Sync from felladrin/MiniSearch@998b6c8

agents.md

@@ -128,7 +128,7 @@ Need to:
 - `client/modules/textToSpeechWorker.ts` - Synthesizes sentences off the main thread
 - `client/modules/textToSpeechWorkerProtocol.ts` - Message types shared by both sides of the worker
 - `client/modules/piper.ts` - The only module that imports `@diffusionstudio/vits-web`
-- `client/modules/speechToText.ts` - Dictation: microphone capture, the worker's lifecycle, and the `SpeechRecognition` fallback
+- `client/modules/speechToText.ts` - Dictation: microphone capture, the worker's lifecycle, and engine selection between the on-device model and `SpeechRecognition`
 - `client/modules/speechToTextWorker.ts` - Runs the Moonshine transcriber off the main thread
 - `client/modules/speechToTextWorkerProtocol.ts` - Message types shared by both sides of the dictation worker
 - `client/modules/moonshine.ts` - The only module that imports `@moonshine-ai/moonshine-wasm`

client/components/Pages/Main/Menu/VoiceSettingsForm.test.tsx

@@ -22,6 +22,7 @@ const { settings, setSettings, listVoices } = vi.hoisted(() => ({
   settings: {
     current: {
       enableDictation: false,
+      enableLocalDictationModel: true,
       selectedVoiceId: "",
       textToSpeechEngine: "local" as "local" | "system",
     },
@@ -72,6 +73,7 @@ beforeEach(() => {
   vi.clearAllMocks();
   settings.current = {
     enableDictation: false,
+    enableLocalDictationModel: true,
     selectedVoiceId: "",
     textToSpeechEngine: "local",
   };
@@ -111,6 +113,32 @@ describe("VoiceSettingsForm", () => {
     ]);
   });
 
+  it("disables the on-device model switch while dictation itself is off", () => {
+    renderForm();
+    expect(
+      screen.getByRole("switch", {
+        name: /On-device dictation model/i,
+      }),
+    ).toBeDisabled();
+  });
+
+  it("persists toggling the on-device dictation model while dictation is on", () => {
+    settings.current.enableDictation = true;
+    renderForm();
+
+    const switchInput = screen.getByRole("switch", {
+      name: /On-device dictation model/i,
+    }) as HTMLInputElement;
+    expect(switchInput).not.toBeDisabled();
+
+    fireEvent.click(switchInput);
+
+    expect(setSettings).toHaveBeenCalledWith(
+      expect.objectContaining({ enableLocalDictationModel: false }),
+      expect.anything(),
+    );
+  });
+
   it("goes back to auto-detection when the engine changes", async () => {
     settings.current.selectedVoiceId = localVoice.value;
     renderForm();

client/components/Pages/Main/Menu/VoiceSettingsForm.tsx

@@ -57,9 +57,18 @@ export default function VoiceSettingsForm() {
       <Switch
         {...form.getInputProps("enableDictation", { type: "checkbox" })}
         label="Dictate the search query"
-        description="Shows a microphone button next to the search field. The speech is transcribed on this device."
+        description="Shows a Dictate button next to the search field. Which engine transcribes the speech is decided by the setting below."
         labelPosition="left"
       />
+      <Switch
+        {...form.getInputProps("enableLocalDictationModel", {
+          type: "checkbox",
+        })}
+        label="On-device dictation model (English-only)"
+        description="Downloads a ~51 MB model on first use and transcribes without the audio leaving this device, but it only understands English. Turn it off to use your browser's built-in speech recognition instead, which handles other languages but may send the audio to your browser vendor. On browsers without built-in speech recognition, the on-device model is used regardless."
+        labelPosition="left"
+        disabled={!settings.enableDictation}
+      />
       <Text size="sm">Speech Engine</Text>
       <Text size="xs" c="dimmed">
         The local engine downloads a small neural voice on the first use and

client/components/Search/Form/DictationButton.test.tsx

@@ -94,6 +94,30 @@ it("hides when the setting is off", async () => {
   }
 });
 
+it("passes the local-model preference through to the engine", async () => {
+  const { settingsPubSub } = await import("@/modules/pubSub");
+  settingsPubSub[0]({
+    ...(settingsPubSub[2]?.() ?? {}),
+    enableLocalDictationModel: false,
+  });
+  try {
+    const user = userEvent.setup();
+    renderButton();
+    await user.click(
+      screen.getByRole("button", { name: "Dictate the search query" }),
+    );
+    await waitFor(() =>
+      expect(startDictation).toHaveBeenCalledWith(expect.anything(), false),
+    );
+    expect(getDictationEngine).toHaveBeenCalledWith(false);
+  } finally {
+    settingsPubSub[0]({
+      ...(settingsPubSub[2]?.() ?? {}),
+      enableLocalDictationModel: true,
+    });
+  }
+});
+
 it("switches to the recording state and stops on the second press", async () => {
   const user = userEvent.setup();
   renderButton();
@@ -102,6 +126,14 @@ it("switches to the recording state and stops on the second press", async () =>
     screen.getByRole("button", { name: "Dictate the search query" }),
   );
 
