release: 5.7.0

.github/dependabot.yml

@@ -19,7 +19,7 @@ updates:
     commit-message:
       prefix: build       # Conventional Commits — the commit-msg hook and the changelog both depend on it
       include: scope
-    labels: [dependencies, ci]
+    labels: [dependencies]
     groups:
       # Every action here is pinned by full commit SHA, so a bump is a one-line SHA change per action and
       # reviewing them one PR at a time buys nothing but pipeline runs.
@@ -126,7 +126,7 @@ updates:
     commit-message:
       prefix: build
       include: scope
-    labels: [dependencies, ci]
+    labels: [dependencies]
     groups:
       security:
         applies-to: security-updates

.gitignore

@@ -80,6 +80,7 @@
 *.pyc
 **/__pycache__/
 *.log
+subprojects/
 
 # ==========================================================================================
 # SECRETS AND KEY MATERIAL — LAST, and it must stay last.
@@ -131,4 +132,9 @@ secrets.yaml
 # filename included. A leak has to stay an explicit mistake.
 !/docs/trust-chain.asc
 PROJECTMAP.md
-**/PROJECTMAP.md
+**/PROJECTMAP.md
+
+# Anchored, because this holds whole checkouts: an assistant working in isolated worktrees puts them
+# under .claude/worktrees/, and an unanchored pattern would also hide a real directory of that name
+# somewhere in the tree. Committing it would commit a copy of the repository into the repository.
+/.claude/

CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.7.0] — 2026-08-21
+
+**The guard is now something you can see, tune and audit**, instead of a set of rules that only spoke up to
+refuse something.
+
+### Added
+- **A Guard view in the chat's view row.** Every alert raised in this project: what matched, what the rule
+  saw, the verdict, and what let the call through if anything did. Free-text search, multi-select filters by
+  category and by rule, and a *Whitelist* button on any entry. Retention is configurable; capped at 500.
+- **The guard keeps its alerts in the IDE's password safe, per project** — which is what makes the view
+  above possible, and what puts the guard's rows back when you reopen a chat. Each row returns anchored to
+  the call it judged, and an alert raised inside an agent is drawn in that agent's transcript, not the main
+  one. An *Allow All* given on a card comes back without its undo link: that approval died with the IDE.
+- **A shield in the chat's button row**, left of auto-scroll: switches the guard to Allow All for a chosen
+  duration, and back with one click. Unlit whenever the guard is not deciding.
+- **Settings ▸ Claude Code Security**, its own page: the guard's mode, a mode per rule with *All Enforcing* /
+  *All Permissive* per category, live suspensions you can end, extra credential globs, extra blocked domains,
+  and the whitelist at three reaches — all rules, one category, one rule. Any rule can be whitelisted;
+  credential and foreign-path rules ask for confirmation first.
+- **A warning row whenever a rule matched and the call ran anyway.** It names the rule, what it saw and what
+  let it through, and carries the link that undoes it — including **Remove from whitelist**, which takes the
+  command off whichever of the three lists is letting it through, narrowest first.
+- **A *Whitelist Command* link on a guard block**, beside *Disable rule*. Files the exact command under the
+  rule that refused it, and will not add a duplicate.
+- **A Vulnerabilities view.** Checks your project's dependencies against a public advisory database
+  (OSV.dev) for known CVEs, filters by severity, and hands the findings to Claude to plan how to solve
+  them — reading your code and checking current advisories first, not just bumping a version.
+- **Export, import and migrate settings**, including straight from another JetBrains IDE on this machine. An
+  exported file never carries your environment variables; a keychain-to-keychain migration does, because it
+  never leaves the machine. A permission mode that would weaken security is refused on the way in.
+
+### Changed
+- **Both settings pages rebuilt, and they now fit the window.** Titled groups instead of one column of forty
+  rows, with Tools, MCP and Advanced folded away; every note sits under its own field and re-wraps as you
+  resize. Nothing runs off the right edge any more.
+- **The guard has a mode: Enforcing, Permissive or Allow All.** Enforcing refuses, Permissive asks on a card
+  every time, Allow All lets the call run. Rules take the first two and are Enforcing by default.
+- **Settings are per project, per IDE installation.** Two repositories can disagree about the model, the
+  permission mode or a security rule. The login stays global, and signing out no longer wipes your settings.
+- ***Always allow this command* on a guard alert is per chat, and in memory.** It was written to the settings
+  document, so one conversation answered for every other one, for ever. Revocable from that chat's ⚙ menu.
+- **Every view redraws in place instead of from scratch**, so a filter, a scroll position or an open card
+  survives the transcript refreshing underneath it, and an agent's transcript no longer flickers as it runs.
+- **The branch graph draws to the full height of its row.** An `<svg>` is a replaced element, so a tall row —
+  uncommitted changes with its file list, a commit carrying several ref tags — had its edge stop short of
+  the next commit and its dot sat below the junction.
+
+### Security
+- **Privilege escalation is refused**: `sudo`, `su`, `doas`, `pkexec`, `runuser`, `setpriv`, `run0`, the
+  desktop wrappers, `osascript` asking for administrator privileges, `runas`,
+  `Start-Process -Verb RunAs`, `psexec`, `wsl -u root`. Matched only where the payload **executes**, so a
+  file that documents `sudo apt update` trips nothing. Whitelistable per command.
+- **The "outside the project" rule now sees paths inside shell commands.** It only ever read a tool's own
+  location argument, so `Read /home/you/notes.txt` was refused while `cat ~/notes.txt` was not — and the
+  shell is where the work happens.
+- **Obfuscated payloads are decoded before they are judged** — hex and reversed strings.
+- **Destructive orchestration covers OpenShift**: `oc delete project` alongside the `kubectl` equivalents.
+- **Recovery inhibition covers VSS and APFS snapshots.**
+- **A variable that decides which code runs is never an innocent declaration.** `PATH`, `LD_PRELOAD`,
+  `BASH_ENV`, `GIT_SSH_COMMAND` and their family are checked wherever they are set. Declaring a path is not
+  reaching it; expanding it is.
+- **System binaries and inert devices are not reaches**: `/usr/bin/git status` and `2>/dev/null` still run.
+
 ## [5.5.0] — 2026-08-19
 
