The ambiguous-name refusal added in #4517 routed through _resolve_single_node,
whose winning tier can be a prefix or substring match, so a bare search keyword
that merely substring-matched several labels was wrongly refused: `query "client"`
returned EXIT 3 because it is a substring of `AlphaClient`/`BetaClient`. That
narrowed query's keyword-search semantics.
Adds _query_name_refusal, which refuses only when the term EXACTLY names several
nodes (the source_exact/exact tiers) -- #4511's `.nonce()` case -- and otherwise
falls through to scoring. The `query` and `--seed` paths use it; explain/path/
get_node keep _resolve_single_node, whose prefix/substring tiers are correct for a
direct node lookup. Adds a regression test that a substring keyword still searches.
Co-Authored-By: shivampal46011 <shivampal46011@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
query guessed a node when the same name existed in several files, and an ambiguous --seed still exited 0. explain and path already refuse that lookup. query now returns the same candidate list and exits 3, and a --seed that matches nothing exits 4.
_shebang_interpreter returned the interpreter exactly as written, and both
detect's _SHEBANG_CODE_INTERPRETERS and extract's _SHEBANG_DISPATCH list
only the generic names. An extensionless CLI starting with
#!/usr/bin/env python3.12, #!/usr/bin/python2.7 or #!/usr/bin/lua5.4 was
classified as None and silently left out of the scan. Map a version
suffix on a known interpreter back to that interpreter (python3.12 ->
python3, lua5.4 -> lua) in the shared parser, so detection and extractor
dispatch both see it. Unknown names are left as they are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
extract_pdf_text wrapped the whole PdfReader loop in except Exception:
return "", so a malformed or encrypted PDF looked exactly like a PDF with
no text and dropped out of the graph with no trace. Keep returning ""
(callers rely on it), but print a warning naming the file and the error
first. Warn once per path, since detect() and the semantic pass both read
the same file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Obsidian writes wikilink paths from the vault root, so scanning a folder
below it meets links like [[Corp/wiki/Fox]] from inside Corp/. The
vault-wide fallback matched them as suffixes of root-relative paths,
which never succeeds, and the references edge was dropped. When nothing
matches, drop the longest leading run of the scan root's own folders
and match the rest exactly from the root.
_run_cli refreshed stale skills and old OpenCode plugins before the
--version/--help early returns, so checking what was installed rewrote
SKILL.md, left a .bak and restamped .graphify_version. Skip both
refreshes for version, help and `<cmd> --help`; the stale-skill warning
still runs, since it only reads. Free-text commands keep refreshing.
Carries the tests that belong with the module-call exact-name fix (#4577): the
fix landed via the PR's follow-up perf commit, which did not include the test
file. Adds the PR author's five cases (exact-name function/class resolution,
aliased import, fold-only fail-closed) plus a negative cross-module case proving a
call never binds to a same-named child of an UNRELATED module -- the one headline
risk of re-bucketing by exact name.
Co-Authored-By: madhusudanpatnaik <madhusudanpatnaik@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up to #4566. Adds an opaque (non-JWT) `Bearer <token>` shape to the
credential redactor so `Authorization: Bearer <opaque>` is redacted (the JWT form
was already caught by the eyJ pattern); the word "Bearer" is kept, only the token
is replaced. Adds an over-redaction regression test proving a 40-char git SHA, a
sha256 digest and a UUID pass through untouched, so the redactor never mangles the
ordinary high-entropy identifiers that appear in real rationale labels.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Metal (.metal) and CUDA (.cu/.cuh) are C++-derived GPU languages that route
through the C++ extractor, but their qualifiers are not part of the C++ grammar:
- Metal address-space / function qualifiers: `device`, `constant`,
`threadgroup`, `thread`, `kernel`, `vertex`, `fragment`, ...
- CUDA execution-space / memory qualifiers: `__global__`, `__device__`,
`__host__`, `__shared__`, `__constant__`, `__forceinline__`, ...
tree-sitter-cpp parses a leading qualifier as the declaration's
`type_identifier` (the real type is pushed into an ERROR node), and
`_cpp_collect_type_refs` emitted it as a type reference. Each qualifier then
became a sourceless, corpus-shared god node that every shader/kernel
`references` (e.g. `kernel`/`device`/`constant` on sample.metal,
`__global__`/`__device__`/`__host__` on sample.cu, the CUDA ones colliding on
ids `global`/`device`/`host`). That is a provenance violation — a node with no
source_file — and the hubs also pollute god-node rankings in analyze.
