+  it("POST /vst/carve returns bands from the sidecar", async () => {
+    const projectDir = createProjectDir();
+    mkdirSync(join(projectDir, "media"), { recursive: true });
+    writeFileSync(join(projectDir, "media/music.wav"), "RIFF");
+    writeFileSync(join(projectDir, "media/vo.wav"), "RIFF");
+    // Fake sidecar: print a fixed bands payload for `carve`.
+    installFakeVstHost(
+      projectDir,
+      `#!/bin/sh\necho '{"bands":[{"freq":1000,"gainDb":-4,"q":1.5},{"freq":2500,"gainDb":-2,"q":1.5}]}'\n`,
+    );
+
+    const res = await carveViaProjectDir(projectDir, {
+      musicPath: "media/music.wav",
+      voicePath: "media/vo.wav",
+      maxCutDb: 4,
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.bands).toHaveLength(2);
+    expect(body.bands[0]).toEqual({ freq: 1000, gainDb: -4, q: 1.5 });
+  });
+
+  it("POST /vst/carve 404s when a track file is missing", async () => {
+    const projectDir = createProjectDir();
+    const res = await carveViaProjectDir(projectDir, {
+      musicPath: "media/nope.wav",
+      voicePath: "media/nope.wav",
+      maxCutDb: 4,
+    });
+    expect(res.status).toBe(404);
+  });
+
+  it("POST /vst/carve 500s when the sidecar fails", async () => {
+    const projectDir = createProjectDir();
+    mkdirSync(join(projectDir, "media"), { recursive: true });
+    writeFileSync(join(projectDir, "media/vo.wav"), "RIFF");
+    installFakeVstHost(projectDir, `#!/bin/sh\necho "boom" >&2; exit 1\n`);
+    const res = await carveViaProjectDir(projectDir, {
+      musicPath: "media/vo.wav",
+      voicePath: "media/vo.wav",
+      maxCutDb: 4,
+    });
+    expect(res.status).toBe(500);
+  });
+});
diff --git a/packages/studio-server/src/routes/vst.ts b/packages/studio-server/src/routes/vst.ts
new file mode 100644
index 0000000000..ddecbf92f1
--- /dev/null
+++ b/packages/studio-server/src/routes/vst.ts
@@ -0,0 +1,115 @@
+import type { Hono } from "hono";
+import { existsSync } from "node:fs";
+import type { StudioApiAdapter } from "../types.js";
+import { resolveWithinProject } from "../helpers/safePath.js";
+import { runCarve } from "../vstCarve.js";
+
+const INSTALL_HINT = "Install the VST host: uv tool install hyperframes-vst-host (requires uv)";
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null;
+}
+
+interface CarveRequestBody {
+  projectId: string;
+  musicPath: string;
+  voicePath: string;
+  maxCutDb: number;
+}
+
+/** Narrows an unknown JSON body to the shape `/vst/carve` needs, or `null` if malformed. */
+function parseCarveRequestBody(body: unknown): CarveRequestBody | null {
+  if (!isRecord(body)) return null;
+  const { projectId, musicPath, voicePath, maxCutDb } = body;
+  if (
+    typeof projectId !== "string" ||
+    typeof musicPath !== "string" ||
+    typeof voicePath !== "string" ||
+    typeof maxCutDb !== "number"
+  ) {
+    return null;
+  }
+  return { projectId, musicPath, voicePath, maxCutDb };
+}
+
+/** Resolves a project-relative path and confirms the file exists on disk, or `null`. */
+function resolveExistingProjectFile(projectDir: string, subPath: string): string | null {
+  const file = resolveWithinProject(projectDir, subPath);
+  return file && existsSync(file) ? file : null;
+}
+
+export function registerVstRoutes(api: Hono, adapter: StudioApiAdapter): void {
+  /**
+   * The VST sidecar is a native Python process on the same host as this
+   * server — it reads audio via pedalboard's `AudioFile`, which needs a
+   * real filesystem path, not the `/preview/*` HTTP URL the browser plays
+   * the dry `<audio>` element from. This resolves a project-relative asset
+   * path (the part of that URL after `/preview/`) to its absolute path on
+   * disk, the same way the `/preview/*` static route does, so a client that
+   * already has a working playback URL can hand the sidecar something it
+   * can actually open.
