v6.0.1

[6.0.1] — 2026-09-22

Fixed

• find_symbols no longer fails outright in Rider. A contributor that refuses the platform's
  processNames call — which Rider's do, because its symbols live in the ReSharper backend and are
  served only over its own protocol — is skipped instead of taking the whole tool down with
  UnsupportedOperationException: Use RdChooseByNameContributor.processNamesLifetimed. An answer
  reached by asking fewer contributors than the IDE has carries refused and contributors, and when
  it is also empty it carries a note, so an empty list is not read as an absent symbol or a stale
  index. Only when every contributor refuses does the tool fail, naming what does work there
  (search_text, find_files, file_outline, definition, references, implementations).

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key, and everything needed to check it is in the one file attached here as
trust-chain.asc: that key's public half, plus the two hardware CAs that certify it — so the
chain terminates in keys whose private halves have never been on a computer.

One file rather than three because a chain is imported whole or not at all. A certification you
have no way to follow is indistinguishable from one nobody made, which is exactly the assurance
the two CA keys carry.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from the merge into main, with no approval step and no required reviewer. What
stands behind it instead is mechanical, and it is worth being exact about — main accepts nothing
but pull requests that are up to date and have all nine required checks green (among them the JVM
and frontend tests, both CodeQL scans, the dependency audit and the plugin verifier), that
protection can be bypassed by nobody including admins, and this workflow refuses to publish a
commit that is not reachable from main or a version number that has already been released.

gpg --import trust-chain.asc
# The CI key is the LAST block in that file — the CAs come first, and the awk below takes the
# last one deliberately. Then: endorsed by both of them, not merely asserted by a file.
gpg --check-sigs "$(gpg --show-keys --with-colons trust-chain.asc \
                    | awk -F: '$1=="pub"{getline; if ($1=="fpr") f=$10} END{print f}')"
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

The one check worth doing that this file cannot do for you. Everything above arrives from
this repository, so it proves the release is internally consistent and nothing more — whoever
could publish a forged artifact could publish a bundle agreeing with it. The CAs are therefore
also on keys.openpgp.org, an operator with no relation to GitHub, and fetching one by
fingerprint is what turns the chain into evidence:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <CA fingerprint from SECURITY.md>

Two copies of the same CA from two unrelated publishers either agree, or the disagreement is
the story.

v6.0.0

[6.0.0] — 2026-09-12

Claude becomes one with your IDE. The plugin now runs four MCP servers of its own inside the IDE
and hands Claude the IDE itself: 178 tools in 55 domains, on by default, every action mirrored on
your screen without taking your focus, every call judged by the guard first. Underneath, the code is
restructured, the page is TypeScript, the plugin can be traced, and the bugs found on the way are fixed.

Added

• Four MCP servers of the plugin's own — code, run, vcs, ops — over Unix sockets, with no
  port, nothing to install and nothing exposed. Claude reads through the IDE's index (unsaved edits
  included), searches, navigates by symbol, edits through the document model (one undo entry, a diff,
  saved), renames and moves with the refactoring engine, reformats with the project's code style, reads
  the IDE's problems and inspections, builds, runs configurations, runs tests through the IDE's runner,
  runs commands in the IDE's Terminal, debugs with breakpoints, drives Git through the IDE and its Log,
  Commit and Pull Requests views, works the Services panel, databases, the HTTP Client and SSH hosts, and
  can fire any action the IDE registers — with a file, a commit or a Services node as its target. Each
  server offers its tools on demand, so a session pays only for the domains it uses; results come back
  as compact tables.
• Claude God Mode: one switch, on by default. The flame in the chat bar lights when all four servers
  and every rule are on. Each rule is one instruction in Claude's system prompt, repeated every turn,
  naming which IDE tool replaces which native one, so a session does not drift back to grep and sed.
  Settings ▸ Claude Code ▸ Claude IDE Integration fine-tunes servers, rules, the mirror and whether
  an unexpected client must be approved. An upgrade that adds domains switches their rules on.
• Everything Claude does is mirrored in the IDE, never focused. What it reads opens in the preview
  tab, what it edits in a real tab; a commit it names is selected in the Log, a service in Services, a
  problem in its tab, a run in its window; a range it points at flashes. Your caret stays where you are
  typing and the Terminal keeps its tab. One switch in the same settings group turns the mirror off.
• Claude opens, shows and navigates for you. Ask for a file at a line, a commit, a range of commits,
  a diff of two files or of a file against any ref, a pull request, a tool window, a Settings page, a
  Services node, a file in the Project view, a path in the file manager — it appears in the IDE, in the
  right place, without you touching the mouse.
• Cards for the IDE tools. Every own call is a card named by server, tool and subject; a list
  passed to a tool draws one sub-card per item, each with its own title, diff, live lines, state and a
  one-click link into the IDE (the commit, the Log, the tool window, the terminal tab, the run, the
  problem, the diff). An own edit has View diff and Restore; a long tool keeps its outcome in view;
  a subagent's calls draw under its Task card.
• Pull requests and releases through the IDE's own GitHub account. List and read pull requests,
  open one selected in the IDE's Pull Requests view, create one, comment on it, read its mergeability
  and checks until they settle, and merge it once they are green; then verify the tags, the Actions runs,
  the GitHub Release and the plugin's versions on the JetBrains Marketplace. No gh, no token of its own.
• Any MCP client can drive the IDE. The servers speak plain MCP over their sockets with the
  session's token; a bundled stdio bridge and the protocol are documented in docs/MCP_CLIENT.md. When
  the chat page cannot be shown, the servers still start and a notification carries the configuration.
• Marks, banners and notifications. Claude can highlight ranges, leave gutter icons and inline hints,
  ask you something in a banner over the file you are reading, write to the status bar, open a scratch
  file, set bookmarks and raise a balloon in the IDE's notification area — all gone when the session ends.
• A Log view in the chat's view row. The plugin's own log, filtered by level, with a Copy button
  that puts a report-ready text on the clipboard. Credentials, prompts and other people's paths never
  reach it. A Debug switch in the same view turns detailed tracing on for this IDE session.

