@redscope-ai/redscope 1.0.2 → 1.0.4

package/dist/{chunk-2ws1k5sw.js → chunk-s2t5anwv.js}

@@ -4242,9 +4242,72 @@ var init_managedEnvConstants = __esm(() => {
   ]);
 });
 
-// src/utils/envConfig.ts
+// src/utils/authorizedEgressConfig.ts
 import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname } from "path";
+import { dirname, join as join3, resolve } from "path";
+import { fileURLToPath } from "url";
+function getPreferredRefereeEgressConfigFilePath() {
+  return getPreferredUserConfigFile(REFEREE_EGRESS_CONFIG_FILE);
+}
+function ensureUserRefereeEgressConfigFile() {
+  const filePath = getPreferredRefereeEgressConfigFilePath();
+  if (existsSync(filePath)) {
+    return { filePath, created: false, error: null };
+  }
+  try {
+    const template = readBundledRefereeEgressTemplate();
+    const content = prepareUserRefereeEgressConfigContent(template, filePath);
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, content, {
+      encoding: "utf-8",
+      mode: 384
+    });
+    return { filePath, created: true, error: null };
+  } catch (error) {
+    return {
+      filePath,
+      created: false,
+      error: error instanceof Error ? error : new Error(String(error))
+    };
+  }
+}
+function readBundledRefereeEgressTemplate() {
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const argvEntry = process.argv[1] ? dirname(process.argv[1]) : undefined;
+  const candidates = [
+    process.env.REDSCOPE_REFEREE_EGRESS_TEMPLATE_PATH,
+    resolve(moduleDir, "../../tools", REFEREE_EGRESS_CONFIG_FILE),
+    resolve(moduleDir, "../tools", REFEREE_EGRESS_CONFIG_FILE),
+    argvEntry ? resolve(argvEntry, "../tools", REFEREE_EGRESS_CONFIG_FILE) : undefined,
+    argvEntry ? resolve(argvEntry, "../../tools", REFEREE_EGRESS_CONFIG_FILE) : undefined,
+    resolve(process.cwd(), "tools", REFEREE_EGRESS_CONFIG_FILE)
+  ].filter((path) => Boolean(path));
+  for (const candidate of uniquePaths(candidates)) {
+    if (existsSync(candidate)) {
+      return readFileSync2(candidate, "utf-8");
+    }
+  }
+  throw new Error(`Could not find bundled ${REFEREE_EGRESS_CONFIG_FILE} template`);
+}
+function prepareUserRefereeEgressConfigContent(template, targetFilePath) {
+  const parsed = JSON.parse(template);
+  parsed.policy ??= {};
+  parsed.policy.statePath = join3(dirname(targetFilePath), REFEREE_EGRESS_STATE_FILE);
+  parsed.policy.notes ??= [];
+  if (!parsed.policy.notes.includes("This user-level copy is safe to edit; RedScope will not overwrite it after creation.")) {
+    parsed.policy.notes.push("This user-level copy is safe to edit; RedScope will not overwrite it after creation.");
+  }
+  return `${JSON.stringify(parsed, null, 2)}
+`;
+}
+var REFEREE_EGRESS_CONFIG_FILE = "authorized-egress.referee-provided.json", REFEREE_EGRESS_STATE_FILE = "redscope-egress-referee-provided-state.json";
+var init_authorizedEgressConfig = __esm(() => {
+  init_redscopeCompat();
+});
+
+// src/utils/envConfig.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
 function resetEnvConfigCache() {
   envConfigCache = undefined;
 }
@@ -4279,9 +4342,10 @@ function getEnvConfigEnvironment() {
     return { ...envConfigCache };
   }
   ensureEnvConfigFile();
+  ensureUserRefereeEgressConfigFile();
   const merged = {};
   for (const filePath of getReadableEnvConfigFiles()) {
-    Object.assign(merged, parseEnvConfig(readFileSync2(filePath, "utf-8")));
+    Object.assign(merged, parseEnvConfig(readFileSync3(filePath, "utf-8")));
   }
   const expanded = expandEnvConfigEnvironment(merged);
   envConfigCache = expanded;
@@ -4300,7 +4364,7 @@ function updateEnvConfigValues(values) {
     if (Object.keys(values).length === 0) {
       return { error: null, filePath };
     }
-    const content = existsSync(filePath) ? readFileSync2(filePath, "utf-8") : "";
+    const content = existsSync2(filePath) ? readFileSync3(filePath, "utf-8") : "";
     const updated = upsertEnvConfigContent(content, values);
     writeEnvConfigFile(filePath, updated);
     resetEnvConfigCache();
@@ -4405,13 +4469,13 @@ function ensureEnvConfigFile() {
   writeEnvConfigFile(getPreferredEnvConfigFilePath(), content);
 }
 function getReadableEnvConfigFiles() {
-  return uniquePaths(getEnvConfigFilePaths().filter((path) => existsSync(path))).reverse();
+  return uniquePaths(getEnvConfigFilePaths().filter((path) => existsSync2(path))).reverse();
 }
 function readLegacyDotEnvForMigration() {
   const merged = {};
