fix(desktop): ship the VC++ runtime the Windows voice wheels need

onnxruntime (wake word) and ctranslate2 (local speech-to-text) link against
msvcp140.dll and msvcp140_1.dll, which the managed CPython does not ship.
On Windows without the system VC++ Redistributable both imports failed with
"DLL load failed: The specified module could not be found", so "Hey Hermes"
and voice chat transcription never worked.

- Bundle the Microsoft-signed VC143 CRT set (14.44.35211, matching the
  managed CPython's vcruntime140) as a Windows extra resource with a SHA-256
  manifest.
- Before every local backend start, copy missing or mismatching CRT files
  beside the managed python.exe (the process image directory, searched first),
  verifying digests; never overwrite the interpreter's own vcruntime and never
  block boot. Existing installs heal on their next launch.
- Report an unloadable native voice wheel as a VC++ runtime problem in the
  wake-word requirements, local transcription and `hermes doctor`, instead of
  treating installed package metadata as proof the wheel loads.
- Bump AITURK IDE to 1.0.0-beta.12.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/desktop/electron/main.ts

@@ -33,6 +33,7 @@ import {
 } from 'electron'
 
 import { classifyActiveRuntime, needsPackagedRuntimeUpgrade } from './active-runtime-state'
+import { describeVcRuntimeResult, ensureWindowsVcRuntime } from './windows-vc-runtime'
 import { destroyKeepaliveAgents, downloadAgentFor, jsonAgentFor, withRetry } from './api-transport'
 import { appIconCandidates, resolveAppIcon } from './app-icon'
 import { stopBackendChild as stopBackendChildImpl, stopBackendTreesForUpdate } from './backend-child'
@@ -5221,6 +5222,22 @@ async function ensureRuntime(backend) {
     )
   }
 
+  // Voice wheels (onnxruntime, ctranslate2) need msvcp140*.dll, which the
+  // managed CPython does not ship. Place the bundled Microsoft CRT beside the
+  // managed python.exe before the backend imports anything. Never blocks boot:
+  // only the voice features depend on it.
+  if (IS_WINDOWS) {
+    const vcRuntime = ensureWindowsVcRuntime({
+      platform: process.platform,
+      venvRoot: VENV_ROOT,
+      sourceDir: IS_PACKAGED
+        ? path.join(process.resourcesPath, 'vc-runtime', 'x64')
+        : path.join(APP_ROOT, 'assets', 'windows', 'vc-runtime', 'x64')
+    })
+
+    rememberLog(`[vc-runtime] ${describeVcRuntimeResult(vcRuntime)}`)
+  }
+
   backend.command = getVenvPython(VENV_ROOT)
   backend.label = `Hermes at ${ACTIVE_HERMES_ROOT} (venv: ${VENV_ROOT})`
   updateBootProgress({

