@bahulam/code 2.6.14 → 2.6.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bahulam/code",
-  "version": "2.6.14",
+  "version": "2.6.15",
   "description": "Bahulam Code \u2014 abundance, in your terminal. CLI-first, reliability-first, sub-agents, 65.6% SWE-bench Verified.",
   "type": "module",
   "bin": {
@@ -49,8 +49,8 @@
     "web-tree-sitter": "^0.26.9"
   },
   "optionalDependencies": {
-    "@bahulam/runtime-darwin-arm64": "2.6.14",
-    "@bahulam/runtime-linux-x64": "2.6.14",
-    "@bahulam/runtime-win32-x64": "2.6.14"
+    "@bahulam/runtime-darwin-arm64": "2.6.15",
+    "@bahulam/runtime-linux-x64": "2.6.15",
+    "@bahulam/runtime-win32-x64": "2.6.15"
   }
 }

package/src/core/approval-log.mjs

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { isSensitiveConfigPath } from './safety.mjs';
 
 const REDACTED = 'REDACTED';
 const MAX_ARG_LOG_CHARS = 4000;
@@ -53,10 +54,32 @@ function sanitizeForLog(value, depth = 0) {
 function safeArgs(args) {
   if (args?.command) return redactSensitive(String(args.command)).slice(0, MAX_ARG_LOG_CHARS);
   if (args?.file_path || args?.path) return redactSensitive(String(args.file_path || args.path)).slice(0, MAX_ARG_LOG_CHARS);
+  if (Array.isArray(args?.files)) {
+    try {
+      const { files, ...rest } = args;
+      return JSON.stringify({
+        ...sanitizeForLog(rest),
+        files: files.slice(0, 100).map(file => sanitizeProjectFileArg(file)),
+      }).slice(0, MAX_ARG_LOG_CHARS);
+    } catch {
+      return '[files omitted]';
+    }
+  }
   try { return JSON.stringify(sanitizeForLog(args || {})).slice(0, MAX_ARG_LOG_CHARS); }
   catch { return redactSensitive(String(args || '')).slice(0, MAX_ARG_LOG_CHARS); }
 }
 
+function sanitizeProjectFileArg(file) {
+  if (typeof file === 'string') return redactSensitive(file);
+  if (!file || typeof file !== 'object') return sanitizeForLog(file);
+  const out = sanitizeForLog(file);
+  const filePath = file.path || file.file_path || '';
+  if (isSensitiveConfigPath(filePath) && typeof out.content === 'string') {
+    out.content = '[redacted sensitive config]';
+  }
+  return out;
+}
+
 function safeText(value, max = 500) {
   if (!value) return undefined;
   return redactSensitive(String(value)).slice(0, max);

package/src/core/approval.mjs

@@ -25,7 +25,7 @@ import {
   defaultOptions as approvalOptions,
 } from '../ui/approval.mjs';
 import { clearInputPrompt, isInputDockMounted, moveToContent, renderDockOverlay } from '../ui/input-dock.mjs';
-import { validateShellCommand } from './safety.mjs';
+import { isApprovalRequiredWritePath, isSensitiveConfigPath, validateShellCommand } from './safety.mjs';
 import { classifyCommand } from '../permissions/command-classifier.mjs';
 import { ApprovalLog } from './approval-log.mjs';
 import { TrustStore } from './trust.mjs';
@@ -46,9 +46,19 @@ const WRITE_TOOLS = new Set([
 
 function defaultWhy(tier, tool, args) {
     const subject = approvalSummary(tool, args);
+    const protectedTarget = protectedWriteTarget(tool, args);
+    if (protectedTarget) {
+        const target = protectedTarget.path;
+        if (protectedTarget.sensitive) {
+            return `Edits sensitive environment config (${target}). Confirm before writing; values stay redacted in summaries and diffs.`;
+        }
+        return `Edits protected project file (${subject || target}). Confirm before writing.`;
+    }
     switch (tier) {
         case TIERS.SENSITIVE_READ:
             return `Reads a sensitive path (${subject || 'secret-like file'}). Confirm before exposing its contents to the agent.`;
+        case TIERS.PROTECTED_EDIT:
+            return `Edits a protected project file. Confirm before writing.`;
         case TIERS.SHELL_DANGEROUS:
             return `Shell command matches a high-risk pattern (rm -rf, sudo, force push, etc.). Confirm before running.`;
         case TIERS.DESTRUCTIVE:
@@ -62,6 +72,26 @@ function defaultWhy(tier, tool, args) {
     }
 }
 
