
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@mouadja02/murmur
Advanced tools
Voice-first prompt engineering for vibe coders. Floating overlay that turns your voice into clean, structured prompts using local Whisper + your own local LLM.
Murmur is a tiny floating button that sits on top of your desktop. You tap it and talk, and a few seconds later a clean, structured prompt appears exactly where your cursor is — in Cursor, ChatGPT, a terminal, a GitHub issue, anywhere.
Under the hood, your voice is transcribed on your own machine (with whisper.cpp), then rewritten into a high-quality prompt by your own local LLM (Ollama, LM Studio, llama.cpp server — your choice). Nothing ever leaves your computer unless you explicitly configure a cloud endpoint.
Think of it as:
"I know what I want, I just don't want to type it."
Ctrl+Shift+Space) and talk. A soundbar reacts while you speak.You stay in flow. No context switch. No "open app, paste, reformat, paste again."
You need Node.js 20+, a working microphone, and a local LLM server running somewhere (see the table further down if you're not sure which). Windows 10/11, macOS 12+, and modern Linux (X11; Wayland via Xwayland) are all supported.
npx @mouadja02/murmur
That pulls the published package from npm, runs the pre-launch banner, and spins up the overlay.
On the first run, Murmur detects your OS and walks you through setup interactively. It first asks for your LLM connection:
── LLM setup ─────────────────────────────────────────────
? LLM_PROVIDER (ollama | openai-compat | anthropic)
? LLM_BASE_URL (suggested: http://localhost:11434)
? LLM_MODEL (example: qwen3:4b)
If LLM_PROVIDER, LLM_BASE_URL, or LLM_MODEL already exist in your environment or .env, Murmur shows them as defaults. Press Enter to keep using the env value without writing over it in config.json. If no env value exists, Murmur requires an explicit answer so you do not accidentally launch against the wrong model.
If whisper-cli and/or the model file are missing, it asks:
── First-time setup ────────────────────────────────────────
o whisper-cli not found at /home/you/.config/murmur/whisper-cli
? Install whisper.cpp now? (builds from source, ~2-5 min) (Y/n)
o whisper model not found at /home/you/.config/murmur/models/ggml-base.en.bin
? Download ggml-base.en.bin (~148 MB)? (Y/n)
Say yes and Murmur does the rest — building whisper.cpp from source on Linux/macOS (or downloading a prebuilt binary on Windows), downloading the model, and writing the correct paths into your config file. No manual setup script, no editing JSON.
If you prefer to run the setup step manually (e.g. on a CI agent):
# Windows: downloads whisper-cli.exe + ggml-base.en.bin into <userData>/bin/whisper/
npx @mouadja02/murmur setup:whisper
# macOS / Linux: downloads ggml-base.en.bin into ./models/
# and prints the exact command to install whisper-cli via your package manager
npx @mouadja02/murmur setup:whisper
npm install -g @mouadja02/murmur
murmur
After this, murmur is on your PATH and you can launch it from any terminal.
git clone https://github.com/mouadja02/murmur.git
cd murmur
pnpm install
pnpm setup:whisper
pnpm dev
Options A-C drop you in the same overlay flow. The first run creates a config file at %APPDATA%\murmur\config.json (Windows), ~/Library/Application Support/murmur/config.json (macOS), or ~/.config/murmur/config.json (Linux), pre-filled with just the absolute whisper, logs and skills paths (every other setting uses its built-in default until you change it), and prints a banner in the terminal. Grab the control panel URL it shows (default http://localhost:7331) to tweak things in a browser without touching JSON.
Run Murmur as a local MCP server for Cursor, Claude Code, VS Code Copilot, or any Streamable HTTP MCP client:
murmur serve --port 7331 --mcp-port 7332
| Service | URL |
|---|---|
| Control panel | http://127.0.0.1:7331 |
| MCP (Streamable HTTP) | http://127.0.0.1:7332/mcp |
Headless recording uses a local command, not the Electron overlay mic:
sox on PATH)arecord on PATH)Override with --recorder-command or MURMUR_RECORDER_COMMAND if needed.
