v0.9.94

Nineteen community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded `user:pass@` credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS `require` binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. SQL gets its own pass: T-SQL bracketed names are unbracketed, a `GO` batch separator ends the statement, cross-file table stubs fold onto their real definition, and a procedure emits `reads_from`/`writes_to` edges. Plus a markdown bare method only links when its class is cited, the MCP node lookup refuses a substring near-miss instead of answering with an unrelated node, a cross-repo edge points at the call site, Objective-C calls resolve across a split header/impl, an incremental build stops re-queuing files an extractor declined by design, a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-`Host` serve fix, and a complete, drift-guarded `--platform` list in `--help`. The AST cache schema is bumped, so the first build after upgrading re-extracts.

- Fix: **security** `validate_url` rejects a fetched URL that has no hostname (`http:///path`), a non-numeric, out-of-range, or zero port, or embedded `user:pass@` credentials, before the request is made and again on every redirect, so a malformed or credential-bearing URL is no longer fetched or persisted into the graph; a normal `@` in a path or query and a valid high port still pass (#4643, #4644, #4645, thanks @cellrishi-code).
- Fix: **manifest** a Maven `pom.xml` contributes only its own `<dependencies>` (including those under `<profiles>`), not the version pins under `<dependencyManagement>` or a build plugin's own `<dependencies>`, so a parent or BOM POM no longer emits dependency edges it only manages (#4596, thanks @jayhemnani9910).
- Fix: **js** a member call on an untyped receiver (`x.foo()` where `x` has no known type) is deferred to receiver-typed resolution instead of binding to a same-named method elsewhere in the file, so a spurious self-loop or cross-call edge is no longer emitted; `this.foo()`, a typed receiver, and a locally instantiated receiver still resolve (#4598, #4605, thanks @ayushcodes10; reported by @SaschaAndresGrimm).
- Fix: **js** a CommonJS `const X = require('./m')` binding no longer mints a module-scope node that shadows the class the required file exports, so `new X()` resolves to the required declaration; a real `const x = factory()` binding still keeps its node (#4621, #4634, thanks @lab1207; reported by @sub4biz).
- Fix: **extract** an Objective-C category's class and method node ids stay repo-relative instead of embedding the absolute checkout path, so a category file like `Foo+Cat.h` yields portable ids that match across machines and merge cleanly; two same-named categories in different directories stay distinct (#4666, #4642, thanks @madhusudanpatnaik; reported by @xiongjianxu).
- Fix: **codex** the generated Codex PreToolUse hook command quotes the graphify executable path, so an install under a path containing a space no longer builds a broken hook command, matching the existing Claude and Gemini hooks (#4662, thanks @supercell02).
- Fix: **serve** an IPv6 HTTP bind accepts its own bracketed `Host` header (`[::1]:port`), so a server bound to an IPv6 loopback no longer refuses every request with a 421 (#4656, thanks @zydo).
- Fix: **ingest** a text capture never writes through an existing entry: the free-path search uses `lstat`, so a name that is a dangling symlink is treated as occupied and the capture is diverted instead of following the link and writing outside the corpus (#4657, thanks @zydo).
- Fix: **cli** `graphify --help` lists every accepted `--platform` value (it had omitted amp, copilot, kilo, kimi, and antigravity-windows); the list is derived from the same source as the install usage so the two cannot drift, with a guard test (#4655, thanks @zydo).
- Fix: **sql** T-SQL bracketed identifiers (`[dbo].[Orders]`) are unbracketed so a name matches across styles, and a stored procedure's body emits `reads_from`/`writes_to` edges for the tables it reads and writes; aliases, variables, temp tables, strings, and comments never become targets (#4635, #4649, thanks @Deepjyoti-Sarmah; reported by @RuVl).
- Fix: **sql** a `GO` batch separator (a client command, not a terminator) ends the statement, so a statement after a `GO` with no trailing `;` parses on its own instead of merging into one malformed node; a `GO` inside a string, comment, or column name is left alone (#4651, #4652, thanks @Deepjyoti-Sarmah).
- Fix: **sql** a table referenced before its `CREATE TABLE` is seen folds onto the real definition instead of staying a separate stub, and a schema-qualified name binds correctly, while two genuinely different tables in different schemas (`dbo.Orders` vs `sales.Orders`) stay distinct and a SQL stub no longer binds to a same-named class in another language (#4653, #4654, thanks @Deepjyoti-Sarmah).
- Fix: **markdown** a bare method name in prose (for example `redis` where only `Cache.redis` exists) only links to the method when the owning class is cited in the same document, so a plain word is no longer turned into a false `references` edge; a qualified `Class.method` or `Class::method` mention still resolves (#4609, #4617, thanks @nothariharan; reported by @saad-siddique).
- Fix: **mcp** the `get_node` and `get_neighbors` tools, and the `explain` command, refuse a substring-only near-miss with candidate suggestions instead of returning an unrelated node as the answer; an exact or prefix match still resolves (#3917, #4618, thanks @nothariharan; reported by @Alexandre-Aktisea).
- Fix: **cross-repo** a cross-repo call edge points at the real call site rather than the caller's header declaration, so the edge's `source_file` and `source_location` name the line that makes the call (#4668, #4669, thanks @xiongjianxu).
- Fix: **extract** an incremental build no longer re-queues, on every run, a code file an extractor declined by design (for example a virtual-workspace manifest); the file is marked `ast_empty` and left alone, while a genuinely failed or transiently empty extraction is still retried (#2543, #4672, thanks @xiongjianxu).
- Fix: **objc** a member call resolves when a class is split across a header and an implementation in different directories, binding the selector to its single definition; two unrelated same-named classes that both define the selector stay ambiguous and get no edge (#4673, #4674, thanks @xiongjianxu).