claude install --strict overwrites the entire ~/.claude/settings.json (destroys mcpServers, plugins, and all other hooks) with no backup

[Second-Summit-marketing]

Severity

Data loss. graphify claude install --strict replaced my entire ~/.claude/settings.json with a file containing only graphify's own hooks. No backup was written. Everything else in the file was destroyed.

Affected version

• graphifyy 0.9.25 (uv tool install)
• Windows 11, Claude Code

What happened

$ cd ~
$ graphify claude install --strict
graphify section written to C:\Users\<user>\CLAUDE.md
  .claude/settings.json  ->  PreToolUse hooks registered (Bash|Grep search + Read/Glob) (strict)

~/.claude/settings.json went from 5117 bytes to 519 bytes.

Before

hooks.SessionStart      2 entries   (memory hook, serena activate)
hooks.PreToolUse        3 entries   (memory hook, serena remind, serena auto-approve)
hooks.PostToolUse       1 entry
hooks.Stop              1 entry / 3 commands
hooks.UserPromptSubmit  1 entry
hooks.SessionEnd        1 entry     (serena cleanup)
mcpServers              repowise, serena
enabledPlugins          7
extraKnownMarketplaces  3
autoUpdatesChannel, theme, agentPushNotifEnabled, skipWorkflowUsageWarning

After

{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash|Grep",  "hooks": [ { "type": "command", "command": "\"...graphify.EXE\" hook-guard search" } ] },
      { "matcher": "Read|Glob",  "hooks": [ { "type": "command", "command": "\"...graphify.EXE\" hook-guard read --strict" } ] }
    ]
  }
}

Every other hook, both MCP server definitions, all plugin registrations, all marketplaces, and every top-level preference were gone. The file was not merged — it was rewritten from a template.

No .bak was created by graphify. I recovered only because I had made an unrelated backup 90 minutes earlier.

Expected

claude install should merge into the existing settings.json:

• append its entries to hooks.PreToolUse, leaving existing entries intact
• leave all other hooks.* sections untouched
• never touch mcpServers, enabledPlugins, extraKnownMarketplaces, or top-level keys

This is what the Codex installer already does correctly — _install_codex_hook in install.py reads the existing hooks.json, filters only graphify entries, and extends:

pre_tool = existing.setdefault("hooks", {}).setdefault("PreToolUse", [])
existing["hooks"]["PreToolUse"] = [h for h in pre_tool if "graphify" not in str(h)]
existing["hooks"]["PreToolUse"].extend(hook_entry["hooks"]["PreToolUse"])

The Claude Code path should do the same thing. It appears to write a fresh object instead.

Also, please write a backup

Given this writes to a live agent config, a timestamped .bak before any write would turn a catastrophic failure into a recoverable one. Related precedent: #2062 (graphify uninstall deletes user-written content).

Secondary bug in the same command

The same invocation wrote the markdown section to ~/CLAUDE.md (the cwd) rather than ~/.claude/CLAUDE.md (Claude Code's user-scope memory file). An earlier graphify install run from a different directory had correctly targeted ~/.claude/CLAUDE.md, so the destination depends on the shell's working directory. Same class as #2164.

Reproduce

1. Have a populated ~/.claude/settings.json with mcpServers, enabledPlugins, and hooks in several sections
2. graphify claude install --strict
3. Diff the file

Environment

• Windows 11, PowerShell 5.1
• graphifyy 0.9.25 via uv tool install
• Claude Code with 7 plugins, 2 MCP servers, hooks in 6 sections

[safishamsi]

Fixed in v0.9.27. The installers now read utf-8-sig, refuse to modify a settings file that isn't a JSON object (instead of clobbering it), and back up to .graphify-bak before any write. https://github.com/Graphify-Labs/graphify/releases/tag/v0.9.27