-  const files = uniquePaths(getUserConfigFiles(LEGACY_DOTENV_FILE).filter((path) => existsSync(path))).reverse();
+  const files = uniquePaths(getUserConfigFiles(LEGACY_DOTENV_FILE).filter((path) => existsSync2(path))).reverse();
   for (const filePath of files) {
-    Object.assign(merged, parseEnvConfig(readFileSync2(filePath, "utf-8")));
+    Object.assign(merged, parseEnvConfig(readFileSync3(filePath, "utf-8")));
   }
   return merged;
 }
@@ -4527,6 +4591,8 @@ function createEnvConfigTemplate(values, migratedFromDotEnv) {
     "# REDSCOPE_AUTO_EGRESS: 1 enables automatic authorized egress; 0 disables it.",
     "# REDSCOPE_AUTO_EGRESS=0",
     "# REDSCOPE_AUTO_EGRESS_CONFIG: config used when automatic egress is enabled.",
+    "# RedScope creates authorized-egress.referee-provided.json next to this",
+    "# env.config on first startup; edit that user-level copy for referee IPs.",
     "# REDSCOPE_AUTO_EGRESS_CONFIG=tools/authorized-egress.referee-provided.json",
     "# REDSCOPE_EGRESS_POOL: egress pool id from the authorized egress config.",
     "# REDSCOPE_EGRESS_POOL=referee-provided-traffic-simulation",
@@ -4642,8 +4708,8 @@ function createEnvConfigTemplate(values, migratedFromDotEnv) {
 `;
 }
 function writeEnvConfigFile(filePath, content) {
-  mkdirSync(dirname(filePath), { recursive: true });
-  writeFileSync(filePath, content, {
+  mkdirSync2(dirname2(filePath), { recursive: true });
+  writeFileSync2(filePath, content, {
     encoding: "utf-8",
     mode: 384
   });
@@ -4651,7 +4717,7 @@ function writeEnvConfigFile(filePath, content) {
 function hasEnvConfigRuntimeModelValues() {
   const merged = {};
   for (const filePath of getReadableEnvConfigFiles()) {
-    Object.assign(merged, parseEnvConfig(readFileSync2(filePath, "utf-8")));
+    Object.assign(merged, parseEnvConfig(readFileSync3(filePath, "utf-8")));
   }
   return Object.keys(merged).some(isRuntimeModelConfigKey);
 }
@@ -4794,6 +4860,7 @@ var ENV_CONFIG_FILE = "env.config", LEGACY_DOTENV_FILE = ".env", ENV_KEY_PATTERN
 var init_envConfig = __esm(() => {
   init_redscopeCompat();
   init_managedEnvConstants();
+  init_authorizedEgressConfig();
   ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
   RUNTIME_MODEL_CONFIG_KEYS = new Set([
     "REDSCOPE_MODEL_PROVIDER",
@@ -5095,7 +5162,7 @@ var init_configConstants = __esm(() => {
 // src/utils/config.ts
 import { randomBytes } from "crypto";
 import { unwatchFile, watchFile } from "fs";
-import { basename, dirname as dirname2, join as join3, resolve } from "path";
+import { basename, dirname as dirname3, join as join4, resolve as resolve2 } from "path";
 function createDefaultGlobalConfig() {
   return {
     numStartups: 0,
@@ -5160,7 +5227,7 @@ function computeTrustDialogAccepted() {
     if (pathConfig?.hasTrustDialogAccepted) {
       return true;
     }
-    const parentPath = normalizePathForConfigKey(resolve(currentPath, ".."));
+    const parentPath = normalizePathForConfigKey(resolve2(currentPath, ".."));
     if (parentPath === currentPath) {
       break;
     }
@@ -5170,11 +5237,11 @@ function computeTrustDialogAccepted() {
 }
 function isPathTrusted(dir) {
   const config = getGlobalConfig();
-  let currentPath = normalizePathForConfigKey(resolve(dir));
+  let currentPath = normalizePathForConfigKey(resolve2(dir));
   while (true) {
     if (config.projects?.[currentPath]?.hasTrustDialogAccepted)
       return true;
-    const parentPath = normalizePathForConfigKey(resolve(currentPath, ".."));
+    const parentPath = normalizePathForConfigKey(resolve2(currentPath, ".."));
     if (parentPath === currentPath)
       return false;
     currentPath = parentPath;
@@ -5370,7 +5437,7 @@ function getCustomApiKeyStatus(truncatedApiKey) {
   return "new";
 }
 function saveConfig(file, config, defaultConfig) {
-  const dir = dirname2(file);
+  const dir = dirname3(file);
   const fs = getFsImplementation();
   fs.mkdirSync(dir);
   const filteredConfig = pickBy_default(config, (value, key) => jsonStringify(value) !== jsonStringify(defaultConfig[key]));
@@ -5384,7 +5451,7 @@ function saveConfig(file, config, defaultConfig) {
 }
 function saveConfigWithLock(file, createDefault, mergeFn) {
   const defaultConfig = createDefault();
-  const dir = dirname2(file);
+  const dir = dirname3(file);
   const fs = getFsImplementation();
   fs.mkdirSync(dir);
   let release;
@@ -5450,14 +5517,14 @@ function saveConfigWithLock(file, createDefault, mergeFn) {
       const mostRecentTimestamp = mostRecentBackup ? Number(mostRecentBackup.split(".backup.").pop()) : 0;
