Release 5.5.0

.github/ISSUE_TEMPLATE/bug_report.md

@@ -31,8 +31,13 @@ What actually happened. Include error messages verbatim.
 
 ## Environment
 
+> From **5.5.0** the minimum supported IDE is **2025.3 (build 253)**. The whole chat UI is the IDE's
+> embedded browser, and the module that provides it does not exist before 253. On 2025.1 or 2025.2 the
+> last supported version is **5.1.1** — a bug report against 5.5.0 on those builds is expected behaviour,
+> not a defect.
+
 - **OS:** (e.g. Ubuntu 24.04, macOS 14.5, Windows 11 23H2)
-- **IDE:** (Help → About → product + build, e.g. `IntelliJ IDEA 2025.1.2 IC-251.23774.435`)
+- **IDE:** (Help → About → product + build, e.g. `IntelliJ IDEA 2025.3 IC-253.28294.334`)
 - **Plugin version:** (Settings → Plugins → Claude Code Native)
 - **`claude` binary version:** output of `claude --version`
 - **Binary location:** `which claude` (Linux/macOS) or `where claude` (Windows)

.github/PULL_REQUEST_TEMPLATE.md

@@ -32,10 +32,16 @@ or the permission surface, say what happens to a user who already ran it.
 - [ ] Commits follow Conventional Commits (the `commit-msg` hook enforces it —
       install once with `git config core.hooksPath .githooks`).
 - [ ] `./gradlew test verifyPlugin buildPlugin` passes locally.
-- [ ] `verifyPlugin` is **Compatible** across the declared range (251 → 263.\*)
+- [ ] `verifyPlugin` is **Compatible** across the declared range (253 → 263.\*)
       and reports no new internal-API usage (`@ApiStatus.Internal`).
       The CDN download is unreliable here; use
       `-PlocalIdePath=<dir>[,<dir>…]` with locally-extracted IDEs.
+- [ ] `./gradlew detekt spotlessCheck`, `npm run lint` and `npm run format:check`
+      pass. These are gated on PRs into `main` only, so a failure otherwise
+      lands on `develop` and blocks the next release rather than this PR.
+- [ ] Renamed a CI job? `.github/rulesets/*.json` names required checks by the
+      job's **display name** — update them in this PR and re-run
+      `./scripts/apply-rulesets.sh`, or the gate silently stops applying.
 - [ ] No new deprecated or scheduled-for-removal IntelliJ Platform APIs.
 - [ ] Tests added or updated for the new behaviour — `src/test/kotlin/…` for
       Kotlin, `src/test/frontend/…` (`npm test`) for anything under
@@ -46,7 +52,12 @@ or the permission surface, say what happens to a user who already ran it.
       recorded in [`THIRD-PARTY-NOTICES.md`](../THIRD-PARTY-NOTICES.md) if it
       ships in the artifact.
 - [ ] User-visible changes are documented in [`CHANGELOG.md`](../CHANGELOG.md)
-      and [`RELEASE_NOTES.md`](../RELEASE_NOTES.md) under `Unreleased`.
+      (what changed, for someone debugging) **and**
+      [`RELEASE_NOTES.md`](../RELEASE_NOTES.md) (why it matters, for someone on
+      the Marketplace page), under the version being prepared. There is no
+      `Unreleased` section — `release.yml` publishes the newest `## [x.y.z]`
+      block of `CHANGELOG.md` verbatim, so a heading that is not a version
+      would ship as the release notes.
 - [ ] No secrets, tokens, conversation transcripts, or personal absolute
       paths in the diff or commit messages.
 - [ ] Follows the conventions in [`CONTRIBUTING.md`](../CONTRIBUTING.md), the

.github/ci-image/jvm-test.Dockerfile

@@ -1,8 +1,8 @@
 # jvm-test — the CI image for every job that runs Gradle. Built ON TOP of node-test.
 #
 # WHO USES IT
-# `JVM tests`, `Static analysis` and `Plugin verifier` in ci.yml, `CodeQL (java-kotlin)`, the weekly drift
-# check, and the release gate in release.yml.
+# `JVM tests`, `Static analysis`, `Plugin verifier` and `UI end-to-end tests` in ci.yml, `CodeQL
+# (java-kotlin)`, the weekly drift check, and the release gate in release.yml.
 #
 # WHY IT IS BUILT FROM node-test RATHER THAN FROM fedora
 # Two reasons, and the second is the one that matters.
@@ -88,6 +88,39 @@ RUN curl -fsSL https://packages.adoptium.net/artifactory/api/gpg/key/public \
     && rm -rf /var/cache/dnf \
     && rm -rf /usr/share/locale
 
