feat: Add Electron desktop app with MLX Parakeet transcription

[johnnyhuy]

Summary

• Electron + React + TypeScript desktop application for local and cloud transcription
• Global hotkey recording (Cmd+Shift+Space default) — works from any app
• Enhanced Model Manager with categories, speaker recognition, and download management
• Local Models: MLX Parakeet, WhisperKit, Whisper C++, Apple Speech
• Cloud Providers: OpenAI Whisper API, AssemblyAI (with speaker diarization)
• Speaker Recognition: Badge indicators, speaker diarization display, separate speaker segments
• Export Formats: TXT, SRT, VTT, JSON, CSV, PDF, Word
• Copy to Clipboard: One-click copy with visual feedback
• Meeting App Detection: Zoom, Teams, Webex, Skype, Discord, Chime
• System Tray Integration: Menu bar access with quick record/stop
• Auto-Paste: Automatically insert transcribed text into active application
• Cloud API Key Management: Secure storage in settings

Model Categories

Category	Description
Apple Speech	On-device Apple Speech recognition
WhisperKit	Greater accuracy, faster performance, real-time
Parakeet	Nvidia Parakeet engine for accuracy and speed
Whisper C++	Lightweight C++ engine
Speaker Recognition	Models that identify and separate speakers
Pro	Advanced models for power users

Export Formats

• TXT — Plain text
• SRT — Subtitles with timestamps
• VTT — Web video text tracks
• JSON — Structured data with speakers
• CSV — Spreadsheet format
• PDF — Portable document
• Word — Microsoft Word document

Architecture

• Electron Main Process: Window, tray, hotkeys, IPC, recording, export
• Electron Preload: Secure IPC bridge
• React Frontend: Recording UI, model manager, settings, history, export dialog
• Python Backend: MLX Parakeet (local), OpenAI/AssemblyAI (cloud)

Prerequisites

• macOS 14+ with Apple Silicon (M1/M2/M3) for MLX
• Python 3.9+ with parakeet-mlx, openai, assemblyai
• Node.js 18+ and npm
• sox/rec for audio recording (brew install sox)

How to Run

cd desktop
npm install
pip install parakeet-mlx openai assemblyai
npm run dev

Consequences

• New desktop/ directory with full Electron application
• No changes to existing Python CLI tool
• Desktop app is optional/additional interface

Testing

• Vite build passes successfully
• TypeScript compilation passes
• Electron app packages successfully for macOS

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​electron-builder@​26.8.1
	npm/​wav-file-encoder@​1.0.4
	npm/​typescript-eslint@​8.59.1
	npm/​@​types/​react-dom@​19.2.3
	npm/​node-record-lpcm16@​1.0.1
	npm/​@​types/​react@​19.2.14
	npm/​@​electron/​remote@​2.1.3
	npm/​@​types/​node@​24.12.2
	npm/​cross-env@​10.1.0
	npm/​electron-store@​11.0.2
	npm/​vite@​8.0.10
	npm/​electron@​41.4.0
	npm/​react@​19.2.5
	npm/​globals@​17.5.0
	npm/​@​eslint/​js@​10.0.1
	npm/​wait-on@​9.0.5
	npm/​typescript@​6.0.3
	npm/​concurrently@​9.2.1
	npm/​react-dom@​19.2.5
	npm/​eslint-plugin-react-refresh@​0.5.2
	npm/​vite-plugin-electron-renderer@​0.14.7
	npm/​lucide-react@​0.469.0
	npm/​@​vitejs/​plugin-react@​6.0.1
	npm/​vite-plugin-electron@​0.29.1
	npm/​eslint-plugin-react-hooks@​7.1.1
	npm/​eslint@​10.2.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: npm shell-quote quote() does not escape newlines in object .op values CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL) Affected versions: >= 1.1.0 < 1.8.4 Patched version: 1.8.4 From: desktop/package-lock.json → npm/concurrently@9.2.1 → npm/shell-quote@1.8.3 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: node-npm tar: Decompression/parse DoS via unlimited input CVE: GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input (CRITICAL) Affected versions: < 7.5.19 Patched version: 7.5.19 From: desktop/package-lock.json → npm/electron-builder@26.8.1 → npm/tar@7.5.13 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tar@7.5.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm brace-expansion is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: desktop/package-lock.json → npm/electron-builder@26.8.1 → npm/eslint@10.2.1 → npm/typescript-eslint@8.59.1 → npm/brace-expansion@5.0.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/brace-expansion@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm electron-winstaller is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: desktop/package-lock.json → npm/electron-builder@26.8.1 → npm/electron-winstaller@5.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/electron-winstaller@5.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm tar is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: desktop/package-lock.json → npm/electron-builder@26.8.1 → npm/tar@7.5.13 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tar@7.5.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm tiny-async-pool is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: desktop/package-lock.json → npm/electron-builder@26.8.1 → npm/tiny-async-pool@1.3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tiny-async-pool@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report