project-init 0.5.2__tar.gz → 0.6.0__tar.gz

{project_init-0.5.2/templates/lifecycle/dot_claude → project_init-0.6.0/.claude}/hooks/dag_workflow.py

@@ -42,8 +42,6 @@ import sys
 import time
 from pathlib import Path
 
-CACHE_PATH = Path(".claude/.workflow-state.json")
-
 GRAPH: dict[str, list[str]] = {
     "issue.created": [],
     "branch.created": [],
@@ -253,6 +251,17 @@ COMMAND_RULES: list[tuple[re.Pattern[str], str | None, str]] = [
         "pr.merged",
         "Use .claude/scripts/monitor_pr.sh <pr> --merge instead of `gh api .../merge` so CI and review gates are honored.",
     ),
+    (
+        # GraphQL merges bypass the REST-path rule above (2026-07 review): a
+        # `gh api graphql` mutation can merge or enable auto-merge without ever
+        # naming `/pulls/N/merge`. Block the mutation fields themselves.
+        re.compile(
+            r"\bgh\s+api\b[^&;]*\bgraphql\b[^&;]*"
+            r"(?:mergePullRequest|enablePullRequestAutoMerge)"
+        ),
+        "pr.merged",
+        "Use .claude/scripts/monitor_pr.sh <pr> --merge instead of a `gh api graphql` merge mutation so CI and review gates are honored.",
+    ),
     (
         re.compile(r"\bgh\s+pr\s+merge\b"),
         "pr.merged",
@@ -291,12 +300,64 @@ _HEREDOC_RE = re.compile(
     re.DOTALL,
 )
 
+# Git global options that sit BETWEEN `git` and the subcommand (`git -C dir
+# push`, `git -c k=v push`). Left unnormalized they defeat every `git push`
+# rule, including the direct-push-to-main block (2026-07 review). Options that
+# consume a value are listed with their value; boolean options stand alone.
+_GIT_GLOBAL_OPT = (
+    r"(?:"
+    r"-C[ \t]+\S+"  # -C <path>
+    r"|-c[ \t]+\S+"  # -c <name=value>
+    r"|--git-dir(?:=\S+|[ \t]+\S+)"
+    r"|--work-tree(?:=\S+|[ \t]+\S+)"
+    r"|--namespace(?:=\S+|[ \t]+\S+)"
+    r"|--config-env(?:=\S+|[ \t]+\S+)"
+    r"|--exec-path(?:=\S+)?"
+    r"|--no-pager|--paginate|-p|-P|--bare"
+    r"|--no-replace-objects|--literal-pathspecs|--no-optional-locks|--icase-pathspecs"
+    r")"
+)
+_GIT_NORMALIZE_RE = re.compile(r"\bgit((?:[ \t]+" + _GIT_GLOBAL_OPT + r")+)[ \t]+")
+
+# An interpreter receiving a heredoc executes its body, so a guarded command
+# hidden in `bash <<'EOF' … EOF` must still be scanned (2026-07 review). The
+# negative lookbehind lets `/bin/bash` match while sparing `rebash`.
+_INTERP = r"(?:bash|sh|zsh|dash|ksh|python3?|python2|eval|source)"
+_INTERP_INTRO_RE = re.compile(r"(?<![\w.-])" + _INTERP + r"\b")
+_PIPE_INTERP_RE = re.compile(r"^\s*\|\s*(?:sudo[ \t]+)?(?<![\w.-])" + _INTERP + r"\b")
+
+
+def _normalize_git_globals(cmd: str) -> str:
+    """Rewrite ``git <global-opts> <subcommand>`` to ``git <subcommand>`` for
+    matching, so interposed ``-C``/``-c``/``--git-dir`` flags can't smuggle a
+    push past the rules (2026-07 review)."""
+    return _GIT_NORMALIZE_RE.sub("git ", cmd)
+
 
 def _strip_heredocs(cmd: str) -> str:
     """Remove heredoc body text so pattern rules don't fire on body content."""
     return _HEREDOC_RE.sub("", cmd)
 
