Bug-fix and feature release: Ruby type-aware call resolution, workspace exports-map resolution, the alias/workspace import-edge regression fix (#1529), tsconfig paths fallbacks, semantic-cache pruning, three Objective-C extractor fixes, Swift static-call confidence, and security dep bumps.

• Feat: type-aware Ruby member-call resolution (#1499, thanks @vamsipavanmahesh). p.run is now resolved by the inferred type of the receiver (p = Processor.new ⇒ Processor#run) instead of by globally-unique method name, so the edge survives name collisions (an unrelated Worker#run no longer makes it ambiguous) and never points at the wrong method. Introduces a small resolver-registry framework that the existing Swift (#1356) and Python (#1446) cross-file passes register into. Receiver types are inferred only from unambiguous local var = ClassName.new bindings; a call whose receiver type can't be proven resolves to nothing rather than to a guess — a deliberate precision-over-recall change for Ruby member calls.
• Feat: resolve workspace imports through the package's exports map (#1308, thanks @guyoron1). A subpath import like import { x } from "@scope/pkg/browser" now resolves through the package.json exports map (string values, condition objects, nested conditions, and ./* wildcard patterns) instead of falling back to a bare path string, falling back to the existing bare-path/index resolution when there's no exports map or no match. default is consulted last (Node's catch-all), and an export target that escapes the package directory is rejected.
• Fix: import edges silently dropped on codebases using tsconfig path aliases or workspace packages (#1529), a regression from the 0.9.0 full-repo-relative node-ID change. Relative imports resolve to repo-relative paths and matched fine, but alias (@/lib/utils) and workspace imports resolve to absolute paths, so the import-target ID baked in the on-disk prefix and no longer matched the repo-relative definition node — the edge was dropped at build (common on Next.js/SvelteKit). The id-remap post-pass now also registers the absolute-resolved form, so alias/workspace import targets land on the real node again.
• Fix: tsconfig compilerOptions.paths fallback targets are now honored (#1531, thanks @oleksii-tumanov). A paths value is an ordered list ("@app/*": ["src/app/*", "lib/app/*"]) that tsc tries in turn; graphify kept only the first entry, so an import whose file lived at a later target was dropped or misresolved. Each target is now tried in order and the first that resolves to a real file wins (no false edge when none exist).
• Fix: the semantic (LLM) extraction cache is now pruned (#1527, thanks @mwolter805). The AST cache was version-swept but the content-hash-keyed semantic cache had no cleanup, so every content change or file deletion left an orphan entry and graphify-out/cache/semantic/ grew unbounded. Orphan entries are now removed at the end of extract, computed against the full live document set (not the incremental changed subset, which would have evicted still-valid entries) and only touching cache/semantic/; the cache stays unversioned so releases never re-bill LLM extraction.
• Fix: three Objective-C extractor bugs (#1475, thanks @JabberYQ for the detailed report and test repo). (1) .h headers using NS_ASSUME_NONNULL_BEGIN before @interface produced no class node — tree-sitter-objc can't expand the argument-less macro and fails to emit a class_interface node at all, so the macro is now blanked (offset-preserving) before parsing. (2) Quoted #import "X.h" edges dangled once a .h/.m pair existed (the bare-stem target was salted away during id-disambiguation); imports now resolve to the real header file node, fixing the equivalent latent C #include bug too. (3) [[Foo alloc] init] now emits a references edge to the allocated class, resolved only to an unambiguous class (no false edges). Dot-syntax property accesses and @selector(...) target-action edges remain follow-ups.
• Fix: Swift type-qualified static calls now resolve as EXTRACTED rather than INFERRED (#1533, thanks @JabberYQ). SessionType.staticMethod() / Singleton.shared.method() name the receiver type explicitly in source, so the resolved edge is an exact reference, matching the Python qualified-class-method pass; instance calls typed via local inference (obj.method()) stay INFERRED.
• Fix: enforce the API timeout in the secondary LLM dispatch path (#1442, thanks @DhruvTilva). _call_llm (used by the dedup LLM tiebreaker) built its Anthropic/OpenAI clients without timeout, so requests there ignored GRAPHIFY_API_TIMEOUT and could hang — it now passes the timeout like the primary extraction paths.
• Fix: to_graphml no longer raises ValueError on a node/edge with a None attribute value — null fields are coerced to "" before writing (#1502, thanks @antonioscarinci).
• Feat: graphify save-result accepts --answer-file as an alternative to --answer, so a long or multi-line answer can be read from a file instead of an inline shell argument (#1502, thanks @antonioscarinci).
• Fix: generated install/skill guidance is now host-generic (#1530, thanks @ari-mitophane). The wording no longer tells agents to invoke a literal skill tool with skill: "graphify" (host-specific and invalid in many environments); it now points to the installed graphify skill or instructions.
• Security: bump msgpack to 1.2.1 (GHSA-6v7p-g79w-8964) and pydantic-settings to 2.14.2 (GHSA-4xgf-cpjx-pc3j), and drop the unused safety dev dependency, which only pulled in nltk (an unpatched HIGH advisory). All transitive; the two HIGH-severity ones were dev-tooling only and never in the published wheel. pip-audit (already run in CI) continues to provide dependency-CVE scanning.

Patch release over 0.9.0 — node-ID hardening, incremental-update correctness, rate-limit resilience, and Java extraction. All non-breaking; no re-migration.

• Fix: rate-limited (HTTP 429) extraction chunks are now retried instead of dropped (#1523, thanks @bercedev). The provider SDKs back off and honor Retry-After, but the SDK default of 2 retries was too low for strict per-org concurrency/RPM caps (e.g. Moonshot/kimi), so a parallel extract 429'd, each chunk logged chunk N failed, and was silently lost (incomplete graph + console spam). The OpenAI-compatible, Azure, and Anthropic clients are now built with a higher max_retries (default 6, override via GRAPHIFY_MAX_RETRIES). For very tight accounts, --max-concurrency 1 further reduces the concurrency that triggers org-level limits.
• Fix: graphify update now prunes the edges a re-extracted file no longer produces (#1521, thanks @UltronOfSpace). Old edges were preserved by endpoint-node membership alone, so a deleted import's edge survived forever as long as both endpoints still existed — driving phantom circular-dependency findings (and --force didn't help). Edges owned by a re-extracted file (source_file) are dropped before merging the fresh extraction; cross-file edges that merely point at the file are untouched.
• Fix: residual node-ID collisions after the 0.9.0 full-path change (#1522, thanks @sub4biz). normalize_id collapses every separator to _, so distinct paths that differ only by a separator-vs-punctuation swap (foo/bar_baz.py vs foo_bar/baz.py) still merged. Colliders are now salted with a short stable path hash so they stay distinct; non-colliding IDs are byte-identical to 0.9.0 (no re-migration).
• Fix: Java record component types now emit references edges (#1519, thanks @oleksii-tumanov) — a record's data dependencies (record Order(Payload p, List<Item> items, …)) were invisible; primitives and the record's own type parameters are skipped.
• Fix: same-label cross-file imported-type stubs now stay distinct in the six dedicated extractors too — Julia, Fortran, Go, Rust, PowerShell, ObjC (#1515, thanks @TPAteeq). The #1462 disambiguation previously only covered the generic extractor, so e.g. two Go files importing the same ext.Widget collapsed into one conflated node; they're now kept distinct (while source_file stays empty so the #1402 rewire onto a real definition is unchanged).
• Fix: Java type parameters no longer emit spurious references edges (#1518, thanks @oleksii-tumanov). The generic-parent support (#1511) created a stray edge/stub for the bare T in class Box<T> extends Container<T>; the extractor now collects in-scope type-parameter names (class/interface/record/method/constructor, incl. bounded/multiple) and skips them, while keeping every real type and the inherits/implements edge to the base.
• Fix: the internal origin_file disambiguation field (#1462) is no longer serialized into graph.json, where it had shipped (in 0.9.0) as an absolute, machine-specific path — it is dropped once the colliding-id pass consumes it, keeping output portable (#1516, thanks @TPAteeq; cf. #555, #932). _origin stays (the incremental watcher needs it, #1116).

⚠️ Breaking change — node IDs changed

Node IDs now include the full repo-relative path, fixing silent data loss when same-named files live in different directories. Existing graphs migrate automatically on the next build/update (no LLM re-bill). Run graphify extract --force to recover nodes that previously collided. If you push to a persisted Neo4j store, re-import after upgrading; GraphML/Gephi layouts go stale; query by label rather than persisting node IDs.

• Breaking — node IDs now include the full repo-relative path (#1504, #1509). The node-ID stem was the immediate parent dir + filename, so same-named files in different directories collided into one last-writer-wins node and silently dropped graph content (docs/v1/api/README.md and docs/v2/api/README.md both → api_readme). The stem is now the full repo-relative path (docs_v1_api_readme vs docs_v2_api_readme); top-level files are unchanged (setup.py → setup). The AST extractor, the LLM system prompt, the extraction-spec, and the two hand-copied stem helpers are all aligned to this one rule (fixing the #1509 AST↔LLM divergence that produced ghost duplicates), and build_from_json deterministically re-keys any cached/older semantic fragment onto the new IDs from its source_file so the unversioned semantic cache survives without ghosts or a re-bill. Existing graphs migrate to the new ID format automatically on the next build/update (no re-bill). Note: same-named files in different directories that previously collided into one node are only recovered as distinct nodes by a fresh extraction — run graphify extract --force to rebuild and gain them (migrating an already-collided graph/cache can't resurrect the nodes that were already dropped). If you push to a persisted Neo4j store, re-import after upgrading (re-exported IDs change); saved Gephi/yEd (GraphML) layouts go stale; MCP/cypher consumers should query by label rather than persisting node IDs across rebuilds.
• Feat: --timing flag on graphify extract and graphify cluster-only prints per-stage wall-clock timings to stderr (#1490). Shows how long each pipeline stage takes — extract: detect → AST → semantic → build → cluster → analyze → export; cluster-only: load → cluster → analyze → label → report → export — plus a final total, so slow stages are visible on large corpora. Off by default (monotonic perf_counter, stderr-only); machine-read stdout / graph.json are unchanged.