Skip a fixed per-extension set of dialect qualifier keywords in the C++
type-ref collector, keyed by file extension so plain `.cpp`/`.cc`/`.h` files
are untouched (there these words are legal identifiers and still resolve as
real user types). Genuine user types in the shader/kernel (the `Vec3` struct)
are preserved.
Documented limitation: `constant Foo* p` buries the real `Foo` type inside the
ERROR node, so `Foo` is not recovered; this change only removes the bogus
qualifier node.
Docstrings and `# WHY:`/`# NOTE:` comments become rationale node labels,
which are persisted verbatim to graph.json, graph.html, GRAPH_REPORT.md and
the AST cache. A token pasted into a comment therefore ended up in the
artifacts the README tells users to commit and share.
Add security.redact_secrets() (shape-based: vendor-prefixed tokens, PEM
private-key headers, JWTs, URL passwords) and apply it in
_shorten_rationale_label(), before truncation so a cut can't leave a partial
token. That helper is shared by the Python and JS/TS rationale extractors.
Related to #2781 (document text sent to LLM backends unredacted); this
covers only the comment/docstring -> graph path.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A C-API header guarded by `#ifdef __cplusplus extern "C" {` has no
class/namespace/template/:: marker, so `_is_cpp_header` left it on
extract_c. The C grammar rejects the linkage block and the header
extracts zero symbols (e.g. whisper.cpp's include/whisper.h and
include/parakeet.h), dropping the project's public API from the graph.
Add `extern "C"` to `_CPP_HEADER_MARKERS`. ObjC sniffing keeps priority.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since #4500, graph.json carries "multigraph": true whenever it holds
parallel edges (imports and calls between the same pair, say), and
graphify export loads it as a MultiGraph. to_graphml's attribute
coercion indexed edges as H.edges[u, v], which needs a key on a
MultiGraph, so graphify export graphml crashed with "not enough values to
unpack" and wrote nothing. Iterate edges(data=True) instead, which works
for both graph types and keeps every parallel edge.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gh's statusCheckRollup mixes CheckRun entries (status/conclusion) with
StatusContext entries, the commit statuses external CI such as Jenkins or
CircleCI posts, which carry only a state. _parse_ci never read state, so a
failing external CI showed as NONE, or as SUCCESS beside a passing check
run, and the PR was classified READY instead of CI-FAIL in pr list,
triage and the MCP PR tools. Fold state into the conclusions, with ERROR
as a failure and PENDING/EXPECTED as pending.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The git symbolic-ref fallback in _detect_default_branch kept only the last
path segment of refs/remotes/origin/<branch>, so a default branch named
release/2.x came back as 2.x and every PR targeting it was classified
WRONG-BASE. Strip the refs/remotes/origin/ prefix instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Swift 5.9 macros were dropped entirely. `macro stringify(...) = #externalMacro(...)`
parses as a `macro_declaration` (freestanding or attached), which was in neither
`function_types` nor `class_types`, so the symbol never entered the graph. A
freestanding call `#stringify(...)` parses as a `macro_invocation`, not a
`call_expression`, so its call edge was lost too.
- Add `macro_declaration` to the Swift `function_types`. It has no `name` field,
but the name is a bare `simple_identifier` child already covered by
`name_fallback_child_types`, so the existing name resolution handles it; the
generic `<T>` type parameter is excluded by the existing type-param scope pass
(no `t` god node).
- Add `macro_invocation` to `call_types` and give it a callee branch in
walk_calls: a freestanding macro is a free top-level symbol (resolved by bare
name, no `self` receiver). Calls inside the macro's arguments
(`#stringify(helper())`) still resolve because walk_calls recurses into the
invocation's children.
Attached-macro *usage* (`@AddCompletion` on a type) is an attribute, not a
`macro_invocation`, so it is not linked to the macro — left unresolved
(fail-closed); the declaration itself is still extracted.
