Deployment

Overview#

As an administrator, you decide:

• how TypeWhisper is installed: once per device with the MSI, or per user with the setup;
• how it is configured: license, models, cloud processing, downloads, updates, and startup through managed settings;
• what it may reach: the network hosts below and the microphone.

Each Windows user keeps their own settings, models, and plugins in their profile. The policy key, in contrast, is device-wide and applies to every user.

Choose an installer#

Both files are attached to the latest stable release, each with a .sha256 file for verification:

• TypeWhisper-win-x64.msi
• TypeWhisper-win-x64-Setup.exe

Get-FileHash .\TypeWhisper-win-x64.msi -Algorithm SHA256

Machine-wide installer (MSI)#

The MSI installs TypeWhisper once for all users of a device into C:\Program Files\TypeWhisper, or into the folder given in VELOPACK_INSTALLDIR. It adds Start menu and desktop shortcuts for all users and registers under the machine's uninstall key.

Like the setup, the MSI from GitHub is not code-signed. Application control policies that require a signature, such as App Control for Business or AppLocker, need an exception for it. Verify the file with its SHA-256 hash first.

Prerequisite: .NET 10 Runtime#

The MSI needs the .NET 10 Runtime (x64). An interactive installation offers to install it; a silent installation does not. Deploy the runtime first, for example as an Intune dependency, which has to be a Win32 app itself. The installer is available at dotnet.microsoft.com.

.\dotnet-runtime-10.0.<patch>-win-x64.exe /install /quiet /norestart

# or
winget install Microsoft.DotNet.Runtime.10

Install and uninstall#

# Install for all users
msiexec /i TypeWhisper-win-x64.msi /qn /norestart

# Install into another folder
msiexec /i TypeWhisper-win-x64.msi /qn /norestart VELOPACK_INSTALLDIR="D:\Apps\TypeWhisper"

# Uninstall with the product code of the installed version
msiexec /x '{<product code>}' /qn /norestart

The product code changes with every version. Read it from the MSI's ProductCode property, or on a device with the app installed from QuietUninstallString under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MSI:TypeWhisper. When you package the MSI for Intune, Intune fills in the uninstall command with the product code.

Updates#

Your deployment updates a machine-wide installation. The app does not check for, download, or install app updates, shows “App updates are managed by your organization's deployment.” in Settings > Account & about, and locks the update channel. You don't need UpdateMode for this. If you set it anyway, keep it at 0 or 1: standard users cannot write to Program Files, so an installation started from the app under 2 fails. Plugin updates are not affected, because plugins live in the user's profile.

To upgrade, deploy the newer MSI the same way, for example through supersedence in Intune. It replaces the installed version in place. A Release Candidate sorts below the Stable release of the same version.

As an Intune Win32 app#

Per-user installer#

The setup installs TypeWhisper for the user who runs it: it writes to %LocalAppData%\TypeWhisper, registers under the user's uninstall key, and starts the app when it finishes.

# Install for the current user
.\TypeWhisper-win-x64-Setup.exe --silent

# Uninstall for the current user
& "$env:LOCALAPPDATA\TypeWhisper\Update.exe" --uninstall --silent

As an Intune Win32 app#

With UpdateMode 0 your organization owns updates: deploy new installers through the same tools. With 1 the app announces new versions in Settings > Account & about, without an install button. On shared devices, use the MSI, or let each Windows user run the setup once; your deployment tool can install it in the user's context.

Network hosts#

TypeWhisper only makes outbound HTTPS connections and uses the Windows proxy settings, including WPAD and PAC scripts; there is no separate proxy configuration. The app itself contacts these hosts:

Cloud plugins contact their vendor. The table lists the hosts of the plugins in the catalog as of TypeWhisper for Windows 1.2. Plugins with the configurable locality reach whatever endpoint the user enters.

Microphone and permissions#

TypeWhisper is a desktop app. Windows does not ask for microphone access per desktop app, so there is nothing to pre-approve. The app can record as long as two switches in Settings > Privacy & security > Microphone are on (on Windows 10: Settings > Privacy > Microphone):

The Group Policy “Let Windows apps access the microphone” (Computer Configuration > Administrative Templates > Windows Components > App Privacy) governs packaged (Store or MSIX) apps only. It applies to the Microsoft Store version of TypeWhisper, whose package family name goes into its “Force Allow” list, and not to the GitHub installers. If a user turns a switch off, TypeWhisper reports the missing microphone in its status and setup instead of failing silently.

To run, TypeWhisper needs no administrator rights, no driver, and no firewall exception: it only makes outbound connections, and the optional HTTP API listens on the loopback interface only.

Provide models and plugins#

• Models and plugins live in each user's profile. If you turn off AllowModelDownloads or AllowPluginDownloads, place the required packages and model files in the user's profile before the restriction applies. Never copy another user's settings, credentials, or DPAPI-protected data.
• Some local plugins fetch runtime files while they load a model. AllowModelDownloads does not stop that; allow the runtime hosts from the table above or provide the files.
• The policy is read before plugins and background work start. If it is present at the first launch, it applies right away.

Pilot checklist#

Before the rollout, check on one or two managed devices:

1. Install the .NET 10 Runtime and the MSI silently, then start TypeWhisper as a standard user.
2. Import the Group Policy templates, set a few policies, and compare them with Settings > Advanced > Managed settings.
3. Deploy ManagedLicenseKey and check Settings > Premium > License in a standard user's session. Restart twice and confirm that Polar shows no additional activations. Repeat with a second Windows user and with an offline first launch followed by Retry activation.
4. Confirm microphone access and the models your setup needs, especially with downloads turned off.
5. Upgrade with the next MSI and uninstall it again.