• Fix: the Obsidian export (--obsidian / to_obsidian) no longer overwrites a user's own notes or .obsidian/ config when pointed at an existing vault (#1506). It wrote one note per node straight into the target dir and unconditionally replaced .obsidian/graph.json, so --obsidian-dir ~/my-vault could clobber a same-named note (Database.md) and the user's graph-view settings — silently, no backup. graphify now records the files it owns in a .graphify_obsidian_manifest.json and refuses to overwrite any pre-existing file it didn't create (skipping it with one aggregated warning); a re-run still updates graphify's own notes. The default graphify-out/obsidian output is unchanged.
• Fix: Java enum and annotation (@interface) declarations are now emitted as type nodes (#1512, thanks @oleksii-tumanov), so a field typed as an enum or a class annotated with a project annotation resolves to a real node instead of a dangling reference.
• Fix: Java generic parent relationships are no longer dropped (#1510, thanks @oleksii-tumanov) — class Foo extends Bar<T> / implements List<T> now emit the inherits/implements edge to the base type, with the type arguments as generic_arg references.
• Fix: the claude-cli backend no longer crashes with UnicodeDecodeError on Windows systems where claude.cmd emits GBK/cp936 bytes (#1505, thanks @nuthalapativarun) — both subprocess calls decode with errors="replace".
• Fix: graphify explain and graphify affected now resolve a query given as a source-file path even when the graph has multiple nodes from that file (#1503, thanks @behavio1). A path like app/api/route.ts tokenized to terms that matched no node, so explain returned "No node matching"; source-file paths are now indexed and matched exactly, and when several nodes share the file the lookup prefers the file-level node (the L1 node whose name matches the file). Trailing-separator handling is aligned between the two commands.
• Docs: clearer install/PATH guidance for uv tool install graphifyy on macOS (#1471, thanks @Patsch36). Two expected uv behaviors read as bugs: (1) after uv tool install, the graphify command lands in uv's tool bin dir (~/.local/bin), which a fresh macOS/zsh shell often doesn't have on PATH — the README now points to uv tool update-shell instead of implying uv always wires PATH; (2) uvx graphify … / uv tool run graphify … resolve the first word as a package and fail, because the package is graphifyy and graphify is only its console script — the docs now show uvx --from graphifyy graphify install. README install note + Troubleshooting only; no code change.
• Fix: imported type stubs with the same label no longer falsely merge across files when there is no project definition to rewire onto (#1462, thanks @jiangyq9). Two files that both from pathlib import Path and use Path as a type previously collapsed into one node; the referencing file is now kept as an internal disambiguator (origin_file) used only when splitting colliding ids, while source_file stays empty so a real project definition can still be rewired onto (the #1402 path is unaffected).
• Feat: resolve C# cross-file type references and extract enum/struct/record declarations (#1466, thanks @TheFedaikin). A new _resolve_csharp_type_references (the C# counterpart to the Java resolver) re-points dangling inherits/implements/references edges from no-source "shadow" stubs to their real definitions, disambiguating same-named types in different namespaces via the referencing file's using directives and enclosing namespace; ambiguous matches are refused rather than guessed. enum/struct/record types are now extracted as definitions so those references resolve too. Advances #1318 for C#.
• Fix: the Go AST extractor no longer creates phantom duplicate nodes for cross-file type references — the Go copy of ensure_named_node still used the older sourced-stub fallback; it now emits a sourceless stub like the other extractors, extending the #1402 fix to Go (#1500, thanks @TPAteeq).

• Feat: graphify label --missing-only relabels only communities that are unnamed or still hold a Community N placeholder, preserving existing non-placeholder labels from .graphify_labels.json (#1481, thanks @jiangyq9; supersedes #1421 by @matiasduartee, who proposed the same flag). Lets a large graph be relabeled incrementally without re-naming (and paying for) communities that already have good names.
• Feat: index Metal (.metal) shader files — Metal Shading Language is C++14, so .metal is classified as code and routed through the existing C++ extractor, mirroring the CUDA .cu/.cuh reuse (#1480, thanks @jiangyq9; supersedes #1450 by @GoodOlClint). Also adds .cu/.cuh/.metal to the cross-language edge-filter family map (they were missing), so phantom cross-language calls edges between these and C++ are correctly suppressed.
• Fix: pass stream: False explicitly on OpenAI-compatible chat-completion calls (#1223, thanks @jiangyq9). Some gateways default to SSE streaming when stream is omitted, but graphify always reads the result as a single response, so the call failed against those gateways. Applied to both the extraction dispatch path and the --dedup-llm tiebreaker path.
• Fix: emit references edges for Java field types (#1485) and for type-level annotations on Java classes/interfaces/records (#1487, both thanks @oleksii-tumanov). Field types (including the generic_arg element of List<Handler>) and class annotations (@Service, @Entity) were missing from the graph even though parameter/return types and method annotations were already captured; primitives are still skipped.
• Fix: the Objective-C extractor was silently dropping most code-level relationships (#1475, thanks @JabberYQ for the detailed report). Five fixes: (1) ObjC .h headers were parsed by the C extractor (1 node, 0 edges, losing every @interface/@protocol/@property/method) — a .h is now routed to the ObjC extractor when it contains an ObjC-only directive (@interface/@protocol/@implementation/@import), which never hijacks a real C/C++ header; (2) [receiver selector] calls produced no calls edges at all because the method-body pass looked for selector/keyword_argument_list nodes, but the grammar tags selector parts with the field name method (type identifier) — the selector is now read from the method fields, skipping the receiver, which also makes compound sends like [self a:x b:y] resolve; (3) generic property types (NSArray<Product *> *) were invisible because the type was wrapped in a generic_specifier — the element and container types are now both referenced; (4) class methods (+foo) were mislabeled -foo; (5) @import Foundation; now produces an imports edge. Property/dot-syntax accesses and @selector(...) target-action edges remain follow-ups.
• Feat: link WPF/XAML views to their ViewModels and extract richer binding references (#1473, thanks @MikeKatsoulakis). Builds on the initial XAML support (#1460). Resolves a view to its ViewModel from an explicit <Window.DataContext><vm:MainViewModel/>, a design-time d:DataContext="{d:DesignInstance Type=…}", the View→ViewModel naming convention, or Prism ViewModelLocator.AutoWireViewModel="True" — always against an actually-extracted C# class, so a name with no matching class (or an ambiguous one) emits no edge (explicit DataContext is EXTRACTED, conventions are INFERRED). Also extracts binding paths ({Binding User.Name}, Path=Order.Total), commands (Command="{Binding SaveCommand}"), converters, and CommunityToolkit [ObservableProperty]/[RelayCommand] generated members. The event-handler resolution stays gated on the .NET handler signature (no spurious event edges), and ViewModel discovery is bounded to the extraction root.
• Fix: .vue Single File Components now extract their <script> with the right grammar (#1468, thanks @papinto). .vue was dispatched to extract_js, which selects a tree-sitter grammar by suffix; .vue is neither .ts nor .tsx, so the whole SFC — <template> markup, <script>, and <style> — was parsed as JavaScript, producing a top-level ERROR node and recovering no imports, symbols, or type references. A dedicated extract_vue now masks everything outside <script> (replacing it with spaces so line numbers stay accurate) and parses just the script with the grammar named by lang (ts default, tsx/js/jsx honored). The open-tag scan tolerates > inside quoted attributes, so Vue 3.3+ generic components (generic="T extends Record<string, unknown>") parse correctly.
• Fix: graphify reflect --if-stale now also checks the .graphify_analysis.json and .graphify_labels.json sidecars (and any custom --analysis/--labels paths) when deciding whether LESSONS.md is up to date (#1470, thanks @oleksii-tumanov). It previously only stat'd the memory docs and graph.json, so lessons could stay stale after community analysis or labels changed without the graph changing. A missing sidecar is treated as not-an-input, so no-cluster builds are unaffected.
• Fix: the Read|Glob PreToolUse hook (the "run graphify first" nudge installed for Claude Code and CodeBuddy) now matches the file's real trailing extension instead of substring-scanning the path (#1463, thanks @marketechniks). The old check asked any(ext in path), which had two opposite failures: .json files (package.json, tsconfig.json) spuriously fired because .js is a substring of .json, and .astro/.vue/.svelte never fired because they weren't in the set — so on Astro/Vue/Svelte projects, where those are the primary source type, reads and globs never surfaced the graph. The hook now compares the segment after the last / then after the last . against the extension set (with .astro/.vue/.svelte added), so package.json stays silent, data.geojson stays silent, **/*.astro fires, and an extension sitting on a directory component (my.ts/file) correctly doesn't. The graphify-out/ suppression and fail-open behavior are unchanged.
• Fix: make it unambiguous in the skill that graphify needs no API key, so terminal-style hosts stop looping on a missing one (#1461). Hermes (and the other AGENTS.md hosts: Codex, Aider, OpenClaw, Droid, Trae, …) run the graphify CLI directly and don't dispatch subagents, but the Step 3 extraction guidance framed the no-key path only as "fall through to subagent dispatch" — so on /graphify . those agents would spin for minutes insisting they needed an API key before eventually proceeding. Step 3 now opens with an explicit, hoisted "graphify needs no API key — never ask the user for one, never block on one" statement (code is AST-only; a code-only corpus skips semantic extraction entirely), and the fallback now spells out a non-subagent path for terminal hosts instead of assuming subagent dispatch. Applied across every generated skill body, including the aider/devin monoliths, with a regression test that pins the wording in place.
• Feat: extract WPF/XAML structure from .xaml files (#1460, thanks @MikeKatsoulakis). No new parser dependency (stdlib XML, with the same DOCTYPE/ENTITY and size guards as the .csproj extractor). Captures the root element, named controls (x:Name/Name) and their control types, {Binding ...} references, and x:Class, and bridges the view to its .xaml.cs code-behind by resolving event-handler attributes to the matching methods on the partial class. Event resolution is gated on the .NET handler signature (object sender, …EventArgs e) and skips free-form attributes (Content, Text, Tag, …), so a property value that merely matches a method name (e.g. Content="Save" next to a business method Save()) can't fabricate a spurious event edge.
• Fix: to_canvas (Obsidian Canvas export) now lays out each community's node cards in the same ceil(sqrt(n))-column grid the group box is sized for. The box width assumed a roughly-square sqrt(n)-column layout, but the placement loop hardcoded 3 columns, so any community larger than ~9 members rendered as a cramped 3-wide strip in an over-wide, mostly-empty box. The column count is now computed once per community and reused for the box width, box height, and card placement, so the cards fill the box. Cosmetic, no data change (#1452, thanks @TPAteeq).
• Fix: to_obsidian / to_canvas / to_wiki no longer silently overwrite notes whose labels differ only by case (e.g. a class References and a prose heading references). The filename dedup was keyed on the exact-case name, so two such labels counted as non-colliding and the second write clobbered the first on case-insensitive filesystems (macOS/APFS, Windows/NTFS) — no suffix, no warning. Dedup now folds case (keyed on the lowercased name) while still emitting the original-case filename, so any pair that would collide on disk gets a numeric suffix. The obsidian/canvas dedup is shared in one helper so they can't drift, wiki's slug dedup gets the matching fix, the _COMMUNITY_*.md overview notes (which had no dedup) are covered, and a generated base_1 is itself re-checked so it can't overwrite a node literally labelled base_1 (#1453, thanks @TPAteeq).
• Feat: the kimi, gemini, and deepseek semantic-extraction backends now honor KIMI_BASE_URL, GEMINI_BASE_URL, and DEEPSEEK_BASE_URL to point at any OpenAI-compatible endpoint (a proxy, gateway, or self-hosted relay), matching the existing OLLAMA_BASE_URL / OPENAI_BASE_URL overrides. Each falls back to its hardcoded official default when the variable is unset, so behavior is unchanged for everyone who doesn't set it (#1458, thanks @jc2shile).
• Fix: to_wiki (Wikipedia-style wiki export) now emits portable relative markdown links instead of Obsidian [[wikilinks]], so navigation works in every renderer — VS Code preview, GitHub, GitLab, a plain browser — not just Obsidian. Two defects: (1) [[Title]] resolves by note title only inside Obsidian; everywhere else [[Domain Data Models]] points at a literal Domain Data Models.md, but the article file is Domain_Data_Models.md (the slug substitutes spaces and reserved characters), so nearly every community/god-node navigation link opened an empty page. (2) God-node articles linked every neighbor ([[AwsHelper.py]], [[.read_object_key()]]), but only communities and god nodes get article files, so those node-level links were dead even inside Obsidian. Links are now standard [display](slug.md) with the target URL-encoded, so spaces, &, parentheses, and # survive intact in CommonMark renderers and Obsidian alike; any link whose target has no article is downgraded to plain text instead of left dangling. Each article's slug is computed up front (a label -> slug resolver built before any body is rendered) so a link to a community or god-node article points at the real on-disk filename, including the case-fold collision suffix (parser_2.md). Cosmetic, no graph/data change (#1444, thanks @restagner).

graphify 0.8.49

Fixes

• get_community MCP tool now shows the community name in its header (Community 12 — Auth & Sessions (8 nodes)), matching get_node / query output; skipped when it is only the Community N placeholder so it never doubles (#1448, thanks @rmart1308).
• graphify reflect no longer duplicates "known dead ends" / "corrections" lines when the same Q&A is saved more than once (dedup by question, most recent wins).
• Work-memory works without the git hook: the skill runs graphify reflect --if-stale at the start of graph work, so a skill-only install still refreshes LESSONS.md. --if-stale no-ops when the file is already newer than every input, so the post-commit hook is an optimization rather than a requirement.

