mixdog 0.9.147 → 0.9.148

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.147",
+  "version": "0.9.148",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -62,7 +62,7 @@
     "test:shellhardening": "npm run build:spawn:test && node --test scripts/suite-shellhardening-test.mjs scripts/suite-shell-direct-exe-test.mjs",
     "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs scripts/cursor-provider-test.mjs src/runtime/agent/orchestrator/providers/openai-codex-identity.test.mjs src/runtime/agent/orchestrator/providers/openai-ws-delta-parity.test.mjs",
     "test:embedding-runtime:warmup": "node scripts/verify-embedding-runtime.mjs --warmup",
-    "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --check scripts/prepare-native-assets.mjs && node --test scripts/release-gate-test.mjs scripts/prepare-native-assets-test.mjs",
+    "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --check scripts/prepare-native-assets.mjs && node --test scripts/release-gate-test.mjs scripts/prepare-native-assets-test.mjs scripts/generate-voice-runtime-manifest.test.mjs",
     "test:native-edit-wire": "node scripts/native-edit-wire-test.mjs",
     "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
     "test:spec-advisory": "node scripts/advisory-spec-test.mjs && npm run test:spec-advisory --prefix apps/desktop",
@@ -92,6 +92,10 @@
     "audit:models": "node scripts/model-catalog-audit.mjs",
     "patch:replay": "node scripts/patch-replay.mjs",
     "build:tui": "node scripts/build-tui.mjs",
+    "build:local": "npm run build:fast --prefix apps/desktop",
+    "deploy:local": "npm run update:dev:fast --prefix apps/desktop",
+    "deploy:vps": "pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File scripts/deploy-remote.ps1",
+    "deploy:fast": "pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File scripts/deploy-remote.ps1 -FastDirect",
     "release:patch": "gh workflow run deploy.yml --ref main -f bump=patch -f native=auto",
     "release:minor": "gh workflow run deploy.yml --ref main -f bump=minor -f native=auto",
     "release:major": "gh workflow run deploy.yml --ref main -f bump=major -f native=auto"
@@ -99,6 +103,15 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.105.0",
     "@google/generative-ai": "^0.24.1",
@@ -113,6 +126,7 @@
     "kiwi-nlp": "^0.21.0",
     "marked": "^14.1.4",
     "node-cron": "^4.5.0",
+    "onnxruntime-node": "1.23.2",
     "openai": "^6.44.0",
     "pg": "^8.22.0",
     "puppeteer-core": "^25.2.0",
@@ -129,6 +143,7 @@
   },
   "overrides": {
     "onnxruntime-node": {
+      ".": "1.23.2",
       "global-agent": "^4.1.3"
     },
     "sharp": "^0.35.3"
@@ -140,5 +155,10 @@
   },
   "optionalDependencies": {
     "@vscode/ripgrep": "^1.18.0"
-  }
+  },
+  "main": "index.js",
+  "directories": {
+    "doc": "docs"
+  },
+  "author": ""
 }

package/scripts/build-voice-runtime-unix.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CONFIG_PATH="${PROJECT_ROOT}/scripts/voice-runtime-config.json"
