@ctxo/cli 0.9.2 → 0.10.0

package/dist/{cli-router-IK3NJEKJ.js → cli-router-45W4IRYE.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   ArchitecturalOverlay,
+  BlastRadiusCalculator,
   BoundaryViolationDetector,
   CommunitySnapshotWriter,
   DeadCodeDetector,
@@ -18,7 +19,7 @@ import {
   loadConfig,
   makeGlobMatcher,
   watchSnapshotMinFileChanges
-} from "./chunk-HXEPS2XY.js";
+} from "./chunk-I6HLEK4G.js";
 import {
   atomicWrite,
   createLogger
@@ -31,8 +32,8 @@ import {
 } from "./chunk-PSKDDLSF.js";
 
 // src/cli/cli-router.ts
-import { readFileSync as readFileSync15, existsSync as existsSync23 } from "fs";
-import { dirname as dirname8, join as join25 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync25 } from "fs";
+import { dirname as dirname8, join as join29 } from "path";
 
 // src/cli/index-command.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -494,6 +495,25 @@ function detectFromLockfileWalkUp(startDir) {
   }
   return null;
 }
+function readWorkspaceLinks(projectRoot) {
+  const links = /* @__PURE__ */ new Set();
+  const pkgPath = join3(projectRoot, "package.json");
+  if (!existsSync4(pkgPath)) return links;
+  try {
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
+    for (const group of [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies, pkg.optionalDependencies]) {
+      if (!group) continue;
+      for (const [name, spec] of Object.entries(group)) {
+        if (typeof spec === "string" && spec.startsWith("workspace:")) {
+          links.add(name);
+        }
+      }
+    }
+    return links;
+  } catch {
+    return links;
+  }
+}
 function isWorkspaceRoot(projectRoot) {
   if (existsSync4(join3(projectRoot, "pnpm-workspace.yaml"))) return true;
   const pkgPath = join3(projectRoot, "package.json");
@@ -1753,6 +1773,34 @@ import { createRequire as createRequire4 } from "module";
 // src/cli/ai-rules.ts
 import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
 import { join as join12, dirname as dirname6 } from "path";
+var CTXO_HOOK_COMMAND = "ctxo gate-hook";
+function ensureClaudeHook(projectRoot) {
+  const filePath = join12(projectRoot, ".claude", "settings.json");
+  const dir = dirname6(filePath);
+  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
+  const ctxoEntry = { matcher: "Edit", hooks: [{ type: "command", command: CTXO_HOOK_COMMAND }] };
+  if (!existsSync11(filePath)) {
+    writeFileSync3(filePath, JSON.stringify({ hooks: { PreToolUse: [ctxoEntry] } }, null, 2) + "\n", "utf-8");
+    return { file: ".claude/settings.json", action: "created" };
+  }
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync7(filePath, "utf-8"));
+  } catch {
+    writeFileSync3(filePath, JSON.stringify({ hooks: { PreToolUse: [ctxoEntry] } }, null, 2) + "\n", "utf-8");
+    return { file: ".claude/settings.json", action: "updated" };
+  }
+  const hooks = existing.hooks ?? {};
+  const pre = hooks.PreToolUse ?? [];
+  if (pre.some((e) => e.hooks?.some((h) => h.command === CTXO_HOOK_COMMAND))) {
+    return { file: ".claude/settings.json", action: "skipped" };
+  }
+  pre.push(ctxoEntry);
+  hooks.PreToolUse = pre;
+  existing.hooks = hooks;
+  writeFileSync3(filePath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  return { file: ".claude/settings.json", action: "updated" };
+}
 var PLATFORMS = [
   { id: "claude-code", name: "Claude Code", file: "CLAUDE.md", mode: "append", detectPaths: ["CLAUDE.md", ".claude"], starred: true },
   { id: "cursor", name: "Cursor", file: ".cursor/rules/ctxo.mdc", mode: "create", detectPaths: [".cursor", ".cursorrules"], starred: false },
@@ -1859,6 +1907,37 @@ ${content}${SECTION_END}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+var SKILLS = ["ctxo-understand", "ctxo-safe-edit", "ctxo-review-pr"];
+var SKILL_TARGET_DIR = {
+  "claude-code": (root, skill) => join12(root, ".claude", "skills", skill, "SKILL.md"),
+  cursor: (root, skill) => join12(root, ".cursor", "rules", `${skill}.mdc`)
+};
+function skillsSourceDir() {
