.cargo/config.toml

@@ -0,0 +1,11 @@
+# Portable x86_64 codegen (SSE2 baseline). Do not set target-cpu=native.
+# AVX kernels belong in CPU-dispatched libraries (Microsoft ONNX Runtime),
+# not in the Rust binary itself.
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "target-cpu=x86-64"]
+
+[target.x86_64-apple-darwin]
+rustflags = ["-C", "target-cpu=x86-64"]
+
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "target-cpu=x86-64"]

Makefile

@@ -154,5 +154,6 @@ dev-api: ## Run lazyboy-api on the host (terminal 2)
 	 export API_BIND="$${API_BIND:-0.0.0.0:3101}"; \
 	 export LAZYBOY_WEB_DIR="$${LAZYBOY_WEB_DIR:-$$PWD/$(WEB_DIR)}"; \
 	 mkdir -p "$$DATA_DIR"; \
+	 export ORT_DYLIB_PATH="$${ORT_DYLIB_PATH:-$$(./scripts/fetch-onnxruntime.sh "$$DATA_DIR/onnxruntime")}"; \
 	 echo "starting api on $$API_BIND (web dir $$LAZYBOY_WEB_DIR)"; \
 	 exec cargo run -p lazyboy-api

crates/api/Cargo.toml

@@ -32,7 +32,7 @@ tokio-tungstenite.workspace = true
 futures-util = "0.3"
 http-body-util = "0.1"
 dotenvy = "0.15"
-fastembed = "6.0.2"
+fastembed = { version = "6.0.2", default-features = false, features = ["hf-hub-rustls-tls", "ort-load-dynamic"] }
 rmcp = { version = "3.2", default-features = false, features = ["client", "transport-child-process", "transport-streamable-http-client-reqwest"] }
 http = "1"
 aes-gcm = "0.10"

docker-compose.yml

@@ -102,6 +102,7 @@ services:
       LAZYBOY_DB_WARN_MB: ${LAZYBOY_DB_WARN_MB:-1024}
       LAZYBOY_WEB_DIR: /web
       LAZYBOY_SCREEN_UPSTREAM: host.docker.internal
+      ORT_DYLIB_PATH: /usr/local/lib/libonnxruntime.so
     ports:
       - "${LAZYBOY_BIND_IP:-127.0.0.1}:3101:3100"
     volumes:

image/api/Dockerfile

@@ -23,6 +23,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 FROM rust:1-trixie AS build
 WORKDIR /src
 COPY Cargo.toml Cargo.lock ./
+COPY .cargo .cargo
 COPY crates crates
 COPY migrations migrations
 COPY apps/web/vnc.html apps/web/vnc.html
@@ -30,10 +31,19 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/src/target,id=lazyboy-api-release,sharing=locked \
     cargo build --locked --release -p lazyboy-api && cp /src/target/release/lazyboy-api /lazyboy-api
 
+FROM debian:trixie-slim AS onnxruntime
+ARG TARGETARCH
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/*
+COPY scripts/fetch-onnxruntime.sh /fetch-onnxruntime.sh
+RUN chmod +x /fetch-onnxruntime.sh \
+    && TARGETARCH="${TARGETARCH}" /fetch-onnxruntime.sh /opt/onnxruntime
+
 FROM debian:trixie-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates python3 python3-lxml \
+        ca-certificates python3 python3-lxml libstdc++6 \
     && rm -rf /var/lib/apt/lists/*
+COPY --from=onnxruntime /opt/onnxruntime/lib/ /usr/local/lib/
 COPY --from=web /usr/local/bin/node /usr/local/bin/node
 COPY --from=web /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
 COPY --from=python /opt/python /opt/python
@@ -51,7 +61,8 @@ RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
     && node -v && npx --version \
     && PYTHONPATH=/opt/python python3 -c "import mcp_server_fetch"
 ENV LAZYBOY_WEB_DIR=/web \
-    PYTHONPATH=/opt/python
+    PYTHONPATH=/opt/python \
+    ORT_DYLIB_PATH=/usr/local/lib/libonnxruntime.so
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false
 ENV NPM_CONFIG_FUND=false
 RUN useradd --create-home --uid 1000 lazyboy