       const shouldCreateBackup = Number.isNaN(mostRecentTimestamp) || Date.now() - mostRecentTimestamp >= MIN_BACKUP_INTERVAL_MS;
       if (shouldCreateBackup) {
-        const backupPath = join3(backupDir, `${fileBase}.backup.${Date.now()}`);
+        const backupPath = join4(backupDir, `${fileBase}.backup.${Date.now()}`);
         fs.copyFileSync(file, backupPath);
       }
       const MAX_BACKUPS = 5;
       const backupsForCleanup = shouldCreateBackup ? fs.readdirStringSync(backupDir).filter((f) => f.startsWith(`${fileBase}.backup.`)).sort().reverse() : existingBackups;
       for (const oldBackup of backupsForCleanup.slice(MAX_BACKUPS)) {
         try {
-          fs.unlinkSync(join3(backupDir, oldBackup));
+          fs.unlinkSync(join4(backupDir, oldBackup));
         } catch {}
       }
     } catch (e) {
@@ -5508,15 +5575,15 @@ function findMostRecentBackup(file) {
     const backups = fs.readdirStringSync(backupDir).filter((f) => f.startsWith(`${fileBase}.backup.`)).sort();
     const mostRecent = backups.at(-1);
     if (mostRecent) {
-      return join3(backupDir, mostRecent);
+      return join4(backupDir, mostRecent);
     }
   } catch {}
-  const fileDir = dirname2(file);
+  const fileDir = dirname3(file);
   try {
     const backups = fs.readdirStringSync(fileDir).filter((f) => f.startsWith(`${fileBase}.backup.`)).sort();
     const mostRecent = backups.at(-1);
     if (mostRecent) {
-      return join3(fileDir, mostRecent);
+      return join4(fileDir, mostRecent);
     }
     const legacyBackup = `${file}.backup`;
     try {
@@ -5599,7 +5666,7 @@ Claude configuration file at ${file} is corrupted: ${error.message}
       const currentContent = fs.readFileSync(file, { encoding: "utf-8" });
       for (const backup of existingCorruptedBackups) {
         try {
-          const backupContent = fs.readFileSync(join3(corruptedBackupDir, backup), { encoding: "utf-8" });
+          const backupContent = fs.readFileSync(join4(corruptedBackupDir, backup), { encoding: "utf-8" });
           if (currentContent === backupContent) {
             alreadyBackedUp = true;
             break;
@@ -5607,7 +5674,7 @@ Claude configuration file at ${file} is corrupted: ${error.message}
         } catch {}
       }
       if (!alreadyBackedUp) {
-        corruptedBackupPath = join3(corruptedBackupDir, `${fileBase}.corrupted.${Date.now()}`);
+        corruptedBackupPath = join4(corruptedBackupDir, `${fileBase}.corrupted.${Date.now()}`);
         try {
           fs.copyFileSync(file, corruptedBackupPath);
           logForDebugging(`Corrupted config backed up to: ${corruptedBackupPath}`, {
@@ -5757,13 +5824,13 @@ function getMemoryPath(memoryType) {
   const cwd = getOriginalCwd();
   switch (memoryType) {
     case "User":
-      return join3(getClaudeConfigHomeDir(), "CLAUDE.md");
+      return join4(getClaudeConfigHomeDir(), "CLAUDE.md");
     case "Local":
-      return join3(cwd, "CLAUDE.local.md");
+      return join4(cwd, "CLAUDE.local.md");
     case "Project":
-      return join3(cwd, "CLAUDE.md");
+      return join4(cwd, "CLAUDE.md");
     case "Managed":
-      return join3(getManagedFilePath(), "CLAUDE.md");
+      return join4(getManagedFilePath(), "CLAUDE.md");
     case "AutoMem":
       return getAutoMemEntrypoint();
   }
@@ -5771,10 +5838,10 @@ function getMemoryPath(memoryType) {
   return "";
 }
 function getManagedClaudeRulesDir() {
-  return join3(getManagedFilePath(), ".claude", "rules");
+  return join4(getManagedFilePath(), ".claude", "rules");
 }
 function getUserClaudeRulesDir() {
-  return join3(getClaudeConfigHomeDir(), "rules");
+  return join4(getClaudeConfigHomeDir(), "rules");
 }
 function _setGlobalConfigCacheForTesting(config) {
   globalConfigCache.config = config;
@@ -5886,7 +5953,7 @@ var init_config = __esm(() => {
     if (gitRoot) {
       return normalizePathForConfigKey(gitRoot);
     }
-    return normalizePathForConfigKey(resolve(originalCwd));
+    return normalizePathForConfigKey(resolve2(originalCwd));
   });
   _getConfigForTesting = getConfig;
   _wouldLoseAuthStateForTesting = wouldLoseAuthState;
@@ -5894,7 +5961,7 @@ var init_config = __esm(() => {
 
 // src/utils/userAgent.ts
 function getClaudeCodeUserAgent() {
-  return `claude-code/${"1.0.2"}`;
+  return `claude-code/${"1.0.4"}`;
 }
 var init_userAgent = () => {};
 
@@ -5917,7 +5984,7 @@ function getUserAgent() {