+  let dir = import.meta.dirname;
+  for (let i = 0; i < 10; i++) {
+    const candidate = join12(dir, "skills");
+    if (existsSync11(join12(candidate, "ctxo-safe-edit", "SKILL.md"))) return candidate;
+    const parent = join12(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Could not locate ctxo skills/ directory.");
+}
+function installSkills(projectRoot, platformId) {
+  const target = SKILL_TARGET_DIR[platformId];
+  if (!target) return [];
+  const src = skillsSourceDir();
+  const out = [];
+  for (const skill of SKILLS) {
+    const from = join12(src, skill, "SKILL.md");
+    const to = target(projectRoot, skill);
+    mkdirSync4(dirname6(to), { recursive: true });
+    const existed = existsSync11(to);
+    writeFileSync3(to, readFileSync7(from, "utf-8"), "utf-8");
+    out.push({ file: to, action: existed ? "updated" : "created" });
+  }
+  return out;
+}
 var GITIGNORE_ENTRY = ".ctxo/.cache/";
 function ensureGitignore(projectRoot) {
   const filePath = join12(projectRoot, ".gitignore");
@@ -1897,6 +1976,10 @@ index:
   ignoreProjects: []
   # - "packages/experimental-*"
   # - "examples/*"
+
+gate:
+  enabled: true
+  sensitivity: balanced   # strict | balanced | lenient
 `;
 function ensureConfig(projectRoot) {
   const filePath = join12(projectRoot, ".ctxo", "config.yaml");
@@ -2190,6 +2273,18 @@ var InitCommand = class {
       }
       console.error("");
     }
+    let installGuard = false;
+    if (!options.rulesOnly && selectedTools.includes("claude-code")) {
+      const guard = await clack.confirm({
+        message: pc.cyan("Install the safe-edit guard? Blocks edits to high-impact symbols until blast radius is checked."),
+        initialValue: true
+      });
+      if (clack.isCancel(guard)) {
+        clack.cancel("Setup cancelled.");
+        process.exit(0);
+      }
+      installGuard = guard;
+    }
     const s = clack.spinner();
     s.start(pc.dim("Configuring..."));
     const results = [];
@@ -2207,6 +2302,9 @@ var InitCommand = class {
     for (const toolId of selectedTools) {
       const result = installRules(this.projectRoot, toolId);
       results.push(`${pc.green("\u2713")} ${pc.bold(result.file)}  ${pc.dim(result.action)}`);
+      for (const sk of installSkills(this.projectRoot, toolId)) {
+        results.push(`${pc.green("\u2713")} ${pc.bold(sk.file)}  ${pc.dim(sk.action + " \u2014 skill")}`);
+      }
     }
     const mcpTargets = getMcpConfigTargets(selectedTools);
     for (const target of mcpTargets) {
@@ -2219,6 +2317,10 @@ var InitCommand = class {
       this.installHooks();
       results.push(`${pc.green("\u2713")} ${pc.bold("post-commit, post-merge")}  ${pc.dim("hooks installed")}`);
     }
+    if (installGuard) {
+      const r = ensureClaudeHook(this.projectRoot);
+      if (r.action !== "skipped") results.push(`${pc.green("\u2713")} ${pc.bold(r.file)}  ${pc.dim(r.action + " \u2014 safe-edit guard")}`);
+    }
     if (pluginsToInstall.length > 0) {
       s.stop(pc.dim("Installing language plugins..."));
       const installer = new InstallCommand(this.projectRoot);
@@ -2271,6 +2373,9 @@ var InitCommand = class {
     for (const toolId of toolIds) {
       const result = installRules(this.projectRoot, toolId);
       console.error(`[ctxo] \u2713 ${result.file} \u2014 ${result.action}`);
+      for (const sk of installSkills(this.projectRoot, toolId)) {
+        console.error(`[ctxo] \u2713 ${sk.file} \u2014 ${sk.action} (skill)`);
+      }
     }
     const mcpTargets = getMcpConfigTargets(toolIds);
     for (const target of mcpTargets) {
@@ -2283,6 +2388,10 @@ var InitCommand = class {
       this.installHooks();
       console.error("[ctxo] \u2713 Git hooks installed");
     }
+    if (!options.rulesOnly && toolIds.includes("claude-code")) {
+      const r = ensureClaudeHook(this.projectRoot);
+      if (r.action !== "skipped") console.error(`[ctxo] \u2713 ${r.file} \u2014 ${r.action} (safe-edit guard)`);
+    }
     if (!options.rulesOnly && !options.noInstall) {