+  // The mirror of the `false` case above: the pubsub holds a literal
+  // `true` restored by that test's finally block, so a hardcoded `false`
+  // at the forwarding sites fails here. The en-US derivation itself is
+  // pinned in settings.test.ts.
+  await waitFor(() =>
+    expect(startDictation).toHaveBeenCalledWith(expect.anything(), true),
+  );
+
   await waitFor(() =>
     expect(
       screen.getByRole("button", { name: "Stop dictating the search query" }),

client/components/Search/Form/DictationButton.tsx

@@ -1,9 +1,9 @@
 import { Button } from "@mantine/core";
 import { notifications } from "@mantine/notifications";
-import { IconMicrophone } from "@tabler/icons-react";
 import { usePubSub } from "create-pubsub/react";
 import { memo, useCallback, useEffect, useRef, useState } from "react";
 import { settingsPubSub } from "@/modules/pubSub";
+import { prefersLocalDictationModel } from "@/modules/settings";
 import {
   DictationError,
   type DictationSession,
@@ -124,6 +124,15 @@ export default memo(function DictationButton({
     void stop();
   }, [settings.enableDictation, stop]);
 
+  /**
+   * An upgrading profile's stored settings lack this key until `App` merges
+   * the defaults after `/api/config` resolves. Reading it raw would be
+   * falsy in that window and hand the microphone to the vendor recognizer
+   * unnoticed, so the derived default is applied here as well.
+   */
+  const preferLocalModel =
+    settings.enableLocalDictationModel ?? prefersLocalDictationModel();
+
   const handleClick = useCallback(async () => {
     if (sessionRef.current) {
       await stop();
@@ -134,31 +143,34 @@ export default memo(function DictationButton({
     const generation = ++pressGenerationRef.current;
     setPhase("loading");
     try {
-      const session = await startDictation({
-        onTranscript: handleTranscript,
-        onProgress: (loaded, total) => setProgress({ loaded, total }),
-        onFallback: () =>
-          notifications.show({
-            title: "Using the browser's recognizer",
-            message:
-              "The on-device model could not run, so this browser's own speech recognition is transcribing instead. It may send the audio to the browser vendor.",
-            color: "yellow",
-          }),
-        onEnd: () => void stop(),
-        onError: (error) => {
-          const denied = error.kind === "permission";
-          notifications.show({
-            title: denied
-              ? "Microphone permission denied"
-              : "Dictation stopped",
-            message: denied
-              ? "Allow microphone access in the browser settings to dictate a search."
-              : error.message,
-            color: "red",
-          });
-          void stop();
+      const session = await startDictation(
+        {
+          onTranscript: handleTranscript,
+          onProgress: (loaded, total) => setProgress({ loaded, total }),
+          onFallback: () =>
+            notifications.show({
+              title: "Using the browser's recognizer",
+              message:
+                "The on-device model could not run, so this browser's own speech recognition is transcribing instead. It may send the audio to the browser vendor.",
+              color: "yellow",
+            }),
+          onEnd: () => void stop(),
+          onError: (error) => {
+            const denied = error.kind === "permission";
+            notifications.show({
+              title: denied
+                ? "Microphone permission denied"
+                : "Dictation stopped",
+              message: denied
+                ? "Allow microphone access in the browser settings to dictate a search."
+                : error.message,
+              color: "red",
+            });
+            void stop();
+          },
         },
-      });
+        preferLocalModel,
+      );
       // The load takes seconds and the permission prompt can take minutes, so
       // the button may well be gone by now; whichever path removed it had no
       // session to stop when it ran.
@@ -185,9 +197,13 @@ export default memo(function DictationButton({
         color: "red",
       });
     }
-  }, [handleTranscript, stop, phase]);
+  }, [handleTranscript, stop, phase, preferLocalModel]);
 
