fix(remotesync): avoid archiving Windsurf workspace roots

VALID (fixed): kenn-io#1 -- Windsurf remote-sync targets exposed workspaceStorage as a recursive archive root.

Windsurf targets now separate import roots from archived files, so the HTTP archive endpoint streams only state.vscdb, sidecars, and workspace.json. Dir-only archive requests for file-scoped Windsurf targets are rejected instead of falling back to recursive tar.

Author: wesm

internal/remotesync/archive.go

@@ -11,13 +11,23 @@ import (
 
 func WriteArchive(w io.Writer, targets TargetSet) error {
 	tw := tar.NewWriter(w)
-	for _, dirs := range targets.Dirs {
+	for agent, dirs := range targets.Dirs {
+		if _, fileScoped := targets.Files[agent]; fileScoped {
+			continue
+		}
 		for _, root := range dirs {
 			if err := writeArchivePath(tw, root); err != nil {
 				return err
 			}
 		}
 	}
+	for _, files := range targets.Files {
+		for _, path := range files {
+			if err := writeArchivePath(tw, path); err != nil {
+				return err
+			}
+		}
+	}
 	for _, path := range targets.ExtraFiles {
 		if err := writeArchivePath(tw, path); err != nil {
 			return err

internal/remotesync/paths.go

@@ -112,6 +112,13 @@ func validateTargetSetPaths(targets TargetSet) error {
 			}
 		}
 	}
+	for agent, files := range targets.Files {
+		for _, file := range files {
+			if _, err := safeRemotePathArchiveName(file); err != nil {
+				return fmt.Errorf("target file %s %q: %w", agent, file, err)
+			}
+		}
+	}
 	for _, file := range targets.ExtraFiles {
 		if _, err := safeRemotePathArchiveName(file); err != nil {
 			return fmt.Errorf("target file %q: %w", file, err)

internal/remotesync/resolve.go

@@ -5,13 +5,15 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"sort"
 
 	"go.kenn.io/agentsview/internal/config"
 	"go.kenn.io/agentsview/internal/parser"
 )
 
 func ResolveTargets(cfg config.Config) TargetSet {
 	dirs := make(map[parser.AgentType][]string)
+	files := make(map[parser.AgentType][]string)
 	var extra []string
 	for _, def := range parser.Registry {
 		if !resolveAgentHasOnDiskSource(def) {
@@ -26,9 +28,10 @@ func ResolveTargets(cfg config.Config) TargetSet {
 				continue
 			}
 			if def.Type == parser.AgentWindsurf {
-				target := resolveWindsurfTarget(dir)
-				if target != "" {
-					dirs[def.Type] = append(dirs[def.Type], target)
+				root, targetFiles := resolveWindsurfTarget(dir)
+				if root != "" && len(targetFiles) > 0 {
+					dirs[def.Type] = append(dirs[def.Type], root)
+					files[def.Type] = append(files[def.Type], targetFiles...)
 				}
 				continue
 			}
@@ -46,7 +49,7 @@ func ResolveTargets(cfg config.Config) TargetSet {
 			}
 		}
 	}
-	return TargetSet{Dirs: dirs, ExtraFiles: extra}
+	return TargetSet{Dirs: dirs, Files: files, ExtraFiles: extra}
 }
 
 func resolveAgentHasOnDiskSource(def parser.AgentDef) bool {
@@ -86,15 +89,60 @@ func resolveAiderTargets(root string) []string {
 	return out
 }
 
