Graphify manifest.json absolute path keys — how do I share graphify-out?

Question

Graphify 0.7.5 writes absolute path keys into graphify-out/manifest.json, and the generated directory also contains per-machine files like .graphify_root and .graphify_incremental.json. Committing manifest.json leaked local /Users//... paths across the team. Is this behavior intended, and is there a way to share generated graphs without leaking local paths?

Originally asked on GitHub: https://github.com/Graphify-Labs/graphify/issues/722

AgentArmorHQ team · Accepted Answer

Still open as of the thread's last comment (June 2026): no maintainer answer appears in the thread, but a library-side fix exists.

The issue reporter found that `save_manifest()` in `graphify/detect.py` writes file paths as dictionary keys directly from `os.walk`, so the keys are absolute. `graph.json` got relativized `source_file` paths in 0.5.0, but `manifest.json` did not. They also listed `.graphify_root`, `.graphify_incremental.json`, `.graphify_python`, and `.graphify_detect.json` as per-machine state files containing absolute paths or local values.

Commenters confirmed absolute paths in git hooks, `GRAPH_REPORT.md`, `graph.json`, `manifest.json`, and `cache/*.json`. One commenter notes that the library side was fixed by PR #1125 (for #777): `save_manifest()` / `load_manifest()` now accept a `root=` argument and relativize keys. However, none of the bundled skill instructions pass that argument, so the default agent-driven pipeline still writes absolute-keyed manifests.

The only workaround in the thread is to gitignore `graphify-out/` entirely; one commenter quotes Claude Code's suggestion to "gitignore `graphify-out/` completely". Also note that on version 0.8.39, renaming the repo directory and running a `/graphify update` caused a full rescan and duplicated every file in `manifest.json`.

General advice: until the shipped skills opt into the `root=` behavior, treat `manifest.json` and the `.graphify_*` files as local state and do not commit them. They contain absolute filesystem paths, so committing them leaks local usernames and project locations to anyone with repo access.

AgentArmorHQ team · Answer

**What @edgarlepe tried on GitHub** (Partly worked)

Reported that PR #1125 fixed the library side: save_manifest()/load_manifest() now accept root= and relativize keys, but the bundled skill files never pass root=, so the default pipeline still writes absolute-keyed manifests.

Source: https://github.com/Graphify-Labs/graphify/issues/722#issuecomment-4677055305

AgentArmorHQ team · Answer

**What @xuanswe tried on GitHub** (Outcome unclear)

Reported absolute paths across git hooks, GRAPH_REPORT.md, graph.json, manifest.json, and cache/*.json, and relayed Claude Code's suggestion to gitignore graphify-out/ completely.

Source: https://github.com/Graphify-Labs/graphify/issues/722#issuecomment-4657370642

AgentArmorHQ team · Answer

**What @pydentity tried on GitHub** (Didn't work)

On 0.8.39, renamed the repo directory and then ran /graphify update; the tool rescanned the whole repo and duplicated all files in manifest.json.

Source: https://github.com/Graphify-Labs/graphify/issues/722#issuecomment-4771474132

AgentArmorHQ team · Answer

**What a GitHub user tried on GitHub** (Outcome unclear)

Inspected save_manifest() on 0.7.5, found absolute path keys from os.walk, and asked maintainers if a PR relativizing manifest.json keys would be accepted; no maintainer response is in the thread.

Source: https://github.com/Graphify-Labs/graphify/issues/722

Graphify manifest.json absolute path keys — how do I share graphify-out?

5 answers

Add your answer or comment

Graphify manifest.json absolute path keys — how do I share graphify-out?

5 answers

Add your answer or comment

Related questions