-  if (!settings.enableDictation || getDictationEngine() === null) return null;
+  if (
+    !settings.enableDictation ||
+    getDictationEngine(preferLocalModel) === null
+  )
+    return null;
 
   const recording = phase === "recording";
   const percent = formatDownloadProgress(progress);
@@ -205,14 +221,6 @@ export default memo(function DictationButton({
       }
       aria-pressed={recording}
       data-dictation-phase={phase}
-      leftSection={
-        <IconMicrophone
-          size={14}
-          style={
-            recording ? { color: "var(--mantine-color-red-filled)" } : undefined
-          }
-        />
-      }
     >
       {phase === "loading"
         ? `Loading${percent}`

client/modules/settings.test.ts

@@ -5,6 +5,7 @@ import {
   defaultSettings,
   getDefaultCpuThreads,
   getInferenceTypes,
+  prefersLocalDictationModel,
 } from "./settings";
 
 const mockConfig: ServerConfig = {
@@ -55,6 +56,27 @@ describe("Settings Module", () => {
     });
   });
 
+  describe("prefersLocalDictationModel", () => {
+    it("is true when the primary language is English", () => {
+      expect(prefersLocalDictationModel("en")).toBe(true);
+      expect(prefersLocalDictationModel("en-US")).toBe(true);
+      expect(prefersLocalDictationModel("en-GB")).toBe(true);
+      expect(prefersLocalDictationModel("EN")).toBe(true);
+    });
+
+    it("is false when the primary language is not English", () => {
+      expect(prefersLocalDictationModel("pt")).toBe(false);
+      expect(prefersLocalDictationModel("pt-BR")).toBe(false);
+      expect(prefersLocalDictationModel("de-DE")).toBe(false);
+    });
+
+    it("compares the subtag exactly instead of by prefix", () => {
+      // `startsWith("en")` would match historical subtags like Middle
+      // English, which no browser UI actually uses.
+      expect(prefersLocalDictationModel("enm")).toBe(false);
+    });
+  });
+
   it("should include core inference types", () => {
     const values = getInferenceTypes(mockConfig).map((i) => i.value);
     expect(values).toContain("browser");
@@ -158,3 +180,34 @@ describe("legacy voice migration", () => {
     expect(settings.textToSpeechEngine).toBe("local");
   });
 });
+
+describe("dictation model default", () => {
+  const loadWithLanguage = async (language: string) => {
+    // Scoped restore rather than vi.restoreAllMocks(): the setup file installs
+    // matchMedia as a mock, and a broad restore would take it down with the
+    // language spy for anything that runs after this describe.
+    const languageSpy = vi
+      .spyOn(navigator, "language", "get")
+      .mockReturnValue(language);
+    vi.resetModules();
+    const module = await import("./settings");
+    languageSpy.mockRestore();
+    return module;
+  };
+
+  it("starts a non-English profile on the browser recognizer", async () => {
+    // The wiring from prefersLocalDictationModel into defaultSettings: a
+    // literal `true` here would leave every non-English first visit on a
+    // model that cannot transcribe their speech, while the pure function
+    // kept passing its own tests.
+    const { defaultSettings: settings } = await loadWithLanguage("pt-BR");
+
+    expect(settings.enableLocalDictationModel).toBe(false);
+  });
+
+  it("starts an English profile on the on-device model", async () => {
+    const { defaultSettings: settings } = await loadWithLanguage("en-US");
+
+    expect(settings.enableLocalDictationModel).toBe(true);
+  });
+});

client/modules/settings.ts

@@ -57,6 +57,23 @@ export function getDefaultCpuThreads(
   return Math.max(1, Math.floor(hardwareConcurrency / 2));
 }
 
+/**
+ * Whether the browser's primary language is English. The on-device dictation
+ * model understands English only, so a non-English profile should start on
+ * the browser's own multi-lingual recognizer instead.
+ *
+ * Only the primary language is consulted, never the full `navigator.languages`
+ * list: OEM images commonly append `en-US` to non-English installs, which
+ * would resolve "English" for a large share of the users this default exists
+ * to protect. The primary subtag is compared exactly, so a prefix match on
+ * `en` cannot pick up unrelated subtags like `enm`.
+ */
+export function prefersLocalDictationModel(
+  language: string = navigator.language,
+): boolean {
+  return language.toLowerCase().split("-")[0] === "en";
+}
+
 /**
  * Default application settings configuration.
  * Runtime server config is merged in via `applyServerConfig()` after
@@ -88,6 +105,7 @@ export const defaultSettings = {
   historyGroupByDate: true,
   selectedVoiceId: "",
   enableDictation: true,
+  enableLocalDictationModel: prefersLocalDictationModel(),
   textToSpeechEngine: (hasLegacySystemVoice ? "system" : "local") as
     | "local"
     | "system",

client/modules/speechToText.test.ts

@@ -93,22 +93,41 @@ afterEach(() => {
 });
 
