harden: impact homonym parity, plan retirement, and inPath edge case

Align consumer surfaces, delete shipped plan, fix skipped_scope on unknown
symbols with inPath, and add homonym/MCP regression tests.

Author: SutuSebastian

.agents/skills/harden-pr/LEDGER.md

@@ -10,6 +10,9 @@ By-design or false-positive findings — do not re-raise.
 - **[category]** `file:line` — label: reason
 ```
 
+- **[correctness]** `src/application/impact-engine.ts:147` — explicit inPath on single-definition symbol enables first-hop scopeFiles: by-design — matches show `--in` disambiguation (plan P2.1).
+- **[correctness]** `src/application/impact-engine.ts:162` — per-file walk LIMIT before global dedup: by-design v1 — plan architecture per-defining-file walks; global limit still applies at slice.
+
 <!-- Example:
 - **[security]** `src/cli/proxy.ts:42` — https_proxy env: by-design — standard CLI proxy convention.
 -->

.changeset/impact-inpath-homonyms.md

@@ -2,4 +2,4 @@
 "@stainless-code/codemap": patch
 ---
 
-Scope `codemap impact` and MCP/HTTP `impact` homonym symbols: `--in` / `in` disambiguates by defining file (show-engine prefix/exact rules); unscoped homonyms union per-defining-file call graphs instead of merging by name only. Mismatched scope returns empty `matches` with `skipped_scope`.
+Scope `codemap impact` and MCP/HTTP `impact` homonym symbols: `--in` / `in` disambiguates by defining file (same prefix/exact rules as `codemap show --in`); unscoped homonyms union per-defining-file call graphs instead of merging by name only. Mismatched scope returns empty `matches` with `skipped_scope`.

README.md

@@ -210,7 +210,8 @@ codemap impact handleAudit --depth 1 --via calls                # direct callers
 codemap impact runWatchLoop --json --summary | jq '.summary.nodes'  # CI-gate fan-in score
 # Replaces hand-composed `WITH RECURSIVE` queries. Cycle-detected, depth-bounded
 # (default 3, --depth 0 = unbounded), limit-capped (default 500). Result envelope:
-# {target, matches: [{depth, edge, kind, name?, file_path}], summary: {nodes, terminated_by}}.
+# {target, matches: [...], summary: {nodes, terminated_by}, skipped_scope?}.
+# Homonym symbols: unscoped unions per-defining-file graphs; --in scopes one file.
 
 # Affected tests — reverse dependency walk from changed sources → test files to run
 codemap affected --json                                         # working-tree changes vs HEAD (git status + diff)

docs/plans/impact-inpath-homonyms.md

@@ -24,7 +24,7 @@
 | PR    | Plan                                                            | Status                                                                              | Blocks                              |
 | ----- | --------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ----------------------------------- |
 | **1** | lifted → [`architecture.md`](../architecture.md) (plan retired) | **merged** ([#180](https://github.com/stainless-code/codemap/pull/180) · `a5caca8`) | —                                   |
-| **2** | [`impact-inpath-homonyms.md`](./impact-inpath-homonyms.md)      | **in progress** (`fix/impact-inpath-homonyms`)                                      | —                                   |
+| **2** | lifted → [`architecture.md`](../architecture.md) (plan retired) | **PR open** (`fix/impact-inpath-homonyms`)                                          | —                                   |
 | **3** | [`runtime-test-isolation.md`](./runtime-test-isolation.md)      | **pending**                                                                         | PR **1** merged (PR **2** optional) |
 
 | — | — | **deferred** | golden `schema.test.ts` + path guards |
@@ -71,7 +71,8 @@ Evaluated 2026-06 against [roadmap § Floors](../roadmap.md#floors-v1-product-sh
 | 2026-06-05 | PR 1 harden | `/harden-pr full` — plan retired; contracts in architecture/glossary.        |
 | 2026-06-05 | PR 1 merge  | [#180](https://github.com/stainless-code/codemap/pull/180) → `a5caca8`.      |
 | 2026-06-05 | PR 2 start  | `fix/impact-inpath-homonyms` — `inPath` + homonym walks in impact-engine.    |
-| —          | PR 2 merge  | _fill_                                                                       |
+| 2026-06-05 | PR 2 harden | `/harden-pr full` — plan retired; CLI/MCP/docs parity.                       |
+| —          | PR 2 merge  | _PR URL · merge SHA_                                                         |
 | —          | PR 3 start  | _from `main`_                                                                |
 | —          | PR 3 merge  | _fill · close orchestrator_                                                  |
 

docs/plans/security-hardening-orchestrator.md

@@ -108,7 +108,7 @@ Predicate-as-API only — enrich row shape and audit deltas; no standalone pass/
 - [ ] **`organize-imports` diff-shape recipe** — deterministic single-file import sort/group; `imports.line_number` + `source` substrate sufficient. Review-first (`auto_fixable: false`). Effort: S.
