@ctxo/cli 0.9.3 → 0.11.0

package/dist/{cli-router-CQJ7CN6E.js → cli-router-NFAGLJ46.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   ArchitecturalOverlay,
+  BlastRadiusCalculator,
   BoundaryViolationDetector,
   CommunitySnapshotWriter,
   DeadCodeDetector,
@@ -18,26 +19,28 @@ import {
   loadConfig,
   makeGlobMatcher,
   watchSnapshotMinFileChanges
-} from "./chunk-HXEPS2XY.js";
+} from "./chunk-HZ4UGA6J.js";
 import {
-  atomicWrite,
-  createLogger
-} from "./chunk-6EKERTJ7.js";
+  atomicWrite
+} from "./chunk-RFEXMBTG.js";
 import {
   JsonIndexReader
-} from "./chunk-2TVHKCCU.js";
+} from "./chunk-CDGQGCVN.js";
+import {
+  createLogger
+} from "./chunk-5DSKZJNN.js";
 import {
   StalenessDetector
 } from "./chunk-PSKDDLSF.js";
 
 // src/cli/cli-router.ts
-import { readFileSync as readFileSync15, existsSync as existsSync23 } from "fs";
-import { dirname as dirname8, join as join25 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync27 } from "fs";
+import { dirname as dirname9, join as join31 } from "path";
 
 // src/cli/index-command.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, existsSync as existsSync9, statSync, readdirSync as readdirSync2 } from "fs";
-import { join as join8, relative, extname as extname3 } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, existsSync as existsSync10, statSync, readdirSync as readdirSync2 } from "fs";
+import { join as join9, relative, extname as extname3 } from "path";
 import { createRequire as createRequire3 } from "module";
 
 // src/core/staleness/content-hasher.ts
@@ -263,9 +266,9 @@ async function loadPlugins(projectRoot, options = {}) {
 }
 
 // src/cli/install-command.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/core/detection/detect-languages.ts
 import { execFileSync } from "child_process";
@@ -574,7 +577,53 @@ function resolveBinary(command) {
   return `${command}.cmd`;
 }
 
+// src/core/detection/detect-java-runtime.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import { join as join4 } from "path";
+function parseJavaMajor(output) {
+  const m = output.match(/version "([^"]+)"/);
+  if (!m) return void 0;
+  const parts = m[1].split(".");
+  const major = parts[0] === "1" && parts[1] ? parseInt(parts[1], 10) : parseInt(parts[0], 10);
+  return Number.isNaN(major) ? void 0 : major;
+}
+var _javaMajorCache = void 0;
+function detectJavaMajor() {
+  if (_javaMajorCache !== void 0) {
+    return _javaMajorCache === null ? void 0 : _javaMajorCache;
+  }
+  const home = process.env["CTXO_JAVA_HOME"] || process.env["JAVA_HOME"];
+  const bin = home ? join4(home, "bin", process.platform === "win32" ? "java.exe" : "java") : "java";
+  if (home && !existsSync5(bin)) {
+    _javaMajorCache = null;
+    return void 0;
+  }
+  const r = spawnSync(bin, ["-version"], {
+    encoding: "utf-8",
+    timeout: 1e4,
+    windowsHide: true
+  });
+  if (r.error || r.status === null) {
+    _javaMajorCache = null;
+    return void 0;
+  }
+  const major = parseJavaMajor(`${r.stderr ?? ""}${r.stdout ?? ""}`);
+  _javaMajorCache = major ?? null;
+  return major;
+}
+function javaRuntimeAvailable() {
+  return (detectJavaMajor() ?? 0) >= 17;
+}
+
 // src/cli/install-command.ts
+function resolveJavaPackages(opts) {
+  if (opts.fullTier && opts.syntaxOnly) throw new Error("Cannot combine --full-tier with --syntax-only.");
+  const base = ["@ctxo/lang-java"];
+  if (opts.syntaxOnly) return base;
+  if (opts.fullTier || opts.jreAvailable) return [...base, "@ctxo/lang-java-analyzer"];
+  return base;
+}
 var InstallCommand = class {
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
@@ -598,7 +647,7 @@ var InstallCommand = class {
       process.exitCode = 1;
       return;
     }
-    if (!options.global && !existsSync5(join4(this.projectRoot, "package.json"))) {
+    if (!options.global && !existsSync6(join5(this.projectRoot, "package.json"))) {
       console.error("[ctxo] No package.json in the current project. Re-run with --global or create a package.json first.");
       process.exitCode = 1;
       return;
@@ -608,9 +657,28 @@ var InstallCommand = class {
       process.exitCode = 1;
       return;
     }
-    const specifiers = resolvedLangs.map(
-      (lang) => options.version ? `${officialPluginFor(lang)}@${options.version}` : officialPluginFor(lang)
-    );
+    const specifiers = [];
+    for (const lang of resolvedLangs) {
+      if (lang === "java") {
+        const jreAvailable = javaRuntimeAvailable();
+        if (!jreAvailable && !options.fullTier && !options.syntaxOnly) {
+          console.error('[ctxo] JRE 17+ not found; installing Java syntax tier. Install a JRE then run "ctxo install java --full-tier" for resolved call/use edges.');
+        }
+        let javaPkgs;
+        try {
+          javaPkgs = resolveJavaPackages({ jreAvailable, fullTier: options.fullTier, syntaxOnly: options.syntaxOnly });
+        } catch (err) {
+          console.error(`[ctxo] ${err.message}`);
+          process.exitCode = 1;
+          return;
+        }
+        for (const pkg of javaPkgs) {
+          specifiers.push(options.version ? `${pkg}@${options.version}` : pkg);
+        }
+      } else {
+        specifiers.push(options.version ? `${officialPluginFor(lang)}@${options.version}` : officialPluginFor(lang));
+      }
+    }
     const invocation = buildInstallCommand(resolution.manager, specifiers, {
       global: options.global,
       workspaceRoot: !options.global && isWorkspaceRoot(this.projectRoot)
@@ -702,12 +770,12 @@ function isLockedCI(env) {
 }
 
 // src/adapters/storage/json-index-writer.ts
-import { mkdirSync, unlinkSync, existsSync as existsSync6 } from "fs";
-import { dirname as dirname4, join as join5, resolve as resolve2, sep } from "path";
+import { mkdirSync, unlinkSync, existsSync as existsSync7 } from "fs";
+import { dirname as dirname4, join as join6, resolve as resolve2, sep } from "path";
 var JsonIndexWriter = class {
   indexDir;
   constructor(ctxoRoot) {
-    this.indexDir = join5(ctxoRoot, "index");
+    this.indexDir = join6(ctxoRoot, "index");
   }
   write(fileIndex) {
     if (!fileIndex.file) {
@@ -721,7 +789,7 @@ var JsonIndexWriter = class {
   }
   writeCoChanges(matrix) {
     mkdirSync(this.indexDir, { recursive: true });
-    const targetPath = join5(this.indexDir, "co-changes.json");
+    const targetPath = join6(this.indexDir, "co-changes.json");
     this.atomicWrite(targetPath, JSON.stringify(matrix, null, 2));
   }
   atomicWrite(targetPath, content) {
@@ -729,7 +797,7 @@ var JsonIndexWriter = class {
   }
   delete(relativePath) {
     const targetPath = this.resolveIndexPath(relativePath);
-    if (existsSync6(targetPath)) {
+    if (existsSync7(targetPath)) {
       unlinkSync(targetPath);
     }
   }
@@ -757,19 +825,19 @@ var JsonIndexWriter = class {
 };
 
 // src/adapters/storage/schema-manager.ts
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
-import { join as join6, dirname as dirname5 } from "path";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs";
+import { join as join7, dirname as dirname5 } from "path";
 var CURRENT_SCHEMA_VERSION = "1.0.0";
 var SchemaManager = class {
   versionFilePath;
   constructor(ctxoRoot) {
-    this.versionFilePath = join6(ctxoRoot, "index", "schema-version");
+    this.versionFilePath = join7(ctxoRoot, "index", "schema-version");
   }
   currentVersion() {
     return CURRENT_SCHEMA_VERSION;
   }
   readStoredVersion() {
-    if (!existsSync7(this.versionFilePath)) {
+    if (!existsSync8(this.versionFilePath)) {
       return void 0;
     }
     return readFileSync4(this.versionFilePath, "utf-8").trim();
@@ -786,8 +854,8 @@ var SchemaManager = class {
 };
 