 describe("getDictationEngine", () => {
-  it("reports the wasm engine when every piece is present", () => {
-    stubWasmSupport(vi.fn());
-    expect(getDictationEngine()).toBe("wasm");
-  });
-
-  it("falls back to web-speech when the wasm pieces are missing", () => {
+  function installRecognitionFake() {
     class FakeRecognition {
       start = vi.fn();
     }
     (window as unknown as Record<string, unknown>).webkitSpeechRecognition =
       FakeRecognition;
-    expect(getDictationEngine()).toBe("web-speech");
+  }
+
+  it("reports the wasm engine when it is preferred and every piece is present", () => {
+    stubWasmSupport(vi.fn());
+    expect(getDictationEngine(true)).toBe("wasm");
+  });
+
+  it("falls back to web-speech when the wasm pieces are missing", () => {
+    installRecognitionFake();
+    expect(getDictationEngine(true)).toBe("web-speech");
+  });
+
+  it("prefers web-speech over a capable wasm path when the local model is off", () => {
+    stubWasmSupport(vi.fn());
+    installRecognitionFake();
+    expect(getDictationEngine(false)).toBe("web-speech");
+  });
+
+  it("keeps the wasm engine when the local model is off but no recognizer exists", () => {
+    // The preference reorders engines, it never empties the list: a browser
+    // without `SpeechRecognition` (Firefox, for one) must still get a
+    // working Dictate button with the setting off.
+    stubWasmSupport(vi.fn());
+    expect(getDictationEngine(false)).toBe("wasm");
   });
 
   it("reports no engine when neither path is available", () => {
-    expect(getDictationEngine()).toBeNull();
+    expect(getDictationEngine(true)).toBeNull();
+    expect(getDictationEngine(false)).toBeNull();
   });
 });
 
@@ -137,10 +156,13 @@ describe("startDictation with the wasm engine", () => {
     const transcripts: string[] = [];
     const progress: [number, number | undefined][] = [];
 
-    const sessionPromise = startDictation({
-      onTranscript: (text) => transcripts.push(text),
-      onProgress: (loaded, total) => progress.push([loaded, total]),
-    });
+    const sessionPromise = startDictation(
+      {
+        onTranscript: (text) => transcripts.push(text),
+        onProgress: (loaded, total) => progress.push([loaded, total]),
+      },
+      true,
+    );
 
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
@@ -173,7 +195,7 @@ describe("startDictation with the wasm engine", () => {
     stubWasmSupport(getUserMedia);
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     FakeWorker.instances[0].respond({ type: "loaded" });
 
@@ -207,7 +229,7 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const started = installLocalRecognitionFake();
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     // A 502 from `/dictation-models/` is "cannot run here", not "no engine".
     FakeWorker.instances[0].respond({
@@ -230,7 +252,7 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const started = installLocalRecognitionFake();
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     FakeWorker.instances[0].respond({ type: "loaded" });
 
@@ -252,7 +274,7 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const started = installLocalRecognitionFake();
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "loaded" });
@@ -282,7 +304,7 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const started = installLocalRecognitionFake();
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "loaded" });
@@ -304,7 +326,7 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const onTranscript = vi.fn();
 
-    const sessionPromise = startDictation({ onTranscript });
+    const sessionPromise = startDictation({ onTranscript }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "loaded" });
@@ -328,7 +350,7 @@ describe("startDictation with the wasm engine", () => {
     stubWasmSupport(vi.fn().mockResolvedValue(stream));
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "loaded" });
@@ -351,10 +373,13 @@ describe("startDictation with the wasm engine", () => {
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
     const onError = vi.fn();
 
-    const sessionPromise = startDictation({
-      onTranscript: vi.fn(),
-      onError,
-    });
+    const sessionPromise = startDictation(
+      {
+        onTranscript: vi.fn(),
+        onError,
+      },
+      true,
+    );
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "loaded" });
@@ -374,7 +399,7 @@ describe("startDictation with the wasm engine", () => {
     stubWasmSupport(getUserMedia);
     setWorkerFactory(() => new FakeWorker() as unknown as Worker);
 
-    const sessionPromise = startDictation({ onTranscript: vi.fn() });
+    const sessionPromise = startDictation({ onTranscript: vi.fn() }, true);
     await vi.waitFor(() => expect(FakeWorker.instances.length).toBe(1));
     const worker = FakeWorker.instances[0];
     worker.respond({ type: "error", message: "model download failed" });
@@ -391,6 +416,63 @@ describe("startDictation with the wasm engine", () => {
   });
 });
 
