v0.8.31

Graphify-Labs/graphifyv0.8.31Jun 3, 2026by safishamsi

AI Summary

This release fixes hook installation reliability by embedding the current interpreter, adds security hardening against shell injection, and implements query logging.

Key Highlights

  • Hook install embeds current interpreter (sys.executable)
  • Security hardening against shell injection
  • Relative paths for manifest.json and cache files
  • Query logging to ~/.cache/graphify-queries.log

New Features

  • Interpreter-embedded hook scripts
  • Shell injection prevention
  • Relative path storage for team commits
  • JSON Lines query logging

Full Release Notes

- **Fix:** `graphify hook install` now embeds the current interpreter (`sys.executable`) directly into the generated hook scripts. Previously, uv tool and pipx installs silently no-oped on git commit in GUI clients and CI runners where `~/.local/bin` is not on PATH — the hook could not find the graphify launcher, fell through all detection probes, and exited 0 without rebuilding. If you already have hooks installed, re-run `graphify hook install` to pick up the fix (#1127).
- **Fix:** hook scripts also probe `graphify-out/.graphify_python` as a fallback interpreter source, covering Windows/Git Bash installs where the launcher is a binary with no parseable shebang, and the case where the pinned path goes stale after a reinstall.
- **Security:** hook script hardening — `_PINNED=` uses single quotes to prevent shell injection; `nohup "$GRAPHIFY_PYTHON" -c` is properly quoted; the fallback emits a loud stderr diagnostic instead of a bare silent `exit 0`.
- **Fix:** `manifest.json` keys, `.graphify_root`, and `cache/ast/*.json` `source_file` fields are now stored as relative paths and re-anchored on load. Teams committing `graphify-out/` no longer see forced full rebuilds on every CI checkout or clone (#777, #1125).
- **Feat:** query logging. Every `graphify query`, `graphify path`, `graphify explain`, and MCP `query_graph` call is appended to `~/.cache/graphify-queries.log` in JSON Lines format (timestamp, question, corpus, nodes returned, duration). Control with `GRAPHIFY_QUERY_LOG`, `GRAPHIFY_QUERY_LOG_DISABLE=1`, or `GRAPHIFY_QUERY_LOG_RESPONSES=1` (#1128).