v0.9.16

graphify turns any folder of code, docs, papers, images, or videos into a queryable knowledge graph. 0.9.16 is a correctness and privacy release: it fixes two regressions from 0.9.15 that could zero out a graph, closes a residual path leak, and lands a batch of extraction and reliability fixes, most from community reports.

Highlights

• Two 0.9.15 regressions that could empty your graph are fixed (#1873 / #1887 / #1880). A nested .gitignore with a bare * (a common scratch-dir idiom) was applied to the whole tree instead of its own directory, so detect() returned zero files and produced an empty graph; graphify update then saw 0 nodes and refused to overwrite. Nested ignore patterns are now scoped to their own subtree.
• Residual path/username leak closed (#1899). Out-of-scan-root reference targets (an out-of-root .csproj/.sln project, a bash source) and degenerate symbols (a minified $, a JSONC "//" key) could still embed the absolute scan path in a committed graph.json. Both are now portable.
• Silently-lost documents are now surfaced (#1890). When the semantic pass returns a clean response that omits some dispatched documents, the run now reconciles dispatched-vs-returned and warns instead of dropping them without a trace.

All fixes

• Fix: nested .gitignore/.graphifyignore patterns are scoped to their own subtree; a nested bare * no longer zeroes the corpus (#1873 / #1887 / #1885, thanks @Alwyn93).
• Fix: graphify update no longer emits 0 nodes and refuses to overwrite when the tree has a nested broad .gitignore (#1880).
• Fix: close residual absolute-path/username leaks for out-of-root reference targets and degenerate symbols (#1899).
• Fix: the incremental semantic-cache checkpoint no longer fails on sliced (oversized) documents (#1870).
• Fix: --exclude patterns persist into update/watch/hook rebuilds instead of applying only to the initial scan (#1886).
• Fix: Python calls to an imported module (module.function()) now produce a calls edge (#1883).
• Fix: semantic cache writes are scoped so a mis-attributed source_file cannot clobber another file's entry — including the per-chunk checkpoint (#1757 / #1835, thanks @TPAteeq).
• Fix: a full graphify update no longer evicts the LLM semantic edges of a re-extracted document (#1865 / #1868, thanks @xor-xe).
• Fix: ID-collision resolves to a deterministic survivor and warns only about real loss (#1851 / #1852, thanks @bchan84x).
• Fix: --cargo honors Cargo's package = "..." dependency rename (#1858 / #1861, thanks @thejesh23).
• Fix: detect_incremental re-extracts a legacy-manifest file when its mtime moves backwards (#1859 / #1862, thanks @thejesh23).
• Fix: the dedup summary reports the fuzzy-merge count even with zero exact merges (#1857 / #1860, thanks @thejesh23).
• Fix: uppercase TypeScript extensions (.TS/.TSX/.MTS/.CTS) are parsed with the TypeScript grammar (#1881, thanks @xkam7ar).
• Fix: Kotlin builtin/stdlib types are filtered from the references graph (#1876, thanks @kebwlmbhee).
• Fix: the stale/missing-skill version warning prints to stderr, not stdout (#1805 / #1893, thanks @Mzt00).
• Fix: semantic extraction reconciles dispatched vs returned files and warns on silently-omitted documents (#1890).

Install

pip install --upgrade graphifyy
# or
uv tool install graphifyy@0.9.16

Then graphify install to update the skill for your agent.