Fix suggested by Claude

Still has a missing corner case:

    class E extends D(new D(1))

Author: odersky

compiler/src/dotty/tools/dotc/core/SymDenotations.scala

@@ -947,7 +947,9 @@ object SymDenotations {
         if !cls.exists then
           pre.termSymbol.isPackageObject && accessWithin(pre.termSymbol.owner)
         else {
-          val isConstructorAccessOK = isConstructor && ctx.owner.isConstructor
+          val isConstructorAccessOK =
+            isConstructor && ctx.owner.isPrimaryConstructor
+            && cls.info.parents.exists(_.classSymbol == owner)
           // allow accesses to types from arbitrary subclasses fixes #4737
           // don't perform this check for static members
           isType || pre.derivesFrom(cls) || isConstructorAccessOK || owner.is(ModuleClass)

tests/neg/i25442/protected-constructors.scala

@@ -0,0 +1,24 @@
+package protectedCtors
+
+class A protected (x: Int)
+
+// Protected constructor in super call arguments (transitive parent)
+class B(a: A) extends A(a.hashCode)
+class C extends B(new A(1)) // error
+
+// Mixed visibility constructors
+class F protected (x: Int) {
+  def this() = this(0) // public secondary
+}
+class G(f: F) extends F(f.hashCode)
+class H extends G(new F()) // ok: public secondary in super args
+class J extends G(new F(1)) // error: protected primary in super args
+
+// new in primary constructor body
+class K extends A(42) {
+  val k = new A(1) // error
+}
+
+// Lambda in super call arguments
+class M(f: () => A) extends A(1)
+class N extends M(() => new A(2)) // error

tests/neg/i25442/test.scala

@@ -5,4 +5,5 @@ class I protected (x: Int) {
 class M protected () extends I(42) {
   def t1 = new M()   // ok
   def t2 = new I(42) // error
+  def this(x: Int) = { this(); new I(x) } // error
 }

tests/pos/i25442.scala

@@ -0,0 +1,18 @@
+package protectedCtorsPos
+
+class A protected (x: Int)
+
+// Super calls are allowed
+class B extends A(42)
+
+// Inner class extending protected parent
+class C extends A(42) {
+  class Inner extends A(1)
+}
+
+// Mixed visibility: public secondary constructor is accessible
+class D protected (x: Int) {
+  def this() = this(0)
+}
+class E(d: D) extends D(d.hashCode)
+class F extends E(new D())