mixdog 0.9.156 → 0.9.158

package/README.md

@@ -45,31 +45,35 @@ workflow setup.
 
 Terminal-Bench 2.1 — same model, same 89 tasks, same official verifier, with
 only the harness changed. Against the native CLI of each model family, Mixdog
-scores higher while spending less to get there.
+delivers the same results at the same speed — on a fraction of the context,
+for far less cost.
 
 ### GPT-5.6 Sol xhigh — Mixdog vs Codex CLI
 
 ![Terminal-Bench 2.1: Mixdog with GPT-5.6 Sol xhigh versus Codex CLI](https://raw.githubusercontent.com/tribgames/mixdog/main/benchmarks/terminal-bench-2.1/tb21-sol-vs-codex.svg)
 
-- **86.5%** (385/445) vs Codex CLI's **84.3%** (75/89)
-- **42%** lower priced cost — $0.641 vs $1.096 per trial
-- **45%** smaller median final context — 18.5k vs 33.5k tokens
-- **1.11×** faster — 339s vs 378s per trial
+- **39%** lower priced cost — $0.476 vs $0.782 per trial
+- **46%** smaller median final context — 18.5k vs 34.3k tokens
+- **86.5%** (385/445) vs Codex CLI's **86.1%** (383/445) — full `k=5` on both
+  sides, pass@5 **96.6%** vs 95.5%
+- Matched speed — 415s vs 437s wall time per trial
 
 ### Claude Opus 5 — Mixdog vs Claude Code
 
 ![Terminal-Bench 2.1: Mixdog with Claude Opus 5 versus Claude Code](https://raw.githubusercontent.com/tribgames/mixdog/main/benchmarks/terminal-bench-2.1/tb21-opus-vs-claude-code.svg)
 
-- **79/89** vs Claude Code's **77/89**
 - **19%** lower priced cost — $104.29 vs $129.21 per run
 - **28%** smaller median final context — 27.6k vs 38.2k tokens
-- **1.15×** faster
+- **79/89** vs Claude Code's **77/89**
+- **1.16×** faster — 610s vs 708s wall time per trial
 
-Every run uses the official Harbor verifier, fast mode off, a 272k context
-window, and zero retries. The Mixdog Sol run follows the protocol the official
-Terminal-Bench leaderboard requires — all 89 tasks repeated five times (`k=5`,
-445 trials); the Codex CLI baseline and both Opus-side runs are single passes
-(`k=1`, 89 trials each).
+Every run uses the official Harbor verifier, fast mode off, and a 272k context
+window; task failures and agent timeouts are never retried. The Sol comparison
+follows the protocol the official Terminal-Bench leaderboard requires on both
+sides — all 89 tasks repeated five times (`k=5`, 445 trials each); the
+Opus-side runs are single passes (`k=1`, 89 trials each). Speed is the full
+trial wall clock, and cost values both sides at the same current API list
+rates.
 
 The leaderboard is not accepting community submissions, so every run here ships
 its raw artifacts instead — Harbor verdicts, official verifier output, pinned
@@ -88,6 +92,13 @@ the harness, presets, and metric scripts that recompute each number above:
   MCP, skills, hooks, and plugins.
 - **Local memory** — semantic and lexical recall with project-scoped context
   and multilingual retrieval.
+- **Browser Use** — a logged-in Chromium pane the agent can drive: tabs,
+  forms, downloads, and snapshots, with one-time Chrome profile import
+  including cookies and passwords.
+- **Computer Use** — agent control of the Windows desktop through screen
+  capture, accessibility, OCR, and a strict guarded input contract.
+- **Office documents** — author and edit Word, Excel, and PowerPoint files
+  with model-authored design plans, charts, and assurance-checked output.
 - **Encrypted remote access** — pair the installable web app with Desktop and
   use Mixdog from a browser or phone over authenticated E2EE.
 - **Desktop coding app** — agent panes, Monaco editor, Git, terminals, file
@@ -202,14 +213,20 @@ Mixdog Desktop runs the same agent runtime as the CLI:
 - Git staging, commits, branches, and generated commit messages
 - File explorer with previews, thumbnails, search, and drag-and-drop
 - Integrated terminal tabs using the local system shell
+- Browser Use pane with agent control and Chromium profile import
+- Computer Use on Windows with guarded native input
+- Office document authoring with rendered previews
 - Image and video generation Studio with a persistent local gallery
 - Visual workflow, agent, schedule, and webhook editors
 - Voice dictation with an optional local transcription runtime
+- Extensions hub with guided setup for Git, Memory, Browser Use, Computer
+  Use, Office, and voice
 - Provider setup, usage, git identity, and remote pairing settings
 
