hyprnote - Moses Yebei

The Problem

Teams need a way to capture meeting content without exposing it to cloud services. Existing transcription tools either stream audio to third‑party APIs or require manual note‑taking, which breaks focus and raises privacy concerns.

What This Does

hyprnote is a self‑hosted suite that listens to audio, runs speech‑to‑text locally (via ONNX‑converted models), and stores the transcript in a Tauri‑based desktop UI. The UI lives in apps/desktop/, the transcription engine in apps/ai/ (apps/ai/src/main.rs), and the HTTP API that powers the web front‑end in apps/api/ (apps/api/src/index.ts). Key files:

apps/ai/Dockerfile – builds a Rust container with the transcription pipeline.
apps/api/package.json + apps/api/tsconfig.json – define the Node/TypeScript API server.
apps/desktop/src/store/zustand/tabs/index.ts – the central Zustand store that 34 other modules import (the “hub” module).
packages/agent-core/src/index.ts – provides the LangChain‑style agent used for summarisation.

The codebase is a portfolio of eight loosely coupled projects (apps, crates, plugins, packages, etc.), each with its own build artefacts, rather than a monolithic application.

How It Is Wired

Execution starts in the desktop client:

apps/desktop/src/services/apple-calendar/index.ts exports run (line 29). run invokes useTabs, which calls wrapSliceWithLogging six times, then reaches the UI components that render notes.
The transcription service is launched via the Rust binary built from apps/ai/src/main.rs. This binary is packaged in the apps/ai/Dockerfile and invoked by the desktop via an IPC bridge (see packages/tiptap/src/shared/utils.ts for md2json/json2md conversions).
API requests hit apps/api/src/index.ts, which routes through middleware (apps/api/src/middleware/index.ts) and observability (apps/api/src/observability/index.ts). The API’s fetch function (defined in apps/restate/src/index.ts) is called by many UI components (e.g., SearchResultGroup → cn).

The most widely used utility is packages/utils/src/cn.ts (cn), referenced from 38 places, making it a high‑blast‑radius hotspot. The Zustand store in apps/desktop/src/store/zustand/tabs/index.ts is similarly central, with 34 inbound imports.

A circular import chain exists among apps/desktop/src/store/tinybase/store/settings.ts, apps/desktop/src/config/use-config.ts, and apps/desktop/src/contexts/listener.tsx. This cycle inflates build times and complicates refactoring because any change ripples through the three modules.

Only two functions touch external resources: one reads/writes the SQLite database (via the fetch wrapper) and one reads/writes files (e.g., loading the ONNX model in apps/ai/src/main.rs). All other code is pure computation or UI state management.

How To Use It

# 1. Clone the repo
git clone https://github.com/moses-y/hyprnote
cd hyprnote

# 2. Build Rust components (AI transcription, Tauri backend)
cargo build --workspace          # uses Cargo.toml at repo root

# 3. Install and build the desktop UI (Node/TypeScript)
pnpm install                     # pnpm_install action is defined in .github/actions
pnpm run build                  # produces the Tauri bundle

# 4. (Optional) Run the API container
docker build -t hyprnote-api -f apps/api/Dockerfile .
docker run -p 3000:3000 hyprnote-api

Environment variables required by the API are defined in apps/api/.env.example (e.g., OPENAI_API_KEY, POSTHOG_API_KEY). The desktop client reads HYPRNOTE_MODEL_PATH to locate the ONNX model; the default path is set in apps/desktop/src/utils/index.ts.

Real‑World Use

A sales team installs the desktop client on each laptop, points HYPRNOTE_MODEL_PATH at a locally‑hosted Ollama model, and enables the Apple Calendar integration. During a client call, the app records audio, transcribes it in‑process, and stores the transcript in the encrypted local database. After the call, the user clicks “Summarise” – the UI calls packages/agent-core/src/index.ts to run a LangChain agent that produces a bullet‑point recap, which can be exported to Notion via the planned integration.