+function protectedWriteTarget(tool, args = {}) {
+    const paths = writeTargetPaths(tool, args);
+    const path = paths.find(isApprovalRequiredWritePath);
+    if (!path) return null;
+    return { path, sensitive: isSensitiveConfigPath(path) };
+}
+
+function writeTargetPaths(tool, args = {}) {
+    const key = String(tool || '').toLowerCase();
+    if (key === 'write_file' || key === 'edit_file') {
+        return [args.file_path || args.path].filter(Boolean);
+    }
+    if (key === 'write_project') {
+        return (args.files || [])
+            .map(file => typeof file === 'string' ? file : file?.path || file?.file_path)
+            .filter(Boolean);
+    }
+    return [];
+}
+
 function approvalSummary(tool, args = {}) {
     const summary = toolDisplaySummary(tool, args);
     if (tool !== 'shell') return summary;
@@ -118,6 +148,8 @@ export class ApprovalManager {
         this.history = [];
         this.rejectionHints = [];
         this._rl = null;
+        this._approvalPromptActive = false;
+        this._approvalPromptWasRaw = false;
     }
 
     setReadline(rl) { this._rl = rl; }
@@ -128,6 +160,29 @@ export class ApprovalManager {
         this._approvalPromptEnd = onApprovalPromptEnd || null;
     }
 
+    _beginApprovalInput() {
+        if (this._approvalPromptActive || !process.stdin.isTTY) return false;
+        this._approvalPromptActive = true;
+        this._approvalPromptWasRaw = process.stdin.isRaw;
+        if (this._execPause) this._execPause();
+        if (this._rl) this._rl.pause();
+        if (typeof process.stdin.setRawMode === 'function') {
+            process.stdin.setRawMode(true);
+        }
+        process.stdin.resume();
+        return true;
+    }
+
+    _endApprovalInput() {
+        if (!this._approvalPromptActive) return;
+        if (typeof process.stdin.setRawMode === 'function') {
+            process.stdin.setRawMode(this._approvalPromptWasRaw || false);
+        }
+        if (this._rl) this._rl.resume();
+        if (this._execResume) this._execResume();
+        this._approvalPromptActive = false;
+    }
+
     revoke() {
         const wasActive = this.approveAll || this.approvedToolTypes.size > 0;
         this.approveAll = false;
@@ -275,6 +330,9 @@ export class ApprovalManager {
             printedHeight = block.split('\n').length;
         };
 
+        const ownsApprovalInput = isInteractive ? this._beginApprovalInput() : false;
+
+        try {
         if (isInteractive) drawPrompt();
 
         // ── Input loop ─────────────────────────────────────────────────
@@ -334,7 +392,7 @@ export class ApprovalManager {
                 return { approved: true, tier };
 
             case 'allow-session': {
-                if (!this.policy.hitl?.allowSessionTrust) return this._prompt(toolName, args, context);
+                if (!this.policy.hitl?.allowSessionTrust) return await this._prompt(toolName, args, context);
                 const rule = this.trustStore.add({ tool: toolName, args, tier, scope: 'SESSION' });
                 write(`  ${GREEN}✓${RST}  ${DIM}trusted for this session: ${rule.pattern}${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'session-trust', tier, time: Date.now(), rule_id: rule.id });
@@ -343,7 +401,7 @@ export class ApprovalManager {
             }
 