 // src/adapters/storage/architecture-artifacts-writer.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "fs";
-import { join as join7, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join8, resolve as resolve3 } from "path";
 import { tmpdir } from "os";
 var log3 = createLogger("ctxo:architecture-artifacts");
 var DRIFT_FILE_NAME = "drift-events.json";
@@ -795,20 +863,20 @@ var VIOLATIONS_FILE_NAME = "boundary-violations.json";
 var ArchitectureArtifactsWriter = class {
   indexDir;
   constructor(ctxoRoot, options = {}) {
-    this.indexDir = join7(ctxoRoot, "index");
+    this.indexDir = join8(ctxoRoot, "index");
     assertSafeWritePath(ctxoRoot, options.allowProductionPath ?? false);
   }
   writeDriftEvents(artifact) {
     mkdirSync3(this.indexDir, { recursive: true });
-    atomicWrite(join7(this.indexDir, DRIFT_FILE_NAME), JSON.stringify(artifact, null, 2));
+    atomicWrite(join8(this.indexDir, DRIFT_FILE_NAME), JSON.stringify(artifact, null, 2));
   }
   writeBoundaryViolations(artifact) {
     mkdirSync3(this.indexDir, { recursive: true });
-    atomicWrite(join7(this.indexDir, VIOLATIONS_FILE_NAME), JSON.stringify(artifact, null, 2));
+    atomicWrite(join8(this.indexDir, VIOLATIONS_FILE_NAME), JSON.stringify(artifact, null, 2));
   }
   readDriftEvents() {
-    const path = join7(this.indexDir, DRIFT_FILE_NAME);
-    if (!existsSync8(path)) return void 0;
+    const path = join8(this.indexDir, DRIFT_FILE_NAME);
+    if (!existsSync9(path)) return void 0;
     try {
       return JSON.parse(readFileSync5(path, "utf-8"));
     } catch (err) {
@@ -817,8 +885,8 @@ var ArchitectureArtifactsWriter = class {
     }
   }
   readBoundaryViolations() {
-    const path = join7(this.indexDir, VIOLATIONS_FILE_NAME);
-    if (!existsSync8(path)) return void 0;
+    const path = join8(this.indexDir, VIOLATIONS_FILE_NAME);
+    if (!existsSync9(path)) return void 0;
     try {
       return JSON.parse(readFileSync5(path, "utf-8"));
     } catch (err) {
@@ -1127,7 +1195,7 @@ var IndexCommand = class {
   supportedExtensions;
   constructor(projectRoot, ctxoRoot) {
     this.projectRoot = projectRoot;
-    this.ctxoRoot = ctxoRoot ?? join8(projectRoot, ".ctxo");
+    this.ctxoRoot = ctxoRoot ?? join9(projectRoot, ".ctxo");
     this.supportedExtensions = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".go", ".cs"]);
   }
   loadIgnoreConfig() {
@@ -1155,7 +1223,7 @@ var IndexCommand = class {
     }
     const ignore = this.loadIgnoreConfig();
     const registry = new LanguageAdapterRegistry();
-    const { tsMorphLike, roslynAdapter, csharpTier, goTier } = await this.registerDiscoveredPlugins(registry, ignore.ignoreProjectPatterns);
+    const { tsMorphLike, roslynAdapter, csharpTier, goTier, javaTier } = await this.registerDiscoveredPlugins(registry, ignore.ignoreProjectPatterns);
     this.supportedExtensions = registry.getSupportedExtensions();
     this.printLanguagePreview();
     const writer = new JsonIndexWriter(this.ctxoRoot);
@@ -1165,7 +1233,7 @@ var IndexCommand = class {
     const revertDetector = new RevertDetector();
     let files;
     if (options.file) {
-      const fullPath = join8(this.projectRoot, options.file);
+      const fullPath = join9(this.projectRoot, options.file);
       files = [fullPath];
       console.error(`[ctxo] Incremental re-index: ${options.file}`);
     } else {
@@ -1178,8 +1246,8 @@ var IndexCommand = class {
       console.error(`[ctxo] Building codebase index... Found ${files.length} source files`);
     }
     try {
-      const { sweepStaleTmpFiles } = await import("./atomic-write-AQNYJFAG.js");
-      const swept = sweepStaleTmpFiles(join8(this.ctxoRoot, "index"));
+      const { sweepStaleTmpFiles } = await import("./atomic-write-BAFH464Q.js");
+      const swept = sweepStaleTmpFiles(join9(this.ctxoRoot, "index"));
       if (swept > 0) {
         console.error(`[ctxo] Cleaned ${swept} orphan .tmp file(s) from previous interrupted run`);
       }
@@ -1266,7 +1334,7 @@ var IndexCommand = class {
     }
     let communitySnapshot;
     if (options.skipCommunity && pendingIndices.length > 0) {
-      if (existsSync9(join8(this.ctxoRoot, "index", "communities.json"))) {
+      if (existsSync10(join9(this.ctxoRoot, "index", "communities.json"))) {
         console.error(
           `[ctxo] WARN stale communities.json present \u2014 --skip-community preserved existing snapshot. Run \`ctxo index\` (full) to refresh.`
         );
@@ -1279,6 +1347,7 @@ var IndexCommand = class {
           {
             csharpTier,
             goTier,
+            javaTier,
             tsCount: graphIndices.filter((idx) => /\.(ts|tsx|js|jsx)$/.test(idx.file)).length
           },
           gitAdapter
@@ -1316,10 +1385,12 @@ var IndexCommand = class {
     const csCount = pendingIndices.filter((e) => e.relativePath.endsWith(".cs")).length;
     const tsCount = pendingIndices.filter((e) => /\.(ts|tsx|js|jsx)$/.test(e.relativePath)).length;
     const goCount = pendingIndices.filter((e) => e.relativePath.endsWith(".go")).length;
+    const javaCount = pendingIndices.filter((e) => e.relativePath.endsWith(".java")).length;
     console.error(`[ctxo] Index complete: ${processed} files indexed`);
     if (tsCount > 0) console.error(`[ctxo]   TypeScript/JS: ${tsCount} files (full tier)`);
     if (csCount > 0) console.error(`[ctxo]   C#: ${csCount} files (${csharpTier} tier${csharpTier === "syntax" ? " - .NET SDK 8+ for full analysis" : ""})`);
     if (goCount > 0) console.error(`[ctxo]   Go: ${goCount} files (${goTier} tier${goTier === "syntax" ? " - Go 1.22+ for full analysis" : ""})`);
+    if (javaCount > 0) console.error(`[ctxo]   Java: ${javaCount} files (${javaTier} tier${javaTier === "syntax" ? ' - JRE 17+ & "ctxo install java --full-tier" for full analysis' : ""})`);
     if (roslynAdapter) await roslynAdapter.dispose();
   }
   async autoInstallMissingPlugins() {
@@ -1355,6 +1426,7 @@ var IndexCommand = class {
     let roslynAdapter = null;
     let csharpTier = "unavailable";
     let goTier = "unavailable";
+    let javaTier = "unavailable";
     for (const { plugin, adapter } of loaded) {
       if (typeof adapter.initialize === "function") {
         try {
@@ -1378,11 +1450,15 @@ var IndexCommand = class {
       if (plugin.id === "go" && typeof goCandidate.getTier === "function") {
         goTier = goCandidate.getTier();
       }
-      const activeTier = plugin.id === "csharp" ? csharpTier : plugin.id === "go" ? goTier : plugin.tier;
+      const javaCandidate = adapter;
+      if (plugin.id === "java" && typeof javaCandidate.getTier === "function") {
+        javaTier = javaCandidate.getTier();
+      }
+      const activeTier = plugin.id === "csharp" ? csharpTier : plugin.id === "go" ? goTier : plugin.id === "java" ? javaTier : plugin.tier;
       const tierSuffix = activeTier !== plugin.tier ? ` (active: ${activeTier})` : "";
       console.error(`[ctxo] Plugin ${plugin.id}@${plugin.version} (${plugin.tier} tier${tierSuffix}) \u2014 ${plugin.extensions.join(", ")}`);
     }
-    return { tsMorphLike, roslynAdapter, csharpTier, goTier };
+    return { tsMorphLike, roslynAdapter, csharpTier, goTier, javaTier };
   }
   discoverFilesIn(root, ignoreFile = () => false) {
     try {
@@ -1391,18 +1467,18 @@ var IndexCommand = class {
         encoding: "utf-8",
         maxBuffer: 10 * 1024 * 1024
       });
-      return output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).filter((line) => this.isSupportedExtension(line)).map((line) => join8(root, line)).filter((abs) => {
+      return output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).filter((line) => this.isSupportedExtension(line)).map((line) => join9(root, line)).filter((abs) => {
         const rel = relative(this.projectRoot, abs).replace(/\\/g, "/");
         return !ignoreFile(rel);
-      }).filter((abs) => existsSync9(abs));
+      }).filter((abs) => existsSync10(abs));
     } catch {
       console.error(`[ctxo] git ls-files failed for ${root}`);
       return [];
     }
   }
   discoverWorkspaces(ignoreProject = () => false) {
-    const pkgPath = join8(this.projectRoot, "package.json");
-    if (!existsSync9(pkgPath)) return [this.projectRoot];
+    const pkgPath = join9(this.projectRoot, "package.json");
+    if (!existsSync10(pkgPath)) return [this.projectRoot];
     try {
       const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
       const workspaces = Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces?.packages;
@@ -1410,17 +1486,17 @@ var IndexCommand = class {
       const resolved = [];
       for (const ws of workspaces) {
         if (ws.endsWith("/*") || ws.endsWith("\\*")) {
-          const parentDir = join8(this.projectRoot, ws.slice(0, -2));
-          if (existsSync9(parentDir)) {
+          const parentDir = join9(this.projectRoot, ws.slice(0, -2));
+          if (existsSync10(parentDir)) {
             for (const entry of readdirSync2(parentDir, { withFileTypes: true })) {
               if (entry.isDirectory()) {
-                resolved.push(join8(parentDir, entry.name));
+                resolved.push(join9(parentDir, entry.name));
               }
             }
           }
         } else {
-          const wsPath = join8(this.projectRoot, ws);
-          if (existsSync9(wsPath)) {
+          const wsPath = join9(this.projectRoot, ws);
+          if (existsSync10(wsPath)) {
             resolved.push(wsPath);
           }
         }
@@ -1453,7 +1529,7 @@ var IndexCommand = class {
     if (_roslyn) await _roslyn.dispose();
     const hasher = new ContentHasher();
     const files = this.discoverFilesIn(this.projectRoot);
-    const reader = new (await import("./json-index-reader-XOEE6VMD.js")).JsonIndexReader(this.ctxoRoot);
+    const reader = new (await import("./json-index-reader-UYS74USB.js")).JsonIndexReader(this.ctxoRoot);
     const indices = reader.readAll();
     const indexedMap = new Map(indices.map((i) => [i.file, i]));
     let staleCount = 0;
@@ -1466,7 +1542,7 @@ var IndexCommand = class {
         staleCount++;
         continue;
       }
-      if (!existsSync9(filePath)) {
+      if (!existsSync10(filePath)) {
         console.error(`[ctxo] DELETED: ${relativePath}`);
         staleCount++;
         continue;
@@ -1492,13 +1568,13 @@ var IndexCommand = class {
     console.error("[ctxo] Index is up to date");
   }
   ensureGitignore() {
-    const gitignorePath = join8(this.projectRoot, ".gitignore");
+    const gitignorePath = join9(this.projectRoot, ".gitignore");
     const cachePattern = ".ctxo/.cache/";
     const suffix = `
 # Ctxo local cache (never committed)
 ${cachePattern}
 `;
-    const existing = existsSync9(gitignorePath) ? readFileSync6(gitignorePath, "utf-8") : "";
+    const existing = existsSync10(gitignorePath) ? readFileSync6(gitignorePath, "utf-8") : "";
     if (existing.includes(cachePattern)) return;
     writeFileSync2(gitignorePath, existing + suffix, "utf-8");
     console.error("[ctxo] Added .ctxo/.cache/ to .gitignore");
@@ -1617,8 +1693,8 @@ ${cachePattern}
   }
 };
 function pickEdgeQuality(tiers) {
-  const hasSyntaxOnly = tiers.csharpTier === "syntax" || tiers.goTier === "syntax";
-  const hasFull = tiers.tsCount > 0 || tiers.csharpTier === "full" || tiers.goTier === "full";
+  const hasSyntaxOnly = tiers.csharpTier === "syntax" || tiers.goTier === "syntax" || tiers.javaTier === "syntax";
+  const hasFull = tiers.tsCount > 0 || tiers.csharpTier === "full" || tiers.goTier === "full" || tiers.javaTier === "full";
   if (hasSyntaxOnly && hasFull) return "mixed";
   if (hasSyntaxOnly) return "syntax-only";
   return "full";
@@ -1643,11 +1719,11 @@ function countCommunities(snapshot) {
 }
 