 The paired remote web app is installable on desktop and mobile browsers. It
 uses an authenticated end-to-end encrypted connection before session state,
-terminal data, files, or operation requests cross the relay.
+terminal data, files, or operation requests cross the relay, and adds mobile
+share-target intake, push notifications, and remote Browser Use.
 
 For desktop development:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.156",
+  "version": "0.9.158",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -54,7 +54,7 @@
     "smoke:all": "npm run smoke && npm run smoke:boot && npm run smoke:patch && npm run smoke:compact",
     "smoke:boot": "node scripts/boot-smoke.mjs",
     "smoke:compact": "node scripts/compact-smoke.mjs",
-    "test:compact": "node --test scripts/suite-compact-test.mjs",
+    "test:compact": "node --test scripts/suite-compact-test.mjs src/runtime/agent/orchestrator/session/token-estimate.test.mjs",
     "test:markdown": "node --test scripts/markdown-surface-test.mjs",
     "smoke:loop": "node scripts/smoke-loop.mjs",
     "smoke:loop:final": "node scripts/smoke-loop-report.mjs --require-complete --min-elapsed 5h --min-iterations 400 --max-gap 60s --max-smoke-ms 10000 --max-avg-smoke-ms 8500 --max-step-ms smoke.mjs=4000 --max-step-ms boot-smoke.mjs=8000 --max-rss-mb 140 --max-rss-growth-mb 50",
@@ -72,7 +72,7 @@
     "test:session-transport": "node --test scripts/session-transport-test.mjs scripts/daemon-bootstrap-test.mjs src/runtime/shared/child-spawn-remote.test.mjs src/standalone/session-runtime-agent-control-client.test.mjs src/standalone/session-runtime-dispatch-cancel.test.mjs src/standalone/session-runtime-host-factory.test.mjs src/standalone/session-runtime-inline-host.test.mjs src/standalone/session-runtime-provider-cooldown.test.mjs src/standalone/session-runtime-shard-host.test.mjs src/standalone/session-runtime-shard-router.test.mjs",
     "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store-test.mjs scripts/turn-review-revert-test.mjs src/runtime/shared/tool-surface.test.mjs src/runtime/bridge-clients.test.mjs",
     "test:quick": "npm run test:session && npm run test:session-transport && npm run test:desktop-main --prefix apps/desktop",
-    "test:office": "node --test src/runtime/office/office-runtime.test.mjs src/runtime/office/office-assurance.test.mjs src/runtime/office/portable-authoring.test.mjs && npm run test:office-approval --prefix apps/desktop",
+    "test:office": "node --test scripts/run-office-live-tests.test.mjs src/runtime/office/office-runtime.test.mjs src/runtime/office/office-assurance.test.mjs src/runtime/office/portable-authoring.test.mjs src/runtime/office/slide-quality.test.mjs && npm run test:office-approval --prefix apps/desktop",
     "test:office:live": "node scripts/run-office-live-tests.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs src/runtime/media/adapters/codex-image.test.mjs",
     "failures": "node scripts/tool-failures.mjs",
@@ -125,7 +125,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.105.0",
     "@google/generative-ai": "^0.24.1",
-    "@huggingface/transformers": "^3.8.1",
+    "@huggingface/transformers": "^4.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@mozilla/readability": "^0.6.0",
     "@napi-rs/canvas": "^1.0.8",
@@ -136,10 +136,9 @@
     "ink": "^7.1.0",
     "jsdom": "^27.0.0",
     "jszip": "^3.10.1",
-    "kiwi-nlp": "^0.21.0",
     "marked": "^14.1.4",
     "node-cron": "^4.5.0",
-    "onnxruntime-node": "1.23.2",
+    "onnxruntime-node": "1.29.0",
     "openai": "^6.44.0",
     "pdf-lib": "^1.17.1",
     "pdfjs-dist": "^6.2.108",
@@ -150,7 +149,6 @@
     "string-width": "^8.2.1",
     "strip-ansi": "^7.2.0",
     "tesseract.js": "^7.0.0",
-    "tiktoken": "^1.0.22",
     "undici": "^8.5.0",
     "unpdf": "^1.8.0",
     "wrap-ansi": "^10.0.0",
@@ -160,7 +158,7 @@
   },
   "overrides": {
     "onnxruntime-node": {
-      ".": "1.23.2",
+      ".": "1.29.0",
       "global-agent": "^4.1.3"
     },
     "sharp": "^0.35.3"

