* feat: add Swift language support
Add tree-sitter-swift extractor for classes, structs, protocols,
functions, imports, and call graph edges. Includes 8 passing tests.
* feat: full Swift AST support — enums, extensions, actors, conformance
- Enums: extract enum types, methods, and cases (case_of edges)
- Extensions: methods attach to the original type (no duplicate nodes)
- Actors: recognized via unified class_declaration node type
- Conformance/inheritance: inherits edges from : Protocol syntax
- deinit/subscript: name resolution for nameless declarations
- 12 new tests (110 total, all passing)
Two targeted security hardening changes:
1. SSRF: validate_url() now resolves hostnames and blocks private/reserved
IP ranges (127.x, 10.x, 169.254.x, etc.) and cloud metadata endpoints.
Prevents SSRF attacks in cloud environments where a URL like
http://169.254.169.254/latest/meta-data/ could leak instance credentials.
2. Neo4j Cypher injection: Node labels (file_type) are now sanitized to
alphanumeric + underscore before interpolation into Cypher queries.
Previously, attacker-controlled file_type metadata could inject
arbitrary Cypher in team/shared graph scenarios.
Both changes are zero-impact on normal UX - no new config, no new flags,
no behavioral changes for legitimate use.
- Add --graphml to Usage table (was implemented but undocumented there)
- Remove early manifest save from --update merge step (Step 9 owns it; saving early meant failed pipelines left manifest ahead of graph)
- query/path/explain now check graph.json exists before running, with clear "run /graphify first" message
- --no-viz: clarify it skips both Obsidian vault and HTML (was contradictory)
- Replace pyvis with custom vis.js renderer: node size by degree,
click-to-inspect panel with clickable neighbors, search box,
community filter, physics clustering by community
- HTML graph generated by default on every run (no --html flag needed)
- Token reduction benchmark auto-runs after every /graphify on corpora >5k words
- Fix 292 edge warnings: silently skip stdlib/external edges in build.py
- Fix build() to merge extractions before building (cross-extraction edges were dropped)
- Add 5 HTML renderer tests (223 total)
- Remove unnecessary files: lib/, tests/eval_attention.py, misplaced eval reports
- Add graphify-out/ and .graphify_*.json to .gitignore
- Bump version to 0.1.4, remove pyvis dependency
- README: token reduction as top-level selling point, vis.js in tech stack,
graph.html in output listing, correct test count and install command
style: replace all em dashes with hyphens
fix: explain hidden .graphify/ folder in skill output and README
fix: rename .graphify/ to graphify-out/ so output is visible by default
- Add GitHub Actions CI workflow (Python 3.10 and 3.12)
- Add CI badge to README
- Add ARCHITECTURE.md: pipeline overview, module table, schema, how to
add a language extractor, security summary
- Move eval reports from tests/ to worked/httpx/ and worked/mixed-corpus/
- Fix README: test count 163→212, language table (13 languages via
tree-sitter), extract.py description, worked examples links
benchmark: 8.8x token reduction on nanoGPT + minGPT + micrograd
- Run AST extraction on 29 Python files across 3 Karpathy repos
- 177 nodes, 246 edges, 17 communities (Leiden)
- 8.8x avg token reduction vs naive full-corpus context stuffing
- Notable: micrograd cleanly splits into engine/nn communities;
nanoGPT model vs training loop correctly separated
- Honest: stdlib import noise flagged, config isolates documented
benchmark: 71.5x token reduction on mixed corpus (code+papers+images)
Full run: nanoGPT+minGPT+micrograd + 5 research papers + 4 images
285 nodes, 340 edges, 53 communities
Average BFS query: 1,726 tokens vs 123,488 naive (71.5x)
Code-only (AST) sub-benchmark: 8.8x on 13k-word corpus
Safi