   const clientApp = process.env.CLAUDE_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `claude-cli/${"1.0.2"} (${process.env.USER_TYPE}, ${process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `claude-cli/${"1.0.4"} (${process.env.USER_TYPE}, ${process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -5931,7 +5998,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `claude-code/${"1.0.2"}${suffix}`;
+  return `claude-code/${"1.0.4"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `Claude-User (${getClaudeCodeUserAgent()}; +https://support.anthropic.com/)`;
@@ -6070,7 +6137,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.0.2",
+      appVersion: "1.0.4",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -6671,8 +6738,8 @@ class ExportOperation {
   _exportScheduledPromise;
   _exportScheduledResolve;
   constructor(exporter, logRecords, exportTimeoutMillis) {
-    this._exportScheduledPromise = new Promise((resolve2) => {
-      this._exportScheduledResolve = resolve2;
+    this._exportScheduledPromise = new Promise((resolve3) => {
+      this._exportScheduledResolve = resolve3;
     });
     this._exportCompleted = this._executeExport(exporter, logRecords, exportTimeoutMillis);
   }
@@ -6694,14 +6761,14 @@ class ExportOperation {
     }
   }
   async _exportWithTimeout(exporter, logRecords, exportTimeoutMillis) {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         reject(new Error("Timeout"));
       }, exportTimeoutMillis);
       exporter.export(logRecords, (result) => {
         clearTimeout(timer);
         if (result.code === import_core7.ExportResultCode.SUCCESS) {
-          resolve2();
+          resolve3();
         } else {
           reject(result.error ?? new Error("BatchLogRecordProcessor: log record export failed"));
         }
@@ -9291,14 +9358,14 @@ var init_client = __esm(() => {
 });
 
 // src/utils/model/modelCapabilities.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { mkdir, writeFile } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function getCacheDir() {
-  return join4(getClaudeConfigHomeDir(), "cache");
+  return join5(getClaudeConfigHomeDir(), "cache");
 }
 function getCachePath() {
-  return join4(getCacheDir(), "model-capabilities.json");
+  return join5(getCacheDir(), "model-capabilities.json");
 }
 function isModelCapabilitiesEligible() {
   if (getAPIProvider() !== "firstParty")
@@ -9381,7 +9448,7 @@ var init_modelCapabilities = __esm(() => {
   }));
   loadCache = memoize_default((path) => {
     try {
-      const raw = readFileSync3(path, "utf-8");
+      const raw = readFileSync4(path, "utf-8");
       const parsed = CacheFileSchema().safeParse(safeParseJSON(raw, false));
       return parsed.success ? parsed.data.models : null;
     } catch {
@@ -10275,7 +10342,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.0.2".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.0.4".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -10315,9 +10382,9 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isClaudeCodeAction: isEnvTruthy(process.env.CLAUDE_CODE_ACTION),
       isClaudeAiAuth: isClaudeAISubscriber(),
-      version: "1.0.2",
+      version: "1.0.4",
       versionBase: getVersionBase(),
-      buildTime: "2026-05-21T04:34:14.136Z",
+      buildTime: "2026-05-21T06:48:39.722Z",
       deploymentEnvironment: env.detectDeploymentEnvironment(),
       ...isEnvTruthy(process.env.GITHUB_ACTIONS) && {
         githubEventName: process.env.GITHUB_EVENT_NAME,
@@ -10976,7 +11043,7 @@ function initialize1PEventLogging() {
   const platform = getPlatform();
   const attributes = {
     [import_semantic_conventions2.ATTR_SERVICE_NAME]: "claude-code",
-    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "1.0.2"
+    [import_semantic_conventions2.ATTR_SERVICE_VERSION]: "1.0.4"
   };
   if (platform === "wsl") {
     const wslVersion = getWslVersion();
@@ -11003,7 +11070,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "1.0.2");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.anthropic.claude_code.events", "1.0.4");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -11762,13 +11829,13 @@ import { realpath, stat as stat2 } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import {
   basename as basename2,
-  dirname as dirname3,
+  dirname as dirname4,
   extname as extname2,
   isAbsolute as isAbsolute2,
-  join as join6,
+  join as join7,
   normalize as normalize2,
   relative,
-  resolve as resolve2,
+  resolve as resolve3,
   sep as sep2
 } from "path";
 async function pathExists(path2) {
