Deployment

Overview#

As an administrator, you decide:

• which edition goes on the Macs and how: the direct download through your MDM or Homebrew, or the Mac App Store edition through Apple Business Manager;
• how it is configured: license, models, cloud processing, downloads, updates, and startup through managed settings;
• what it may do and reach: the login item, permissions, and the network hosts below.

TypeWhisper needs macOS 14 or later and no administrator rights to run. Each user of a Mac keeps their own settings, models, and plugins in their account. A device profile applies to every user, a user profile only to that user.

Choose an edition#

The two editions are separate apps with separate settings, so usually only one of them is installed. Apps and Books licenses do not include in-app purchases, so commercial license keys need the direct download.

Install the direct download#

Every release includes TypeWhisper-v<version>.dmg and a ZIP file. Most MDMs install the DMG or a package built from it; place TypeWhisper.app in /Applications. The files are on the GitHub releases page. With Homebrew:

brew install --cask typewhisper/tap/typewhisper

To uninstall, quit the app and delete it from /Applications. Settings, models, and plugins stay in the user's account; the installation page lists the paths for a complete cleanup. Deleting the app does not deactivate a managed license; remove the activation in Polar.

Updates#

The direct download updates itself with Sparkle from https://typewhisper.github.io/typewhisper-mac/appcast.xml. UpdateMode controls this: 0 leaves updates to your deployment, 1 only announces new versions, and 2 installs only when the user starts it. Under 0, deploy new versions with your MDM.

An update that Sparkle downloaded for automatic installation before a restrictive UpdateMode arrived can still install when TypeWhisper quits; Sparkle offers no way to cancel it. Deploy the policy together with the app to avoid that window.

Login item#

macOS lists TypeWhisper in System Settings > General > Login Items & Extensions, where users can turn it off even while LaunchAtLogin is enforced; Settings > General in TypeWhisper then shows that the item needs approval.

To approve and lock the item, deploy a Service Management payload (com.apple.servicemanagement, macOS 13 or later, delivered by MDM) with a rule for TypeWhisper's team identifier 2D8ALY3LCL or its bundle identifier. The login item example covers both editions. An app that has never been started cannot register its login item, so launch TypeWhisper once after installation.

Permissions#

TypeWhisper asks for these permissions when a feature first needs them. A privacy preferences profile (PPPC, com.apple.TCC.configuration-profile-policy) delivered by MDM can pre-approve some of them. The privacy example contains entries for Accessibility, PostEvent, Input Monitoring, and Screen Recording. Pre-approve only the entries your features and edition need. Calendars and Automation are optional; add their entries yourself if you want them pre-approved.

The code requirements in the example are TypeWhisper's designated requirements. To check them against an installed app:

codesign -dr - /Applications/TypeWhisper.app

macOS applies privacy preferences only when an MDM with user-approved or automated device enrollment delivers them. A profile installed by hand is not enough.

From macOS 27: app settings#

From macOS 27, the Accessibility entry in a PPPC profile is deprecated, and System Settings calls the pane Device Control and Data Access: macOS notifies the user and lets them turn the permission off there. Apple's replacement is the Privacy key of the declarative app settings configuration (com.apple.configuration.app.settings) for supervised Macs with macOS 27 or later. It sets permission defaults per app, matched by bundle identifier and code requirement, which the user confirms in one prompt when the app launches, together with your organization's justification. It can propose Accessibility, the microphone, and local network access, but never grants them silently.

• The app settings example proposes Accessibility and the microphone for both editions. Adapt its OrganizationJustification.
• The prompt lists only permissions the user has not been asked for yet and does not appear once they have seen all of them, so deploy the declaration before users first launch TypeWhisper.
• Deliver it with an MDM that supports declarative device management on the user channel, because macOS applies the Privacy key only to users. Give it a new ServerToken whenever you change it, or the Mac keeps the previous version; most MDMs set the token themselves.
• Keep the privacy profile for earlier macOS versions and for PostEvent, Input Monitoring, and Screen Recording.

Network hosts#

The app itself contacts these hosts over HTTPS, using the system proxy settings:

When a user turns on the connection for paired iPhones and iPads, TypeWhisper listens on the local network for them. The HTTP API listens on the loopback interface only.

Cloud plugins contact their vendor. The table lists the hosts of the plugins in the catalog as of TypeWhisper for Mac 1.8. Plugins with the configurable locality reach whatever endpoint, command, or service the user configures.

Provide models and plugins#

• TypeWhisper reads the profile before anything else at launch, so a profile present at the first launch applies right away. Deploy restrictive profiles before or together with the app.
• With AllowModelDownloads or AllowPluginDownloads turned off, users cannot fetch models or plugins themselves. Models and plugins live in each user's ~/Library/Application Support: stage them there before the restriction applies, or allow downloads for the first setup. Never copy another user's settings or Keychain items.
• The keys govern TypeWhisper's behavior, not the network. Combine them with your MDM's network controls where you need stronger guarantees.

Pilot checklist#

Before the rollout, check on one managed Mac with the release you deploy:

1. Deploy the profile and launch TypeWhisper as a standard user. Settings > Advanced > Managed Settings lists the values, with no invalid keys or policy problems.
2. Locked settings show “Managed by your organization”, and refused providers and plugins show the reason.
3. Dictate once with the intended engine and, if used, a language model workflow.
4. Confirm the models your setup needs, especially with downloads turned off.
5. Change a value in the MDM and confirm the app applies it within about 30 seconds without a restart. Remove the profile and confirm the user's own settings return.
6. With ManagedLicenseKey: Settings > License shows the managed state and the activation. Restart TypeWhisper twice and confirm that Polar shows no additional activations. Repeat with a second user and with an offline first launch followed by Retry Activation. Then replace the key, remove it, and compare the result with the lifecycle under Managed license key.
7. Restart the Mac and confirm that the login item, the microphone, and the other permissions behave as intended.
8. Repeat with the Mac App Store edition if you deploy it.