feat: 6.5.0 — split plugin for Remote Development

.github/ISSUE_TEMPLATE/bug_report.md

@@ -31,13 +31,13 @@ What actually happened. Include error messages verbatim.
 
 ## Environment
 
-> From **5.5.0** the minimum supported IDE is **2025.3 (build 253)**. The whole chat UI is the IDE's
-> embedded browser, and the module that provides it does not exist before 253. On 2025.1 or 2025.2 the
-> last supported version is **5.1.1** — a bug report against 5.5.0 on those builds is expected behaviour,
-> not a defect.
+> From **6.5.0** the minimum supported IDE is **2026.2 (build 262.8665.258)**. On 2025.3 or 2026.1 the
+> last supported version is **6.0.1**; on 2025.1 or 2025.2 it is **5.1.1**. A bug report against 6.5.0 on
+> an older build is expected behaviour, not a defect. In Remote Development, say whether the plugin is
+> installed on the host, the client, or both.
 
 - **OS:** (e.g. Ubuntu 24.04, macOS 14.5, Windows 11 23H2)
-- **IDE:** (Help → About → product + build, e.g. `IntelliJ IDEA 2025.3 IC-253.28294.334`)
+- **IDE:** (Help → About → product + build, e.g. `IntelliJ IDEA 2026.2.3 IU-262.10968.63`)
 - **Plugin version:** (Settings → Plugins → Claude Code Native)
 - **`claude` binary version:** output of `claude --version`
 - **Binary location:** `which claude` (Linux/macOS) or `where claude` (Windows)

.github/ISSUE_TEMPLATE/config.yml

@@ -9,9 +9,9 @@ contact_links:
 
   # TODO: replace with the GitHub Discussions URL once enabled for the repo.
   - name: GitHub Discussions
-    url: https://github.com/serialexperimentslainnnn/claude-code-for-jetbrains/discussions
+    url: https://github.com/serialexperimentslainnnn/claude-code-native/discussions
     about: Ask a question, share a workflow, or discuss ideas before filing an issue.
 
   - name: Security vulnerability
-    url: https://github.com/serialexperimentslainnnn/claude-code-for-jetbrains/security/advisories/new
+    url: https://github.com/serialexperimentslainnnn/claude-code-native/security/advisories/new
     about: Do NOT open a public issue. Report it privately here; see SECURITY.md.

.github/PULL_REQUEST_TEMPLATE.md

@@ -32,7 +32,7 @@ or the permission surface, say what happens to a user who already ran it.
 - [ ] Commits follow Conventional Commits (the `commit-msg` hook enforces it —
       install once with `git config core.hooksPath .githooks`).
 - [ ] `./gradlew test verifyPlugin buildPlugin` passes locally.
-- [ ] `verifyPlugin` is **Compatible** across the declared range (253 → 263.\*)
+- [ ] `verifyPlugin` is **Compatible** across the declared range (262.8665.258 → 263.\*)
       and reports no new internal-API usage (`@ApiStatus.Internal`).
       The CDN download is unreliable here; use
       `-PlocalIdePath=<dir>[,<dir>…]` with locally-extracted IDEs.
@@ -45,7 +45,7 @@ or the permission surface, say what happens to a user who already ran it.
 - [ ] No new deprecated or scheduled-for-removal IntelliJ Platform APIs.
 - [ ] Tests added or updated for the new behaviour — `src/test/kotlin/…` for
       Kotlin, `src/test/frontend/…` (`npm test`) for anything under
-      `src/main/resources/jcef/`.
+      `frontend/src/main/resources/jcef/` or `frontend/src/main/ts/`.
 - [ ] Protocol changes: `./gradlew checkDrift` is green and the baseline in
       `scripts/drift-baseline.properties` matches what was verified.
 - [ ] New dependency? Its licence is compatible with GPL-3.0-only and it is

.github/ci-image/jvm-test.Dockerfile

@@ -43,22 +43,14 @@
 
 # Declared before FROM so it can be used there. The default names this repository's own package; a fork
 # overrides it with --build-arg rather than editing the file.
-ARG NODE_IMAGE=ghcr.io/serialexperimentslainnnn/node-test:v1.0.0
+ARG NODE_IMAGE=ghcr.io/serialexperimentslainnnn/node-test:v1.1.0
 FROM ${NODE_IMAGE}
 