apps/desktop/electron/windows-vc-runtime.test.ts

@@ -0,0 +1,171 @@
+import assert from 'node:assert/strict'
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { afterEach, test } from 'vitest'
+
+import { ensureWindowsVcRuntime, loadVcRuntimeManifest, readPythonHome } from './windows-vc-runtime'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const roots: string[] = []
+
+function tempRoot() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'aiturk-vc-runtime-'))
+  roots.push(root)
+
+  return root
+}
+
+function sha256(data: Buffer) {
+  return crypto.createHash('sha256').update(data).digest('hex')
+}
+
+// A fake install: venv/pyvenv.cfg -> python home, plus a bundled source dir
+// whose manifest describes the given files.
+function fixture(files: Record<string, { data: string; ownedByPython?: boolean }>) {
+  const root = tempRoot()
+  const home = path.join(root, 'python home')
+  const venv = path.join(root, 'venv')
+  const source = path.join(root, 'bundle')
+
+  for (const dir of [home, venv, source]) {
+    fs.mkdirSync(dir, { recursive: true })
+  }
+
+  fs.writeFileSync(path.join(home, 'python.exe'), 'exe')
+  fs.writeFileSync(path.join(venv, 'pyvenv.cfg'), `home = ${home}\r\nversion_info = 3.11\r\n`)
+
+  const entries = Object.entries(files).map(([name, { data, ownedByPython }]) => {
+    const bytes = Buffer.from(data)
+    fs.writeFileSync(path.join(source, name), bytes)
+
+    return { name, size: bytes.length, sha256: sha256(bytes), ...(ownedByPython ? { ownedByPython } : {}) }
+  })
+
+  fs.writeFileSync(
+    path.join(source, 'manifest.json'),
+    JSON.stringify({ schemaVersion: 1, version: 'test', architecture: 'x64', files: entries })
+  )
+
+  return { home, venv, source }
+}
+
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('non-Windows platforms are left untouched', () => {
+  const { home, venv, source } = fixture({ 'msvcp140.dll': { data: 'crt' } })
+
+  assert.deepEqual(ensureWindowsVcRuntime({ platform: 'linux', venvRoot: venv, sourceDir: source }), {
+    status: 'skipped',
+    reason: 'not windows'
+  })
+  assert.equal(fs.existsSync(path.join(home, 'msvcp140.dll')), false)
+})
+
+test('readPythonHome parses pyvenv.cfg home with spaces', () => {
+  const { home, venv } = fixture({ 'msvcp140.dll': { data: 'crt' } })
+
+  assert.equal(readPythonHome(venv), home)
+  assert.equal(readPythonHome(path.join(venv, 'missing')), null)
+})
+
+test('missing CRT files are copied beside python.exe and verified', () => {
+  const { home, venv, source } = fixture({
+    'msvcp140.dll': { data: 'msvcp' },
+    'msvcp140_1.dll': { data: 'msvcp1' }
+  })
+
+  const result = ensureWindowsVcRuntime({ platform: 'win32', venvRoot: venv, sourceDir: source })
+
+  assert.deepEqual(result, { status: 'repaired', pythonHome: home, copied: ['msvcp140.dll', 'msvcp140_1.dll'] })
+  assert.equal(fs.readFileSync(path.join(home, 'msvcp140_1.dll'), 'utf8'), 'msvcp1')
+  assert.deepEqual(fs.readdirSync(home).filter(name => name.endsWith('.tmp')), [])
+  // Second launch: nothing to do.
+  assert.deepEqual(ensureWindowsVcRuntime({ platform: 'win32', venvRoot: venv, sourceDir: source }), {
+    status: 'ok',
+    pythonHome: home,
+    copied: []
+  })
+})
+
+test('a mismatching msvcp140 copy is replaced, a python-owned vcruntime is kept', () => {