+describe("startDictation with the local model preference off", () => {
+  let recognitionStarted = false;
+
+  function installRecognitionFake(
+    startImpl: () => void = () => {
+      recognitionStarted = true;
+    },
+  ) {
+    class FakeRecognition {
+      continuous = false;
+      interimResults = false;
+      lang = "";
+      onresult: unknown = null;
+      onerror: unknown = null;
+      onend: unknown = null;
+      start = startImpl;
+      stop = () => {};
+    }
+    (window as unknown as Record<string, unknown>).webkitSpeechRecognition =
+      FakeRecognition;
+  }
+
+  beforeEach(() => {
+    recognitionStarted = false;
+  });
+
+  it("never constructs the model worker on a fully wasm-capable browser", async () => {
+    // The whole point of the setting: with it off, the ~51 MB model must
+    // not be downloaded even where it could run.
+    const { stream } = makeMediaStream();
+    stubWasmSupport(vi.fn().mockResolvedValue(stream));
+    setWorkerFactory(() => new FakeWorker() as unknown as Worker);
+    installRecognitionFake();
+
+    const session = await startDictation({ onTranscript: vi.fn() }, false);
+
+    expect(FakeWorker.instances.length).toBe(0);
+    expect(recognitionStarted).toBe(true);
+    await session.stop();
+  });
+
+  it("does not fall back to the wasm engine when the recognizer fails", async () => {
+    // A reverse fallback would start the ~51 MB download right after the
+    // user turned that model off; the failure must surface instead.
+    stubWasmSupport(vi.fn());
+    setWorkerFactory(() => new FakeWorker() as unknown as Worker);
+    installRecognitionFake(() => {
+      throw new Error("recognizer refused to start");
+    });
+
+    await expect(
+      startDictation({ onTranscript: vi.fn() }, false),
+    ).rejects.toMatchObject({ kind: "unavailable" });
+    expect(FakeWorker.instances.length).toBe(0);
+  });
+});
+
 describe("startDictation with the web speech fallback", () => {
   interface RecognitionFake {
     continuous: boolean;
@@ -437,9 +519,12 @@ describe("startDictation with the web speech fallback", () => {
     installRecognitionFake();
 
     const transcripts: string[] = [];
-    const session = await startDictation({
-      onTranscript: (text) => transcripts.push(text),
-    });
+    const session = await startDictation(
+      {
+        onTranscript: (text) => transcripts.push(text),
+      },
+      true,
+    );
 
     expect(instance?.continuous).toBe(true);
     expect(instance?.interimResults).toBe(true);
@@ -468,7 +553,7 @@ describe("startDictation with the web speech fallback", () => {
     });
 
     await expect(
-      startDictation({ onTranscript: vi.fn() }),
+      startDictation({ onTranscript: vi.fn() }, true),
     ).rejects.toMatchObject({ kind: "permission" });
   });
 
@@ -479,10 +564,13 @@ describe("startDictation with the web speech fallback", () => {
     installRecognitionFake();
     const onError = vi.fn();
 
-    const session = await startDictation({
-      onTranscript: vi.fn(),
-      onError,
-    });
+    const session = await startDictation(
+      {
+        onTranscript: vi.fn(),
+        onError,
+      },
+      true,
+    );
 
     instance?.onerror?.({ error: "not-allowed" });
 
@@ -496,11 +584,14 @@ describe("startDictation with the web speech fallback", () => {
     const onError = vi.fn();
     const onEnd = vi.fn();
 
-    const session = await startDictation({
-      onTranscript: vi.fn(),
-      onEnd,
-      onError,
-    });
+    const session = await startDictation(
+      {
+        onTranscript: vi.fn(),
+        onEnd,
+        onError,
+      },
+      true,
+    );
 
     // Chrome ends after silence even with `continuous`. The session is over,
     // but there is nothing the user needs told about.
@@ -516,11 +607,14 @@ describe("startDictation with the web speech fallback", () => {
     const onError = vi.fn();
     const onEnd = vi.fn();
 
-    const session = await startDictation({
-      onTranscript: vi.fn(),
-      onEnd,
-      onError,
-    });
+    const session = await startDictation(
+      {
+        onTranscript: vi.fn(),
+        onEnd,
+        onError,
+      },
+      true,
+    );
 
     await session.stop();
     instance?.onend?.();
@@ -533,7 +627,7 @@ describe("startDictation with the web speech fallback", () => {
 describe("startDictation without any engine", () => {
   it("rejects with an unavailable error", async () => {
     await expect(
-      startDictation({ onTranscript: vi.fn() }),
+      startDictation({ onTranscript: vi.fn() }, true),
     ).rejects.toMatchObject({ kind: "unavailable" });
   });
 });