+CONFIG_VERSION="$(node -e "const c=require(process.argv[1]);process.stdout.write(c.runtimeVersion)" "${CONFIG_PATH}")"
+CONFIG_COMMIT="$(node -e "const c=require(process.argv[1]);process.stdout.write(c.whisperCommit)" "${CONFIG_PATH}")"
+WHISPER_VERSION="${WHISPER_VERSION:-${CONFIG_VERSION}}"
+WHISPER_COMMIT="${WHISPER_COMMIT:-${CONFIG_COMMIT}}"
+TARGET_OS="${TARGET_OS:?TARGET_OS is required}"
+TARGET_ARCH="${TARGET_ARCH:?TARGET_ARCH is required}"
+BACKEND="${BACKEND:?BACKEND is required}"
+
+if [[ "${WHISPER_VERSION}" != "${CONFIG_VERSION}" || "${WHISPER_COMMIT}" != "${CONFIG_COMMIT}" ]]; then
+  echo "voice runtime version/commit must match ${CONFIG_PATH}" >&2
+  exit 2
+fi
+
+HOST_ARCH="$(uname -m)"
+case "${TARGET_ARCH}:${HOST_ARCH}" in
+  x64:x86_64|x64:amd64|arm64:arm64|arm64:aarch64) ;;
+  *)
+    echo "voice runtime target ${TARGET_ARCH} does not match runner architecture ${HOST_ARCH}" >&2
+    exit 2
+    ;;
+esac
+
+WORK_BASE="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+WORK_ROOT="${WORK_BASE}/mixdog-whisper-${WHISPER_COMMIT}-${TARGET_OS}-${TARGET_ARCH}-${BACKEND}"
+SOURCE_ROOT="${WORK_ROOT}/whisper.cpp-${WHISPER_COMMIT}"
+BUILD_ROOT="${WORK_ROOT}/build"
+STAGE_ROOT="${WORK_ROOT}/stage"
+DIST_ROOT="${PROJECT_ROOT}/dist"
+ASSET_NAME="whisper-server-${TARGET_OS}-${TARGET_ARCH}-${BACKEND}.zip"
+OUTPUT_PATH="${DIST_ROOT}/${ASSET_NAME}"
+
+rm -rf "${WORK_ROOT}"
+mkdir -p "${WORK_ROOT}" "${STAGE_ROOT}" "${DIST_ROOT}"
+curl --fail --location --retry 3 \
+  "https://github.com/ggml-org/whisper.cpp/archive/${WHISPER_COMMIT}.tar.gz" \
+  --output "${WORK_ROOT}/source.tar.gz"
+tar -xzf "${WORK_ROOT}/source.tar.gz" -C "${WORK_ROOT}"
+
+CMAKE_ARGS=(
+  -S "${SOURCE_ROOT}"
+  -B "${BUILD_ROOT}"
+  -DCMAKE_BUILD_TYPE=Release
+  -DBUILD_SHARED_LIBS=OFF
+  -DWHISPER_BUILD_EXAMPLES=ON
+  -DWHISPER_BUILD_SERVER=ON
+  -DWHISPER_BUILD_TESTS=OFF
+  -DWHISPER_SDL2=OFF
+)
+
+case "${BACKEND}" in
+  vulkan)
+    CMAKE_ARGS+=(-DGGML_VULKAN=ON)
+    ;;
+  metal)
+    CMAKE_ARGS+=(-DGGML_METAL=ON -DGGML_METAL_EMBED_LIBRARY=ON)
+    ;;
+  cpu)
+    CMAKE_ARGS+=(-DGGML_METAL=OFF -DGGML_VULKAN=OFF)
+    ;;
+  *)
+    echo "unsupported voice runtime backend: ${BACKEND}" >&2
+    exit 2
+    ;;
+esac
+
+cmake "${CMAKE_ARGS[@]}"
+cmake --build "${BUILD_ROOT}" --config Release --target whisper-server --parallel 2
+
+SERVER_PATH="$(find "${BUILD_ROOT}" -type f -name whisper-server -perm -111 | head -n 1)"
+if [[ -z "${SERVER_PATH}" ]]; then
+  echo "whisper-server was not produced" >&2
+  exit 1
+fi
+
+cp "${SERVER_PATH}" "${STAGE_ROOT}/whisper-server"
+cp "${SOURCE_ROOT}/LICENSE" "${STAGE_ROOT}/LICENSE-whisper.cpp.txt"
+find "$(dirname "${SERVER_PATH}")" -maxdepth 1 -type f \
+  \( -name '*.so' -o -name '*.so.*' -o -name '*.dylib' \) \
+  -exec cp {} "${STAGE_ROOT}/" \;
+chmod +x "${STAGE_ROOT}/whisper-server"
+"${STAGE_ROOT}/whisper-server" --help >/dev/null
+
+rm -f "${OUTPUT_PATH}"
+(
+  cd "${STAGE_ROOT}"
+  cmake -E tar cf "${OUTPUT_PATH}" --format=zip .
