fix(devin): verify hashed skip-cache hits

Hash-suffixed provider skip-cache entries can outlive the DB row they originally matched. When a Devin transcript is rewritten A -> B -> A with the same mtime, the old A key must not skip while the DB still stores hash B.

Check the current Devin fingerprint hash against the stored DB hash before honoring a provider cache hit. Non-hash-required providers keep the prior mtime-only skip behavior.

VALID (fixed): kenn-io#1

Author: wesm

internal/sync/engine.go

@@ -3692,7 +3692,9 @@ func (e *Engine) processProviderFile(
 			// self-healing (e.g. a parser data-version bump or generated
 			// roborev CI worktree project): clear the entry and fall through
 			// to a full reparse, mirroring the legacy process arm.
-			if e.pathNeedsCachedSkipBypass(file.Path) {
+			if !e.providerSkipCacheEntryFreshInDB(file, source, fingerprint) {
+				e.clearSkip(cacheKey)
+			} else if e.pathNeedsCachedSkipBypass(file.Path) {
 				e.clearSkip(cacheKey)
 			} else {
 				return processResult{
@@ -4152,6 +4154,25 @@ func providerFingerprintHashRequiredForFreshness(agent parser.AgentType) bool {
 	return agent == parser.AgentDevin
 }
 
+func (e *Engine) providerSkipCacheEntryFreshInDB(
+	file parser.DiscoveredFile,
+	source parser.SourceRef,
+	fingerprint parser.SourceFingerprint,
+) bool {
+	agent := file.Agent
+	if agent == "" {
+		agent = source.Provider
+	}
+	if fingerprint.Hash == "" || !providerFingerprintHashRequiredForFreshness(agent) {
+		return true
+	}
+	lookupPath := providerSkipLookupPath(file, source, fingerprint)
+	if e.pathRewriter != nil {
+		lookupPath = e.pathRewriter(lookupPath)
+	}
+	return e.providerFingerprintHashMatchesDB(agent, lookupPath, fingerprint)
+}
+
 func processFileUsesProvider(agent parser.AgentType) bool {
 	switch agent {
 	case parser.AgentForge, parser.AgentPiebald, parser.AgentWarp:

internal/sync/provider_process_test.go

@@ -764,6 +764,71 @@ func TestProcessFileProviderDevinSameSizeSameMtimeTranscriptRewriteReparses(t *t
 	}
 }
 
+func TestProcessFileProviderDevinRepeatedHashRewriteIgnoresStaleHashedCache(t *testing.T) {
+	root := t.TempDir()
+	dbPath, transcriptPath := writeProcessProviderDevinFixture(
+		t,
+		root,
+		"session-repeated-hash",
+		"Initial reply",
+		1700000000000,
+		1700000005000,
+	)
+	virtualPath := parser.VirtualSourcePath(dbPath, "session-repeated-hash")
+	file := parser.DiscoveredFile{
+		Path:  virtualPath,
+		Agent: parser.AgentDevin,
+	}
+	database := dbtest.OpenTestDB(t)
+	engine := NewEngine(database, EngineConfig{
+		AgentDirs: map[parser.AgentType][]string{
+			parser.AgentDevin: {root},
+		},
+		Machine: "devbox",
+	})
+
+	first := engine.processFile(context.Background(), file)
+	require.NoError(t, first.err)
+	require.Len(t, first.results, 1)
+	require.Len(t, first.results[0].Messages, 2)
+	assert.Equal(t, "Initial reply", first.results[0].Messages[1].Content)
+	initialMtime := first.results[0].Session.File.Mtime
+	initialHash := first.results[0].Session.File.Hash
+	require.NotZero(t, initialMtime)
+	require.NotEmpty(t, initialHash)
+	require.Contains(t, first.cacheKey, "?source_hash="+initialHash)
+	writeProcessProviderDevinResult(t, engine, first)
+
+	engine.cacheSkip(first.cacheKey, initialMtime)
+
+	writeProcessProviderDevinTranscript(t, transcriptPath, "Changed reply")
+	initialTime := time.Unix(0, initialMtime)
+	require.NoError(t, os.Chtimes(transcriptPath, initialTime, initialTime))
+	second := engine.processFile(context.Background(), file)
+	require.NoError(t, second.err)
+	assert.False(t, second.skip)
+	require.Len(t, second.results, 1)
+	require.Len(t, second.results[0].Messages, 2)
+	assert.Equal(t, "Changed reply", second.results[0].Messages[1].Content)
+	changedHash := second.results[0].Session.File.Hash
+	require.NotEmpty(t, changedHash)
+	require.NotEqual(t, initialHash, changedHash)
+	require.Contains(t, second.cacheKey, "?source_hash="+changedHash)
+	writeProcessProviderDevinResult(t, engine, second)
+	engine.clearSkip(second.cacheKey)
+
+	writeProcessProviderDevinTranscript(t, transcriptPath, "Initial reply")
+	require.NoError(t, os.Chtimes(transcriptPath, initialTime, initialTime))
+
+	third := engine.processFile(context.Background(), file)
+	require.NoError(t, third.err)
+	assert.False(t, third.skip)
+	require.Len(t, third.results, 1)
+	require.Len(t, third.results[0].Messages, 2)
+	assert.Equal(t, "Initial reply", third.results[0].Messages[1].Content)
+	assert.Equal(t, initialHash, third.results[0].Session.File.Hash)
+}
+
 func TestSyncAllProviderDevinMissingDBPreservesArchive(t *testing.T) {
 	root := t.TempDir()
 	dbPath, _ := writeProcessProviderDevinFixture(
@@ -843,6 +908,27 @@ func writeProcessProviderForgeDB(t *testing.T, root string) string {
 	return dbPath
 }
 
+func writeProcessProviderDevinResult(
+	t *testing.T,
+	engine *Engine,
+	result processResult,
+) {
+	t.Helper()
+	require.Len(t, result.results, 1)
+	written, _, failed := engine.writeBatch(
+		[]pendingWrite{{
+			sess:         result.results[0].Session,
+			msgs:         result.results[0].Messages,
+			usageEvents:  result.results[0].UsageEvents,
+			forceReplace: result.forceReplace,
+		}},
+		syncWriteDefault,
+		false,
+	)
+	require.Equal(t, 0, failed)
+	require.Equal(t, 1, written)
+}
+
 func writeProcessProviderDevinFixture(
 	t *testing.T,
 	root string,