Code Health & Issues

High – Pin GitHub Actions: workflows reference actions by mutable tags (e.g., superfly/flyctl-actions/setup-flyctl@master). Replace with SHA‑pinned versions.
High – Vulnerable Dependency: tauri@2.9 has CVE‑2026‑42184. Upgrade to the patched release and update lockfiles.
Medium – Enable Dependabot: 209 manifest files lack an update bot; add .github/dependabot.yml.
Medium – Pin Docker Base Images: apps/ai/Dockerfile uses mutable tags (rust:${RUST_VERSION}-bookworm). Pin by digest.
Medium – Add Dependency‑Vulnerability Scan: CI lacks a dependency review step; integrate dependency-review-action or osv-scanner.
Medium – Move Large Binaries to LFS: apps/desktop/src-tauri/resources/libonnxruntime.dylib (31.9 MiB) and ONNX models exceed 5 MiB. Track with Git LFS or fetch from object storage in CI.
Medium – Checkout without Persisted Credentials: .github/workflows/desktop_cd.yaml keeps the token after checkout; add with: persist-credentials: false.
Low – Set Workflow Timeouts: desktop_cd.yaml lacks timeout-minutes; define a reasonable bound.

The Bottom Line

hyprnote delivers a locally‑hosted, end‑to‑end meeting‑note workflow, but the codebase is fragmented and contains several high‑impact hotspots (central utility modules and import cycles) that increase maintenance risk. Security hygiene needs tightening (pinned actions, base images, and large binaries). Teams comfortable managing Rust/Tauri builds and willing to address the identified hotspots can adopt it for privacy‑first transcription; otherwise the onboarding effort may be non‑trivial.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

3,671 files

Rust813
TypeScript628
TSX414
TOML406
JSON237
Markdown82

ReactDockerTransformersONNXLangChain

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["apps 596 modules"] g1["packages 124 modules"] g2["plugins 81 modules"] g3["extensions 10 modules"] g4["e2e 5 modules"] g5["scripts 5 modules"] g6["(root) 2 modules"] g0 -->|3| g1 g0 -->|1| g3

Module dependencies

The 10 most depended-upon modules of 823, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_store_zustand_tabs_index["index"] n1_apps_desktop_src_utils_index["index"] n2_tore_tinybase_store_settings["settings"] n3_apps_api_src_env["env"] n4_ybase_persister_shared_index["index"] n5_apps_desktop_src_billing["billing"] n6_esktop_src_config_use_config["use-config"] n7_esktop_src_contexts_listener["listener"] n8_apps_desktop_src_auth_index["index"] n9_d_ai_task_task_configs_index["index"] n9_d_ai_task_task_configs_index --> n2_tore_tinybase_store_settings n5_apps_desktop_src_billing --> n8_apps_desktop_src_auth_index n5_apps_desktop_src_billing --> n1_apps_desktop_src_utils_index n6_esktop_src_config_use_config --> n7_esktop_src_contexts_listener n6_esktop_src_config_use_config --> n2_tore_tinybase_store_settings n7_esktop_src_contexts_listener --> n6_esktop_src_config_use_config classDef cyc stroke:#ef4444,stroke-width:2px; class n2_tore_tinybase_store_settings,n6_esktop_src_config_use_config,n7_esktop_src_contexts_listener,n9_d_ai_task_task_configs_index cyc;

Dependencies

7 of 144 declared dependencies are a major version behind. Resolved 22 of 144 against the registry.

Package	Declared	Latest	Behind
`stripe`	^19.3.1	22.5.0	3 major
`typescript`	^5.9.3	7.0.2	2 major
`@posthog/ai`	^7.8.2	8.8.0	1 major
`hono-openapi`	^0.4.8	1.3.1	1 major
`openai`	^6.17.0	7.4.0	1 major
`zod-openapi`	^5.4.6	6.0.1	1 major
`@dotenvx/dotenvx`	^1.52.0	2.21.0	1 major

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them apps/bot/test/fixtures/mock-cert.pem

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low1

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

superfly/flyctl-actions/setup-flyctl@master, mathieudutour/github-tag-action@v6.2, ncipollo/release-action@v1

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh

tauri@2.9 CVE-2026-42184 (medium)

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Enable Dependabot or Renovatemedium

209 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium3 occurrences

apps/ai/Dockerfile

rust:${RUST_VERSION}-bookworm, rust:${RUST_VERSION}-bookworm, debian:bookworm-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium16 occurrences

apps/desktop/src-tauri/resources/libonnxruntime.dylib

16 blobs over 5MB: libonnxruntime.dylib 31.9MB, embedding.onnx 27.9MB, model_512_2.onnx 23.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/desktop_cd.yaml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/desktop_cd.yaml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.