 # NB there is no dnf tuning here and that is not an omission: `max_parallel_downloads=20` and
 # `fastestmirror=True` were written into /etc/dnf/dnf.conf by node-test, and this image starts from its
 # filesystem — so the JDK transaction below already runs with them. Adding the lines again would append a
 # SECOND copy of each key to dnf.conf rather than overriding anything.
 #
-# Temurin, not Fedora's OpenJDK.
-#
-# Fedora 44 no longer packages java-21-openjdk — it has moved on to a newer LTS — and the JDK version is not
-# ours to float: build.gradle.kts pins the toolchain to 21 because the IDE runs on JBR 21, which is the
-# ceiling. Building on 25 would produce class files no target IDE can load. Adoptium's repository is the
-# same source the `setup-java` action uses on the hosted runners, so the image and the pipeline compile
-# against the same JDK rather than two different builds of "21".
-#
 # There is deliberately no `dnf-plugins-core`: nothing here calls `dnf config-manager` — the repo file is
 # written with `printf` — and `curl` is already in the base image, so installing it dragged in a ~150 MB
 # Python stack to run a command nobody ran.
@@ -81,7 +73,7 @@ RUN curl -fsSL https://packages.adoptium.net/artifactory/api/gpg/key/public \
         'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Adoptium' \
         > /etc/yum.repos.d/adoptium.repo \
     && dnf -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs install \
-        temurin-21-jdk \
+        temurin-25-jdk \
         python3 \
         zip \
     && dnf clean all \
@@ -125,9 +117,9 @@ RUN dnf -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs install \
 # silently break on the next base-image bump. The symlink keeps the ENV below stable across rebuilds.
 RUN JH="$(dirname "$(dirname "$(readlink -f "$(command -v javac)")")")" \
     && echo "JAVA_HOME=$JH" >> /etc/environment \
-    && ln -sfn "$JH" /opt/java-21 \
+    && ln -sfn "$JH" /opt/java-25 \
     && "$JH/bin/java" -version
-ENV JAVA_HOME=/opt/java-21
+ENV JAVA_HOME=/opt/java-25
 ENV PATH="${JAVA_HOME}/bin:${PATH}"
 
 # Gradle writes here, and the path MUST match GRADLE_USER_HOME in the workflow. If they diverge, the warm

.github/ci-image/node-test.Dockerfile

@@ -19,8 +19,8 @@
 # BUILDING — from the repository ROOT, so /.dockerignore applies:
 #
 #   docker build -f .github/ci-image/node-test.Dockerfile \
-#     -t ghcr.io/OWNER/node-test:v1.0.0 .
-#   docker push ghcr.io/OWNER/node-test:v1.0.0
+#     -t ghcr.io/OWNER/node-test:v1.1.0 .
+#   docker push ghcr.io/OWNER/node-test:v1.1.0
 #
 # The tag is `vMAJOR.MINOR.PATCH`, never `latest`: a floating tag makes "which image was that job green on?"
 # unanswerable, and this repository's standard is to pin. Bumping it is a commit — change the tag here and
@@ -49,7 +49,7 @@ RUN echo "max_parallel_downloads=20" >> /etc/dnf/dnf.conf \
 # not, and bumping the tag is the deliberate act that moves it.
 RUN dnf -y upgrade --refresh \
     && dnf -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs install \
-        nodejs npm \
+        nodejs24 nodejs24-bin nodejs24-npm nodejs24-npm-bin \
         git-core unzip tar which findutils procps-ng ca-certificates \
     && dnf clean all \
     && rm -rf /var/cache/dnf \

.github/workflows/ci.yml

@@ -88,14 +88,14 @@ jobs:
     # EVERY job in this file runs in this image, and the image is the ONLY caching mechanism.
     #
     # `gradle/actions/setup-gradle` used to sit in the heavy jobs and was quietly useless here: the warm
-    # GRADLE_USER_HOME measures 31 GB (23 GB of extracted IDE transforms under caches/9.5.1, 7.7 GB of the
+    # GRADLE_USER_HOME measures 31 GB (23 GB of extracted IDE transforms under caches/9.7.1, 7.7 GB of the
     # downloaded IDE artifacts under modules-2), and a GitHub Actions cache entry is capped at 10 GB per
     # repository. It could never have stored what it appeared to be storing — it was saving a partial
     # cache, evicting it, and re-downloading the rest on the next run. The image has no such ceiling, and
     # the trade is explicit: refreshing what CI has cached now means rebuilding and pushing the image,
     # which is a deliberate act rather than something that drifts between runs.
     container:
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. This requires the package to have been granted Read access to
       # THIS repository (package settings -> Manage Actions access): `packages: read` widens what the token
@@ -158,7 +158,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     container:
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. `packages: read` is granted per job below; without it the pull
       # fails with a 401 that reads like a wrong image name rather than a permission problem.
@@ -229,7 +229,7 @@ jobs:
             build/reports/kover/
           retention-days: 14
 