+)
+
+if command -v sha256sum >/dev/null 2>&1; then
+  HASH="$(sha256sum "${OUTPUT_PATH}" | cut -d' ' -f1)"
+else
+  HASH="$(shasum -a 256 "${OUTPUT_PATH}" | cut -d' ' -f1)"
+fi
+SIZE="$(wc -c < "${OUTPUT_PATH}" | tr -d ' ')"
+printf '%s  %s\n' "${HASH}" "${ASSET_NAME}" > "${OUTPUT_PATH}.sha256"
+echo "voice-runtime ${WHISPER_VERSION} ${TARGET_OS}-${TARGET_ARCH} ${BACKEND}: ${OUTPUT_PATH} (${SIZE} bytes, sha256=${HASH})"

package/scripts/embedding-quality-probe.mjs

@@ -0,0 +1,96 @@
+import {
+  embedText,
+  embedTexts,
+  getEmbeddingDtype,
+  getEmbeddingModelId,
+  shutdownEmbeddingProvider,
+  warmupEmbeddingProvider,
+} from '../src/runtime/memory/lib/embedding-provider.mjs'
+
+const cases = [
+  {
+    query: '윈도우 음성 인식이 너무 많은 메모리를 쓰는 원인은?',
+    relevant: 'Windows 음성 인식 런타임은 CUDA DLL과 Whisper 모델을 함께 올려 메모리 사용량이 커졌다.',
+    distractors: [
+      'macOS 렌더러는 창 크기를 local storage에 저장한다.',
+      '세션 목록은 최근 접속 시각을 기준으로 정렬한다.',
+    ],
+  },
+  {
+    query: 'How is the embedding worker released when it becomes idle?',
+    relevant: 'The embedding worker terminates after its idle timeout so native ONNX memory returns to the OS.',
+    distractors: [
+      'The release workflow uploads desktop installers to GitHub.',
+      'The renderer uses CSS grid to arrange conversation panes.',
+    ],
+  },
+  {
+    query: '검색 query와 저장 문서의 embedding 입력은 어떻게 구분해?',
+    relevant: '검색 query에는 retrieval instruction을 붙이고 저장 문서는 원문 그대로 embedding한다.',
+    distractors: [
+      '음성 녹음은 WAV 파일로 임시 저장한 뒤 삭제한다.',
+      '데스크톱 업데이트는 설치된 앱의 userData를 보존한다.',
+    ],
+  },
+  {
+    query: 'Which function opens the memory database with the active embedding identity?',
+    relevant: 'openDatabase receives the embedding identity and resets incompatible stored vectors.',
+    distractors: [
+      'ensureReady starts the whisper server on an available TCP port.',
+      'selectVoiceModelId chooses the bundled speech recognition model.',
+    ],
+  },
+]
+
+function cosine(a, b) {
+  let dot = 0
+  let aa = 0
+  let bb = 0
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i]
+    aa += a[i] * a[i]
+    bb += b[i] * b[i]
+  }
+  return dot / Math.sqrt(aa * bb)
+}
+
+const startedAt = performance.now()
+try {
+  await warmupEmbeddingProvider()
+  let hits = 0
+  const margins = []
+  const rows = []
+
+  for (const item of cases) {
+    const documents = [item.relevant, ...item.distractors]
+    const [queryVector, documentVectors] = await Promise.all([
+      embedText(item.query, { inputType: 'query', priority: true }),
+      embedTexts(documents, { inputType: 'document' }),
+    ])
+    const scores = documentVectors.map((vector, index) => ({
+      index,
+      score: cosine(queryVector, vector),
+    })).sort((a, b) => b.score - a.score)
+    const hit = scores[0].index === 0
+    if (hit) hits++
+    margins.push(scores.find((row) => row.index === 0).score - scores.find((row) => row.index !== 0).score)
+    rows.push({
+      query: item.query,
+      hit,
+      relevant: Number(scores.find((row) => row.index === 0).score.toFixed(4)),
+      bestDistractor: Number(scores.find((row) => row.index !== 0).score.toFixed(4)),
+    })
+  }
+
+  console.log(JSON.stringify({
+    model: getEmbeddingModelId(),
+    dtype: getEmbeddingDtype(),
+    hitAt1: `${hits}/${cases.length}`,
+    meanMargin: Number((margins.reduce((sum, value) => sum + value, 0) / margins.length).toFixed(4)),
+    wallMs: Math.round(performance.now() - startedAt),
+    rssMiB: Number((process.memoryUsage().rss / 1024 / 1024).toFixed(1)),
+    rows,
+  }, null, 2))
+} finally {
+  await shutdownEmbeddingProvider()
+}

package/scripts/generate-voice-runtime-manifest.mjs

@@ -0,0 +1,300 @@
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+const CONFIG_URL = new URL('./voice-runtime-config.json', import.meta.url)
