sttapp

System-wide speech-to-text desktop app built with Flutter and rust pluggins. (Currently only tested in Fedora)

sttapp records audio, transcribes it with an OpenAI-compatible API, copies the transcript to the clipboard, and can paste it into the active application. The app supports global shortcuts, tray controls, and local settings storage.

The repository also contains an optional hosted-service backend. Manual-provider credentials remain local and are never sent to the hosted backend. See backend/README.md for its architecture and development workflow.

Recommendation to use Groq's Whisper 3 large turbo for the best experience.

Pre-built Binaries

Take a look here

Building from source

• Flutter stable
• Dart SDK from Flutter
• Rust stable
• Platform desktop build tools:
  • Linux: clang, cmake, ninja-build, pkg-config, libgtk-3-dev, libayatana-appindicator3-dev, libkeybinder-3.0-dev, libasound2-dev, cargo
  • macOS: Xcode command line tools
  • Windows: Visual Studio C++ build tools
• Linux runtime secret storage requires an available and unlocked Secret Service provider such as GNOME Keyring or KWallet.

Development

Install dependencies:

flutter pub get

Run the desktop app:

flutter run -d linux
flutter run -d macos
flutter run -d windows

Released builds embed tags in the form v<year>.<major>.<mmdd>.<unix-seconds>. To exercise the update UI without a published release, provide both the current and fake latest tags in a debug build:

flutter run -d linux \
  --dart-define=STTAPP_RELEASE_TAG=v2026.1.0713.1783900800 \
  --dart-define=STTAPP_FAKE_LATEST_TAG=v2026.1.0713.1783904400

The fake tag is ignored in release builds. Give both defines the same value to test the “latest version” status; open Settings from the tray because an up-to-date app remains hidden at startup. Replace linux with macos or windows to test another desktop target.

Automatic updates

Signed release builds check the latest GitHub Release on startup. When a newer version is available, sttapp downloads it in the background, verifies its Ed25519-signed descriptor, exact byte length, and SHA-256 digest, waits for any recording or transcription to finish, then installs it and relaunches.

• Windows runs the verified Inno Setup installer. Program Files installations require the normal UAC approval.
• macOS replaces the application bundle only for Developer ID signed, notarized releases.
• Linux AppImage releases atomically replace the running AppImage when its containing directory is writable. Extracted tar installations continue to use the GitHub release fallback.

Automatic update publishing is enabled by configuring these GitHub Actions secrets:

• STTAPP_UPDATE_PRIVATE_KEY: base64-encoded raw 32-byte Ed25519 private seed.
• STTAPP_UPDATE_PUBLIC_KEY: matching base64-encoded raw 32-byte public key.
• MACOS_CERTIFICATE_BASE64, MACOS_CERTIFICATE_PASSWORD, and MACOS_SIGNING_IDENTITY: Developer ID Application certificate.
• MACOS_NOTARY_APPLE_ID, MACOS_NOTARY_PASSWORD, and MACOS_TEAM_ID: notarization credentials.
• WINDOWS_CERTIFICATE_BASE64 and WINDOWS_CERTIFICATE_PASSWORD: optional Authenticode PFX.
• WINDOWS_AUTHENTICODE_SHA256: optional SHA-256 certificate thumbprint pinned by the Windows installer handoff.

STTAPP_UPDATE_PUBLIC_KEY_ID is an optional repository variable and defaults to stable-2026. Release metadata is generated only when both update signing keys are configured. Versioned artifacts and descriptors are uploaded before the app-archive.json index becomes visible through the published release. The automatic updater compares the first three numeric tag components, so increment the tag's second component when publishing more than once on the same calendar day.

Build a release:

flutter build linux --release
flutter build macos --release
flutter build windows --release

Installing on Windows

Download and run sttapp-windows-x64-<version>-setup.exe. The installer copies the complete application bundle and installs the required Microsoft Visual C++ Redistributable. Administrator approval is required because both are installed for all users under Program Files.

If the app does not open, its early native and Dart startup diagnostics are in %LOCALAPPDATA%\sttapp\startup.log. Installer diagnostics can be captured by running the setup executable with /LOG="sttapp-installer.log".

Troubleshooting global shortcuts

The app verifies both global shortcuts whenever it starts. If registration fails, it retries after two seconds and then after another four seconds. If the third attempt fails, the settings window stays open with the failed combination and a Retry registration action. Release the shortcut in the other application, or select another function key on macOS and Windows, then retry. Registration attempts and shortcut activation events are written to the startup log (%LOCALAPPDATA%\sttapp\startup.log on Windows and $TMPDIR/sttapp/startup.log on Linux and macOS).

Installing on macOS

macOS releases are distributed as a single universal DMG that runs natively on both Intel and Apple Silicon Macs. Open the DMG and drag sttapp.app into the Applications folder.

The current DMG is not Developer ID signed or notarized. On first launch, Control-click sttapp.app in Finder, choose Open, and confirm that you want to run it. On macOS versions that do not offer that confirmation immediately, attempt to open the app once and then use **System Settings > Privacy & Security

Open Anyway**.

sttapp needs both of these permissions before capture is enabled:

• Microphone records audio only after you start a transcription.
• Accessibility sends the paste shortcut to the application that was active when transcription started.

The first-run setup window explains and requests both permissions. If access is denied or later revoked, open System Settings > Privacy & Security, select Microphone or Accessibility, enable sttapp, and return to the app. The status refreshes when the setup window regains focus.

Unsigned development releases may cause macOS to request approval or privacy permissions again. Production automatic updates are enabled only when the release workflow has signed, notarized, and stapled the application.

Project Layout

• lib/ contains the Flutter app.
• backend/ contains the optional Deno/PostgreSQL hosted service.
• packages/sttapp_audio/ contains the native audio and FLAC package.
• packages/sttapp_input/ contains native input and paste helpers.
• packages/sttapp_secret_storage/ contains native secret-store implementation helpers.
• linux/, macos/, and windows/ contain desktop platform runners.
• .github/workflows/ contains CI and release publishing workflows.