       const detection = detectLanguages(this.projectRoot);
       const needed = decideNeededLanguages(detection);
@@ -2320,6 +2429,10 @@ var InitCommand = class {
       console.error("  .git/hooks/post-commit    (git hook)");
       console.error("  .git/hooks/post-merge     (git hook)");
     }
+    if (!options.rulesOnly && toolIds.includes("claude-code")) {
+      console.error("  .claude/settings.json     (safe-edit guard hook)");
+      console.error("  .claude/skills/ctxo-*/SKILL.md (skills)");
+    }
   }
   /* ---------------------------------------------------------------- */
   /*  Helpers                                                          */
@@ -2648,8 +2761,8 @@ var StatsCommand = class {
       if (options.clear) {
         recorder.clear();
         const data = db.export();
-        const { writeFileSync: writeFileSync6 } = await import("fs");
-        writeFileSync6(dbPath, Buffer.from(data));
+        const { writeFileSync: writeFileSync7 } = await import("fs");
+        writeFileSync7(dbPath, Buffer.from(data));
         console.error("[ctxo] Session data cleared.");
         return;
       }
@@ -3632,7 +3745,7 @@ var DoctorCommand = class {
     this.ctxoRoot = join22(projectRoot, ".ctxo");
   }
   async run(options = {}) {
-    const { getVersion: getVersion2 } = await import("./cli-router-IK3NJEKJ.js");
+    const { getVersion: getVersion2 } = await import("./cli-router-45W4IRYE.js");
     console.error(`ctxo v${getVersion2()} \u2014 health check
 `);
     const checks = [
@@ -3699,6 +3812,17 @@ var DoctorCommand = class {
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync21 } from "fs";
 import { join as join23, basename } from "path";
 import { execFile } from "child_process";
+
+// src/cli/graph-loader.ts
+function loadGraph(ctxoRoot) {
+  const indices = new JsonIndexReader(ctxoRoot).readAll();
+  const graph = new SymbolGraph();
+  for (const fi of indices) for (const sym of fi.symbols) graph.addNode(sym);
+  for (const fi of indices) for (const edge of fi.edges) graph.addEdge(edge);
+  return { graph, indices };
+}
+
+// src/cli/visualize-command.ts
 var VisualizeCommand = class {
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
@@ -3707,25 +3831,13 @@ var VisualizeCommand = class {
   projectRoot;
   ctxoRoot;
   async run(options = {}) {
-    const reader = new JsonIndexReader(this.ctxoRoot);
-    const indices = reader.readAll();
+    const { graph, indices } = loadGraph(this.ctxoRoot);
     if (indices.length === 0) {
       console.error('[ctxo] No index found. Run "ctxo index" first.');
       process.exit(1);
       return;
     }
     console.error(`[ctxo] Building graph from ${indices.length} files...`);
-    const graph = new SymbolGraph();
-    for (const fileIndex of indices) {
-      for (const sym of fileIndex.symbols) {
-        graph.addNode(sym);
-      }
-    }
-    for (const fileIndex of indices) {
-      for (const edge of fileIndex.edges) {
-        graph.addEdge(edge);
-      }
-    }
     console.error(`[ctxo] Graph: ${graph.nodeCount} symbols, ${graph.edgeCount} edges`);
     const pageRank = new PageRankCalculator();
     const prResult = pageRank.calculate(graph, { limit: 1e5 });
@@ -4038,6 +4150,11 @@ function computePackageStates(installed, results) {
 function selectInstallTargets(states) {
   return states.filter((s) => s.status === "update" && typeof s.latest === "string").filter((s) => isSafeVersionSpecifier(s.latest)).map((s) => ({ name: s.name, version: s.latest }));
 }
+function markWorkspaceLinks(states, workspaceLinkNames) {
+  return states.map(
+    (s) => workspaceLinkNames.has(s.name) ? { ...s, status: "workspace", latest: null } : s
+  );
+}
 var SAFE_SPECIFIER_RE = /^[0-9A-Za-z.+-]+$/;
 function isSafeVersionSpecifier(version) {
   return SAFE_SPECIFIER_RE.test(version);
@@ -4056,17 +4173,20 @@ function formatText(report) {
     lines.push(`All ${total} package${total === 1 ? "" : "s"} are up to date.`);