@@ -11859,10 +11926,10 @@ function getDisplayPath(filePath) {
 function findSimilarFile(filePath) {
   const fs = getFsImplementation();
   try {
-    const dir = dirname3(filePath);
+    const dir = dirname4(filePath);
     const fileBaseName = basename2(filePath, extname2(filePath));
     const files = fs.readdirSync(dir);
-    const similarFiles = files.filter((file) => basename2(file.name, extname2(file.name)) === fileBaseName && join6(dir, file.name) !== filePath);
+    const similarFiles = files.filter((file) => basename2(file.name, extname2(file.name)) === fileBaseName && join7(dir, file.name) !== filePath);
     const firstMatch = similarFiles[0];
     if (firstMatch) {
       return firstMatch.name;
@@ -11877,18 +11944,18 @@ function findSimilarFile(filePath) {
 }
 async function suggestPathUnderCwd(requestedPath) {
   const cwd = getCwd();
-  const cwdParent = dirname3(cwd);
+  const cwdParent = dirname4(cwd);
   let resolvedPath = requestedPath;
   try {
-    const resolvedDir = await realpath(dirname3(requestedPath));
-    resolvedPath = join6(resolvedDir, basename2(requestedPath));
+    const resolvedDir = await realpath(dirname4(requestedPath));
+    resolvedPath = join7(resolvedDir, basename2(requestedPath));
   } catch {}
   const cwdParentPrefix = cwdParent === sep2 ? sep2 : cwdParent + sep2;
   if (!resolvedPath.startsWith(cwdParentPrefix) || resolvedPath.startsWith(cwd + sep2) || resolvedPath === cwd) {
     return;
   }
   const relFromParent = relative(cwdParent, resolvedPath);
-  const correctedPath = join6(cwd, relFromParent);
+  const correctedPath = join7(cwd, relFromParent);
   try {
     await stat2(correctedPath);
     return correctedPath;
@@ -11940,7 +12007,7 @@ function writeFileSyncAndFlush_DEPRECATED(filePath, content, options = { encodin
   let targetPath = filePath;
   try {
     const linkTarget = fs.readlinkSync(filePath);
-    targetPath = isAbsolute2(linkTarget) ? linkTarget : resolve2(dirname3(filePath), linkTarget);
+    targetPath = isAbsolute2(linkTarget) ? linkTarget : resolve3(dirname4(filePath), linkTarget);
     logForDebugging(`Writing through symlink: ${filePath} -> ${targetPath}`);
   } catch {}
   const tempPath = `${targetPath}.tmp.${process.pid}.${Date.now()}`;
@@ -12008,7 +12075,7 @@ function getDesktopPath() {
   const platform = getPlatform();
   const homeDir = homedir2();
   if (platform === "macos") {
-    return join6(homeDir, "Desktop");
+    return join7(homeDir, "Desktop");
   }
   if (platform === "windows") {
     const windowsHome = process.env.USERPROFILE ? process.env.USERPROFILE.replace(/\\/g, "/") : null;
@@ -12026,7 +12093,7 @@ function getDesktopPath() {
         if (user.name === "Public" || user.name === "Default" || user.name === "Default User" || user.name === "All Users") {
           continue;
         }
-        const potentialDesktopPath = join6(usersDir, user.name, "Desktop");
+        const potentialDesktopPath = join7(usersDir, user.name, "Desktop");
         if (getFsImplementation().existsSync(potentialDesktopPath)) {
           return potentialDesktopPath;
         }
@@ -12035,7 +12102,7 @@ function getDesktopPath() {
       logError(error);
     }
   }
-  const desktopPath = join6(homeDir, "Desktop");
+  const desktopPath = join7(homeDir, "Desktop");
   if (getFsImplementation().existsSync(desktopPath)) {
     return desktopPath;
   }
@@ -12079,7 +12146,7 @@ var init_file = __esm(() => {
 // src/utils/git/gitignore.ts
 import { appendFile as appendFile2, mkdir as mkdir3, readFile, writeFile as writeFile3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 async function isPathGitignored(filePath, cwd) {
   const { code } = await execFileNoThrowWithCwd("git", ["check-ignore", filePath], {
     preserveOutputOnError: false,
@@ -12088,7 +12155,7 @@ async function isPathGitignored(filePath, cwd) {
   return code === 0;
 }
 function getGlobalGitignorePath() {
-  return join7(homedir3(), ".config", "git", "ignore");
+  return join8(homedir3(), ".config", "git", "ignore");
 }
 async function addFileGlobRuleToGitignore(filename, cwd = getCwd()) {
   try {
@@ -12101,7 +12168,7 @@ async function addFileGlobRuleToGitignore(filename, cwd = getCwd()) {
       return;
     }
     const globalGitignorePath = getGlobalGitignorePath();
-    const configGitDir = dirname4(globalGitignorePath);
+    const configGitDir = dirname5(globalGitignorePath);
     await mkdir3(configGitDir, { recursive: true });
     try {