+  const { home, venv, source } = fixture({
+    'msvcp140.dll': { data: 'good' },
+    'vcruntime140.dll': { data: 'bundled', ownedByPython: true }
+  })
+
+  fs.writeFileSync(path.join(home, 'msvcp140.dll'), 'stale')
+  fs.writeFileSync(path.join(home, 'vcruntime140.dll'), 'interpreter-owned')
+
+  const result = ensureWindowsVcRuntime({ platform: 'win32', venvRoot: venv, sourceDir: source })
+
+  assert.deepEqual(result, { status: 'repaired', pythonHome: home, copied: ['msvcp140.dll'] })
+  assert.equal(fs.readFileSync(path.join(home, 'msvcp140.dll'), 'utf8'), 'good')
+  assert.equal(fs.readFileSync(path.join(home, 'vcruntime140.dll'), 'utf8'), 'interpreter-owned')
+})
+
+test('a tampered bundled file is refused and nothing is written', () => {
+  const { home, venv, source } = fixture({ 'msvcp140.dll': { data: 'genuine' } })
+
+  fs.writeFileSync(path.join(source, 'msvcp140.dll'), 'tampered')
+
+  const result = ensureWindowsVcRuntime({ platform: 'win32', venvRoot: venv, sourceDir: source })
+
+  assert.equal(result.status, 'failed')
+  assert.match((result as { error: string }).error, /does not match its manifest digest/)
+  assert.equal(fs.existsSync(path.join(home, 'msvcp140.dll')), false)
+})
+
+test('an unresolvable python home fails without throwing', () => {
+  const { venv, source } = fixture({ 'msvcp140.dll': { data: 'crt' } })
+
+  fs.writeFileSync(path.join(venv, 'pyvenv.cfg'), 'home = C:\\does-not-exist\n')
+
+  assert.equal(ensureWindowsVcRuntime({ platform: 'win32', venvRoot: venv, sourceDir: source }).status, 'failed')
+})
+
+test('the shipped CRT set matches its manifest and covers the voice wheels', () => {
+  const sourceDir = path.join(here, '..', 'assets', 'windows', 'vc-runtime', 'x64')
+  const manifest = loadVcRuntimeManifest(sourceDir)
+  const names = manifest.files.map(file => file.name)
+
+  for (const required of ['msvcp140.dll', 'msvcp140_1.dll', 'vcruntime140.dll', 'vcruntime140_1.dll']) {
+    assert.ok(names.includes(required), `${required} must be bundled`)
+  }
+
+  for (const file of manifest.files) {
+    const bytes = fs.readFileSync(path.join(sourceDir, file.name))
+
+    assert.equal(bytes.length, file.size, file.name)
+    assert.equal(sha256(bytes), file.sha256, file.name)
+  }
+})
+
+test('the Windows package ships the CRT set as an extra resource', () => {
+  const pkg = JSON.parse(fs.readFileSync(path.join(here, '..', 'package.json'), 'utf8'))
+  const resources = pkg.build.win.extraResources
+
+  assert.ok(
+    resources.some(entry => entry.from === 'assets/windows/vc-runtime/x64' && entry.to === 'vc-runtime/x64'),
+    'win.extraResources must carry vc-runtime/x64'
+  )
+})
+
+test('ensureRuntime places the CRT before handing the venv python to the backend', () => {
+  const source = fs.readFileSync(path.join(here, 'main.ts'), 'utf8')
+  const start = source.indexOf('async function ensureRuntime(')
+  const body = source.slice(start, source.indexOf('\nfunction ', start + 1))
+
+  const ensureIdx = body.indexOf('ensureWindowsVcRuntime(')
+  const commandIdx = body.indexOf('backend.command = getVenvPython(VENV_ROOT)')
+
+  assert.notEqual(ensureIdx, -1, 'ensureRuntime must call ensureWindowsVcRuntime')
+  assert.ok(ensureIdx < commandIdx, 'CRT must be in place before the backend command is chosen')
+})