 - [ ] **`codemap-to-tsmorph` Path B adapter** — separate package experiment: `query_recipe` discovery → `ts-morph` / `jscodeshift` transforms for AST-shape edits codemap's substring executor defers (see [architecture § Rejected apply-path alternatives](./architecture.md#apply--input-modes-transport-and-policy)). Not an in-tree AST writer (Path A rejected). Effort: M.
 - [ ] **Apply write-safety hardening** — close apply TOCTOU: SHA-256 `hashContent` at phase-1 read, recheck disk hash immediately before phase-2 write (`file content changed` conflict); `fsync` temp file before `rename`; skip files with mixed CRLF/LF (`mixed line endings`). Preserves all-or-nothing on any conflict. Plan: [`plans/apply-write-safety.md`](./plans/apply-write-safety.md). Effort: L.
-- [ ] **Read-surface hardening (3 PRs)** — query/HTTP/validate safety, `impact` `inPath` homonyms, runtime guards + test teardown. **Orchestrator:** [`plans/security-hardening-orchestrator.md`](./plans/security-hardening-orchestrator.md). PR1 ([#180](https://github.com/stainless-code/codemap/pull/180), lifted to [architecture](./architecture.md)) · Plans: [PR2](./plans/impact-inpath-homonyms.md) · [PR3](./plans/runtime-test-isolation.md). Effort: S–M.
+- [ ] **Read-surface hardening (3 PRs)** — query/HTTP/validate safety, `impact` `inPath` homonyms, runtime guards + test teardown. **Orchestrator:** [`plans/security-hardening-orchestrator.md`](./plans/security-hardening-orchestrator.md). PR1 ([#180](https://github.com/stainless-code/codemap/pull/180), lifted to [architecture](./architecture.md)) · PR2 (`impact` homonyms, lifted to [architecture](./architecture.md)) · Plans: [PR3](./plans/runtime-test-isolation.md). Effort: S–M.
 - [ ] **`history` table** (deferred — revisit-triggered) — temporal queries: "when did symbol X get `@deprecated`?", "coverage trend over last 50 commits", "files that became dead this week". `audit --base <ref>` covers the most-common temporal question (PR-scoped diff) without schema growth, so the table earns its place only when bigger questions emerge. Two shapes (per-commit snapshots ~N × DB size; append-only event log heavier CTE walks); both pay an N-reindexes backfill cost (~30s per reindex). **Revisit triggers:** two consumers ship `jq`-based "audit-runs-over-time" workflows, OR `query_baselines` evolution becomes a recurring agent need.
 - [ ] **`codemap audit` verdict + thresholds** (v1.x) — `verdict: "pass" | "warn" | "fail"` driven by an `audit.deltas[<key>].{added_max, action}` field on the config object (`.codemap/config.{ts,js,json}`). Triggers: two consumers ship `jq`-based threshold scripts with similar shapes, OR one consumer asks with a concrete config sketch. Until then, raw deltas + consumer-side `jq` is the CI exit-code idiom. **Likely accelerant:** the Marketplace Action (next item) shipping is the most plausible path to firing the trigger — once `- uses: stainless-code/codemap@v1` is the dominant CI path, real `jq` threshold scripts will surface.
 - [ ] **GitHub Marketplace Action — publish + listing finish** — core Action implementation is in-tree: root `action.yml`, `query --ci`, `audit --format sarif` / `--ci`, package-manager detection, dogfood smoke, and opt-in `pr-comment` summary renderer have shipped. Remaining work is the release/listing slice: `MARKETPLACE.md`, `v1.0.0` / floating `v1` tags, Marketplace setup, sacrificial-repo smoke, and making `action-smoke` blocking once the Action tag exists. Action version stream is independent of CLI version (`package.json` currently drives CLI/npm version; Action publishes at its own `v1.0.0`). Plan: [`plans/github-marketplace-action.md`](./plans/github-marketplace-action.md). Effort: S.