 
+def _executing_heredoc_bodies(cmd: str) -> str:
+    """Concatenate heredoc bodies that WILL run — those fed to an interpreter
+    directly (``bash <<EOF``) or via a pipe (``cat <<EOF … | bash``).
+
+    ``_strip_heredocs`` removes every body to spare prose (a commit message or
+    ``gh pr comment --body-file - <<EOF`` mentioning "git push main"), but that
+    also hid genuinely-executing bodies. Re-surfacing only the interpreter-fed
+    ones keeps prose exempt while closing the execution bypass (2026-07 review).
+    """
+    bodies = []
+    for m in _HEREDOC_RE.finditer(cmd):
+        line_start = cmd.rfind("\n", 0, m.start()) + 1
+        intro = cmd[line_start : m.start()]
+        after = cmd[m.end() : m.end() + 60]
+        if _INTERP_INTRO_RE.search(intro) or _PIPE_INTERP_RE.match(after):
+            bodies.append(m.group(0))
+    return "\n".join(bodies)
+
+
 # Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
 # and release bodies, titles) that must not be scanned for command patterns — a
 # `--body` mentioning the literal "git push main" is data, not an invocation.
@@ -358,8 +419,15 @@ def guard(payload: dict) -> dict | None:
 
     # Strip heredoc bodies and free-text flag values so pattern rules don't fire
     # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
-    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
-    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`), then
+    # normalize interposed git global options so `git -C dir push` is matched
+    # like `git push` (2026-07 review).
+    cmd_scan = _normalize_git_globals(_strip_text_flag_values(_strip_heredocs(cmd)))
+    # A heredoc fed to an interpreter DOES execute its body — scan those too, so
+    # `bash <<'EOF' … git push … EOF` is not a bypass (2026-07 review).
+    exec_bodies = _executing_heredoc_bodies(cmd)
+    if exec_bodies:
+        cmd_scan += "\n" + _normalize_git_globals(_strip_text_flag_values(exec_bodies))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):

{project_init-0.5.2 → project_init-0.6.0}/.github/workflows/ci.yml

@@ -14,10 +14,10 @@ jobs:
     name: Lint and test
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -25,24 +25,32 @@ jobs:
           python-version: "3.12"
 
       - name: Sync dev dependencies
-        run: uv sync --extra dev --locked
+        run: uv sync --group dev --locked
 
       - name: Lint (ruff)
         run: uv run ruff check .
 
       - name: Tests (pytest) — parallel mode
-        # Falls back to single-threaded if xdist not available
-        run: uv run pytest -n auto --tb=short -q 2>/dev/null || uv run pytest --tb=short -q
+        # Use xdist when importable, else single-threaded — decided by an
+        # explicit capability check, not `|| retry`, so a genuinely failing
+        # suite is not run twice with its first-pass stderr hidden (2026-07
+        # review).
+        run: |
+          if uv run python -c "import xdist" 2>/dev/null; then
+            uv run pytest -n auto --tb=short -q
+          else
+            uv run pytest --tb=short -q
+          fi
 
   wheel-smoke:
     name: Wheel smoke test
     runs-on: ubuntu-24.04
     needs: lint-and-test
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -89,12 +97,12 @@ jobs:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           # Full history so leaked commits are caught, not just the latest diff
           fetch-depth: 0
 
-      - uses: gitleaks/gitleaks-action@v3
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
@@ -104,10 +112,10 @@ jobs:
     name: ShellCheck (scaffolded scripts)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -146,8 +154,8 @@ jobs:
     outputs:
       shell: ${{ steps.filter.outputs.shell }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590  # v3
         id: filter
         with:
           filters: |
@@ -170,10 +178,10 @@ jobs:
     if: needs.changes.outputs.shell == 'true'
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           python-version: "3.12"
@@ -228,10 +236,10 @@ jobs:
       run:
         shell: bash  # GitHub's "bash" on Windows is Git Bash — the supported path
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           python-version: "3.12"

