graphify install now auto-detects Windows and installs the Windows skill
variant. skill-windows.md replaces bash-specific commands (which, head, tr,
rm -f, mkdir -p) with PowerShell equivalents. Bumps to v0.3.3.
* feat: add Swift language support
Add tree-sitter-swift extractor for classes, structs, protocols,
functions, imports, and call graph edges. Includes 8 passing tests.
* feat: full Swift AST support — enums, extensions, actors, conformance
- Enums: extract enum types, methods, and cases (case_of edges)
- Extensions: methods attach to the original type (no duplicate nodes)
- Actors: recognized via unified class_declaration node type
- Conformance/inheritance: inherits edges from : Protocol syntax
- deinit/subscript: name resolution for nameless declarations
- 12 new tests (110 total, all passing)
Two targeted security hardening changes:
1. SSRF: validate_url() now resolves hostnames and blocks private/reserved
IP ranges (127.x, 10.x, 169.254.x, etc.) and cloud metadata endpoints.
Prevents SSRF attacks in cloud environments where a URL like
http://169.254.169.254/latest/meta-data/ could leak instance credentials.
2. Neo4j Cypher injection: Node labels (file_type) are now sanitized to
alphanumeric + underscore before interpolation into Cypher queries.
Previously, attacker-controlled file_type metadata could inject
arbitrary Cypher in team/shared graph scenarios.
Both changes are zero-impact on normal UX - no new config, no new flags,
no behavioral changes for legitimate use.
- Add --graphml to Usage table (was implemented but undocumented there)
- Remove early manifest save from --update merge step (Step 9 owns it; saving early meant failed pipelines left manifest ahead of graph)
- query/path/explain now check graph.json exists before running, with clear "run /graphify first" message
- --no-viz: clarify it skips both Obsidian vault and HTML (was contradictory)
- Replace pyvis with custom vis.js renderer: node size by degree,
click-to-inspect panel with clickable neighbors, search box,
community filter, physics clustering by community
- HTML graph generated by default on every run (no --html flag needed)
- Token reduction benchmark auto-runs after every /graphify on corpora >5k words
- Fix 292 edge warnings: silently skip stdlib/external edges in build.py
- Fix build() to merge extractions before building (cross-extraction edges were dropped)
- Add 5 HTML renderer tests (223 total)
- Remove unnecessary files: lib/, tests/eval_attention.py, misplaced eval reports
- Add graphify-out/ and .graphify_*.json to .gitignore
- Bump version to 0.1.4, remove pyvis dependency
- README: token reduction as top-level selling point, vis.js in tech stack,
graph.html in output listing, correct test count and install command
Safi