v0.8.40

## What's changed

### Features
- **Feat: custom OpenAI- and Anthropic-compatible endpoints.** `OPENAI_BASE_URL`/`OPENAI_MODEL` and `ANTHROPIC_BASE_URL`/`ANTHROPIC_MODEL` point either backend at a self-hosted or proxy server (vLLM, llama.cpp, LM Studio, LiteLLM, gateways); defaults preserve `api.openai.com`/`api.anthropic.com` and `GRAPHIFY_OPENAI_MODEL` still wins over `OPENAI_MODEL`. Wired through extraction and community labeling (#1273).
- **Feat: PowerShell `.psm1` modules indexed.** `.psm1` was missing from `CODE_EXTENSIONS` and the dispatch table, so modules and their dependents were silently absent from the graph (#1315). `.psd1` manifests and `Import-Module`/dot-source edges remain a follow-up.
- **Feat: JS/TS AST extracts assignment-form symbols** — `this.X = () => {}` / `this.X = function(){}`, `exports.X`/`module.exports.X`, `Foo.prototype.X`, class arrow/function fields, and `const f = function(){}` expressions. Constructor-style and CommonJS codebases (DAOs, route handlers, services) previously lost most callable symbols. Arbitrary `obj.x = fn` stays excluded (preserves the #1077 god-node guard) (#1322).

### Fixes
- **Fix: Swift `import` edges no longer silently dropped.** The import target previously had no backing node, so `build.py` pruned 100% of Swift imports; the module node is now synthesized so the edge survives (#1327).
- **Fix: `--no-cluster` / incremental `update` no longer accumulate duplicate edges.** These paths bypass the `DiGraph` that collapses parallel edges, so repeated `update` grew edge counts and diverged across build modes. Edges are now deduped by `(source, target, relation)` — deterministic and idempotent (#1317).
- **Fix: community names shown after `cluster-only`.** `query`/`explain`/MCP now surface the human-readable community name instead of a blank/numeric id; backward-compatible with old graphs (#1305).
- **Fix: `graphify-mcp` and `graphify.serve` accept `--graph <path>`** as an alias for the positional arg, consistent with other subcommands (#1304).
- **Fix: AST extraction no longer crashes on Windows with >61 logical cores** — the 61-worker `ProcessPoolExecutor` cap now applies to all worker-count paths (#1298).
- **Fix: ghost-merge skips ambiguous `(basename, label)` collisions** so same-named symbols in same-named files across directories no longer mis-point edges (#1257).
- **Fix: startup no longer crashes on unreadable `.graphify_version`** (restricted installs / network mounts) — FS probes wrapped in `try/except OSError` (#1299).
- **Fix: `prs.py` claude-cli backend resolves `claude.cmd` on Windows** (WinError 2 on npm installs) (#1288).

### Performance
- **Perf: `save_manifest` file hashing parallelized** with a `ThreadPoolExecutor` (#1295).
- **Perf: `_walk_js_tree` converted from recursive generator to iterative walk** (#1294).

### CI / Docs
- **CI: bandit + pip-audit `security-scan` job** added as non-blocking advisory signal (`continue-on-error`) (#1209).
- **Docs: RFC for file-level node summaries** (`docs/node-summaries-rfc.md`) (#1166).

---
Install: \`uv tool install graphifyy\` · [PyPI](https://pypi.org/project/graphifyy/0.8.40/) · [CHANGELOG](https://github.com/safishamsi/graphify/blob/v8/CHANGELOG.md)