Security

• Floor starlette at >=1.3.1 for CVE-2026-48818 and CVE-2026-54283 (both resolved by 1.3.1). starlette underpins the HTTP MCP transport (graphify-mcp over HTTP); stdio and the CLI are unaffected. Now declared in the mcp/all extras and floored so end users installing graphifyy[mcp] are covered, not just the dev lock (#1391, #1396, thanks @orbisai0security).

Refactor / Performance

• Begin splitting extract.py into per-language modules under graphify/extractors/ (blade, elixir, razor, zig + shared base.py), behavior-neutral, with extract.py re-exporting the moved names so all callers and the dispatch table are unchanged (#1212, thanks @TheFedaikin).
• Parallel community labeling: cluster-only / label take --max-concurrency and --batch-size; ollama/claude-cli stay serial unless opted in (#1390).

Install: uv tool install graphifyy==0.8.49

graphify 0.8.47

Self-improving "work memory" (#1441)

• graphify save-result --outcome useful|dead_end|corrected [--correction TEXT] records how a saved Q&A turned out.
• graphify reflect aggregates graphify-out/memory/ into a deterministic reflections/LESSONS.md an agent loads next session. Source nodes are scored, not counted — signed and recency-decayed (configurable --half-life-days, default 30), so a fresh dead end outweighs a stale useful. A node is preferred only once corroborated by ≥--min-corroboration distinct results (default 2); others are tentative; mixed-signal nodes render once as contested (recency-wins). Citations whose node no longer exists in the graph are dropped, so stale lessons don't linger. Deterministic, no LLM.
• Zero-config adoption: the skill instructs the agent to read LESSONS.md at the start of graph work and to record outcomes, and the git post-commit/post-checkout hooks now auto-run reflect after each rebuild — so lessons stay fresh without a manual command.

Fixes

• Python qualified class-method calls (ClassName.method(...)) now produce an EXTRACTED calls edge to the class-qualified method node (#1446) — previously dropped, including the common case where the called method shares its name with the caller (a viewset action delegating to a same-named service action).
• validate_extraction/build_from_json no longer crash on a non-hashable node id or edge endpoint from a malformed extraction — a single bad node no longer aborts the whole build (#1447, thanks @dschwartzi).
• graphify update now prunes a function/symbol removed from a still-present file without --force — the shrink-guard is file-aware (allows shrinkage from re-extracted/deleted files, still refuses unexplained loss).

Install: uv tool install graphifyy==0.8.47

Faster queries, a graph-health gate in the skill runbook, CUDA support, and a batch of extraction/install fixes.

Performance

• Trigram query prefilter — graphify query/path/explain and the MCP query tools now narrow candidates via a trigram index (built once per graph, rebuilt on hot-reload) before the IDF scorer, cutting the previous O(N) scan on large graphs. The prefilter is a strict superset of the exhaustive scorer, so results and ranking are unchanged; short/CJK/low-selectivity queries fall back to the full scan (#1431, thanks @papinto).

Skill runbook

• Step 4.5 graph-health gate — after building the graph, the runbook runs diagnose_extraction and surfaces dangling/self-loop/collapsed-edge warnings before labeling (read-only; never aborts). It also anchors the semantic cache on the scan root so cache hits survive a non-cwd scan (#1437, thanks @bahcgscateringsa-design).

Languages

• CUDA (.cu/.cuh) is now extracted via the existing C++ (tree-sitter-cpp) grammar — no new dependency. Kernels, host functions, structs, includes and host call edges are captured; <<<grid, block>>> launch syntax parses cleanly (#1411).

Extraction quality

• No more phantom duplicate nodes from cross-file type annotations. A class defined once but referenced via type annotations in N files produced 1+N nodes (the extras with the file path baked into the id, e.g. pkg_a_py_thing). The cross-file reference now resolves to the single canonical definition — fixed across all six language extractors (#1402, thanks @ZedUserdesign).

Install & misc fixes

• graphify install --platform hermes installs to %LOCALAPPDATA%\hermes\skills on Windows (where Hermes scans), not ~/.hermes/skills (#1403, thanks @SHJordan).
• The opencode plugin's search reminder no longer contains backticks that bash executed as a command substitution on every search (#1413, thanks @WSHAPER).
• to_obsidian/to_canvas never emit punctuation-only filenames (e.g. @.md) that break downstream re-sluggers — they fall back to unnamed (#1409, thanks @Mylock51).
• graphify extract --cargo exits with a clear error instead of a traceback when Cargo.toml is missing/unreadable (#1428, thanks @DhruvTilva).
• Internal: resolved an F821 in prs.py via a TYPE_CHECKING import (#1429, thanks @DhruvTilva).

Path-portability fixes so graphify-out/ artifacts are portable across clones and machines, plus a native-backend extraction fix.

Path portability

• Portable manifest.json — the skill runbooks now relativize manifest keys to the scan root, so graphify --update matches cached files after a clone or move instead of re-extracting the whole corpus. (#1417)
• Hyperedge source_file relativized — build_from_json now relativizes graph.hyperedges[] like nodes and edges, so a semantic subagent's absolute path no longer leaks into graph.json. (#1418)
• Report header shows the scan root — the split-skill runbook passed '.' to report.generate; it now passes the real scan path, so GRAPH_REPORT.md no longer titles itself .. (#1419)
• GRAPHIFY_OUT honoured end-to-end — the custom output-dir override was only respected by some readers, so GRAPHIFY_OUT=custom-out graphify extract still wrote to graphify-out/. It's now resolved through a single graphify.paths module across extract, cluster-only, query/affected/benchmark, save-result, uninstall --purge, cache-check, the manifest/transcripts/memory/converted paths, the build_merge/serve/prs defaults, and the detect scan-exclude. Default behaviour is unchanged. (#1423)

Native-backend extraction

• Hyperedges are now requested on the native path — graphify extract --backend <gemini|claude|claude-cli|openai|kimi|…> never produced hyperedges (the prompt's schema showed an empty array and never described them), while the agent/skill path did. The native prompt now matches the skill spec, so both paths yield the same hyperedge behaviour. (#1430)

Skill-runbook correctness and a crash fix.

Generated skill (#1392)

Crash & data-loss tier:

• Semantic chunk files are derived from cwd (where Part C globs graphify-out/), not the scanned dir, so a non-cwd scan no longer produces "no nodes".
• Code-only corpora write an empty .graphify_semantic.json before Part C, fixing a FileNotFoundError.
• --cluster-only relies on the self-contained graphify cluster-only CLI instead of re-running steps that read already-deleted intermediate files.
• The zero-node guard runs before any write, and GRAPH_REPORT.md/analysis are written only when to_json actually persisted the graph (respects the #479 shrink-guard).

Remaining correctness tier:

• --directed is propagated as directed= into build_from_json (build + rebuild) and build_merge (--update merge + diff), so a --directed / --directed --update run no longer collapses reciprocal edges into an undirected graph.
• Semantic extraction scopes to document/paper/image only (code is covered by the AST pass), so subagents stop re-reading every source file.
• .graphify_cached.json is deleted on a cache miss, so a stale cache from a prior run is never merged.
• --update transcribes changed video files into documents before the semantic pipeline.
• Transcription writes via write_text, honours GRAPHIFY_WHISPER_MODEL/GRAPHIFY_WHISPER_PROMPT, prints status to stderr.
• add-watch/exports use the resolved interpreter explicitly; MCP Desktop config documents the absolute interpreter path.

Library

• The semantic extract entry points no longer crash on FileSlice units. The 0.8.43 #1386 fix coerced every item with Path(f), which raised TypeError on the FileSlice objects from the oversized-text slicing path (#1369). Items are coerced only when not already a Path/FileSlice (#1397, #1399).

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

pip install -U graphifyy / uv tool upgrade graphifyy.

Two new capabilities plus a security update and four fixes.

Features

• Package-manifest dependency graph. apm.yml, pyproject.toml, go.mod, and pom.xml are now parsed deterministically into one canonical package node per package (keyed by name) plus depends_on edges, routed to the AST path so the LLM never sees them. Previously apm.yml was an LLM-handled document, so a package got a different file-anchored id from its own manifest than from each dependent's reference and split into duplicate nodes — now a package referenced from many manifests is a single hub. (#1377)
• Markdown links become edges. Inline [text](./other.md) links, reference-style links, and [[wikilinks]] in markdown are now resolved (relative to the source file; external URLs / anchors / images skipped) and emitted as references edges between docs, so hub docs like index.md / table-of-contents.md actually become hubs. (#1376)

Security

• Bumped vulnerable dependencies to patched versions: pypdf 6.11.0→6.13.3 (CVE-2026-48155/48156), yt-dlp 2026.3.17→2026.6.9, pyjwt 2.12.1→2.13.0, cryptography 48.0.0→49.0.0, python-multipart 0.0.28→0.0.32, with lower-bound floors for the direct deps so installs get the patched versions. (#1375 — thanks @hypnwtykvmpr)

Fixes

• The semantic extract entry points (extract_corpus_parallel, extract_files_direct) crashed on str paths instead of pathlib.Path; both now coerce at entry. (#1386)
• Community labeling now recovers from a malformed-JSON batch by splitting and retrying each half (mirroring the extract path) instead of silently dropping ~100 names per failed batch on large graphs. (#1280, #1278 — thanks @CJdev232)
• graphify hook install no longer creates a backslash-named junk directory and reports false success when core.hooksPath is a Windows-style path under WSL — such paths are now rejected with a clear error. (#1385)

Internal

• Node-ID normalization unified into a single graphify.ids module; the four hand-synced copies (extract, build, mcp_ingest, symbol_resolution) — root of the recurring ghost-node bug class — now share one guarded implementation. (#1378 — thanks @danielnguyenfinhub)

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

Bug-fix release. pip install -U graphifyy / uv tool upgrade graphifyy.

Ships a live regression fix and a security fix from 0.8.41, plus two correctness/feature fixes.

Fixes

• 🔴 /graphify --update no longer deletes a changed file's freshly re-extracted nodes. The 0.8.41 root= fix (#1361) made build_merge's prune actually match relative source_file values — which then matched the just-re-extracted nodes of changed files (still in prune_sources) and removed them, so --update on a changed file could wipe its nodes. The update runbook now prunes only genuinely deleted files; changed files are reconciled by build_merge's replace-on-re-extract (#1344). The full build also passes root= to build_from_json, and the extraction-spec source_file is pinned to the verbatim path, so full build and incremental updates never drift. (#1366 — thanks @RelywOo)

• 🔒 Security: .graphifyignore and .gitignore are now merged per directory instead of .graphifyignore silently replacing the dir's .gitignore. Previously, adding a .graphifyignore disabled that directory's .gitignore entirely, so a file excluded only by .gitignore — including neutrally-named secrets like prod-dump.sql or customer-data.json — got indexed into the graph (whose artifacts embed file contents and are routinely committed). .gitignore is read first and .graphifyignore last, so it still wins on conflict (including ! negations); adding one can only ever exclude more. (#1363)

• Java record declarations are now first-class type nodes, and new Foo(...) constructor calls produce a calls edge. Previously a record appeared only as its file node (degree 0). (#1373)

• Large text documents are no longer silently truncated during semantic extraction. _read_files capped every file at 20,000 chars and dropped the rest; oversized Markdown/text/rST docs are now sliced at heading/paragraph boundaries so the whole file is extracted (slices share the parent source_file, so the graph isn't fragmented). Code files and PDFs are never sliced. (#1369)

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

Bug-fix release. pip install -U graphifyy / uv tool install graphifyy@0.8.41.