+   */
+  api.get("/vst/wav-path", async (c) => {
+    const projectId = c.req.query("projectId");
+    const subPath = c.req.query("path");
+    if (!projectId || !subPath) {
+      return c.json({ error: "projectId and path query params required" }, 400);
+    }
+    const project = await adapter.resolveProject(projectId);
+    if (!project) return c.json({ error: "not found" }, 404);
+    const file = resolveWithinProject(project.dir, subPath);
+    if (!file || !existsSync(file)) return c.json({ error: "not found" }, 404);
+    return c.json({ path: file });
+  });
+
+  /**
+   * Analyze a voiceover track and return complementary PeakFilter carve bands
+   * for a music track (the "vocal pocket"). Both paths are project-relative,
+   * resolved against the project dir here so no absolute paths cross the
+   * wire. V1 only analyzes the voice; the music path is validated-to-exist
+   * for symmetry and future dynamic ducking.
+   */
+  api.post("/vst/carve", async (c) => {
+    const body: unknown = await c.req.json().catch(() => null);
+    const parsed = parseCarveRequestBody(body);
+    if (!parsed) {
+      return c.json({ error: "projectId, musicPath, voicePath, maxCutDb required" }, 400);
+    }
+    const { projectId, musicPath, voicePath, maxCutDb } = parsed;
+    const project = await adapter.resolveProject(projectId);
+    if (!project) return c.json({ error: "not found" }, 404);
+    const musicFile = resolveExistingProjectFile(project.dir, musicPath);
+    const voiceFile = resolveExistingProjectFile(project.dir, voicePath);
+    if (!musicFile || !voiceFile) return c.json({ error: "not found" }, 404);
+    try {
+      const { bands } = await runCarve(voiceFile, maxCutDb);
+      return c.json({ bands });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return c.json({ error: message }, 500);
+    }
+  });
+
+  api.post("/vst/start", async (c) => {
+    if (!adapter.startVstSidecar) {
+      return c.json(
+        { error: "VST host not available in this studio mode", installHint: INSTALL_HINT },
+        503,
+      );
+    }
+    try {
+      const { port, token } = await adapter.startVstSidecar();
+      return c.json({ port, token });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return c.json({ error: message, installHint: INSTALL_HINT }, 503);
+    }
+  });
+
+  api.get("/vst/status", (c) => {
+    if (!adapter.getVstSidecarStatus) {
+      return c.json({ running: false, port: null });
+    }
+    return c.json(adapter.getVstSidecarStatus());
+  });
+}
diff --git a/packages/studio-server/src/types.ts b/packages/studio-server/src/types.ts
index f9223ece09..cd2e574068 100644
--- a/packages/studio-server/src/types.ts
+++ b/packages/studio-server/src/types.ts
@@ -203,4 +203,22 @@ export interface StudioApiAdapter {
     project: ResolvedProject;
     blockName: string;
   }): Promise<{ written: string[]; block: RegistryItem }>;
+
+  /**
+   * Optional: start the VST host sidecar and return its bound port + the
+   * shared-secret token the sidecar generated for this run (see
+   * `hyperframes_vst/server.py`'s `_authenticate` in the
+   * `heygen-com/hyperframes-vst-host` repo).
+   * Absent means VST plugin hosting isn't supported in this studio mode. The
+   * browser connects directly to `ws://localhost:<port>/?token=<token>` —
+   * both are simply relayed back to the client, not proxied. The token
+   * prevents any other local process/webpage that might guess or scan the
+   * ephemeral port from also driving the sidecar (native plugin loading is
+   * inherently native code execution; chain loading also reads arbitrary
+   * files off disk).
+   */
+  startVstSidecar?: () => Promise<{ port: number; token: string }>;
+
+  /** Optional: current VST sidecar status. Absent implies not running. */
+  getVstSidecarStatus?: () => { running: boolean; port: number | null };
 }
diff --git a/packages/studio-server/src/vstCarve.ts b/packages/studio-server/src/vstCarve.ts
new file mode 100644
index 0000000000..50bfe2c7ba
--- /dev/null
+++ b/packages/studio-server/src/vstCarve.ts
@@ -0,0 +1,74 @@
+/**
+ * Spawns the `hyperframes-vst carve` verb to analyze a voiceover WAV and
+ * returns its recommended PeakFilter carve bands. Mirrors the engine's
+ * `vstBounce.ts` spawn/error handling; DSP stays entirely in the GPL sidecar.
