v0.8.26

## What's new

### New features

**Circular import cycle detection** — `GRAPH_REPORT.md` now includes an `## Import Cycles` section showing file-level circular dependencies. Uses Johnson's algorithm on a directed file-level import graph, deduplicates rotations, and sorts by cycle length (tightest coupling first). Also available programmatically via `find_import_cycles(G)` in `graphify.analyze`. (#961 — thanks @deXterbed)

**Custom LLM provider registry** — Register any OpenAI-compatible endpoint without touching source code:
\`\`\`bash
graphify provider add nvidia \
  --base-url https://integrate.api.nvidia.com/v1 \
  --default-model minimaxai/minimax-m2.7 \
  --env-key NVIDIA_API_KEY

graphify provider list / show / remove
\`\`\`
Providers stored in `~/.graphify/providers.json`. Custom providers are auto-detected after all built-ins in `detect_backend()` priority so they never shadow a configured paid key. Works for any OpenAI-compatible endpoint: NVIDIA NIM, vLLM, OpenRouter, Together AI, LiteLLM, Fireworks, etc. (#1084 — thanks @timburman)

### Bug fixes

**`extract_files_direct()` no longer silently defaults to kimi (Moonshot AI)** — `backend=None` now calls `detect_backend()` and picks whichever API key you have set, matching CLI behavior. Raises a clear `ValueError` listing all options if nothing is configured. README Privacy section updated with data-residency notes and provider priority order. (#1086 — thanks @EmanuelFaria)

**`pnpm-workspace.yaml` crash on Python 3.10 fixed** — `packages: - '.'` (single-package-at-root workspace) caused `IndexError: tuple index out of range` in `_load_workspace_packages`, silently skipping every JS/TS file in the project. Fixed with a one-line guard: `[root]` is used directly instead of `root.glob('.')`. Also added `GRAPHIFY_DEBUG=1` env var to `_safe_extract` — set it to print full tracebacks instead of the terse one-liner warning. (#1083 — thanks @santiagotorres-united)

**Anchored `.graphifyignore` patterns no longer match deep in the tree** — `/inbox/` should only match `inbox/` at the repo root, not `src/inbox/` anywhere in the tree. The basename shortcut and per-segment loop in `_matches()` now respect the `anchored` flag. Anchored patterns do an exact anchor-relative path match only. Same fix applied to `_is_included()`. (#1087 — thanks @cheerc)

### Docs

Filipino (fil-PH) README translation added. (#1080 — thanks @Reihanboo)

## Upgrade

\`\`\`bash
uv tool upgrade graphifyy
# or
pip install --upgrade graphifyy
\`\`\`