A C# `delegate` is a named type, but `delegate_declaration` was in neither
`class_types` nor `function_types`, so the declaration was dropped from the
graph. A field or parameter typed as the delegate (`public BinOp Op;`,
`int Apply(BinOp f, ...)`) still resolved the name `BinOp` through
`ensure_named_node`, which minted a *sourceless* stub and pointed the
`references` edge at it — even though `BinOp` is declared in the same file.
That violates the provenance invariant: a real source-backed declaration must
not lose to a sourceless god node (and the bare-id stub becomes a cross-file
hub shared by every same-named reference in the corpus).
`delegate_declaration` has a `name` field and no body, so adding it to the C#
`class_types` emits a clean empty type node (no phantom members) that the
in-file references now bind to. Namespaced delegates are scoped and contained
exactly like the sibling class/enum/struct declarations.
Delegate parameter/return type references and delegate-instance invocation
resolution are unchanged (out of scope).
A Kotlin `typealias` is a named type, but `type_alias` was in neither
`class_types` nor `function_types`, so the declaration was dropped from the
graph. A property or parameter typed as the alias (`var onClick: ClickHandler?`,
`fun handler(h: ClickHandler)`) still resolved the name `ClickHandler` through
`ensure_named_node`, which minted a *sourceless* stub and pointed the
`references` edge at it — even though the alias is declared in the same file.
That violates the provenance invariant: a real source-backed declaration must
not lose to a sourceless god node (and a bare-id stub becomes a cross-file hub
shared by every same-named reference in the corpus). Scala and TypeScript
already model type aliases as nodes, so Kotlin was the inconsistent outlier.
`type_alias` has an `identifier` name (covered by `name_fallback_child_types`)
and no body, so adding it to the Kotlin `class_types` emits a clean empty type
node (no phantom members) that the in-file references now bind to.
_fold_confidence normalized the confidence/confidence_score pair on edges
and hyperedges, but nodes passed through the build verbatim, so a model
emitting a lowercase enum value, a bare float, or a drifted word for a
node's confidence landed in graph.json as-is. Fold it in
_fold_node_aliases, which both build_from_json and build_merge already
call, so nodes share one normalization contract with edges.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When a labeling reply is cut off mid-object, _parse_label_response falls
back to a regex that pulls the complete "<cid>": "<name>" pairs, but it
used the captured string body as-is. Escapes such as \u00e9 and \" then
ended up in the community name as literal backslashes, while the same
name in a complete reply decoded correctly. Decode each salvaged value as
a JSON string body, keeping it unchanged when it is not a valid one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Windows PowerShell 5.1 (Set-Content -Encoding UTF8) and older Notepad save
UTF-8 with a BOM. load_graphifyrc read the file as plain utf-8, so the BOM
became part of the first key; unknown keys are ignored by design, so that
setting (say language.inc=php) vanished without a warning. Read with
utf-8-sig, as the other Windows-edited files in the repo already are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Pi skill rendered the shared agent-tool-disk dispatch, which tells the
host to use subagent_type="general-purpose". pi-subagents has no agent by
that name and rejects it as unknown, so semantic extraction never started
(#4494). Step B3's re-run hints named the same agent.
Pi now gets its own dispatch fragment that sends one builtin `delegate`
agent per chunk; delegate has read, bash, edit and write. The two B3 hints
are core slots filled per dispatch variant, so every other host renders
byte-identical output.
(cherry picked from commit a0b3a053a5)
`extractors/markdown.py` read the scan root of the extraction in flight with a
function-local `import graphify.extract` + `getattr(_extract,
"_XAML_ACTIVE_EXTRACT_ROOT", None)`. That violates MIGRATION.md invariant #4
("never import from graphify.extract inside this package; direction is
extract.py -> extractors/"), and the `getattr(..., None)` meant a rename of the
module global would silently disable Markdown wikilink (Obsidian vault)
resolution rather than fail loudly.
Move the ambient scan root onto `extractors/base.py` — where the extractors
legitimately live — as `set_active_scan_root()` / `active_scan_root()`.
`_safe_extract_with_xaml_root` now publishes the root there (still saving and
restoring for nested extraction), the two XAML readers and the Markdown vault
lookup read it through the accessor, and `markdown.py` imports it in the correct
direction. The `_XAML_ACTIVE_EXTRACT_ROOT` module global in extract.py is gone;
nothing else referenced it.