+const RELEASE_HASH_INPUTS = [
+  CONFIG_URL,
+  new URL('../.github/workflows/build-voice-runtime.yml', import.meta.url),
+  new URL('./build-voice-runtime-unix.sh', import.meta.url),
+  new URL('./build-voice-runtime-windows.ps1', import.meta.url),
+  new URL('./generate-voice-runtime-manifest.mjs', import.meta.url),
+]
+
+function loadVoiceRuntimeConfig() {
+  const config = JSON.parse(readFileSync(CONFIG_URL, 'utf8'))
+  if (!/^\d+\.\d+\.\d+$/.test(config.runtimeVersion || '')) {
+    throw new Error('voice runtime config has an invalid runtimeVersion')
+  }
+  if (!/^[a-f0-9]{40}$/.test(config.whisperCommit || '')) {
+    throw new Error('voice runtime config has an invalid whisperCommit')
+  }
+  if (!Array.isArray(config.platforms) || config.platforms.length === 0) {
+    throw new Error('voice runtime config has no platforms')
+  }
+  const keys = new Set()
+  const assets = new Set()
+  for (const platform of config.platforms) {
+    for (const field of ['key', 'os', 'arch', 'backend', 'runner', 'asset', 'executable']) {
+      if (!platform[field]) throw new Error(`voice runtime platform is missing ${field}`)
+    }
+    if (keys.has(platform.key)) throw new Error(`duplicate voice runtime platform ${platform.key}`)
+    if (assets.has(platform.asset)) throw new Error(`duplicate voice runtime asset ${platform.asset}`)
+    keys.add(platform.key)
+    assets.add(platform.asset)
+    Object.freeze(platform)
+  }
+  Object.freeze(config.platforms)
+  return Object.freeze(config)
+}
+
+export const VOICE_RUNTIME_CONFIG = loadVoiceRuntimeConfig()
+export const VOICE_RUNTIME_VERSION = VOICE_RUNTIME_CONFIG.runtimeVersion
+export const VOICE_RUNTIME_COMMIT = VOICE_RUNTIME_CONFIG.whisperCommit
+export const VOICE_RUNTIME_TAG = `voice-runtime-v${VOICE_RUNTIME_VERSION}`
+
+export function releaseAssetSha256(asset) {
+  const digest = String(asset?.digest || '')
+  const match = /^sha256:([a-f0-9]{64})$/i.exec(digest)
+  if (!match) throw new Error(`release asset ${asset?.name || '(unknown)'} has no SHA256 digest`)
+  return match[1].toLowerCase()
+}
+
+export async function voiceRuntimeBuildHash() {
+  const hash = createHash('sha256')
+  for (const input of RELEASE_HASH_INPUTS) {
+    hash.update(input.pathname.split('/').pop() || '')
+    hash.update('\0')
+    hash.update(await readFile(input))
+    hash.update('\0')
+  }
+  return hash.digest('hex')
+}
+
+export function compareSemver(left, right) {
+  const parse = (value) => {
+    if (!/^\d+\.\d+\.\d+$/.test(String(value || ''))) {
+      throw new Error(`invalid semantic version ${value || '(missing)'}`)
+    }
+    return String(value).split('.').map(Number)
+  }
+  const a = parse(left)
+  const b = parse(right)
+  for (let index = 0; index < 3; index++) {
+    if (a[index] !== b[index]) return a[index] - b[index]
+  }
+  return 0
+}
+
+export function buildVoiceRuntimePlatforms(
+  releaseAssets,
+  { repository = 'tribgames/mixdog', tag = VOICE_RUNTIME_TAG } = {},
+) {
+  const byName = new Map((releaseAssets || []).map((asset) => [asset.name, asset]))
+  const expectedAssets = new Set(VOICE_RUNTIME_CONFIG.platforms.map((platform) => platform.asset))
+  const unexpected = (releaseAssets || []).filter(
+    (asset) => /^whisper-server-.*\.zip$/i.test(asset.name) && !expectedAssets.has(asset.name),
+  )
+  if (unexpected.length > 0) {
+    throw new Error(`release has unexpected runtime asset ${unexpected.map((asset) => asset.name).join(', ')}`)
+  }
+  const platforms = {}
+  for (const spec of VOICE_RUNTIME_CONFIG.platforms) {
+    const asset = byName.get(spec.asset)
+    if (!asset) throw new Error(`release is missing required asset ${spec.asset}`)
+    if (!Number.isSafeInteger(asset.size) || asset.size <= 0) {
+      throw new Error(`release asset ${spec.asset} has invalid size`)
