fix(parser): validate db-backed stored sources

Stored source-path hints for Forge, Piebald, and Warp are virtual DB-row identities, so a fresh lookup must prove both the canonical root DB and the requested row still exist. Accepting stale virtual paths would let changed-path migration parse the wrong source or skip a deleted row.

Keep non-fresh lookup permissive for tombstone parsing, but make RequireFreshSource authoritative for stored hints and raw-session mismatches before falling back to session lookup.

Validation: go test -tags "fts5" ./internal/parser -run 'TestDBBackedProvider(StoredVirtualPathFreshness|RejectsInvalidStoredVirtualPaths)' -count=1 -v; go test -tags "fts5" ./internal/parser -run 'Test(Forge|Piebald|Warp|DBBackedProvider)' -count=1 -v; go test -tags "fts5" ./internal/sync -run 'TestObserveProviderSourceMatchesDBBackedLegacyParsers|TestProcessFileProviderChangedPathForgeVirtualSource|TestProcessFileProviderAuthoritativeSourceErrorsOnlyForceParse' -count=1 -v; go vet ./...; GOMAXPROCS=1 GOGC=5 GOMEMLIMIT=128MiB ./custom-gcl run --config .golangci.nilaway.yml ./internal/parser ./internal/sync; git diff --check. Broad go test -tags "fts5" ./internal/parser ./internal/sync -count=1 still fails on existing TestSyncPathsCodexIndexEventRefreshesStoredDuplicate.

Author: mariusvniekerk

internal/parser/db_backed_provider.go

@@ -264,16 +264,34 @@ func (s dbBackedSourceSet) FindSource(
 	if err := ctx.Err(); err != nil {
 		return SourceRef{}, false, err
 	}
+	freshStoredSource := req.RequireFreshSource &&
+		(req.StoredFilePath != "" || req.FingerprintKey != "")
 	for _, path := range []string{req.StoredFilePath, req.FingerprintKey} {
 		if path == "" {
 			continue
 		}
 		for _, root := range s.roots {
 			if source, ok := s.sourceRef(root, path, true); ok {
+				src := source.Opaque.(dbBackedSource)
+				if req.RawSessionID != "" && src.SessionID != req.RawSessionID {
+					continue
+				}
+				if req.RequireFreshSource {
+					fresh, err := s.sourceExists(src)
+					if err != nil {
+						return SourceRef{}, false, err
+					}
+					if !fresh {
+						continue
+					}
+				}
 				return source, true, nil
 			}
 		}
 	}
+	if freshStoredSource {
+		return SourceRef{}, false, nil
+	}
 	if req.RawSessionID == "" {
 		return SourceRef{}, false, nil
 	}
@@ -295,6 +313,22 @@ func (s dbBackedSourceSet) FindSource(
 	return SourceRef{}, false, nil
 }
 
+func (s dbBackedSourceSet) sourceExists(src dbBackedSource) (bool, error) {
+	if !IsRegularFile(src.DBPath) {
+		return false, nil
+	}
+	metas, err := s.spec.listMeta(src.DBPath)
+	if err != nil {
+		return false, err
+	}
+	for _, meta := range metas {
+		if meta.SessionID == src.SessionID {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 func (s dbBackedSourceSet) Fingerprint(
 	ctx context.Context,
 	source SourceRef,
@@ -361,7 +395,7 @@ func (s dbBackedSourceSet) sourceRef(
 	if filepath.Base(dbPath) != s.spec.dbName {
 		return SourceRef{}, false
 	}
-	if !pathIsUnderRoot(dbPath, root) {
+	if !samePath(dbPath, filepath.Join(root, s.spec.dbName)) {
 		return SourceRef{}, false
 	}
 	if !allowMissing && !IsRegularFile(dbPath) {

internal/parser/db_backed_provider_test.go

@@ -207,6 +207,104 @@ func TestDBBackedProviderDeletedRowFingerprintsTombstoneAndSkips(t *testing.T) {
 	assert.Empty(t, outcome.Results)
 }
 
