release: Claude Code Native 5.0.0 — plaintext credentials closed, native login, install screen, session data, compliance

[serialexperimentslainnnn]

Release PR for 5.0.0. build.gradle.kts is already at 5.0.0, so tagging v5.0.0 after this merge satisfies release.yml's guard (tag reachable from main + version match).

1. Plaintext credentials, closed

Claude Code's own sign-in leaves its OAuth credentials in ~/.claude/.credentials.json: plaintext on Linux, readable by every process running as the user, and shared with every terminal session on the machine. A bearer token sitting unencrypted in a well-known path is the kind of thing that turns any unrelated code execution into an account compromise, and it is on disk permanently — including long after the IDE is closed.

This release closes it. The credential is moved into the IDE's password safe (OS keychain / KWallet / DPAPI), the plaintext file is overwritten and deleted — a login the user made in their own terminal included — and nothing ever writes it back. It reaches the binary through the process environment instead: /proc/<pid>/environ is owner-only where the file was readable by anything running as the user, and it leaves nothing behind when the process exits. An orphan left by a hard IDE kill is folded back into the safe at the next launch.

The whole credential travels, not just the access token — token, refresh token, scopes, subscription type, rate-limit tier and account — so the session is a full identity rather than a degraded one. Credentials are environment only, never argv (/proc/<pid>/cmdline is world-readable), and never in logs, the transcript or any XML the plugin writes.

An API key gets the same treatment: its own per-provider slot shared with Settings ▸ Provider, so the card and the settings field are one credential rather than two that disagree, and no provider's key can overwrite another's.

2. Native login

Sign-in is a card in the tab, shown before a turn can fail on it, not a slash command to know about. The subscription flow is fully native and requests the full OAuth consent — the reduced setup-token grant drops scopes Claude Code exercises, file upload among them. The browser leg completes on its own; pasting the code is an optional fallback on the same screen. Console sign-in is available as its own mode. claude auth status verifies whichever identity is effective, and Log out stops the session and clears the IDE's copies without touching the terminal CLI's login.

3. Claude Code install screen

A tab opened without the claude binary shows an install card instead of a loading screen that faded into nothing: one button per official route for the current OS — Linux install script plus apt/dnf/apk by distro detection, macOS script and Homebrew, Windows PowerShell/winget/cmd — each showing the exact command it runs, copyable, so a network that blocks one route still has a way through. Commands run visibly in the IDE terminal. A manual path accepts a file or a directory and is validated by running --version and requiring the answer to name Claude Code. Once the binary appears, by any route, the session starts on its own — the boot state is re-derived every few seconds rather than decided once at startup, so installing the binary or signing in elsewhere no longer requires closing the tab.

4. Session data in the UI

• Plan limits panel — get_usage, a control request known since 4.0.1 and never sent, returns the whole picture: five-hour and seven-day windows with reset times, per-model weekly buckets and the extra-credit balance. Dashboard bars and composer dots (blue < 65%, amber < 85%, red above), announced once per threshold per window. It is what users had to leave the IDE to check.
• Account card — email, organization, plan and provider, every field auth status reports.
• Context and cost — polled on ready, on tab open and at both turn edges.

5. Chat tabs

Tabs scroll instead of squeezing and actually show their close button; long titles truncate with the full title in the tooltip.

6. Performance

Context and cost are polled when the session becomes ready, when the tab is opened and at both edges of a turn, instead of waiting out a javax.swing.Timer whose initial delay equalled its 60s interval — so the figures appear when they change rather than up to a minute later. The timer also retires at the end of a turn: those numbers cannot move while the session is idle.

7. Compliance and standards refactor

The repository was taken through the standards catalogue domain by domain, and the code changed with it:

• Dependencies — the protocol-reference SDK moved out of the distributed scope; npm audit --omit=dev is 0, and CI asserts the artifact packages no npm code.
• Accessibility — a WCAG 4.1.3 live region and a :focus-visible baseline with a forced-colors fallback, pinned by frontend tests. The EU Accessibility Act has applied since June 2025.
• Licensing — attribution (LICENSE, THIRD-PARTY-NOTICES.md, LICENSES/*) ships inside the artifact and CI fails if it is missing: a permissive licence's notice obligation binds on redistribution.
• Architecture — LoginCoordinator extracted from ClaudeSession, keeping it a delegating orchestrator.
• Governance — commitlint with a versioned hook that degrades to advisory rather than becoming a reason to skip it, .gitattributes, and three ADRs: release process, threat model (STRIDE, prompt injection assumed to succeed rather than detected), and i18n deferred with its triggers.
• Test contracts — source-level tests for two defect classes the compiler cannot see: initialization order in class bodies, and the filesystem-deletion surface (recursive deletion banned outright; single-file deletion confined to the one plaintext credential the plugin takes into the safe — transcripts and session history are the user's, and nothing in the plugin removes them).

8. Fixes

An initialization-order NPE that could take a tab with it; the CLI's <tool_use_error> wrapper stripped instead of rendered as raw markup; failed tool cards that auto-open once and wrap their text; markdown links whose href is a path opening through the same confirmation gate as jb://; ToolSearch and the current first-party agent tools added to the trust allowlist, so a session that defers tool schemas no longer has its unlocking call land in the untrusted branch.

Verification

Every gate ci.yml runs, locally on the tip of this branch:

• test — 749 JVM tests, 0 failures; npm test — 104 frontend tests
• koverVerify — session 65.35% against its 65% floor, raised by covering the restore path rather than by lowering the gate
• detekt, spotlessCheck, ESLint, Prettier — clean
• npm audit --omit=dev --audit-level=low — 0 vulnerabilities
• verifyPlugin — Compatible against IC-251, IC-252, IU-253, IU-261, IU-262
• Smoke-tested by hand in the IDE: install and sign-in cards, plan-limit bars, account card, tool cards, markdown, tables and syntax highlighting.

Merge with a merge commit, not a rebase, so the tag points at a commit reachable from main.

🤖 Generated with Claude Code