This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
Summary
AI summaryRead and Glob tools now nudge toward graphify query when a source file is accessed outside the output directory, closing a bypass.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Add `anthropic` optional extra so the `claude` backend is installable via `uv tool install "graphifyy[anthropic]"`. Add `anthropic` optional extra so the `claude` backend is installable via `uv tool install "graphifyy[anthropic]"`. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Feature | Low |
Add `Read|Glob` hook to nudge toward `graphify query` when a source/doc file outside `graphify-out/` is read and `graphify-out/graph.json` exists. Add `Read|Glob` hook to nudge toward `graphify query` when a source/doc file outside `graphify-out/` is read and `graphify-out/graph.json` exists. Source: llm_adapter@2026-06-03 Confidence: high |
— |
| Bugfix | Medium |
Fix: `graphify install --project --platform antigravity` now writes Antigravity's always-on layer files correctly. Fix: `graphify install --project --platform antigravity` now writes Antigravity's always-on layer files correctly. Source: llm_adapter@2026-06-03 Confidence: high |
— |
Full changelog
- Fix:
graphify install --project --platform antigravitynow writes Antigravity's always-on layer (.agents/rules/graphify.md+.agents/workflows/graphify.md), not just the skill. The project-scoped path went through the skill-only branch and skipped them, even though the project uninstall removes them. - Feat: close the Read-tool graph bypass. The
PreToolUsenudge previously only fired on Bash search (grep/rg/find); an agent answering a question by reading many source files through the nativeReadtool (orGlob) slipped past it. A newRead|Globhook nudges towardgraphify querywhengraphify-out/graph.jsonexists, only for a source/doc file outsidegraphify-out/, and never blocks (#1114). - Feat: add an
anthropicoptional extra (and include it in[all]) so theclaudebackend is installable like every other one:uv tool install "graphifyy[anthropic]". Previously it was the only backend with no extra, so a user withANTHROPIC_API_KEYset could not satisfy it without--with anthropic. The backend package-missing errors now point atuv tool install "graphifyy[<extra>]"(the isolated-venv path) rather than onlypip install.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About graphify
AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, OpenClaw, Factory Droid, Trae). Turn any folder of code, docs, papers, images, videos, or YouTube links into a queryable knowledge graph
Beta — feedback welcome: [email protected]