 // src/cli/sync-command.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var SyncCommand = class {
   ctxoRoot;
   constructor(projectRoot) {
-    this.ctxoRoot = join9(projectRoot, ".ctxo");
+    this.ctxoRoot = join10(projectRoot, ".ctxo");
   }
   async run() {
     console.error("[ctxo] Rebuilding SQLite cache from committed JSON index...");
@@ -1662,19 +1738,19 @@ var SyncCommand = class {
 };
 
 // src/cli/status-command.ts
-import { join as join10 } from "path";
-import { existsSync as existsSync10 } from "fs";
+import { join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
 import { execFileSync as execFileSync3 } from "child_process";
 var StatusCommand = class {
   projectRoot;
   ctxoRoot;
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
-    this.ctxoRoot = join10(projectRoot, ".ctxo");
+    this.ctxoRoot = join11(projectRoot, ".ctxo");
   }
   run() {
-    const indexDir = join10(this.ctxoRoot, "index");
-    if (!existsSync10(indexDir)) {
+    const indexDir = join11(this.ctxoRoot, "index");
+    if (!existsSync11(indexDir)) {
       console.error('[ctxo] No index found. Run "ctxo index" first.');
       return;
     }
@@ -1689,7 +1765,7 @@ var StatusCommand = class {
     console.error(`  Indexed files:  ${indices.length}`);
     console.error(`  Total symbols:  ${totalSymbols}`);
     console.error(`  Total edges:    ${totalEdges}`);
-    const cacheExists = existsSync10(join10(this.ctxoRoot, ".cache", "symbols.db"));
+    const cacheExists = existsSync11(join11(this.ctxoRoot, ".cache", "symbols.db"));
     console.error(`  SQLite cache:   ${cacheExists ? "present" : "missing (run ctxo sync)"}`);
     if (indices.length > 0) {
       console.error("");
@@ -1718,7 +1794,7 @@ var StatusCommand = class {
 
 // src/cli/verify-command.ts
 import { mkdtempSync, rmSync } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 var VerifyCommand = class {
   projectRoot;
@@ -1727,12 +1803,12 @@ var VerifyCommand = class {
   }
   async run() {
     console.error("[ctxo] Verifying index freshness...");
-    const tempDir = mkdtempSync(join11(tmpdir2(), "ctxo-verify-"));
+    const tempDir = mkdtempSync(join12(tmpdir2(), "ctxo-verify-"));
     try {
-      const tempCtxo = join11(tempDir, ".ctxo");
+      const tempCtxo = join12(tempDir, ".ctxo");
       const indexCmd = new IndexCommand(this.projectRoot, tempCtxo);
       await indexCmd.run({ skipSideEffects: true });
-      const committedReader = new JsonIndexReader(join11(this.projectRoot, ".ctxo"));
+      const committedReader = new JsonIndexReader(join12(this.projectRoot, ".ctxo"));
       const freshReader = new JsonIndexReader(tempCtxo);
       const committedIndices = committedReader.readAll();
       const freshIndices = freshReader.readAll();
@@ -1765,13 +1841,41 @@ var VerifyCommand = class {
 };
 
 // src/cli/init-command.ts
-import { join as join13 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, chmodSync } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync8, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, chmodSync } from "fs";
 import { createRequire as createRequire4 } from "module";
 