If startup fails with headless recorder command not found: sox, install SoX and restart your terminal:
winget install --id ChrisBagwell.SoX -e
sox --version
If sox --version still fails, add the SoX install folder to PATH or pass the full executable path with --recorder-command.
If winget says SoX is already installed but sox --version still fails, the portable install may be incomplete or not linked into PATH. Remove and reinstall it, then verify again:
winget uninstall --id ChrisBagwell.SoX -e
winget install --id ChrisBagwell.SoX -e
sox --version
Integration guides:
.cursor/mcp.json.mcp.json / claude mcp add.vscode/mcp.jsonLinux runtime deps. The overlay's global hotkeys + paste injection use
uiohook-napi+@nut-tree-fork/nut-js, which link against X11 at runtime. On Ubuntu/Debian:sudo apt-get install -y libx11-6 libxtst6 libxkbcommon0Most desktops ship these by default; install them if the overlay fails to boot with an
Error loading shared librarymessage.
macOS accessibility permission. Synthetic key events (the
Cmd+Vpaste step) require Murmur to be granted Accessibility access. On first run, macOS will prompt you automatically. If you dismissed the prompt, go to System Settings → Privacy & Security → Accessibility, findElectron(orMurmur), and toggle it on. Without this permission the overlay runs but the refined text will not be pasted at your cursor.
If you don't have a local LLM yet, the fastest path is:
# Install Ollama from https://ollama.com, then: ollama pull qwen3:4bMurmur targets
qwen3:4bon Ollama by default.
Four stages, strictly local:
| Stage | What happens |
|---|---|
| Capture | The overlay records 16 kHz mono PCM while you hold the hotkey (or between two clicks). |
| Transcribe | whisper.cpp turns the WAV into text on your CPU. |
| Refine | Your local LLM rewrites the transcription into a concise prompt using your active system prompt + enabled skills. |
| Inject | Murmur copies the refined text, fires Ctrl+V (Windows/Linux) or Cmd+V (macOS) at your current cursor, and keeps the generated prompt on your clipboard by default. |
Every session gets a timestamped folder under logs/. By default it stores timings and errors only; enable Full debugging in the control panel if you want audio, raw transcription, system prompt, and refined output persisted locally.
Ctrl+Shift+Space.Ctrl+Shift+H hides / shows the overlay from any app.http://) is refused with a message next to the field instead of being reported as saved..md files into ./skills/, toggle them on/off from the panel. Import directly from a local file or a raw URL. Version-controllable, shareable.--flag or env var, the control panel marks it read-only with a clear badge and tooltip explaining exactly how to unlock it. If an env var is set but a flag or config.json outranks it, the field stays editable and a note says why the env var has no effect.pnpm dev shows your current setup and offers a one-key menu to edit the prompt or jump to the panel.logs/<timestamp>/ for full traceability.murmur serve exposes Streamable HTTP tools (murmur_record, murmur_transcribe, murmur_refine, skills) for IDE agents without launching Electron.Open it from the overlay (right-click → Open control panel), from the pre-launch terminal menu, or by pasting http://localhost:7331 into your browser.
| Tab | What you can do |
|---|---|
| System prompt | Live-edit the active prompt and see the composed preview (base + enabled skills). |
| Skills | Add, edit, rename, delete skills. Import from a local .md file or any raw Markdown URL (GitHub raw, Gist, …). One click to enable/disable each. |
| Provider | Switch provider, base URL, model, API key, temperature. One-click presets for local and online providers. Test connection button reports latency. Fields whose value comes from a CLI flag or env var are shown read-only with a lock badge — see Config precedence. |
| Whisper | Point to a different whisper-cli binary (or whisper-cli.exe on Windows) or .bin model. |
| Hotkeys | Bind push-to-talk and toggle combos, choose insertion mode, and decide whether the generated prompt stays on the clipboard after auto-paste. |
| Paths | Logs dir, skills dir, and the resolved config file path. |
| Model guide | Hardware-tiered model recommendations with one-click ollama pull copy commands. |
Every save writes back to the config file atomically and hot-reloads in the running app — no restart needed.