       const content = await readFile(globalGitignorePath, { encoding: "utf-8" });
@@ -13757,7 +13824,7 @@ var init_validation2 = __esm(() => {
 
 // src/utils/settings/mdm/constants.ts
 import { homedir as homedir4, userInfo } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function getMacOSPlistPaths() {
   let username = "";
   try {
@@ -13776,7 +13843,7 @@ function getMacOSPlistPaths() {
   });
   if (process.env.USER_TYPE === "ant") {
     paths.push({
-      path: join8(homedir4(), "Library", "Preferences", `${MACOS_PREFERENCE_DOMAIN}.plist`),
+      path: join9(homedir4(), "Library", "Preferences", `${MACOS_PREFERENCE_DOMAIN}.plist`),
       label: "user preferences (ant-only)"
     });
   }
@@ -13789,11 +13856,11 @@ var init_constants4 = __esm(() => {
 
 // src/utils/settings/mdm/rawRead.ts
 import { execFile } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 function execFilePromise(cmd, args) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     execFile(cmd, args, { encoding: "utf-8", timeout: MDM_SUBPROCESS_TIMEOUT_MS }, (err, stdout) => {
-      resolve3({ stdout: stdout ?? "", code: err ? 1 : 0 });
+      resolve4({ stdout: stdout ?? "", code: err ? 1 : 0 });
     });
   });
 }
@@ -13802,7 +13869,7 @@ function fireRawRead() {
     if (process.platform === "darwin") {
       const plistPaths = getMacOSPlistPaths();
       const allResults = await Promise.all(plistPaths.map(async ({ path: path2, label }) => {
-        if (!existsSync2(path2)) {
+        if (!existsSync3(path2)) {
           return { stdout: "", label, ok: false };
         }
         const { stdout, code } = await execFilePromise(PLUTIL_PATH, [
@@ -13856,7 +13923,7 @@ var init_rawRead = __esm(() => {
 });
 
 // src/utils/settings/mdm/settings.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function startMdmSettingsLoad() {
   if (mdmLoadPromise)
     return;
@@ -13958,7 +14025,7 @@ function consumeRawReadResult(raw) {
 }
 function hasManagedSettingsFile() {
   try {
-    const filePath = join9(getManagedFilePath(), "managed-settings.json");
+    const filePath = join10(getManagedFilePath(), "managed-settings.json");
     const content = readFileSync(filePath);
     const data = safeParseJSON(content, false);
     if (data && typeof data === "object" && Object.keys(data).length > 0) {
@@ -13973,7 +14040,7 @@ function hasManagedSettingsFile() {
         continue;
       }
       try {
-        const content = readFileSync(join9(dropInDir, d.name));
+        const content = readFileSync(join10(dropInDir, d.name));
         const data = safeParseJSON(content, false);
         if (data && typeof data === "object" && Object.keys(data).length > 0) {
           return true;
@@ -14000,9 +14067,9 @@ var init_settings = __esm(() => {
 });
 
 // src/utils/settings/settings.ts
-import { dirname as dirname5, join as join10, resolve as resolve3 } from "path";
+import { dirname as dirname6, join as join11, resolve as resolve4 } from "path";
 function getManagedSettingsFilePath() {
-  return join10(getManagedFilePath(), "managed-settings.json");
+  return join11(getManagedFilePath(), "managed-settings.json");
 }
 function loadManagedFileSettings() {
   const errors = [];
@@ -14018,7 +14085,7 @@ function loadManagedFileSettings() {
   try {
     const entries = getFsImplementation().readdirSync(dropInDir).filter((d) => (d.isFile() || d.isSymbolicLink()) && d.name.endsWith(".json") && !d.name.startsWith(".")).map((d) => d.name).sort();
     for (const name of entries) {
-      const { settings: settings2, errors: fileErrors } = parseSettingsFile(join10(dropInDir, name));
+      const { settings: settings2, errors: fileErrors } = parseSettingsFile(join11(dropInDir, name));
       errors.push(...fileErrors);
       if (settings2 && Object.keys(settings2).length > 0) {
         merged = mergeWith_default(merged, settings2, settingsMergeCustomizer);
@@ -14088,15 +14155,15 @@ function parseSettingsFileUncached(path2) {
 function getSettingsRootPathForSource(source) {
   switch (source) {
     case "userSettings":
-      return resolve3(getRedScopeConfigHomeDir());
+      return resolve4(getRedScopeConfigHomeDir());
     case "policySettings":
     case "projectSettings":
     case "localSettings": {
-      return resolve3(getOriginalCwd());
+      return resolve4(getOriginalCwd());
     }
     case "flagSettings": {
       const path2 = getFlagSettingsPath();
-      return path2 ? dirname5(resolve3(path2)) : resolve3(getOriginalCwd());
