v0.8.31
Graphify-Labs/graphifyv0.8.31Jun 3, 2026by safishamsi
AI Summary
This release fixes hook installation reliability by embedding the current interpreter, adds security hardening against shell injection, and implements query logging.
Key Highlights
- Hook install embeds current interpreter (sys.executable)
- Security hardening against shell injection
- Relative paths for manifest.json and cache files
- Query logging to ~/.cache/graphify-queries.log
New Features
- Interpreter-embedded hook scripts
- Shell injection prevention
- Relative path storage for team commits
- JSON Lines query logging
Full Release Notes
- **Fix:** `graphify hook install` now embeds the current interpreter (`sys.executable`) directly into the generated hook scripts. Previously, uv tool and pipx installs silently no-oped on git commit in GUI clients and CI runners where `~/.local/bin` is not on PATH — the hook could not find the graphify launcher, fell through all detection probes, and exited 0 without rebuilding. If you already have hooks installed, re-run `graphify hook install` to pick up the fix (#1127). - **Fix:** hook scripts also probe `graphify-out/.graphify_python` as a fallback interpreter source, covering Windows/Git Bash installs where the launcher is a binary with no parseable shebang, and the case where the pinned path goes stale after a reinstall. - **Security:** hook script hardening — `_PINNED=` uses single quotes to prevent shell injection; `nohup "$GRAPHIFY_PYTHON" -c` is properly quoted; the fallback emits a loud stderr diagnostic instead of a bare silent `exit 0`. - **Fix:** `manifest.json` keys, `.graphify_root`, and `cache/ast/*.json` `source_file` fields are now stored as relative paths and re-anchored on load. Teams committing `graphify-out/` no longer see forced full rebuilds on every CI checkout or clone (#777, #1125). - **Feat:** query logging. Every `graphify query`, `graphify path`, `graphify explain`, and MCP `query_graph` call is appended to `~/.cache/graphify-queries.log` in JSON Lines format (timestamp, question, corpus, nodes returned, duration). Control with `GRAPHIFY_QUERY_LOG`, `GRAPHIFY_QUERY_LOG_DISABLE=1`, or `GRAPHIFY_QUERY_LOG_RESPONSES=1` (#1128).