             case 'allow-project': {
-                if (!this.policy.hitl?.allowProjectTrust) return this._prompt(toolName, args, context);
+                if (!this.policy.hitl?.allowProjectTrust) return await this._prompt(toolName, args, context);
                 const rule = this.trustStore.add({ tool: toolName, args, tier, scope: 'PROJECT' });
                 write(`  ${GREEN}✓${RST}  ${DIM}trusted for this project: ${rule.pattern}${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'project-trust', tier, time: Date.now(), rule_id: rule.id });
@@ -362,7 +420,7 @@ export class ApprovalManager {
             }
 
             case 'allow-all':
-                if (requiresExplicitApproval(tier)) return this._prompt(toolName, args, context);
+                if (requiresExplicitApproval(tier)) return await this._prompt(toolName, args, context);
                 this.approveAll = true;
                 write(`  ${GREEN}✓✓${RST} ${DIM}allow-all activated${RST}\n\n`);
                 this.history.push({ tool: toolName, decision: 'approve-all', tier, time: Date.now() });
@@ -370,7 +428,7 @@ export class ApprovalManager {
                 return { approved: true, tier };
 
             case 'allow-type':
-                if (requiresExplicitApproval(tier)) return this._prompt(toolName, args, context);
+                if (requiresExplicitApproval(tier)) return await this._prompt(toolName, args, context);
                 this.approvedToolTypes.add(toolName);
                 this.history.push({ tool: toolName, decision: 'type-approve', tier, time: Date.now() });
                 this.approvalLog.append({ tool: toolName, args, tier, decision: 'type-approve', scope: 'session', prompt });
@@ -380,7 +438,7 @@ export class ApprovalManager {
             case 'why':
                 write(`\n  ${DIM}${(context.reason || why).slice(0, 400)}${RST}\n\n`);
                 printedHeight = 0;
-                return this._prompt(toolName, args, context);
+                return await this._prompt(toolName, args, context);
 
             case 'edit':
             case 'replan':
@@ -395,7 +453,10 @@ export class ApprovalManager {
             }
 
             default:
-                return this._prompt(toolName, args, context);
+                return await this._prompt(toolName, args, context);
+        }
+        } finally {
+            if (ownsApprovalInput) this._endApprovalInput();
         }
     }
 
@@ -406,16 +467,25 @@ export class ApprovalManager {
                 return;
             }
 
-            if (this._execPause) this._execPause();
-            if (this._rl) this._rl.pause();
+            const managesInput = !this._approvalPromptActive;
+            if (managesInput) {
+                if (this._execPause) this._execPause();
+                if (this._rl) this._rl.pause();
+            }
 
             const wasRaw = process.stdin.isRaw;
-            process.stdin.setRawMode(true);
+            if (managesInput && typeof process.stdin.setRawMode === 'function') {
+                process.stdin.setRawMode(true);
+            }
             process.stdin.resume();
             process.stdin.once('data', (data) => {
-                process.stdin.setRawMode(wasRaw || false);
-                if (this._rl) this._rl.resume();
-                if (this._execResume) this._execResume();
+                if (managesInput) {
+                    if (typeof process.stdin.setRawMode === 'function') {
+                        process.stdin.setRawMode(wasRaw || false);
+                    }
+                    if (this._rl) this._rl.resume();
+                    if (this._execResume) this._execResume();
+                }
 
                 const bytes = [...data];
                 const str = data.toString();
@@ -444,8 +514,11 @@ export class ApprovalManager {
                 return;
             }
 
