feat: offer to download prebuilt mac/win binaries, new macos build fallback if xcode is not installed

5 files changed, 792 insertions, 65 deletions

diff --git a/app/backends/audiocpp/__init__.py b/app/backends/audiocpp/__init__.py
index 02fe967..2bb9cc7 100644
--- a/app/backends/audiocpp/__init__.py
+++ b/app/backends/audiocpp/__init__.py
@@ -68,6 +68,12 @@ from .build import (
     uninstall,
     update,
 )
+from .prebuilt import (
+    fetch_latest_release,
+    install_prebuilt,
+    installed_release,
+    select_assets,
+)
 from .remote import fetch_server_models, fetch_server_voices
 from .wizard import (
     build_parser,
@@ -100,6 +106,9 @@ __all__ = [
     # build
     "find_local_checkout", "find_audiocpp_server_bin", "find_build_script",
     "apply_ggml_patches", "build_audiocpp", "uninstall", "update",
+    # prebuilt
+    "fetch_latest_release", "install_prebuilt", "installed_release",
+    "select_assets",
     # remote
     "fetch_server_models", "fetch_server_voices",
     # wizard / status
diff --git a/app/backends/audiocpp/build.py b/app/backends/audiocpp/build.py
index 22d2fa1..f840193 100644
--- a/app/backends/audiocpp/build.py
+++ b/app/backends/audiocpp/build.py
@@ -14,6 +14,7 @@ import logging_kit
 
 from backends import common, servers
 from backends.common import APP_DIR
+from . import prebuilt as _prebuilt
 from .catalog import _BACKEND_TOKEN_RE, detect_backend, load_server_config
 from .constants import AUDIOCPP_DIR_NAME, BACKENDS, PATCH_DIR
 
@@ -54,14 +55,19 @@ def update(*, emit=None, cancel=None) -> int:
     """Update the audio.cpp backend: refresh the checkout, rebuild if stale.
 
     A managed server that is running is stopped first (best-effort): it
-    serves the binary whose sources are being replaced. Phases: stop
-    server / git update / rebuild — CANCEL is honored between phases only,
-    so a started phase always completes. The git update is a fetch plus
-    hard reset to origin's HEAD (see ``common.git_update``): everything
-    that matters lives untracked in the checkout (models, build trees,
-    server.json) and survives, while the vendored-ggml patch edit is
-    intentionally wiped — the rebuild re-applies it (the patch step is
-    idempotent and fails loudly when upstream re-shaped the file).
+    serves the binary whose sources are being replaced. Prebuilt installs
+    (a ``prebuilt.json`` marker next to the binary, see
+    ``backends.audiocpp.prebuilt``) take a different route: they skip the
+    git update and rebuild entirely and instead re-download when upstream
+    published a newer release (see ``_update_prebuilt``). Source-built
+    checkouts keep the original flow — phases: stop server / git update /
+    rebuild — CANCEL is honored between phases only, so a started phase
+    always completes. The git update is a fetch plus hard reset to origin's
+    HEAD (see ``common.git_update``): everything that matters lives
+    untracked in the checkout (models, build trees, server.json) and
+    survives, while the vendored-ggml patch edit is intentionally wiped —
+    the rebuild re-applies it (the patch step is idempotent and fails
+    loudly when upstream re-shaped the file).
 
     The rebuild target is the backend recorded in server.json, else the
     one detected from existing build directories; when neither names one
@@ -85,6 +91,9 @@ def update(*, emit=None, cancel=None) -> int:
     if checkout is None:
         print("[INFO] No audio.cpp checkout to update.")
         return 0
+    backend = _rebuild_backend(checkout)
+    if _prebuilt.installed_release(checkout, backend) is not None:
+        return _update_prebuilt(checkout, backend, emit=emit, cancel=cancel)
     head_before = common.git_head(checkout)
     rc = common.git_update(checkout, emit=emit, cancel=cancel)
     if rc != 0:
@@ -94,7 +103,6 @@ def update(*, emit=None, cancel=None) -> int:
     head_after = common.git_head(checkout)
     if common.cancel_requested(cancel):
         return 130
-    backend = _rebuild_backend(checkout)
     if backend is None:
         print("[INFO] audiocpp_server was never built for a known "
               "backend; skipping the rebuild. 'Build audio.cpp Server' "
@@ -125,6 +133,43 @@ def update(*, emit=None, cancel=None) -> int:
     return build_rc
 
 
+def _update_prebuilt(checkout: Path, backend: Optional[str], *,
+                     emit=None, cancel=None) -> int:
+    """The update route for a prebuilt (release-downloaded) install.
+
+    Source builds update by rebuilding after a git pull; a prebuilt
+    install instead re-downloads when upstream published a newer release
+    (the marker's tag is compared against the latest release tag). The
+    recorded/detected backend selects the asset, mirroring what was
+    originally installed. A GitHub outage is not fatal — the installed
+    binary keeps working. Returns the install exit code (0 when already
+    current or when the check could not run).
+    """
+    marker = _prebuilt.installed_release(checkout, backend)
+    release = _prebuilt.fetch_latest_release()
+    if release is None:
+        print("[WARNING] Could not check GitHub for a newer prebuilt "
+              "audiocpp_server; keeping the installed one ("
+              f"{marker.get('tag') if marker else 'unknown'}).")
+        return 0
+    tag = str(release.get("tag_name") or "")
+    if marker and tag and tag == marker.get("tag"):
+        print(f"[OK] Prebuilt audiocpp_server is current ({tag}).")
+        return 0
+    print(f"[INFO] audio.cpp {tag} is available; downloading the prebuilt "
+          f"audiocpp_server ({backend})...")
+    rc = _prebuilt.install_prebuilt(checkout, backend, emit=emit,
+                                    cancel=cancel)
+    if rc == 0:
+        print(f"[OK] audiocpp_server updated to {tag}.")
+    else:
+        print(f"[WARNING] prebuilt update failed (exit {rc}); the "
+              "installed audiocpp_server was left in place. Retry "
+              "'Update Backends' later, or build from source with "
+              "'Build audio.cpp Server'.")
+    return rc
+
+
 def _rebuild_needed(checkout: Path, binary: Optional[Path],
                     *, moved: bool) -> bool:
     """True when audiocpp_server must be (re)built after an update.
@@ -464,6 +509,49 @@ def apply_ggml_patches(audiocpp_dir: Path, *, emit=None, cancel=None) -> int:
     return 0
 