Behavior is unchanged — the same process-global root is set around each
extraction and read by the same sites. Tests assert the extractor no longer
imports graphify.extract (fails on the old code), that the set/get/restore
contract nests correctly, and that markdown's accessor IS the base accessor.
The markdown, XAML/dotnet, and language suites stay green; the only failures on
this machine are the pre-existing v8 baseline set (c-include determinism,
wikilink-unicode, two watch cwd-deleted cases), which fail identically on clean
v8.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJbLfztSxm2tH5cJwBbe9q
(cherry picked from commit 86721f765d)
Covers every shape the issue reports: the non numeric drifted words,
a numeric looking string that still backfills confidence_score, a
case only variant that gets recased rather than treated as an
unknown word, the three valid spellings staying untouched, and the
new hyperedge fold. A build_from_json test reproduces the issue's
own warning text end to end and checks it no longer prints.
(cherry picked from commit da369c5ea8)
Covers the exact repro from issue 4492: a node with a source_file and
one without, sharing an id that neither file encodes. Checks both
arrival orders keep the sourced node, matching the sibling order
independent tests already covering the lifecycle and path form
tiebreaks right next to it.
(cherry picked from commit 151becb880)
bash runs the backticked text in Part C's comment when graphify is on PATH, which broke the test in CI. The blocks do not need it. Also narrow three Optional values for pyright. The test checks the same things.
(cherry picked from commit e487672683)
Part A reads .graphify_detect.json and Step 9 deletes it, but the aider
and devin --update sections never wrote it again, so Part A raised
FileNotFoundError after any full build.
The sections now write it from .graphify_incremental.json, as the
generated references/update.md does, with each file's own path
convention.
The test no longer seeds the file; it asserts the update section wrote
it.
(cherry picked from commit ca090b6da5)
On aider and devin nothing wrote .graphify_semantic.json for a code-only
run, so Part C raised FileNotFoundError, and the --update paragraph sent
the agent from Part A to a merge that reads .graphify_extract.json.
Part B now has the fast-path block, the paragraph names Step 3A, the
fast path, Part C and the merge, and aider's only-deletions guard writes
the file its merge reads.
Adds tests/test_code_only_update_all_hosts.py for the two monoliths and
a skillgen audit entry for the new lines; the 14 generated hosts are
left to #4313.
(cherry picked from commit bbe1a7ca9b)
Checks every generated skill file statically, and runs the Part C and
update merge statements under bash with a stub interpreter. This commit
alone fails 58 cases (29 per check); the next commit fixes them.
(cherry picked from commit 0bbdd9d36c)
Preserve user-supplied database URIs in generated export instructions.
Prevent Neo4j and FalkorDB push workflows from replacing custom destinations with localhost.
Document safe URI quoting and credential handling.
Add regression coverage for URI forwarding and export-only behavior.
Co-authored-by: OpenAI Codex <codex@openai.com>
(cherry picked from commit 813b94ff51)
Two guards for the review questions on #4468: an in-file call to
`ignore()`, `e()` or `E()` binds by the name as written and reaches the
salted node (on v8 the calls to `ignore()` and `E()` bind nowhere, since
those functions had no node), and the other types in a Go file that holds
a case-only pair keep the ids they have without the pair.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 5c49344807)
#3782 left a reference placed above `struct Handle` on a sourceless stub
whenever another file-level item folded to the same id (`fn handle`,
`const HANDLE`, an `impl` for `HANDLE`), because walk() gave that id to
whichever item came first. Those items now get ids of their own, so the
struct owns its id and the reference can resolve to it, as a reference
below the declaration already did. Without this, the stub only folds back
when the type's name is unique across the corpus.
A declared type is now pre-registered unless a non-type item has its
exact name (`fn Foo()` beside `struct Foo {}` still share one node), and a
`type HANDLE` alias still keeps its stub. The #3782 test that pinned the
stub for the case-only shapes now asserts the resolution; the shapes that
still share a node keep the stub assertion.
local_type_names becomes a frozenset, which is what
_rust_collect_type_refs is annotated to take.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit f710c8a16e)
make_id casefolds, so in one file `type ResponseWriter interface` and
`type responseWriter struct` (gin), or `struct Ignore` and `fn ignore`
(ripgrep), mint one node id. The walk keeps whichever
declaration it meets first and drops the other: the dropped struct's
methods hang off the interface, and a dropped function's calls are
credited to the struct.