-            if (this._execPause) this._execPause();
-            if (this._rl) this._rl.pause();
+            const managesInput = !this._approvalPromptActive;
+            if (managesInput) {
+                if (this._execPause) this._execPause();
+                if (this._rl) this._rl.pause();
+            }
 
             const wasRaw = process.stdin.isRaw;
             if (typeof process.stdin.setRawMode === 'function') {
@@ -460,8 +533,10 @@ export class ApprovalManager {
                 if (typeof process.stdin.setRawMode === 'function') {
                     process.stdin.setRawMode(wasRaw || false);
                 }
-                if (this._rl) this._rl.resume();
-                if (this._execResume) this._execResume();
+                if (managesInput) {
+                    if (this._rl) this._rl.resume();
+                    if (this._execResume) this._execResume();
+                }
             };
             const finish = () => {
                 cleanup();
@@ -535,6 +610,7 @@ function promptForLog(tool, args, tier, why) {
 function approvalTitleForLog(tier) {
     switch (tier) {
         case TIERS.SENSITIVE_READ:
+        case TIERS.PROTECTED_EDIT:
         case TIERS.SHELL_DANGEROUS:
         case TIERS.DESTRUCTIVE:
             return 'EXPLICIT APPROVAL';

package/src/core/file-diff.mjs

@@ -8,7 +8,7 @@ export function buildFileDiff({
   after = '',
   cwd = process.cwd(),
   context = 3,
-  maxDiffLines = 400,
+  maxDiffLines = Infinity,
 } = {}) {
   const oldText = before == null ? '' : String(before);
   const newText = after == null ? '' : String(after);

package/src/core/risk-tier.mjs

@@ -14,12 +14,15 @@
  * intent can't be hidden behind a friendly description.
  */
 
+import { isApprovalRequiredWritePath, isSensitiveConfigPath } from './safety.mjs';
+
 // ── Tier enum ────────────────────────────────────────────────────────────
 
 export const TIERS = Object.freeze({
   READ:            'read',
   SENSITIVE_READ:  'sensitive-read',
   LOCAL_EDIT:      'local-edit',
+  PROTECTED_EDIT:  'protected-edit',
   SHELL_SAFE:      'shell-safe',
   SHELL_MEDIUM:    'shell-medium',
   SHELL_DANGEROUS: 'shell-dangerous',
@@ -38,6 +41,7 @@ export const BEHAVIOR = Object.freeze({
   [TIERS.READ]:            'auto',
   [TIERS.SENSITIVE_READ]:  'prompt-explicit',
   [TIERS.LOCAL_EDIT]:      'auto-with-undo',
+  [TIERS.PROTECTED_EDIT]:  'prompt-explicit',
   [TIERS.SHELL_SAFE]:      'auto',
   [TIERS.SHELL_MEDIUM]:    'prompt-safe',
   [TIERS.SHELL_DANGEROUS]: 'prompt-explicit',
@@ -77,6 +81,14 @@ const LOCAL_EDIT_TOOLS = new Set([
   'workflow_create_multi', 'workflow_sync_multi',
 ]);
 
+const WRITE_PATH_KEYS = [
+  'path', 'file_path', 'file', 'target',
+];
+
+const WRITE_PATH_ARRAY_KEYS = [
+  'paths', 'file_paths', 'targets',
+];
+
 const DESTRUCTIVE_TOOLS = new Set([
   'delete_file', 'skill_remove',
 ]);
@@ -219,6 +231,7 @@ const TIER_ORDER = [
   TIERS.SENSITIVE_READ,
   TIERS.SHELL_SAFE,
   TIERS.LOCAL_EDIT,
+  TIERS.PROTECTED_EDIT,
   TIERS.NETWORK,
   TIERS.SHELL_MEDIUM,
   TIERS.DESTRUCTIVE,
@@ -243,7 +256,9 @@ export function classify(tool, args = {}) {
   if (READ_TOOLS.has(tool)) {
     return isSensitiveRead(args) ? TIERS.SENSITIVE_READ : TIERS.READ;
   }
-  if (LOCAL_EDIT_TOOLS.has(tool))  return TIERS.LOCAL_EDIT;
+  if (LOCAL_EDIT_TOOLS.has(tool)) {
+    return isApprovalRequiredWrite(args) ? TIERS.PROTECTED_EDIT : TIERS.LOCAL_EDIT;
+  }
   if (DESTRUCTIVE_TOOLS.has(tool)) return TIERS.DESTRUCTIVE;
   if (NETWORK_TOOLS.has(tool))     return TIERS.NETWORK;
 
