release: Claude Code Native 5.0.0 — install screen, native login, session data, compliance

[serialexperimentslainnnn]

Release PR for 5.0.0. build.gradle.kts is already at 5.0.0, so tagging v5.0.0 after this merge satisfies release.yml's guard (tag reachable from main + version match).

1. Claude Code install screen

A tab opened without the claude binary now shows an install card instead of a loading screen that faded into nothing. One button per official install route for the current OS — Linux install script plus apt/dnf/apk by distro detection, macOS script and Homebrew, Windows PowerShell/winget/cmd — each showing the exact command it runs, copyable, so a network that blocks one route still has a way through. Commands run visibly in the IDE terminal. A manual path accepts a file or an install directory and is validated by running --version and requiring the answer to name Claude Code. Once the binary appears, by any route, the session starts on its own.

The boot state is re-derived every few seconds instead of decided once at startup, so installing the binary — or signing in from somewhere else — takes effect without closing the tab.

2. Native login

Sign-in is a card in the tab, shown before a turn can fail on it, not a slash command to know about. The subscription flow is fully native and requests the full OAuth consent (the reduced setup-token grant drops scopes Claude Code exercises, file upload among them): the browser leg completes on its own and pasting the code is an optional fallback on the same screen. Console sign-in is available as its own mode.

The credential is kept in the IDE's password safe — OS keychain / KWallet / DPAPI — rather than in plaintext on disk, and is handed to the binary through the process environment, whole: token, refresh token, scopes, subscription type, rate-limit tier and account. An API key typed into the card goes to the same per-provider slot Settings ▸ Provider uses, so there is one credential and two doors onto it, and it is approved once — which is what fixes a valid key being refused by a --print session. Log out stops the session and clears the IDE's own copies, without touching the terminal CLI's login.

3. Session data in the UI

• Plan limits panel — get_usage, a control request known since 4.0.1 and never sent, returns the whole picture: five-hour and seven-day windows with reset times, per-model weekly buckets, and the extra-credit balance. Shown as dashboard bars and composer dots (blue < 65%, amber < 85%, red above), announced once per threshold per window. It is what users had to leave the IDE to check.
• Account card — email, organization, plan and provider, every field claude auth status reports.
• Context and cost — polled on ready, on tab open and at both turn edges.

4. Chat tabs

Tabs scroll instead of squeezing, and actually show their close button; long titles truncate with the full title in the tooltip.

5. Performance

• Context and cost no longer wait out a javax.swing.Timer whose initial delay equalled its 60s interval, and the timer retires at the end of a turn — those numbers cannot move while idle, so polling them was pure cost.
• The account identity is read from the safe instead of spawning claude auth status on every dashboard push, and the account profile is cached in memory on a hot path.
• Per-write VFS refresh for the exact paths touched, rather than a project-tree refresh per turn.

6. Compliance and standards refactor

The repository was taken through the standards catalogue domain by domain, and the code changed with it:

• Dependencies — the protocol-reference SDK moved out of the distributed scope; npm audit --omit=dev is 0, and CI asserts the artifact packages no npm code.
• Accessibility — a WCAG 4.1.3 live region and a :focus-visible baseline with a forced-colors fallback, pinned by frontend tests. The EU Accessibility Act has applied since June 2025.
• Licensing — third-party attribution (LICENSE, THIRD-PARTY-NOTICES.md, LICENSES/*) ships inside the artifact, and CI fails if it is missing: a permissive licence's notice obligation binds on redistribution.
• Architecture — LoginCoordinator extracted from ClaudeSession, keeping it a delegating orchestrator.
• Governance — commitlint with a versioned hook that degrades to advisory rather than becoming a reason to skip it, .gitattributes, and three ADRs: release process, threat model (STRIDE, with prompt injection assumed to succeed rather than detected), and i18n deferred with its triggers.
• Test contracts — source-level tests for the two defect classes the compiler cannot see: initialization order in class bodies, and the filesystem-deletion surface (recursive deletion banned; single-file deletion confined to the one plaintext credential the plugin takes into the safe — transcripts and session history are the user's and nothing removes them).

7. Fixes

An initialization-order NPE that could take a tab with it; the <tool_use_error> wrapper stripped instead of rendered as raw markup; failed tool cards that auto-open once and wrap their text; markdown links whose href is a path opening through the same confirmation gate as jb://; ToolSearch and the current first-party agent tools added to the trust allowlist, so a session that defers tool schemas no longer has its unlocking call land in the untrusted branch.

Verification

Every gate ci.yml runs, locally on the tip of this branch:

• test — 749 JVM tests, 0 failures; npm test — 104 frontend tests
• koverVerify — session 65.35% against its 65% floor, raised by covering the restore path rather than by lowering the gate
• detekt, spotlessCheck, ESLint, Prettier — clean
• npm audit --omit=dev --audit-level=low — 0 vulnerabilities
• verifyPlugin — Compatible against IC-251, IC-252, IU-253, IU-261, IU-262
• Smoke-tested by hand in the IDE: install and sign-in cards, plan-limit bars, account card, tool cards, markdown, tables and syntax highlighting.

Merge with a merge commit, not a rebase, so the tag points at a commit reachable from main.

🤖 Generated with Claude Code