image/supervisor/Dockerfile

@@ -2,6 +2,7 @@
 FROM rust:1-bookworm AS build
 WORKDIR /src
 COPY Cargo.toml Cargo.lock ./
+COPY .cargo .cargo
 COPY crates crates
 COPY migrations migrations
 RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \

scripts/fetch-onnxruntime.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Download Microsoft's CPU-dispatched ONNX Runtime (not pyke's AVX2-static build).
+# Usage: fetch-onnxruntime.sh [DEST_DIR]
+set -euo pipefail
+
+VERSION="${ORT_VERSION:-1.24.1}"
+DEST="${1:-}"
+if [ -z "$DEST" ]; then
+  DEST="${DATA_DIR:-./data}/onnxruntime"
+fi
+
+os_raw="${TARGETOS:-$(uname -s | tr '[:upper:]' '[:lower:]')}"
+arch_raw="${TARGETARCH:-$(uname -m)}"
+
+case "$os_raw" in
+  linux|darwin|macos) ;;
+  *) echo "unsupported OS: $os_raw" >&2; exit 1 ;;
+esac
+[ "$os_raw" = macos ] && os_raw=darwin
+
+case "$arch_raw" in
+  amd64|x86_64|x64) arch_raw=x86_64 ;;
+  arm64|aarch64) arch_raw=aarch64 ;;
+esac
+
+if [ "$os_raw" = linux ]; then
+  if [ "$arch_raw" = x86_64 ]; then
+    artifact="onnxruntime-linux-x64-${VERSION}.tgz"
+    sha256="9142552248b735920f9390027e4512a2cacf8946a1ffcbe9071a5c210531026f"
+  elif [ "$arch_raw" = aarch64 ]; then
+    artifact="onnxruntime-linux-aarch64-${VERSION}.tgz"
+    sha256="0f56edd68f7602df790b68b874a46b115add037e88385c6c842bb763b39b9f89"
+  else
+    echo "unsupported Linux arch: $arch_raw" >&2
+    exit 1
+  fi
+  dylib_glob="libonnxruntime.so*"
+elif [ "$os_raw" = darwin ]; then
+  if [ "$arch_raw" = aarch64 ]; then
+    artifact="onnxruntime-osx-arm64-${VERSION}.tgz"
+  else
+    artifact="onnxruntime-osx-universal2-${VERSION}.tgz"
+  fi
+  sha256=""
+  dylib_glob="libonnxruntime.dylib"
+else
+  echo "unsupported OS: $os_raw" >&2
+  exit 1
+fi
+
+url="https://github.com/microsoft/onnxruntime/releases/download/v${VERSION}/${artifact}"
+mkdir -p "$DEST"
+stamp="$DEST/.ort-${VERSION}-$(basename "$artifact" .tgz)"
+if [ -f "$stamp" ]; then
+  dylib=$(find "$DEST" -maxdepth 3 \( -name 'libonnxruntime.so.1.*' -o -name 'libonnxruntime.dylib' \) | head -n 1)
+  if [ -n "$dylib" ]; then
+    printf '%s\n' "$dylib"
+    exit 0
+  fi
+fi
+
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' EXIT
+echo "downloading ONNX Runtime ${VERSION} ($artifact)" >&2
+curl -fsSL "$url" -o "$tmp"
+if [ -n "$sha256" ]; then
+  echo "$sha256  $tmp" | sha256sum -c - >&2
+fi
+tar -xzf "$tmp" -C "$DEST" --strip-components=1
+touch "$stamp"
+dylib=$(find "$DEST" -maxdepth 3 \( -name 'libonnxruntime.so.1.*' -o -name 'libonnxruntime.dylib' \) | head -n 1)
+if [ -z "$dylib" ]; then
+  echo "ONNX Runtime dylib missing after extract in $DEST" >&2
+  exit 1
+fi
+printf '%s\n' "$dylib"