@@ -273,6 +288,7 @@ export function label(tier) {
     case TIERS.READ:            return 'READ';
     case TIERS.SENSITIVE_READ:  return 'SENSITIVE-READ';
     case TIERS.LOCAL_EDIT:      return 'LOCAL-EDIT';
+    case TIERS.PROTECTED_EDIT:  return 'PROTECTED-EDIT';
     case TIERS.SHELL_SAFE:      return 'SHELL-SAFE';
     case TIERS.SHELL_MEDIUM:    return 'SHELL-MEDIUM';
     case TIERS.SHELL_DANGEROUS: return 'SHELL-DANGEROUS';
@@ -310,11 +326,15 @@ export function isSensitiveReadPath(filePath = '') {
 
   const parts = normalized.split('/').filter(Boolean);
   const base = parts[parts.length - 1] || normalized;
-  if (base === '.env') return true;
+  if (isSensitiveConfigPath(base)) return true;
   if (/\.pem$/i.test(base)) return true;
   return parts.includes('secrets');
 }
 
+export function isApprovalRequiredWrite(args = {}) {
+  return extractWritePaths(args).some(isApprovalRequiredWritePath);
+}
+
 function extractReadPaths(args = {}) {
   const paths = [];
   for (const key of READ_PATH_KEYS) {
@@ -335,3 +355,34 @@ function extractReadPaths(args = {}) {
   }
   return paths;
 }
+
+function extractWritePaths(args = {}) {
+  const paths = [];
+  for (const key of WRITE_PATH_KEYS) {
+    if (typeof args[key] === 'string') paths.push(args[key]);
+  }
+  for (const key of WRITE_PATH_ARRAY_KEYS) {
+    const value = args[key];
+    if (!Array.isArray(value)) continue;
+    for (const item of value) {
+      if (typeof item === 'string') {
+        paths.push(item);
+      } else if (item && typeof item === 'object') {
+        for (const nestedKey of WRITE_PATH_KEYS) {
+          if (typeof item[nestedKey] === 'string') paths.push(item[nestedKey]);
+        }
+      }
+    }
+  }
+  if (Array.isArray(args.files)) {
+    for (const item of args.files) {
+      if (typeof item === 'string') paths.push(item);
+      else if (item && typeof item === 'object') {
+        for (const nestedKey of WRITE_PATH_KEYS) {
+          if (typeof item[nestedKey] === 'string') paths.push(item[nestedKey]);
+        }
+      }
+    }
+  }
+  return paths;
+}

package/src/core/safety.mjs

@@ -28,6 +28,18 @@ const PROTECTED_NAMES = new Set([
   'go.sum',
 ]);
 
+const APPROVAL_REQUIRED_WRITE_NAMES = new Set([
+  '.env',
+  '.env.local',
+  '.env.production',
+  'package.json',
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  'Cargo.lock',
+  'go.sum',
+]);
+
 /** Directory names that indicate a source root — never delete the dir itself. */
 const SOURCE_DIRS = new Set([
   'src',
@@ -80,13 +92,35 @@ const HIGH_RISK_COMMANDS = [
 