 
+def _metal_compiler_available() -> bool:
+    """Whether Xcode's offline Metal shader compiler is installed.
+
+    ``build_metal.sh`` hard-requires it (``xcrun --find metal``), but the
+    compiler ships only with full Xcode — Command Line Tools report
+    ``unable to find utility "metal"``. When it is missing the darwin
+    build falls back to direct cmake with ``GGML_METAL_EMBED_LIBRARY=ON``:
+    the ggml Metal build then only embeds the shader *source* and macOS's
+    built-in Metal runtime compiles it on first GPU init, so Apple's
+    Command Line Tools (clang) plus cmake are enough.
+    """
+    proc = common.run_console_subprocess_quiet(
+        ["xcrun", "--sdk", "macosx", "--find", "metal"], timeout=30)
+    return proc is not None and proc.returncode == 0
+
+
+def _darwin_cmake_script() -> str:
+    """The one-line cmake invocation replacing build_metal.sh's two steps.
+
+    Mirrors the script's defaults for our target (RelWithDebInfo, OpenMP
+    off, llamafile/native-CPU on, deployment build on) plus
+    ``GGML_METAL_EMBED_LIBRARY=ON`` — the flag that makes the build
+    independent of the offline Metal compiler (see
+    ``_metal_compiler_available``). The build directory is the same
+    ``build/macos-metal-release`` the script uses, so backend detection
+    (``-metal-`` -> ``cpu``) is unaffected. Relative paths: the command
+    runs with cwd = the checkout.
+    """
+    build_dir = "build/macos-metal-release"
+    jobs = os.cpu_count() or 4
+    return (
+        "cmake -S . -B " + build_dir + " -DCMAKE_BUILD_TYPE=RelWithDebInfo"
+        " -DENGINE_ENABLE_CUDA=OFF -DENGINE_ENABLE_VULKAN=OFF"
+        " -DENGINE_ENABLE_METAL=ON -DENGINE_ENABLE_OPENMP=OFF"
+        " -DGGML_OPENMP=OFF -DENGINE_ENABLE_LLAMAFILE=ON"
+        " -DENGINE_ENABLE_NATIVE_CPU=ON"
+        " -DGGML_METAL_EMBED_LIBRARY=ON"
+        " -DAUDIOCPP_DEPLOYMENT_BUILD=ON"
+        f" && cmake --build {build_dir} --parallel {jobs}"
+        " --target audiocpp_server"
+    )
+
+
 def build_audiocpp(audiocpp_dir: Path, backend: str, *,
                    emit=None, cancel=None) -> int:
     """Build audiocpp_server for BACKEND, streaming output.
@@ -476,6 +564,12 @@ def build_audiocpp(audiocpp_dir: Path, backend: str, *,
     Windows (presets ``windows-{cuda,vulkan,cpu}-release``), and
     ``build_linux.sh`` under bash everywhere else.
 