+      return path2 ? dirname6(resolve4(path2)) : resolve4(getOriginalCwd());
     }
   }
 }
@@ -14109,10 +14176,10 @@ function getUserSettingsFilePath() {
 function getSettingsFilePathForSource(source) {
   switch (source) {
     case "userSettings":
-      return join10(getSettingsRootPathForSource(source), getUserSettingsFilePath());
+      return join11(getSettingsRootPathForSource(source), getUserSettingsFilePath());
     case "projectSettings":
     case "localSettings": {
-      return join10(getSettingsRootPathForSource(source), getRelativeSettingsFilePathForSource(source));
+      return join11(getSettingsRootPathForSource(source), getRelativeSettingsFilePathForSource(source));
     }
     case "policySettings":
       return getManagedSettingsFilePath();
@@ -14124,12 +14191,12 @@ function getSettingsFilePathForSource(source) {
 function getSettingsFilePathsForSource(source) {
   switch (source) {
     case "userSettings": {
-      const redscopePath = join10(getRedScopeConfigHomeDir(), getUserSettingsFilePath());
+      const redscopePath = join11(getRedScopeConfigHomeDir(), getUserSettingsFilePath());
       if (!isLegacyClaudeSettingsCompatibilityEnabled()) {
         return [redscopePath];
       }
       return uniquePaths([
-        join10(getLegacyClaudeConfigHomeDir(), getUserSettingsFilePath()),
+        join11(getLegacyClaudeConfigHomeDir(), getUserSettingsFilePath()),
         redscopePath
       ]);
     }
@@ -14137,12 +14204,12 @@ function getSettingsFilePathsForSource(source) {
     case "localSettings": {
       const filename = source === "projectSettings" ? "settings.json" : "settings.local.json";
       const root = getSettingsRootPathForSource(source);
-      const redscopePath = join10(root, REDSCOPE_CONFIG_DIR, filename);
+      const redscopePath = join11(root, REDSCOPE_CONFIG_DIR, filename);
       if (!isLegacyClaudeSettingsCompatibilityEnabled()) {
         return [redscopePath];
       }
       return uniquePaths([
-        join10(root, CLAUDE_CONFIG_DIR, filename),
+        join11(root, CLAUDE_CONFIG_DIR, filename),
         redscopePath
       ]);
     }
@@ -14173,9 +14240,9 @@ function readLegacyClaudeSettingsCompatibilityFlag(filePath) {
 function getRedScopeSettingsCompatibilityFiles() {
   const root = getSettingsRootPathForSource("projectSettings");
   return uniquePaths([
-    join10(getRedScopeConfigHomeDir(), getUserSettingsFilePath()),
-    join10(root, REDSCOPE_CONFIG_DIR, "settings.json"),
-    join10(root, REDSCOPE_CONFIG_DIR, "settings.local.json")
+    join11(getRedScopeConfigHomeDir(), getUserSettingsFilePath()),
+    join11(root, REDSCOPE_CONFIG_DIR, "settings.json"),
+    join11(root, REDSCOPE_CONFIG_DIR, "settings.local.json")
   ]);
 }
 function isLegacyClaudeSettingsCompatibilityEnabled() {
@@ -14232,9 +14299,9 @@ function setLegacyClaudeSettingsCompatibility(enabled, scope = "user") {
 function getRelativeSettingsFilePathForSource(source) {
   switch (source) {
     case "projectSettings":
-      return join10(".redscope", "settings.json");
+      return join11(".redscope", "settings.json");
     case "localSettings":
-      return join10(".redscope", "settings.local.json");
+      return join11(".redscope", "settings.local.json");
   }
 }
 function getSettingsForSource(source) {
@@ -14319,7 +14386,7 @@ function updateSettingsForSource(source, settings) {
     return { error: null };
   }
   try {
-    getFsImplementation().mkdirSync(dirname5(filePath));
+    getFsImplementation().mkdirSync(dirname6(filePath));
     let existingSettings = getSettingsForSourceUncached(source);
     if (!existingSettings) {
       let content = null;
@@ -14500,7 +14567,7 @@ function loadSettingsFromDisk() {
         continue;
       }
       for (const filePath of getSettingsFilePathsForSource(source)) {
-        const resolvedPath = resolve3(filePath);
+        const resolvedPath = resolve4(filePath);
         if (!seenFiles.has(resolvedPath)) {
           seenFiles.add(resolvedPath);
           const { settings, errors } = parseSettingsFile(filePath);
@@ -15126,14 +15193,14 @@ var init_getOauthProfile = __esm(() => {
 });
 
 // src/utils/authFileDescriptor.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 function maybePersistTokenForSubprocesses(path2, token, tokenName) {
   if (!isEnvTruthy(process.env.CLAUDE_CODE_REMOTE)) {
     return;
   }
   try {
-    mkdirSync2(CCR_TOKEN_DIR, { recursive: true, mode: 448 });
-    writeFileSync2(path2, token, { encoding: "utf8", mode: 384 });
