Summary
curl ... | bash installs more than a binary. On Linux it silently edits ~/.config/niri/config.kdl (3 global hotkeys) and injects a SessionStart hook into ~/.claude/settings.json and ~/.codex/hooks.json that shows ad-style desktop notifications whenever I open Claude Code or Codex. There is no consent prompt and no working opt-out.
What happens (all in scripts/install.sh → jcode setup-hotkey)
- Installer runs
jcode setup-hotkey unconditionally on Linux/macOS — no prompt, no JCODE_SKIP_* env var (only JCODE_SKIP_SERVER_RELOAD exists).
- Linux: splices 3 binds (
Super+;, Super+', Super+Shift+') into ~/.config/niri/config.kdl between sentinel comments (// >>> jcode launch hotkeys (managed) >>> / <<<). Does write a timestamped .bak-jcode-hotkeys-* backup first.
- Injects a
hooks.SessionStart entry (matcher: "startup|resume") into ~/.claude/settings.json and ~/.codex/hooks.json. Every Claude Code/Codex launch fires a desktop notification: "Claude Code is open. Press Super+; anytime to launch Jcode." (capped at 3 per CLI, 7-day cooldown).
[launch_hotkeys] enabled = false in ~/.jcode/config.toml only suppresses notices — it does not gate the Linux install path, so there is no real opt-out.
Why it matters
Modifying another tool's config to advertise jcode is the part that crosses the line — that's adware behavior, not a feature. A coding tool should never write into ~/.claude/settings.json without asking, even if the intent is a shortcut reminder.
Suggested fix
- Make hotkey setup opt-in (installer prompt or
--no-hotkeys flag)
- Never install reminders into other CLIs' configs without explicit consent
- Make
enabled = false actually prevent installation, not just silence notices
Related issues
Summary
curl ... | bashinstalls more than a binary. On Linux it silently edits~/.config/niri/config.kdl(3 global hotkeys) and injects aSessionStarthook into~/.claude/settings.jsonand~/.codex/hooks.jsonthat shows ad-style desktop notifications whenever I open Claude Code or Codex. There is no consent prompt and no working opt-out.What happens (all in
scripts/install.sh→jcode setup-hotkey)jcode setup-hotkeyunconditionally on Linux/macOS — no prompt, noJCODE_SKIP_*env var (onlyJCODE_SKIP_SERVER_RELOADexists).Super+;,Super+',Super+Shift+') into~/.config/niri/config.kdlbetween sentinel comments (// >>> jcode launch hotkeys (managed) >>>/<<<). Does write a timestamped.bak-jcode-hotkeys-*backup first.hooks.SessionStartentry (matcher: "startup|resume") into~/.claude/settings.jsonand~/.codex/hooks.json. Every Claude Code/Codex launch fires a desktop notification: "Claude Code is open. Press Super+; anytime to launch Jcode." (capped at 3 per CLI, 7-day cooldown).[launch_hotkeys] enabled = falsein~/.jcode/config.tomlonly suppresses notices — it does not gate the Linux install path, so there is no real opt-out.Why it matters
Modifying another tool's config to advertise jcode is the part that crosses the line — that's adware behavior, not a feature. A coding tool should never write into
~/.claude/settings.jsonwithout asking, even if the intent is a shortcut reminder.Suggested fix
--no-hotkeysflag)enabled = falseactually prevent installation, not just silence noticesRelated issues
Cmd+;launch hotkey conflicts with macOS app conventions; no easy in-app way to disable #670 — DefaultCmd+;launch hotkey conflicts with macOS app conventions; no easy in-app way to disable