+    macOS exception: when Xcode's offline Metal compiler is missing (only
+    full Xcode ships it), ``build_metal.sh`` would abort at its probe —
+    the build instead runs cmake directly with the Metal shaders embedded
+    as source (see ``_darwin_cmake_script``), so the Apple Command Line
+    Tools plus cmake are enough.
+
     With EMIT None the build script runs on the console (inherits the
     terminal); with EMIT given (the in-TUI task view) its output streams line
     by line to EMIT so the view can show progress, and CANCEL aborts it.
@@ -509,6 +603,14 @@ def build_audiocpp(audiocpp_dir: Path, backend: str, *,
         else:
             argv += ["-Preset", f"windows-{backend}-release", "-Target",
                      "audiocpp_server", "-DeploymentBuild"]
+    elif sys.platform == "darwin" and not _metal_compiler_available():
+        say = emit if emit is not None else print
+        say("[INFO] Xcode's offline Metal compiler is not installed; "
+            "building with cmake directly (Apple Command Line Tools "
+            "suffice — Metal shaders are compiled by macOS at runtime on "
+            "first use, adding a short delay to the first model load; "
+            "install cmake, e.g. `brew install cmake`).")
+        argv = ["bash", "-c", _darwin_cmake_script()]
     else:
         argv = ["bash", str(script)]
         if sys.platform != "darwin":
diff --git a/app/backends/audiocpp/catalog.py b/app/backends/audiocpp/catalog.py
index 5d49fac..65b525b 100644
--- a/app/backends/audiocpp/catalog.py
+++ b/app/backends/audiocpp/catalog.py
@@ -82,7 +82,7 @@ def _backend_options(detected: Optional[str] = None
     on macOS — never reach the build step.
     """
     if sys.platform == "darwin":
-        label = "cpu - Apple Metal (recorded as cpu)"
+        label = "cpu - Apple Metal"
         if detected == "cpu":
             label += " [auto-detected]"
         return [(label, "cpu")], 0
diff --git a/app/backends/audiocpp/prebuilt.py b/app/backends/audiocpp/prebuilt.py
new file mode 100644
index 0000000..28d60b5
--- /dev/null
+++ b/app/backends/audiocpp/prebuilt.py
@@ -0,0 +1,506 @@
+"""Prebuilt audiocpp_server installs from audio.cpp's GitHub releases.
+
+Upstream (0xShug0/audio.cpp) publishes ready-to-run ``audiocpp_server``
+binaries for every release, built with ``AUDIOCPP_DEPLOYMENT_BUILD=ON``
+(the model-spec catalog is embedded, so the binary is self-contained):
+
+- ``audio-v<tag>-bin-macos-arm64-metal.tar.gz`` — Apple Silicon, real Metal
+- ``audio-v<tag>-bin-macos-x64-metal.tar.gz`` — Intel Macs (upstream's CI
+  Intel runners have no usable GPU, so this asset is CPU-only despite the
+  name; either way the tool records macOS installs as the ``cpu`` backend)
+- ``audio-v<tag>-bin-windows-x64-{cpu,vulkan,cuda12.4,cuda13.3}.zip`` —
+  Windows; the CUDA variants additionally need the matching
+  ``audio-v<tag>-cudart-windows-x64-cuda<ver>.zip`` runtime DLLs because
+  those builds ship the CUDA backend as ``ggml-cuda.dll``
+  (``ENGINE_ENABLE_CPU_ALL_VARIANTS``), loaded from the binary's directory.
+
+Installing a release into the same ``build/<dir>/bin/`` layout the source
+builds use means binary discovery (``find_audiocpp_server_bin`` /
+``built_server_binary``), the ``-metal-`` -> ``cpu`` backend token mapping,
+the managed-server launch, and the model-manager tooling from the git
+checkout all work unchanged. A ``prebuilt.json`` marker in the build
+directory records what was installed so ``build.update()`` can re-download
+a newer release instead of rebuilding from source.
+
+Everything downloads through urllib (no new dependencies); the GitHub API
+publishes a ``sha256:<hex>`` digest per asset, which is verified before
+extraction. Files saved by urllib carry no macOS quarantine attribute, so
+the ad-hoc-signed binaries run without Gatekeeper prompts.
+"""
+
+import hashlib
+import json
+import os
+import platform as _platform
+import re
+import shutil
+import sys
+import tarfile
+import tempfile
+import time
+import urllib.error
+import urllib.request
+import zipfile
+from pathlib import Path
+from typing import List, Optional, Tuple
+
+from backends import common
+
+RELEASES_API_URL = \
+    "https://api.github.com/repos/0xShug0/audio.cpp/releases/latest"
+
+# GitHub rejects API/HTTP requests without a User-Agent header.
+USER_AGENT = "tts-audiobook-generator (+https://github.com/0xShug0/audio.cpp)"
+
+API_TIMEOUT = 30
+
+# The CUDA runtime variant selected when the driver version cannot be
+# detected: CUDA 12.4 runs on the widest range of installed drivers.
+DEFAULT_CUDA_VARIANT = "12.4"
+
+# nvidia-smi driver major version from which the CUDA 13.x builds run.
+CUDA_13_MIN_DRIVER = 580
+
+_ASSET_RE = re.compile(
+    r"^audio-v[^/]+-bin-(?P<platform>macos|windows)-(?P<arch>arm64|x64)"
+    r"-(?P<variant>[a-z0-9.]+)\.(?P<ext>tar\.gz|zip)$")
+
+_CUDART_RE = re.compile(
+    r"^audio-v[^/]+-cudart-windows-x64-cuda(?P<variant>[a-z0-9.]+)\.zip$")
+
+# Download progress reporting: emit a line at most every 4 MiB.
+_REPORT_STEP = 4 * 1024 * 1024
+
+
+def prebuilt_supported(backend: Optional[str], *,
+                       platform: Optional[str] = None) -> bool:
+    """Whether a prebuilt release asset can exist for PLATFORM/BACKEND.
+
+    Pure metadata (no network): macOS releases exist for the ``cpu``
+    backend only (Metal is recorded as ``cpu``), Windows releases exist
+    for ``cpu``, ``vulkan``, and ``cuda`` (HIP has no release asset and
+    keeps building from source), and no other platform ships prebuilt
+    binaries — Linux keeps using ``build_linux.sh``.
+    """
+    if platform is None:
+        platform = sys.platform
+    if platform == "darwin":
+        return backend == "cpu"
+    if platform == "win32":
+        return backend in ("cpu", "vulkan", "cuda")
+    return False
+
+
+def _arch_token(machine: Optional[str] = None) -> Optional[str]:
+    """The release asset's arch token for this machine, or None."""
+    if machine is None:
+        machine = _platform.machine()
+    machine = machine.lower()
+    if machine in ("arm64", "aarch64"):
+        return "arm64"
+    if machine in ("x86_64", "amd64"):
+        return "x64"
+    return None
+
+
+def _platform_token(platform: Optional[str] = None) -> Optional[str]:
+    if platform is None:
+        platform = sys.platform
+    if platform == "darwin":
+        return "macos"
+    if platform == "win32":
+        return "windows"
+    return None
+
+
+def _default_cuda_variant() -> str:
+    """The CUDA runtime variant to download, from the installed driver.
+
+    ``nvidia-smi`` reports the driver version; CUDA 13.x builds need a
+    580+ driver, older (or undetectable) drivers get the CUDA 12.4 build.
+    """
+    try:
+        proc = common.run_console_subprocess_quiet(
+            ["nvidia-smi", "--query-gpu=driver_version",
+             "--format=csv,noheader"], timeout=10)
+    except Exception:
+        return DEFAULT_CUDA_VARIANT
+    if proc is None or proc.returncode != 0:
+        return DEFAULT_CUDA_VARIANT
+    for line in proc.stdout.decode("utf-8", errors="replace").splitlines():
+        major = line.strip().split(".")[0]
+        if major.isdigit():
+            return "13.3" if int(major) >= CUDA_13_MIN_DRIVER \
+                else DEFAULT_CUDA_VARIANT
+    return DEFAULT_CUDA_VARIANT
+
+
+def install_dir(audiocpp_dir: Path, backend: Optional[str], *,
+                platform: Optional[str] = None) -> Optional[Path]:
+    """The ``bin`` directory a prebuilt install for BACKEND lands in.
+
+    Mirrors the source-build directory names so backend detection and
+    binary discovery keep working: ``build/macos-metal-release/bin`` on
+    macOS and ``build/windows-<backend>-release/bin`` on Windows. None
+    when the platform/backend has no prebuilt asset (see
+    ``prebuilt_supported``).
+    """