 **This release needs IntelliJ Platform 2025.3.1 (build 253.29346.138) or newer.** On 2026.2 it is the fix:

CLAUDE.md

@@ -1,5 +1,29 @@
 t# Project rules
 
+## ⛔ NO COMMENTS IN THE CODE
+
+**Do not write comments.** No KDoc, no block comments, no line comments, no docstrings — in any
+language in this repository.
+
+This overrides the general engineering habit of documenting rationale in place. It is a decision
+taken for **this** project and it is not up for re-litigation: the plugin is small, the comments were
+reaching **80% of the lines**, and the whole lot was stripped by hand once already. A codebase where
+most lines are prose is harder to read, not easier, and the bloat is paid on every read by every
+session.
+
+Where the reasoning goes instead:
+
+- **A name.** If a function needs a paragraph, it needs a better name or a smaller body.
+- **A test.** A contract worth explaining is a contract worth asserting — that is what the contract
+  tests in `src/test/` are for, and an assertion cannot go stale silently.
+- **The commit message.** Why a change was made belongs to whoever runs `blame` or `bisect`, and it
+  is already required to say so.
+- **`docs/`** for anything a user or a maintainer has to know.
+
+The only exceptions are text that is not a comment about the code: a licence header if one is ever
+required, a machine-read pragma (`@Suppress`, `// noinspection`, a `MAP:GENERATED` marker), and the
+`description` a tool renders to a user.
+
 ## ⛔ ABSOLUTE PROHIBITION — the plugin's security code is off limits
 
 **Claude is CATEGORICALLY FORBIDDEN from modifying any code in this project that implements the