Changed

• The JetBrains MCP Server switch and the third-party Index and Debugger servers are gone. The
  plugin's own servers replace all three; nothing to install, no port to configure. Custom MCP servers
  are still yours to add under Custom MCP Servers.
• Update and Plan in the Vulnerabilities view open their own chat tab, named after the job, instead
  of writing into the chat you were in.
• The plugin uses no deprecated or internal platform API, verified by the Plugin Verifier against
  every IDE build from 2025.3.1 to 2026.3 on IntelliJ IDEA and PyCharm, and the policy is written down
  in docs/PLATFORM_API_POLICY.md.
• The code is restructured, one responsibility per file. The session orchestrator, the chat
  bridge, the page host and the guard are split along their seams and every comment is gone. No
  behaviour changes; the test suite and a new package-dependency gate say so.
• The chat page is written in TypeScript, one small file per concern, compiled into the same
  scripts the page always loaded. Nothing changes on screen.
• Logging is consistent. One level vocabulary across the plugin: warn means something went
  wrong, info marks a lifecycle step, debug is the trace. The binary's stderr and the page's own
  errors are recorded instead of dropped.
• The transcript keeps the last 500 rows on screen instead of 2,000. A long session rendered
  thousands of rows and the chat slowed down. The model and the page trim at the same number, the
  notice at the top says how many earlier rows were dropped, and the session file on disk still holds
  the whole conversation.

Fixed

• Closing the last chat, or opening the only one, could leave a blank panel — no composer, no
  tabs, "loading" forever — until Open previous session brought a chat back. The page host gave up
  on a browser that was still starting and fell back to two delivery routes its own navigation guard
  refused. The first route now waits for the browser to exist, and the dead routes are gone.
• A page reloaded after a failed delivery kept the loading screen up, because three of the states
  the host re-sends were remembered as "already sent".
• JavaScript errors in the chat page never reached the IDE log. The page reported them under a
  message name the host did not parse.
• The model, effort and thinking pills did not survive a new chat, unlike the mode pill next to
  them: they changed the running session and never the stored setting.
• Fork Session resumed the original session's id, so both chats wrote into one transcript.
• /btw never got its answer. A side question is a full model call; the host gave every control
  request thirty seconds, declared the question unanswered and dropped the reply when it arrived. A
  request the binary reports as started now waits for its answer.
• Closing a chat while its sign-in was still open left a claude process running with no tab
  to stop it.
• The Workloads view leaked a pair of mouse listeners on every redraw.
• Shift+Tab in the prompt could not leave it, and Escape with the find bar open was swallowed
  before the settings menu, the attach tree or the palette saw it.
• Switching chats with a search open left the find bar showing a count for a search that was no
  longer running.

Security

• Every IDE tool call is judged by the guard inside the servers, before it runs, with the same rules
  as the agent's native tools; a refusal comes back as the tool's error naming the rule and the text that
  tripped it. The shield, the whitelists and the Security settings page apply to both alike.
• A write through the IDE tools stays inside the project. write_file, create_file, replace_text,
  insert_text, move_file, file_from_template and worktrees add refuse a destination outside the
  project root, and the guard judges an own call with its arguments in front of it, exactly as it judges the
  native Write. The socket files and the parent of their directory are private to the user, like the
  directory itself.
• A path that is only mentioned, does not exist and is not written is a parameter, not a reach, so
  an API endpoint or a flag that looks like a path no longer trips the outside-the-project rule; a path
  that exists, or that the command creates or writes, is judged as before.
• A container mount is judged by its host side: the container side of -v, --mount and
  kubectl cp is never read as a path on your machine; the host side is.
• More privileged-container vectors are refused: further dangerous capabilities, podman and
  nerdctl spellings, kubectl and oc security contexts and policies that grant privilege.
• The guard's test suite is hardened: assertions pin the verdict a rule must give, not the one the
  code happened to give, and Windows paths and commands get their own cases across every rule
  family. The guard's own code is restructured under those tests with no verdict changed.
• The guard sees more of Windows. Writes into the Startup folder and PowerShell profiles are
  judged by their content; copy, move, del, Set-Content, Out-File and friends count as file
  writes with no diff; an 8.3 short name never folds a path inside the project; an explicit NTFS
  alternate data stream is a write no diff shows; a caret-split command is read as what it runs; and a
  raw device is named as a device rather than as a network mount. Four
  Windows false positives are g...

v5.8.1

[5.8.1] — 2026-08-30

Fixed

• Closing the last chat no longer reports an internal error. Closing a chat that was the only one
  open, and that had been used, left the IDE logging Already disposed from the browser component the
  chat had just torn down. The chat's card is now hidden before it leaves the tool window, so the layout
  never lays out a browser that is already gone. Nothing about closing a chat changes for you: the
  replacement chat still opens as before.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key, and everything needed to check it is in the one file attached here as
trust-chain.asc: that key's public half, plus the two hardware CAs that certify it — so the
chain terminates in keys whose private halves have never been on a computer.

