post-commit hook overwrites .graphify_root, silently expanding a scoped build to the whole repo

[dispather]

Summary

After a scoped build (graphify src/), installing the post-commit hook (graphify hook install) causes the next commit to re-extract all changed code files via git diff, ignoring the scoped src/ boundary, and overwrites .graphify_root from .../src to . (repo root). The graph silently expands beyond the user's intended scope, and there is no warning.

Reproduction (measured on a TS router project)

1. graphify src/ → graphify-out/.graphify_root = /abs/path/src, 214 nodes / 512 edges / 12 communities.
2. graphify hook install.
3. First commit that includes new scripts/*.py and *.ts (outside src/).
4. Hook auto-rebuilds. Result:
   • .graphify_root is overwritten to . (1 byte).
   • Graph grows to 374 nodes / 667 edges / 30 communities — scripts/ was absorbed.

Why this is surprising / hard to detect

• The user explicitly scoped to src/, yet scripts/ ends up in the graph after a single commit. ("Why did scripts/ enter the graph when I only built src/?")
• mtime-based staleness checks cannot catch it: graph.json mtime is fresh — what changed is the coverage scope, not freshness.

Suggested directions

• The hook should respect an existing .graphify_root (not overwrite it), restricting the git diff re-extraction to the scoped root.
• Or, if the whole-repo behavior is intended, warn at graphify hook install time that the hook re-extracts the entire repo on every commit and will override a scoped root.
• Optionally a graphify hook install --respect-root flag.

Environment

• graphify: PyPI graphifyy, 0.8.x
• flow: scoped build (graphify src/) → hook install → first commit
• shell: fish

[safishamsi]

Fixed in 6a549e4. Post-commit and post-checkout hook bodies now read graphify-out/.graphify_root before calling _rebuild_code, falling back to Path('.') if absent. A scoped build (graphify src/) no longer gets silently expanded to the full repo on the next commit.