Fixes

• Swift cross-file class relationships now resolve through member calls and constructors. A per-file type table (from property/parameter declarations + constructor inference) types the receiver of recv.method(), Type.staticMethod(), Singleton.shared.method(), and self.prop.method(), and property/field initializers (let vm = VM()) are walked for constructor calls. Edges emit only when the receiver's type resolves to exactly one definition (preserving the god-node guards) and are tagged INFERRED. (#1356)

• /graphify <path> --update prunes stale nodes correctly. The update runbook called build_merge without root=, so absolute prune paths never matched the graph's relative source_file values — nothing was pruned and changed/deleted files left ghost nodes that compounded every run. (#1361)

• export obsidian no longer writes an empty 32-byte graph.canvas on a populated graph. to_canvas now falls back to one synthetic community covering every node when no community data is present (e.g. --no-cluster builds). (#1324)

• Edges missing source_file (occasionally emitted by the semantic/LLM extractor) are now backfilled from their endpoint nodes in build_from_json and the --no-cluster path, so they no longer reach graph.json without a file reference. (#1279)

• Fuzzy dedup no longer over-merges distinct nodes in three cases: numbered/versioned siblings (ADR 0011 vs ADR 0013), cross-file rationale/document boilerplate (file-anchored like code), and cross-file labels sharing a long prefix but diverging in a distinguishing token (testing-library jest-native vs react-native, now scored on plain Jaro). Same-file near-duplicates still merge. (#1284 — thanks @van4oza, #1243)

• OpenAI-compatible backends (ollama, openai, deepseek, kimi) now honour their configured 16384 output-token cap instead of silently falling back to 8192, which had been truncating deep-mode JSON mid-string. GRAPHIFY_MAX_OUTPUT_TOKENS still overrides. (#1365)

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

What's changed

Features

• Feat: custom OpenAI- and Anthropic-compatible endpoints. OPENAI_BASE_URL/OPENAI_MODEL and ANTHROPIC_BASE_URL/ANTHROPIC_MODEL point either backend at a self-hosted or proxy server (vLLM, llama.cpp, LM Studio, LiteLLM, gateways); defaults preserve api.openai.com/api.anthropic.com and GRAPHIFY_OPENAI_MODEL still wins over OPENAI_MODEL. Wired through extraction and community labeling (#1273).
• Feat: PowerShell .psm1 modules indexed. .psm1 was missing from CODE_EXTENSIONS and the dispatch table, so modules and their dependents were silently absent from the graph (#1315). .psd1 manifests and Import-Module/dot-source edges remain a follow-up.
• Feat: JS/TS AST extracts assignment-form symbols — this.X = () => {} / this.X = function(){}, exports.X/module.exports.X, Foo.prototype.X, class arrow/function fields, and const f = function(){} expressions. Constructor-style and CommonJS codebases (DAOs, route handlers, services) previously lost most callable symbols. Arbitrary obj.x = fn stays excluded (preserves the #1077 god-node guard) (#1322).

Fixes

• Fix: Swift import edges no longer silently dropped. The import target previously had no backing node, so build.py pruned 100% of Swift imports; the module node is now synthesized so the edge survives (#1327).
• Fix: --no-cluster / incremental update no longer accumulate duplicate edges. These paths bypass the DiGraph that collapses parallel edges, so repeated update grew edge counts and diverged across build modes. Edges are now deduped by (source, target, relation) — deterministic and idempotent (#1317).
• Fix: community names shown after cluster-only. query/explain/MCP now surface the human-readable community name instead of a blank/numeric id; backward-compatible with old graphs (#1305).
• Fix: graphify-mcp and graphify.serve accept --graph <path> as an alias for the positional arg, consistent with other subcommands (#1304).
• Fix: AST extraction no longer crashes on Windows with >61 logical cores — the 61-worker ProcessPoolExecutor cap now applies to all worker-count paths (#1298).
• Fix: ghost-merge skips ambiguous (basename, label) collisions so same-named symbols in same-named files across directories no longer mis-point edges (#1257).
• Fix: startup no longer crashes on unreadable .graphify_version (restricted installs / network mounts) — FS probes wrapped in try/except OSError (#1299).
• Fix: prs.py claude-cli backend resolves claude.cmd on Windows (WinError 2 on npm installs) (#1288).

Performance

• Perf: save_manifest file hashing parallelized with a ThreadPoolExecutor (#1295).
• Perf: _walk_js_tree converted from recursive generator to iterative walk (#1294).

CI / Docs

• CI: bandit + pip-audit security-scan job added as non-blocking advisory signal (continue-on-error) (#1209).
• Docs: RFC for file-level node summaries (docs/node-summaries-rfc.md) (#1166).

---

Install: `uv tool install graphifyy` · PyPI · CHANGELOG

What's changed

Performance

• Perf: O(n²)→O(n) LSH neighbor lookup in dedup. candidates_by_id dict replaces inner O(n) scan per neighbor; norm_cache avoids re-normalising labels on every comparison.

Fixes

• Fix: affected handles "edges"-keyed graph.json (KeyError: 'links' crash). Normalised using the established pattern in __main__.py/serve.py.
• Fix: .graphifyignore single ! negation no longer disables all directory pruning. Pure performance fix — the descent was always wasted since gitignore can't rescue files beneath an excluded parent.
• Fix: merge-chunks prints node count instead of raw list object.
• Fix: manifest data-loss on corrupt JSON. Silent except: pass replaced with corrupt-file backup + stderr warning.
• Fix: tree-sitter packages have pinned upper-bound version ranges to prevent silent breakage on grammar API changes.

Features

• Feat: FalkorDB export backend. graphify export falkordb --push redis://localhost:6379 (optional dep: uv tool install "graphifyy[falkordb]").
• Feat: --model flag for graphify cluster-only and graphify label. Override the model used for community naming independently of the backend.

Docs

• Persian (فارسی) README translation added.
• README: --model examples added to cluster-only/label command section.

---

Install: uv tool install graphifyy · PyPI · CHANGELOG

What's changed

13 fixes and improvements merged in this release.

Correctness

• Fix: LLM calls edges now have correct direction. The extraction prompt never stated source = caller / target = callee — the LLM systematically emitted callee→caller. Explicit direction rule added to prompt. Ghost-node merge extended to collapse LLM bare-stem duplicates onto AST canonical nodes even when the LLM node has a source_location. Post-fix annotation: calls precision 100% (n=6), overall INFERRED precision 94% (n=16).
• Fix: JS/TS default imports/exports now produce symbol-level edges. export default class Foo imported as import Foo from './foo' previously got only a file→file edge. The class node now receives a proper imports edge and call resolution through renamed bindings works correctly.
• Fix: tsconfig paths aliases resolved relative to baseUrl. NestJS, monorepo, and similar layouts using baseUrl: "./src" now resolve @/* aliases correctly.
• Fix: dedup pass 2 picks winner only from the verified pair. Unrelated same-named nodes from different files were being dragged into merges and supplanting the correct winner.
• Fix: global-graph edges rewired to deduplicated external nodes. Dangling edge references after external node dedup are now remapped before insertion.
• Fix: ghost-merge skips ambiguous (basename, label) keys. Two same-named symbols in different files (e.g. two render functions) no longer get mis-merged.
• Fix: resolve_seed matches bare names against callable-decorated labels. A query for render now finds nodes labelled .render().

Performance

• Fix: collect_files is now a single pruned os.walk. Replaces ~85 redundant rglob passes; noise directories are pruned before descent.

Cache

• Fix: AST cache namespaced by graphify version. Stale cache from previous releases no longer silently produces wrong output after upgrade.
• Fix: extraction cache anchored at --out root. graphify extract ./src --out /tmp/out no longer leaks graphify-out/ into the scanned project.
• Fix: frontmatter delimiter requires whole --- line. Thematic breaks (----) and YAML title lines (--- title: foo) no longer trigger false frontmatter parsing.

Platform

• Fix: claude-cli spawns claude.cmd on Windows headless installs. Adds CREATE_NO_WINDOW to both subprocess spawn sites.
• Fix: claude-cli handles JSON-array envelope from Claude Code CLI ≥ 2.1.

Features

• Feat: Cargo workspace dependency extraction. graphify extract ./my-workspace --cargo maps Rust workspace crates and internal crate_depends_on edges.
• Fix: SystemVerilog class-level extraction improved. Dart with MyMixin now correctly emits mixes_in (not implements).

Docs

• README grammar count updated: 28 → 36 tree-sitter grammars.

---

Install: uv tool install graphifyy · PyPI · CHANGELOG

Security

• SSRF guard thread-safety: Replaced the global socket.getaddrinfo monkey-patch with per-connection _SSRFGuardedHTTPConnection/_SSRFGuardedHTTPSConnection subclasses. DNS is resolved once, IP validated, connection made to that exact address — closes the concurrent-thread race and the underlying TOCTOU gap.
• Prompt injection mitigation: Untrusted source files are now wrapped in <untrusted_source path="..." sha256="..."> XML delimiters during LLM extraction. Jailbreak sentinel tokens neutralised; system prompt hardened.

Fixes

• Obsidian/Canvas export crash: KeyError when a community contains a node absent from the graph — dangling members now skipped gracefully.
• macOS NFC/NFD re-extraction loop: Office sidecar filenames now NFC-normalised before hashing, fixing the bug where --update re-extracted all Office files on every run on HFS+/APFS.
• Data JSON orphan nodes: The JSON extractor now only processes config/manifest JSON (package.json, tsconfig.json, etc.). Data JSON files (arrays, generic key/value) are skipped by the AST pass — eliminates 561+ orphan nodes on real repos.
• OpenAI reasoning models temperature error: temperature=0 is now auto-omitted for o1/o3/o4/gpt-5 series. Override with GRAPHIFY_LLM_TEMPERATURE.
• Corporate Windows / EDR hang: datasketch and scipy removed. Replaced with a self-contained pure-numpy MinHash/MinHashLSH implementation — eliminates the numpy.testing → platform.machine() subprocess spawn at import time that EDR software (CrowdStrike, SentinelOne) was intercepting.
• Dedup merges distinct same-named symbols: Config class in app.py and Config class in db.py are no longer collapsed. Code nodes are now deduplicated by ID only.

Performance

• detect() 34% faster on large repos: Ignore-pattern checks memoized per scan. Each ancestor directory evaluated once across all sibling files, eliminating ~42M redundant fnmatch calls on 2k+ file corpora.

Features

• GRAPHIFY_MAX_GRAPH_BYTES: Override the 512 MiB graph.json size cap (e.g. 700MB, 2GB). The cap error message now cites this env var. graphify export html auto-falls back to community-aggregation view when over cap.
• Stronger CLAUDE.md instructions: "MANDATORY: Before using Read/Grep/Glob/Bash you MUST run graphify first" — includes explicit instruction to forward the rule to every subagent prompt.
• GRAPHIFY_LLM_TEMPERATURE: Override LLM temperature for any backend (none to omit entirely).