One file rather than three because a chain is imported whole or not at all. A certification you
have no way to follow is indistinguishable from one nobody made, which is exactly the assurance
the two CA keys carry.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from the merge into main, with no approval step and no required reviewer. What
stands behind it instead is mechanical, and it is worth being exact about — main accepts nothing
but pull requests that are up to date and have all nine required checks green (among them the JVM
and frontend tests, both CodeQL scans, the dependency audit and the plugin verifier), that
protection can be bypassed by nobody including admins, and this workflow refuses to publish a
commit that is not reachable from main or a version number that has already been released.

gpg --import trust-chain.asc
# The CI key is the LAST block in that file — the CAs come first, and the awk below takes the
# last one deliberately. Then: endorsed by both of them, not merely asserted by a file.
gpg --check-sigs "$(gpg --show-keys --with-colons trust-chain.asc \
                    | awk -F: '$1=="pub"{getline; if ($1=="fpr") f=$10} END{print f}')"
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

The one check worth doing that this file cannot do for you. Everything above arrives from
this repository, so it proves the release is internally consistent and nothing more — whoever
could publish a forged artifact could publish a bundle agreeing with it. The CAs are therefore
also on keys.openpgp.org, an operator with no relation to GitHub, and fetching one by
fingerprint is what turns the chain into evidence:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <CA fingerprint from SECURITY.md>

Two copies of the same CA from two unrelated publishers either agree, or the disagreement is
the story.

v5.8.0

[5.8.0] — 2026-08-28

A chat in the IDE can now be driven from claude.ai or the Claude app, and keeps running on your own
machine the whole time.

Added

• Remote Control for a chat, from a phone button in the chat's button row — left of the guard's shield —
  or from Remote control in the ⚙ menu. Execution and filesystem access stay local: your files, your MCP
  servers and your project configuration remain the ones in use, and claude.ai or the Claude app becomes a
  second window onto the same conversation. The transcript announces the session URL when the reply carries
  one.
• The button reports its own outcome. Lit while Remote Control is on, red with the reason in its tooltip
  when the request was refused — Remote Control has to be enabled for your account, and on Team and
  Enterprise plans by an organisation Owner as well. Neither control turns itself on until the binary has
  said yes.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key, and everything needed to check it is in the one file attached here as
trust-chain.asc: that key's public half, plus the two hardware CAs that certify it — so the
chain terminates in keys whose private halves have never been on a computer.

One file rather than three because a chain is imported whole or not at all. A certification you
have no way to follow is indistinguishable from one nobody made, which is exactly the assurance
the two CA keys carry.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from the merge into main, with no approval step and no required reviewer. What
stands behind it instead is mechanical, and it is worth being exact about — main accepts nothing
but pull requests that are up to date and have all nine required checks green (among them the JVM
and frontend tests, both CodeQL scans, the dependency audit and the plugin verifier), that
protection can be bypassed by nobody including admins, and this workflow refuses to publish a
commit that is not reachable from main or a version number that has already been released.

gpg --import trust-chain.asc
# The CI key is the LAST block in that file — the CAs come first, and the awk below takes the
# last one deliberately. Then: endorsed by both of them, not merely asserted by a file.
gpg --check-sigs "$(gpg --show-keys --with-colons trust-chain.asc \
                    | awk -F: '$1=="pub"{getline; if ($1=="fpr") f=$10} END{print f}')"
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

The one check worth doing that this file cannot do for you. Everything above arrives from
this repository, so it proves the release is internally consistent and nothing more — whoever
could publish a forged artifact could publish a bundle agreeing with it. The CAs are therefore
also on keys.openpgp.org, an operator with no relation to GitHub, and fetching one by
fingerprint is what turns the chain into evidence:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <CA fingerprint from SECURITY.md>

Two copies of the same CA from two unrelated publishers either agree, or the disagreement is
the story.

v5.7.0

[5.7.0] — 2026-08-21

The guard is now something you can see, tune and audit, instead of a set of rules that only spoke up to
refuse something.

Added

• A Guard view in the chat's view row. Every alert raised in this project: what matched, what the rule
  saw, the verdict, and what let the call through if anything did. Free-text search, multi-select filters by
  category and by rule, and a Whitelist button on any entry. Retention is configurable; capped at 500.
• The guard keeps its alerts in the IDE's password safe, per project — which is what makes the view
  above possible, and what puts the guard's rows back when you reopen a chat. Each row returns anchored to
  the call it judged, and an alert raised inside an agent is drawn in that agent's transcript, not the main
  one. An Allow All given on a card comes back without its undo link: that approval died with the IDE.
• A shield in the chat's button row, left of auto-scroll: switches the guard to Allow All for a chosen
  duration, and back with one click. Unlit whenever the guard is not deciding.
• Settings ▸ Claude Code Security, its own page: the guard's mode, a mode per rule with All Enforcing /
  All Permissive per category, live suspensions you can end, extra credential globs, extra blocked domains,
  and the whitelist at three reaches — all rules, one category, one rule. Any rule can be whitelisted;
  credential and foreign-path rules ask for confirmation first.
• A warning row whenever a rule matched and the call ran anyway. It names the rule, what it saw and what
  let it through, and carries the link that undoes it — including Remove from whitelist, which takes the
  command off whichever of the three lists is letting it through, narrowest first.
• A Whitelist Command link on a guard block, beside Disable rule. Files the exact command under the
  rule that refused it, and will not add a duplicate.
• A Vulnerabilities view. Checks your project's dependencies against a public advisory database
  (OSV.dev) for known CVEs, filters by severity, and hands the findings to Claude to plan how to solve
  them — reading your code and checking current advisories first, not just bumping a version.
• Export, import and migrate settings, including straight from another JetBrains IDE on this machine. An
  exported file never carries your environment variables; a keychain-to-keychain migration does, because it
  never leaves the machine. A permission mode that would weaken security is refused on the way in.