client/modules/speechToText.ts

@@ -71,23 +71,32 @@ function getSpeechRecognitionConstructor(): SpeechRecognitionConstructor | null
 /**
  * The engine that would run a dictation right now, or null when neither the
  * WASM path nor `SpeechRecognition` is available and the button should hide.
+ *
+ * `preferLocalModel` reorders the two engines; it never empties the list.
+ * A user who turns the on-device model off on a browser without
+ * `SpeechRecognition` (Firefox, for one) must still get a working Dictate
+ * button, so the preference cannot be an exclusion.
  */
-export function getDictationEngine(): DictationEngine | null {
+export function getDictationEngine(
+  preferLocalModel: boolean,
+): DictationEngine | null {
   // Neither engine can open a microphone outside a secure context. Without
   // this, a plain-HTTP LAN deployment falls through to `SpeechRecognition`,
   // which then reports `not-allowed` and tells the user permission was denied
   // when the real cause is the origin.
   if (typeof isSecureContext !== "undefined" && !isSecureContext) return null;
-  if (
+  const wasmCapable =
     typeof Worker !== "undefined" &&
     typeof WebAssembly !== "undefined" &&
     typeof AudioContext !== "undefined" &&
-    typeof navigator.mediaDevices?.getUserMedia === "function"
-  ) {
-    return "wasm";
+    typeof navigator.mediaDevices?.getUserMedia === "function";
+  const webSpeechAvailable = getSpeechRecognitionConstructor() !== null;
+  if (preferLocalModel) {
+    if (wasmCapable) return "wasm";
+    return webSpeechAvailable ? "web-speech" : null;
   }
-  if (getSpeechRecognitionConstructor()) return "web-speech";
-  return null;
+  if (webSpeechAvailable) return "web-speech";
+  return wasmCapable ? "wasm" : null;
 }
 
 export interface DictationCallbacks {
@@ -433,8 +442,9 @@ function startWebSpeechDictation(
  */
 export async function startDictation(
   callbacks: DictationCallbacks,
+  preferLocalModel: boolean,
 ): Promise<DictationSession> {
-  const engine = getDictationEngine();
+  const engine = getDictationEngine(preferLocalModel);
   if (engine === "wasm") {
     try {
       return await startWasmDictation(callbacks);
@@ -454,7 +464,13 @@ export async function startDictation(
       return startWebSpeechDictation(callbacks);
     }
   }
-  if (engine === "web-speech") return startWebSpeechDictation(callbacks);
+  if (engine === "web-speech") {
+    // No reverse fallback to wasm when this recognizer fails. Falling through
+    // would start a ~51 MB model download right after the user turned that
+    // model off; a clear failure is the better answer, and it matches what
+    // web-speech-only browsers already do.
+    return startWebSpeechDictation(callbacks);
+  }
   addLogEntry("Dictation is not available in this browser");
   throw new DictationError(
     "unavailable",

docs/configuration.md

@@ -188,7 +188,8 @@ Search results:
 |---------|------|---------|-------------|
 | `selectedVoiceId` | string | `""` | Voice for reading answers aloud. `piper:<voice>` picks a local neural voice, `system:<voiceURI>` an OS voice, and `""` picks one automatically for the browser language. The Voice settings panel lists only the voices of the selected engine, and switching that engine resets this to `""`. A bare value stored by an earlier version is read as an OS voice whenever the system engine runs; with the local engine it is ignored in favor of a language match |
 | `textToSpeechEngine` | `"local" \| "system"` | `"local"` | Which engine reads answers aloud, and which set of voices the Voice settings panel lists. `"system"` also overrides a local voice picked above, and stops the voice list from being fetched, so it never contacts a third-party host. A profile that had picked an OS voice before this setting existed starts on `"system"`, so the upgrade does not replace that choice with a model download |
-| `enableDictation` | boolean | `true` | Shows the microphone button that fills the search field while the user speaks. Transcription runs on the device; turning this off hides the button and loads nothing. The button is also hidden outside a secure context, so an instance served over plain HTTP on a LAN will not show it: no browser grants microphone access there |
+| `enableDictation` | boolean | `true` | Shows the Dictate button that fills the search field while the user speaks. Turning this off hides the button and loads nothing. The button is also hidden outside a secure context, so an instance served over plain HTTP on a LAN will not show it: no browser grants microphone access there |
+| `enableLocalDictationModel` | boolean | `true` only when the browser's primary language is English | Whether the Dictate button prefers the on-device Moonshine model, which understands English only. With it off, the button uses the browser's built-in `SpeechRecognition`, which handles other languages but may send the audio to the browser vendor. The preference reorders the two engines and never removes one: on browsers without `SpeechRecognition` the on-device model is used regardless. The default is derived from `navigator.language` at first load, so a non-English browser starts on the built-in recognizer with no model download; the Voice settings panel can flip it either way |
 | `reasoningStartMarker` | string | `"<think>"` | Marker for start of reasoning content |
 | `reasoningEndMarker` | string | `"</think>"` | Marker for end of reasoning content |
 

