Fourteen bugs fixed across two community code reviews.
Git hooks now exit with a non-zero code when a rebuild fails. Previously the hook caught the exception and exited 0, so git assumed everything was fine and your graph would go stale with no warning.
The /graphify query token budget was overshooting by about 3x. The character-to-token ratio has been corrected.
Deleted files are now tracked in incremental mode. If you remove a file and run /graphify --update, its nodes are flagged for cleanup instead of staying in the graph as ghost nodes.
Cache writes are now atomic. A crash mid-write no longer leaves a corrupt cache entry that silently causes a full re-extraction on the next run.
/graphify add tweet fetching was bypassing SSRF protections and making raw HTTP requests. It now routes through the same safe fetch layer as everything else.
Neo4j Cypher export was vulnerable to injection via backslash sequences in node labels. Escaping is now correct.
The HTML visualization was embedding AI-generated community labels directly into innerHTML without sanitization. Labels are now sanitized before rendering.
Graph diff was reporting phantom additions and removals on undirected graphs because edge key ordering was non-deterministic. Edge keys are now normalized.
The file cache was keyed only on content hash, so two files with identical content would share a cache entry with wrong source metadata baked in. The file path is now included in the key.
Hook uninstall used a naive string split that could corrupt other hooks sharing the same file. Uninstall now uses paired start and end markers.
What is next
v0.4.0 brings local embeddings via quantized Gemma 4, no API cost for semantic similarity. Also planned: more /graphify add sources, graph diff across runs, and worked examples for Codex and OpenCode.