     return lines.join("\n");
   }
+  const latestCell = (p) => {
+    if (p.status === "workspace") return "(local)";
+    return p.latest ?? "(not found)";
+  };
   const nameCol = Math.max(7, ...report.packages.map((p) => p.name.length));
   const curCol = Math.max(7, ...report.packages.map((p) => p.current.length));
-  const latestCol = Math.max(15, ...report.packages.map((p) => (p.latest ?? "(not found)").length));
+  const latestCol = Math.max(15, ...report.packages.map((p) => latestCell(p).length));
   lines.push(
     `${"PACKAGE".padEnd(nameCol)}  ${"CURRENT".padEnd(curCol)}  ${`LATEST (${report.channel})`.padEnd(latestCol)}  STATUS`
   );
   for (const pkg of report.packages) {
-    const latestText = pkg.latest ?? "(not found)";
     const statusText = renderStatus(pkg, report.channel);
     lines.push(
-      `${pkg.name.padEnd(nameCol)}  ${pkg.current.padEnd(curCol)}  ${latestText.padEnd(latestCol)}  ${statusText}`
+      `${pkg.name.padEnd(nameCol)}  ${pkg.current.padEnd(curCol)}  ${latestCell(pkg).padEnd(latestCol)}  ${statusText}`
     );
   }
   if (report.plan && report.strategy === "execute") {
@@ -4088,6 +4208,8 @@ function renderStatus(pkg, reportChannel) {
       return "up to date";
     case "ahead":
       return "ahead of registry";
+    case "workspace":
+      return "workspace link";
     case "unknown":
       return pkg.reason === "registry-404" ? "skipped" : `error${pkg.reason ? ` (${pkg.reason})` : ""}`;
     case "update":
@@ -4138,7 +4260,8 @@ var UpdateCommand = class {
       this.deps.setExitCode?.(1);
       return;
     }
-    const states = computePackageStates(installed, results);
+    const rawStates = computePackageStates(installed, results);
+    const states = markWorkspaceLinks(rawStates, readWorkspaceLinks(this.projectRoot));
     const targets = selectInstallTargets(states);
     const cliVersion = getVersion();
     const channel = detectChannel(cliVersion);
@@ -4239,20 +4362,326 @@ function isLockedCI2(env) {
   return env["CI"] === "true" || env["CI"] === "1";
 }
 
+// src/cli/blast-radius-command.ts
+import { join as join25 } from "path";
+var BlastRadiusCommand = class {
+  ctxoRoot;
+  constructor(projectRoot) {
+    this.ctxoRoot = join25(projectRoot, ".ctxo");
+  }
+  run(options) {
+    const { graph } = loadGraph(this.ctxoRoot);
+    if (!graph.hasNode(options.symbolId)) {
+      process.stdout.write(JSON.stringify({ found: false, symbolId: options.symbolId }) + "\n");
+      return;
+    }
+    const result = new BlastRadiusCalculator().calculate(graph, options.symbolId);
+    const payload = {
+      found: true,
+      symbolId: options.symbolId,
+      directDependentsCount: result.directDependentsCount,
+      confirmedCount: result.confirmedCount,
+      likelyCount: result.likelyCount,
+      potentialCount: result.potentialCount,
+      overallRiskScore: result.overallRiskScore,
+      impactedSymbols: result.impactedSymbols.map((s) => ({
+        symbolId: s.symbolId,
+        confidence: s.confidence,
+        depth: s.depth
+      }))
+    };
+    process.stdout.write(JSON.stringify(payload) + "\n");
+  }
+};
+
+// src/cli/gate-hook-command.ts
+import { join as join27, relative as relative3, sep as sep2 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync16 } from "fs";
+
+// src/core/gate/gate-config.ts
+var DIAL = {
+  strict: { percentile: 30, minDependents: 2 },
+  balanced: { percentile: 15, minDependents: 3 },
+  lenient: { percentile: 5, minDependents: 5 }
+};
+function resolveGateThresholds(gate) {
+  const dial = DIAL[gate?.sensitivity ?? "balanced"];
+  return {
+    enabled: gate?.enabled ?? true,
+    percentile: gate?.percentile ?? dial.percentile,
+    minDependents: gate?.minDependents ?? dial.minDependents
+  };
+}
+
+// src/core/gate/symbol-locator.ts
+function lineOfSnippet(source, snippet) {
+  const idx = source.indexOf(snippet);
+  if (idx === -1) return null;
+  let line = 0;
+  for (let i = 0; i < idx; i++) {