docs/failure-injection.md

@@ -73,7 +73,8 @@ needed.
 | A follow-up question generation rejects after a newer one started | The failed call blanks nothing, so the newer question still lands and the flag stays on until it does | `client/components/AiResponse/ChatInterface.test.tsx` › blanks nothing when an orphaned call rejects after a newer one started |
 | `ChatInterface` unmounts while a regenerate is still awaiting its response | The orphaned regenerate leaves the next mount's response flag alone | `client/components/AiResponse/ChatInterface.test.tsx` › leaves the next mount's response flag alone when an orphaned regenerate settles |
 | `ChatInterface` unmounts while a send is still awaiting its response | The orphaned send asks for no follow-up question and leaves the next mount's response flag alone | `client/components/AiResponse/ChatInterface.test.tsx` › starts no follow-up question for a send that settles after unmount, leaves the next mount's response flag alone when an orphaned send settles |
-| The dictation model cannot load in the browser | The local engine is abandoned for the browser's `SpeechRecognition`, and the button hides when that is missing too | `client/modules/speechToText.test.ts` › falls back to the browser recognizer when the local engine fails |
+| The dictation model cannot load in the browser | While the on-device model is preferred, the local engine is abandoned for the browser's `SpeechRecognition`, and the button hides when that is missing too | `client/modules/speechToText.test.ts` › falls back to the browser recognizer when the local engine fails |
+| The browser recognizer fails while the on-device model is off | The session fails outright; there is no reverse fallback, so the disabled model is never downloaded behind the user's back | `client/modules/speechToText.test.ts` › does not fall back to the wasm engine when the recognizer fails |
 | Microphone permission is denied | A notification says so instead of the press failing quietly, and no fallback asks again | `client/components/Search/Form/DictationButton.test.tsx` › shows a notification when microphone permission is denied, `client/modules/speechToText.test.ts` › reports a denied microphone instead of falling back |
 | The dictation engine fails while the microphone permission prompt is open | The load fails rather than resolving into a dead transcriber, so the browser recognizer takes over | `client/modules/speechToText.test.ts` › fails the load when the engine dies while permission is pending, fails the load when the worker dies uncaught while permission is pending |
 | The browser recognizer is denied after the session started | Reported through the error callback, since the promise it would have rejected has already resolved | `client/modules/speechToText.test.ts` › reports a denial that arrives after the session resolved |

docs/project-structure.md

@@ -59,7 +59,7 @@ The `client/modules/` directory contains core business logic organized by domain
 | `textToSpeechWorker.ts` | Synthesizes sentences off the main thread |
 | `textToSpeechWorkerProtocol.ts` | Message types shared by both sides of the worker |
 | `piper.ts` | The only module that imports `@diffusionstudio/vits-web` |
-| `speechToText.ts` | Dictation: microphone capture, the worker's lifecycle, and the `SpeechRecognition` fallback |
+| `speechToText.ts` | Dictation: microphone capture, the worker's lifecycle, and engine selection between the on-device model and `SpeechRecognition` |
 | `speechToTextWorker.ts` | Runs the Moonshine transcriber off the main thread |
 | `speechToTextWorkerProtocol.ts` | Message types shared by both sides of the dictation worker |
 | `moonshine.ts` | The only module that imports `@moonshine-ai/moonshine-wasm` |

docs/security.md

@@ -49,7 +49,7 @@ Every HTTP request from client to backend carries a `token` query parameter for
 - **Page Reading Is On By Default, And Reversible**: `enablePageContentFetch` ships on and the user can turn it off under AI Settings; nothing is read until AI responses are enabled, and the server (never the browser) requests the top result pages, so those sites see the instance and no user cookies or IP
 - **Search And Page Reading Leave No Query In The Log**: The search query is never written to the server log, and neither is the URL of a page read for grounding; how often searches come back empty, fail on unresponsive engines or are fully discarded, and how page reads ended, are counted instead and reported on `/status` (`searchesWithoutResults`, `searchesWithUnresponsiveEngines`, `searchesWithAllResultsDiscarded`, `pageReads`). `searches.unresponsiveEngines` names the engines behind those failures, which is configured infrastructure rather than anything a user typed, the same basis on which `inference.byModel` names model ids. What each failed with is published as one of `blocked`, `timeout` or `other`, never SearXNG's own wording: `/status` needs no token, and an upstream engine is free to build its error text out of the request URL, and so out of the query. The raw string stays in the server log and in the thrown error the search endpoint catches; the 502 it answers with carries a fixed message, so the string never leaves the server. Anything in front of the instance keeps its own access log, where `?q=` appears in full
 