{project_init-0.5.2 → project_init-0.6.0}/.github/workflows/docs.yml

@@ -35,10 +35,10 @@ jobs:
     name: Build site
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -54,7 +54,7 @@ jobs:
         run: uv run mkdocs build --strict
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa  # v3
         with:
           path: site
 
@@ -72,4 +72,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4

{project_init-0.5.2 → project_init-0.6.0}/.github/workflows/release.yml

@@ -18,13 +18,13 @@ jobs:
   release:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           # Full history — git-cliff needs prior tags to scope --latest.
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
 
@@ -40,7 +40,7 @@ jobs:
         run: uv build
 
       - name: Generate changelog (latest tag)
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5  # v4
         with:
           config: cliff.toml
           args: --latest
@@ -48,7 +48,7 @@ jobs:
           OUTPUT: RELEASE_NOTES.md
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3
         with:
           # Only the build artifacts — an unscoped glob also picks up the
           # tracked dist/.gitignore and uploads it as a stray
@@ -72,10 +72,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
 
@@ -83,4 +83,4 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1

{project_init-0.5.2/templates/lifecycle/dot_github → project_init-0.6.0/.github}/workflows/review-status.yml

@@ -31,6 +31,10 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           SHA: ${{ github.event.pull_request.head.sha }}
           REPO: ${{ github.repository }}
+          # Route the event value through env, not inline ${{ }} in the script —
+          # keeps the whole workflow to one untrusted-input discipline (2026-07
+          # review). GitHub-generated URL, so risk is low; consistency matters.
+          REVIEW_URL: ${{ github.event.review.html_url }}
         run: |
           DECISION=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json reviewDecision -q '.reviewDecision // ""')
           case "$DECISION" in
@@ -45,4 +49,4 @@ jobs:
             --field state="$STATE" \
             --field description="$DESCRIPTION" \
             --field context="review/decision" \
-            --field target_url="${{ github.event.review.html_url }}"
+            --field target_url="$REVIEW_URL"

{project_init-0.5.2 → project_init-0.6.0}/.github/workflows/third-party-updates.yml

@@ -17,10 +17,10 @@ jobs:
     name: Check pinned third-party tools
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           python-version: "3.12"

{project_init-0.5.2 → project_init-0.6.0}/CITATION.cff

@@ -9,4 +9,4 @@ authors:
 repository-code: https://github.com/VytCepas/project-init
 url: https://vytcepas.github.io/project-init/
 license: Apache-2.0
-version: 0.5.2
+version: 0.6.0