+    if (source.codePointAt(i) === 10) line++;
+  }
+  return line;
+}
+function locateSymbolAtLine(fileIndex, line) {
+  let best = null;
+  for (const s of fileIndex.symbols) {
+    if (line >= s.startLine && line <= s.endLine) {
+      const span = s.endLine - s.startLine;
+      if (best === null || span < best.span) best = { id: s.symbolId, span };
+    }
+  }
+  return best?.id ?? null;
+}
+
+// src/core/gate/transcript-scan.ts
+function fileAndName(symbolId) {
+  const [file, name] = symbolId.split("::");
+  return `${file}::${name}`;
+}
+function transcriptHasBlastCheck(lines, symbolId) {
+  const target = fileAndName(symbolId);
+  for (const line of lines) {
+    if (!line.includes("get_blast_radius")) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const content = entry?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      const b = block;
+      if (b?.type === "tool_use" && typeof b.name === "string" && b.name.includes("get_blast_radius")) {
+        const id = b.input?.symbolId;
+        if (typeof id === "string" && fileAndName(id) === target) return true;
+      }
+    }
+  }
+  return false;
+}
+
+// src/adapters/gate/gate-session-store.ts
+import { existsSync as existsSync23, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "fs";
+import { join as join26 } from "path";
+var log7 = createLogger("ctxo:gate-store");
+var GateSessionStore = class {
+  constructor(cacheDir) {
+    this.cacheDir = cacheDir;
+  }
+  cacheDir;
+  file(sessionId) {
+    const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join26(this.cacheDir, "gate", `${safe}.json`);
+  }
+  read(sessionId) {
+    const f = this.file(sessionId);
+    if (!existsSync23(f)) return /* @__PURE__ */ new Set();
+    try {
+      return new Set(JSON.parse(readFileSync15(f, "utf-8")));
+    } catch (err) {
+      log7.error(`${err.message}`);
+      return /* @__PURE__ */ new Set();
+    }
+  }
+  hasWarned(sessionId, symbolId) {
+    return this.read(sessionId).has(symbolId);
+  }
+  recordWarned(sessionId, symbolId) {
+    try {
+      const set = this.read(sessionId);
+      set.add(symbolId);
+      const f = this.file(sessionId);
+      mkdirSync7(join26(this.cacheDir, "gate"), { recursive: true });
+      writeFileSync6(f, JSON.stringify([...set]), "utf-8");
+    } catch (err) {
+      log7.error(`${err.message}`);
+    }
+  }
+};
+
+// src/core/gate/percentile.ts
+function percentileCutoff(scores, topPercent) {
+  if (scores.length === 0) return Infinity;
+  const sorted = [...scores].sort((a, b) => a - b);
+  const rank = Math.ceil((100 - topPercent) / 100 * sorted.length);
+  const idx = Math.min(Math.max(rank, 0), sorted.length - 1);
+  return sorted[idx];
+}
+
+// src/core/gate/gate-decision.ts
+var MAX_TOP_DEPENDENTS = 8;
+function shouldBlock(input, t) {
+  if (!t.enabled) return false;
+  return input.riskCount >= t.minDependents && input.importanceScore >= input.importanceCutoff;
+}
+function formatBlockReason(symbolName, riskCount, topDependents) {
+  const list = topDependents.slice(0, MAX_TOP_DEPENDENTS).map((d) => `  - ${d}`).join("\n");
+  return [
+    `\u26A0 ctxo guard: "${symbolName}" is a high-impact symbol - ${riskCount} confirmed/likely dependents may break.`,
+    topDependents.length > 0 ? `Top dependents:
+${list}` : "",
+    `Call get_blast_radius / get_why_context before editing. This guard fires once per symbol per session - re-issue the edit to proceed.`
+  ].filter(Boolean).join("\n");
+}
+
+// src/cli/gate-hook-command.ts
+var log8 = createLogger("ctxo:gate-hook");
+var RANK_ALL = 1e5;
+var GateHookCommand = class {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+    this.ctxoRoot = join27(projectRoot, ".ctxo");
+    this.cacheDir = join27(this.ctxoRoot, ".cache");
+  }
+  projectRoot;
+  ctxoRoot;
+  cacheDir;
+  /** Pure-ish decision: never throws (fail-open). */
+  evaluate(payload) {
+    try {
+      if (payload.tool_name !== "Edit") return { block: false };
+      const filePath = payload.tool_input?.file_path;
