Add GRAPHIFY_CLAUDE_CLI_BARE opt-in for claude -p spawns

[ayushcodes10]

Each claude -p spawn (one per extraction chunk, plus one per
community label) boots a full Claude Code session with the user's
global config, including SessionStart/SessionEnd hooks and plugins.
For an unattended extraction pipeline this is pure overhead, and
worse: a failing or cancelled SessionEnd hook can flip the process
exit code to nonzero, so a chunk whose extraction actually succeeded
gets recorded as a hook failure instead.

GRAPHIFY_CLAUDE_CLI_BARE=1 passes --bare to both claude-cli spawn
sites (_call_claude_cli's extraction path, and _call_llm's labeling
path) -- a real, current Claude Code CLI flag (verified against
Claude Code's own docs: "Skip auto-discovery of hooks, skills,
plugins, MCP servers, auto memory, and CLAUDE.md", explicitly
recommended for scripted/headless -p runs, and documented not to
affect OAuth/subscription auth). Opt-in and off by default, matching
the existing GRAPHIFY_CLAUDE_CLI_MODEL / GRAPHIFY_CLAUDE_CLI_PARALLEL
convention already in this module -- existing users who rely on their
hooks firing are unaffected. Not changing any default, per the
issue's own ask.

Verification:

• 6 new tests covering both spawn sites: flag absent by default, flag
  present when GRAPHIFY_CLAUDE_CLI_BARE=1, flag absent for any other
  value (only the exact string "1" opts in, matching
  GRAPHIFY_CLAUDE_CLI_PARALLEL's own convention), plus a direct test
  of the extracted helper.
• Full suite: 4367 passed, 0 failed.
• ruff and skillgen --check clean.

Fixes #2693.

[ayushcodes10]

@safishamsi this PR's CI run is waiting on approval (first-time contributor gate) — could you approve the workflow run when you get a chance? Happy to address any review feedback in the meantime.

[graphify-labs]

Graphify reviewed this change.

Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).

Formal verification. No changes could be formally verified in this run.

---

Graphify review — findings

This PR adds an opt-in --bare flag to graphify's claude-cli backend, gated behind a new GRAPHIFY_CLAUDE_CLI_BARE=1 environment variable via a new _claude_cli_bare_args() helper. The flag is threaded into both claude -p invocation sites (_call_claude_cli for extraction and _call_llm for labeling), and is off by default. New tests cover the helper's behavior and verify the flag's presence/absence across both spawn paths under various env values.

No blocking issues surfaced.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 703 functions depend on the 219 functions this change touches.

Health — this change adds coupling hotspots:

• new: deduplicate_entities() — 63 callers, 20 callees
• new: build_merge() — 41 callers, 14 callees
• new: extract_files_direct() — 17 callers, 20 callees
• new: _call_claude_cli() — 34 callers, 10 callees
• new: extract_corpus_parallel() — 26 callers, 10 callees
• new: dispatch_command() — 2 callers, 117 callees
• new: _call_llm() — 13 callers, 18 callees
• new: _call_openai_compat() — 23 callers, 8 callees
• …and 14 more

Verification — 703 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 703 function(s) in the blast radius were not formally verified this run

Formal verification

Could not verify: Could not verify \_call\_claude\_cli.

The verifier did not have enough to check \_call\_claude\_cli, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 200 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly RuntimeError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify \_call\_llm.

The verifier did not have enough to check \_call\_llm, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 23 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)

· 22 more finding(s) on lines outside this diff (see the check run).