CI

• Self-graph release asset: Every release now ships graphify-self-graph.tar.gz — graph.json + graph.html + GRAPH_REPORT.md from Graphify analysing its own source. Download and open graph.html locally to see what Graphify produces, no install required.

Upgrade

uv tool upgrade graphifyy
# or
pip install --upgrade graphifyy

What's new

Features

• extra_body for custom providers — pass model-specific request shapes (e.g. Qwen3 thinking disable, vLLM chat templates) via providers.json. Explicit extra_body also bypasses Ollama num_ctx auto-derive. Thanks @EirikWolf (#1197)
• Multi-batch community labeling — label_communities now chunks in groups of 100 (configurable batch_size=) for 16k-context models; partial batch failures no longer drop the whole pass. Thanks @EirikWolf (#1197)
• .slnx solution file support — modern VS 2022 XML solution format, with contains and imports edges. Thanks @bakgaard (#1189)
• graphify-mcp console script — MCP stdio server directly invocable from uv tool install / pipx. Thanks @jr2804 (#1190)

Fixes

• Community label token budget — raised from min(40+16n,4096) to min(64+24n,8192); GRAPHIFY_MAX_OUTPUT_TOKENS now honoured for labeling path (#1200)
• Import cycle hang on large graphs — nx.simple_cycles() now receives length_bound=max_cycle_length, dropping report generation from never-returns to ~0.1s (#1196)
• Fuzzy dedup prefix-extension false merges — getActiveSession/getActiveSessions, parseConfig/parseConfigFile etc. no longer silently merged by prefix-extension guard in Pass 2 and LLM tiebreaker (#1201)
• None node label crash — _norm, _norm_label, _strip_diacritics now guard against null label fields. Thanks @freiit (#1195)
• Skill trigger: field removed — not part of Agent Skills spec; agentskills validate CI no longer flags graphify installs (#1180)

Upgrade

uv tool upgrade graphifyy

What's new

• CodeBuddy support — graphify codebuddy install installs the skill, registers Bash + Read|Glob hooks in .codebuddy/settings.json, and writes the CODEBUDDY.md always-on section. The hooks nudge the agent toward graphify query instead of grepping when a graph exists. Thanks to @studyzy (#1136).
• Fix: --update no longer destroys nodes — the skill's incremental merge now passes re-extracted files to prune_sources so old nodes are pruned before fresh AST is inserted, preventing fuzzy dedup from collapsing distinct same-named symbols across files. A secondary guard in dedup.py prevents label-only merging of no-source-file nodes. Anti-shrink guard message improved (#1178).

Upgrade

uv tool upgrade graphifyy

New features

• Streamable HTTP MCP transport — graphify serve graph.json --transport http serves the graph over HTTP so a whole team shares one server. Includes API key auth (--api-key) and Docker image (#1143).
• Salesforce Apex extractor — .cls and .trigger files now produce a full dependency graph (classes, methods, triggers, SOQL/DML edges) (#1159).
• Azure OpenAI backend — --backend azure with AZURE_OPENAI_API_KEY + AZURE_OPENAI_ENDPOINT. Auto-detected, no new dependency (#1107).
• Live PostgreSQL introspection — graphify extract --postgres "postgresql://..." maps your schema directly. New graphify[postgres] extra (#1093 / #1103).
• Vision and PDF in headless extract — images now go through the proper vision API per backend instead of producing garbage binary data (#1109 / #1110).

Bug fixes

• Stale symbols pruned from surviving files on full rebuild (#1116 / #1118)
• Multi-word path/query endpoints now fire exact-match bonus (#1165)
• _is_sensitive false positives on topic-mentioning filenames fixed (#1169)
• Git hooks use cross-platform Python detach instead of nohup (Windows fix) (#1161 / #1170)
• Post-commit hook now respects .graphify_root scoped builds (#1173)
• graphify affected direction-blind on undirected graphs fixed (#1174)
• Step 9 cleanup no longer aborts under fish/zsh on pure-code corpora (#1172)
• detect_incremental gracefully handles schema-drifted manifest files (#1163)
• numpy pinned to >=2.0; python_version>='3.13' only (#1153 / #1154)
• Codex skill now installs to .codex/ not .agents/ (#1160)

Upgrade

uv tool upgrade graphifyy
uv tool install "graphifyy[postgres]"   # for PostgreSQL introspection

What's new

• Install banner — graphify install now shows an amber knowledge-graph brain. TTY-only, silent in CI.
• Package-form import fix — from pkg import submod now resolves to a file-level edge to the submodule. Previously left test files as disconnected islands (up to 66% of test nodes in some repos) (#1146).
• Builtin annotation noise removed — str, int, bool, MagicMock, etc. no longer become graph nodes or accumulate edges. Inflated degree counts ~25% and pushed real abstractions out of god-node rankings (#1147).
• Ghost duplicate auto-merge — AST/semantic node ID mismatches are now merged at build time. No more duplicate nodes for the same symbol. Existing graphs: run graphify extract . --force to clean up (#1145).

Upgrade

uv tool upgrade graphifyy

What's new

• Terraform/HCL support — .tf, .tfvars, .hcl files now produce a full infrastructure dependency graph via tree-sitter-hcl. Resources, data sources, modules, variables, outputs, providers, and locals become nodes; interpolation references and depends_on become edges. Requires uv tool install graphifyy[terraform] (#1129).
• Code-only extract needs no API key — graphify extract now defers backend resolution until after file detection. A corpus with only code files runs fully offline — no GEMINI_API_KEY, ANTHROPIC_API_KEY, or anything else needed. Key is only required when docs, PDFs, or images are present (#1122).
• Kiro install fix — graphify kiro install now correctly writes the references/ sidecar and .graphify_version stamp. Re-run graphify kiro install to pick up the fix (#1142).
• API timeout fix — GRAPHIFY_API_TIMEOUT and --api-timeout now apply to the claude-cli subprocess and Anthropic SDK backend, not just the HTTP client (#1112).
• Dependency floors — networkx>=3.4, datasketch>=1.6, rapidfuzz>=3.0 prevent silent breakage from incompatible old versions resolving via pip.

Install / upgrade

uv tool install graphifyy          # fresh install
uv tool upgrade graphifyy          # upgrade
uv tool install "graphifyy[terraform]"  # with Terraform/HCL support

• Fix: graphify hook install now embeds the current interpreter (sys.executable) directly into the generated hook scripts. Previously, uv tool and pipx installs silently no-oped on git commit in GUI clients and CI runners where ~/.local/bin is not on PATH — the hook could not find the graphify launcher, fell through all detection probes, and exited 0 without rebuilding. If you already have hooks installed, re-run graphify hook install to pick up the fix (#1127).
• Fix: hook scripts also probe graphify-out/.graphify_python as a fallback interpreter source, covering Windows/Git Bash installs where the launcher is a binary with no parseable shebang, and the case where the pinned path goes stale after a reinstall.
• Security: hook script hardening — _PINNED= uses single quotes to prevent shell injection; nohup "$GRAPHIFY_PYTHON" -c is properly quoted; the fallback emits a loud stderr diagnostic instead of a bare silent exit 0.
• Fix: manifest.json keys, .graphify_root, and cache/ast/*.json source_file fields are now stored as relative paths and re-anchored on load. Teams committing graphify-out/ no longer see forced full rebuilds on every CI checkout or clone (#777, #1125).
• Feat: query logging. Every graphify query, graphify path, graphify explain, and MCP query_graph call is appended to ~/.cache/graphify-queries.log in JSON Lines format (timestamp, question, corpus, nodes returned, duration). Control with GRAPHIFY_QUERY_LOG, GRAPHIFY_QUERY_LOG_DISABLE=1, or GRAPHIFY_QUERY_LOG_RESPONSES=1 (#1128).

• Fix: graphify install --project --platform antigravity now writes Antigravity's always-on layer (.agents/rules/graphify.md + .agents/workflows/graphify.md), not just the skill. The project-scoped path went through the skill-only branch and skipped them, even though the project uninstall removes them.
• Feat: close the Read-tool graph bypass. The PreToolUse nudge previously only fired on Bash search (grep/rg/find); an agent answering a question by reading many source files through the native Read tool (or Glob) slipped past it. A new Read|Glob hook nudges toward graphify query when graphify-out/graph.json exists, only for a source/doc file outside graphify-out/, and never blocks (#1114).
• Feat: add an anthropic optional extra (and include it in [all]) so the claude backend is installable like every other one: uv tool install "graphifyy[anthropic]". Previously it was the only backend with no extra, so a user with ANTHROPIC_API_KEY set could not satisfy it without --with anthropic. The backend package-missing errors now point at uv tool install "graphifyy[<extra>]" (the isolated-venv path) rather than only pip install.

• Feat: progressive-disclosure skill files. The per-host SKILL.md is now a lean core (~615 lines, down from the ~1156-line monolith, about 47% less always-loaded context) that carries the full default code-build pipeline inline and links to an on-demand references/ sidecar (extraction-spec, query, update, exports, transcribe, github-and-merge, add-watch, hooks); an agent reads a reference only when that path is actually taken, so a normal build needs none. 18 hosts go progressive (claude, codex, opencode, kilo, copilot, claw, droid, trae, trae-cn, hermes, kiro, pi, antigravity, antigravity-windows, windows, kimi, amp, gemini); aider and devin stay monolithic by design. All 15 skill bodies + sidecars are generated from one source under tools/skillgen/, with CI guards (--check, --audit-coverage, --monolith-roundtrip, --always-on-roundtrip) proving the references are byte-identical slices of the old monolith so nothing is lost (#1121).
• Fix: graphify install --platform gemini shipped a SKILL.md with 8 dead references/ pointers. gemini installs claude's lean progressive core but the installer never copied claude's references sidecar; it now does, so every on-demand reference resolves (regression from the progressive-disclosure split).
• Security (F1): a project-local ./.graphify/providers.json (which travels with a cloned or shared repo) is no longer loaded automatically, since a custom provider's base_url is where your corpus and API key are sent. Set GRAPHIFY_ALLOW_LOCAL_PROVIDERS=1 to opt in; the user's own ~/.graphify/providers.json is still trusted. Non-http(s) base_urls are rejected on load and on provider add, and plaintext-http egress warns. Behavior change: if you relied on an auto-loaded project-local providers file, set the opt-in env var.
• Security (F2): untrusted office/PDF files are screened before parsing (on-disk size cap, plus a bounded streaming-decompression ceiling for .docx/.xlsx zip containers) so a zip-bomb in a scanned corpus can no longer exhaust memory.
• Security (F3): OLLAMA_BASE_URL pointing at a link-local or cloud-metadata address (169.254.x, metadata.google.*, or any host that resolves to one) now fails closed with a clean error instead of sending the corpus there. Trusted LAN hosts still warn-and-allow.
• Security (F5): the Fortran C-preprocessor step passes an absolute path so an attacker-named corpus file cannot be interpreted as a cpp option.