-func resolveWindsurfTarget(root string) string {
-	target := filepath.Clean(root)
-	if filepath.Base(target) != "workspaceStorage" {
-		target = filepath.Join(target, "workspaceStorage")
+func resolveWindsurfTarget(root string) (string, []string) {
+	targetRoot := filepath.Clean(root)
+	workspaceRoot := windsurfRemoteWorkspaceRoot(targetRoot)
+	if info, err := os.Stat(workspaceRoot); err != nil || !info.IsDir() {
+		return "", nil
 	}
-	if info, err := os.Stat(target); err == nil && info.IsDir() {
-		return target
+	files := resolveWindsurfFiles(workspaceRoot)
+	if len(files) == 0 {
+		return "", nil
 	}
-	return ""
+	return targetRoot, files
+}
+
+func windsurfRemoteWorkspaceRoot(root string) string {
+	clean := filepath.Clean(root)
+	if filepath.Base(clean) == "workspaceStorage" {
+		return clean
+	}
+	return filepath.Join(clean, "workspaceStorage")
+}
+
+func resolveWindsurfFiles(workspaceRoot string) []string {
+	entries, err := os.ReadDir(workspaceRoot)
+	if err != nil {
+		return nil
+	}
+	var files []string
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		workspaceDir := filepath.Join(workspaceRoot, entry.Name())
+		dbPath := filepath.Join(workspaceDir, parser.WindsurfStateDBName)
+		if !regularRemoteSyncFile(dbPath) {
+			continue
+		}
+		files = append(files, dbPath)
+		for _, path := range []string{
+			dbPath + "-wal",
+			dbPath + "-shm",
+			filepath.Join(workspaceDir, "workspace.json"),
+		} {
+			if regularRemoteSyncFile(path) {
+				files = append(files, path)
+			}
+		}
+	}
+	sort.Strings(files)
+	return files
+}
+
+func regularRemoteSyncFile(path string) bool {
+	info, err := os.Lstat(path)
+	return err == nil && info.Mode().IsRegular()
 }
 
 func providerDiscoveredPath(source parser.SourceRef) string {
@@ -121,6 +169,12 @@ func SelectAllowedTargets(allowed TargetSet, requested TargetSet) (TargetSet, bo
 	}
 	for agent, dirs := range requested.Dirs {
 		allowedDirs := allowed.Dirs[agent]
+		if _, fileScoped := allowed.Files[agent]; fileScoped {
+			requestedFiles, ok := requested.Files[agent]
+			if !ok || len(requestedFiles) == 0 {
+				return TargetSet{}, false
+			}
+		}
 		for _, dir := range dirs {
 			selectedDir, ok := selectAllowedString(allowedDirs, dir)
 			if !ok {
@@ -129,6 +183,22 @@ func SelectAllowedTargets(allowed TargetSet, requested TargetSet) (TargetSet, bo
 			selected.Dirs[agent] = append(selected.Dirs[agent], selectedDir)
 		}
 	}
+	for agent, files := range requested.Files {
+		allowedFiles, ok := allowed.Files[agent]
+		if !ok {
+			return TargetSet{}, false
+		}
+		for _, file := range files {
+			selectedFile, ok := selectAllowedString(allowedFiles, file)
+			if !ok {
+				return TargetSet{}, false
+			}
+			if selected.Files == nil {
+				selected.Files = make(map[parser.AgentType][]string)
+			}
+			selected.Files[agent] = append(selected.Files[agent], selectedFile)
+		}
+	}
 	for _, file := range requested.ExtraFiles {
 		selectedFile, ok := selectAllowedString(allowed.ExtraFiles, file)
 		if !ok {