+    }
+    const sourceUrl = String(asset.browser_download_url || '')
+    const url = `https://github.com/${repository}/releases/download/${tag}/${spec.asset}`
+    let validDraftUrl = false
+    try {
+      const parsed = new URL(sourceUrl)
+      const prefix = `/${repository}/releases/download/`
+      const parts = parsed.pathname.startsWith(prefix)
+        ? parsed.pathname.slice(prefix.length).split('/')
+        : []
+      validDraftUrl = parsed.origin === 'https://github.com'
+        && !parsed.search
+        && !parsed.hash
+        && parts.length === 2
+        && parts[0].startsWith('untagged-')
+        && parts[1] === spec.asset
+    } catch {
+      validDraftUrl = false
+    }
+    if (sourceUrl !== url && !validDraftUrl) {
+      throw new Error(`release asset ${spec.asset} has invalid download URL`)
+    }
+    platforms[spec.key] = {
+      variants: [{
+        id: spec.backend,
+        requires: null,
+        url,
+        sha256: releaseAssetSha256(asset),
+        size: asset.size,
+        format: 'zip',
+        executable: spec.executable,
+      }],
+    }
+  }
+  return platforms
+}
+
+function githubHeaders(token, accept = 'application/vnd.github+json') {
+  return {
+    Accept: accept,
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': 'mixdog-voice-runtime-manifest',
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  }
+}
+
+export async function fetchGithubRelease(
+  repository,
+  tag,
+  token,
+  { allowMissing = false } = {},
+) {
+  let lastError
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      const response = await fetch(`https://api.github.com/repos/${repository}/releases/tags/${tag}`, {
+        headers: githubHeaders(token),
+        signal: AbortSignal.timeout(30_000),
+      })
+      if (response.ok) return response.json()
+      if (response.status !== 404) {
+        throw new Error(`GitHub release lookup failed: HTTP ${response.status}`)
+      }
+
+      // GitHub keeps a hidden draft under an `untagged-*` URL and the
+      // releases/tags endpoint returns 404 until publication creates the real
+      // tag. Authenticated release listings still expose its requested
+      // tag_name, which lets interrupted release runs resume and verify it.
+      for (let page = 1; page <= 10; page++) {
+        const listing = await fetch(
+          `https://api.github.com/repos/${repository}/releases?per_page=100&page=${page}`,
+          {
+            headers: githubHeaders(token),
+            signal: AbortSignal.timeout(30_000),
+          },
+        )
+        if (!listing.ok) {
+          throw new Error(`GitHub release listing failed: HTTP ${listing.status}`)
+        }
+        const releases = await listing.json()
+        const draft = releases.find((release) => release?.draft && release?.tag_name === tag)
+        if (draft) return draft
+        if (releases.length < 100) break
+      }
+      if (allowMissing) return null
+      throw new Error('GitHub release lookup failed: HTTP 404')
+    } catch (error) {
+      lastError = error
+      if (attempt < 3) await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 1_000))
+    }
+  }
+  throw lastError
+}
+
+export async function downloadReleaseAsset(asset, token) {
+  if (!asset?.url) throw new Error('release asset has no API URL')
+  const response = await fetch(asset.url, {
+    headers: githubHeaders(token, 'application/octet-stream'),
+    redirect: 'follow',
+    signal: AbortSignal.timeout(30_000),
+  })
+  if (!response.ok) throw new Error(`GitHub release asset download failed: HTTP ${response.status}`)
+  return Buffer.from(await response.arrayBuffer())
+}
+
+export function voiceRuntimeIdentity(manifest) {
+  return {
+    version: manifest?.version,
+    source: manifest?.source,
+    release_tag: manifest?.release_tag,
