Five permission modes make the desktop a security boundary
Claude Code Haha turns an agent terminal into a desktop control room. Five permission modes range from asking on every action to skipping approvals, while sessions, diffs, browser previews, terminals, and worktree launches remain visible in the same window. The useful part is supervision: you can see a task's tool calls, inspect file changes, undo a turn, and approve a subagent request without chasing several terminals. The dangerous part is also supervision, because one permissive setting can authorize shell and tool access across that larger surface.
The scope goes far beyond a Claude wrapper. cc-haha includes multi-session search, a model picker, image generation, MCP and skill managers, Agent Teams, generated orchestration scripts, Computer Use, scheduled work, phone access, and chat integrations. Its checkout contained 4,765 files and roughly 1,158,126 lines of source. A developer who needs three of those systems may appreciate one workspace. Someone who needs a prettier prompt box is adopting far more code and authority than the job requires.
What happened when we ran it
Our Bun install completed in 151 seconds, adding 497 packages and using 327 MB on disk. commit f2bfaab occupied 169.1 MB before dependencies. The repository had 6 CI workflow files and a tests directory, but its root package did not expose a conventional build or test script for our harness. We therefore skipped both steps. That is different from saying no checks exist: the manifest contains targeted desktop, server, adapter, provider, policy, and release quality commands.
The dependency audit reported 25 known vulnerabilities: 1 critical, 9 high, 14 moderate, and 1 low. The supplied measurement does not identify affected packages, reachable code paths, or fixes, so it cannot establish exploitability. It does establish a review gate. This application holds API keys, reads repositories, launches commands, installs skills, connects MCP servers, and can control desktop apps. Before granting those powers, trace every critical and high advisory through the installed dependency tree and the packaged release.
Version 0.6.4 fixed a model choice that could raise costs
Release v0.6.4 landed on September 17, 2026. Its central fix changed Agent Teams behavior from a hardcoded Claude Opus 4.8 fallback to the lead session's selected model when a member has no explicit choice. The release notes say mapped third-party providers could route the old identifier to their most expensive tier, so 0.6.3 users were told to update. The same release forwards teammate permission prompts to the lead session and avoids a full JSONL scan when the local index is empty.
That correction shows why model labels need inspection in a multi-provider client. cc-haha can sign in to Claude, ChatGPT, or Grok, use preset providers, and point at local endpoints such as LM Studio or Ollama. An alias that looks familiar may map differently upstream. Version 0.6.4 now resolves aliases through the provider mapping, while models pinned in configuration still win. Cost controls should log the actual provider, model identifier, and usage, then stop unexpected fallbacks before a team of agents multiplies them.
Local sessions still cross the network through enabled services
The privacy guide says primary data lives under ~/.claude and the operating system's application-data directory. The project itself does not run a cloud backend that receives sessions. Model requests can still send prompts, attachments, selected code, tool results, parameters, and authentication data to the provider you chose. MCP tools receive the inputs they need, while Telegram, Feishu, WeChat, DingTalk, WhatsApp, H5 remote access, or other relays handle selected content and connection metadata.
Upstream agent traffic may also reach diagnostic, analytics, or feature-flag services. The guide documents DISABLE_TELEMETRY=1 and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 for reducing that traffic. Uninstalling the app leaves sessions and configuration behind until you remove them manually. None of this is hidden, and the documentation is unusually direct. It means local-first describes storage and project infrastructure, not a guarantee that enabled agent work stays on one machine.
Version 0.6.4 is signed on macOS and unsigned on Windows
Desktop packages cover macOS, Windows, and Linux on x64 or ARM64. They bundle the CLI engine and ripgrep, so users do not need Node.js, Python, or a separate Claude Code installation. The v0.6.4 macOS builds are signed and notarized. Windows packages remain unsigned while the project waits for SignPath onboarding, which can trigger SmartScreen. Linux users can choose AppImage, deb, or rpm builds, with FUSE packages needed for some AppImage hosts.
A fresh Windows 10 report on issue 1341 deserves attention before sensitive use. The reporter says v0.6.4 showed content from other conversations after /compact and sometimes rendered history as blank until restart. It is one open report, not a confirmed finding across platforms. Session separation is important enough that a team should try several projects, compact long histories, and inspect the stored JSONL before placing unrelated clients or secrets in parallel sessions.
September activity is high, and the open queue is large
GitHub recorded 14,617 stars, a September 17, 2026 last push, and 191 combined issues and pull requests. A separate search found 132 open issues, with new bug and feature reports arriving on September 18. Version 0.6.4 shipped one day earlier. That pace shows active maintenance and heavy user interest. It also means behavior can change between minor 0.x releases, so teams should read each changelog and stage upgrades against disposable projects.
cc-haha earns a trial when visual supervision, multi-provider routing, MCP management, worktrees, and remote approvals are all genuine needs. Start with the strictest of its 5 permission modes, one provider, no messaging relay, and a throwaway repository. The 25-advisory audit and open cross-session report prevent a blanket recommendation today. If the official Claude Code terminal already covers the job, its smaller surface is the easier decision.