docs/roadmap.md

@@ -417,6 +417,17 @@ describe("findImpact — inPath + homonym scoping", () => {
     expect(r.matches.map((m) => m.name)).toEqual(["onlyA"]);
   });
 
+  it("inPath on unknown symbol omits skipped_scope", () => {
+    const r = findImpact(db, {
+      target: "missing",
+      direction: "down",
+      via: "calls",
+      inPath: "src/a.ts",
+    });
+    expect(r.target.matched_in).toEqual([]);
+    expect(r.skipped_scope).toBeUndefined();
+  });
+
   it("inPath outside matched_in returns empty matches with skipped_scope", () => {
     const r = findImpact(db, {
       target: "dup",
@@ -428,6 +439,18 @@ describe("findImpact — inPath + homonym scoping", () => {
     expect(r.skipped_scope?.reason).toContain("src/z.ts");
   });
 
+  it("unscoped homonym unions per-file graphs for direction=up", () => {
+    seedCall("src/a.ts", "callerA", "dup");
+    seedCall("src/b.ts", "callerB", "dup");
+
+    const r = findImpact(db, {
+      target: "dup",
+      direction: "up",
+      via: "calls",
+    });
+    expect(r.matches.map((m) => m.name).sort()).toEqual(["callerA", "callerB"]);
+  });
+
   it("inPath directory prefix scopes homonym definitions", () => {
     seedFile("src/pkg/b.ts");
     seedSymbol("dup", "src/pkg/b.ts");

src/application/impact-engine.test.ts

@@ -118,13 +118,13 @@ export function findImpact(
   if (
     opts.inPath !== undefined &&
     opts.inPath.length > 0 &&
-    target.kind === "symbol"
+    target.kind === "symbol" &&
+    target.matched_in.length > 0
   ) {
     const scoped = filterMatchedInByInPath(target.matched_in, opts.inPath);
-    target = { ...target, matched_in: scoped };
     if (scoped.length === 0) {
       return emptyImpactResult({
-        target,
+        target: { ...target, matched_in: scoped },
         direction,
         backends,
         depthRaw,
@@ -136,6 +136,7 @@ export function findImpact(
         },
       });
     }
+    target = { ...target, matched_in: scoped };
   }
   const directions: Array<"up" | "down"> =
     direction === "both" ? ["up", "down"] : [direction];

src/application/impact-engine.ts

@@ -1891,6 +1891,32 @@ describe("MCP server — impact tool", () => {
     }
   });
 
+  it("impact in mismatch returns skipped_scope", async () => {
+    const db = openDb();
+    try {
+      db.run(
+        `INSERT INTO symbols (file_path, name, kind, line_start, line_end, signature, is_exported, is_default_export)
+         VALUES ('src/a.ts', 'dup', 'function', 1, 1, 'function dup()', 0, 0),
+                ('src/b.ts', 'dup', 'function', 1, 1, 'function dup()', 0, 0)`,
+      );
+    } finally {
+      closeDb(db);
+    }
+
+    const { client, server } = await makeClient();
+    try {
+      const r = await client.callTool({
+        name: "impact",
+        arguments: { target: "dup", in: "src/z.ts" },
+      });
+      const json = readJson(r);
+      expect(json.matches).toEqual([]);
+      expect(json.skipped_scope?.reason).toContain("src/z.ts");
+    } finally {
+      await server.close();
+    }
+  });
+
   it("impact returns isError on non-integer depth (Zod rejects)", async () => {
     const { client, server } = await makeClient();
     try {

src/application/mcp-server.test.ts

@@ -65,7 +65,7 @@ Graph composers (MCP trace / explore / node twins):
   codemap node <name> [--kind <k>] [--in <path>] [--include-snippets] [--budget-chars N] [--compact]
 
 Impact analysis (graph walk for refactor blast-radius):
-  codemap impact <target> [--direction up|down|both] [--depth N] [--via <b>] [--limit N] [--summary] [--json]
+  codemap impact <target> [--in <path>] [--direction up|down|both] [--depth N] [--via <b>] [--limit N] [--summary] [--json]
 
 Affected tests (reverse dep walk → test files to run):
   codemap affected [--stdin] [--changed-since <ref>] [--json] [<path>...]