+    token = _platform_token(platform)
+    if token == "macos":
+        if backend != "cpu":
+            return None
+        return audiocpp_dir / "build" / "macos-metal-release" / "bin"
+    if token == "windows":
+        if backend not in ("cpu", "vulkan", "cuda"):
+            return None
+        return (audiocpp_dir / "build"
+                / f"windows-{backend}-release" / "bin")
+    return None
+
+
+def marker_path(audiocpp_dir: Path, backend: Optional[str], *,
+                platform: Optional[str] = None) -> Optional[Path]:
+    """The ``prebuilt.json`` marker path for this install, or None."""
+    bin_dir = install_dir(audiocpp_dir, backend, platform=platform)
+    if bin_dir is None:
+        return None
+    return bin_dir.parent / "prebuilt.json"
+
+
+def installed_release(audiocpp_dir: Path, backend: Optional[str], *,
+                      platform: Optional[str] = None) -> Optional[dict]:
+    """What prebuilt release is installed for BACKEND, or None.
+
+    Reads the ``prebuilt.json`` marker written by ``install_prebuilt``
+    (``{"tag", "asset", "sha256", "installed_at"}``). Any unreadable or
+    missing marker means "not a prebuilt install" — a source build lives
+    there instead and ``update()`` keeps rebuilding it.
+    """
+    path = marker_path(audiocpp_dir, backend, platform=platform)
+    if path is None or not path.is_file():
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    if not isinstance(data, dict) or not data.get("tag"):
+        return None
+    return data
+
+
+def fetch_latest_release(*, timeout: int = API_TIMEOUT) -> Optional[dict]:
+    """The latest audio.cpp GitHub release (API JSON), or None.
+
+    Unauthenticated requests suffice (60/hour); callers treat None as
+    "cannot check right now" and keep whatever is installed.
+    """
+    request = urllib.request.Request(
+        RELEASES_API_URL,
+        headers={"User-Agent": USER_AGENT,
+                 "Accept": "application/vnd.github+json"})
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return json.loads(response.read().decode("utf-8"))
+    except (OSError, ValueError) as exc:
+        print(f"[ERROR] Could not reach {RELEASES_API_URL}: {exc}")
+        return None
+
+
+def select_assets(assets: List[dict], backend: Optional[str], *,
+                  platform: Optional[str] = None,
+                  machine: Optional[str] = None,
+                  cuda_variant: Optional[str] = None
+                  ) -> Optional[Tuple[dict, Optional[dict]]]:
+    """Pick the release assets for this machine and BACKEND.
+
+    Returns ``(main, extra)`` — the server binary archive plus the CUDA
+    runtime DLL archive when BACKEND is ``cuda`` — or None when no asset
+    matches (unsupported platform, HIP, an unexpected arch). The CUDA
+    variant defaults to the driver-appropriate one (``_default_cuda_variant``).
+    """
+    token = _platform_token(platform)
+    arch = _arch_token(machine)
+    if token is None or arch is None or not prebuilt_supported(
+            backend, platform=platform):
+        return None
+    variant: Optional[str]
+    cuda: Optional[str] = None
+    if token == "macos":
+        variant = "metal"
+    elif backend == "cuda":
+        # The binary asset names carry a "cuda" prefix on the variant
+        # token (``...-bin-windows-x64-cuda12.4.zip``); the cudart asset
+        # names use the bare version (``...-cudart-...-cuda12.4.zip``).
+        cuda = cuda_variant or _default_cuda_variant()
+        variant = "cuda" + cuda
+    else:
+        variant = backend
+    main = _find_asset(assets, token, arch, variant)
+    if main is None:
+        return None
+    extra = None
+    if token == "windows" and backend == "cuda":
+        extra = _find_cudart_asset(assets, cuda or "")
+        if extra is None:
+            return None
+    return main, extra
+
+
+def _find_asset(assets: List[dict], platform_token: str, arch: str,
+                variant: str) -> Optional[dict]:
+    for asset in assets:
+        match = _ASSET_RE.match(str(asset.get("name", "")))
+        if match and match.group("platform") == platform_token \
+                and match.group("arch") == arch \
+                and match.group("variant") == variant:
+            return asset
+    return None
+
+
+def _find_cudart_asset(assets: List[dict], variant: str) -> Optional[dict]:
+    for asset in assets:
+        match = _CUDART_RE.match(str(asset.get("name", "")))
+        if match and match.group("variant") == variant:
+            return asset
+    return None
+
+
+def _download(url: str, dest: Path, *, emit=None, cancel=None) -> int:
+    """Stream URL to DEST with progress lines, honoring CANCEL.
+
+    Returns 0 on success, 130 when cancelled (the partial file is
+    removed), 1 on any network or filesystem error. EMIT receives a
+    progress line at most every 4 MiB (the in-TUI task view sink when
+    set; console paths print nothing until the install summary).
+    """
+    say = emit if emit is not None else print
+    request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    try:
+        with urllib.request.urlopen(request, timeout=API_TIMEOUT) as response:
+            total = response.headers.get("Content-Length")
+            total = int(total) if total else None
+            with dest.open("wb") as fh:
+                downloaded = 0
+                next_report = _REPORT_STEP
+                while True:
+                    if common.cancel_requested(cancel):
+                        fh.close()
+                        dest.unlink(missing_ok=True)
+                        say("[INFO] Download cancelled.")
+                        return 130
+                    chunk = response.read(1 << 20)
+                    if not chunk:
+                        break
+                    fh.write(chunk)
+                    downloaded += len(chunk)
+                    if emit is not None and downloaded >= next_report:
+                        next_report += _REPORT_STEP
+                        if total:
+                            say(f"[INFO] Downloading: "
+                                f"{downloaded / (1 << 20):.1f} / "
+                                f"{total / (1 << 20):.1f} MB "
+                                f"({100 * downloaded // total}%)")
+                        else:
+                            say(f"[INFO] Downloading: "
+                                f"{downloaded / (1 << 20):.1f} MB")
+        if emit is not None:
+            say(f"[INFO] Downloaded {dest.name} "
+                f"({dest.stat().st_size / (1 << 20):.1f} MB).")
+        return 0
+    except urllib.error.HTTPError as exc:
+        print(f"[ERROR] Download failed ({exc.code} {exc.reason}): {url}")
+        dest.unlink(missing_ok=True)
+        return 1
+    except OSError as exc:
+        print(f"[ERROR] Download failed: {exc}")
+        dest.unlink(missing_ok=True)
+        return 1
+
+
+def _sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as fh:
+        for chunk in iter(lambda: fh.read(1 << 20), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _verify_checksum(path: Path, asset: dict, *, emit=None) -> bool:
+    """Verify PATH against the asset's published sha256 digest.
+
+    The GitHub API publishes ``digest: "sha256:<hex>"``; a missing digest
+    only warns (older releases), a mismatched one fails the install.
+    """
+    expected = str(asset.get("digest") or "")
+    if not expected.startswith("sha256:"):
+        print(f"[WARNING] {path.name} has no published checksum; "
+              "skipping verification")
+        return True
+    actual = _sha256(path)
+    if actual != expected[len("sha256:"):]:
+        (emit if emit is not None else print)(
+            f"[ERROR] {path.name}: checksum mismatch "
+            f"(expected {expected}, got sha256:{actual}); not installing "