+      const oldString = payload.tool_input?.old_string;
+      if (!filePath || !oldString) return { block: false };
+      const loaded = loadConfig(this.ctxoRoot);
+      const thresholds = resolveGateThresholds(loaded.config.gate);
+      if (!thresholds.enabled) return { block: false };
+      const relPath = relative3(this.projectRoot, filePath).split(sep2).join("/");
+      const indexFile = join27(this.ctxoRoot, "index", `${relPath}.json`);
+      if (!existsSync24(indexFile)) return { block: false };
+      const fileIndex = new JsonIndexReader(this.ctxoRoot).readSingle(indexFile);
+      if (!fileIndex) return { block: false };
+      if (!existsSync24(filePath)) return { block: false };
+      const source = readFileSync16(filePath, "utf-8");
+      const line = lineOfSnippet(source, oldString);
+      if (line === null) return { block: false };
+      const symbolId = locateSymbolAtLine(fileIndex, line);
+      if (!symbolId) return { block: false };
+      const store = new GateSessionStore(this.cacheDir);
+      if (store.hasWarned(payload.session_id, symbolId)) return { block: false };
+      if (payload.transcript_path && existsSync24(payload.transcript_path)) {
+        const lines = readFileSync16(payload.transcript_path, "utf-8").split("\n").filter(Boolean);
+        if (transcriptHasBlastCheck(lines, symbolId)) return { block: false };
+      }
+      const { graph } = loadGraph(this.ctxoRoot);
+      if (!graph.hasNode(symbolId)) return { block: false };
+      const blast = new BlastRadiusCalculator().calculate(graph, symbolId);
+      const riskCount = blast.confirmedCount + blast.likelyCount;
+      const pr = new PageRankCalculator().calculate(graph, { limit: RANK_ALL });
+      const prMap = new Map(pr.rankings.map((r) => [r.symbolId, r.score]));
+      const cutoff = percentileCutoff([...prMap.values()], thresholds.percentile);
+      const importanceScore = prMap.get(symbolId) ?? 0;
+      const block = shouldBlock({ riskCount, importanceScore, importanceCutoff: cutoff }, thresholds);
+      if (!block) return { block: false };
+      store.recordWarned(payload.session_id, symbolId);
+      const name = symbolId.split("::")[1] ?? symbolId;
+      const top = blast.impactedSymbols.filter((s) => s.confidence !== "potential").map((s) => s.symbolId);
+      return { block: true, reason: formatBlockReason(name, riskCount, top) };
+    } catch (err) {
+      log8.error(`${err.message}`);
+      return { block: false };
+    }
+  }
+  async run() {
+    try {
+      const payload = await this.readStdin();
+      if (payload) {
+        const decision = this.evaluate(payload);
+        if (decision.block) this.emitBlock(decision.reason ?? "ctxo guard");
+      }
+    } catch (err) {
+      log8.error(`${err.message}`);
+    }
+    process.exit(0);
+  }
+  /** PreToolUse block contract (verified): exit 0 + stdout JSON deny. */
+  emitBlock(reason) {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    }) + "\n");
+    process.exit(0);
+  }
+  readStdin() {
+    return new Promise((resolve4) => {
+      let data = "";
+      process.stdin.setEncoding("utf-8");
+      process.stdin.on("data", (c) => {
+        data += c;
+      });
+      process.stdin.on("end", () => {
+        try {
+          resolve4(JSON.parse(data));
+        } catch {
+          resolve4(null);
+        }
+      });
+      process.stdin.on("error", () => resolve4(null));
+    });
+  }
+};
+
+// src/cli/gate-command.ts
+import { join as join28 } from "path";
+var RANK_ALL2 = 1e5;
+var GateCommand = class {
+  ctxoRoot;
+  constructor(projectRoot) {
+    this.ctxoRoot = join28(projectRoot, ".ctxo");
+  }
+  preview(options = {}) {
+    const gate = loadConfig(this.ctxoRoot).config.gate;
+    const thresholds = resolveGateThresholds(gate);
+    const { graph } = loadGraph(this.ctxoRoot);
+    const pr = new PageRankCalculator().calculate(graph, { limit: RANK_ALL2 });
+    const prMap = new Map(pr.rankings.map((r) => [r.symbolId, r.score]));
