fix: patch uiohook-napi to use listen-only CGEventTap on macOS

Fixes system-wide freeze when Accessibility permissions are enabled.
Two changes to libuiohook/src/darwin/input_hook.c via pnpm patch:
- Switch kCGEventTapOptionDefault to kCGEventTapOptionListenOnly
- Strip mouse move/drag/scroll/left/right-click events from mask

Listen-only taps are passive observers that cannot freeze the system.
Keeps keyboard events and mouse buttons 3+ for PTT side buttons.
Windows and Linux native paths are completely untouched.

package.json

@@ -15,7 +15,15 @@
     "build:desktop": "pnpm --filter @backspace/desktop build"
   },
   "pnpm": {
-    "onlyBuiltDependencies": ["better-sqlite3", "esbuild", "electron", "sharp"]
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild",
+      "electron",
+      "sharp"
+    ],
+    "patchedDependencies": {
+      "uiohook-napi@1.5.5": "patches/uiohook-napi@1.5.5.patch"
+    }
   },
   "engines": {
     "node": ">=20.0.0",

patches/uiohook-napi@1.5.5.patch

@@ -0,0 +1,44 @@
+diff --git a/libuiohook/src/darwin/input_hook.c b/libuiohook/src/darwin/input_hook.c
+index e6cd6cec9c3c5a26cda5eccc5fe9eb087752eef9..954f0c5fe8ba1325124cf6117d4b66a788c52a60 100644
+--- a/libuiohook/src/darwin/input_hook.c
++++ b/libuiohook/src/darwin/input_hook.c
+@@ -1149,34 +1149,26 @@ static int create_event_runloop_info(event_runloop_info **hook) {
+     }
+ 
+     // Setup the event mask to listen for.
++    // [Backspace patch] Stripped left/right mouse, mouse-move, drag, and scroll
++    // events. Backspace only needs keyboard + mouse buttons 3+ (PTT side buttons).
+     CGEventMask event_mask = CGEventMaskBit(kCGEventKeyDown) |
+             CGEventMaskBit(kCGEventKeyUp) |
+             CGEventMaskBit(kCGEventFlagsChanged) |
+ 
+-            CGEventMaskBit(kCGEventLeftMouseDown) |
+-            CGEventMaskBit(kCGEventLeftMouseUp) |
+-            CGEventMaskBit(kCGEventLeftMouseDragged) |
+-
+-            CGEventMaskBit(kCGEventRightMouseDown) |
+-            CGEventMaskBit(kCGEventRightMouseUp) |
+-            CGEventMaskBit(kCGEventRightMouseDragged) |
+-
+             CGEventMaskBit(kCGEventOtherMouseDown) |
+             CGEventMaskBit(kCGEventOtherMouseUp) |
+-            CGEventMaskBit(kCGEventOtherMouseDragged) |
+-
+-            CGEventMaskBit(kCGEventMouseMoved) |
+-            CGEventMaskBit(kCGEventScrollWheel) |
+ 
+             // NOTE This event is undocumented and used
+             // for caps-lock release and multi-media keys.
+             CGEventMaskBit(NX_SYSDEFINED);
+ 
+     // Create the event tap.
++    // [Backspace patch] Listen-only tap cannot freeze the system — macOS delivers
++    // events asynchronously without waiting for the callback to return.
+     (*hook)->port = CGEventTapCreate(
+             kCGSessionEventTap,       // kCGHIDEventTap
+             kCGHeadInsertEventTap,    // kCGTailAppendEventTap
+-            kCGEventTapOptionDefault, // kCGEventTapOptionListenOnly See https://github.com/kwhat/jnativehook/issues/22
++            kCGEventTapOptionListenOnly,
+             event_mask,
+             hook_event_proc,
+             NULL);

pnpm-lock.yaml

@@ -4,6 +4,11 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+patchedDependencies:
+  uiohook-napi@1.5.5:
+    hash: 58cc6a1bd7f69277c47fa5fb1d8342d52acc5a48c420c0e5854857ee6e783d51
+    path: patches/uiohook-napi@1.5.5.patch
+
 importers:
 