 // ── Validation Functions ─────────────────────────────────────
 
+function basenameFor(filePath = '') {
+  return path.basename(String(filePath || '').replace(/\\/g, '/'));
+}
+
+function isEnvLikeName(name = '') {
+  return /^\.env(?:\.|$)/.test(String(name || ''));
+}
+
+function isProtectedName(name = '') {
+  return PROTECTED_NAMES.has(name) || isEnvLikeName(name);
+}
+
+export function isSensitiveConfigPath(filePath = '') {
+  return isEnvLikeName(basenameFor(filePath));
+}
+
+export function isApprovalRequiredWritePath(filePath = '') {
+  const basename = basenameFor(filePath);
+  return isSensitiveConfigPath(filePath) || APPROVAL_REQUIRED_WRITE_NAMES.has(basename);
+}
+
 /**
  * Check if a path is protected (should not be deleted/overwritten entirely).
  * @param {string} filePath - Absolute path
  * @param {string} cwd - Current working directory
- * @returns {{ safe: boolean, reason?: string }}
+ * @param {{ allowApprovalRequiredWrite?: boolean }} options
+ * @returns {{ safe: boolean, reason?: string, requiresApproval?: boolean, sensitive?: boolean, protected?: boolean }}
  */
-export function validatePath(filePath, cwd = process.cwd()) {
+export function validatePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return { safe: false, reason: 'Empty path' };
 
   const resolved = path.resolve(cwd, filePath);
@@ -100,7 +134,16 @@ export function validatePath(filePath, cwd = process.cwd()) {
   }
 
   // Block protected file names at any level
-  if (PROTECTED_NAMES.has(basename) && !resolved.includes('node_modules/')) {
+  if (isProtectedName(basename) && !resolved.includes('node_modules/')) {
+    if (options.allowApprovalRequiredWrite && isApprovalRequiredWritePath(resolved)) {
+      return {
+        safe: true,
+        reason: `Approval required for protected path: ${basename}`,
+        requiresApproval: true,
+        protected: true,
+        sensitive: isSensitiveConfigPath(resolved),
+      };
+    }
     return { safe: false, reason: `Protected path: ${basename}` };
   }
 
@@ -172,16 +215,29 @@ export function validateShellCommand(command) {
  * @returns {{ safe: boolean, reason?: string }}
  */
 export function validateWrite(filePath, content, cwd = process.cwd()) {
-  const pathCheck = validatePath(filePath, cwd);
+  const pathCheck = validatePath(filePath, cwd, { allowApprovalRequiredWrite: true });
   if (!pathCheck.safe) return pathCheck;
 
   const resolved = path.resolve(cwd, filePath);
+  const basename = path.basename(resolved);
 
   // Don't allow overwriting .git internals
   if (resolved.includes('/.git/')) {
     return { safe: false, reason: 'Cannot write to .git directory' };
   }
 
+  if (pathCheck.requiresApproval) {
+    return {
+      safe: true,
+      reason: pathCheck.sensitive
+        ? `Sensitive config write requires approval: ${basename}`
+        : `Protected file write requires approval: ${basename}`,
+      requiresApproval: true,
+      protected: true,
+      sensitive: pathCheck.sensitive,
+    };
+  }
+
   // Warn if writing a very large file (> 1MB)
   if (content && content.length > 1_000_000) {
     return { safe: true, reason: `Large file write: ${(content.length / 1024).toFixed(0)}KB` };
@@ -196,6 +252,7 @@ export function validateWrite(filePath, content, cwd = process.cwd()) {
 export function getSafetyRules() {
   return {
     protectedNames: [...PROTECTED_NAMES],
+    approvalRequiredWriteNames: [...APPROVAL_REQUIRED_WRITE_NAMES],
     sourceDirs: [...SOURCE_DIRS],
     blockedPatterns: DANGEROUS_SHELL_PATTERNS.length,
     highRiskPatterns: HIGH_RISK_COMMANDS.length,

package/src/core/tool-executor.mjs

@@ -10,7 +10,7 @@
 
 import { createToolRegistry } from '../tools/registry.mjs';
 import { detectCommandType, filterOutput } from './output-filter.mjs';
-import { validatePath, validateDelete, validateShellCommand, validateWrite } from './safety.mjs';
+import { isSensitiveConfigPath, validatePath, validateDelete, validateShellCommand, validateWrite } from './safety.mjs';
 import { classifyCommand, isExitCodeError } from '../permissions/command-classifier.mjs';
 import { analyzeCode } from '../context/ast-parser.mjs';
 import { ProjectRegistry } from '../tools/project-overview.mjs';
@@ -366,18 +366,35 @@ export function createToolExecutor({
         return result;
     }
 