Auto-refresh and form protection. The panel polls
/api/stateevery 4 seconds to keep the composed system prompt and skill list in sync. It will never overwrite a field you are actively editing — each form section tracks its own "dirty" state and auto-refresh skips it until you save.
Skills are small Markdown files that layer onto your base system prompt when enabled. Perfect for "always talk like a senior Go reviewer", "bias toward concise output", or project-specific vocabulary.
Each skill lives at skills/<id>.md:
---
id: concise-output
name: Concise output
description: Trim filler, keep the prompt to the point.
---
Prefer terse, structured prompts. Use bullets for constraints.
No hedging, no apologies, no restating the question.
You can author them in your editor (they're git-friendly) or in the control panel's Skills tab. Enabled skills are concatenated under an ## Active skills header in the prompt sent to the LLM.
The Skills tab has an ↑ Import button that opens an import panel with two tabs:
.md file onto the drop zone. Parses YAML frontmatter (id, name, description) and body, then pre-fills the new-skill form..md file.Both paths land in the new-skill form where you can review and adjust before saving.
Pick one. The openai-compat provider covers practically every local server that speaks the OpenAI chat-completions dialect — and also cloud endpoints like OpenAI and OpenRouter.
| Provider | --provider | Default base URL | Known-good servers |
|---|---|---|---|
| Ollama (native) | ollama | http://localhost:11434 | Ollama. Uses /api/generate with think:false. |
| OpenAI-compatible | openai-compat | http://localhost:1234/v1 | LM Studio, llama.cpp server, vLLM, Jan, KoboldCpp, oobabooga, Ollama's own /v1 endpoint — and OpenAI, OpenRouter, Groq (online). |
| Anthropic (Claude) | anthropic | https://api.anthropic.com/v1 | Claude 3 Haiku, Sonnet, Opus. Requires an API key. ☁ Online. |
openai-compatexpects the full base URL including/v1— Murmur will not append it for you.
anthropicalso expects/v1in the base URL (https://api.anthropic.com/v1).
⚠️ Online provider data notice. When
baseUrlpoints to a hostname (notlocalhostor an IP address), the control panel shows a warning banner after you save. Cloud providers receive your voice transcription text and refined prompts. Review each provider's privacy and data-retention policy before use. We recommend a local model for any sensitive or proprietary work — see the Model guide below.
# Ollama (default)
ollama pull qwen3:4b
pnpm dev
# LM Studio — load a model, click "Start Server"
pnpm dev --provider openai-compat --base-url http://localhost:1234/v1 --model qwen/qwen3-1.7b
# llama.cpp server
# llama-server -m models/qwen3-4b.Q4_K_M.gguf --port 8080
pnpm dev --provider openai-compat --base-url http://localhost:8080/v1 --model qwen3
# Generic, with an API key
pnpm dev --provider openai-compat --base-url http://localhost:5000/v1 --model my-model --api-key sk-xxx
# OpenAI (online ☁)
pnpm dev --provider openai-compat --base-url https://api.openai.com/v1 --model gpt-4o-mini --api-key sk-...
# Anthropic Claude (online ☁)
pnpm dev --provider anthropic --base-url https://api.anthropic.com/v1 --model claude-haiku-4-5 --api-key sk-ant-...
# OpenRouter (online ☁ — free models available)
pnpm dev --provider openai-compat --base-url https://openrouter.ai/api/v1 --model meta-llama/llama-3.1-8b-instruct:free --api-key sk-or-...