   .: {}
@@ -15,8 +20,11 @@ importers:
         version: 6.8.3
       uiohook-napi:
         specifier: ^1.5.5
-        version: 1.5.5
+        version: 1.5.5(patch_hash=58cc6a1bd7f69277c47fa5fb1d8342d52acc5a48c420c0e5854857ee6e783d51)
     devDependencies:
+      '@electron/rebuild':
+        specifier: ^3.7.1
+        version: 3.7.2
       electron:
         specifier: ^40.0.0
         version: 40.8.2
@@ -788,6 +796,12 @@ packages:
     resolution: {integrity: sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==}
     engines: {node: '>=12'}
 
+  '@electron/node-gyp@https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2':
+    resolution: {tarball: https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2}
+    version: 10.2.0-electron.1
+    engines: {node: '>=12.13.0'}
+    hasBin: true
+
   '@electron/notarize@2.5.0':
     resolution: {integrity: sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==}
     engines: {node: '>= 10.0.0'}
@@ -802,6 +816,11 @@ packages:
     engines: {node: '>=12.13.0'}
     hasBin: true
 
+  '@electron/rebuild@3.7.2':
+    resolution: {integrity: sha512-19/KbIR/DAxbsCkiaGMXIdPnMCJLkcf8AvGnduJtWBs/CBwiAjY1apCqOLVxrXg+rtXFCngbXhBanWjxLUt1Mg==}
+    engines: {node: '>=12.13.0'}
+    hasBin: true
+
   '@electron/universal@2.0.1':
     resolution: {integrity: sha512-fKpv9kg4SPmt+hY7SVBnIYULE9QJl8L3sCfcBsnqbJwwBwAeTLokJ9TRt9y7bK0JAzIW2y78TVVjvnQEms/yyA==}
     engines: {node: '>=16.4'}
@@ -4290,6 +4309,10 @@ packages:
     peerDependencies:
       react: '>=16.0.0'
 
+  proc-log@2.0.1:
+    resolution: {integrity: sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==}
+    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+
   process-nextick-args@2.0.1:
     resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
 
@@ -6143,6 +6166,22 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@electron/node-gyp@https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2':
+    dependencies:
+      env-paths: 2.2.1
+      exponential-backoff: 3.1.3
+      glob: 8.1.0
+      graceful-fs: 4.2.11
+      make-fetch-happen: 10.2.1
+      nopt: 6.0.0
+      proc-log: 2.0.1
+      semver: 7.7.4
+      tar: 6.2.1
+      which: 2.0.2
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
   '@electron/notarize@2.5.0':
     dependencies:
       debug: 4.4.3
@@ -6182,6 +6221,26 @@ snapshots:
       - bluebird
       - supports-color
 
+  '@electron/rebuild@3.7.2':
+    dependencies:
+      '@electron/node-gyp': https://codeload.github.com/electron/node-gyp/tar.gz/06b29aafb7708acef8b3669835c8a7857ebc92d2
+      '@malept/cross-spawn-promise': 2.0.0
+      chalk: 4.1.2
+      debug: 4.4.3
+      detect-libc: 2.1.2
+      fs-extra: 10.1.0
+      got: 11.8.6
+      node-abi: 3.87.0
+      node-api-version: 0.2.1
+      ora: 5.4.1
+      read-binary-file-arch: 1.0.6
+      semver: 7.7.4
+      tar: 6.2.1
+      yargs: 17.7.2
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
   '@electron/universal@2.0.1':
     dependencies:
       '@electron/asar': 3.4.1
@@ -9856,6 +9915,8 @@ snapshots:
       clsx: 2.1.1
       react: 18.3.1
 
+  proc-log@2.0.1: {}
+
   process-nextick-args@2.0.1: {}
 
   process-warning@3.0.0: {}
@@ -10730,7 +10791,7 @@ snapshots:
 
   typescript@5.9.3: {}
 
-  uiohook-napi@1.5.5:
+  uiohook-napi@1.5.5(patch_hash=58cc6a1bd7f69277c47fa5fb1d8342d52acc5a48c420c0e5854857ee6e783d51):
     dependencies:
       node-gyp-build: 4.8.4