 // src/cli/ai-rules.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
-import { join as join12, dirname as dirname6 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync7, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join13, dirname as dirname6 } from "path";
+var CTXO_HOOK_COMMAND = "ctxo gate-hook";
+function ensureClaudeHook(projectRoot) {
+  const filePath = join13(projectRoot, ".claude", "settings.json");
+  const dir = dirname6(filePath);
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
+  const ctxoEntry = { matcher: "Edit", hooks: [{ type: "command", command: CTXO_HOOK_COMMAND }] };
+  if (!existsSync12(filePath)) {
+    writeFileSync3(filePath, JSON.stringify({ hooks: { PreToolUse: [ctxoEntry] } }, null, 2) + "\n", "utf-8");
+    return { file: ".claude/settings.json", action: "created" };
+  }
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync7(filePath, "utf-8"));
+  } catch {
+    writeFileSync3(filePath, JSON.stringify({ hooks: { PreToolUse: [ctxoEntry] } }, null, 2) + "\n", "utf-8");
+    return { file: ".claude/settings.json", action: "updated" };
+  }
+  const hooks = existing.hooks ?? {};
+  const pre = hooks.PreToolUse ?? [];
+  if (pre.some((e) => e.hooks?.some((h) => h.command === CTXO_HOOK_COMMAND))) {
+    return { file: ".claude/settings.json", action: "skipped" };
+  }
+  pre.push(ctxoEntry);
+  hooks.PreToolUse = pre;
+  existing.hooks = hooks;
+  writeFileSync3(filePath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  return { file: ".claude/settings.json", action: "updated" };
+}
 var PLATFORMS = [
   { id: "claude-code", name: "Claude Code", file: "CLAUDE.md", mode: "append", detectPaths: ["CLAUDE.md", ".claude"], starred: true },
   { id: "cursor", name: "Cursor", file: ".cursor/rules/ctxo.mdc", mode: "create", detectPaths: [".cursor", ".cursorrules"], starred: false },
@@ -1786,7 +1890,7 @@ var PLATFORMS = [
 function detectPlatforms(projectRoot) {
   const detected = /* @__PURE__ */ new Set();
   for (const p of PLATFORMS) {
-    if (p.detectPaths.some((d) => existsSync11(join12(projectRoot, d)))) {
+    if (p.detectPaths.some((d) => existsSync12(join13(projectRoot, d)))) {
       detected.add(p.id);
     }
   }
@@ -1848,15 +1952,15 @@ function generateRules(platformId) {
 function installRules(projectRoot, platformId) {
   const platform = PLATFORMS.find((p) => p.id === platformId);
   if (!platform) throw new Error(`Unknown platform: ${platformId}`);
-  const filePath = join12(projectRoot, platform.file);
+  const filePath = join13(projectRoot, platform.file);
   const content = generateRules(platformId);
   const dir = dirname6(filePath);
-  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
   if (platform.mode === "create") {
     writeFileSync3(filePath, content, "utf-8");
-    return { file: platform.file, action: existsSync11(filePath) ? "updated" : "created" };
+    return { file: platform.file, action: existsSync12(filePath) ? "updated" : "created" };
   }
-  if (!existsSync11(filePath)) {
+  if (!existsSync12(filePath)) {
     writeFileSync3(filePath, content, "utf-8");
     return { file: platform.file, action: "created" };
   }
@@ -1878,10 +1982,41 @@ ${content}${SECTION_END}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+var SKILLS = ["ctxo-understand", "ctxo-safe-edit", "ctxo-review-pr"];
+var SKILL_TARGET_DIR = {
+  "claude-code": (root, skill) => join13(root, ".claude", "skills", skill, "SKILL.md"),
+  cursor: (root, skill) => join13(root, ".cursor", "rules", `${skill}.mdc`)
+};
+function skillsSourceDir() {
+  let dir = import.meta.dirname;
+  for (let i = 0; i < 10; i++) {
+    const candidate = join13(dir, "skills");
+    if (existsSync12(join13(candidate, "ctxo-safe-edit", "SKILL.md"))) return candidate;
+    const parent = join13(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Could not locate ctxo skills/ directory.");
+}
+function installSkills(projectRoot, platformId) {
+  const target = SKILL_TARGET_DIR[platformId];
+  if (!target) return [];
+  const src = skillsSourceDir();
+  const out = [];
+  for (const skill of SKILLS) {
+    const from = join13(src, skill, "SKILL.md");
+    const to = target(projectRoot, skill);
+    mkdirSync4(dirname6(to), { recursive: true });
+    const existed = existsSync12(to);
+    writeFileSync3(to, readFileSync7(from, "utf-8"), "utf-8");
+    out.push({ file: to, action: existed ? "updated" : "created" });
+  }
+  return out;
+}
 var GITIGNORE_ENTRY = ".ctxo/.cache/";
 function ensureGitignore(projectRoot) {
-  const filePath = join12(projectRoot, ".gitignore");
-  if (!existsSync11(filePath)) {
+  const filePath = join13(projectRoot, ".gitignore");
+  if (!existsSync12(filePath)) {
     writeFileSync3(filePath, `# Ctxo local cache (auto-rebuilt, never committed)
 ${GITIGNORE_ENTRY}
 `, "utf-8");
@@ -1916,12 +2051,16 @@ index:
   ignoreProjects: []
   # - "packages/experimental-*"
   # - "examples/*"
+
+gate:
+  enabled: true
+  sensitivity: balanced   # strict | balanced | lenient
 `;
 function ensureConfig(projectRoot) {
-  const filePath = join12(projectRoot, ".ctxo", "config.yaml");
+  const filePath = join13(projectRoot, ".ctxo", "config.yaml");
   const dir = dirname6(filePath);
-  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
-  if (existsSync11(filePath)) {
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
+  if (existsSync12(filePath)) {
     return { file: ".ctxo/config.yaml", action: "skipped" };
   }
   writeFileSync3(filePath, DEFAULT_CONFIG, "utf-8");
@@ -1956,11 +2095,11 @@ function getMcpConfigTargets(selectedPlatformIds) {
   return [...targets.values()];
 }
 function ensureMcpConfig(projectRoot, target) {
-  const filePath = join12(projectRoot, target.file);
+  const filePath = join13(projectRoot, target.file);
   const dir = dirname6(filePath);
-  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
   const entry = target.extraFields ? { ...target.extraFields, ...CTXO_MCP_ENTRY } : { ...CTXO_MCP_ENTRY };
-  if (!existsSync11(filePath)) {
+  if (!existsSync12(filePath)) {
     const config = { [target.serverKey]: { ctxo: entry } };
     writeFileSync3(filePath, JSON.stringify(config, null, 2) + "\n", "utf-8");
     return { file: target.file, action: "created" };
@@ -2076,13 +2215,13 @@ var InitCommand = class {
     this.projectRoot = projectRoot;
   }
   installHooks() {
-    const hooksDir = join13(this.projectRoot, ".git", "hooks");
+    const hooksDir = join14(this.projectRoot, ".git", "hooks");
     mkdirSync5(hooksDir, { recursive: true });
     this.installHook(hooksDir, "post-commit", POST_COMMIT_CONTENT);
     this.installHook(hooksDir, "post-merge", POST_MERGE_CONTENT);
   }
   async run(options = {}) {
-    if (!existsSync12(join13(this.projectRoot, ".git"))) {
+    if (!existsSync13(join14(this.projectRoot, ".git"))) {
       console.error('[ctxo] Not a git repository. Run "git init" first.');
       process.exit(1);
     }
@@ -2119,8 +2258,8 @@ var InitCommand = class {
         clack.cancel("Setup cancelled.");
         process.exit(0);
       }
-      const fullPath = join13(this.projectRoot, indexDir);
-      if (!existsSync12(fullPath)) mkdirSync5(fullPath, { recursive: true });
+      const fullPath = join14(this.projectRoot, indexDir);
+      if (!existsSync13(fullPath)) mkdirSync5(fullPath, { recursive: true });
       console.error("");
     }
     stepNum++;
@@ -2209,6 +2348,18 @@ var InitCommand = class {
       }
       console.error("");
     }
+    let installGuard = false;
+    if (!options.rulesOnly && selectedTools.includes("claude-code")) {
+      const guard = await clack.confirm({
+        message: pc.cyan("Install the safe-edit guard? Blocks edits to high-impact symbols until blast radius is checked."),
+        initialValue: true
+      });
+      if (clack.isCancel(guard)) {
+        clack.cancel("Setup cancelled.");
+        process.exit(0);
+      }
+      installGuard = guard;
+    }
     const s = clack.spinner();
     s.start(pc.dim("Configuring..."));
     const results = [];
@@ -2226,6 +2377,9 @@ var InitCommand = class {
     for (const toolId of selectedTools) {
       const result = installRules(this.projectRoot, toolId);
       results.push(`${pc.green("\u2713")} ${pc.bold(result.file)}  ${pc.dim(result.action)}`);
+      for (const sk of installSkills(this.projectRoot, toolId)) {
+        results.push(`${pc.green("\u2713")} ${pc.bold(sk.file)}  ${pc.dim(sk.action + " \u2014 skill")}`);
+      }
     }
     const mcpTargets = getMcpConfigTargets(selectedTools);
     for (const target of mcpTargets) {
@@ -2238,6 +2392,10 @@ var InitCommand = class {
       this.installHooks();
       results.push(`${pc.green("\u2713")} ${pc.bold("post-commit, post-merge")}  ${pc.dim("hooks installed")}`);
     }
+    if (installGuard) {
+      const r = ensureClaudeHook(this.projectRoot);
+      if (r.action !== "skipped") results.push(`${pc.green("\u2713")} ${pc.bold(r.file)}  ${pc.dim(r.action + " \u2014 safe-edit guard")}`);
+    }
     if (pluginsToInstall.length > 0) {
       s.stop(pc.dim("Installing language plugins..."));
       const installer = new InstallCommand(this.projectRoot);
@@ -2277,8 +2435,8 @@ var InitCommand = class {
     const gitignoreResult = ensureGitignore(this.projectRoot);
     const configResult = ensureConfig(this.projectRoot);
     if (!options.rulesOnly) {
-      const indexDir = join13(this.projectRoot, ".ctxo", "index");
-      if (!existsSync12(indexDir)) mkdirSync5(indexDir, { recursive: true });
+      const indexDir = join14(this.projectRoot, ".ctxo", "index");
+      if (!existsSync13(indexDir)) mkdirSync5(indexDir, { recursive: true });
       console.error("[ctxo] \u2713 .ctxo/index/ ready");
     }
     if (configResult.action !== "skipped") {
@@ -2290,6 +2448,9 @@ var InitCommand = class {
     for (const toolId of toolIds) {
       const result = installRules(this.projectRoot, toolId);
       console.error(`[ctxo] \u2713 ${result.file} \u2014 ${result.action}`);
+      for (const sk of installSkills(this.projectRoot, toolId)) {
+        console.error(`[ctxo] \u2713 ${sk.file} \u2014 ${sk.action} (skill)`);
+      }
     }
     const mcpTargets = getMcpConfigTargets(toolIds);
     for (const target of mcpTargets) {
@@ -2302,6 +2463,10 @@ var InitCommand = class {
       this.installHooks();
       console.error("[ctxo] \u2713 Git hooks installed");
     }
+    if (!options.rulesOnly && toolIds.includes("claude-code")) {
+      const r = ensureClaudeHook(this.projectRoot);
+      if (r.action !== "skipped") console.error(`[ctxo] \u2713 ${r.file} \u2014 ${r.action} (safe-edit guard)`);
+    }
     if (!options.rulesOnly && !options.noInstall) {
       const detection = detectLanguages(this.projectRoot);
       const needed = decideNeededLanguages(detection);
@@ -2330,7 +2495,7 @@ var InitCommand = class {
     for (const id of toolIds) {
       const platform = PLATFORMS.find((p) => p.id === id);
       if (platform) {
-        const exists = existsSync12(join13(this.projectRoot, platform.file));
+        const exists = existsSync13(join14(this.projectRoot, platform.file));
         const action = platform.mode === "append" && exists ? "append section" : "create";
         console.error(`  ${platform.file.padEnd(42)} (${action})`);
       }
@@ -2339,27 +2504,31 @@ var InitCommand = class {
       console.error("  .git/hooks/post-commit    (git hook)");
       console.error("  .git/hooks/post-merge     (git hook)");
     }
+    if (!options.rulesOnly && toolIds.includes("claude-code")) {
+      console.error("  .claude/settings.json     (safe-edit guard hook)");
+      console.error("  .claude/skills/ctxo-*/SKILL.md (skills)");
+    }
   }
   /* ---------------------------------------------------------------- */
   /*  Helpers                                                          */
   /* ---------------------------------------------------------------- */
   async getVersion() {
     try {
-      const pkgPath = join13(this.projectRoot, "node_modules", "@ctxo", "cli", "package.json");
-      if (existsSync12(pkgPath)) {
+      const pkgPath = join14(this.projectRoot, "node_modules", "@ctxo", "cli", "package.json");
+      if (existsSync13(pkgPath)) {
         return JSON.parse(readFileSync8(pkgPath, "utf-8")).version;
       }
-      const { createRequire: createRequire8 } = await import("module");
-      const require4 = createRequire8(import.meta.url);
-      return require4("../../package.json").version;
+      const { createRequire: createRequire9 } = await import("module");
+      const require5 = createRequire9(import.meta.url);
+      return require5("../../package.json").version;
     } catch {
       return void 0;
     }
   }
   installHook(hooksDir, hookName, hookContent) {
-    const hookPath = join13(hooksDir, hookName);
+    const hookPath = join14(hooksDir, hookName);
     let existing = "";
-    if (existsSync12(hookPath)) {
+    if (existsSync13(hookPath)) {
       existing = readFileSync8(hookPath, "utf-8");
       if (existing.includes(CTXO_START)) return;
     } else {
@@ -2372,7 +2541,7 @@ var InitCommand = class {
 };
 
 // src/cli/watch-command.ts
-import { join as join14, extname as extname4, relative as relative2 } from "path";
+import { join as join15, extname as extname4, relative as relative2 } from "path";
 import { readFileSync as readFileSync9 } from "fs";
 
