v0.9.27

A large maintenance release: install-safety fixes, node-identity/canonicalization fixes, cross-file resolution improvements, and a batch of community contributions.

Install and data safety

• claude/gemini/codex/codebuddy install no longer overwrite a settings/hooks file they cannot parse (#2167). On any JSON parse error they used to fall back to an empty config and rewrite the whole file, destroying the user's settings (most often triggered by a UTF-8 BOM). They now read utf-8-sig, refuse to modify a non-JSON-object file, and back up to <name>.graphify-bak before any write.
• Incremental extract --no-cluster no longer overwrites the full graph with just the changed files (#2169). It now merges the existing graph forward with the same replace/prune semantics as the clustered path and canonicalizes cross-file edge targets.
• Running the test suite no longer touches the developer's real ~/.claude/~/.gemini/~/.codebuddy/~/.copilot (#2168).

Node identity and caching

• stat-index.json is stored with root-relative keys (re-anchored on load, mirroring manifest.json) and pruned of deleted-file entries, so a moved or cloned corpus keeps its cache hits instead of re-extracting everything (#2199).
• JavaScript/TypeScript regex-rescued imports (Svelte/Astro/Vue) no longer create ghost target nodes with absolute-path ids (#2195).
• Cross-file concept nodes with identical normalized labels now merge, matching the behavior already applied to near-identical labels (#2182).
• Absolute source_file paths (for example from a Windows scan) no longer break node identity (#2197), and build_from_json folds legacy field aliases (name/path/type/confidence_score) so alias-carrying nodes stop entering the graph invisible and unmergeable (#2194).

Resolution

• C# member calls on a typed receiver now resolve namespace-aware, with base./this.field receivers, inherited-member lookup through the inherits chain, and shadow-poisoning so a local shadowing a field of a different type no longer produces a wrong edge (#1609, adapted from #1620 by @TheFedaikin).
• Python decorators now create graph edges so affected <decorator> finds what a decorator touches, with builtin/stdlib decorators excluded (#2154, thanks @Rishet11).
• JavaScript/TypeScript non-relative imports resolve through jsconfig.json/tsconfig.json baseUrl and paths (#2153, thanks @Rishet11).
• Swift/Foundation/SwiftUI builtins are filtered from call resolution and god-node ranking (#2147, thanks @MasterFede5).
• graphify query/explain no longer fabricate indirect_call edges to class definitions (#2137, thanks @Rishet11).
• Bash calls into a sourced file resolve for extensionless scripts and bare source lib.sh (#2171), and source "${VAR}/lib.sh" resolves against the variable's real directory (#2172). Both thanks @Souptik96.
• SQL routines with PL/pgSQL-only bodies that tree-sitter cannot parse are recovered by a raw-text scan, gated on a failed parse (#2180, thanks @Souptik96).

Windows and hooks

• The git-hook interpreter allowlist accepts Windows backslash paths (#2126, thanks @Rishet11) and interpreter paths containing a space (#2166, thanks @Souptik96); the rebuild timeout is armed on Windows via a threading fallback (#2148, thanks @Rishet11); the extraction process pool is skipped when only one worker is available (#2173, thanks @Souptik96).
• The Codex PreToolUse hook is documented as an intentional no-op (#2165, thanks @Souptik96).