# Doubleslash capture path — open source

These are the files that touch keystrokes on your Mac.

Doubleslash is otherwise a closed indie app. The Pro destination drivers (Slack, Logseq, Calendar, Alarm, etc.) are **not** published here. What *is* published is every line that decides whether a keystroke is buffered for a `//` trigger, and every line that decides whether a context is unsafe (passwords, Secure Input, excluded apps).

## Files

| File | Role |
|------|------|
| [`EventTapManager.swift`](./EventTapManager.swift) | Installs the `CGEvent` tap on a dedicated thread, watchdog re-arm, routes key events |
| [`PrivacyFirewall.swift`](./PrivacyFirewall.swift) | Skips password/Secure fields, excluded apps, high-entropy secrets |
| [`TriggerMatching.swift`](./TriggerMatching.swift) | Excerpt of the `//command` + delimiter matcher from `CaptureRouterController` |

## What is buffered

- The tap sees key events (macOS Accessibility / Input Monitoring).
- A short sliding buffer is kept only to detect the `//command` sequence.
- On match + space/return, Doubleslash strips the trigger from the host field and opens the capture HUD.
- Unrelated keystrokes are not logged, not uploaded, and not persisted as a keystroke stream.

## What never leaves your Mac from this path

Nothing. This code path has no network calls. Network exists only for optional Slack posts and one-time Gumroad license verify — elsewhere in the app, opt-in.

## How to verify

1. Read these files on [doubleslash.tafil.app/open-source/capture-path/](https://doubleslash.tafil.app/open-source/capture-path/).
2. Compare to a local install by searching the same symbols in the app binary / your own build if you compile from a private tree.
3. Read the full security write-up: [doubleslash.tafil.app/security](https://doubleslash.tafil.app/security).

## License

Published for audit and trust. © 2026 Doubleslash. You may read and cite these files. Redistribution of modified capture-path code in another product requires written permission; filing security issues does not.