apps/desktop/electron/windows-vc-runtime.ts

@@ -0,0 +1,168 @@
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+
+// ── Windows VC++ runtime for the managed Python ─────────────────────────────
+//
+// Voice features load native wheels (onnxruntime for the wake word,
+// ctranslate2 for local speech-to-text) that link against msvcp140.dll and
+// msvcp140_1.dll. The managed CPython only ships vcruntime140*.dll, so on a
+// Windows install without the system-wide VC++ Redistributable those imports
+// fail with "DLL load failed / The specified module could not be found".
+//
+// The desktop package carries the Microsoft-signed VC143 CRT set and copies it
+// next to the managed python.exe before every local backend start. That
+// directory is the process image directory, which Windows searches first for
+// extension-module dependencies, so a stale msvcp140.dll elsewhere on PATH can
+// never win. Existing installs are healed on their next launch.
+
+export interface VcRuntimeFile {
+  name: string
+  size: number
+  sha256: string
+  // Files the managed CPython already ships. Never overwrite an existing copy:
+  // the interpreter owns it and replacing a loaded DLL is not possible anyway.
+  ownedByPython?: boolean
+}
+
+export interface VcRuntimeManifest {
+  schemaVersion: 1
+  version: string
+  architecture: string
+  files: VcRuntimeFile[]
+}
+
+export type VcRuntimeResult =
+  | { status: 'skipped'; reason: string }
+  | { status: 'ok' | 'repaired'; pythonHome: string; copied: string[] }
+  | { status: 'failed'; pythonHome: string | null; copied: string[]; error: string }
+
+const FILE_NAME_RE = /^[a-z0-9_]+\.dll$/i
+const SHA256_RE = /^[0-9a-f]{64}$/
+
+export function readPythonHome(venvRoot: string): string | null {
+  let text: string
+
+  try {
+    text = fs.readFileSync(path.join(venvRoot, 'pyvenv.cfg'), 'utf8')
+  } catch {
+    return null
+  }
+
+  for (const line of text.split(/\r?\n/)) {
+    const match = /^\s*home\s*=\s*(.+?)\s*$/i.exec(line)
+
+    if (match) {
+      return match[1]
+    }
+  }
+
+  return null
+}
+
+export function loadVcRuntimeManifest(sourceDir: string): VcRuntimeManifest {
+  const manifest = JSON.parse(fs.readFileSync(path.join(sourceDir, 'manifest.json'), 'utf8'))
+
+  if (manifest?.schemaVersion !== 1 || !Array.isArray(manifest.files) || manifest.files.length === 0) {
+    throw new Error('invalid VC++ runtime manifest')
+  }
+
+  for (const file of manifest.files) {
+    if (!FILE_NAME_RE.test(file?.name) || !SHA256_RE.test(file?.sha256) || !Number.isInteger(file?.size)) {
+      throw new Error(`invalid VC++ runtime manifest entry: ${JSON.stringify(file?.name)}`)
+    }
+  }
+
+  return manifest
+}
+
+function sha256File(filePath: string): string {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+function matches(filePath: string, file: VcRuntimeFile): boolean {
+  try {
+    return fs.statSync(filePath).size === file.size && sha256File(filePath) === file.sha256
+  } catch {
+    return false
+  }
+}
+
+function installFile(sourceDir: string, pythonHome: string, file: VcRuntimeFile) {
+  const source = path.join(sourceDir, file.name)
+
+  if (!matches(source, file)) {
+    throw new Error(`bundled ${file.name} does not match its manifest digest`)
+  }
+
+  const target = path.join(pythonHome, file.name)
+  const temp = `${target}.aiturk-${process.pid}.tmp`
+
+  try {
+    fs.copyFileSync(source, temp)
+
+    if (!matches(temp, file)) {
+      throw new Error(`copied ${file.name} failed digest verification`)
+    }
+
+    fs.renameSync(temp, target)
+  } finally {
+    fs.rmSync(temp, { force: true })
+  }
+}
+
+export function ensureWindowsVcRuntime({
+  platform,
+  venvRoot,
+  sourceDir
+}: {
+  platform: NodeJS.Platform
+  venvRoot: string
+  sourceDir: string
+}): VcRuntimeResult {
+  if (platform !== 'win32') {
+    return { status: 'skipped', reason: 'not windows' }
+  }
+
+  const pythonHome = readPythonHome(venvRoot)
+
+  if (!pythonHome || !fs.existsSync(path.join(pythonHome, 'python.exe'))) {
+    return { status: 'failed', pythonHome, copied: [], error: 'managed python home not found' }
+  }
+
+  const copied: string[] = []
+
+  try {
+    const manifest = loadVcRuntimeManifest(sourceDir)
+
+    for (const file of manifest.files) {
+      const target = path.join(pythonHome, file.name)
+
+      if (file.ownedByPython ? fs.existsSync(target) : matches(target, file)) {
+        continue
+      }
+
+      installFile(sourceDir, pythonHome, file)
+      copied.push(file.name)
+    }
+  } catch (error) {
+    return { status: 'failed', pythonHome, copied, error: error instanceof Error ? error.message : String(error) }
+  }
+
+  return { status: copied.length ? 'repaired' : 'ok', pythonHome, copied }
+}
+
+export function describeVcRuntimeResult(result: VcRuntimeResult): string {
+  if (result.status === 'skipped') {
+    return `skipped (${result.reason})`
+  }
+
+  if (result.status === 'failed') {
+    return `failed for ${result.pythonHome ?? 'unknown python home'}: ${result.error}` +
+      (result.copied.length ? ` (copied before failure: ${result.copied.join(', ')})` : '')
+  }
+
+  return result.status === 'repaired'
+    ? `installed ${result.copied.join(', ')} into ${result.pythonHome}`
+    : `verified in ${result.pythonHome}`
+}