package/scripts/build-ffmpeg-runtime.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FFMPEG_VERSION="${FFMPEG_VERSION:-6.1.1}"
+TARGET_OS="${TARGET_OS:?TARGET_OS is required}"
+TARGET_ARCH="${TARGET_ARCH:?TARGET_ARCH is required}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BUILD_DIR="$ROOT_DIR/build/ffmpeg-runtime-${TARGET_OS}-${TARGET_ARCH}"
+SOURCE_DIR="$BUILD_DIR/ffmpeg-${FFMPEG_VERSION}"
+DIST_DIR="$ROOT_DIR/dist"
+
+rm -rf "$BUILD_DIR"
+mkdir -p "$BUILD_DIR" "$DIST_DIR"
+
+echo "==> Downloading FFmpeg n${FFMPEG_VERSION}"
+curl -fsSL --retry 3 \
+  "https://ffmpeg.org/releases/ffmpeg-${FFMPEG_VERSION}.tar.xz" \
+  -o "$BUILD_DIR/ffmpeg.tar.xz"
+tar -xJf "$BUILD_DIR/ffmpeg.tar.xz" -C "$BUILD_DIR"
+
+CONFIGURE_FLAGS=(
+  --disable-everything
+  --disable-autodetect
+  --disable-debug
+  --disable-doc
+  --disable-network
+  --disable-shared
+  --enable-static
+  --enable-small
+  --enable-ffmpeg
+  --enable-avcodec
+  --enable-avfilter
+  --enable-avformat
+  --enable-swresample
+  --enable-protocol=file,pipe
+  --enable-demuxer=aac,ac3,aiff,amr,ape,asf,au,avi,caf,flac,flv,matroska,mov,mp3,mpegts,ogg,wav,wv
+  --enable-decoder=aac,aac_fixed,ac3,alac,amrnb,amrwb,ape,eac3,flac,mp1,mp1float,mp2,mp2float,mp3,mp3float,opus,pcm_alaw,pcm_f32be,pcm_f32le,pcm_f64be,pcm_f64le,pcm_mulaw,pcm_s16be,pcm_s16le,pcm_s24be,pcm_s24le,pcm_s32be,pcm_s32le,pcm_s8,pcm_u16be,pcm_u16le,pcm_u24be,pcm_u24le,pcm_u32be,pcm_u32le,pcm_u8,vorbis,wavpack,wmav1,wmav2,wmapro
+  --enable-encoder=pcm_s16le
+  --enable-parser=aac,aac_latm,ac3,flac,mpegaudio,opus,vorbis
+  --enable-filter=aformat,anull,aresample
+  --enable-muxer=wav
+)
+
+EXE_NAME=ffmpeg
+STRIP_COMMAND=strip
+if [[ "$TARGET_OS" == "win32" ]]; then
+  CONFIGURE_FLAGS+=(
+    --target-os=mingw32
+    --arch=x86_64
+    --cc=gcc
+    --ar=ar
+    --ranlib=ranlib
+    --nm=nm
+    --strip=strip
+    --extra-ldflags=-static
+  )
+  EXE_NAME=ffmpeg.exe
+elif [[ "$TARGET_OS" == "darwin" ]]; then
+  STRIP_COMMAND="strip -x"
+fi
+
+echo "==> Configuring minimal audio-transcode runtime"
+pushd "$SOURCE_DIR" >/dev/null
+./configure "${CONFIGURE_FLAGS[@]}"
+make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || sysctl -n hw.logicalcpu)"
+popd >/dev/null