 // src/adapters/watcher/chokidar-watcher-adapter.ts
@@ -2422,12 +2591,12 @@ var WatchCommand = class {
   ctxoRoot;
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
-    this.ctxoRoot = join14(projectRoot, ".ctxo");
+    this.ctxoRoot = join15(projectRoot, ".ctxo");
   }
   async run() {
     console.error("[ctxo] Starting file watcher...");
     const registry = new LanguageAdapterRegistry();
-    let roslynAdapter = null;
+    const keepAliveByExt = /* @__PURE__ */ new Map();
     for (const { plugin, adapter } of await loadPlugins(this.projectRoot)) {
       if (typeof adapter.initialize === "function") {
         try {
@@ -2438,15 +2607,12 @@ var WatchCommand = class {
         }
       }
       registry.register(plugin.extensions, adapter);
-      const csCandidate = adapter;
-      if (typeof csCandidate.getRoslynDelegate === "function") {
-        const roslyn = csCandidate.getRoslynDelegate();
-        if (roslyn?.isReady()) {
-          const started = await roslyn.startKeepAlive();
-          if (started) {
-            roslynAdapter = roslyn;
-            console.error("[ctxo] C# watch: Roslyn keep-alive active (full tier, <100ms per change)");
-          }
+      const capable = adapter;
+      if (typeof capable.getIncrementalReindex === "function") {
+        const cap = capable.getIncrementalReindex();
+        if (cap?.isReady() && await cap.startKeepAlive()) {
+          for (const ext of plugin.extensions) keepAliveByExt.set(ext.toLowerCase(), cap);
+          console.error(`[ctxo] ${plugin.id} watch: keep-alive active (full tier, fast incremental re-index)`);
         }
       }
       console.error(`[ctxo] Plugin ${plugin.id}@${plugin.version} (${plugin.tier} tier)`);
@@ -2467,8 +2633,9 @@ var WatchCommand = class {
       if (!adapter) return;
       const relativePath = relative2(this.projectRoot, filePath).replace(/\\/g, "/");
       try {
-        if (roslynAdapter?.isReady() && filePath.endsWith(".cs")) {
-          const result = await roslynAdapter.reindexFile(relativePath);
+        const cap = keepAliveByExt.get(extname4(filePath).toLowerCase());
+        if (cap?.isReady()) {
+          const result = await cap.reindexFile(relativePath);
           if (result) {
             const commits2 = await gitAdapter.getCommitHistory(relativePath);
             const intent2 = commits2.map((c) => ({
@@ -2504,7 +2671,7 @@ var WatchCommand = class {
             };
             writer.write(fileIndex2);
             storage.writeSymbolFile(fileIndex2);
-            console.error(`[ctxo] Re-indexed (Roslyn): ${relativePath}`);
+            console.error(`[ctxo] Re-indexed (keep-alive): ${relativePath}`);
             return;
           }
         }
@@ -2592,8 +2759,9 @@ var WatchCommand = class {
         clearTimeout(timeout);
       }
       if (communitySnapshotTimer) clearTimeout(communitySnapshotTimer);
-      const roslynShutdown = roslynAdapter ? roslynAdapter.dispose() : Promise.resolve();
-      roslynShutdown.then(() => {
+      const uniques = new Set(keepAliveByExt.values());
+      const shutdowns = Promise.all([...uniques].map((c) => c.dispose()));
+      shutdowns.then(() => {
         watcher.stop().then(() => {
           storage.close();
           console.error("[ctxo] Watcher stopped");
@@ -2637,21 +2805,21 @@ function readHeadSha() {
 }
 
 // src/cli/stats-command.ts
-import { join as join15 } from "path";
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
+import { join as join16 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
 import initSqlJs from "sql.js";
 var StatsCommand = class {
   ctxoRoot;
   constructor(projectRoot) {
-    this.ctxoRoot = join15(projectRoot, ".ctxo");
+    this.ctxoRoot = join16(projectRoot, ".ctxo");
   }
   async run(options) {
     if (!this.isStatsEnabled()) {
       console.error("[ctxo] Stats collection is disabled in .ctxo/config.yaml");
       return;
     }
-    const dbPath = join15(this.ctxoRoot, ".cache", "symbols.db");
-    if (!existsSync13(dbPath)) {
+    const dbPath = join16(this.ctxoRoot, ".cache", "symbols.db");
+    if (!existsSync14(dbPath)) {
       if (options.json) {
         process.stdout.write(JSON.stringify(this.emptyReport(options.days)) + "\n");
       } else {
@@ -2667,8 +2835,8 @@ var StatsCommand = class {
       if (options.clear) {
         recorder.clear();
         const data = db.export();
-        const { writeFileSync: writeFileSync6 } = await import("fs");
-        writeFileSync6(dbPath, Buffer.from(data));
+        const { writeFileSync: writeFileSync7 } = await import("fs");
+        writeFileSync7(dbPath, Buffer.from(data));
         console.error("[ctxo] Session data cleared.");
         return;
       }
@@ -2698,8 +2866,8 @@ var StatsCommand = class {
     }
   }
   isStatsEnabled() {
-    const configPath = join15(this.ctxoRoot, "config.yaml");
-    if (!existsSync13(configPath)) return true;
+    const configPath = join16(this.ctxoRoot, "config.yaml");
+    if (!existsSync14(configPath)) return true;
     try {
       const raw = readFileSync10(configPath, "utf-8");
       const match = raw.match(/stats:\s*\n\s*enabled:\s*(true|false)/);
@@ -2790,8 +2958,8 @@ var StatsCommand = class {
 };
 
 // src/cli/doctor-command.ts
-import { join as join22 } from "path";
-import { existsSync as existsSync20 } from "fs";
+import { join as join24 } from "path";
+import { existsSync as existsSync22 } from "fs";
 
 // src/adapters/diagnostics/health-checker.ts
 var log4 = createLogger("ctxo:doctor");
@@ -3126,10 +3294,111 @@ function pluginResolves(packageName) {
   }
 }
 
+// src/adapters/diagnostics/checks/java-tier-check.ts
+import { createRequire as createRequire7 } from "module";
+import { existsSync as existsSync15, readdirSync as readdirSync3 } from "fs";
+import { join as join17, dirname as dirname7 } from "path";
+var require4 = createRequire7(import.meta.url);
+function evaluateJavaTier(i) {
+  const id = "java_tier";
+  const title = "Java analysis tier";
+  if (!i.hasJava) {
+    return { id, title, status: "pass", message: "no Java sources detected" };
+  }
+  const jreOk = (i.jreMajor ?? 0) >= 17;
+  if (jreOk && i.analyzerInstalled) {
+    return { id, title, status: "pass", message: `full tier (JRE ${i.jreMajor}, analyzer installed)` };
+  }
+  if (jreOk && !i.analyzerInstalled) {
+    return {
+      id,
+      title,
+      status: "warn",
+      message: `syntax tier (JRE ${i.jreMajor} present, analyzer missing)`,
+      fix: 'Run "ctxo install java --full-tier" for resolved call/use edges'
+    };
+  }
+  if (!jreOk && i.analyzerInstalled) {
+    return {
+      id,
+      title,
+      status: "warn",
+      message: "syntax tier (analyzer installed but no JRE 17+)",
+      fix: "Install a JRE 17+ and ensure it is on PATH (or set JAVA_HOME)"
+    };
+  }
+  return {
+    id,
+    title,
+    status: "pass",
+    message: 'syntax tier (install JRE 17+ and run "ctxo install java --full-tier" for full tier)'
+  };
+}
+function analyzerJarPresent() {
+  try {
+    const pkgJson = require4.resolve("@ctxo/lang-java-analyzer/package.json");
+    const jarPath = join17(dirname7(pkgJson), "jar", "ctxo-jdt-analyzer.jar");
+    return existsSync15(jarPath);
+  } catch {
+    return false;
+  }
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "target",
+  "build",
+  "out",
+  "bin",
+  ".git",
+  ".ctxo",
+  "dist",
+  "coverage"
+]);
+function findJavaFile(root, maxDepth) {
+  function walk(dir, depth) {
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isFile() && entry.name.endsWith(".java")) return true;
+    }
+    if (depth >= maxDepth) return false;
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+        if (walk(join17(dir, entry.name), depth + 1)) return true;
+      }
+    }
+    return false;
+  }
+  return walk(root, 0);
+}
+function projectHasJava(root) {
+  for (const f of ["pom.xml", "build.gradle", "build.gradle.kts"]) {
+    if (existsSync15(join17(root, f))) return true;
+  }
+  return findJavaFile(root, 4);
+}
+var JavaTierCheck = class {
+  id = "java_tier";
+  title = "Java analysis tier";
+  async run(ctx) {
+    return evaluateJavaTier({
+      hasJava: projectHasJava(ctx.projectRoot),
+      jreMajor: detectJavaMajor(),
+      analyzerInstalled: analyzerJarPresent()
+    });
+  }
+};
+
 // src/adapters/diagnostics/checks/git-check.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { existsSync as existsSync14 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join18 } from "path";
 var GitBinaryCheck = class {
   id = "git_binary";
   title = "Git available";
@@ -3146,7 +3415,7 @@ var GitRepoCheck = class {
   id = "git_repo";
   title = "Git repository";
   async run(ctx) {
-    if (existsSync14(join16(ctx.projectRoot, ".git"))) {
+    if (existsSync16(join18(ctx.projectRoot, ".git"))) {
       return { id: this.id, title: this.title, status: "pass", message: ctx.projectRoot, value: ctx.projectRoot };
     }
     return { id: this.id, title: this.title, status: "fail", message: "Not a git repository", fix: 'Run "git init" or clone a repository' };
@@ -3154,9 +3423,9 @@ var GitRepoCheck = class {
 };
 