+    const cutoff = percentileCutoff([...prMap.values()], thresholds.percentile);
+    const calc = new BlastRadiusCalculator();
+    const firing = [];
+    for (const [symbolId, importance] of prMap) {
+      if (importance < cutoff) continue;
+      const blast = calc.calculate(graph, symbolId);
+      const riskCount = blast.confirmedCount + blast.likelyCount;
+      if (shouldBlock({ riskCount, importanceScore: importance, importanceCutoff: cutoff }, thresholds)) {
+        firing.push({ symbolId, riskCount, importance: Math.round(importance * 1e4) / 1e4 });
+      }
+    }
+    firing.sort((a, b) => b.riskCount - a.riskCount);
+    const payload = {
+      sensitivity: gate?.sensitivity ?? "balanced",
+      thresholds,
+      totalSymbols: graph.nodeCount,
+      wouldFireCount: firing.length,
+      symbols: firing.slice(0, 50)
+    };
+    if (options.json) {
+      process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+      return;
+    }
+    console.error(`[ctxo] gate preview (${payload.sensitivity}): ${firing.length}/${graph.nodeCount} symbols would gate.`);
+    for (const f of firing.slice(0, 25)) console.error(`  ${f.riskCount} dep  ${f.symbolId}`);
+  }
+};
+
 // src/cli/cli-router.ts
 function getVersion() {
   let dir = import.meta.dirname;
   for (let i = 0; i < 10; i++) {
-    const pkg = join25(dir, "package.json");
-    if (existsSync23(pkg)) {
+    const pkg = join29(dir, "package.json");
+    if (existsSync25(pkg)) {
       try {
-        const json = JSON.parse(readFileSync15(pkg, "utf-8"));
+        const json = JSON.parse(readFileSync17(pkg, "utf-8"));
         return json.version ?? "unknown";
       } catch {
         break;
       }
     }
-    const parent = join25(dir, "..");
+    const parent = join29(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -4261,7 +4690,7 @@ function getVersion() {
 function locateGitRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 12; i++) {
-    if (existsSync23(join25(dir, ".git"))) return dir;
+    if (existsSync25(join29(dir, ".git"))) return dir;
     const parent = dirname8(dir);
     if (parent === dir) break;
     dir = parent;
@@ -4451,6 +4880,28 @@ var CliRouter = class {
         });
         break;
       }
+      case "gate": {
+        if (args.includes("--preview")) {
+          new GateCommand(this.projectRoot).preview({ json: args.includes("--json") });
+        } else {
+          console.error("[ctxo] usage: ctxo gate --preview [--json]");
+          process.exit(1);
+        }
+        break;
+      }
+      case "gate-hook":
+        await new GateHookCommand(this.projectRoot).run();
+        break;
+      case "blast-radius": {
+        const symbolId = args[1];
+        if (!symbolId || symbolId.startsWith("--")) {
+          console.error("[ctxo] usage: ctxo blast-radius <symbolId> [--json]");
+          process.exit(1);
+          return;
+        }
+        new BlastRadiusCommand(this.projectRoot).run({ symbolId, json: args.includes("--json") });
+        break;
+      }
       case "visualize": {
         const outputIdx = args.indexOf("--output");
         const outputArg = outputIdx !== -1 ? args[outputIdx + 1] : void 0;
@@ -4505,6 +4956,9 @@ Usage:
   ctxo update --json       Machine-readable output
   ctxo update --pm <pm>    Override package manager (npm|pnpm|yarn|bun)
   ctxo update --force      Bypass CI lockfile guard
+  ctxo blast-radius <symbolId>   Blast radius for one symbol (--json for machine output)
+  ctxo gate --preview            Preview which symbols the safe-edit guard would block
+  ctxo gate --preview --json     Same, machine-readable output
   ctxo --version                 Print core version
   ctxo --version --verbose       Print core + plugins + runtime
   ctxo --version --json          Machine-readable version payload
@@ -4518,4 +4972,4 @@ export {
   getVersion,
   locateGitRoot
 };
-//# sourceMappingURL=cli-router-IK3NJEKJ.js.map
+//# sourceMappingURL=cli-router-45W4IRYE.js.map