Architecture
OpenWhispr uses a secure IPC bridge architecture to enable communication between the Electron renderer process (UI) and the main process (system integration).Context Isolation
OpenWhispr enforces context isolation for security:- The renderer process runs in a sandboxed environment
- Direct access to Node.js APIs is disabled
- All system operations go through the IPC bridge
- The preload script (
preload.js) exposes a safe API viawindow.electronAPI
IPC Bridge
The preload script uses Electron’scontextBridge to expose methods:
Accessing the API
In your renderer code (React components, services), access the IPC methods viawindow.electronAPI:
Available IPC Channels
OpenWhispr provides IPC channels organized by feature area:Transcription
transcribeLocalWhisper- Transcribe audio using local Whisper modeltranscribeLocalParakeet- Transcribe audio using NVIDIA Parakeet modeltranscribeAudioFile- Transcribe an audio file from diskcloudTranscribe- Transcribe using OpenWhispr Cloud API
Database
saveTranscription- Save transcription to databasegetTranscriptions- Get transcription historydeleteTranscription- Delete a specific transcriptionclearTranscriptions- Clear all transcriptionsgetDictionary- Get custom dictionary wordssetDictionary- Update custom dictionarysaveNote- Save a note with metadatagetNotes- Get notes by type/folderupdateNote- Update note contentdeleteNote- Delete a note
Settings & Configuration
getOpenAIKey- Get OpenAI API keysaveOpenAIKey- Save OpenAI API keygetAnthropicKey- Get Anthropic API keysaveAnthropicKey- Save Anthropic API keygetGeminiKey- Get Gemini API keysaveGeminiKey- Save Gemini API keygetGroqKey- Get Groq API keysaveGroqKey- Save Groq API keygetMistralKey- Get Mistral API keysaveMistralKey- Save Mistral API keygetDictationKey- Get dictation activation keysaveDictationKey- Save dictation activation keygetActivationMode- Get activation mode (tap/push)saveActivationMode- Save activation modeupdateHotkey- Update global hotkeygetAutoStartEnabled- Check if auto-start is enabledsetAutoStartEnabled- Enable/disable auto-start
Model Management
checkWhisperInstallation- Check if Whisper is installeddownloadWhisperModel- Download a Whisper modellistWhisperModels- List downloaded Whisper modelsdeleteWhisperModel- Delete a Whisper modelcheckParakeetInstallation- Check Parakeet installationdownloadParakeetModel- Download Parakeet modellistParakeetModels- List Parakeet modelsmodelGetAll- Get all available local models (llama.cpp)modelDownload- Download a local reasoning modelmodelDelete- Delete a local model
System Integration
pasteText- Paste text to active applicationopenMicrophoneSettings- Open system microphone settingsopenAccessibilitySettings- Open accessibility settings (macOS)openExternal- Open URL in default browsercheckAccessibilityPermission- Check clipboard permissionsreadClipboard- Read clipboard contentwriteClipboard- Write to clipboard
Window Management
hideWindow- Hide the dictation windowshowDictationPanel- Show the dictation windowwindowMinimize- Minimize the control panelwindowMaximize- Maximize/restore control panelwindowClose- Close the control panelappQuit- Quit the application
Event Listeners
Some IPC channels provide event listeners for real-time updates:Available Events
onToggleDictation- Dictation toggle requestedonStartDictation- Start dictation eventonStopDictation- Stop dictation eventonTranscriptionAdded- New transcription savedonTranscriptionDeleted- Transcription deletedonNoteAdded- New note createdonNoteUpdated- Note updatedonNoteDeleted- Note deletedonDictionaryUpdated- Dictionary changedonNoAudioDetected- No audio in recordingonModelDownloadProgress- Model download progressonUpdateAvailable- App update available
Security Model
What’s Exposed
- Only explicitly exposed methods via
contextBridge - No direct Node.js or Electron API access
- All operations validated in main process
What’s Protected
- File system access (only through safe IPC methods)
- Process spawning
- System settings modification
- Network requests (proxied through main process)
API Key Storage
- API keys stored in environment variables and
.envfile - Loaded securely from main process
- Never exposed directly to renderer