 // src/adapters/diagnostics/checks/index-check.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { execFileSync as execFileSync6 } from "child_process";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 function pass2(id, title, message, value) {
   return { id, title, status: "pass", message, value };
 }
@@ -3173,8 +3442,8 @@ var IndexDirectoryCheck = class {
   id = "index_directory";
   title = "Index directory";
   async run(ctx) {
-    const indexDir = join17(ctx.ctxoRoot, "index");
-    if (!existsSync15(indexDir)) {
+    const indexDir = join19(ctx.ctxoRoot, "index");
+    if (!existsSync17(indexDir)) {
       return fail(this.id, this.title, "No index directory", 'Run "ctxo index"');
     }
     const indices = getIndices(ctx);
@@ -3268,8 +3537,8 @@ var CoChangesCacheCheck = class {
   id = "co_changes_cache";
   title = "Co-changes cache";
   async run(ctx) {
-    const coChangesPath = join17(ctx.ctxoRoot, "index", "co-changes.json");
-    if (existsSync15(coChangesPath)) {
+    const coChangesPath = join19(ctx.ctxoRoot, "index", "co-changes.json");
+    if (existsSync17(coChangesPath)) {
       return pass2(this.id, this.title, "present");
     }
     return warn2(this.id, this.title, "missing (co-change analysis disabled)", 'Run "ctxo index" with git history');
@@ -3293,14 +3562,14 @@ var SchemaVersionCheck = class {
 };
 
 // src/adapters/diagnostics/checks/storage-check.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync11 } from "fs";
+import { join as join20 } from "path";
 var SqliteCacheCheck = class {
   id = "sqlite_cache";
   title = "SQLite cache";
   async run(ctx) {
-    const dbPath = join18(ctx.ctxoRoot, ".cache", "symbols.db");
-    if (!existsSync16(dbPath)) {
+    const dbPath = join20(ctx.ctxoRoot, ".cache", "symbols.db");
+    if (!existsSync18(dbPath)) {
       return { id: this.id, title: this.title, status: "warn", message: "SQLite cache missing", fix: 'Run "ctxo sync" to rebuild' };
     }
     try {
@@ -3322,14 +3591,14 @@ var SqliteCacheCheck = class {
 };
 
 // src/adapters/diagnostics/checks/config-check.ts
-import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync12 } from "fs";
+import { join as join21 } from "path";
 var ConfigFileCheck = class {
   id = "config_file";
   title = "Config file";
   async run(ctx) {
-    const configPath = join19(ctx.ctxoRoot, "config.yaml");
-    if (!existsSync17(configPath)) {
+    const configPath = join21(ctx.ctxoRoot, "config.yaml");
+    if (!existsSync19(configPath)) {
       return { id: this.id, title: this.title, status: "warn", message: "No config.yaml (using defaults)" };
     }
     try {
@@ -3367,8 +3636,8 @@ var ConfigFileCheck = class {
 };
 
 // src/adapters/diagnostics/checks/disk-check.ts
-import { existsSync as existsSync18, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { join as join22 } from "path";
 var DEFAULT_THRESHOLDS = { warnMb: 100, failMb: 500 };
 var DiskUsageCheck = class {
   id = "disk_usage";
@@ -3378,7 +3647,7 @@ var DiskUsageCheck = class {
     this.thresholds = thresholds;
   }
   async run(ctx) {
-    if (!existsSync18(ctx.ctxoRoot)) {
+    if (!existsSync20(ctx.ctxoRoot)) {
       return { id: this.id, title: this.title, status: "pass", message: "no .ctxo/ directory", value: "0" };
     }
     const bytes = this.getDirSize(ctx.ctxoRoot);
@@ -3395,12 +3664,12 @@ var DiskUsageCheck = class {
   getDirSize(dirPath) {
     let total = 0;
     try {
-      const entries = readdirSync3(dirPath, { withFileTypes: true, recursive: true });
+      const entries = readdirSync4(dirPath, { withFileTypes: true, recursive: true });
       for (const entry of entries) {
         if (entry.isFile()) {
           try {
             const parent = entry.parentPath ?? entry.path ?? dirPath;
-            total += statSync2(join20(parent, entry.name)).size;
+            total += statSync2(join22(parent, entry.name)).size;
           } catch {
           }
         }
@@ -3413,9 +3682,9 @@ var DiskUsageCheck = class {
 
 // src/cli/doctor-fix.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync6, rmSync as rmSync2, unlinkSync as unlinkSync2 } from "fs";
-import { createRequire as createRequire7 } from "module";
-import { dirname as dirname7, join as join21 } from "path";
+import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync6, rmSync as rmSync2, unlinkSync as unlinkSync2 } from "fs";
+import { createRequire as createRequire8 } from "module";
+import { dirname as dirname8, join as join23 } from "path";
 async function applyFixes(report, options) {
   if (isCI(process.env) && !options.yes && !options.dryRun) {
     return {
@@ -3550,8 +3819,8 @@ async function fixIndex(projectRoot, dryRun) {
 }
 async function pruneOrphans(projectRoot, ctxoRoot, dryRun) {
   if (dryRun) return;
-  const indexDir = join21(ctxoRoot, "index");
-  if (!existsSync19(indexDir)) return;
+  const indexDir = join23(ctxoRoot, "index");
+  if (!existsSync21(indexDir)) return;
   const sourceFiles = listGitFiles2(projectRoot);
   if (sourceFiles.size === 0) return;
   const reader = new JsonIndexReader(ctxoRoot);
@@ -3559,9 +3828,9 @@ async function pruneOrphans(projectRoot, ctxoRoot, dryRun) {
   let removed = 0;
   for (const idx of indices) {
     if (sourceFiles.has(idx.file)) continue;
-    const jsonPath = join21(indexDir, `${idx.file}.json`);
+    const jsonPath = join23(indexDir, `${idx.file}.json`);
     try {
-      if (existsSync19(jsonPath)) {
+      if (existsSync21(jsonPath)) {
         unlinkSync2(jsonPath);
         removed += 1;
         pruneEmptyParents(jsonPath, indexDir);
@@ -3572,14 +3841,14 @@ async function pruneOrphans(projectRoot, ctxoRoot, dryRun) {
   if (removed === 0) return;
 }
 function pruneEmptyParents(filePath, stopAt) {
-  let dir = dirname7(filePath);
+  let dir = dirname8(filePath);
   while (dir !== stopAt && dir.startsWith(stopAt)) {
     try {
       rmSync2(dir, { recursive: false });
     } catch {
       return;
     }
-    dir = dirname7(dir);
+    dir = dirname8(dir);
   }
 }
 function listGitFiles2(projectRoot) {
@@ -3595,12 +3864,12 @@ function listGitFiles2(projectRoot) {
   }
 }
 async function fixSqliteCache(projectRoot, ctxoRoot, dryRun) {
-  const cacheDir = join21(ctxoRoot, ".cache");
+  const cacheDir = join23(ctxoRoot, ".cache");
   if (dryRun) return;
-  if (existsSync19(cacheDir)) rmSync2(cacheDir, { recursive: true, force: true });
+  if (existsSync21(cacheDir)) rmSync2(cacheDir, { recursive: true, force: true });
   await new SyncCommand(projectRoot).run();
 }
-var doctorRequire = createRequire7(import.meta.url);
+var doctorRequire = createRequire8(import.meta.url);
 function canResolvePlugin(lang) {
   try {
     doctorRequire.resolve(`${officialPluginFor(lang)}/package.json`);
@@ -3614,8 +3883,8 @@ function isCI(env) {
 }
 function writeLog(ctxoRoot, attempts, halted, reason) {
   try {
-    if (!existsSync19(ctxoRoot)) mkdirSync6(ctxoRoot, { recursive: true });
-    const path = join21(ctxoRoot, "doctor-fix.log");
+    if (!existsSync21(ctxoRoot)) mkdirSync6(ctxoRoot, { recursive: true });
+    const path = join23(ctxoRoot, "doctor-fix.log");
     const ts = (/* @__PURE__ */ new Date()).toISOString();
     const lines = [`# ${ts} doctor --fix${halted ? " (halted: " + reason + ")" : ""}`];
     for (const a of attempts) {
@@ -3648,10 +3917,10 @@ var DoctorCommand = class {
   ctxoRoot;
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
-    this.ctxoRoot = join22(projectRoot, ".ctxo");
+    this.ctxoRoot = join24(projectRoot, ".ctxo");
   }
   async run(options = {}) {
-    const { getVersion: getVersion2 } = await import("./cli-router-CQJ7CN6E.js");
+    const { getVersion: getVersion2 } = await import("./cli-router-NFAGLJ46.js");
     console.error(`ctxo v${getVersion2()} \u2014 health check
 `);
     const checks = [
@@ -3666,6 +3935,7 @@ var DoctorCommand = class {
       new TsMorphCheck(),
       new TreeSitterCheck(),
       new LanguageCoverageCheck(),
+      new JavaTierCheck(),
       new DiskUsageCheck(),
       new SymbolCountCheck(),
       new EdgeCountCheck(),
@@ -3673,8 +3943,8 @@ var DoctorCommand = class {
       new CoChangesCacheCheck(),
       new SchemaVersionCheck()
     ];
-    const indexDir = join22(this.ctxoRoot, "index");
-    const indices = existsSync20(indexDir) ? new JsonIndexReader(this.ctxoRoot).readAll() : [];
+    const indexDir = join24(this.ctxoRoot, "index");
+    const indices = existsSync22(indexDir) ? new JsonIndexReader(this.ctxoRoot).readAll() : [];
     const checker = new HealthChecker(checks, { quiet: Boolean(options.quiet) });
     const report = await checker.runAll({
       projectRoot: this.projectRoot,
@@ -3715,36 +3985,35 @@ var DoctorCommand = class {
 };
 