Changed

• Both settings pages rebuilt, and they now fit the window. Titled groups instead of one column of forty
  rows, with Tools, MCP and Advanced folded away; every note sits under its own field and re-wraps as you
  resize. Nothing runs off the right edge any more.
• The guard has a mode: Enforcing, Permissive or Allow All. Enforcing refuses, Permissive asks on a card
  every time, Allow All lets the call run. Rules take the first two and are Enforcing by default.
• Settings are per project, per IDE installation. Two repositories can disagree about the model, the
  permission mode or a security rule. The login stays global, and signing out no longer wipes your settings.
• Always allow this command on a guard alert is per chat, and in memory. It was written to the settings
  document, so one conversation answered for every other one, for ever. Revocable from that chat's ⚙ menu.
• Every view redraws in place instead of from scratch, so a filter, a scroll position or an open card
  survives the transcript refreshing underneath it, and an agent's transcript no longer flickers as it runs.
• The branch graph draws to the full height of its row. An <svg> is a replaced element, so a tall row —
  uncommitted changes with its file list, a commit carrying several ref tags — had its edge stop short of
  the next commit and its dot sat below the junction.

Security

• Privilege escalation is refused: sudo, su, doas, pkexec, runuser, setpriv, run0, the
  desktop wrappers, osascript asking for administrator privileges, runas,
  Start-Process -Verb RunAs, psexec, wsl -u root. Matched only where the payload executes, so a
  file that documents sudo apt update trips nothing. Whitelistable per command.
• The "outside the project" rule now sees paths inside shell commands. It only ever read a tool's own
  location argument, so Read /home/you/notes.txt was refused while cat ~/notes.txt was not — and the
  shell is where the work happens.
• Obfuscated payloads are decoded before they are judged — hex and reversed strings.
• Destructive orchestration covers OpenShift: oc delete project alongside the kubectl equivalents.
• Recovery inhibition covers VSS and APFS snapshots.
• A variable that decides which code runs is never an innocent declaration. PATH, LD_PRELOAD,
  BASH_ENV, GIT_SSH_COMMAND and their family are checked wherever they are set. Declaring a path is not
  reaching it; expanding it is.
• System binaries and inert devices are not reaches: /usr/bin/git status and 2>/dev/null still run.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key, and everything needed to check it is in the one file attached here as
trust-chain.asc: that key's public half, plus the two hardware CAs that certify it — so the
chain terminates in keys whose private halves have never been on a computer.

One file rather than three because a chain is imported whole or not at all. A certification you
have no way to follow is indistinguishable from one nobody made, which is exactly the assurance
the two CA keys carry.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from the merge into main, with no approval step and no required reviewer. What
stands behind it instead is mechanical, and it is worth being exact about — main accepts nothing
but pull requests that are up to date and have all nine required checks green (among them the JVM
and frontend tests, both CodeQL scans, the dependency audit and the plugin verifier), that
protection can be bypassed by nobody including admins, and this workflow refuses to publish a
commit that is not reachable from main or a version number that has already been released.

gpg --import trust-chain.asc
# The CI key is the LAST block in that file — the CAs come first, and the awk below takes the
# last one deliberately. Then: endorsed by both of them, not merely asserted by a file.
gpg --check-sigs "$(gpg --show-keys --with-colons trust-chain.asc \
                    | awk -F: '$1=="pub"{getline; if ($1=="fpr") f=$10} END{print f}')"
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

The one check worth doing that this file cannot do for you. Everything above arrives from
this repository, so it proves the release is internally consistent and nothing more — whoever
could publish a forged artifact could publish a bundle agreeing with it. The CAs are therefore
also on keys.openpgp.org, an operator with no relation to GitHub, and fetching one by
fingerprint is what turns the chain into evidence:

gpg --keyserver hkps://keys.openpgp.org --recv-keys <CA fingerprint from SECURITY.md>

Two copies of the same CA from two unrelated publishers either agree, or the disagreement is
the story.

v5.5.0

[5.5.0] — 2026-08-19

This release needs IntelliJ Platform 2025.3.1 (build 253.29346.138) or newer. On 2026.2 it is the fix:
5.1.1 could not open a chat there at all. On 2025.1, 2025.2 or the first 2025.3, stay on 5.1.1 — it keeps
working — or update the IDE.

