typing-insight — DSH typing analytics & app usage tracker

Local-first input recorder, daily/weekly statistics, topic analysis and app usage tracking for DeepSeek Harness Desktop (Windows x64). Chinese documentation: README.zh-CN.md.

Privacy first (read before install)

• Global keyboard hook for key counts; committed text is read via UI Automation from focused controls.
• Password fields are fail-closed: never recorded (keys and text both blocked). Unknown controls are treated as passwords.
• Sensitive data (phone / ID / bank card / email) is masked before it touches disk.
• Plaintext storage: data lives in local SQLite files without disk encryption (encryption is a documented, unimplemented feature). The protection is content-level masking, not full-disk security. Do not enable on shared machines.
• No network requests at runtime; no window titles, mouse coordinates, screenshots or clipboard content are captured.
• First run requires explicit authorization: the plugin starts paused; enable capture from the settings panel after reviewing the scope list.
• WeChat 4.1.x (MMUI closed rendering): keys only, no text capture.

Full details: PRIVACY.md · SECURITY.md · RELEASE.md · THIRD_PARTY_NOTICES.md.

Install

dsh plugin add @sharelights/dsh-typing-insight@next

(RC channel: the next dist-tag. For local tarball installs: dsh plugin add ./sharelights-dsh-typing-insight-1.0.0-rc.1.tgz.)

Then open Settings → 输入记录与统计 (Typing Insight): review the recording scope, click 开始采集 (Start capture).

Uninstall: remove the dependency from the DSH profile's package.json and restart DSH Desktop. Uninstalling does not delete recorded data — clear it first (/typing clear) or delete %USERPROFILE%\.dsh\data\typing-insight\.

Commands (10 tools)

Command	Purpose
/typing status	capture state, hook/UIA health, today counts, DB size
/typing today [date]	daily stats: units/keys/active time/speed/app & hourly distribution
/typing report [week-offset]	weekly trend, top apps, keywords, summary
/typing analyze [date|all]	keywords, topic clusters (≤5), local extractive summary
/typing export date [md|json|csv]	daily report export with SHA-256
/typing usage [date]	per-app foreground / foreground-active / strong-interaction minutes + gaps
/typing pause / resume	pause / resume capture
/typing clear [date]	delete recorded data (confirmation required, unrecoverable)
/typing config	get/set config (scope, retention, hotkey, analysis)

Capture behavior & compatibility

App type	Keys	Text
Chromium / UIA apps (Chrome, Edge, ChatGPT, DingTalk, DSH Desktop…)	✓	✓
Standard Win32 edit controls (Notepad…)	✓	✓
IMM32 fallback channel	✓	partial
WeChat 4.1.x (MMUI closed renderer)	✓	✗ (keys-only, badge shown in panel)
Password fields	✗	✗
Fullscreen-exclusive apps (games)	✓ (keys-only, capture_mode=2)	✗

Software usage time is tracked with three metrics side by side: foreground / foreground-active (default core metric; foreground and not AFK — an estimate, not actual work output) / strong-interaction. AFK default 180s (60/180/300 configurable), unknown gaps are never attributed to any app.

Limitations & known issues

• SQLite is not encrypted (FR-022 not implemented).
• Helper exe is not Authenticode-signed yet — this release is rc/beta only (not latest). SHA-256 is published in RELEASE.md.
• Extractive local summary (generative model summary not implemented).
• See SECURITY.md and RELEASE.md §7/§9 for the full lists.

Development

• npm test — full regression (10 suites; add --with-e2e for the focus-stealing E2E).
• npm run verify:release — package hygiene gate (runs automatically on npm pack via prepack).
• npm pack --dry-run --json — inspect the publish tarball.
• Helper source: native/uia/Program.cs (.NET Framework 4.8, compiled with csc; the prebuilt exe ships in the package).

License

MIT © 2026 sushare. See LICENSE.