# Groq (online ☁ — very fast inference)
pnpm dev --provider openai-compat --base-url https://api.groq.com/openai/v1 --model llama-3.1-8b-instant --api-key gsk_...
| Action | Behaviour |
|---|---|
| Click the pill | Toggles recording (start / stop) |
Hold Ctrl+Shift+Space | Push-to-talk: records while held, processes on release |
Tap Ctrl+Shift+H | Show / hide the overlay from anywhere |
| Drag the pill | Moves it; the new position survives restart |
| Right-click the pill | Context menu: open control panel · hide · reset position · quit |
| Hover the pill | Tooltip with provider · model · both hotkeys · hints |
After Murmur finishes bootstrapping it prints a compact status block in the terminal with clickable links (thanks to OSC-8 hyperlinks — works in Windows Terminal, iTerm2, VS Code, Alacritty, WezTerm, Kitty and most modern emulators):
o murmur is ready
Overlay show / hide / toggle
Panel http://localhost:7331
Hotkeys Ctrl+Shift+Space (push-to-talk) / Ctrl+Shift+H (toggle)
murmur://show, murmur://hide, murmur://toggle URL scheme. Clicking them (Ctrl-click in some terminals) routes the action straight into the already-running Murmur instance via Electron's single-instance lock — no browser tab opens. Registration happens automatically the first time Murmur starts; on Linux a .desktop file is written to ~/.local/share/applications/.http:// URL and opens the control panel in your default browser.The same overlay controls live in the Overlay widget at the top-right of the browser panel, with a live status pill (visible / hidden).
Settings are resolved in this order, highest to lowest:
CLI flags > config file > environment variables > built-in defaults
A key written in config.json therefore beats the same setting's env var, and a --model flag beats both. On first run Murmur only pre-fills the absolute whisper, logs and skills paths (skipping any whose env var is set at that moment), so env vars such as MURMUR_HOTKEY or MURMUR_RECORDER_COMMAND take effect until the matching key appears in config.json. Saving a field from the control panel writes it to config.json, which from then on outranks the env var.
The control panel reflects the order that is actually in effect. Any field whose current value comes from a CLI flag or env var is rendered read-only with a coloured badge beneath it:
Locked by --model CLI flag
Hovering the badge shows a tooltip: "Restart Murmur without the --model flag to edit this here."
If an env var is set but a higher-precedence source wins, the field is not locked. A note under it says so (for example "MURMUR_HOTKEY is set, but config.json overrides it"), and Murmur prints the same warning at startup. To make the env var take effect, remove that key from config.json. Configs created by Murmur 0.7 or earlier already contain every key, so their env vars stay shadowed until you do.
To unlock a locked field: remove the corresponding entry from your .env file or drop the flag from the pnpm dev command.
Every invocation writes a timestamped folder under logs/<ISO-timestamp>/. The default logMode is metadata-only, which avoids persisting audio, transcripts, system prompts, or refined prompts:
logs/2026-04-17T19-28-01-234Z/
├── whisper-stderr.log
└── timings.json # audioDurationMs, transcribeMs, refineMs, injectMs, totalMs
If you switch Paths → Session logging to full, Murmur also persists the content artifacts for local debugging:
logs/2026-04-17T19-28-01-234Z/
├── audio.wav # exactly what Whisper received
├── transcription.txt # Whisper's raw output
├── system-prompt.txt # base + enabled skills, as sent
├── refined.txt # what got pasted
├── whisper-stderr.log
└── timings.json # audioDurationMs, transcribeMs, refineMs, injectMs, totalMs
timings.json is your ground truth for end-to-end latency — see Latency below. Full logs may contain sensitive speech and prompt data; keep metadata-only for privacy-sensitive work.