 // src/cli/visualize-command.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync21 } from "fs";
-import { join as join23, basename } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync23 } from "fs";
+import { join as join25, basename } from "path";
 import { execFile } from "child_process";
+
+// src/cli/graph-loader.ts
+function loadGraph(ctxoRoot) {
+  const indices = new JsonIndexReader(ctxoRoot).readAll();
+  const graph = new SymbolGraph();
+  for (const fi of indices) for (const sym of fi.symbols) graph.addNode(sym);
+  for (const fi of indices) for (const edge of fi.edges) graph.addEdge(edge);
+  return { graph, indices };
+}
+
+// src/cli/visualize-command.ts
 var VisualizeCommand = class {
   constructor(projectRoot) {
     this.projectRoot = projectRoot;
-    this.ctxoRoot = join23(projectRoot, ".ctxo");
+    this.ctxoRoot = join25(projectRoot, ".ctxo");
   }
   projectRoot;
   ctxoRoot;
   async run(options = {}) {
-    const reader = new JsonIndexReader(this.ctxoRoot);
-    const indices = reader.readAll();
+    const { graph, indices } = loadGraph(this.ctxoRoot);
     if (indices.length === 0) {
       console.error('[ctxo] No index found. Run "ctxo index" first.');
       process.exit(1);
       return;
     }
     console.error(`[ctxo] Building graph from ${indices.length} files...`);
-    const graph = new SymbolGraph();
-    for (const fileIndex of indices) {
-      for (const sym of fileIndex.symbols) {
-        graph.addNode(sym);
-      }
-    }
-    for (const fileIndex of indices) {
-      for (const edge of fileIndex.edges) {
-        graph.addEdge(edge);
-      }
-    }
     console.error(`[ctxo] Graph: ${graph.nodeCount} symbols, ${graph.edgeCount} edges`);
     const pageRank = new PageRankCalculator();
     const prResult = pageRank.calculate(graph, { limit: 1e5 });
@@ -3876,7 +4145,7 @@ var VisualizeCommand = class {
     const templatePath = this.getTemplatePath();
     const template = readFileSync13(templatePath, "utf-8");
     const html = template.replace("/*__CTXO_DATA__*/null", JSON.stringify(payload));
-    const outputPath = options.output ?? join23(this.ctxoRoot, "visualize.html");
+    const outputPath = options.output ?? join25(this.ctxoRoot, "visualize.html");
     writeFileSync5(outputPath, html, "utf-8");
     console.error(`[ctxo] Wrote visualization to ${outputPath}`);
     console.error(`[ctxo] ${nodes.length} symbols, ${edges.length} edges, ${deadResult.deadSymbols.length} dead`);
@@ -3887,9 +4156,9 @@ var VisualizeCommand = class {
   getTemplatePath() {
     let dir = import.meta.dirname;
     for (let i = 0; i < 10; i++) {
-      const candidate = join23(dir, "pages", "visualize-template.html");
-      if (existsSync21(candidate)) return candidate;
-      const parent = join23(dir, "..");
+      const candidate = join25(dir, "pages", "visualize-template.html");
+      if (existsSync23(candidate)) return candidate;
+      const parent = join25(dir, "..");
       if (parent === dir) break;
       dir = parent;
     }
@@ -3913,8 +4182,8 @@ var VisualizeCommand = class {
 };
 
 // src/cli/update-command.ts
-import { existsSync as existsSync22, readFileSync as readFileSync14 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync14 } from "fs";
+import { join as join26 } from "path";
 
 // src/core/update/registry-client.ts
 import { request } from "https";
@@ -4232,8 +4501,8 @@ var UpdateCommand = class {
     return this.projectHasCtxoDep() ? "execute" : "print";
   }
   projectHasCtxoDep() {
-    const pkg = join24(this.projectRoot, "package.json");
-    if (!existsSync22(pkg)) return false;
+    const pkg = join26(this.projectRoot, "package.json");
+    if (!existsSync24(pkg)) return false;
     try {
       const json = JSON.parse(readFileSync14(pkg, "utf-8"));
       const merged = { ...json.dependencies ?? {}, ...json.devDependencies ?? {} };
@@ -4269,20 +4538,326 @@ function isLockedCI2(env) {
   return env["CI"] === "true" || env["CI"] === "1";
 }
 