+            "a tampered or corrupted download.")
+        return False
+    (emit if emit is not None else print)(
+        f"[OK] {path.name}: checksum verified.")
+    return True
+
+
+def _validate_member(name: str) -> str:
+    """Normalize an archive member name; raise ValueError on traversal."""
+    normalized = name.replace("\\", "/")
+    path = Path(normalized)
+    if path.is_absolute() or ".." in path.parts or path.drive:
+        raise ValueError(f"unsafe archive member: {name!r}")
+    return normalized
+
+
+def _extract(archive: Path, dest: Path, *, emit=None) -> None:
+    """Extract a release archive into DEST (tar.gz or zip, safely)."""
+    say = emit if emit is not None else print
+    say(f"[INFO] Extracting {archive.name} into {dest}...")
+    if tarfile.is_tarfile(archive):
+        with tarfile.open(archive) as tf:
+            try:
+                tf.extractall(dest, filter="data")
+            except TypeError:  # Python < 3.12: no filter= parameter
+                for member in tf.getmembers():
+                    _validate_member(member.name)
+                tf.extractall(dest)
+        return
+    with zipfile.ZipFile(archive) as zf:
+        for name in zf.namelist():
+            _validate_member(name)
+        zf.extractall(dest)
+
+
+def _sync_checkout_to_release(checkout: Path, tag: str, *,
+                              emit=None, cancel=None) -> None:
+    """Point the checkout's tracked files at the installed release tag.
+
+    The prebuilt binary embeds the release tag's model-spec catalog; the
+    wizard reads model_specs/ and runs tools/model_manager_v2.py from the
+    checkout, so detaching to the same tag keeps the tooling, the model
+    catalog, and the binary consistent. Non-fatal: a failure (offline
+    fetch, local edits) leaves the checkout on its current commit — the
+    binary still works, worst case the model list drifts slightly from
+    what the binary knows.
+    """
+    fetch_rc = common.run_console_subprocess(
+        ["git", "-C", str(checkout), "fetch", "--tags", "origin"],
+        emit=emit, cancel=cancel)
+    if fetch_rc != 0:
+        print(f"[WARNING] Could not fetch audio.cpp tags (exit {fetch_rc}); "
+              f"the checkout stays on its current commit (binary is {tag}).")
+        return
+    detach_rc = common.run_console_subprocess(
+        ["git", "-C", str(checkout), "checkout", "--detach", tag],
+        emit=emit, cancel=cancel)
+    if detach_rc != 0:
+        print(f"[WARNING] Could not check out {tag} (exit {detach_rc}); "
+              "the checkout's model catalog may differ from the binary's.")
+
+
+def _ensure_executables(bin_dir: Path) -> None:
+    """Make the extracted binaries executable (POSIX only).
+
+    GitHub's artifact round-trip does not preserve tar permission bits,
+    so the released binaries can land mode 644; the hub launches
+    ``audiocpp_server`` directly, which then fails with EACCES. Every
+    extension-less ``audiocpp_*`` entry in the bin directory (server,
+    cli, gguf converter) gets the exec bits; data files (metallib,
+    model_specs/, tools/) are untouched.
+    """
+    if os.name != "posix":
+        return
+    for entry in bin_dir.iterdir():
+        if entry.is_file() and not entry.suffix \
+                and entry.name.startswith("audiocpp_"):
+            entry.chmod(entry.stat().st_mode | 0o111)
+
+
+def install_prebuilt(audiocpp_dir: Path, backend: Optional[str], *,
+                     emit=None, cancel=None,
+                     cuda_variant: Optional[str] = None) -> int:
+    """Download and install the latest prebuilt audiocpp_server for BACKEND.
+
+    Fetches the latest release, picks this machine's asset(s), downloads
+    them to a temp directory, verifies the published sha256 digests, then
+    extracts into ``build/<dir>/bin/`` (replacing any previous content —
+    including a source build there), syncs the checkout to the release
+    tag, and writes the ``prebuilt.json`` marker. Streaming output and
+    cancellation behave like the other install steps. Returns 0 on
+    success, 130 when cancelled, 1 on any failure.
+    """
+    say = emit if emit is not None else print
+    bin_dir = install_dir(audiocpp_dir, backend)
+    if bin_dir is None:
+        print(f"[ERROR] No prebuilt audiocpp_server asset exists for "
+              f"{backend!r} on this platform; build from source instead.")
+        return 1
+    say("[INFO] Checking the latest audio.cpp release...")
+    release = fetch_latest_release()
+    if release is None:
+        return 1
+    tag = str(release.get("tag_name") or "?")
+    pair = select_assets(release.get("assets") or [], backend,
+                         cuda_variant=cuda_variant)
+    if pair is None:
+        print(f"[ERROR] No prebuilt audiocpp_server asset for "
+              f"{backend!r} in release {tag}; build from source instead.")
+        return 1
+    main, extra = pair
+    existing = installed_release(audiocpp_dir, backend)
+    if existing and existing.get("tag") == tag \
+            and existing.get("asset") == main.get("name"):
+        say(f"[OK] Prebuilt audiocpp_server is already {tag}.")
+        return 0
+
+    tmp = Path(tempfile.mkdtemp(prefix="audiocpp-prebuilt-"))
+    try:
+        downloads: List[Tuple[dict, Path]] = []
+        for asset in (main, extra):
+            if asset is None:
+                continue
+            dest = tmp / str(asset.get("name"))
+            say(f"[INFO] Downloading {asset.get('name')} "
+                f"({int(asset.get('size') or 0) / (1 << 20):.1f} MB) "
+                f"from release {tag}...")
+            rc = _download(str(asset.get("browser_download_url")), dest,
+                           emit=emit, cancel=cancel)
+            if rc != 0:
+                return rc
+            downloads.append((asset, dest))
+        for asset, dest in downloads:
+            if not _verify_checksum(dest, asset, emit=emit):
+                return 1
+        if common.cancel_requested(cancel):
+            say("[INFO] Download cancelled.")
+            return 130
+        build_dir = bin_dir.parent
+        if build_dir.is_dir():
+            shutil.rmtree(build_dir, ignore_errors=True)
+        bin_dir.mkdir(parents=True, exist_ok=True)
+        for _asset, dest in downloads:
+            _extract(dest, bin_dir, emit=emit)
+        _ensure_executables(bin_dir)
+        marker = {
+            "tag": tag,
+            "asset": main.get("name"),
+            "sha256": str(main.get("digest") or ""),
+            "installed_at": time.strftime("%Y-%m-%dT%H:%M:%SZ",
+                                          time.gmtime()),
+        }
+        (build_dir / "prebuilt.json").write_text(
+            json.dumps(marker, indent=2) + "\n", encoding="utf-8")
+        if sys.platform == "darwin" \
+                and _arch_token() == "x64":
+            say("[INFO] Note: upstream's Intel macOS release is built "
+                "without Metal (CI limitation); it runs on CPU.")
+        say(f"[OK] audiocpp_server {tag} installed at {bin_dir}.")
+        _sync_checkout_to_release(audiocpp_dir, tag, emit=emit, cancel=cancel)
+        return 0
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
diff --git a/app/backends/audiocpp/wizard.py b/app/backends/audiocpp/wizard.py
index 6d2d33a..5b237c4 100644
--- a/app/backends/audiocpp/wizard.py
+++ b/app/backends/audiocpp/wizard.py
@@ -24,6 +24,7 @@ from ui import taskview, tui
 from . import build as _build
 from . import configsync as _configsync
 from . import models as _models
+from . import prebuilt as _prebuilt
 from . import voices as _voices
 from .catalog import (_backend_options, build_model_entry,
                       build_server_config, detect_backend,
@@ -35,6 +36,22 @@ from .constants import (AUDIOCPP_DIR_NAME, AUDIOCPP_GIT_URL, BACKENDS,
 _GO_BACK = object()
 
