AIKIDO-2026-712855

TL;DR

The graphify code-graph extractor derives node IDs and source_file values from filesystem paths when it builds a committed graph.json. For reference targets outside the scan root and for degenerate symbol or config-key names (such as a minified $ or a JSONC "//" key) that normalize to nothing, the ID derivation falls back to the absolute scan path, embedding it, including the local OS username and home directory, into the graph artifact. Anyone who reads a shared or published graph.json can then recover the local username and directory layout of the machine that generated it. The fix rewrites out-of-root targets to a portable ext_ id with a walk-up source_file and skips degenerate names so no absolute path is written into node IDs or source_file.