Added

• A tab per agent, with its own transcript. A second row under the chats lists everything the open chat
  started — agents, the agents they started, background tasks — all of it at once rather than behind a menu,
  and scrollable the same way the chats are. Opening one swaps what the conversation area shows; closing it
  hides a view and destroys nothing, and the card that started the agent opens it again.
• The chat tabs are all one width, so the row reads as a strip rather than as an accordion of long and
  short titles, and nothing reflows when you select a tab. A long name ellipsises with the whole of it in the
  tooltip. Selecting a chat centres it, which is what makes ordinary use need no scrolling at all.
• A Chat settings menu on the composer — the wrench beside the prompt box — holding the settings worth
  changing without leaving the chat, in ten collapsible groups: model, effort, permission mode, the chat
  toggles, the security lock's rules — 28 of them, behind the nine groups they belong to, so the list is
  navigable rather than a wall — setting sources, allowed / disallowed / always-allowed tools,
  and the two MCP switches. Model, effort and mode act on the chat you are in — they are the same controls as
  the pills beside them, so the two can never disagree — and anything that can only take effect the next time
  a chat starts says so over its group instead of quietly doing nothing. Everything else is one row away,
  behind Open Plugin Settings.
• "Always allow" can be granted in advance from that menu, instead of only by answering a permission card
  for that tool first. What it cannot do is widen the deterministic lock: a credential file, a dangerous
  command, the system temp folder and anything outside your project still stop and ask, for an always-allowed
  tool exactly as for any other.
• The composer's two rows of buttons collect what does not fit behind a ⋮, instead of running off the edge
  of a narrow tool window where nothing could reach them. The send button is never collected and never
  shrinks to make room.
• Attach ▸ Files… and Directory… browse your project inside the menu, as a tree that unfolds in place,
  rather than opening a separate file dialog over the IDE. Pick as many as you like and press Done; marking
  a folder marks everything under it and tells you how many that is before you commit to it. It offers what
  the IDE considers yours — your .gitignore and the project's excluded folders are honoured, so build/
  and node_modules/ are simply not there — and it says so out loud when a folder is too large to offer
  whole, rather than quietly attaching part of it.
• The chat's own buttons are in the chat. New chat, Stop, Commands, Git, Close all diffs and Log out sit
  in a row above the prompt box, where they are used, instead of in the tool window's title bar — which now
  holds only the IDE's own controls. Stop is greyed unless a turn is running, and Close all diffs unless
  there is a diff open.
• Install, sign-in and loading are screens over the transcript, and nothing else. Whichever one a tab
  owes you covers the conversation and leaves the chat tabs and the prompt box alone, so you can switch
  chats while one starts and type into a chat whose binary is still coming up — what you type is queued and
  sent the moment it is ready. A start that takes a moment draws no screen at all.
• Workloads: everything running across every open chat as one diagram, replacing the three lists that
  were three views of the same tree. Finished work ages out of it on a window you choose in Settings — five
  minutes through four hours, or All — while anything still running is always shown.
• Background tasks keep their tab and their output after they end, tailed live while they run and
  rebuilt after a restart. Until now both vanished at exactly the moment the output was worth reading.
• Git, without the plugin ever running git. A Git button in the chat's own button row opens the
  repository view, which holds a conversation of its own about the repository — so none of this plumbing
  lands in the chat you are working in, and none of it makes you leave it either. ⚙ also offers
  Initialize Git Repository, Commit Changes with Claude and
  Revert This File with Claude — each one asks Claude to do it, so the command is in front of you in an
  approval card before it runs and you can answer back ("squash those two", "not that file") instead of
  getting one shot at a button. On a project that is not a repository yet, opening it offers to create one.
  • Its turns are always approved by hand — whatever permission mode you are in, and whatever you have
    marked "Always allow". The plugin started the turn, so it does not inherit permissions you granted for
    your own work.
  • Each entry is hidden where it means nothing: no Initialize where there is already a repository, no
    Commit with nothing to commit, no Revert unless the file in the editor has actually changed.
• ⚙ ▸ Git Operations — branches and new branch, pull, fetch, push, merge, rebase, stash, unstash and the
  commit dialog, which are the IDE's own actions: the same dialogs, the same shortcuts, the same
  enablement, one menu away.
• Git context in the ⚙ menu: the checked-out branch in the menu label itself, your recent commits, and
  the history of the file you have open — all of it handing off to the IDE's own Git Log. It only ever
  reads, and on an IDE without the Git plugin, or outside a working copy, the entries are simply absent.
• A Git view in the session dashboard, so the same repository picture and the same actions are one click
  from the conversation: the branch, what is still uncommitted file by file, and the history as one graph
  with branch lanes — a commit list and a separate branch map asked you to hold two pictures of the same
  history at once. Every line and every fork in it comes from real parents and real refs; nothing is
  inferred, and a line that continues past the oldest commit shown says so rather than ending in mid-air. It
  reads every branch, remote branch and tag, not only the one you have checked out, because a fork you can
  only see one side of cannot be drawn. Colour carries nothing on its own: a branch is a text tag on its row
  and a merge says the word.
• GitHub and GitLab answer for the branch you are on: the pull or merge requests open from it, and its
  most recent CI run. Read-only, and opt-in — it does nothing until you paste an access token under Settings ▸
  Claude Code ▸ Git forge, and until then there is no card and no prompt to configure one. The token is stored in
  your OS keychain and kept per server, so a company GitLab and gitlab.com are two separate credentials
  and one can never be sent to the other. Clearing the field revokes it.
• ⚙ ▸ Review This Session's Changes… — everything the agent has touched this session, as native diff
  tabs, against one base. When the original side cannot be rebuilt exactly the file still opens and that
  pane says why — new file, binary, too large or restricted, or changed on disk since — because a fabricated
  original in a review tool is worse than none.
• A Plan view in the dashboard, holding this session's plan in full, with a button that appears only
  once there is one. It is re-read as soon as you approve a plan, so a revision does not leave the old one
  on screen.
• The transcript keeps a bounded number of rows in memory, dropping the oldest and saying so in a row at
  the top. Nothing is lost: the whole conversation is on disk, and "Open Previous Session…" reads it
  back in full.
• A chat names itself. At the end of the first turn Claude is asked to title the conversation, and the
  title is kept with the conversation — so it survives a restart and is never asked for twice. Until it
  arrives the tab shows the first thing you typed, one line, rather than "Chat 3" for the rest of its life. A
  name you set yourself always wins, whenever you set it. The same name appears in the live tab, in the tabs
  restored at startup and in the list behind "Open Previous Session…".
• The agent is told what it is running inside — that the transcript is a real interface and not a
  terminal, that its edits become a diff you review and its paths become links you click, and that a
  deterministic guard may refuse a call outright. It is fixed text: nothing about your machine, your
  environment or your project, and nothing that softens a rule.