0.8.28

• Feat: Kilo Code support — graphify install --platform kilo installs a native skill + /graphify command and a .kilo tool.execute.before plugin (mirroring OpenCode). Existing .kilo/kilo.jsonc is read but never rewritten — plugin registration goes to kilo.json, preserving user comments (#512)
• Feat: modernized Dart extractor — comment stripping, part of redirection, nested-generic-aware extends/with/implements parsing, generic type-argument mapping, generic call detection (#1098)
• Fix: uv tool install graphifyy / pip install graphifyy no longer fails to build on Linux/macOS — tree-sitter-dm (BYOND DreamMaker) ships only a Windows wheel, so on other platforms it compiled from source and aborted the whole install when a C toolchain / python3-dev was missing. It's now an optional extra (graphifyy[dm], also in [all]), so the default install needs no compiler (#1104).
  • Upgrade note: DreamMaker .dm/.dme users must reinstall with graphifyy[dm] (or [all]) to keep AST extraction. .dmi/.dmm/.dmf parsing is unaffected.
• Fix: community IDs are now assigned by a total order ((-size, sorted node IDs)), so an identical grouping always gets identical IDs across runs — fixes spurious per-node community "churn" that was just unstable integer labels, not real regrouping (#1090 follow-up)

PyPI: https://pypi.org/project/graphifyy/0.8.28/

0.8.27

• Feat: standalone CLI now auto-names communities with the configured backend instead of leaving Community N placeholders — community labeling was previously an agent-only step (skill.md Step 5), so bare-CLI runs never got semantic names. cluster-only now auto-labels when no .graphify_labels.json exists, new graphify label <path> subcommand (re)generates names on demand, --no-label opts out, --backend=<name> overrides auto-detection. One batched LLM call with per-community placeholder fallback and graceful degradation on missing backend/API error; works with all built-in and custom OpenAI-compatible backends (#1097)
• Fix: AST file-level node IDs now match the skill.md {parent_dir}_{stem} spec — they were derived from the full relative path plus extension (match_script_pipeline_step_py) while semantic subagents use script_pipeline_step, splitting every file into two disconnected ghost nodes. Fixed at the single relative-path remap chokepoint so file nodes and all import/dependency edge endpoints (Python, TS, Lua, C, bash) convert together (#1033)
• Fix: symbol-level node IDs for root-level files now match the spec too — the #1033 remap relativized file nodes but symbols still embedded the absolute parent-dir name (<rootdir>_main_run vs spec main_run), splitting every top-level file's symbols into AST/semantic ghost pairs. The remap now canonicalizes symbol stems and raw_calls caller IDs, gated by source_file (#1096)
• Fix: TypeScript interface A extends B and same-file class X extends Y now produce inherits/implements edges — the walker only inspected class_heritage (missing the interface extends_type_clause node) and the resolver only consulted the import table (missing same-file bases); both gaps closed (#1095)
• Fix: graphify export obsidian no longer crashes with OSError ENAMETOOLONG on long node labels — to_obsidian/to_canvas now cap filenames on UTF-8 bytes (not chars, so multibyte/CJK labels are handled) with an 8-char hash suffix on truncation to keep distinct long-prefix labels from colliding; also fixes the previously-uncapped _COMMUNITY_ notes (#1094)
• Fix: graph.json is now deterministic across runs — detect() sorts file traversal lexicographically (os.walk order is filesystem-dependent), which had made first-writer-wins node-ID decisions and Leiden community counts vary between identical runs (#1090)
• Fix: Windows consoles no longer crash with UnicodeEncodeError on non-UTF-8 code pages — main() reconfigures stdout/stderr to UTF-8 at startup and →/— in print statements replaced with ASCII (#992)

PyPI: https://pypi.org/project/graphifyy/0.8.27/

What's new

New features

Circular import cycle detection — GRAPH_REPORT.md now includes an ## Import Cycles section showing file-level circular dependencies. Uses Johnson's algorithm on a directed file-level import graph, deduplicates rotations, and sorts by cycle length (tightest coupling first). Also available programmatically via find_import_cycles(G) in graphify.analyze. (#961 — thanks @deXterbed)

Custom LLM provider registry — Register any OpenAI-compatible endpoint without touching source code: ```bash graphify provider add nvidia
--base-url https://integrate.api.nvidia.com/v1
--default-model minimaxai/minimax-m2.7
--env-key NVIDIA_API_KEY

graphify provider list / show / remove ``` Providers stored in ~/.graphify/providers.json. Custom providers are auto-detected after all built-ins in detect_backend() priority so they never shadow a configured paid key. Works for any OpenAI-compatible endpoint: NVIDIA NIM, vLLM, OpenRouter, Together AI, LiteLLM, Fireworks, etc. (#1084 — thanks @timburman)

Bug fixes

extract_files_direct() no longer silently defaults to kimi (Moonshot AI) — backend=None now calls detect_backend() and picks whichever API key you have set, matching CLI behavior. Raises a clear ValueError listing all options if nothing is configured. README Privacy section updated with data-residency notes and provider priority order. (#1086 — thanks @EmanuelFaria)

pnpm-workspace.yaml crash on Python 3.10 fixed — packages: - '.' (single-package-at-root workspace) caused IndexError: tuple index out of range in _load_workspace_packages, silently skipping every JS/TS file in the project. Fixed with a one-line guard: [root] is used directly instead of root.glob('.'). Also added GRAPHIFY_DEBUG=1 env var to _safe_extract — set it to print full tracebacks instead of the terse one-liner warning. (#1083 — thanks @santiagotorres-united)

Anchored .graphifyignore patterns no longer match deep in the tree — /inbox/ should only match inbox/ at the repo root, not src/inbox/ anywhere in the tree. The basename shortcut and per-segment loop in _matches() now respect the anchored flag. Anchored patterns do an exact anchor-relative path match only. Same fix applied to _is_included(). (#1087 — thanks @cheerc)

Docs

Filipino (fil-PH) README translation added. (#1080 — thanks @Reihanboo)

Upgrade

```bash uv tool upgrade graphifyy

or

pip install --upgrade graphifyy ```

What's changed

Bug fixes:

• JS/TS phantom god-nodes — const/let inside arrow-function callbacks no longer emit graph nodes. _js_extra_walk now restricts node emission to program-level declarations only. Applies uniformly to JS, TS, and TSX. (#1077)
• Markdown orphan nodes — fenced code blocks no longer emit codeblock_N nodes. They had only contains edges and no semantic meaning; fence-toggle still prevents inner content from being mis-parsed as headings. (#1077)
• Lua imports — require("pkg.sub") now resolves to the correct file node ID. Dots are converted to path separators and the filesystem is probed for .lua/.luau/init.lua variants. (#1075)
• Windows claude-cli — WinError 2 on Windows is fixed by preferring claude.cmd over bare claude to avoid PATHEXT .ps1 resolution failure. (#1072)
• Post-commit hook silent drop — rapid commits no longer silently lose changed_paths when another rebuild holds the lock. Lock-losers queue paths to a pending file; the lock-holder drains and merges on acquire. (#1059)
• Antigravity install path — graphify install antigravity now correctly writes to ~/.gemini/config/skills/ (per Antigravity docs) instead of ~/.agents/. Uninstall, version-stamp refresh, and project-scope install all updated to match. (#1079)

Docs:

• README warns against pip install on Mac/Windows due to Python env mismatch causing ModuleNotFoundError; uv tool install recommended as primary method. (#1074)

Upgrade

uv tool upgrade graphifyy
# or
pipx upgrade graphifyy

What's changed

Features:

• Cross-language type-reference edges (wave 2) — ObjC, Julia, C, C++, Scala, Fortran, and PowerShell now emit references edges with parameter_type, return_type, generic_arg, field, and attribute contexts; extends the work from v0.8.23. CI matrix now covers Python 3.10 with faster-whisper version guard. (#1071)

Bug fixes:

• claude-cli hollow-response loop — backend no longer loops on hollow streamed responses; handles all four documented failure modes (empty stream, no JSON, missing result, empty result) with tests. (#1063)
• calls edge direction flip — edges no longer flip caller/callee when the same node pair appears in both directions in an undirected build; first-seen direction preserved on bidirectional collision. (#1061)
• .graphify_python path prefix — graphify-out/ prefix was missing in 8 skill files (256 instances), causing cat: .graphify_python: No such file or directory on every non-Claude-Code platform.
• uv-aware interpreter detection — all skill files now prefer uv tool run graphifyy python over shebang parsing when uv is available.

Upgrade

uv tool upgrade graphifyy

What's new

• BYOND DreamMaker support — .dm/.dme files extracted via tree-sitter-dm (type definitions, proc declarations, #include edges, in-file call resolution, new /type() instantiation edges); .dmi PNG icon files parsed for icon-state nodes; .dmm map files parsed for type-path uses edges from the tile dictionary section; .dmf interface files parsed for window/elem/control-type hierarchy (#884)
• graphify extract --mode deep — enables richer semantic extraction using an extended system prompt; flag propagated through all four LLM backends (#1030)

Install / upgrade

pip install --upgrade graphifyy

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

What's new

Fixes

• Ghost nodes on graphify update — full re-extraction now reconciles against disk state and evicts nodes from deleted files (no --changed flag needed) (#1007)
• OpenCode --project path — skill now written to .opencode/skills/graphify/SKILL.md (was incorrectly .config/opencode/skills/) (#1040)
• Hook rebuild loop — post-commit hook skips when only graphify-out/ files changed; GRAPHIFY_SKIP_HOOK=1 env var for one-off opt-out; rebuild log now appends instead of overwriting (#1018, #1037)
• Deterministic output — edges sorted and PYTHONHASHSEED=0 in hooks so graphify-out/ no longer churns on re-run (#1010)
• Search punctuation — what calls extract? correctly finds the extract node; punctuation stripped before matching (#994, #978)
• Builtin god-nodes — String(), Number(), Boolean(), print(), len() etc. no longer accumulate spurious call edges (#916, #726)

Features

• Amp platform — graphify amp install/uninstall installs into .amp/skills/graphify/SKILL.md (#948)
• SystemVerilog headers — .svh files now extracted alongside .v and .sv (#1042)

Upgrade

pip install --upgrade graphifyy
# or
uv add graphifyy

Bug fixes & security

Ghost nodes after file deletion fully fixed

graphify update on Windows no longer leaves stale nodes after moving/deleting files. Two root causes resolved:

• _relativize_source_files now runs on the existing graph before eviction, not after
• deleted_paths / evict_sources now use .as_posix() for consistent forward-slash paths on all platforms
• Symlinked scan roots now handled correctly via .resolve() in build_merge (#1007)

Security: XML DoS hardening

extract_csproj and extract_lazarus_package now pre-screen for <!DOCTYPE / <!ENTITY before parsing — blocks billion-laughs memory exhaustion on malicious project files. Zero false positives on real MSBuild/Lazarus files. extract_lpk also gains the previously missing 2 MiB size cap.

Dart node ID fix

Dart child node IDs no longer embed absolute paths — now uses _file_stem consistent with all other extractors. Existing Dart graphs should be rebuilt with graphify extract --force. (#999)

cluster-only label alignment

cluster-only now applies remap_communities_to_previous matching the behaviour of graphify update, so community labels stay stable across re-clusterings (#1028)

New features

MCP config extractor

.mcp.json, mcp.json, mcp_servers.json, claude_desktop_config.json are now extracted into the knowledge graph — captures server nodes, npm/pip package references, and env var requirements. Env values are discarded to prevent secret leakage.

Install / upgrade

pip install --upgrade graphifyy

What's new

.NET project file support

.sln, .csproj, .fsproj, .vbproj, .razor, .cshtml files are now extracted into the knowledge graph. Captures NuGet package references, project-to-project dependencies, target frameworks, SDK attributes, Razor/Blazor directives (@using, @inject, @inherits, @model, @page), component references, and @code block methods. Closes #515.

Chinese query segmentation

Compound Chinese tokens like 页面路由 are now split into meaningful words using jieba when installed, with a character bigram fallback when it isn't. The original compound is preserved alongside segments so exact-match still works. Install with pip install "graphifyy[chinese]".

Bug fixes

• Wiki TypeError on null source_file — G.nodes[n].get("source_file") or "" now handles explicit None values that .get("source_file", "") missed (#1016)
• Nested .claude/worktrees/ indexed — _is_noise_dir now skips worktrees/ directories nested inside dotted dirs like .claude/ (#1023)
• Backup accumulation — backup_if_protected uses content-hash comparison to skip identical backups and overwrite in-place when content changes; one folder per day maximum
• TypeScript 5.0 array-form extends — _read_tsconfig_aliases normalizes extends to a list before iteration (#1017)

Also in this release

• Devin CLI support — graphify devin install/uninstall (#1020)

Install / upgrade

pip install --upgrade graphifyy
# or
uvx graphifyy

Optional extras:

pip install "graphifyy[chinese]"   # Chinese query segmentation
pip install "graphifyy[sql]"       # SQL schema extraction
pip install "graphifyy[all]"       # Everything

Fixes & Features

• Fix: Post-commit hook updates graph after delete-only commits — shrink-guard now bypassed when changed paths include explicit deletions (#1000)
• Fix: graphify export no longer collapses to "Single community" when .graphify_analysis.json is absent — falls back to per-node community attribute in graph.json (#1001)
• Feat: Semantic context tags on references edges for Python/JS/TS/C#/Java — parameter_type, return_type, generic_arg, attribute, field; C#/Java now split inherits/implements (#996)
  • Breaking: Java extends edges renamed to inherits — update queries filtering on relation="extends" for Java nodes
• Feat: Constrained query expansion — Step 0 in skill extracts actual graph vocab and forces LLM to pick expansion tokens only from that set; Unicode regex fix captures Cyrillic/CJK labels (#998)
• Docs: Ukrainian README updated to v8 with all new sections, YC badge, 31 language count (#995)

Fixes

• Case-sensitive call resolution — Go, Rust, and Elixir resolvers previously lowercased both the label index and the callee name, causing Authorize to match authorize and produce phantom edges. Ruby, C#, Java, Kotlin, Scala use the same generic resolver which now uses a case-sensitive dict. PHP retains a separate case-insensitive dict since PHP function/class names are genuinely case-insensitive (#993)
• Cross-language phantom calls edges — INFERRED calls edges whose source and target nodes belong to different language families (py/js/go/rs/jvm/c/cpp/rb/php/cs/swift/lua) are now dropped at graph-build time. The skill prompt also now explicitly forbids emitting cross-language call edges (#991)

What's Changed

• Fix: CJK/Unicode labels no longer silently stripped during dedup — _norm() and _norm_label() now use Unicode-aware [\W_]+ regex with casefold() and NFKC normalization; previously 道具処理クラス and any non-ASCII label collapsed to empty string and got falsely merged (#937)
• Fix: .ets (ArkTS/HarmonyOS) files now recognized as code and extracted via the TypeScript parser (#926)
• Fix: graphify now exits non-zero when all semantic-extraction chunks fail — previously a silent empty graph was written with exit code 0, masking backend failures (#889)
• Feat: graphify install --project installs the skill into the current repository (.claude/skills/, .agents/skills/, etc.) instead of the user home directory; per-platform subcommands support the same flag (#931)
• Docs: Uzbek (uz-UZ) README translation (#982)

Install / Upgrade