internal/remotesync/resolve_test.go

@@ -27,13 +27,20 @@ func TestResolveTargetsFiltersAndIncludesSpecialFiles(t *testing.T) {
 	aiderHistory := filepath.Join(aiderRoot, "repo", parser.AiderHistoryFileName())
 	windsurfUserRoot := filepath.Join(root, "Windsurf", "User")
 	windsurfWorkspaceRoot := filepath.Join(windsurfUserRoot, "workspaceStorage")
+	windsurfWorkspaceDir := filepath.Join(windsurfWorkspaceRoot, "workspace-a")
+	windsurfStateDB := filepath.Join(windsurfWorkspaceDir, parser.WindsurfStateDBName)
+	windsurfWorkspaceJSON := filepath.Join(windsurfWorkspaceDir, "workspace.json")
+	windsurfSecret := filepath.Join(windsurfWorkspaceDir, "extension-secret.json")
 	require.NoError(t, os.MkdirAll(claudeDir, 0o755))
 	require.NoError(t, os.MkdirAll(codexDir, 0o755))
 	require.NoError(t, os.MkdirAll(devinDir, 0o755))
 	require.NoError(t, os.MkdirAll(warpDir, 0o755))
 	require.NoError(t, os.MkdirAll(filepath.Dir(aiderHistory), 0o755))
-	require.NoError(t, os.MkdirAll(windsurfWorkspaceRoot, 0o755))
+	require.NoError(t, os.MkdirAll(windsurfWorkspaceDir, 0o755))
 	require.NoError(t, os.WriteFile(aiderHistory, []byte("# aider\n"), 0o644))
+	require.NoError(t, os.WriteFile(windsurfStateDB, []byte("state"), 0o644))
+	require.NoError(t, os.WriteFile(windsurfWorkspaceJSON, []byte("{}\n"), 0o644))
+	require.NoError(t, os.WriteFile(windsurfSecret, []byte("secret"), 0o644))
 	codexIndex := filepath.Join(root, ".codex", parser.CodexSessionIndexFilename)
 	require.NoError(t, os.WriteFile(codexIndex, []byte("{}\n"), 0o644))
 
@@ -57,8 +64,13 @@ func TestResolveTargetsFiltersAndIncludesSpecialFiles(t *testing.T) {
 	assert.NotContains(t, targets.Dirs, parser.AgentWarp)
 	assert.Equal(t, []string{aiderHistory}, targets.Dirs[parser.AgentAider])
 	assert.NotContains(t, targets.Dirs, parser.AgentZed)
-	assert.Equal(t, []string{windsurfWorkspaceRoot}, targets.Dirs[parser.AgentWindsurf])
-	assert.NotContains(t, targets.Dirs[parser.AgentWindsurf], windsurfUserRoot)
+	assert.Equal(t, []string{windsurfUserRoot}, targets.Dirs[parser.AgentWindsurf])
+	assert.NotContains(t, targets.Dirs[parser.AgentWindsurf], windsurfWorkspaceRoot)
+	assert.ElementsMatch(t, []string{
+		windsurfStateDB,
+		windsurfWorkspaceJSON,
+	}, targets.Files[parser.AgentWindsurf])
+	assert.NotContains(t, targets.Files[parser.AgentWindsurf], windsurfSecret)
 	assert.Contains(t, targets.ExtraFiles, codexIndex)
 }
 
@@ -84,13 +96,26 @@ func TestResolveTargetsSkipsAiderHomeRoot(t *testing.T) {
 func TestSelectAllowedTargetsReturnsResolvedValues(t *testing.T) {
 	allowed := remotesync.TargetSet{
 		Dirs: map[parser.AgentType][]string{
-			parser.AgentClaude: {"/srv/claude", "/srv/claude-extra"},
+			parser.AgentClaude:   {"/srv/claude", "/srv/claude-extra"},
+			parser.AgentWindsurf: {"/srv/Windsurf/User"},
+		},
+		Files: map[parser.AgentType][]string{
+			parser.AgentWindsurf: {
+				"/srv/Windsurf/User/workspaceStorage/a/state.vscdb",
+				"/srv/Windsurf/User/workspaceStorage/a/workspace.json",
+			},
 		},
 		ExtraFiles: []string{"/srv/.codex/session_index.jsonl"},
 	}
 	requested := remotesync.TargetSet{
 		Dirs: map[parser.AgentType][]string{
-			parser.AgentClaude: {"/srv/claude-extra"},
+			parser.AgentClaude:   {"/srv/claude-extra"},
+			parser.AgentWindsurf: {"/srv/Windsurf/User"},
+		},
+		Files: map[parser.AgentType][]string{
+			parser.AgentWindsurf: {
+				"/srv/Windsurf/User/workspaceStorage/a/state.vscdb",
+			},
 		},
 		ExtraFiles: []string{"/srv/.codex/session_index.jsonl"},
 	}
@@ -99,9 +124,36 @@ func TestSelectAllowedTargetsReturnsResolvedValues(t *testing.T) {
 