CLI flags trump both the config file and environment variables. Append them after pnpm dev:
pnpm dev --provider openai-compat --base-url http://localhost:1234/v1 --model qwen/qwen3-1.7b
| Flag | Purpose |
|---|---|
--provider <ollama | openai-compat | anthropic> | Provider implementation |
--base-url <url> | Provider HTTP base URL |
--model <id> | Model identifier on the provider |
--api-key <key> | Bearer token (required for Anthropic; optional for openai-compat) |
--temperature <float> | Sampling temperature (default 0.2) |
--whisper-cli <path> | Path or PATH-resolvable name of whisper-cli (whisper-cli.exe on Windows) |
--whisper-model <path> | Path to a ggml-*.bin model file |
--hotkey <combo> | Push-to-talk combo (default Ctrl+Shift+Space) |
--toggle-hotkey <combo> | Show/hide combo (default Ctrl+Shift+H) |
--injection-method <auto|clipboard|type> | Insert by paste, type directly, or paste with typing fallback |
--clipboard-retention <keep-generated|restore-previous> | Keep the generated prompt on the clipboard after paste, or restore the previous clipboard |
--logs-dir <path> | Per-session logs directory |
--log-mode <metadata-only|full> | Persist timings/errors only, or full local debugging artifacts |
--skills-dir <path> | Skill .md files directory (default ./skills) |
--enabled-skills <a,b,c> | Comma-separated skill IDs to force-enable for this launch |
--system-prompt <text> | Override the active system prompt (skills still layer on top) |
--control-panel-port <n> | Control-panel port (default 7331; 0 = pick free) |
serve | Headless mode: control panel + MCP server, no Electron overlay |
--port <n> | Alias for --control-panel-port in serve mode |
--mcp-port <n> | MCP Streamable HTTP port (default 7332; 0 = pick free) |
--recorder-command <cmd> | Headless mic command (16 kHz mono S16 LE PCM on stdout) |
--overlay-anchor <bottom-center | bottom-right | top-right | free> | Docking corner |
--overlay-offset-x <px> / --overlay-offset-y <px> | Offset from the anchor |
--overlay-position <x,y> | Force a free-floating position |
--config <path> | Override the config file location |
--print-config | Print resolved config and exit |
-h, --help | Show help and exit |
Combo strings parse from Ctrl+Shift+Space form. Modifiers: Ctrl/Control, Shift, Alt/Option, Cmd/Win/Meta/Super. Keys: A–Z, digits, Space, Enter, Tab, Escape, F1–F12, and friends.
Note. Any field set via a CLI flag will appear locked in the control panel (read-only, with a badge). Drop the flag from the command to make the field editable again.
Auto-created on first run, under the OS user-data dir:
%APPDATA%\murmur\config.json~/Library/Application Support/murmur/config.json~/.config/murmur/config.json (respects $XDG_CONFIG_HOME)Every field is optional. A fresh file contains only whisperCliPath, whisperModelPath, logsDir and skillsDir; anything absent falls through to its env var, then to the built-in default. That includes the LLM fields (provider, baseUrl, model, apiKey), which first-run setup only writes when you choose to persist them. Configs created by Murmur 0.7 or earlier already contain every key, and those values outrank env vars until you delete them from the file.
{
"provider": "ollama",
"baseUrl": "http://localhost:11434",
"model": "qwen3:4b",
"apiKey": null,
"temperature": 0.2,
"whisperCliPath": "whisper-cli",
"whisperModelPath": "./models/ggml-base.en.bin",
"hotkeyCombo": "Ctrl+Shift+Space",
"toggleHotkeyCombo": "Ctrl+Shift+H",
"clipboardRestoreDelayMs": 150,
"clipboardRetention": "keep-generated",
"injectionMethod": "auto",
"overlay": {
"anchor": "bottom-center",
"offsetX": 0,
"offsetY": 24,
"position": null
},
"logMode": "metadata-only",
"logsDir": "./logs",
"skillsDir": "./skills",
"systemPrompt": "You refine a raw voice transcription …",
"enabledSkills": [],
"controlPanelPort": 7331,
"mcpPort": 7332,
"recorderCommand": "sox -q -d -r 16000 -c 1 -b 16 -e signed-integer -t raw -"
}
Any field can be omitted; missing fields fall through to defaults. overlay.position is written the first time you drag the pill — at that point overlay.anchor flips to "free" so the new spot survives restarts. Right-click → Reset position clears it.