-  # The JCEF web app (src/main/resources/jcef/*.js) under vitest + jsdom. Nothing here ships in the
+  # The JCEF web app (frontend/src/main/resources/jcef/*.js) under vitest + jsdom. Nothing here ships in the
   # plugin — vitest and jsdom are devDependencies — but the code under test absolutely does.
   frontend-test:
     name: Frontend tests
@@ -239,7 +239,7 @@ jobs:
       # `node-test`, not `jvm-test`: this job is `npm ci` and then vitest. On the single combined image it
       # pulled a JDK, a Gradle distribution and 3.4 GB of extracted IntelliJ Platform it never opened —
       # 1m05s of container init for 8 seconds of work.
-      image: ghcr.io/serialexperimentslainnnn/node-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/node-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. `packages: read` is granted per job below; without it the pull
       # fails with a 401 that reads like a wrong image name rather than a permission problem.
@@ -283,7 +283,7 @@ jobs:
     timeout-minutes: 10
     container:
       # `node-test`: this job is `npm ci` and two `npm audit` invocations. Nothing here touches the JVM.
-      image: ghcr.io/serialexperimentslainnnn/node-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/node-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. `packages: read` is granted per job below; without it the pull
       # fails with a 401 that reads like a wrong image name rather than a permission problem.
@@ -389,7 +389,7 @@ jobs:
       # Same image as every other job, and it does NOT carry the IDEs this job downloads — see the note at
       # the top of .github/ci-image/jvm-test.Dockerfile. Baking them made the image 38.1 GB, which every job paid for
       # on its own runner, to save ten minutes on the one job that runs least often.
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. `packages: read` is granted per job below; without it the pull
       # fails with a 401 that reads like a wrong image name rather than a permission problem.
@@ -522,13 +522,22 @@ jobs:
         run: |
           zip=$(ls build/distributions/*.zip)
           unzip -o -q "$zip" -d /tmp/artifact
-          jar=$(ls /tmp/artifact/*/lib/claude-code-native-*.jar | grep -v searchableOptions)
-          # -1 lists entry names alone; directory entries end in `/` and carry nothing.
-          unzip -Z -1 "$jar" | grep -v '/$' \
-            | grep -vE '^dev/lain/claudejb/.*\.class$' \
-            | grep -vE '^META-INF/' \
-            | grep -vE '^icons/[^/]+\.svg$' \
-            | grep -vE '^jcef/(.+\.(js|html)|css/.+\.css)$' > /tmp/unexpected.txt || true
+          ls /tmp/artifact/*/lib/dev.lain.claudejb-*.jar /tmp/artifact/*/lib/modules/dev.lain.claudejb.*.jar 2>/dev/null \
+            | grep -v searchableOptions > /tmp/jars.txt || true
+          if [ "$(wc -l < /tmp/jars.txt)" -lt 4 ]; then
+            echo "::error::expected the plugin jar and the shared, frontend and backend module jars"
+            find /tmp/artifact -name '*.jar'
+            exit 1
+          fi
+          : > /tmp/unexpected.txt
+          while IFS= read -r jar; do
+            unzip -Z -1 "$jar" | grep -v '/$' \
+              | grep -vE '^dev/lain/claudejb/.*\.class$' \
+              | grep -vE '^META-INF/' \
+              | grep -vE '^dev\.lain\.claudejb\.(shared|frontend|backend|git|github|java|intellilang|terminal|bookmarks|database|problems)\.xml$' \
+              | grep -vE '^icons/[^/]+\.svg$' \
+              | grep -vE '^jcef/(.+\.(js|html)|css/.+\.css)$' >> /tmp/unexpected.txt || true
+          done < /tmp/jars.txt
           if [ -s /tmp/unexpected.txt ]; then
             echo "::error::unexpected entries in the plugin jar — either they must not ship, or add their family to this allowlist"
             cat /tmp/unexpected.txt
@@ -556,7 +565,7 @@ jobs:
 
           zip=$(ls build/distributions/*.zip)
           unzip -o -q "$zip" -d /tmp/dist
-          jar=$(ls /tmp/dist/*/lib/claude-code-native-*.jar | grep -v searchableOptions | head -1)
+          jar=$(ls /tmp/dist/*/lib/dev.lain.claudejb-*.jar | grep -v searchableOptions | head -1)
 