+
+RUNTIME_EXE="$SOURCE_DIR/ffmpeg"
+if [[ "$TARGET_OS" == "win32" ]]; then
+  RUNTIME_EXE="$SOURCE_DIR/ffmpeg.exe"
+fi
+if [[ ! -f "$RUNTIME_EXE" ]]; then
+  echo "FFmpeg build did not produce $RUNTIME_EXE" >&2
+  exit 1
+fi
+
+read -r -a STRIP_PARTS <<< "$STRIP_COMMAND"
+"${STRIP_PARTS[@]}" "$RUNTIME_EXE"
+
+echo "==> Smoke testing WAV normalization"
+PYTHON_COMMAND=
+for candidate in python3 python; do
+  if command -v "$candidate" >/dev/null 2>&1; then
+    PYTHON_COMMAND="$candidate"
+    break
+  fi
+done
+if [[ -z "$PYTHON_COMMAND" ]]; then
+  echo "Python 3 is required for the FFmpeg runtime smoke test" >&2
+  exit 1
+fi
+
+"$PYTHON_COMMAND" - "$BUILD_DIR/input.wav" <<'PY'
+import math
+import struct
+import sys
+import wave
+
+with wave.open(sys.argv[1], "wb") as wav:
+    wav.setnchannels(2)
+    wav.setsampwidth(2)
+    wav.setframerate(48000)
+    frames = bytearray()
+    for index in range(4800):
+        sample = int(math.sin(index * 2 * math.pi * 440 / 48000) * 12000)
+        frames.extend(struct.pack("<hh", sample, sample))
+    wav.writeframes(frames)
+PY
+"$RUNTIME_EXE" -hide_banner -loglevel error \
+  -i "$BUILD_DIR/input.wav" -ar 16000 -ac 1 -threads 1 -y "$BUILD_DIR/output.wav"
+"$PYTHON_COMMAND" - "$BUILD_DIR/output.wav" <<'PY'
+import sys
+import wave
+
+with wave.open(sys.argv[1], "rb") as wav:
+    assert wav.getframerate() == 16000
+    assert wav.getnchannels() == 1
+    assert wav.getnframes() > 0
+PY
+
+RUNTIME_BYTES="$(wc -c < "$RUNTIME_EXE" | tr -d ' ')"
+if (( RUNTIME_BYTES > 26214400 )); then
+  echo "Minimal FFmpeg exceeds 25 MiB: $RUNTIME_BYTES bytes" >&2
+  exit 1
+fi
+
+ASSET_NAME="ffmpeg-${TARGET_OS}-${TARGET_ARCH}.gz"
+gzip -9 -n -c "$RUNTIME_EXE" > "$DIST_DIR/$ASSET_NAME"
+ASSET_BYTES="$(wc -c < "$DIST_DIR/$ASSET_NAME" | tr -d ' ')"
+if (( ASSET_BYTES > 15728640 )); then
+  echo "Compressed FFmpeg exceeds 15 MiB: $ASSET_BYTES bytes" >&2
+  exit 1
+fi
+
+if command -v sha256sum >/dev/null 2>&1; then
+  (cd "$DIST_DIR" && sha256sum "$ASSET_NAME" > "$ASSET_NAME.sha256")
+else
+  (cd "$DIST_DIR" && shasum -a 256 "$ASSET_NAME" > "$ASSET_NAME.sha256")
+fi
+
+echo "Built $DIST_DIR/$ASSET_NAME ($RUNTIME_BYTES bytes raw, $ASSET_BYTES bytes compressed)"

