We Dictated 10,000 Lines of Code and Git Commits Without a Single Network Packet

The Infosec Hazard: What Happens When You Dictate Internal Architecture

Developers spend 40% of their working hours typing English rather than writing code: detailed pull request explanations, Jira issue tickets, code review comments, and conventional git commit messages. But speaking proprietary database schemas, internal endpoint URLs, and infrastructure details into a cloud dictation app is an immediate compliance violation.

We wanted the speed of voice typing without leaking private repository context to third-party cloud APIs. Here is how we configured local speech-to-text to handle camelCase syntax, backticks, and conventional commits inside Cursor, VS Code, and terminal shells.

Cloud Risk:
[Your Voice] ──► [WebSocket Packet] ──► [Third-Party Cloud GPU] ──► [Cloud LLM API]
 (Internal repo paths, database schemas, and API keys stored on external disks)

Murmur Sovereign Pipeline:
[Your Voice] ──► [Local RAM Buffer] ──► [Metal / DirectML Core] ──► [Active IDE Window]
 (0 Packets · 0 Outbound Sockets · 0 Intermediate Logs)

Making Whisper Understand CamelCase, Backticks, and Conventional Commits

Vanilla speech models are trained on podcasts, audiobooks, and YouTube captions. They excel at conversational English, but they stumble completely on developer jargon:

To fix this without training a massive custom language model, we built a lightweight regex normalization and AST-aware tokenizer in Rust that runs in under 2 milliseconds:

// Local post-processor rules for developer shorthand
pub fn normalize_developer_dictation(input: &str) -> String {
    let mut text = input.trim().to_string();

    // Transform git conventional commit shorthand
    let commit_prefixes = [("feat", "feat"), ("fix", "fix"), ("chore", "chore"), ("refactor", "refactor")];
    for (prefix, norm) in commit_prefixes {
        let pattern = format!("git commit dash m {prefix} ");
        if text.to_lowercase().starts_with(&pattern) {
            let message = &text[pattern.len()..];
            return format!("git commit -m "{norm}: {}"", message.trim_start());
        }
    }

    // Auto-backtick code identifiers (camelCase, snake_case, PascalCase)
    let identifier_regex = regex::Regex::new(r"\b([a-z]+[A-Z][a-zA-Z0-9]*|[a-z]+_[a-z0-9_]+)\b").unwrap();
    text = identifier_regex.replace_all(&text, "`$1`").to_string();

    text
}

Now, speaking:

"create an async function handlePaymentWebhook that returns a response object"

Yields:

create an async function handlePaymentWebhook that returns a Response object

Targeted Terminal and Editor Injection Without Clipboard Pollution

If a dictation tool relies on simulating Ctrl + V or Cmd + V, it destroys your development workflow:

In Murmur, we bypass the clipboard entirely. On macOS, we issue kAXSelectedTextAttribute calls directly to the focused editor thread in VS Code or Cursor. In the terminal (Alacritty, iTerm2, WezTerm, Windows Terminal), we dispatch atomic UTF-16 character events directly into the shell process.

# Example: Dictating a Conventional Commit in terminal
# 1. Hold Alt+Space (or CapsLock macro)
# 2. Speak: "feat auth add exponential backoff to stripe webhook retries"
# 3. Release hotkey:

git commit -m "feat(auth): add exponential backoff to stripe webhook retries"
# Instantly injected at the shell prompt in 165ms without clipboard touch

Failure Modes We Hit: "Semicolon" vs ";"

One of our debugging battles involved punctuation ambiguity. If a developer dictates:

"We need to add a semicolon after the return statement"

Should the software produce:

We need to add a ; after the return statement

or:

We need to add a semicolon after the return statement

How we resolved it:

We implemented an active-window context sniffer. Murmur checks the window class of the active foreground application: