Merge pull request #12 from salmanrajz/fix/supply-chain-safety-and-build-docs

security: remove runtime require of unverified modifiers-napi package

src/utils/modifiers.ts

@@ -1,36 +1,22 @@
 export type ModifierKey = 'shift' | 'command' | 'control' | 'option'
 
-let prewarmed = false
-
 /**
  * Pre-warm the native module by loading it in advance.
- * Call this early to avoid delay on first use.
+ *
+ * NOTE: The `modifiers-napi` package is an Anthropic-internal native addon
+ * that is not shipped with the open-source build. All calls are no-ops here
+ * to avoid supply-chain risk from unverified npm packages with the same name.
  */
 export function prewarmModifiers(): void {
-  if (prewarmed || process.platform !== 'darwin') {
-    return
-  }
-  prewarmed = true
-  // Load module in background
-  try {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { prewarm } = require('modifiers-napi') as { prewarm: () => void }
-    prewarm()
-  } catch {
-    // Ignore errors during prewarm
-  }
+  // No-op in open-source build — native modifier detection is not available.
 }
 
 /**
  * Check if a specific modifier key is currently pressed (synchronous).
+ *
+ * Always returns false in the open-source build since the native addon
+ * is not available.
  */
-export function isModifierPressed(modifier: ModifierKey): boolean {
-  if (process.platform !== 'darwin') {
+export function isModifierPressed(_modifier: ModifierKey): boolean {
   return false
-  }
-  // Dynamic import to avoid loading native module at top level
-  const { isModifierPressed: nativeIsModifierPressed } =
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    require('modifiers-napi') as { isModifierPressed: (m: string) => boolean }
-  return nativeIsModifierPressed(modifier)
 }