{project_init-0.5.2 → project_init-0.6.0}/CLAUDE.md

@@ -16,13 +16,23 @@ Before doing any GitHub issue, branch, push, PR, review, CI, or merge work, read
 ├── pyproject.toml          # uv-managed; core dep = rich; dev = ruff + pytest
 ├── install.sh              # user-facing bootstrap (curl | bash)
 ├── src/project_init/       # wizard CLI + scaffold engine
+├── plugins/                # synced plugin payloads (tools/sync_plugin.py; ADR-010)
+├── tools/                  # sync_plugin.py, third-party update checker, benchmark
 ├── templates/
 │   ├── base/               # always copied into target projects
+│   ├── auto/               # always-on emitted artifacts (agent memory files)
 │   ├── fallback/           # shared hooks/skills — rendered only with --no-plugin (ADR-010)
-│   ├── obsidian/           # overlay for both Obsidian-* presets
-│   ├── graphify/           # overlay for Obsidian+Graphify preset
+│   ├── lifecycle/          # GitHub lifecycle enforcement (default; --lifecycle none opts out)
+│   ├── lifecycle_fallback/ # lifecycle guard hooks + skills for --no-plugin
+│   ├── obsidian/           # vault overlay for both Obsidian-* presets
+│   ├── graphify/           # Graphify overlay (implies obsidian)
+│   ├── rag/                # tier-3 RAG memory overlay
+│   ├── multi_model/        # CCR model-switching overlay (--multi-model)
+│   ├── governance/         # AI governance overlay (--governance)
+│   ├── observability/      # transcript metrics overlay (--observability)
+│   ├── codex/ antigravity/ amp/ junie/  # per-surface wiring overlays (--agents)
 │   └── presets/            # toml preset definitions
-└── tests/                  # focused pytest modules by behavior area
+└── tests/                  # focused pytest modules by behavior area (unit/contract/integration/smoke)
 ```
 
 Template naming convention: directories stored as `dot_claude/`, `dot_gitignore` etc. The scaffolder renames them to `.claude/`, `.gitignore` on copy. This keeps templates visible in GitHub and avoids this repo being auto-loaded as a Claude Code config for itself.

{project_init-0.5.2 → project_init-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: project-init
-Version: 0.5.2
+Version: 0.6.0
 Summary: Scaffolder for agentic-development infrastructure inside any project
 Project-URL: Repository, https://github.com/VytCepas/project-init
 Project-URL: Documentation, https://vytcepas.github.io/project-init/
@@ -21,10 +21,6 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Code Generators
 Requires-Python: >=3.11
 Requires-Dist: rich>=13.7
-Provides-Extra: dev
-Requires-Dist: pytest-xdist>=3.0; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff>=0.4; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.7.6; extra == 'docs'
 Description-Content-Type: text/markdown
@@ -206,7 +202,7 @@ uvx --from ~/.local/share/project-init project-init . \
 The wizard asks (interactive mode only):
 
 - Project name / description
-- Language (Python/Node/Go/none) — drives `lint_command`, `format_command`, `test_command`
+- Language (Python/Node/Go/Rust/none) — drives `lint_command`, `format_command`, `test_command`
 - Delivery model (`--delivery library|service|prototype`) — how the project ships, driving its env/CI/release bundle (ADR-015). `service` adds the container **parity bundle** (Dockerfile + `compose.yaml` + devcontainer + `just up`/`build`) and unlocks the deploy overlay; `library` adds a tag-triggered release workflow (publish **disabled** until you wire the registry); `prototype` (default) adds nothing env-specific. `service` requires a language.
 - Deploy overlay (`--deploy none|cloud-run|fly|k8s|registry|custom`) — opt-in, **service only**. Container targets scaffold a build-once-**by-digest** `deploy.yml` (GitHub Environments: staging auto-deploys, production is **gated**) + a declarative `deploy/environments.yaml`, plus `setup_env_protection.sh` (server-side prod gate, tiered by profile) and `whats_deployed.sh`. `none` (default) = your platform (Vercel/Render/Fly/…) owns deploy.
 - Infrastructure-as-Code (`--iac none|opentofu`) — opt-in OpenTofu/HCL skeleton under `infra/` + a plan-on-PR workflow (apply is **manual / environment-gated**, never apply-on-merge). Emits structure only — no resources or credentials.
@@ -242,7 +238,7 @@ baseline branch protection (require CI green, require PR review, block
 force-push) — unprotected default branches undermine the workflow
 enforcement everything else sets up.
 
-Your answers are recorded in `.claude/config.yaml`. On the **first** scaffold into a project that already has files, your existing files are never clobbered: when a generated file (e.g. a hand-written `CLAUDE.md`) would differ, the new render is written alongside as a `<file>.new` sibling for you to merge, and the run prints which files were preserved. On a **re-run** (config already present) it refreshes the files project-init manages and never overwrites your `memory/` or `vault/` notes. With `--strict`, templates are rendered and validated in a temporary directory first, then the validated scaffold files are merged into the target; strict mode is not a whole-directory replacement.