+ */
+import { spawn } from "node:child_process";
+import { resolveVstHostCommand } from "./vstSidecar.js";
+
+export interface CarveBand {
+  freq: number;
+  gainDb: number;
+  q: number;
+}
+
+const CARVE_TIMEOUT_MS = 2 * 60 * 1000;
+
+export function runCarve(
+  voiceWavAbsPath: string,
+  maxCutDb: number,
+): Promise<{ bands: CarveBand[] }> {
+  const parts = resolveVstHostCommand();
+  const cmd = parts[0];
+  if (!cmd) return Promise.reject(new Error("no VST host command resolved"));
+  const args = [
+    ...parts.slice(1),
+    "carve",
+    "--voice",
+    voiceWavAbsPath,
+    "--max-cut-db",
+    String(maxCutDb),
+    "--json",
+  ];
+
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(cmd, args);
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d: Buffer) => {
+      stdout += d.toString();
+    });
+    child.stderr.on("data", (d: Buffer) => {
+      stderr += d.toString();
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error("carve timed out"));
+    }, CARVE_TIMEOUT_MS);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(new Error(`VST sidecar could not be started: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code !== 0) {
+        reject(new Error(`carve failed (exit ${code}): ${stderr.trim()}`));
+        return;
+      }
+      try {
+        const parsed: unknown = JSON.parse(stdout);
+        if (
+          typeof parsed === "object" &&
+          parsed !== null &&
+          Array.isArray((parsed as { bands?: unknown }).bands)
+        ) {
+          resolvePromise(parsed as { bands: CarveBand[] });
+          return;
+        }
+        reject(new Error(`carve returned malformed JSON: ${stdout.trim()}`));
+      } catch {
+        reject(new Error(`carve returned invalid JSON: ${stdout.trim()}`));
+      }
+    });
+  });
+}
diff --git a/packages/studio-server/src/vstSidecar.test.ts b/packages/studio-server/src/vstSidecar.test.ts
new file mode 100644
index 0000000000..c1bc7f1bbd
--- /dev/null
+++ b/packages/studio-server/src/vstSidecar.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getVstSidecar, startVstSidecar, stopVstSidecar, __resetForTests } from "./vstSidecar";
+
+afterEach(() => {
+  __resetForTests();
+  delete process.env.HF_VST_HOST_CMD;
+});
+
+function fakeServe(dir: string, lines: string): string {
+  const script = join(dir, "fake-serve.sh");
+  writeFileSync(script, `#!/bin/sh\n${lines}\n`);
+  chmodSync(script, 0o755);
+  return script;
+}
+
+/** Points HF_VST_HOST_CMD at a fake sidecar that reports ready immediately on the given port. */
+function useFakeReadySidecar(port: number): void {
+  const dir = mkdtempSync(join(tmpdir(), "vst-cli-"));
+  process.env.HF_VST_HOST_CMD = fakeServe(
+    dir,
+    `echo "VST-HOST-LISTENING port=${port} token=tok-${port}"; sleep 60`,
+  );
+}
+
+/**
+ * Polls for `path` to exist instead of a single fixed sleep — under CI
+ * contention a fixed wait (the previous approach here) can fire before a
+ * slow-to-schedule child process has actually written its PID file, flaking
+ * the test. Polls quickly (10ms) since the common case resolves almost
+ * immediately; `timeoutMs` is a generous ceiling, not the expected wait.