+    function buildResultFileDiff(filePath, before, after) {
+        const diff = buildFileDiff({
+            filePath,
+            before,
+            after,
+            cwd: projectRootFor(filePath),
+        });
+        if (!isSensitiveConfigPath(filePath)) return diff;
+        return {
+            ...diff,
+            hunks: [],
+            unified: '',
+            redacted: true,
+            sensitive: true,
+            redaction_reason: 'Sensitive config diff redacted',
+        };
+    }
+
     function attachFileDiff(result, filePath, before, after) {
         try {
-            const diff = buildFileDiff({
-                filePath,
-                before,
-                after,
-                cwd: projectRootFor(filePath),
-            });
+            const diff = buildResultFileDiff(filePath, before, after);
             result.file_diff = diff;
             result.diff = diff.unified;
             result.lines_added = diff.lines_added;
             result.lines_removed = diff.lines_removed;
+            if (diff.redacted) {
+                result.output = `File updated: ${diff.relative_path || filePath}\nDiff redacted for sensitive config file.`;
+                result.redacted = true;
+            }
         } catch { /* best effort */ }
         return result;
     }
@@ -821,12 +838,7 @@ export function createToolExecutor({
 
                     await occRegistry.call('Write', { file_path: filePath, content });
                     const after = readTextIfExists(filePath);
-                    diffs.push(buildFileDiff({
-                        filePath,
-                        before,
-                        after,
-                        cwd: projectRootFor(filePath),
-                    }));
+                    diffs.push(buildResultFileDiff(filePath, before, after));
                     updateProjectIndex(filePath);
                     results.push(rawPath);
                 } catch (err) {

package/src/core/trust.mjs

@@ -96,11 +96,13 @@ export class TrustStore {
       }
     }
     if ((reask.on_risk_increase ?? this.policy.hitl?.reaskOnRiskIncrease) && rule.tier && tier) {
-      const order = [TIERS.READ, TIERS.SHELL_SAFE, TIERS.LOCAL_EDIT, TIERS.SHELL_MEDIUM, TIERS.NETWORK, TIERS.SHELL_DANGEROUS, TIERS.DESTRUCTIVE];
+      const order = [TIERS.READ, TIERS.SHELL_SAFE, TIERS.LOCAL_EDIT, TIERS.PROTECTED_EDIT, TIERS.SHELL_MEDIUM, TIERS.NETWORK, TIERS.SHELL_DANGEROUS, TIERS.DESTRUCTIVE];
       if (order.indexOf(tier) > order.indexOf(rule.tier)) return 'risk tier increased';
     }
-    if ((this.policy.hitl?.alwaysAskForDangerous ?? true) && (tier === TIERS.SHELL_DANGEROUS || tier === TIERS.DESTRUCTIVE)) {
-      return 'dangerous tier requires fresh approval';
+    if ((this.policy.hitl?.alwaysAskForDangerous ?? true) && (tier === TIERS.SHELL_DANGEROUS || tier === TIERS.DESTRUCTIVE || tier === TIERS.PROTECTED_EDIT)) {
+      return tier === TIERS.PROTECTED_EDIT
+        ? 'protected edit requires fresh approval'
+        : 'dangerous tier requires fresh approval';
     }
     if ((reask.on_command_shape_change ?? this.policy.hitl?.reaskOnCommandShapeChange) && rule.command_shape && args.command) {
       if (rule.command_shape !== commandShape(args.command)) return 'command shape changed';

package/src/index.mjs

@@ -35,7 +35,7 @@ import { printBanner, printProjectInfo, printHints, printAuthStatus, printStyled
 import { ContextRetriever } from './context/retriever.mjs';
 import { loadSettings } from './config/settings.mjs';
 
-const VERSION = '2.6.14';
+const VERSION = '2.6.15';
 
 // ── Arg Parsing (consolidated from index.mjs + cli-args.mjs) ──