Changed

• Settings moved into the IDE's password safe (the OS keychain), one encrypted document shared by every
  project. They used to sit in a plain-text file inside the project, committable, including the environment
  block where an API key ends up. Existing settings are adopted on first run — and because they are now
  shared rather than per project, the first project you open after upgrading is the one whose settings
  become everyone's. If you kept deliberately different settings in two projects, note them down first.
• The chat is noticeably lighter. The tab bar and the dashboard used to redraw everything on every update
  — several times a turn, including updates that changed nothing you could see — and the dashboard did it
  even while it was closed. Both now redraw only when what they draw has actually changed, so a tab bar no
  longer rebuilds itself under your pointer.
• The conversation uses the whole width of the tool window. It was capped at a fixed column, so the wider
  you made the panel the more of it was margin. Diffs, tables and command output are what ...

v5.1.1

[5.1.1] — 2026-08-10

Fixed

• The plan limits stopped refreshing whenever the panel was not on screen. The poll was gated on
  isShowing, so a collapsed tool window or a chat tab that was not the selected one asked for nothing at
  all — and a quota window is not the plugin's state to begin with: other sessions, other devices and
  claude.ai spend the same windows, and a reset is a wall-clock event that owes nothing to this IDE. The
  figure on screen was therefore whatever the last probe happened to catch, and it only moved again when
  something else triggered one — a turn, or opening the dashboard. "It only updates when I talk to the agent"
  is precisely what a visibility-gated poll looks like from outside. The gate is gone and the period is 30 s;
  what it was saving is one control request per half minute against a process that is already running, and
  the event-driven refreshes (turn edges, rate_limit_event, dashboard open, session ready) are unchanged.

Added

• The chat's plan-limit row now says how long each window has left — Reset time: 4h 18m on its own line
  directly under that window's bar, with the full sentence in the tooltip. A percentage alone does not say
  whether it is urgent: 90% with eight minutes to go and 90% with six hours to go are different situations,
  and only the dashboard was answering that. Under the bar rather than beside it because the row is already
  three items wide per window, and a fourth made the countdown the first thing to be squeezed out — the one
  case where it matters most. The countdown is computed by one function in app-core
  (CC.resetIn/resetInShort) that the dashboard card now shares, and a window with no reset time renders
  no element rather than an empty slot that would read as "resets now".

Changed

• Every get_usage poll now logs the reply it got, rate_limits verbatim (truncated), at INFO. The
  derived per-window lines cannot answer the question that keeps coming up — is the number on screen stale,
  or is the server still saying that? — because a window the reply omits leaves no line at all, and one
  carried forward from the previous poll is indistinguishable from a fresh one. It immediately earned its
  place: a live capture showed two of three consecutive polls coming back in the header-seeded shape
  (five_hour/seven_day only, no limits[], resets_at rounded to .000Z), which is the degraded reply
  5.1.0's merge exists for, and confirmed the binary does not cache the endpoint.
• RateLimitInfo.resetsAtIso() puts the epoch-seconds → ISO-8601 conversion on the model, so a window that
  reaches a surface from the event stream and one that arrives in the get_usage report are
  interchangeable to everything that renders them. It was a private copy in the dashboard's builder, and the
  composer needed the same thing.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key (docs/ci-signing-key.asc), which is itself certified by the maintainer's hardware
key — so the chain terminates in a key that has never been on a computer.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from main. That claim rests on the two gates around it — main accepts only
reviewed pull requests, and publication requires an approval on a protected environment.

gpg --import docs/ci-signing-key.asc
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

v5.1.0

[5.1.0] — 2026-08-10

Added

• An "Other models" group in the model picker, holding previous generations (Opus 4.8 → 4.0, Sonnet 4.6 →
  4.0, Sonnet 3.7 and 3.5, Haiku 3.5). Collapsed by default so the four current models keep the menu they had,
  and expanded automatically when the selected model lives inside it.

  The list is curated in the plugin, which deserves stating plainly because this repository removed a
  hardcoded model label in 4.3.3. There is no runtime source for it: the binary's selectable catalog — the
  initialize reply, and the identical answer to the list_models control request — contains only the current
  generation, and ModelInfo carries no deprecated/legacy flag. The binary still accepts these ids, it
  just will not list them. The distinction that makes a curated list defensible here: these are historical
  ids, which never change and never disappear, so the list can only gain entries. What went stale in 4.3.3 was
  a label describing the current tier. Nothing here names a current model, and a test enforces that.

  Choosing a model the account cannot run is handled rather than left to fail: set_model is now sent as a
  correlated control request, and a refusal restores the previous model and says so in the transcript
  instead of leaving the tab pointed at a model every later turn would fail on.

• Per-model plan limits — Fable among them — are reported. get_usage returns them in
  rate_limits.model_scoped, an array alongside the keyed windows rather than another key inside them
  (sdk.d.ts: { display_name, utilization, resets_at }[], and its own example names 'Fable').
  parseUsageReport walked only the keyed windows, so every per-model figure the server sent was dropped on
  the floor — which is why the CLI's /usage showed a Fable row the plugin never did.