+ */
+async function waitForFile(path: string, timeoutMs = 2000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return;
+    await new Promise((r) => setTimeout(r, 10));
+  }
+  throw new Error(`Timed out waiting for ${path} to appear`);
+}
+
+describe("startVstSidecar", () => {
+  it("resolves the announced port", async () => {
+    useFakeReadySidecar(9555);
+    const { port, stop } = await startVstSidecar();
+    expect(port).toBe(9555);
+    expect(getVstSidecar()?.port).toBe(9555);
+    stop();
+  });
+
+  it("resolves the announced token alongside the port", async () => {
+    useFakeReadySidecar(9560);
+    const { token, stop } = await startVstSidecar();
+    expect(token).toBe("tok-9560");
+    stop();
+  });
+
+  it("is a singleton while running", async () => {
+    useFakeReadySidecar(9556);
+    const a = await startVstSidecar();
+    const b = await startVstSidecar();
+    expect(b.port).toBe(a.port);
+    expect(b.token).toBe(a.token);
+    a.stop();
+  });
+
+  it("rejects with install hint when command is missing", async () => {
+    process.env.HF_VST_HOST_CMD = "/definitely/not/here";
+    await expect(startVstSidecar()).rejects.toThrow(/uv tool install hyperframes-vst-host/);
+  });
+
+  it("does not double-spawn when called concurrently before readiness", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "vst-cli-"));
+    const spawnLog = join(dir, "spawns.log");
+    process.env.HF_VST_HOST_CMD = fakeServe(
+      dir,
+      `echo spawned >> "${spawnLog}"\nsleep 0.2\necho "VST-HOST-LISTENING port=9557 token=tok-9557"\nsleep 60`,
+    );
+
+    const p1 = startVstSidecar();
+    const p2 = startVstSidecar();
+    const [a, b] = await Promise.all([p1, p2]);
+
+    expect(a.port).toBe(9557);
+    expect(b.port).toBe(9557);
+
+    const spawnCount = readFileSync(spawnLog, "utf8").trim().split("\n").filter(Boolean).length;
+    expect(spawnCount).toBe(1);
+
+    a.stop();
+  });
+
+  it("recovers after a failed spawn attempt so a later call can succeed", async () => {
+    process.env.HF_VST_HOST_CMD = "/definitely/not/here-again";
+    await expect(startVstSidecar()).rejects.toThrow(/uv tool install hyperframes-vst-host/);
+
+    useFakeReadySidecar(9559);
+    const { port, stop } = await startVstSidecar();
+    expect(port).toBe(9559);
+    stop();
+  });
+});
+
+describe("stopVstSidecar", () => {
+  it("kills a sidecar that is still mid-spawn, before the ready handshake arrives", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "vst-cli-"));
+    const pidFile = join(dir, "child.pid");
+    // Writes its own PID immediately, then simulates a slow real-world boot
+    // (a real `uv run ... hyperframes-vst serve` can take over a second)
+    // before ever printing the ready line.
+    process.env.HF_VST_HOST_CMD = fakeServe(
+      dir,
+      `echo $$ > "${pidFile}"\nsleep 1\necho "VST-HOST-LISTENING port=9558 token=tok-9558"\nsleep 60`,
+    );
+
+    const startPromise = startVstSidecar();
+    // This attempt is expected to be killed out from under it and reject;
+    // swallow here so an unhandled-rejection warning doesn't fire before we
+    // assert on it below.
+    startPromise.catch(() => {});
+
+    // Wait for the child to actually spawn and record its PID (rather than a
+    // fixed sleep, which flakes under CI contention if scheduling the child
+    // process takes longer than expected) — well inside the fake sidecar's
+    // 1s boot delay, so stopVstSidecar() genuinely races the ready handshake
+    // rather than the test's own timing.
+    await waitForFile(pidFile);
+    const pid = Number(readFileSync(pidFile, "utf8").trim());
+    expect(() => process.kill(pid, 0)).not.toThrow();
+
+    stopVstSidecar();
+
+    // Poll until the killed child actually exits.
+    const deadline = Date.now() + 2000;
+    let alive = true;
+    while (Date.now() < deadline) {
+      try {
+        process.kill(pid, 0);
+        await new Promise((r) => setTimeout(r, 50));
+      } catch {
+        alive = false;
+        break;
+      }
+    }
+    expect(alive).toBe(false);
+
+    // The in-flight attempt settles (rejects) once its child is killed, and
+    // clears its bookkeeping so a subsequent startVstSidecar() call isn't
+    // stuck waiting on a dead attempt.
+    await expect(startPromise).rejects.toThrow();
+  }, 5000);
+});
diff --git a/packages/studio-server/src/vstSidecar.ts b/packages/studio-server/src/vstSidecar.ts
new file mode 100644
index 0000000000..3e0245f09b
--- /dev/null
+++ b/packages/studio-server/src/vstSidecar.ts
@@ -0,0 +1,200 @@
+/**
+ * Lifecycle for the VST host sidecar (`heygen-com/hyperframes-vst-host` on
+ * PyPI as `hyperframes-vst-host`), shared by both `hyperframes preview` (CLI,
+ * via `packages/cli/src/vst/sidecar.ts`'s re-export of this module) and the
+ * Studio Vite dev server. Spawns the sidecar's `serve` subcommand, waits for
+ * its ready handshake on stdout, and tracks the single running instance for
+ * the lifetime of this process. `hyperframes preview` registers the running
+ * child with the same signal-driven shutdown paths it uses for its own
+ * studio child processes so Ctrl-C during a preview session also tears the
+ * sidecar down.
