post-commit hook silently skips rebuild on .tsx/.jsx and other valid code files (stale CODE_EXTS gate)

[ukanhaupa]

Summary

The post-commit hook installed by graphify hook install (in graphify/hooks.py) gates the rebuild on a hardcoded CODE_EXTS allowlist that has drifted from the authoritative CODE_EXTENSIONS set in graphify/detect.py. The result: commits that change valid, supported code files exit silently with status 0 and the graph is never rebuilt — so users see a stale graph.json and assume the hook isn't working.

Repro

1. graphify . in any project (build the initial graph).
2. graphify hook install.
3. Commit a change to a .tsx, .jsx, .lua, .ex, .ps1, or .jl file.
4. Inspect graphify-out/graph.json mtime — unchanged. No log, no error, the hook just exited 0.

Same outcome for any markdown/config-only commit on a doc repo, even though graphify supports doc graphs and watch.py has a _notify_only fallback that the hook never reaches.

Root cause

In graphify/hooks.py the embedded post-commit script defines its own CODE_EXTS:

CODE_EXTS = {
    '.py', '.ts', '.js', '.go', '.rs', '.java', '.cpp', '.c', '.rb', '.swift',
    '.kt', '.cs', '.scala', '.php', '.cc', '.cxx', '.hpp', '.h', '.kts',
}

But graphify/detect.py (the source of truth used by _rebuild_code) ships:

CODE_EXTENSIONS = {'.py', '.ts', '.js', '.jsx', '.tsx', '.go', '.rs', '.java', '.cpp', '.cc', '.cxx', '.c', '.h', '.hpp', '.rb', '.swift', '.kt', '.kts', '.cs', '.scala', '.php', '.lua', '.toc', '.zig', '.ps1', '.ex', '.exs', '.m', '.mm', '.jl'}

11 extensions missing from the hook's copy: .jsx .tsx .lua .toc .zig .ps1 .ex .exs .m .mm .jl. Worse, _rebuild_code calls detect() internally which rescans the whole project from scratch using the authoritative set anyway — so the hook's filter doesn't even control what gets rebuilt. It only gates whether the rebuild fires. The whole filter block is dead weight that introduces a stale-duplicate bug class.

Impact

• React/Next/Vite repos (mostly .tsx/.jsx) — hook never fires.
• Lua, Elixir, PowerShell, Julia, Objective-C repos — hook never fires.
• Doc-heavy repos (skills, knowledge bases, READMEs) — hook never fires.
• Silent failure: no log line, no error, exit 0. Users discover the staleness only when query results disagree with the code.

Proposed fix

Drop the filter entirely. The rebuild is cheap (~2s for 400 files, no LLM cost), detect() already handles "no code files found" cleanly, and removing the filter eliminates the duplication bug class permanently. PR incoming.

Bonus: log success/failure to a file under graphify-out/ so silent failures become visible if anything else goes wrong.

[safishamsi]

Fixed in v0.4.2. Removed the stale CODE_EXTS allowlist from the post-commit hook — the hook now rebuilds on any changed file. File type filtering is already handled upstream by detect().

[raye-deng]

The "stale allowlist silently skipping valid files" pattern is exactly the kind of bug that traditional quality tools completely miss — and it gets worse with AI-generated code.

Here's why: AI coding agents tend to import and use newer file types/extensions that weren't in the original allowlist. The hook exits 0 (success), the graph isn't rebuilt, and the CI pipeline reports green. Nobody notices until something breaks downstream and the investigation reveals the graph was stale for weeks.

What's particularly tricky about this class of bug:

1. Exit code 0 masks the failure: Silent success is more dangerous than a loud error
2. Config drift is invisible: CODE_EXTS in hooks.py diverges from the authoritative CODE_EXTENSIONS in detect.py, and there's no CI check that enforces consistency
3. AI agents amplify the problem: An AI refactoring tool might rename .js → .mjs or add .jsx support, unaware that the post-commit hook will silently ignore these changes

The fix (canonical source of truth + sync) is correct. We handle a similar problem in CI: checking that all declared dependencies actually exist on their registries, because the alternative (silent 0 exit) leads to exactly this kind of undetected drift.

npx @opencodereview/cli scan . --sla L1 includes checks for config-file consistency that catch these silent failures at the PR level.