Audio is always captured at 16 kHz mono (what whisper.cpp expects), so there is no sample-rate setting. A sampleRate key left in an older config is ignored (with a warning unless it is 16000). A custom recorderCommand must emit 16 kHz mono S16LE.
Environment variables have lower precedence than CLI flags and the config file (see Config precedence). They are useful for .env-based development workflows and Docker/systemd deployments. A fresh config.json contains only the whisper, logs and skills paths, so every other variable takes effect until you save that setting from the control panel or write it to the file. WHISPER_CLI_PATH, WHISPER_MODEL_PATH, MURMUR_LOGS_DIR and MURMUR_SKILLS_DIR only win when they are set before the first run or when the key is removed from config.json. If a variable is set but shadowed, Murmur warns at startup and the control panel says so next to the field.
| Variable | Maps to |
|---|---|
LLM_PROVIDER | provider |
LLM_BASE_URL (or OLLAMA_URL) | baseUrl |
LLM_MODEL | model |
LLM_API_KEY | apiKey |
LLM_TEMPERATURE | temperature |
WHISPER_CLI_PATH | whisperCliPath |
WHISPER_MODEL_PATH | whisperModelPath |
MURMUR_HOTKEY | hotkeyCombo |
MURMUR_TOGGLE_HOTKEY | toggleHotkeyCombo |
MURMUR_CLIPBOARD_RESTORE_DELAY_MS | clipboardRestoreDelayMs |
MURMUR_CLIPBOARD_RETENTION | clipboardRetention |
MURMUR_INJECTION_METHOD | injectionMethod |
MURMUR_LOGS_DIR | logsDir |
MURMUR_LOG_MODE | logMode |
MURMUR_SKILLS_DIR | skillsDir |
MURMUR_SYSTEM_PROMPT | systemPrompt |
MURMUR_ENABLED_SKILLS | enabledSkills (comma-separated) |
MURMUR_CONTROL_PANEL_PORT | controlPanelPort |
MURMUR_MCP_PORT | mcpPort |
MURMUR_RECORDER_COMMAND | recorderCommand |
Create a .env file in the project root to set them for pnpm dev. Any field whose value comes from one of these variables appears locked in the control panel with an env-var badge (e.g. Locked by LLM_MODEL env var). If the same field is set in config.json or by a CLI flag, that source wins instead: the field stays editable and a note explains that the env var is shadowed. Remove or comment out the line and restart to unlock a locked field.
From architecture.md §3.5 (mid-tier PC, small prompts):
| Stage | Target |
|---|---|
| Hotkey → recording start | < 50 ms |
| STT (~5 s of speech) | 200–400 ms (Parakeet) — whisper-base.en is slower on CPU |
LLM refinement (~200 tok out, qwen3:4b) | 800–1500 ms |
| Injection | < 100 ms |
Typical short utterance ("refactor this function to use async await") on a mid-tier laptop: ~2–4 s end-to-end, dominated by refineMs. Cold-start on the first request is markedly worse because the model hasn't been loaded into RAM/VRAM yet.