+    build_hash: manifest?.build_hash,
+    platforms: manifest?.platforms,
+  }
+}
+
+export function sameVoiceRuntimeIdentity(left, right) {
+  return JSON.stringify(voiceRuntimeIdentity(left)) === JSON.stringify(voiceRuntimeIdentity(right))
+}
+
+export async function assertVoiceRuntimeManifestIdentity(
+  manifest,
+  { repository = 'tribgames/mixdog' } = {},
+) {
+  const expectedSource = `ggml-org/whisper.cpp@${VOICE_RUNTIME_COMMIT}`
+  const expectedHash = await voiceRuntimeBuildHash()
+  if (manifest?.version !== VOICE_RUNTIME_VERSION) {
+    throw new Error(`voice runtime manifest version must be ${VOICE_RUNTIME_VERSION}`)
+  }
+  if (manifest?.source !== expectedSource) {
+    throw new Error(`voice runtime manifest source must be ${expectedSource}`)
+  }
+  if (manifest?.release_tag !== VOICE_RUNTIME_TAG) {
+    throw new Error(`voice runtime manifest release_tag must be ${VOICE_RUNTIME_TAG}`)
+  }
+  if (manifest?.build_hash !== expectedHash) {
+    throw new Error('published voice runtime differs from the current build inputs; bump runtimeVersion')
+  }
+  const platformKeys = Object.keys(manifest?.platforms || {})
+  const expectedKeys = VOICE_RUNTIME_CONFIG.platforms.map((platform) => platform.key)
+  if (JSON.stringify(platformKeys) !== JSON.stringify(expectedKeys)) {
+    throw new Error(`voice runtime manifest platforms must be ${expectedKeys.join(', ')}`)
+  }
+  for (const spec of VOICE_RUNTIME_CONFIG.platforms) {
+    const variants = manifest.platforms[spec.key]?.variants
+    if (!Array.isArray(variants) || variants.length !== 1) {
+      throw new Error(`voice runtime manifest ${spec.key} must have exactly one variant`)
+    }
+    const variant = variants[0]
+    const expectedUrl = `https://github.com/${repository}/releases/download/${VOICE_RUNTIME_TAG}/${spec.asset}`
+    if (
+      variant.id !== spec.backend
+      || variant.requires !== null
+      || variant.url !== expectedUrl
+      || variant.executable !== spec.executable
+      || variant.format !== 'zip'
+      || !/^[a-f0-9]{64}$/.test(variant.sha256 || '')
+      || !Number.isSafeInteger(variant.size)
+      || variant.size <= 0
+    ) {
+      throw new Error(`voice runtime manifest ${spec.key} does not match the release config`)
+    }
+  }
+}
+
+async function main() {
+  const repository = String(process.env.GITHUB_REPOSITORY || 'tribgames/mixdog')
+  const tag = String(process.env.RELEASE_TAG || VOICE_RUNTIME_TAG)
+  if (tag !== VOICE_RUNTIME_TAG) {
+    throw new Error(`voice runtime tag must be ${VOICE_RUNTIME_TAG}, got ${tag}`)
+  }
+  const manifestPath = resolve(process.argv[2] || 'src/runtime/channels/data/voice-runtime-manifest.json')
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+  let platforms
+  let lastError
+  for (let attempt = 1; attempt <= 5; attempt++) {
+    try {
+      const release = await fetchGithubRelease(repository, tag, process.env.GITHUB_TOKEN)
+      platforms = buildVoiceRuntimePlatforms(release.assets, { repository, tag })
+      lastError = null
+      break
+    } catch (error) {
+      lastError = error
+      if (attempt < 5) await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 2_000))
+    }
+  }
+  if (lastError) throw lastError
+  manifest.version = VOICE_RUNTIME_VERSION
+  manifest.source = `ggml-org/whisper.cpp@${VOICE_RUNTIME_COMMIT}`
+  manifest.release_tag = tag
+  manifest.build_hash = await voiceRuntimeBuildHash()
+  manifest.platforms = platforms
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`)
+  console.log(`updated ${manifestPath} from ${tag}`)
+}
+
+const invokedPath = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href : ''
+if (invokedPath === import.meta.url) {
+  main().catch((error) => {
+    console.error(error?.stack || error)
+    process.exitCode = 1
+  })
+}