+    mkdirSync3(CCR_TOKEN_DIR, { recursive: true, mode: 448 });
+    writeFileSync3(path2, token, { encoding: "utf8", mode: 384 });
     logForDebugging(`Persisted ${tokenName} to ${path2} for subprocess access`);
   } catch (error) {
     logForDebugging(`Failed to persist ${tokenName} to disk (non-fatal): ${errorMessage(error)}`, { level: "error" });
@@ -15579,11 +15646,11 @@ var init_macOsKeychainStorage = __esm(() => {
 
 // src/utils/secureStorage/plainTextStorage.ts
 import { chmodSync as chmodSync2 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function getStoragePath() {
   const storageDir = getClaudeConfigHomeDir();
   const storageFileName = ".credentials.json";
-  return { storageDir, storagePath: join11(storageDir, storageFileName) };
+  return { storageDir, storagePath: join12(storageDir, storageFileName) };
 }
 var plainTextStorage;
 var init_plainTextStorage = __esm(() => {
@@ -15671,9 +15738,9 @@ var init_secureStorage = __esm(() => {
 // src/utils/secureStorage/keychainPrefetch.ts
 import { execFile as execFile2 } from "child_process";
 function spawnSecurity(serviceName) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     execFile2("security", ["find-generic-password", "-a", getUsername(), "-w", "-s", serviceName], { encoding: "utf-8", timeout: KEYCHAIN_PREFETCH_TIMEOUT_MS }, (err, stdout) => {
-      resolve4({
+      resolve5({
         stdout: err ? null : stdout?.trim() || null,
         timedOut: Boolean(err && "killed" in err && err.killed)
       });
@@ -15780,7 +15847,7 @@ __export(exports_auth, {
 });
 import { exec } from "child_process";
 import { mkdir as mkdir4, stat as stat3 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 function isManagedOAuthContext() {
   return isEnvTruthy(process.env.CLAUDE_CODE_REMOTE) || process.env.CLAUDE_CODE_ENTRYPOINT === "claude-desktop";
 }
@@ -16105,7 +16172,7 @@ function refreshAwsAuth(awsAuthRefresh) {
   logForDebugging("Running AWS auth refresh command");
   const authStatusManager = AwsAuthStatusManager.getInstance();
   authStatusManager.startAuthentication();
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const refreshProc = exec(awsAuthRefresh, {
       timeout: AWS_AUTH_REFRESH_TIMEOUT_MS
     });
@@ -16127,13 +16194,13 @@ function refreshAwsAuth(awsAuthRefresh) {
       if (code === 0) {
         logForDebugging("AWS auth refresh completed successfully");
         authStatusManager.endAuthentication(true);
-        resolve4(true);
+        resolve5(true);
       } else {
         const timedOut = signal === "SIGTERM";
         const message = timedOut ? source_default.red("AWS auth refresh timed out after 3 minutes. Run your auth command manually in a separate terminal.") : source_default.red("Error running awsAuthRefresh (in settings or ~/.claude.json):");
         console.error(message);
         authStatusManager.endAuthentication(false);
-        resolve4(false);
+        resolve5(false);
       }
     });
   });
@@ -16251,7 +16318,7 @@ function refreshGcpAuth(gcpAuthRefresh) {
   logForDebugging("Running GCP auth refresh command");
   const authStatusManager = AwsAuthStatusManager.getInstance();
   authStatusManager.startAuthentication();
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const refreshProc = exec(gcpAuthRefresh, {
       timeout: GCP_AUTH_REFRESH_TIMEOUT_MS
     });
@@ -16273,13 +16340,13 @@ function refreshGcpAuth(gcpAuthRefresh) {
       if (code === 0) {
         logForDebugging("GCP auth refresh completed successfully");
         authStatusManager.endAuthentication(true);
-        resolve4(true);
+        resolve5(true);
       } else {
         const timedOut = signal === "SIGTERM";
         const message = timedOut ? source_default.red("GCP auth refresh timed out after 3 minutes. Run your auth command manually in a separate terminal.") : source_default.red("Error running gcpAuthRefresh (in settings or ~/.claude.json):");
         console.error(message);
         authStatusManager.endAuthentication(false);
-        resolve4(false);
+        resolve5(false);
       }
     });
   });
@@ -16431,7 +16498,7 @@ function clearOAuthTokenCache() {
 }
 async function invalidateOAuthCacheIfDiskChanged() {
   try {
-    const { mtimeMs } = await stat3(join12(getClaudeConfigHomeDir(), ".credentials.json"));
+    const { mtimeMs } = await stat3(join13(getClaudeConfigHomeDir(), ".credentials.json"));
     if (mtimeMs !== lastCredentialsMtimeMs) {
       lastCredentialsMtimeMs = mtimeMs;
       clearOAuthTokenCache();