Go: the #2779 census now also counts `type` declarations, using its
existing rule. The exported type keeps the plain id and the other is
salted; its methods, receiver anchors and in-file type references use the
salted id. Types are counted first so methods are keyed under their
owner's final id.
Rust: the #3782 pre-scan already lists every file-level item behind an
id, so it doubles as the census. The one declared struct/enum/trait in a
group keeps the plain id (type positions and `impl` blocks name it, so it
and its methods do not move) and every other member is salted with a
hash of its own name; with no single declared type, every member is
salted. `#[cfg]` twins are one name and still share one node.
A name that does not collide keeps its id. The census is per file: a
case-only pair split across two files of one Go package is not covered.
Related to #3302 and #2810.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit bef78ffdbd)
Review on #4479: after the exact-name lookup, the `_key` fallback in
_resolve_typescript_member_calls still matched loosely. With #4475 splitting
close/#close, updateHash/_updateHash and set/$set into separate nodes, one
normalized key can now map to two members, and method_index kept whichever
was registered last. So c._close() bound to #close, c.UpdateHash() to
_updateHash, and c.a() to $a, none of which is the called name. Track keys
that more than one member normalizes to and skip the fallback for them (no
edge rather than a guess). Exact hits, and loose hits with a single
candidate, are unchanged.
Co-Authored-By: Grok Bot
(cherry picked from commit a1ce057757)
make_id drops _, $ and #, so updateHash/_updateHash, close/#close and
set/$set in one JS/TS class body minted one id and the second member
disappeared, with its calls attributed to the survivor. Group each class
body's member names by id and reuse the Python/C# collision rule
(_underscore_salted_nid, now with configurable private prefixes): a unique
public name keeps its id, colliding private ones get a salted id.
Non-colliding members keep their ids. The TS cross-file member resolver now
matches the exact member name before falling back to the normalized key, so
c.set() still binds to set and not $set.
Fixes#4475
Co-Authored-By: Grok Bot
(cherry picked from commit 03beac9d09)
The Python collision pre-scan (#3302) recorded module-level functions and
class methods but not module-level class names, so a class sharing an id
with a function or another class after normalization still lost one
declaration to first-wins add_node:
- `class Session` / `def session()` (requests/sessions.py): session() is
absent from the graph, and which one survives depends on declaration order
- `class Foo` / `class FOO`, `class Pair` / `class _Pair`
Record module-level classes in the same scope as functions and salt the
class id with the existing _underscore_salted_nid rule. Methods of a salted
class are minted under the salted id, so the pre-scan now keys their groups
under the class's resolved id; keying them under the plain one would drop
the existing `_get`/`get` protection inside that class. Same-file base-class
references go through the same salt (as C# already does), so
`class Sub(Session)` binds to the real class instead of minting a sourceless
`Session` stub. The pre-scan also looks through decorated_definition, so
`@dataclass class Session` and the `_x` / `@property x` method idiom are
covered too.
Ids change only for files that contain such a collision; cached AST results
for them keep the collapsed ids until the AST cache schema is bumped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 03b420df97)
post-commit skipped on CHERRY_PICK_HEAD, which git leaves on disk while
the hook runs, so a clean pick never rebuilt. A rebase has no hook that
fires once at the end, because post-commit and post-checkout skip while
rebase-merge/ exists.
Drop the CHERRY_PICK_HEAD check. For a range pick or revert, skip every
step but the last and diff from sequencer/head, so one rebuild covers
the range; ignore a stale sequencer/ left by git reset --hard. Add a
post-rewrite hook that rebuilds on rebase.
(cherry picked from commit 47085dd742)
git leaves .git/MERGE_HEAD on disk while post-merge runs and deletes it
only after the hook returns, so the guard exited on every merge that
makes a merge commit. Only fast-forwards rebuilt. The post-commit and
post-checkout guards are unchanged.
(cherry picked from commit c37d35bd50)
_find_vcs_root() accepted any .git, so an empty or partial .git folder in a
home directory became the ignore-walk ceiling and its .gitignore leaked into
unrelated scans. A .git directory now needs HEAD, objects/ and refs/ (what
git checks), and a .git file must start with gitdir: (worktrees,
submodules). No git subprocess; OSError means not a root. Other VCS
markers are unchanged.