+func TestDBBackedProviderStoredVirtualPathFreshness(t *testing.T) {
+	dbPath, seeder, db := newForgeTestDB(t)
+	seedForgeConversation(t, seeder)
+	root := filepath.Dir(dbPath)
+	virtualPath := dbPath + "#conv-001"
+
+	provider, ok := NewProvider(AgentForge, ProviderConfig{Roots: []string{root}})
+	require.True(t, ok)
+	found, ok, err := provider.FindSource(context.Background(), FindSourceRequest{
+		StoredFilePath:     virtualPath,
+		RequireFreshSource: true,
+	})
+	require.NoError(t, err)
+	require.True(t, ok)
+	assert.Equal(t, virtualPath, found.DisplayPath)
+
+	_, err = db.Exec(`DELETE FROM conversations WHERE conversation_id = ?`, "conv-001")
+	require.NoError(t, err)
+	_, ok, err = provider.FindSource(context.Background(), FindSourceRequest{
+		StoredFilePath:     virtualPath,
+		RequireFreshSource: true,
+	})
+	require.NoError(t, err)
+	assert.False(t, ok, "fresh lookup must reject a deleted DB row")
+
+	staleSource, ok, err := provider.FindSource(context.Background(), FindSourceRequest{
+		StoredFilePath: virtualPath,
+	})
+	require.NoError(t, err)
+	require.True(t, ok, "non-fresh lookup keeps virtual tombstone identity")
+	assert.Equal(t, virtualPath, staleSource.DisplayPath)
+	outcome, err := provider.Parse(context.Background(), ParseRequest{
+		Source: staleSource,
+	})
+	require.NoError(t, err)
+	assert.True(t, outcome.ResultSetComplete)
+	assert.True(t, outcome.ForceReplace)
+	assert.Equal(t, SkipNoSession, outcome.SkipReason)
+	assert.Empty(t, outcome.Results)
+
+	require.NoError(t, db.Close())
+	require.NoError(t, os.Remove(dbPath))
+	_, ok, err = provider.FindSource(context.Background(), FindSourceRequest{
+		StoredFilePath:     virtualPath,
+		RequireFreshSource: true,
+	})
+	require.NoError(t, err)
+	assert.False(t, ok, "fresh lookup must reject a deleted DB file")
+}
+
+func TestDBBackedProviderRejectsInvalidStoredVirtualPaths(t *testing.T) {
+	dbPath, seeder, db := newForgeTestDB(t)
+	defer db.Close()
+	seedForgeConversation(t, seeder)
+	root := filepath.Dir(dbPath)
+	virtualPath := dbPath + "#conv-001"
+	otherPath := dbPath + "#conv-002"
+	seeder.AddConversation(
+		"conv-002",
+		"Other",
+		123,
+		`{"conversation_id":"conv-002","messages":[]}`,
+		"2026-05-03 09:58:15.000000000",
+		"2026-05-03 10:00:16.000000000",
+		"",
+	)
+
+	provider, ok := NewProvider(AgentForge, ProviderConfig{Roots: []string{root}})
+	require.True(t, ok)
+	for _, path := range []string{
+		dbPath + "#",
+		filepath.Join(root, "forge-copy.db") + "#conv-001",
+		filepath.Join(root, "nested", forgeDBFilename) + "#conv-001",
+	} {
+		_, ok, err := provider.FindSource(context.Background(), FindSourceRequest{
+			StoredFilePath:     path,
+			RequireFreshSource: true,
+		})
+		require.NoError(t, err)
+		assert.False(t, ok, "stored path %q", path)
+	}
+
+	_, ok, err := provider.FindSource(context.Background(), FindSourceRequest{
+		RawSessionID:       "conv-001",
+		StoredFilePath:     otherPath,
+		RequireFreshSource: true,
+	})
+	require.NoError(t, err)
+	assert.False(t, ok, "fresh lookup must reject a stored path for a different session")
+
+	source, ok, err := provider.FindSource(context.Background(), FindSourceRequest{
+		StoredFilePath: virtualPath,
+	})
+	require.NoError(t, err)
+	require.True(t, ok)
+	assert.Equal(t, virtualPath, source.DisplayPath)
+}
+
 func TestDBBackedProviderMissingDBFingerprintsTombstoneAndSkips(t *testing.T) {
 	dbPath, seeder, db := newForgeTestDB(t)
 	seedForgeConversation(t, seeder)