+// src/cli/blast-radius-command.ts
+import { join as join27 } from "path";
+var BlastRadiusCommand = class {
+  ctxoRoot;
+  constructor(projectRoot) {
+    this.ctxoRoot = join27(projectRoot, ".ctxo");
+  }
+  run(options) {
+    const { graph } = loadGraph(this.ctxoRoot);
+    if (!graph.hasNode(options.symbolId)) {
+      process.stdout.write(JSON.stringify({ found: false, symbolId: options.symbolId }) + "\n");
+      return;
+    }
+    const result = new BlastRadiusCalculator().calculate(graph, options.symbolId);
+    const payload = {
+      found: true,
+      symbolId: options.symbolId,
+      directDependentsCount: result.directDependentsCount,
+      confirmedCount: result.confirmedCount,
+      likelyCount: result.likelyCount,
+      potentialCount: result.potentialCount,
+      overallRiskScore: result.overallRiskScore,
+      impactedSymbols: result.impactedSymbols.map((s) => ({
+        symbolId: s.symbolId,
+        confidence: s.confidence,
+        depth: s.depth
+      }))
+    };
+    process.stdout.write(JSON.stringify(payload) + "\n");
+  }
+};
+
+// src/cli/gate-hook-command.ts
+import { join as join29, relative as relative3, sep as sep2 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync16 } from "fs";
+
+// src/core/gate/gate-config.ts
+var DIAL = {
+  strict: { percentile: 30, minDependents: 2 },
+  balanced: { percentile: 15, minDependents: 3 },
+  lenient: { percentile: 5, minDependents: 5 }
+};
+function resolveGateThresholds(gate) {
+  const dial = DIAL[gate?.sensitivity ?? "balanced"];
+  return {
+    enabled: gate?.enabled ?? true,
+    percentile: gate?.percentile ?? dial.percentile,
+    minDependents: gate?.minDependents ?? dial.minDependents
+  };
+}
+
+// src/core/gate/symbol-locator.ts
+function lineOfSnippet(source, snippet) {
+  const idx = source.indexOf(snippet);
+  if (idx === -1) return null;
+  let line = 0;
+  for (let i = 0; i < idx; i++) {
+    if (source.codePointAt(i) === 10) line++;
+  }
+  return line;
+}
+function locateSymbolAtLine(fileIndex, line) {
+  let best = null;
+  for (const s of fileIndex.symbols) {
+    if (line >= s.startLine && line <= s.endLine) {
+      const span = s.endLine - s.startLine;
+      if (best === null || span < best.span) best = { id: s.symbolId, span };
+    }
+  }
+  return best?.id ?? null;
+}
+
+// src/core/gate/transcript-scan.ts
+function fileAndName(symbolId) {
+  const [file, name] = symbolId.split("::");
+  return `${file}::${name}`;
+}
+function transcriptHasBlastCheck(lines, symbolId) {
+  const target = fileAndName(symbolId);
+  for (const line of lines) {
+    if (!line.includes("get_blast_radius")) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const content = entry?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      const b = block;
+      if (b?.type === "tool_use" && typeof b.name === "string" && b.name.includes("get_blast_radius")) {
+        const id = b.input?.symbolId;
+        if (typeof id === "string" && fileAndName(id) === target) return true;
+      }
+    }
+  }
+  return false;
+}
+
+// src/adapters/gate/gate-session-store.ts
+import { existsSync as existsSync25, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "fs";
+import { join as join28 } from "path";
+var log7 = createLogger("ctxo:gate-store");
+var GateSessionStore = class {
+  constructor(cacheDir) {
+    this.cacheDir = cacheDir;
+  }
+  cacheDir;
+  file(sessionId) {
+    const safe = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join28(this.cacheDir, "gate", `${safe}.json`);
+  }
+  read(sessionId) {
+    const f = this.file(sessionId);
+    if (!existsSync25(f)) return /* @__PURE__ */ new Set();
+    try {
+      return new Set(JSON.parse(readFileSync15(f, "utf-8")));
+    } catch (err) {
+      log7.error(`${err.message}`);
+      return /* @__PURE__ */ new Set();
+    }
+  }
+  hasWarned(sessionId, symbolId) {
+    return this.read(sessionId).has(symbolId);
+  }
+  recordWarned(sessionId, symbolId) {
+    try {
+      const set = this.read(sessionId);
+      set.add(symbolId);
+      const f = this.file(sessionId);
+      mkdirSync7(join28(this.cacheDir, "gate"), { recursive: true });
+      writeFileSync6(f, JSON.stringify([...set]), "utf-8");
+    } catch (err) {
+      log7.error(`${err.message}`);
+    }
+  }
+};
+
+// src/core/gate/percentile.ts
+function percentileCutoff(scores, topPercent) {
+  if (scores.length === 0) return Infinity;
+  const sorted = [...scores].sort((a, b) => a - b);
+  const rank = Math.ceil((100 - topPercent) / 100 * sorted.length);
+  const idx = Math.min(Math.max(rank, 0), sorted.length - 1);
+  return sorted[idx];
+}
+
+// src/core/gate/gate-decision.ts
+var MAX_TOP_DEPENDENTS = 8;
+function shouldBlock(input, t) {
+  if (!t.enabled) return false;
+  return input.riskCount >= t.minDependents && input.importanceScore >= input.importanceCutoff;
+}
+function formatBlockReason(symbolName, riskCount, topDependents) {
+  const list = topDependents.slice(0, MAX_TOP_DEPENDENTS).map((d) => `  - ${d}`).join("\n");
+  return [
+    `\u26A0 ctxo guard: "${symbolName}" is a high-impact symbol - ${riskCount} confirmed/likely dependents may break.`,
+    topDependents.length > 0 ? `Top dependents:
+${list}` : "",
+    `Call get_blast_radius / get_why_context before editing. This guard fires once per symbol per session - re-issue the edit to proceed.`
+  ].filter(Boolean).join("\n");
+}
+
+// src/cli/gate-hook-command.ts
+var log8 = createLogger("ctxo:gate-hook");
+var RANK_ALL = 1e5;
+var GateHookCommand = class {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+    this.ctxoRoot = join29(projectRoot, ".ctxo");
+    this.cacheDir = join29(this.ctxoRoot, ".cache");
+  }
+  projectRoot;
+  ctxoRoot;
+  cacheDir;
+  /** Pure-ish decision: never throws (fail-open). */
+  evaluate(payload) {
+    try {
+      if (payload.tool_name !== "Edit") return { block: false };
+      const filePath = payload.tool_input?.file_path;
+      const oldString = payload.tool_input?.old_string;
+      if (!filePath || !oldString) return { block: false };
+      const loaded = loadConfig(this.ctxoRoot);
+      const thresholds = resolveGateThresholds(loaded.config.gate);
+      if (!thresholds.enabled) return { block: false };
+      const relPath = relative3(this.projectRoot, filePath).split(sep2).join("/");
+      const indexFile = join29(this.ctxoRoot, "index", `${relPath}.json`);
+      if (!existsSync26(indexFile)) return { block: false };
+      const fileIndex = new JsonIndexReader(this.ctxoRoot).readSingle(indexFile);
+      if (!fileIndex) return { block: false };
+      if (!existsSync26(filePath)) return { block: false };
+      const source = readFileSync16(filePath, "utf-8");
+      const line = lineOfSnippet(source, oldString);
+      if (line === null) return { block: false };
+      const symbolId = locateSymbolAtLine(fileIndex, line);
+      if (!symbolId) return { block: false };
+      const store = new GateSessionStore(this.cacheDir);
+      if (store.hasWarned(payload.session_id, symbolId)) return { block: false };
+      if (payload.transcript_path && existsSync26(payload.transcript_path)) {
+        const lines = readFileSync16(payload.transcript_path, "utf-8").split("\n").filter(Boolean);
+        if (transcriptHasBlastCheck(lines, symbolId)) return { block: false };
+      }
+      const { graph } = loadGraph(this.ctxoRoot);
+      if (!graph.hasNode(symbolId)) return { block: false };
+      const blast = new BlastRadiusCalculator().calculate(graph, symbolId);
+      const riskCount = blast.confirmedCount + blast.likelyCount;
+      const pr = new PageRankCalculator().calculate(graph, { limit: RANK_ALL });
+      const prMap = new Map(pr.rankings.map((r) => [r.symbolId, r.score]));
+      const cutoff = percentileCutoff([...prMap.values()], thresholds.percentile);
+      const importanceScore = prMap.get(symbolId) ?? 0;
+      const block = shouldBlock({ riskCount, importanceScore, importanceCutoff: cutoff }, thresholds);
+      if (!block) return { block: false };
+      store.recordWarned(payload.session_id, symbolId);
+      const name = symbolId.split("::")[1] ?? symbolId;
+      const top = blast.impactedSymbols.filter((s) => s.confidence !== "potential").map((s) => s.symbolId);
+      return { block: true, reason: formatBlockReason(name, riskCount, top) };
+    } catch (err) {
+      log8.error(`${err.message}`);
+      return { block: false };
+    }
+  }
+  async run() {
+    try {
+      const payload = await this.readStdin();
+      if (payload) {
+        const decision = this.evaluate(payload);
+        if (decision.block) this.emitBlock(decision.reason ?? "ctxo guard");
+      }
+    } catch (err) {
+      log8.error(`${err.message}`);
+    }
+    process.exit(0);
+  }
+  /** PreToolUse block contract (verified): exit 0 + stdout JSON deny. */
+  emitBlock(reason) {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    }) + "\n");
+    process.exit(0);
+  }
+  readStdin() {
+    return new Promise((resolve4) => {
+      let data = "";
+      process.stdin.setEncoding("utf-8");
+      process.stdin.on("data", (c) => {
+        data += c;
+      });
+      process.stdin.on("end", () => {
+        try {
+          resolve4(JSON.parse(data));
+        } catch {
+          resolve4(null);
+        }
+      });
+      process.stdin.on("error", () => resolve4(null));
+    });
+  }
+};
+
+// src/cli/gate-command.ts
+import { join as join30 } from "path";
+var RANK_ALL2 = 1e5;
+var GateCommand = class {
+  ctxoRoot;
+  constructor(projectRoot) {
+    this.ctxoRoot = join30(projectRoot, ".ctxo");
+  }
+  preview(options = {}) {
+    const gate = loadConfig(this.ctxoRoot).config.gate;
+    const thresholds = resolveGateThresholds(gate);
+    const { graph } = loadGraph(this.ctxoRoot);
+    const pr = new PageRankCalculator().calculate(graph, { limit: RANK_ALL2 });
+    const prMap = new Map(pr.rankings.map((r) => [r.symbolId, r.score]));
+    const cutoff = percentileCutoff([...prMap.values()], thresholds.percentile);
+    const calc = new BlastRadiusCalculator();
+    const firing = [];
+    for (const [symbolId, importance] of prMap) {
+      if (importance < cutoff) continue;
+      const blast = calc.calculate(graph, symbolId);
+      const riskCount = blast.confirmedCount + blast.likelyCount;
+      if (shouldBlock({ riskCount, importanceScore: importance, importanceCutoff: cutoff }, thresholds)) {
+        firing.push({ symbolId, riskCount, importance: Math.round(importance * 1e4) / 1e4 });
+      }
+    }
+    firing.sort((a, b) => b.riskCount - a.riskCount);
+    const payload = {
+      sensitivity: gate?.sensitivity ?? "balanced",
+      thresholds,
+      totalSymbols: graph.nodeCount,
+      wouldFireCount: firing.length,
+      symbols: firing.slice(0, 50)
+    };
+    if (options.json) {
+      process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+      return;
+    }
+    console.error(`[ctxo] gate preview (${payload.sensitivity}): ${firing.length}/${graph.nodeCount} symbols would gate.`);
+    for (const f of firing.slice(0, 25)) console.error(`  ${f.riskCount} dep  ${f.symbolId}`);
+  }
+};
+
 // src/cli/cli-router.ts
 function getVersion() {
   let dir = import.meta.dirname;
   for (let i = 0; i < 10; i++) {
-    const pkg = join25(dir, "package.json");
-    if (existsSync23(pkg)) {
+    const pkg = join31(dir, "package.json");
+    if (existsSync27(pkg)) {
       try {
-        const json = JSON.parse(readFileSync15(pkg, "utf-8"));
+        const json = JSON.parse(readFileSync17(pkg, "utf-8"));
         return json.version ?? "unknown";
       } catch {
         break;
       }
     }
-    const parent = join25(dir, "..");
+    const parent = join31(dir, "..");
     if (parent === dir) break;
     dir = parent;
   }
@@ -4291,8 +4866,8 @@ function getVersion() {
 function locateGitRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 12; i++) {
-    if (existsSync23(join25(dir, ".git"))) return dir;
-    const parent = dirname8(dir);
+    if (existsSync27(join31(dir, ".git"))) return dir;
+    const parent = dirname9(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -4409,6 +4984,8 @@ var CliRouter = class {
           else if (a === "--global" || a === "-g") flagValues["global"] = true;
           else if (a === "--dry-run") flagValues["dryRun"] = true;
           else if (a === "--force") flagValues["force"] = true;
+          else if (a === "--full-tier") flagValues["fullTier"] = true;
+          else if (a === "--syntax-only") flagValues["syntaxOnly"] = true;
           else if (a === "--pm") {
             const next = args[++i];
             if (!next) {
@@ -4439,6 +5016,8 @@ var CliRouter = class {
           global: flagValues["global"] === true,
           dryRun: flagValues["dryRun"] === true,
           force: flagValues["force"] === true,
+          fullTier: flagValues["fullTier"] === true,
+          syntaxOnly: flagValues["syntaxOnly"] === true,
           pm: typeof flagValues["pm"] === "string" ? flagValues["pm"] : void 0,
           version: typeof flagValues["version"] === "string" ? flagValues["version"] : void 0
         });
@@ -4481,6 +5060,28 @@ var CliRouter = class {
         });
         break;
       }
+      case "gate": {
+        if (args.includes("--preview")) {
+          new GateCommand(this.projectRoot).preview({ json: args.includes("--json") });
+        } else {
+          console.error("[ctxo] usage: ctxo gate --preview [--json]");
+          process.exit(1);
+        }
+        break;
+      }
+      case "gate-hook":
+        await new GateHookCommand(this.projectRoot).run();
+        break;
+      case "blast-radius": {
+        const symbolId = args[1];
+        if (!symbolId || symbolId.startsWith("--")) {
+          console.error("[ctxo] usage: ctxo blast-radius <symbolId> [--json]");
+          process.exit(1);
+          return;
+        }
+        new BlastRadiusCommand(this.projectRoot).run({ symbolId, json: args.includes("--json") });
+        break;
+      }
       case "visualize": {
         const outputIdx = args.indexOf("--output");
         const outputArg = outputIdx !== -1 ? args[outputIdx + 1] : void 0;
@@ -4535,6 +5136,9 @@ Usage:
   ctxo update --json       Machine-readable output
   ctxo update --pm <pm>    Override package manager (npm|pnpm|yarn|bun)
   ctxo update --force      Bypass CI lockfile guard
+  ctxo blast-radius <symbolId>   Blast radius for one symbol (--json for machine output)
+  ctxo gate --preview            Preview which symbols the safe-edit guard would block
+  ctxo gate --preview --json     Same, machine-readable output
   ctxo --version                 Print core version
   ctxo --version --verbose       Print core + plugins + runtime
   ctxo --version --json          Machine-readable version payload
@@ -4548,4 +5152,4 @@ export {
   getVersion,
   locateGitRoot
 };
-//# sourceMappingURL=cli-router-CQJ7CN6E.js.map
+//# sourceMappingURL=cli-router-NFAGLJ46.js.map