```bash uv tool install graphifyy # fresh install uv tool upgrade graphifyy # upgrade pip install --upgrade graphifyy # pip ```

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

• Fix: cluster-only subcommand crashed with FileNotFoundError when graphify-out/ did not yet exist — output directory is now created before any write (#934)
• Fix: GRAPHIFY_MAX_OUTPUT_TOKENS env var now respected for all OpenAI-compatible backends — previously the token limit was hardcoded, causing truncated responses on high-context queries (#973)
• Fix: Swift extension nodes no longer duplicated across files — _merge_swift_extensions deduplicates by canonical name before graph insertion (#969)
• Fix: Non-Latin query terms (CJK, Arabic, Cyrillic, etc.) now preserved through query preprocessing — previous normalization stripped non-ASCII chars, making multi-lingual codebases unsearchable (#964)
• Feat: Multigraph runtime compatibility probe — emits a warning if a MultiDiGraph is passed where a Graph is expected by any downstream consumer (analyze, cluster, wiki, export, report) (#956)
• Feat: JS/TS barrel re-exports tracked as explicit re_exports graph edges — export { X } from './mod' emits typed edges with context="re-export" and confidence=EXTRACTED; file-level imports_from edges also emitted (#960)
• Feat: --affected and --import-resolution flags for the v8 subcommand — impact analysis and cross-file import resolution exposed as first-class CLI options

What's fixed

• Wiki crash on stale node IDs — to_wiki() no longer crashes with TypeError when community node IDs are stale after dedup or re-extract. Stale IDs are silently dropped with a stderr warning; raises a clear error only if every ID is stale (#936)
• .gitignore fallback — when no .graphifyignore exists, .gitignore patterns are now honoured. .graphifyignore still takes precedence when both are present (#945)
• --exclude flag — new CLI flag to pass extra gitignore-style exclusion patterns at runtime without modifying .graphifyignore (#947)
• .worktrees/ skipped — git worktree sibling checkouts inside .worktrees/ are no longer indexed as duplicate source (#947)
• NAT64 SSRF false-positive fixed — hosts like arxiv.org on IPv6-only networks that resolve via RFC 6052 NAT64 (64:ff9b::/96) were incorrectly blocked as reserved IPs

Upgrade

uv tool upgrade graphifyy
# or
pip install --upgrade graphifyy

What's fixed

• Node ID collisions across same-named files in different directories — SQL extractor and Python import resolver now use directory-qualified stems (dir_file_entity) instead of bare filename stems, preventing silent node merging on repos with duplicate filenames
• Absolute source_file paths from semantic subagents no longer stored in graph — build_from_json, build, and build_merge now accept a root param and relativize paths at build time, fixing broken MCP traversal on mixed corpora (#932)
• Failed semantic chunks permanently freezing files — only files that appear in extraction output get semantic_hash stamped in the manifest; failed-chunk files keep an empty hash and are re-queued on the next run (#933)

What's improved

• Stat-based mtime fastpath for file_hash — skips full SHA256 read when file size+mtime_ns are unchanged (same trade-off as make); index flushed atomically via atexit, making incremental re-runs significantly faster on large corpora
• New CLI subcommands — graphify cache-check, graphify merge-chunks, graphify merge-semantic expose cache and merge logic as library-callable commands for skill pipelines

Upgrade

pip install --upgrade graphifyy

• Fix: LLM empty choices / None message guard — Gemini and other providers return choices=[] on content-filtered HTTP 200 responses; now raises a clean error instead of crashing with IndexError (#924)
• Fix: OpenCode skill removed invalid general-purpose agent reference and headless-incompatible interactive halt (#911, closes #825)
• Fix: Codex skill now uses graphify query/explain/path even when graph artifacts are dirty in worktree (#913, closes #860)
• Perf: precompute degrees once in surprise scoring — ~11x speedup per lookup on large graphs (#914)

• Fix: git hooks phantom directory on git < 2.31 (#907)
• Fix: save_manifest incremental data loss — untouched files no longer erased (#917)
• Fix: C++ class/struct inheritance edges missing (#915)
• Fix: cohesion split threshold unreachable due to rounding (#919)
• Fix: Rust cross-crate spurious INFERRED edges via scoped call skip + trait-method blocklist (#908)
• Feat: --resolution N for extract and cluster-only (#919)
• Feat: --exclude-hubs P for extract and cluster-only with majority-vote reattachment (#919)

• Feat: DeepSeek backend support — set DEEPSEEK_API_KEY and use --backend deepseek; default model deepseek-v4-flash

Shipping a new subcommand today: graphify prs.

The problem it solves: no existing PR dashboard knows your codebase structure. You can see CI state and review decisions — but you cannot see that two open PRs both touch the auth community and are going to conflict at merge time. graphify prs does.

What it does

graphify prs                    # dashboard: CI state, review decision, worktree mapping
graphify prs 42                 # deep dive on one PR — blast radius, communities touched
graphify prs --conflicts        # PRs sharing graph communities → merge-order risk
graphify prs --triage           # AI ranks your review queue by graph impact
graphify prs --worktrees        # worktree → branch → PR in one view
graphify prs --repo owner/repo  # works on any GitHub repo

Graph impact

The --conflicts view crosses your open PRs against the knowledge graph. If two PRs touch the same community of nodes, they get flagged — with representative node labels so you know what that community actually is (ValidateToken, SessionStore, AuthMiddleware) rather than just "Community 3".

The dashboard shows a blast radius column per PR: 14 nodes / 3 communities. High number = review this carefully before merging.

Triage

--triage sends your PR queue to whatever LLM backend you have configured and gets a ranked list with one action per PR. Auto-detects from your env: claude → kimi → openai → gemini → claude-cli → ollama. Override with GRAPHIFY_TRIAGE_BACKEND.

MCP

Three new tools on the MCP server: list_prs, get_pr_impact, triage_prs. Your agent can now query PR state the same way it queries the graph.

Install

pip install --upgrade graphifyy

No new required dependencies. Requires gh CLI authenticated for PR data.

What's fixed

Query scoring (#897)

• IDF weighting — common terms like error or handle that match dozens of nodes are down-weighted, so a rare identifier like FooBarService ranks first and BFS expands from the right starting point
• Dynamic K seeds — when one match dominates (>80% score gap vs the next candidate), graphify picks one seed instead of always three; noise nodes no longer consume BFS slots alongside the real target
• Actionable truncation — the truncation message now tells Claude what to do (get_node or add a context_filter) rather than just reporting truncation

C++ extraction (#898)

• Class data members (int x;, static const int MAX = 100;) are now extracted as nodes with defines edges from the parent class — the previous field_declaration branch was silently a no-op due to a wrong child type filter
• _get_cpp_func_name now handles field_identifier, destructor_name, and operator_name node types

C/C++ include edges (#899)

• Quoted #include "path/to/file.h" edges now resolve relative to the including file and use the full resolved path as the target node ID — matching what extraction creates for the included file. Previously all include edges dangled with a basename-only ID and were silently dropped.

Dedup (#895)

• Pass 1 now partitions same-label groups by source file before merging — nodes with generic labels (handle, init, run) from different files no longer collapse into artificial god nodes; cross-file matches fall through to Pass 2 fuzzy
• exact_merges counter now reports only merges actually performed

Upgrade

uvx graphifyy@0.8.7 install
# or
pip install --upgrade graphifyy

What's new

Surprising Connections noise reduction

Two new suppression rules stop false positives from dominating the headline output:

• Cross-language INFERRED edges suppressed — in monorepos the call/import resolver matches symbol names across language boundaries (e.g. Python AuthError → TypeScript Member). These calls/uses edges are now zero-scored so they don't crowd out real structural surprises. semantically_similar_to and EXTRACTED edges are unaffected.
• Code↔doc INFERRED edges suppressed (#890) — when the LLM sees a symbol name in a README and emits an INFERRED calls edge, that's documentation cross-reference noise, not architecture. Same suppression applied. Code↔paper edges are preserved (a code file referencing a research paper is a genuine cross-format signal).

god_nodes noise reduction

• JSON key nodes filtered (#890) — the JSON extractor emits one node per key, so generic keys (name, id, type, start, end, key, value, data, items, title, description, version, properties) accumulate positional degree from sibling records rather than architectural meaning. These are now excluded from god_nodes. Domain-specific labels in JSON files still rank normally.

