typing-insight — DSH typing analytics & app usage tracker
Local-first input recorder, daily/weekly statistics, topic analysis and app usage tracking for DeepSeek Harness Desktop (Windows x64). Chinese documentation: README.zh-CN.md.
Privacy first (read before install)
- Global keyboard hook for key counts; committed text is read via UI Automation from focused controls.
- Password fields are fail-closed: never recorded (keys and text both blocked). Unknown controls are treated as passwords.
- Sensitive data (phone / ID / bank card / email) is masked before it touches disk.
- Plaintext storage: data lives in local SQLite files without disk encryption (encryption is a documented, unimplemented feature). The protection is content-level masking, not full-disk security. Do not enable on shared machines.
- No network requests at runtime; no window titles, mouse coordinates, screenshots or clipboard content are captured.
- First run requires explicit authorization: the plugin starts paused; enable capture from the settings panel after reviewing the scope list.
- WeChat 4.1.x (MMUI closed rendering): keys only, no text capture.
Full details: PRIVACY.md · SECURITY.md · RELEASE.md · THIRD_PARTY_NOTICES.md.
Install
dsh plugin add @sharelights/dsh-typing-insight@next
(RC channel: the next dist-tag. For local tarball installs: dsh plugin add ./sharelights-dsh-typing-insight-1.0.0-rc.1.tgz.)
Then open Settings → 输入记录与统计 (Typing Insight): review the recording scope, click 开始采集 (Start capture).
Uninstall: remove the dependency from the DSH profile's package.json and restart DSH Desktop. Uninstalling does not delete recorded data — clear it first (/typing clear) or delete %USERPROFILE%\.dsh\data\typing-insight\.
Commands (10 tools)
| Command | Purpose |
|---|
| /typing status | capture state, hook/UIA health, today counts, DB size |
| /typing today [date] | daily stats: units/keys/active time/speed/app & hourly distribution |
| /typing report [week-offset] | weekly trend, top apps, keywords, summary |
| /typing analyze [date|all] | keywords, topic clusters (≤5), local extractive summary |
| /typing export date [md|json|csv] | daily report export with SHA-256 |
| /typing usage [date] | per-app foreground / foreground-active / strong-interaction minutes + gaps |
| /typing pause / resume | pause / resume capture |
| /typing clear [date] | delete recorded data (confirmation required, unrecoverable) |
| /typing config | get/set config (scope, retention, hotkey, analysis) |
Capture behavior & compatibility
| App type | Keys | Text |
|---|
| Chromium / UIA apps (Chrome, Edge, ChatGPT, DingTalk, DSH Desktop…) | ✓ | ✓ |
| Standard Win32 edit controls (Notepad…) | ✓ | ✓ |
| IMM32 fallback channel | ✓ | partial |
| WeChat 4.1.x (MMUI closed renderer) | ✓ | ✗ (keys-only, badge shown in panel) |
| Password fields | ✗ | ✗ |
| Fullscreen-exclusive apps (games) | ✓ (keys-only, capture_mode=2) | ✗ |
Software usage time is tracked with three metrics side by side: foreground / foreground-active (default core metric; foreground and not AFK — an estimate, not actual work output) / strong-interaction. AFK default 180s (60/180/300 configurable), unknown gaps are never attributed to any app.
Limitations & known issues
- SQLite is not encrypted (FR-022 not implemented).
- Helper exe is not Authenticode-signed yet — this release is rc/beta only (not
latest). SHA-256 is published in RELEASE.md.
- Extractive local summary (generative model summary not implemented).
- See SECURITY.md and RELEASE.md §7/§9 for the full lists.
Development
npm test — full regression (10 suites; add --with-e2e for the focus-stealing E2E).npm run verify:release — package hygiene gate (runs automatically on npm pack via prepack).npm pack --dry-run --json — inspect the publish tarball.- Helper source:
native/uia/Program.cs (.NET Framework 4.8, compiled with csc; the prebuilt exe ships in the package).
License
MIT © 2026 sushare. See LICENSE.