Choose a model that fits your hardware. All local tiers use Ollama — install from ollama.com, then ollama pull <model> and set the model name in the control panel's Provider tab.
| Tier | RAM | GPU VRAM | Recommended models | Pull command |
|---|---|---|---|---|
| Very low | ≤ 4 GB | CPU only | qwen2.5:0.5b, qwen3:0.6b, tinyllama | ollama pull qwen3:0.6b |
| Low | 8 GB | ≤ 4 GB / integrated | qwen3:1.7b, gemma3:2b, phi4-mini | ollama pull qwen3:1.7b |
| Mid ★ | 16 GB | 4–8 GB | qwen3:4b (default), llama3.2:3b, mistral:7b | ollama pull qwen3:4b |
| High | 32 GB | 10–16 GB | qwen3:8b, llama3.1:8b, phi4:14b | ollama pull qwen3:8b |
| Very high | 64 GB | 24+ GB | qwen3:14b, qwen3:30b-a3b, llama3.3:70b | ollama pull qwen3:14b |
| Online ☁ | any | any | gpt-4o-mini, claude-haiku-4-5, openrouter/* | API key required |
Not sure what tier you are?
- RAM: Windows → Task Manager → Performance → Memory. macOS → About This Mac. Linux →
free -h- GPU VRAM: Windows → Task Manager → GPU. macOS → About This Mac → Graphics. Linux →
nvidia-smi- Rule of thumb: the model file must fit in VRAM (GPU inference) or RAM (CPU inference). Leave ~2 GB headroom for the OS.
The interactive Model guide tab in the control panel (http://localhost:7331#model-guide) shows the same table with one-click ollama pull copy commands.
When baseUrl is a domain hostname (not localhost or a bare IP), Murmur shows a warning banner in the control panel after you save. Cloud providers process your data under their own terms:
For production or privacy-sensitive use, run a local model. The warning does not appear for IP addresses or localhost — those could be your own private server.
| Command | What it does |
|---|---|
pnpm dev | Clean + compile + launch Electron (with the pre-launch CLI) |
pnpm build | Clean + compile only (no launch) |
pnpm check | tsc --noEmit + biome check . |
pnpm format | biome format --write . |
pnpm test | Run the Node built-in test suite against dist/ |
pnpm test:ci | pnpm build && pnpm test |
pnpm clean | Remove dist/ |
pnpm setup:whisper | Windows: download whisper-cli.exe + ggml-base.en.bin. macOS/Linux: download the model + print install hints for whisper-cli. |
Every push and every PR to main runs the CI workflow (.github/workflows/ci.yml) on both Ubuntu and Windows:
pnpm install --frozen-lockfilepnpm check (typecheck + lint)pnpm buildpnpm testA red check blocks merge. Keep it green.
Releases are driven by git tags. To cut a new version:
# 1. Bump the version in package.json
pnpm version patch # or minor / major
# 2. Push the commit + tag
git push origin main --follow-tags
The Release workflow (.github/workflows/release.yml) then runs two jobs in sequence:
package.json matches the tag, runs pnpm check + pnpm test:ci, builds, zips bin/ + dist/ + scripts/ + skills/ + docs/ + package.json + lockfile + README + LICENSE + logo into murmur-v<version>-win-x64.zip, and attaches it to an auto-generated GitHub Release.pnpm publish --access public using the NPM_TOKEN secret. If the token isn't configured the job logs a warning and exits cleanly, so the GitHub Release still ships.You can also trigger the workflow manually from the Actions tab with a tag input (useful for re-releases).
NPM_TOKEN (one-time)NPM_TOKEN.Files shipped to npm are whitelisted in package.json#files — run pnpm pack locally to inspect exactly what the tarball will contain before publishing.
.github/dependabot.yml opens weekly npm PRs (split into dev-dependencies and runtime-dependencies groups) and monthly github-actions PRs.
keep_alive) is queued.auto mode can fall back from paste to typing, but there is not yet a per-app rules engine.ScriptProcessorNode. Move to AudioWorklet before any non-spike build.MIT © Mouad Ja. Pre-1.0; APIs and config may still change.
FAQs
Voice-first prompt engineering for vibe coders. Floating overlay that turns your voice into clean, structured prompts using local Whisper + your own local LLM.
The npm package @mouadja02/murmur receives a total of 2 weekly downloads. As such, @mouadja02/murmur popularity was classified as not popular.
We found that @mouadja02/murmur demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.