+ */
+
+import { spawn, type ChildProcess } from "node:child_process";
+
+// Captures the shared-secret token the sidecar prints alongside its port
+// (see server.py's `_authenticate`/`start`) — required by every WS command,
+// so it must be relayed to the browser (via `/vst/start`'s response) rather
+// than just the port.
+const READY_RE = /VST-HOST-LISTENING port=(\d+) token=(\S+)/;
+const READY_TIMEOUT_MS = 30_000;
+const INSTALL_HINT = "Install the VST host: uv tool install hyperframes-vst-host (requires uv)";
+
+interface RunningSidecar {
+  port: number;
+  token: string;
+  child: ChildProcess;
+}
+
+let running: RunningSidecar | null = null;
+let pending: Promise<{ port: number; token: string; stop: () => void }> | null = null;
+/**
+ * The child process of an in-flight `startVstSidecar()` attempt, tracked from
+ * the moment `spawn()` returns until either the ready handshake arrives (at
+ * which point `running` takes over tracking) or the attempt fails/times out.
+ * Lets `stopVstSidecar()` kill a sidecar that's still booting — without this,
+ * a shutdown that races the ready handshake (e.g. Ctrl-C during a slow boot)
+ * would see `running === null` and leave the child orphaned.
+ */
+let spawningChild: ChildProcess | null = null;
+
+/**
+ * Resolves the command used to invoke the VST host sidecar.
+ *
+ * Precedence:
+ * 1. `HF_VST_HOST_CMD` env var (space-split) — lets CI/dev machines point at
+ *    an arbitrary executable (or, in tests, a fake shell script).
+ * 2. Bare `hyperframes-vst` on PATH (an installed/published sidecar — see
+ *    `uv tool install hyperframes-vst-host`).
+ *
+ * Duplicated from `@hyperframes/engine`'s `resolveVstHostCommand`
+ * (packages/engine/src/services/vstBounce.ts) — that package doesn't export
+ * it from its public entry point or a subpath, so this module carries its own
+ * copy. Exported for reuse by `vstCarve.ts`, which spawns the same sidecar's
+ * `carve` verb; `HF_VST_HOST_CMD` is the test seam (see vstSidecar.test.ts)
+ * for both call sites.
+ */
+export function resolveVstHostCommand(): string[] {
+  const override = process.env.HF_VST_HOST_CMD;
+  if (override && override.trim().length > 0) {
+    return override.trim().split(/\s+/);
+  }
+
+  return ["hyperframes-vst"];
+}
+
+/** Returns the running sidecar's port, or `null` if none is running. */
+export function getVstSidecar(): { port: number } | null {
+  return running ? { port: running.port } : null;
+}
+
+/**
+ * Kills the running sidecar, if any. Safe to call whether or not a sidecar
+ * is currently running — used by `hyperframes preview`'s shutdown paths so
+ * every launch mode tears the sidecar down without needing to know whether
+ * one was ever started.
+ *
+ * Also handles a sidecar that's still mid-spawn (a `startVstSidecar()` call
+ * in flight whose child hasn't announced its ready port yet): `running` is
+ * null in that window, so falls back to killing `spawningChild`.
+ */
+export function stopVstSidecar(): void {
+  if (running) {
+    stopSidecar(running.child);
+  } else if (spawningChild) {
+    stopSidecar(spawningChild);
+  }
+}
+
+/** Test-only: force-resets singleton state between test cases. */
+export function __resetForTests(): void {
+  if (running) {
+    running.child.kill();
+  }
+  if (spawningChild) {
+    spawningChild.kill();
+  }
+  running = null;
+  pending = null;
+  spawningChild = null;
+}
+
+/**
+ * Starts the VST host sidecar (`<resolved cmd> serve --port 0`) and resolves
+ * once it announces its bound port on stdout. Only one sidecar runs per host
+ * process — a second call while one is already running returns the same
+ * instance.
+ *
+ * Concurrent calls made before the FIRST call's child becomes ready share
+ * that same in-flight attempt via the module-level `pending` promise, rather
+ * than each spawning their own child: `running` is only assigned once the
+ * ready handshake arrives (inside `child.stdout`'s `data` handler), so
+ * without `pending` a second call arriving before that point would see
+ * `running === null` and spawn a second, orphaned child (TOCTOU race).
+ * `pending` is set synchronously — before any `await` or callback-based work
+ * — so every concurrent caller observes either `running` (already ready) or
+ * `pending` (in flight) and never falls through to a fresh `spawn()` call.