 
+def _flag_build_mode(args: argparse.Namespace, backend: str) -> str:
+    """Resolve the ``--prebuilt`` flag into a concrete build mode.
+
+    ``auto`` (the default) downloads the prebuilt release when this
+    platform/backend has one and otherwise builds from source; ``yes``
+    forces the download, ``no`` forces the source build. Only consulted
+    when a build/install is actually pending.
+    """
+    choice = getattr(args, "prebuilt", "auto")
+    if choice == "no":
+        return "source"
+    if choice == "yes" or _prebuilt.prebuilt_supported(backend):
+        return "prebuilt"
+    return "source"
+
+
 class _GoBack(Exception):
     """Internal signal: Esc was pressed inside one of a screen's sub-prompts.
 
@@ -285,6 +302,7 @@ def _wizard(stdscr, args: argparse.Namespace, parser: argparse.ArgumentParser
             "port": port,
             "backend": backend,
             "build": build,
+            "build_mode": s.get("build_mode"),
             "lazy_load": True,
             "sync_port": None,
             "wav_dir": s["wav_dir"],
@@ -351,9 +369,25 @@ def _wizard(stdscr, args: argparse.Namespace, parser: argparse.ArgumentParser
         # the build row — honor that by re-checking at apply time.
         if s["backend"] is None:
             s["backend"] = result["backend"]
-            s["build"] = bool(result.get("build")) and (
-                _build.built_server_binary(s["audiocpp_dir"],
-                                           s["backend"]) is None)
+            if _build.built_server_binary(s["audiocpp_dir"],
+                                          s["backend"]) is not None:
+                s["build"] = False
+                s["build_mode"] = None
+            else:
+                # The form reports every field's value, including hidden
+                # ones, so the mode is chosen by whether this backend has
+                # a prebuilt asset at all — not by which field was shown.
+                # Only the visible field's answer is meaningful: the
+                # choice field when a prebuilt asset exists, otherwise the
+                # plain build question.
+                if _prebuilt.prebuilt_supported(s["backend"]):
+                    mode = result.get("build_mode")
+                    if mode not in ("prebuilt", "source", "skip"):
+                        mode = "prebuilt"
+                else:
+                    mode = "source" if bool(result.get("build")) else "skip"
+                s["build_mode"] = mode
+                s["build"] = mode in ("prebuilt", "source")
 