  Reading that array is necessary and not sufficient, which is what the first attempt got wrong: the
  binary does not relay model_scoped, it synthesises it, and only behind its own remote config. Its
  projection (IUt(limits, jJe()) in 2.1.223) reads the tengu_usage_overage_included_models gate, returns
  an empty list the moment that gate is empty, and the key is spliced into rate_limits only when the
  projection yielded something — so in a --print session it simply never arrived, which is why the plugin
  logged five_hour and seven_day and nothing else while the same account's interactive /usage listed
  Fable. The plugin therefore also walks the raw rate_limits.limits[] array the projection reads from,
  which does ride through untouched — the binary's own /usage formatter assumes as much, calling IUt on
  this very payload — taking the weekly_scoped entries that name a model, with the binary's filter and
  without its allowlist. Dropping the allowlist is deliberate: it selects which models get overage billing,
  not which limits a user is subject to, and a limit that meters you is worth showing whether or not you can
  pay past it. resets_at is epoch seconds there as often as a string, so it is normalised rather than
  deserialized — a numeric one would have failed to decode and dropped the whole window in silence.

  And a usage refresh is now merged into the last one instead of replacing it, because the same fetch has
  a second fallback that omits windows: loadPlanRateLimits gives /api/oauth/usage 5 s, and on a timeout, a
  429 or a fieldless body it substitutes seedUtilization() — an object rebuilt from the rate-limit response
  headers, which structurally carries only five_hour and seven_day. It is flagged status:"seeded" and
  then accepted identically to a full reply, so a poll that simply failed was indistinguishable from one
  saying the per-model window no longer exists — and the Fable bar blinked out and back every few polls.
  Merged by window key over the whole set, since seven_day_opus/seven_day_sonnet are missing from a seeded
  object for the same reason and would flicker the same way; a carried-forward window keeps the last figure
  actually reported for it and the next real refresh overwrites it. The extra-credit balance is deliberately
  not carried: null there already means "this plan has none" as often as "this reply did not say".

  They are keyed model_scoped:<display_name> because the quota-crossing record is kept per window and has to
  stay stable across refreshes, and titled from the server's own display_name — the only source for it,
  since nothing in the plugin can name a window the server invents. An entry whose name collides with a keyed
  window is dropped rather than duplicated, one missing a name or a figure is skipped, and they sort after the
  known windows so the row order the user already reads does not shuffle when Anthropic adds a model.

Removed

• The nimbus_quill usage window is no longer shown. The claude.ai usage endpoint emits it and the CLI
  relays it untouched; it appears in no version of the binary and in no SDK type, so nothing here can say what
  it meters — it rendered as "Nimbus quill 0.0%", a row that asks a question and answers none. Hidden by
  name, deliberately not by a general "hide unknown windows" rule, which would silently swallow the next
  real limit; the moment it means something, deleting one line brings it back with its label, bar and ordering
  intact.

  It kept appearing anyway, because the filter sat on one of the two paths that feed a window to the UI:
  the get_usage report was filtered, the rate_limit_event stream was not, and that is the door it was
  arriving through. The rule is now applied on both (isHiddenUsageWindow), and on the event path the window
  is dropped whole rather than merely hidden — it must not become the session's rateLimit either, which
  drives the single-number quota bar.

Fixed

• A quota notification announcing 100% when almost nothing had been used. get_usage reports each
  window as a percentage on a 0–100 scale — sdk.d.ts says so on every window, and a live reply from
  claude 2.1.222 carries 8 and 67. ClaudeSession held a private copy of an "the wire sends both
  0–100 and 0–1, accept either" heuristic that multiplied any value <= 1.0 by a hundred. So a window at a
  genuine 1% was reported as 100%, crossed the 85% threshold, and raised an IDE notification telling
  the user their plan was spent — at the moment they had spent almost none of it, which is to say right
  after a window resets. The heuristic is undecidable at exactly 1.0 by construction: it cannot tell a full
  window from a barely-touched one.

  The rule now lives once, on the model (UsageWindow.utilizationPercent()), with no scale guessing: the
  value is already a percentage. Two of the three copies had been removed in 5.0.1 when the dashboard
  stopped rounding; this was the third, and the only one wired to notifications, which is why the bars got
  quieter while the notifications kept shouting. The event path (RateLimitInfo.utilization, genuinely a
  0..1 fraction) is unchanged and was never affected.

Changed

• The plan limits are their own row under the status line, one labelled bar per window, instead of dots
  at the end of the readout. Inline, they sat behind Running… / Context 65% / 65.3k out / 0 reasoning on a
  wrapping row — so the windows nearest their cap, the ones the row exists for, were the ones most likely to
  wrap out of sight in a narrow tool window. The row is a repeat(auto-fit, minmax(150px, 1fr)) grid: it
  spends the full width at any size and drops to fewer columns as the panel narrows, with no media query and
  no fixed layout to outgrow. The bar is clamped to 100%; the number is not, because a window reported past
  its cap is exactly the figure worth reading.

• Quota notifications title themselves through UsageWindow.title(key) rather than from the key, so a
  per-model window announces "Fable quota at 85%" instead of the synthetic model_scoped:Fable. The record
  that decides whether a threshold has already been announced stays keyed by the key, which is what makes it
  survive a refresh.

