Installer silently adds a global shortcut and persistent LaunchAgent
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 19.9k
- Forks
- 2.3k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 30
Description
I ran:
curl -fsSL https://jcode.sh/install | bash
because I wanted to try the jcode harness. I expected it to install a binary. I did not expect it to create a global keyboard shortcut and install a persistent macOS LaunchAgent with KeepAlive enabled.
This is too invasive for a default install. The installer should not add a daemon or system-wide shortcut without asking first. I only found the LaunchAgent because jcode kept coming back after I killed it.
The shortcut also opens Ghostty, which I do not use.
Please make this opt-in. Installing the binary should install the binary. The installer can offer the shortcut and LaunchAgent through an interactive prompt or a separate flag, but it should not install them silently.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the installer invoked by curl -fsSL https://jcode.sh/install | bash and inspect where it creates the macOS LaunchAgent with KeepAlive and the global shortcut that opens Ghostty. Run the installer in a safe macOS test environment and verify that the binary remains installable while the LaunchAgent and shortcut are not created without an explicit choice.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, rust
- Domain
- cli, devops, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100