         # Clone-voice directory: only meaningful for clone-capable picks.
         if args.input_dir is not None:
@@ -409,16 +443,21 @@ def _wizard(stdscr, args: argparse.Namespace, parser: argparse.ArgumentParser
         if args.build_backend is not None:
             s["backend"] = args.build_backend
             s["build"] = s["detected_backend"] is None
+            s["build_mode"] = _flag_build_mode(args, s["backend"]) \
+                if s["build"] else None
         elif args.backend is not None:
             s["backend"] = args.backend
             s["build"] = False
+            s["build_mode"] = None
         elif s["detected_backend"] is not None:
             # Already built: use the detected backend, no menu, no build.
             s["backend"] = s["detected_backend"]
             s["build"] = False
+            s["build_mode"] = None
         else:
             s["backend"] = None  # decided by the form
             s["build"] = None
+            s["build_mode"] = None
 
         # Clone-voice directory seed: the voice_dir recorded by the
         # server.json being modified, else the project voices/ dir (the
@@ -452,10 +491,30 @@ def _wizard(stdscr, args: argparse.Namespace, parser: argparse.ArgumentParser
                 "kind": "choice", "value": default_backend,
                 "choices": options,
             })
+            # How to get the binary: macOS and Windows have upstream
+            # release binaries (no toolchain needed — see
+            # backends.audiocpp.prebuilt), everything else builds from
+            # source. HIP on Windows has no release asset, so it keeps
+            # the plain build question.
+            fields.append({
+                "key": "build_mode",
+                "label": "Get audiocpp_server",
+                "kind": "choice", "value": "prebuilt",
+                "choices": [
+                    ("Download prebuilt server (recommended)", "prebuilt"),
+                    ("Build from source", "source"),
+                    ("Skip for now", "skip"),
+                ],
+                "visible": lambda fs: (
+                    needs_build(fs) and _prebuilt.prebuilt_supported(
+                        _field_val(fs, "backend", default_backend))),
+            })
             fields.append({
                 "key": "build", "label": "Build audiocpp_server now?",
                 "kind": "bool", "value": True,
-                "visible": needs_build,
+                "visible": lambda fs: (
+                    needs_build(fs) and not _prebuilt.prebuilt_supported(
+                        _field_val(fs, "backend", default_backend))),
             })
 
         wav_field = {
@@ -514,15 +573,15 @@ def _wizard(stdscr, args: argparse.Namespace, parser: argparse.ArgumentParser
     audiocpp_dir = _build.find_local_checkout()
     if audiocpp_dir is None:
         target = APP_DIR / AUDIOCPP_DIR_NAME
+        # The ggml build patches are deliberately NOT applied here: they
+        # belong to the source-build path (build_audiocpp applies them
+        # right before building), and a prebuilt install checks out the
+        # release tag, which the patches may not fit.
         rc = taskview.run_steps(stdscr, "Clone audio.cpp", [
             taskview.TaskStep(
                 f"Cloning audio.cpp into {target}",
                 lambda emit, cancel: common.git_clone(
                     AUDIOCPP_GIT_URL, target, emit=emit, cancel=cancel)),
-            taskview.TaskStep(
-                "Apply ggml build patches",
-                lambda emit, cancel: _build.apply_ggml_patches(
-                    target, emit=emit, cancel=cancel)),
         ])
         if rc == 130:
             # Cancelled from the task view: abort the wizard quietly.
@@ -544,10 +603,12 @@ def _execute_lanes(settings: dict,
 
     The same work ``_execute`` runs on the console, split into two lanes so
     the view can run the build in one pane while configuring and downloading
-    models in the other (both progress bars visible at once). The build lane
-    exists only when ``settings["build"]`` is set; the models lane always
-    exists (transcribe → write server.json → download/print commands).
-    Shared results (the transcription mapping) travel through a small closure
+    models in the other (both progress bars visible at once). The install
+    lane exists only when ``settings["build"]`` is set: it downloads the
+    prebuilt release (``settings["build_mode"] == "prebuilt"``) or builds
+    from source, per the user's choice. The models lane always exists
+    (transcribe → write server.json → download/print commands). Shared
+    results (the transcription mapping) travel through a small closure
     dict scoped to the models lane. Each step's ``work(emit, cancel)``
     returns its exit code; subprocess steps stream through EMIT and abort on
     CANCEL, while print()-based steps are captured by the view's stdout
@@ -559,25 +620,44 @@ def _execute_lanes(settings: dict,
     lanes: List[taskview.TaskLane] = []
 
     if build:
-        def build_step(emit, cancel):
-            rc = _build.build_audiocpp(audiocpp_dir, settings["backend"],
-                                emit=emit, cancel=cancel)
-            if rc == 124:
-                print("[WARNING] build went silent and was stopped; the "
-                      "server.json was still written — build "
-                      "audiocpp_server manually before starting it")
-            elif rc != 0:
-                print(f"[WARNING] build exited with code {rc}; the server.json "
-                      "was still written — build audiocpp_server manually "
-                      "before starting it")
-            else:
-                print("[OK] build complete")
-            return rc
+        mode = settings.get("build_mode") or "source"
+        if mode == "prebuilt":
+            def build_step(emit, cancel):
+                rc = _prebuilt.install_prebuilt(
+                    audiocpp_dir, settings["backend"],
+                    emit=emit, cancel=cancel)
+                if rc == 130:
+                    return rc
+                if rc != 0:
+                    print(f"[WARNING] prebuilt download failed (exit {rc}); "
+                          "the server.json was still written — build "
+                          "audiocpp_server from source ('Build audio.cpp "
+                          "Server', or re-run with --prebuilt no) before "
+                          "starting it")
+                else:
+                    print("[OK] prebuilt audiocpp_server installed")
+                return rc
+            build_title = (f"Download prebuilt audiocpp_server "
+                           f"({settings['backend']})")
+        else:
+            def build_step(emit, cancel):
+                rc = _build.build_audiocpp(audiocpp_dir, settings["backend"],
+                                    emit=emit, cancel=cancel)
+                if rc == 124:
+                    print("[WARNING] build went silent and was stopped; the "
+                          "server.json was still written — build "
+                          "audiocpp_server manually before starting it")
+                elif rc != 0:
+                    print(f"[WARNING] build exited with code {rc}; the "
+                          "server.json was still written — build "
+                          "audiocpp_server manually before starting it")
+                else:
+                    print("[OK] build complete")
+                return rc
+            build_title = f"Build audiocpp_server ({settings['backend']})"
         lanes.append(taskview.TaskLane(
             "Build",
-            [taskview.TaskStep(
-                f"Build audiocpp_server ({settings['backend']})",
-                build_step)]))
+            [taskview.TaskStep(build_title, build_step)]))
 
     def transcribe(emit, cancel):
         args.input_dir = settings["wav_dir"]
@@ -703,18 +783,22 @@ def setup_screen(stdscr) -> int:
 