• The get_usage path now logs each window's raw utilization and the percentage derived from it, at INFO.
  When the false 100% was reported there was nothing in idea.log to check it against, because only the
  event path carried a trace — and that one is debug, so it is off by default. A number the user can see
  should leave behind the value that produced it.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key (docs/ci-signing-key.asc), which is itself certified by the maintainer's hardware
key — so the chain terminates in a key that has never been on a computer.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from main. That claim rests on the two gates around it — main accepts only
reviewed pull requests, and publication requires an approval on a protected environment.

gpg --import docs/ci-signing-key.asc
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

v5.0.1

[5.0.1] — 2026-08-10

Fixed

• The subscription login did not survive a restart. The credential was stored correctly — in the IDE's
  PasswordSafe, which resolves to the OS store — KWallet or GNOME Keyring through the Secret Service on
  Linux, the Keychain on macOS, the Credential Manager on Windows — and it was still there after the reboot,
  confirmed by reading the entry back out of the OS store directly. What expired was the access
  token inside it: the OAuth flow issues one good for hours (~10 h, measured), so any restart the next day
  found a perfectly persisted credential that no longer authenticated anything. hasUsableToken() answered
  false, and false meant "signed out", so the sign-in card came back every morning.

  The blob beside it always carried a refresh token valid for weeks and the plugin never spent it, by
  design: only the binary can, and it does so by rewriting ~/.claude/.credentials.json — the exact file the
  vault exists to remove. The way out is that the binary has a non-interactive login for precisely this:
  given CLAUDE_CODE_OAUTH_REFRESH_TOKEN and CLAUDE_CODE_OAUTH_SCOPES, claude auth login takes a
  dedicated branch, mints a fresh credential and exits — no browser, no TTY, no user. So renewal is now the
  binary's job, exactly as it always was, and the plugin's job stays what it was: take custody of the result
  and delete the plaintext copy. No OAuth client here, no token endpoint called from the IDE, no file written
  back — the invariant NoFileDeletionContractTest and the vault's KDoc both state is untouched.

  Reported on Linux and Windows, and it is one bug rather than two: the binary's default credential store
  is its plaintext provider (~/.claude/.credentials.json) on every platform, so the vault takes custody
  the same way everywhere and the token expires the same way everywhere. The fix carries no platform-specific
  code — the only Windows-specific care is that the renewal environment strips CLAUDE_CODE_OAUTH_TOKEN
  case-insensitively, since environment names are case-insensitive there.

  Scope: the subscription (OAuth) credential only. An Anthropic API key is a different identity in a
  different slot — providerApiKey:anthropic in the same PasswordSafe, not CLAUDE_CREDENTIALS_JSON — and it
  has no expiry and no refresh token, so there was nothing to lose across a restart and there is nothing to
  renew now. CredentialsVault.renew() reads the claudeAiOauth blob and nothing else, and envOverlay
  withdraws entirely when an API key is present, so an API-key session is untouched by any of this.

  An expired-but-renewable credential now counts as an identity (CredentialsVault.canRenew), the renewal
  runs off the EDT at launch (ClaudeSession.renewVaultedCredential, before the launch env is built, and
  never while a sign-in is in flight), the refresh token rotates at every renewal so ordinary use extends it
  indefinitely, and a failed renewal arms a five-minute cooldown so the three-second boot watcher cannot turn
  a flaky network into a process spawn per poll. Sign-in is now needed only after a genuinely idle period, or
  when Anthropic invalidates the grant.

---

Verifying this release. Both the .asc files and the tag are signed by the project's CI
signing key (docs/ci-signing-key.asc), which is itself certified by the maintainer's hardware
key — so the chain terminates in a key that has never been on a computer.

What the signatures do NOT assert is that a human pressed a button: the release is cut
automatically from main. That claim rests on the two gates around it — main accepts only
reviewed pull requests, and publication requires an approval on a protected environment.

gpg --import docs/ci-signing-key.asc
gpg --verify claude-code-native-*.zip.asc   # these bytes came from this workflow
git verify-tag <tag>                        # this workflow cut this release from main

v4.4.1 — /login fix, restored-transcript rendering, review prompt

v4.4.1 — 2026-07-29

🔑 Fixed: /login never actually opened the terminal. Signing in from the chat always ended on "run this command yourself in a terminal" — the plugin was calling IDE terminal APIs that no longer exist in current IDEs (they were removed after 2025.2), and because each lookup failed quietly, nothing showed up in the log to explain it. /login now opens a real terminal tab and runs the sign-in there, on every supported IDE version.

If the terminal can't be opened at all — say you've disabled the bundled Terminal plugin — the plugin now falls back to signing you in natively, with no terminal involved, instead of giving up. The manual command is only ever shown as a genuine last resort.

🔁 Fixed: reopening a past chat lost the command code blocks. Restored conversations rendered Bash and other command calls in the old plain-text style — you couldn't copy the command, and its output wasn't a code block either. Reloading a session now produces exactly the same cards a live turn does.

⭐ Asked once, and only once. After 25 successful turns, a single IDE notification asks whether you'd leave a review on the Marketplace — and then never asks again, whatever you click. No dialogs, no "remind me later", nothing that interrupts your work. Failed or interrupted turns don't count, so you'll only ever see it if the plugin has actually been working for you.

📝 Listing rewritten, with a few stale claims corrected along the way — it advertised a 2025.2 minimum when the plugin actually supports 2025.1+, and documented a couple of shortcuts that had since changed.

Verified Compatible on IC-251, IC-252 and IU-262 — including the exact build the /login regression was reported on.

See CHANGELOG.md for the full technical detail.