           # ONE listing, read by every assertion below. `-Z1` prints one entry name per line, so names are
           # matched WHOLE (`grep -qxF`) instead of as substrings of `unzip -l`'s formatted table — where
@@ -627,7 +636,7 @@ jobs:
     # dead IDE into a fast, explained failure instead of letting it eat the whole budget.
     timeout-minutes: 45
     container:
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       # The package stays PRIVATE and is pulled with the run's own GITHUB_TOKEN — no new secret, nothing to
       # rotate, and access dies with the job. `packages: read` is granted per job below; without it the pull
       # fails with a 401 that reads like a wrong image name rather than a permission problem.
@@ -652,32 +661,6 @@ jobs:
         with:
           persist-credentials: false
 
-      # The image running this job carries no X11 whatsoever: it was built for headless Gradle and npm, and
-      # nothing in it has ever had to draw. This is the one job that does — a real IDE, with a real Chromium
-      # inside it.
-      #
-      # .github/ci-image/jvm-test.Dockerfile ALREADY bakes this exact package set, which is where it belongs:
-      # the image is this pipeline's only caching mechanism, so a `dnf install` per run is a network
-      # transaction whose failure mode is this job's worst one. This step survives because every workflow
-      # pins `jvm-test:v1.0.0`, and that tag names an image built BEFORE the Dockerfile gained the stack. A
-      # Dockerfile edit changes nothing on its own; the image has to be rebuilt and a new tag cut.
-      #
-      # DELETE THIS STEP in the same change that bumps the tag — in every workflow that names it, not just
-      # this one (ci.yml ×4, release.yml, codeql.yml, drift.yml). Leaving it behind costs one redundant
-      # install per nightly run; deleting it BEFORE the tag moves costs an IDE that never opens its port.
-      #
-      # A missing library here does not announce itself — the IDE simply never opens :8082 — which is exactly
-      # the silence the bounded wait below turns back into a message.
-      - name: Install the virtual display and the libraries the IDE draws through
-        run: |
-          set -euo pipefail
-          dnf -y --setopt=install_weak_deps=False --setopt=tsflags=nodocs install \
-            xorg-x11-server-Xvfb \
-            gtk3 nss alsa-lib mesa-libgbm libxkbcommon-x11 \
-            libXtst libXi libXrender libXext libXrandr libXcursor \
-            liberation-fonts
-          dnf clean all
-
       # Step one of the two-process dance that build.gradle.kts and docs/UI_TESTING.md both document: the IDE
       # comes up under Xvfb and STAYS UP, and the suite is a second Gradle invocation that talks to it over
       # :8082. Backgrounded here rather than split into a second job, because the two halves must share a host.

.github/workflows/codeql.yml

@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 45
     container:
       # `jvm-test`: the manual build is `./gradlew classes`, which resolves the whole IntelliJ Platform.
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
@@ -58,11 +58,11 @@ jobs:
         with:
           persist-credentials: false
 
-      # No `setup-java` step: the image already carries the Temurin 21 the rest of the pipeline builds
+      # No `setup-java` step: the image already carries the Temurin 25 the rest of the pipeline builds
       # with. Provisioning a second JDK here meant CodeQL analysed a build that used a different one.
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: java-kotlin
           build-mode: manual
@@ -160,7 +160,7 @@ jobs:
         run: ./gradlew --no-daemon --stacktrace classes
 
       - name: Analyze
-        uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:java-kotlin
 
@@ -177,13 +177,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: javascript-typescript
           build-mode: none
           queries: security-extended
 
       - name: Analyze
-        uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:javascript-typescript

.github/workflows/drift.yml

@@ -34,7 +34,7 @@ jobs:
     timeout-minutes: 30
     container:
       # `jvm-test`: this job runs `npm install` and the global claude CLI install AND `./gradlew checkDrift`.
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -148,7 +148,7 @@ jobs:
     # gate could pass or fail on a toolchain the pull request never saw.
     container:
       # `jvm-test`: this gate runs `npm ci`, `npm test` AND `./gradlew test verifyPlugin` in one job.
-      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.0.0
+      image: ghcr.io/serialexperimentslainnnn/jvm-test:v1.1.0
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
@@ -396,10 +396,10 @@ jobs:
         with:
           node-version-file: .nvmrc
 
-      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
-          java-version: '21'
+          java-version: '25'
 
       # NB no `setup-gradle`, deliberately, and this was the last one left in any workflow.
       #
@@ -450,7 +450,7 @@ jobs:
           echo "published $name  sha256=$(sha256sum "dist/$name" | cut -d' ' -f1)"
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/${{ steps.artifact.outputs.name }}