+Your answers are recorded in `.claude/config.yaml`. On the **first** scaffold into a project that already has files, your existing files are never clobbered: when a generated file (e.g. a hand-written `CLAUDE.md`) would differ, the new render is written alongside as a `<file>.new` sibling for you to merge, and the run prints which files were preserved. On a **re-run** (config already present) it refreshes the files project-init manages and never overwrites your `memory/` or `vault/` notes — and a managed file you have **edited** since the last scaffold (detected via the recorded content hashes) is protected the same way: your file stays, the fresh render lands as a `<file>.new` sibling. With `--strict`, templates are rendered and validated in a temporary directory first, then the validated scaffold files are merged into the target; strict mode is not a whole-directory replacement.
 
 ### Remote and web agent sessions
 
@@ -481,7 +477,7 @@ project-init/
 
 ## Status
 
-Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.5.1). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
+Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.6.0). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
 
 ## License
 

{project_init-0.5.2 → project_init-0.6.0}/README.md

@@ -175,7 +175,7 @@ uvx --from ~/.local/share/project-init project-init . \
 The wizard asks (interactive mode only):
 
 - Project name / description
-- Language (Python/Node/Go/none) — drives `lint_command`, `format_command`, `test_command`
+- Language (Python/Node/Go/Rust/none) — drives `lint_command`, `format_command`, `test_command`
 - Delivery model (`--delivery library|service|prototype`) — how the project ships, driving its env/CI/release bundle (ADR-015). `service` adds the container **parity bundle** (Dockerfile + `compose.yaml` + devcontainer + `just up`/`build`) and unlocks the deploy overlay; `library` adds a tag-triggered release workflow (publish **disabled** until you wire the registry); `prototype` (default) adds nothing env-specific. `service` requires a language.
 - Deploy overlay (`--deploy none|cloud-run|fly|k8s|registry|custom`) — opt-in, **service only**. Container targets scaffold a build-once-**by-digest** `deploy.yml` (GitHub Environments: staging auto-deploys, production is **gated**) + a declarative `deploy/environments.yaml`, plus `setup_env_protection.sh` (server-side prod gate, tiered by profile) and `whats_deployed.sh`. `none` (default) = your platform (Vercel/Render/Fly/…) owns deploy.
 - Infrastructure-as-Code (`--iac none|opentofu`) — opt-in OpenTofu/HCL skeleton under `infra/` + a plan-on-PR workflow (apply is **manual / environment-gated**, never apply-on-merge). Emits structure only — no resources or credentials.
@@ -211,7 +211,7 @@ baseline branch protection (require CI green, require PR review, block
 force-push) — unprotected default branches undermine the workflow
 enforcement everything else sets up.
 
-Your answers are recorded in `.claude/config.yaml`. On the **first** scaffold into a project that already has files, your existing files are never clobbered: when a generated file (e.g. a hand-written `CLAUDE.md`) would differ, the new render is written alongside as a `<file>.new` sibling for you to merge, and the run prints which files were preserved. On a **re-run** (config already present) it refreshes the files project-init manages and never overwrites your `memory/` or `vault/` notes. With `--strict`, templates are rendered and validated in a temporary directory first, then the validated scaffold files are merged into the target; strict mode is not a whole-directory replacement.
+Your answers are recorded in `.claude/config.yaml`. On the **first** scaffold into a project that already has files, your existing files are never clobbered: when a generated file (e.g. a hand-written `CLAUDE.md`) would differ, the new render is written alongside as a `<file>.new` sibling for you to merge, and the run prints which files were preserved. On a **re-run** (config already present) it refreshes the files project-init manages and never overwrites your `memory/` or `vault/` notes — and a managed file you have **edited** since the last scaffold (detected via the recorded content hashes) is protected the same way: your file stays, the fresh render lands as a `<file>.new` sibling. With `--strict`, templates are rendered and validated in a temporary directory first, then the validated scaffold files are merged into the target; strict mode is not a whole-directory replacement.
 
 ### Remote and web agent sessions
 
@@ -450,7 +450,7 @@ project-init/
 
 ## Status
 
-Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.5.1). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
+Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.6.0). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
 
 ## License