package/scripts/build-runtime-linux.sh

@@ -78,6 +78,7 @@ else
   make -j"$(nproc)"
   make install
   make -C contrib/pgcrypto install
+  make -C contrib/pg_trgm install
 fi
 
 PG_CONFIG="$STAGE_DIR/bin/pg_config"
@@ -255,6 +256,10 @@ for attempt in 1 2 3; do
     echo "  vector extension version: $EXTV"
     echo "  distance query result:    $DIST"
     [[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
+    "${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
+    SIM="$("${RUN_AS[@]}" "$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT similarity('mixdog','mixdig') > 0;")"
+    echo "  pg_trgm similarity probe: $SIM"
+    [[ "$SIM" == "t" ]] || { echo "FAIL: pg_trgm similarity=$SIM"; exit 1; }
     "${RUN_AS[@]}" "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
   )
   attempt_rc=$?
@@ -323,6 +328,8 @@ for attempt in 1 2 3; do
       "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc \
       "SELECT extversion FROM pg_extension WHERE extname='vector';")"
     [[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
+    "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+      "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
     "${RUN_AS[@]}" env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
       "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
   )

package/scripts/build-runtime-macos.sh

@@ -73,6 +73,7 @@ else
   make -j"$(sysctl -n hw.logicalcpu)"
   make install
   make -C contrib/pgcrypto install
+  make -C contrib/pg_trgm install
 fi
 
 PG_CONFIG="$STAGE_DIR/bin/pg_config"
@@ -165,6 +166,10 @@ DIST="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d pos
 echo "  vector extension version: $EXTV"
 echo "  distance query result:    $DIST"
 [[ "$EXTV" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extversion=$EXTV expected=$PGVECTOR_VERSION"; exit 1; }
+"$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
+SIM="$("$RUNTIME_DIR/bin/psql" -h 127.0.0.1 -p "$SMOKE_PORT" -U postgres -d postgres -tAc "SELECT similarity('mixdog','mixdig') > 0;")"
+echo "  pg_trgm similarity probe: $SIM"
+[[ "$SIM" == "t" ]] || { echo "FAIL: pg_trgm similarity=$SIM"; exit 1; }
 "$RUNTIME_DIR/bin/pg_ctl" -D "$SMOKE_DATA" -m fast stop > /dev/null
 trap - EXIT
 rm -rf "$SMOKE_DATA"
@@ -207,6 +212,8 @@ env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
   "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
 EXTV2="$(env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
 [[ "$EXTV2" == "$PGVECTOR_VERSION" ]] || { echo "FAIL: extracted-smoke extversion=$EXTV2"; exit 1; }
+env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
+  "$EXTRACT_DIR/bin/psql" -h 127.0.0.1 -p "$EXTRACT_PORT" -U postgres -d postgres -c "CREATE EXTENSION pg_trgm;" > /dev/null
 env -i HOME="$EXTRACT_DIR" PATH="/usr/bin:/bin" \
   "$EXTRACT_DIR/bin/pg_ctl" -D "$EXTRACT_DATA" -m fast stop > /dev/null
 trap - EXIT

package/scripts/generate-voice-runtime-manifest.mjs

@@ -10,6 +10,7 @@ const RELEASE_HASH_INPUTS = [
   new URL('../.github/workflows/build-voice-runtime.yml', import.meta.url),
   new URL('./build-voice-runtime-unix.sh', import.meta.url),
   new URL('./build-voice-runtime-windows.ps1', import.meta.url),
+  new URL('./build-ffmpeg-runtime.sh', import.meta.url),
   new URL('./generate-voice-runtime-manifest.mjs', import.meta.url),
 ]
 
@@ -21,6 +22,9 @@ function loadVoiceRuntimeConfig() {
   if (!/^[a-f0-9]{40}$/.test(config.whisperCommit || '')) {
     throw new Error('voice runtime config has an invalid whisperCommit')
   }
+  if (!/^\d+\.\d+\.\d+-mixdog\.\d+$/.test(config.ffmpegVersion || '')) {
+    throw new Error('voice runtime config has an invalid ffmpegVersion')
+  }
   if (!Array.isArray(config.platforms) || config.platforms.length === 0) {
     throw new Error('voice runtime config has no platforms')
   }
@@ -133,6 +137,38 @@ export function buildVoiceRuntimePlatforms(
   return platforms
 }
 