 
 def build_screen(stdscr) -> int:
-    """Build audiocpp_server from the hub when the checkout has no binary.
-
-    Asks which backend to build for (pre-selecting the backend an existing
-    server.json records, else cuda), runs the build inside the TUI task view
-    — alongside a download of any missing models when server.json is already
-    configured and those models map to an install command (the split view),
-    or just the build otherwise — then updates server.json's ``backend``
-    field to match. Returns 0 on success, non-zero when the user backed out,
-    cancelled, or the build failed. This is the hub's "Build audio.cpp
-    server" action, so a checkout that was cloned but never built is always
-    buildable from the TUI; the standalone "Download Missing Models" action
-    stays as the fallback when the download fails or is interrupted.
+    """Install audiocpp_server from the hub when the checkout has none.
+
+    Asks which backend to install for (pre-selecting the backend an
+    existing server.json records, else cuda), then — where a prebuilt
+    release asset exists (macOS and Windows, see
+    ``backends.audiocpp.prebuilt``) — whether to download it or build
+    from source. The chosen action runs inside the TUI task view —
+    alongside a download of any missing models when server.json is
+    already configured and those models map to an install command (the
+    split view), or alone otherwise — then updates server.json's
+    ``backend`` field to match. Returns 0 on success, non-zero when the
+    user backed out, cancelled, or the install failed. This is the hub's
+    "Build audio.cpp Server" action, so a checkout that was cloned but
+    never built is always installable from the TUI; the standalone
+    "Download Missing Models" action stays as the fallback when a model
+    download fails or is interrupted.
     """
     checkout = _build.find_local_checkout()
     if checkout is None:
@@ -736,12 +820,28 @@ def build_screen(stdscr) -> int:
     if backend is _GO_BACK:
         return 1
 
+    mode = "source"
+    if _prebuilt.prebuilt_supported(backend):
+        mode = tui.menu(
+            stdscr, "Install audiocpp_server:",
+            [("Download prebuilt server from GitHub releases "
+              "(recommended)", "prebuilt"),
+             ("Build from source", "source")],
+            default_index=0, back_value=_GO_BACK)
+        if mode is _GO_BACK:
+            return 1
+
     def build_step(emit, cancel):
-        return _build.build_audiocpp(checkout, backend, emit=emit, cancel=cancel)
+        if mode == "prebuilt":
+            return _prebuilt.install_prebuilt(checkout, backend,
+                                              emit=emit, cancel=cancel)
+        return _build.build_audiocpp(checkout, backend, emit=emit,
+                                     cancel=cancel)
 
-    lanes = [taskview.TaskLane(
-        "Build", [taskview.TaskStep(
-            f"Build audiocpp_server ({backend})", build_step)])]
+    action = "Download prebuilt audiocpp_server" if mode == "prebuilt" \
+        else f"Build audiocpp_server ({backend})"
+    lanes = [taskview.TaskLane("Build", [taskview.TaskStep(action,
+                                                           build_step)])]
 
     # Missing models this build can also fetch, so a configured backend that
     # lost its binary is restored to "installed" in one step.
@@ -758,13 +858,16 @@ def build_screen(stdscr) -> int:
             "Download models",
             [taskview.TaskStep("Download missing models", download_step)]))
 
-    title = "Build & download models" if len(lanes) == 2 \
-        else "Build audiocpp_server"
+    install_title = ("Download prebuilt audiocpp_server"
+                     if mode == "prebuilt" else "Build audiocpp_server")
+    title = f"{install_title} & download models" if len(lanes) == 2 \
+        else install_title
     rc = taskview.run_lanes(stdscr, title, lanes)
     if rc != 0:
         return rc
     if not _configsync.update_server_backend(backend):
-        tui.flash(stdscr, f"audiocpp_server built for {backend}. (Could not "
+        verb = "installed" if mode == "prebuilt" else "built"
+        tui.flash(stdscr, f"audiocpp_server {verb} for {backend}. (Could not "
                   "update server.json's backend field — reconfigure audio.cpp "
                   "if it was already configured.)", "warn")
     # Models that can't be mapped to an install command still need hand
@@ -818,6 +921,8 @@ def _collect_from_flags(args: argparse.Namespace,
     default-location fallback then also exists).
     """
     # Checkout: ./app/audio.cpp, else --clone clones one there.
+    # (The ggml build patches are applied by build_audiocpp itself, so a
+    # prebuilt install never needs them.)
     audiocpp_dir = _build.find_local_checkout()
     if audiocpp_dir is None and args.clone:
         target = APP_DIR / AUDIOCPP_DIR_NAME
@@ -825,13 +930,6 @@ def _collect_from_flags(args: argparse.Namespace,
         if rc != 0:
             parser.error(f"git clone failed (exit {rc}); clone audio.cpp "
                          f"manually: git clone {AUDIOCPP_GIT_URL} {target}")
-        patch_rc = _build.apply_ggml_patches(target)
-        if patch_rc != 0:
-            parser.error(
-                f"ggml build patches could not be applied to {target} "
-                f"(exit {patch_rc}); see messages above. The audio.cpp "
-                f"fork's vendored ggml may have changed — re-evaluate "
-                f"app/backends/patches/.")
         audiocpp_dir = target
     if audiocpp_dir is None:
         parser.error(
@@ -895,6 +993,10 @@ def _collect_from_flags(args: argparse.Namespace,
     else:
         backend = "cuda"
         build = False
+    # How a pending install happens: the prebuilt release by default on
+    # macOS/Windows (``--prebuilt no`` forces the source build), always
+    # the source build elsewhere.
+    build_mode = _flag_build_mode(args, backend) if build else None
     port = _configsync.config_port()
     lazy_load = True
 
@@ -936,6 +1038,7 @@ def _collect_from_flags(args: argparse.Namespace,
         "port": port,
         "backend": backend,
         "build": build,
+        "build_mode": build_mode,
         "lazy_load": lazy_load,
         "sync_port": None,
         "wav_dir": wav_dir,
@@ -981,6 +1084,13 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--build-backend", choices=BACKENDS, default=None,
                         help="Build audiocpp_server for this backend when it "
                              "is not built yet, and use it in server.json")
+    parser.add_argument("--prebuilt", choices=("auto", "yes", "no"),
+                        default="auto",
+                        help="How to install audiocpp_server when it is "
+                             "missing: auto downloads the prebuilt release "
+                             "on macOS/Windows and builds from source "
+                             "elsewhere; yes forces the prebuilt download; "
+                             "no forces a source build")
     parser.add_argument("--whisper-model", type=str, default="base",
                         help="Whisper model size for transcription "
                              "(default: base)")