+# THE DISPLAY STACK, for `UI end-to-end tests` — the one job here that draws.
+#
+# That job boots a real IDE behind a virtual framebuffer and drives a real Chromium inside it, so it needs
+# an X server plus the libraries the JBR and CEF link against. Everything else here is headless Gradle and
+# npm, which is why the base image carries none of it.
+#
+# It is baked rather than installed per run because THE IMAGE IS THIS PIPELINE'S ONLY CACHING MECHANISM: a
+# `dnf install` in a workflow step is a network transaction on every execution, and its failure mode is the
+# job's worst one — a missing library does not announce itself, the IDE simply never opens its port.
+#
+# Its own layer, not appended to the JDK transaction above: the two answer to different consumers, and a
+# change to either would otherwise invalidate the other's cache. Same manager, same flags and the same
+# cache cleanup as that transaction — an image that installs two ways is an image nobody can reason about.
+#
+# `xorg-x11-server-Xvfb` is what supplies `xvfb-run`; `liberation-fonts` is what stops the IDE drawing
+# boxes, which is not cosmetic here — text the harness reads has to be rendered before it can be read.
+RUN dnf -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs install \
+        xorg-x11-server-Xvfb \
+        gtk3 \
+        nss \
+        alsa-lib \
+        mesa-libgbm \
+        libxkbcommon-x11 \
+        libXtst \
+        libXi \
+        libXrender \
+        libXext \
+        libXrandr \
+        libXcursor \
+        liberation-fonts \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
+
 # JAVA_HOME is resolved rather than hardcoded: the exact path carries the package's build number and would
 # silently break on the next base-image bump. The symlink keeps the ENV below stable across rebuilds.
 RUN JH="$(dirname "$(dirname "$(readlink -f "$(command -v javac)")")")" \

.github/dependabot.yml

@@ -106,3 +106,33 @@ updates:
       # to match what the targeted IDEs ship, not the newest release. Bumping it blindly is a
       # NoSuchMethodError on a user's IDE, not an upgrade.
       - dependency-name: 'org.jetbrains.kotlinx:kotlinx-serialization-json'
+
+  # The CI images themselves. Every job in ci.yml, codeql.yml, drift.yml and release.yml runs inside
+  # `ghcr.io/serialexperimentslainnnn/{jvm,node}-test`, built from `.github/ci-image/*.Dockerfile` — so the
+  # base image of those files is the operating system the whole gate executes on, and until now NOTHING
+  # proposed a bump for it. `github-actions` does not cover it (it updates `uses:`, not `container:`), and
+  # neither did the npm or gradle ecosystems. An unwatched base image is the one dependency where "nobody
+  # changed anything" and "it stopped receiving security patches" are the same sentence.
+  #
+  # Dependabot's docker fetcher matches any filename containing `dockerfile` (case-insensitive), so
+  # `jvm-test.Dockerfile` and `node-test.Dockerfile` are both picked up — but it does NOT recurse, hence the
+  # explicit directory. It parses one dependency per `FROM`: in practice that is `fedora:44` in
+  # node-test.Dockerfile, since jvm-test.Dockerfile's `FROM ${NODE_IMAGE}` resolves through an ARG.
+  - package-ecosystem: docker
+    directory: /.github/ci-image
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 2
+    commit-message:
+      prefix: build
+      include: scope
+    labels: [dependencies, ci]
+    groups:
+      security:
+        applies-to: security-updates
+        patterns: ['*']
+    # Deliberately NO `ignore` of majors here, unlike every other ecosystem above. A base image pinned to
+    # `fedora:44` has no minors and no patches to propose — a major IS the only update that exists, so
+    # ignoring majors would leave this block doing precisely nothing, which is worse than not having it:
+    # it would read as coverage. A distro bump is still a human decision; the bot's job is to make sure the
+    # decision gets put in front of someone instead of being reached by nobody.