-- **Dictation Runs On The Device**: The microphone button transcribes speech with the Moonshine streaming model running as WebAssembly in a worker; the audio is read locally and never leaves the device. Nothing loads until the button is pressed, so a user who never dictates pays nothing for the feature. The model files are served by the instance itself under `/dictation-models/` (`server/dictationModelServerHook.ts`), which only resolves a fixed whitelist of filenames for the pinned MIT-licensed English streaming model, fetches them once from `download.moonshine.ai`, and caches them on disk under `DICTATION_MODELS_DIR`; the page makes no third-party requests. The browser asks for microphone permission on the first press; a denied permission shows a notification instead of failing quietly, on either engine. On the fallback the denial arrives after the session has started, so it is reported through the same notification rather than the press simply failing. When the WASM path cannot run, whether because the browser lacks it or because the model fails to load, the button falls back to the browser's own `SpeechRecognition`, which does send audio to the browser vendor; a notification says so at the moment it happens. A denied microphone is never retried that way, since that is the user's answer rather than an engine that cannot run. When neither path is available, or the page is not in a secure context, the button hides. Users can turn the feature off with `enableDictation` in the Voice settings
+- **Dictation: Which Engine Runs, And Where The Audio Goes**: The Dictate button has two engines. The on-device engine transcribes with the Moonshine streaming model running as WebAssembly in a worker; the audio is read locally and never leaves the device, but the model understands English only. The browser engine is the browser's own `SpeechRecognition`, which handles other languages but sends audio to the browser vendor. Which one runs is decided by `enableLocalDictationModel`, and that defaults to on only when the browser's primary language is English, so a non-English browser starts on the vendor recognizer rather than on a model that cannot transcribe its user's speech. The preference reorders the engines and never removes one: on browsers without `SpeechRecognition` the on-device model runs regardless. When the preferred engine cannot run, the switch from on-device to browser happens only while the local model is on, and a notification announces it because the audio's destination changed; the reverse never happens, so a user who turned the model off never gets a surprise ~51 MB download after a recognizer failure. A denied microphone is never retried on the browser engine, since that is the user's answer rather than an engine that cannot run. Nothing loads until the button is pressed, so a user who never dictates pays nothing for the feature. The model files are served by the instance itself under `/dictation-models/` (`server/dictationModelServerHook.ts`), which only resolves a fixed whitelist of filenames for the pinned MIT-licensed English streaming model, fetches them once from `download.moonshine.ai`, and caches them on disk under `DICTATION_MODELS_DIR`; the page makes no third-party requests. The browser asks for microphone permission on the first press; a denied permission shows a notification instead of failing quietly, on either engine. On the browser engine the denial arrives after the session has started, so it is reported through the same notification rather than the press simply failing. When neither engine is available, or the page is not in a secure context, the button hides. Users can turn the feature off with `enableDictation` in the Voice settings
 
 - **Reading Answers Aloud Contacts Third-Party Hosts**: The local text-to-speech engine fetches from outside the instance. It downloads the voice index and the model from `huggingface.co` (served from `us.aws.cdn.hf.co`), the ONNX runtime from `cdnjs.cloudflare.com` and the phonemizer from `cdn.jsdelivr.net`, because `@diffusionstudio/vits-web` hardcodes those URLs. Browser inference already downloads its models from HuggingFace, so `cdnjs.cloudflare.com` and `cdn.jsdelivr.net` are the two hosts new to this feature; unlike wllama, whose runtime is bundled with the app, this engine fetches its runtime at use time. Those hosts see the user's IP and that they used the feature. Nothing is fetched until the user presses Listen or opens the Voice settings panel with the local engine selected, and the voice model is cached in OPFS afterwards, while the index, runtime and phonemizer are fetched again on a later visit. Switching `textToSpeechEngine` to `system` avoids all of these requests, including the voice list
 

docs/ui-components.md

@@ -261,7 +261,7 @@ function AiResponseSection() {
 - **SearchSettingsForm:** Result limits, image search toggle
 - **InterfaceSettingsForm:** UI preferences
 - **HistorySettings:** Retention days, max entries
-- **VoiceSettingsForm:** Dictation toggle, text-to-speech engine and voice selection
+- **VoiceSettingsForm:** Dictation toggle, on-device dictation model toggle, text-to-speech engine and voice selection
 - **ActionsForm:** Data management actions
 
 **PubSub:**