Don't Put a Tap in Everyone's Keyboard

"A suppressing event tap is a tollbooth on every keystroke the machine makes. Be very sure you want that job."

The Requirement

Firekeeper's default activation is a bare Fn hold — no chord, just hold the key you never use and talk. That's a lovely interaction and a genuinely awkward thing to implement, because a bare modifier isn't a normal hotkey. There's no "Fn pressed" event in the ordinary shortcut APIs; modifiers announce themselves through flag changes, and you have to reconstruct press-and-hold from that.

The Tempting Wrong Tool

The obvious answer is a CGEventTap: sit in the system-wide event stream, watch every key, and swallow the ones you claim. It works — and it makes your app a tollbooth on every keystroke the machine produces. If your tap misbehaves, you don't break your app; you break typing, everywhere. That's not hypothetical: a competitor's suppressing tap is exactly what ate users' spacebars. And the permission does not warn you: a suppressing tap is authorized by the same Accessibility grant you already hold for insertion, so that grant quietly becomes a seat in every keystroke. (A listen-only keyboard tap is the kind that needs Input Monitoring, a second prompt; a suppressing one needs nothing new, which is its own kind of danger.)

CGEventTap (rejected):        flagsChanged + keyState (chosen):
  sits in every keystroke       observes modifier flag changes only
  can suppress system-wide      cannot swallow anyone's keys
  same grant, far more power    rides the Accessibility trust we already have
  competitor's ate spacebars    can't eat what it doesn't intercept

The Chosen Path

Firekeeper watches NSEvent flagsChanged monitors instead, and uses CGEventSource.keyState to disambiguate the cases flags alone can't — most notably telling a press from a release when the twin modifier (the other Command key, say) is still held down. It works with the Accessibility trust the app already holds for insertion, adds no new permission surface, and structurally cannot swallow a keystroke, because it never intercepts the stream in the first place. Same interaction, a fraction of the blast radius.

EV v2 · 2026-10-12: Observation won again when voice chat needed keys. Its default cut-in key is Left ⌘ tapped alone, built the same way: only watched through flagsChanged, never held, and counted as a tap only if nothing else happened between press and release — no key, no click, no other modifier, under a second — so ⌘C and ⌘Tab never cut Pippa off, and no Input Monitoring is needed. The pause key (Space) is taken only while the voice panel is the key window, after a Space typed in another app resumed a paused talk. And the binding rules tightened: Firekeeper now accepts only keys it can name — ⌘⌥F13 once recorded, worked, and showed in Settings as "⌘⌥key 105" — with naming moved to the family kit and Caps Lock refused, because hold-to-talk on a latching key is an open microphone.

Prefer observation over interception. When you need to know about system events, watching is dramatically safer than standing in the path. An observer that misbehaves logs a wrong value; an interceptor that misbehaves breaks the system for every app. Reach for interception only when you genuinely must consume the event — and for a push-to-talk key, you don't.

Fn double-fires as the 🌐 key. On modern macOS the Fn key is also the Globe key, so a bare Fn hold can trigger the system's emoji/input-source picker on top of your dictation. There's no code fix — the user sets 'Press 🌐 key to: Do Nothing' in System Settings. Which is why every binding is customizable and the Setup panel surfaces the hint: an interaction that depends on an OS setting must tell the user about that setting.

The Requirement

The Tempting Wrong Tool

The Chosen Path

Code

External links

Exercise

Progress

Comments 0