The three VCS-boundary tests that faked a repo with a bare mkdir .git now
use a minimal valid .git.
Co-Authored-By: Grok Bot
(cherry picked from commit f0b6493163)
A named import through a barrel gets an `imports` edge from the structural
extractor to `<barrel>_<symbol>`, and the symbol facts add a second one to
the defining symbol. The barrel defines nothing, so the first edge dangles
and build mints it as an external stub. Through a named re-export barrel
the first edge was repointed instead, so the same import came out as two
identical edges.
After the facts loop, drop the structural edge when its import resolves
to exactly one owned symbol behind the barrel. An ambiguous barrel (one
name from two modules) and a chain that ends in a third-party package
keep the edge, as before.
(cherry picked from commit 0aaac55a86)
#3834 let a workspace import whose `main`/`types` point into dist/ fall
through to `src/index`, but an `exports` map returned its own candidates
and never reached that fallback. A tsc-built package with
`"exports": {".": {"import": "./dist/index.js"}}` therefore resolved to
dist/ (outside the corpus, so an external stub) when it was built, and to
nothing on a clean clone.
Append each build-output exports target's source twin (dist/sub.js ->
src/sub) and, for the root entry, src/index and index. They come after the
exports targets, and _resolve_workspace_import already prefers a file
outside build output, so source wins when it exists and dist/ stays the
fallback.
(cherry picked from commit 705abe6c4c)
detect_backend() picks a cloud provider purely from whichever API key is set
in the environment, and community labeling additionally falls back to claude -p
when the CLI is on PATH. Keys in a developer environment are often there for
other tools, so a bare `graphify extract .` could send uncached documents to a
provider the user did not intend.
Add explicit control without breaking existing auto-detect flows:
- GRAPHIFY_BACKEND=<name> selects a backend explicitly and wins over ambient
keys; GRAPHIFY_BACKEND=none disables every LLM backend, including the label
claude -p fallback. `graphify extract` then keeps the local AST pass and
reports what it held back instead of failing or auto-selecting a provider.
- Auto-detection now reports the exact environment variable that selected the
backend, so sending a corpus to a cloud provider is never a surprise.
- The claude -p labeling fallback is announced, and GRAPHIFY_BACKEND=none opts
out of it (it is otherwise kept: silently downgrading good labels to
"Community N" was the reason it exists).
- extract_files_direct raises a clear error naming GRAPHIFY_BACKEND when the
library caller would otherwise auto-detect a disabled backend.
README data-residency note updated. detect_backend_with_source() now carries the
detection logic and names its source; detect_backend() delegates to it.
Note: this deliberately keeps auto-detection ON by default (the issue's
alternative #2) rather than flipping cloud use to opt-in, which would break
every existing key-less `graphify extract` flow. GRAPHIFY_BACKEND makes the
opt-in switch a one-liner for a follow-up if maintainers prefer it.
(cherry picked from commit 7e2467ea43)
The native-backend extraction prompt never says what source_file means; its
only guidance is the schema placeholder "relative/path". When a document
cites, links, or describes another file (a "Source:" line, a "Related:" list,
a wiki link, a class a design doc specifies), the model often attributes the
document's own entities to that file. On an incremental run the out-of-scope
filter (#1895) then drops them, so the document silently loses nodes (#2297,
#3377), or a doc-described API is attributed to the code file (#2270).
The skill path already states a source_file RULE in extraction-spec.md. Add
the native-backend equivalent: source_file is the `path` of the enclosing
<untrusted_source> block (or the listed source_file for an image), a file
named inside a source is a reference rather than the source, and the
reference is modelled as a node attributed to the enclosing file plus a
`references`/`cites` edge. The prompt change re-keys the semantic cache via
the existing prompt fingerprint (#1939), so affected files re-extract on
their next change.
Closes#3377
Refs #2270, #2297, #2217, #3982, #2276
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit ff0b4e0dcd)
A one-node membership change failed the exact signature check and replaced the saved name with the hub label. Keep the name when the shared nodes are a strict majority of both the saved set and the current set.
Related to #2298
(cherry picked from commit 62e83eabff)