Rationale extraction

• Autogenerated file docstrings suppressed — module-level docstrings in Alembic migrations, Django migrations, and protobuf-generated files are boilerplate, not design intent. They are now skipped. Function docstrings inside migration files (e.g. upgrade()) are still captured.

Other

• Auto-detect symlinks (#887) — follow_symlinks is now enabled automatically when symlinked children are detected in the target directory, no flag needed.
• Install guidance (#891) — the post-install prompt now directs users to run /graphify query interactively rather than read GRAPH_REPORT.md first.

What's changed since v0.8.1

v0.8.5 — Bug fixes

• Gitignore parent-exclusion rule (#882): .graphifyignore patterns now correctly exclude files under an excluded directory even when a ! negation exists elsewhere in the file. Previously, any negation pattern would disable directory pruning entirely.
• Dedup false merges on short chip/model labels (#878): Jaro-Winkler's prefix bonus was incorrectly merging model SKU variants like ASR1603/ASR1605 or M1/M1 Pro. Two new guards (_is_variant_pair, _short_label_blocked) prevent these false positives while still catching real typos.

v0.8.4 — SQL extraction, deletion pruning, community label fixes

• Firebird SQL (#875): trigger and stored procedure extraction, FK detection via global regex fallback, UTF-8 decode fix for non-ASCII identifiers.
• Deletion pruning (#876): --update now correctly removes nodes and edges from deleted source files (was matching on basenames instead of full paths).
• Community label key normalization: JSON string keys from graph.json are now coerced to int before community label lookup, fixing blank community names in reports and HTML.

v0.8.3 — Windows and skill fixes

• Windows skill temp files no longer pollute the project root.
• --update with deletions-only no longer errors on missing extraction file.

v0.8.2 — Platform and detection fixes

• Fixed Python detection for uv tool and pipx installs on Windows (#831).
• Fixed antigravity Windows skill.
• Fixed indexing of dot directories.
• MCP server now hot-reloads on graph change (#874).

• Feat: Firebird SQL — trigger and stored procedure extraction via CREATE TRIGGER and regex fallback; FK detection via global regex covering REFERENCES and FOREIGN KEY clauses (#875)
• Fix: SQL extraction regex fallback now decodes source as UTF-8 instead of latin-1, preventing non-ASCII identifier hash mismatches (#875)
• Fix: --update deletion pruning now matches on full source file paths instead of basenames, preventing false node removal when different directories contain files with the same name (#876)
• Fix: --update now also prunes edges whose source_file attr points to deleted files, not just nodes (#876)
• Fix: community label keys from graph.json (stored as strings) are now coerced to int before lookup, fixing blank community names in GRAPH_REPORT.md and graph.html (#877)

• Fix: Windows skill temp files (chunk JSONs, .graphify_python, .graphify_root) no longer pollute the project root — all written under graphify-out/ (#831)
• Fix: --update with deletions-only no longer errors when .graphify_extract.json does not yet exist — creates an empty extraction file before merging (#876)

• Fix: Python interpreter detection for uv tool and pipx installs on Windows — graphify install and all skill steps now find the correct executable (#831)
• Fix: antigravity Windows skill path resolution (#831)
• Fix: dot directories (e.g. .github/, .vscode/) are now indexed when explicitly included via .graphifyignore (#873)
• Fix: MCP server hot-reloads the graph when graph.json changes on disk (#874)

What's new

Bash and JSON indexing

Shell scripts and JSON configs are now indexed automatically via tree-sitter — no LLM, no tokens, no flags needed.

Bash extracts functions, cross-function calls, source imports resolved to real file paths, and export/declare variables.

JSON extracts the full key tree, dependencies blocks as import edges, extends chains (tsconfig, eslintrc), and $ref references.

Mermaid architecture diagrams that stay up to date

graphify export callflow-html

Generates a self-contained HTML page with Mermaid call-flow diagrams per module. With graphify hook install set up, the diagram regenerates automatically on every git commit.

Bug fixes

• Coverage, snapshot, and Storybook build dirs filtered out by default (#869, #870)
• Hook install works correctly in git linked worktrees (#865)
• Office sidecar files now respect .graphifyignore (#861)
• Incremental graphify update no longer forces a full re-extract after an AST-only run (#857)
• Skill Windows path fixes (#862)

Upgrade

pip install --upgrade graphifyy

Full changelog: https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md

What's new

• .astro support — frontmatter static imports, dynamic imports, and `<script>` block imports all produce edges; tsconfig path aliases resolved (#850)
• Fix .rebuild.lock orphan — lock file now contains a single PID while running and is unlinked on release; no more PID accumulation or orphan locks blocking downstream tooling (#858)
• Docs — skill.md clarifies graphify does not read `ANTHROPIC_API_KEY` or other provider keys during `/graphify` skill runs

Install / upgrade

``` pip install -U graphifyy

or

uv tool install graphifyy ```

What's new

• graphify update is now idempotent — graph.json and GRAPH_REPORT.md only rewritten when content actually changes; topology comparison short-circuits clustering on unchanged graphs (#824)
• Stable community IDs across rebuilds — deterministic Leiden/Louvain inputs (sorted + fixed seed); greedy overlap remapper preserves existing IDs so hand-edited labels don't drift (#824)
• graphify update --no-cluster — skip reclustering, write raw AST graph only (mirrors graphify extract --no-cluster) (#824)
• Fix --no-cluster schema — now writes "links" key consistent with the full clustered path; previously toggled to "edges" on every mode switch
• Fix labels file churn — .graphify_labels.json no longer rewritten on no-op rebuilds
• Fix shrink-check duplication — unified into a single _check_shrink() helper across both code paths
• Fix node ID format in skill.md — corrected to {parent_dir}_{filename_stem}_{entity}; the old filename-only format caused ghost-duplicate nodes when AST and semantic extractors disagreed; existing graphs with ghost duplicates can be cleaned with graphify extract --force
• Fix serialization crashes — default=str in clustering sort keys prevents crashes on non-JSON-serializable edge attributes
• Docs — Prerequisites, optional extras table, env vars reference, troubleshooting, and dev setup added to README (#833)

Install / upgrade

pip install -U graphifyy
# or
uv tool install graphifyy

What's new

• --backend claude-cli — routes extraction through the Claude Code CLI, no API key needed, zero cost (#855/#856)
• Fix path/explain arrow direction — --> and <-- now reflect actual edge direction in directed graphs (#849/#853)
• Fix MCP arrow direction — same fix for shortest_path and get_neighbors MCP tools (#849/#853)
• Fix hub-transit BFS blocking — hubs can be destinations but not transit nodes in graph traversal (#830)
• Fix --update manifest shrink — incremental re-runs no longer drop previously-indexed files (#837)
• Align file_type enum — prompt, schema, and synonym mapper all use the same 6 values (#840)
• Fix Bedrock CLI guard — AWS env vars accepted even without ANTHROPIC_API_KEY (#846)
• Fix macOS Fortran fixture collision — sample.F90 → sample_preprocessed.F90 (#823)

Install / upgrade

pip install -U graphifyy
# or
uv tool install graphifyy

Bug Fixes

• #832 All read_text()/write_text() calls in the skill pipeline now specify encoding="utf-8" — bare calls defaulted to system codepage on Chinese-locale Windows, silently mojibaking node labels and Markdown content on --update. json.dumps now uses ensure_ascii=False so CJK characters are stored as-is.
• #831 Step 1 install fallback now prefers uv tool install --upgrade graphifyy over pip when uv is on PATH — pip was installing to the wrong environment when graphify was originally installed via uv tool.
• #828 _score_nodes now uses three-tier precedence (exact 1000 / prefix 100 / substring 1) — graphify path "Foo" "FooBar" no longer returns 0 hops when both labels substring-match the same node. Clear error emitted when source and target resolve to the same node.
• #826 file_hash normalises path keys via .as_posix().lower() — Windows junction/case variants hash identically, fixing save_semantic_cache always reporting "Cached 0 files" on subsequent --update runs. check_semantic_cache now mirrors the same abs-path normalization as the save side.
• #827 _AGENTS_MD_SECTION now includes the /graphify skill trigger instruction — all 7 AGENTS.md platforms (OpenCode, Codex, Aider, Trae, Hermes, OpenClaw, Factory Droid) now correctly invoke the skill tool when the user types /graphify.

Upgrade

pip install -U graphifyy

Bug Fixes

• #821 Universal -h/--help/-? guard: any help flag in any position now stops execution and prints usage — previously graphify cursor install --help silently installed into Cursor, and graphify benchmark --help crashed with FileNotFoundError: '--help'
• #818 --version, -v, and graphify version now print the installed version and exit — previously fell through to "unknown command"
• #820 GRAPHIFY_OLLAMA_NUM_CTX=<invalid> no longer falls back to hardcoded 131072 (which exhausted VRAM on constrained cards) — now falls through to auto-derived value with a warning
• #820 When GRAPHIFY_OLLAMA_NUM_CTX is pinned smaller than the estimated chunk size, graphify now warns explicitly that Ollama will silently truncate the prompt and suggests a corrected --token-budget

Upgrade

pip install -U graphifyy

Bug Fixes

• #811 Unicode identifiers (CJK, Cyrillic, Arabic, accented Latin) no longer collapse to a bare file stem — _make_id now uses [^\w]+ with re.UNICODE to preserve non-ASCII word chars. Added NFKC normalization so composed/decomposed forms of the same character produce the same ID. Switched to casefold() for correct locale-sensitive lowercasing. _normalize_id in build.py kept in sync.
• #803 Dedup edge remap uses explicit key-presence check instead of or so empty-string source isn't silently swapped for the from fallback. Stale from/to keys are now popped after remapping so they can't leak into edge attributes in graph.json.
• #801 --update merge block in skill.md now calls build_merge() directly instead of an inline NetworkX round-trip that re-introduced the direction-flip bug from #760. Dict merge ordering fixed so explicit source/target always win over stale attrs. Hyperedges pulled from G.graph (full merged set) rather than just the new extraction.
• #808 Subagent prompts now receive an absolute CHUNK_PATH derived from graphify-out/.graphify_root at dispatch time — chunk files no longer silently land in the wrong directory due to undefined subagent cwd.
• Skill version mismatch warning suppressed during hook-check (runs on every editor tool use, must be silent) and routed to stderr for all other commands.

Upgrade

pip install -U graphifyy

What's new

Fixes

• Ollama VRAM exhaustion (#798): num_ctx is now derived from the actual chunk size instead of hardcoded 131072. With --token-budget 8192, the old value forced Ollama to allocate 128k KV-cache slots on a 31B model — 4×128k slots by chunk 4 caused OOM. New formula: min(input_tokens + output_cap + 2000, 131072) so an 8k chunk gets ~26k instead.
• Hollow-response warning improved: now mentions VRAM pressure and points to GRAPHIFY_OLLAMA_NUM_CTX / GRAPHIFY_OLLAMA_KEEP_ALIVE env vars as tuning knobs.

Features

• graphify export callflow-html (#797): generates a self-contained Mermaid architecture/call-flow HTML page from graphify-out/graph.json — community sections, interactive flowcharts with zoom/pan, call detail tables, and graph report highlights.
• Living architecture diagram (#800): callflow HTML now auto-regenerates on every --watch rebuild and post-commit hook if the file already exists. Run once, stays current forever.

Upgrade

uv tool upgrade graphifyy
# or: pip install --upgrade graphifyy