+function ffmpegAssetName(spec) {
+  return `ffmpeg-${spec.os}-${spec.arch}.gz`
+}
+
+export function buildVoiceFfmpegPlatforms(
+  releaseAssets,
+  { repository = 'tribgames/mixdog', tag = VOICE_RUNTIME_TAG } = {},
+) {
+  const byName = new Map((releaseAssets || []).map((asset) => [asset.name, asset]))
+  const platforms = {}
+  for (const spec of VOICE_RUNTIME_CONFIG.platforms) {
+    const assetName = ffmpegAssetName(spec)
+    const asset = byName.get(assetName)
+    if (!asset) throw new Error(`release is missing required asset ${assetName}`)
+    if (!Number.isSafeInteger(asset.size) || asset.size <= 0) {
+      throw new Error(`release asset ${assetName} has invalid size`)
+    }
+    platforms[spec.key] = {
+      url: `https://github.com/${repository}/releases/download/${tag}/${assetName}`,
+      sha256: releaseAssetSha256(asset),
+      size: asset.size,
+      format: 'gz',
+      executable: spec.os === 'win32' ? 'ffmpeg.exe' : 'ffmpeg',
+    }
+  }
+  return {
+    version: VOICE_RUNTIME_CONFIG.ffmpegVersion,
+    source: 'FFmpeg n6.1.1 minimal audio-transcode build',
+    platforms,
+  }
+}
+
 function githubHeaders(token, accept = 'application/vnd.github+json') {
   return {
     Accept: accept,
@@ -207,6 +243,7 @@ export function voiceRuntimeIdentity(manifest) {
     source: manifest?.source,
     release_tag: manifest?.release_tag,
     build_hash: manifest?.build_hash,
+    ffmpeg: manifest?.ffmpeg,
     platforms: manifest?.platforms,
   }
 }
@@ -258,6 +295,36 @@ export async function assertVoiceRuntimeManifestIdentity(
       throw new Error(`voice runtime manifest ${spec.key} does not match the release config`)
     }
   }
+  const expectedFfmpeg = buildVoiceFfmpegPlatforms(
+    VOICE_RUNTIME_CONFIG.platforms.map((spec, index) => ({
+      name: ffmpegAssetName(spec),
+      size: index + 1,
+      digest: `sha256:${String(index + 1).padStart(64, '0')}`,
+    })),
+    { repository, tag: VOICE_RUNTIME_TAG },
+  )
+  if (
+    manifest?.ffmpeg?.version !== expectedFfmpeg.version
+    || manifest?.ffmpeg?.source !== expectedFfmpeg.source
+    || JSON.stringify(Object.keys(manifest?.ffmpeg?.platforms || {}))
+      !== JSON.stringify(Object.keys(expectedFfmpeg.platforms))
+  ) {
+    throw new Error('voice runtime FFmpeg manifest does not match the release config')
+  }
+  for (const spec of VOICE_RUNTIME_CONFIG.platforms) {
+    const actual = manifest.ffmpeg.platforms[spec.key]
+    const expected = expectedFfmpeg.platforms[spec.key]
+    if (
+      actual?.url !== expected.url
+      || actual?.format !== expected.format
+      || actual?.executable !== expected.executable
+      || !/^[a-f0-9]{64}$/.test(actual?.sha256 || '')
+      || !Number.isSafeInteger(actual?.size)
+      || actual.size <= 0
+    ) {
+      throw new Error(`voice runtime FFmpeg ${spec.key} does not match the release config`)
+    }
+  }
 }
 
 async function main() {
@@ -269,11 +336,13 @@ async function main() {
   const manifestPath = resolve(process.argv[2] || 'src/runtime/channels/data/voice-runtime-manifest.json')
   const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
   let platforms
+  let ffmpeg
   let lastError
   for (let attempt = 1; attempt <= 5; attempt++) {
     try {
       const release = await fetchGithubRelease(repository, tag, process.env.GITHUB_TOKEN)
       platforms = buildVoiceRuntimePlatforms(release.assets, { repository, tag })
+      ffmpeg = buildVoiceFfmpegPlatforms(release.assets, { repository, tag })
       lastError = null
       break
     } catch (error) {
@@ -286,6 +355,7 @@ async function main() {
   manifest.source = `ggml-org/whisper.cpp@${VOICE_RUNTIME_COMMIT}`
   manifest.release_tag = tag
   manifest.build_hash = await voiceRuntimeBuildHash()
+  manifest.ffmpeg = ffmpeg
   manifest.platforms = platforms
   await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`)
   console.log(`updated ${manifestPath} from ${tag}`)