CC GUI (Claude, Codex and More)

trust: least_privilege — the docs define five distinct permission modes (default/plan/acceptEdits/auto/bypassPermissions) and state that under acceptEdits Bash and sub-agent launches still require confirmation, while Full Auto needs allowDangerouslySkipPermissions and a subprocess rebuild; that is deliberate privilege layering, so 2. Not full marks because Full Auto bypasses all ordinary checks, and the docs admit auto mode applies repository-level allow rules before the classifier, so a malicious repo can silently auto-approve. user_confirmation: the SDK permissions doc and the multimodal-permission-bug doc show both a canUseTool callback and a PreToolUse hook confirmation path, and record a real defect where confirmation was skipped for image messages plus its fix — the mechanism exists but has demonstrably been bypassed, so 2. data_flow_transparency: only the Java→Node→SDK/app-server chain and the TMPDIR/CLAUDE_PERMISSION_DIR channel are documented; there is no systematic statement of which third-party endpoints receive code, images or API keys, so 1. sensitive_data_handling: API keys are described as stored in plugin settings and the child environment is sanitized of inherited policy overrides, but there is no evidence of encrypted key storage, log redaction or image-upload scoping, so 1. dependency_security: the only claim is a README assertion that a /security-review audit runs before each minor release, unsupported by any artifact; no lockfile audit, SBOM or scanning config is visible, so 1. external_effects: the plugin writes files, runs Bash and spawns external CLIs — high side effects; there is permission gating and temp-dir cleanup but no undo for effects already applied, so 1. rollback: the docs explicitly state Codex no longer rolls edits back after decline, and Claude only offers conversation rewind rather than file rollback, so 1. source_attribution: README credits contributors, but the publisher is unverified and the repo carries both idea-claude-code-gui and jetbrains-cc-gui names, leaving the attribution chain unclear, so 1.

reliability: self_consistency — the docs contradict each other: README advertises many Beta CLIs (Grok/Kimi/OpenCode/PI/OMP/DeepSeek) while native-auto-approval-mode.md exposes auto only for Claude and Codex; CODEX-INTEGRATION-QUICKSTART.md declares itself historical and says old examples (skipGitRepoCheck, maxTurns, boolean permission IPC, post-execution rollback) are not the current runtime, yet keeps them inline; README badges still point at the old idea-claude-code-gui repo name. So 1. dependency_availability: version floors are stated (Node 22.12.0, JDK 21, Codex CLI 0.146.0, claude-agent-sdk 0.3.182) but no lockfile or dependency manifest text is in the evidence, so availability and pinning cannot be statically confirmed — 1. failure_messages: the Quickstart troubleshooting section maps four concrete failures to causes and fixes, and the auto-mode doc quotes the exact classifier-unavailable error text, so 2.

adaptability: audience_and_scenarios — README targets IntelliJ IDEA users and enumerates concrete scenarios (multi-engine, session management, DIFF, @file references, image input), so 2. capability_boundaries: Beta features are labelled, Codex is noted as lacking openedFiles IDE context, auto is limited to Claude/Codex, and Grok's internal auto alias is explicitly not repurposed — boundaries are well declared, so 2. trigger_precision: a permission flow diagram and processing order are given, but the documented defect where canUseTool does not fire for multimodal messages shows a known trigger blind spot, and @file/slash-command triggers are not precisely specified, so 1. environment_fit: coverage is JetBrains IDE on desktop with a macOS-specific performance workaround; no Linux/Windows notes or IDE version compatibility matrix, so 1.

convention: information_architecture — README is well sectioned (install, performance, features, status, dev, license, contributing) and docs are split into sdk/skills/feat/codex, so 2. install_notes: installation is a single JetBrains Marketplace link plus local dev commands; no version requirements, offline install or upgrade path, so 1. naming_stability: the project renamed from Claude Code GUI to CC GUI while idea-claude-code-gui and jetbrains-cc-gui coexist and badges still link the old name — clearly unstable, so 1. examples_and_faq: code samples and a Quickstart troubleshooting section exist, but no formal FAQ and some samples are self-declared obsolete, so 1. known_limitations: native-auto-approval-mode.md has a dedicated Known limitations section covering the claude-sonnet classifier dependency, failure on third-party relay endpoints, and repo allow-rule precedence — well disclosed, so 2. license: full MIT text with copyright holder and year, consistent with README and badge, so 3. versioning_changelog: README points to CHANGELOG.md which is not in the evidence, and versioning is only inferable from the feature/vX.Y.Z PR workflow, so 1. maintenance_responsibility: SECURITY.md commits to 48-hour acknowledgement and 3-business-day triage and the PR workflow names a single maintainer account, but publisher identity is unverified, so 1.

effectiveness: output_usability — outputs are in-IDE chat, DIFF comparison, file navigation, session export and usage stats, directly consumable, so 2. marginal_value: unifying several AI coding CLIs behind one IDE panel with a common permission-mode mapping is a real increment over using each CLI separately, so 2. cost_benefit: README cites a ~40MB package and the Quickstart cites 50–100MB RAM per active channel, plus external CLI installs and API key setup — meaningful cost against workflow-dependent benefit, so 1.

verifiability: claim_traceability — most claims (security audit cadence, test pass counts of 113 and 1,473) appear only as prose assertions with no checkable run record or CI link, so 1. cross_source_corroboration: README, the permissions doc, the auto-mode doc and the Quickstart partly corroborate each other on permission modes, but also conflict (Beta engine list, legacy Codex examples), so 1. fact_inference_separation: the docs mostly separate investigation findings, known limitations and implementation status, but the self-reported test counts under Implementation status are unverified self-assertion and the README audit promise is unsupported, so 1.