+ */
+export function startVstSidecar(): Promise<{ port: number; token: string; stop: () => void }> {
+  if (running) {
+    const current = running;
+    return Promise.resolve({
+      port: current.port,
+      token: current.token,
+      stop: () => stopSidecar(current.child),
+    });
+  }
+  if (pending) {
+    return pending;
+  }
+
+  const [cmd, ...baseArgs] = resolveVstHostCommand();
+  if (!cmd) {
+    return Promise.reject(new Error(`VST sidecar could not be started. ${INSTALL_HINT}`));
+  }
+
+  pending = new Promise<{ port: number; token: string; stop: () => void }>(
+    (resolvePromise, reject) => {
+      const child = spawn(cmd, [...baseArgs, "serve", "--port", "0"], {
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      spawningChild = child;
+      let settled = false;
+
+      const timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        if (spawningChild === child) spawningChild = null;
+        child.kill();
+        reject(new Error(`VST sidecar did not become ready in 30s. ${INSTALL_HINT}`));
+      }, READY_TIMEOUT_MS);
+
+      child.stdout?.on("data", (buf: Buffer) => {
+        if (settled) return;
+        const match = buf.toString().match(READY_RE);
+        const portGroup = match?.[1];
+        const tokenGroup = match?.[2];
+        if (!portGroup || !tokenGroup) return;
+        settled = true;
+        clearTimeout(timer);
+        const port = Number(portGroup);
+        running = { port, token: tokenGroup, child };
+        if (spawningChild === child) spawningChild = null;
+        resolvePromise({ port, token: tokenGroup, stop: () => stopSidecar(child) });
+      });
+
+      child.on("error", () => {
+        if (settled) return;
+        settled = true;
+        if (spawningChild === child) spawningChild = null;
+        clearTimeout(timer);
+        reject(new Error(`VST sidecar could not be started. ${INSTALL_HINT}`));
+      });
+
+      child.on("exit", () => {
+        if (running && running.child === child) {
+          running = null;
+        }
+        if (spawningChild === child) spawningChild = null;
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        reject(new Error(`VST sidecar exited before becoming ready. ${INSTALL_HINT}`));
+      });
+    },
+  ).finally(() => {
+    pending = null;
+  });
+
+  return pending;
+}
+
+function stopSidecar(child: ChildProcess): void {
+  child.kill();
+  if (running && running.child === child) {
+    running = null;
+  }
+  if (spawningChild === child) {
+    spawningChild = null;
+  }
+}
diff --git a/packages/studio-server/tsup.config.ts b/packages/studio-server/tsup.config.ts
index 0163629005..f5b9679548 100644
--- a/packages/studio-server/tsup.config.ts
+++ b/packages/studio-server/tsup.config.ts
@@ -12,6 +12,7 @@ export default defineConfig({
     "helpers/draftMarkers": "src/helpers/draftMarkers.ts",
     "helpers/finiteMutation": "src/helpers/finiteMutation.ts",
     "helpers/sourceMutation": "src/helpers/sourceMutation.ts",
+    vstSidecar: "src/vstSidecar.ts",
   },
   format: ["esm"],
   outDir: "dist",
diff --git a/packages/studio/vite.adapter.ts b/packages/studio/vite.adapter.ts
index 6bad725b75..49f24eaf2b 100644
--- a/packages/studio/vite.adapter.ts
+++ b/packages/studio/vite.adapter.ts
@@ -20,6 +20,10 @@ import {
   createBackgroundRemovalJob,
   createProjectSignature,
 } from "@hyperframes/studio-server";
+import {
+  getVstSidecar as getVstSidecarSync,
+  startVstSidecar,
+} from "@hyperframes/studio-server/vst-sidecar";
 import type { RegistryItem } from "@hyperframes/core/registry";
 import { createRetryingModuleLoader, ensureProducerDist } from "./vite.producer";
 import { createStudioDevRenderBodyScripts } from "./vite.studioMotion";
@@ -393,5 +397,15 @@ export function createViteAdapter(dataDir: string, server: ViteDevServer): Studi
 
       return { written, block };
     },
+
+    startVstSidecar: async () => {
+      const { port, token } = await startVstSidecar();
+      return { port, token };
+    },
+
+    getVstSidecarStatus: () => {
+      const running = getVstSidecarSync();
+      return running ? { running: true, port: running.port } : { running: false, port: null };
+    },
   };
 }