 	require.True(t, ok)
 	assert.Equal(t, []string{"/srv/claude-extra"}, selected.Dirs[parser.AgentClaude])
+	assert.Equal(t, []string{"/srv/Windsurf/User"}, selected.Dirs[parser.AgentWindsurf])
+	assert.Equal(t, []string{
+		"/srv/Windsurf/User/workspaceStorage/a/state.vscdb",
+	}, selected.Files[parser.AgentWindsurf])
 	assert.Equal(t, []string{"/srv/.codex/session_index.jsonl"}, selected.ExtraFiles)
 }
 
+func TestSelectAllowedTargetsRejectsFileScopedDirOnlyRequest(t *testing.T) {
+	allowed := remotesync.TargetSet{
+		Dirs: map[parser.AgentType][]string{
+			parser.AgentWindsurf: {"/srv/Windsurf/User"},
+		},
+		Files: map[parser.AgentType][]string{
+			parser.AgentWindsurf: {
+				"/srv/Windsurf/User/workspaceStorage/a/state.vscdb",
+			},
+		},
+	}
+	requested := remotesync.TargetSet{
+		Dirs: map[parser.AgentType][]string{
+			parser.AgentWindsurf: {"/srv/Windsurf/User"},
+		},
+	}
+
+	_, ok := remotesync.SelectAllowedTargets(allowed, requested)
+
+	assert.False(t, ok)
+	assert.False(t, remotesync.TargetSetAllowed(allowed, requested))
+}
+
 func TestSelectAllowedTargetsRejectsUnresolvedValues(t *testing.T) {
 	allowed := remotesync.TargetSet{
 		Dirs: map[parser.AgentType][]string{
@@ -132,12 +184,17 @@ func TestResolveTargetsMatchesSSHResolverForRepresentativeHome(t *testing.T) {
 	aiderHistory := filepath.Join(aiderRoot, "repo", parser.AiderHistoryFileName())
 	windsurfUserRoot := filepath.Join(home, "AppData", "Roaming", "Windsurf", "User")
 	windsurfWorkspaceRoot := filepath.Join(windsurfUserRoot, "workspaceStorage")
+	windsurfWorkspaceDir := filepath.Join(windsurfWorkspaceRoot, "workspace-a")
+	windsurfStateDB := filepath.Join(windsurfWorkspaceDir, parser.WindsurfStateDBName)
+	windsurfWorkspaceJSON := filepath.Join(windsurfWorkspaceDir, "workspace.json")
 	require.NoError(t, os.MkdirAll(claudeDir, 0o755))
 	require.NoError(t, os.MkdirAll(codexDir, 0o755))
 	require.NoError(t, os.MkdirAll(devinDir, 0o755))
 	require.NoError(t, os.MkdirAll(filepath.Dir(aiderHistory), 0o755))
-	require.NoError(t, os.MkdirAll(windsurfWorkspaceRoot, 0o755))
+	require.NoError(t, os.MkdirAll(windsurfWorkspaceDir, 0o755))
 	require.NoError(t, os.WriteFile(aiderHistory, []byte("# aider\n"), 0o644))
+	require.NoError(t, os.WriteFile(windsurfStateDB, []byte("state"), 0o644))
+	require.NoError(t, os.WriteFile(windsurfWorkspaceJSON, []byte("{}\n"), 0o644))
 	codexIndex := filepath.Join(home, ".codex", parser.CodexSessionIndexFilename)
 	require.NoError(t, os.WriteFile(codexIndex, []byte("{}\n"), 0o644))
 
@@ -164,6 +221,11 @@ func TestResolveTargetsMatchesSSHResolverForRepresentativeHome(t *testing.T) {
 	assert.NotContains(t, sshDirs, parser.AgentDevin)
 	assert.NotContains(t, goTargets.Dirs, parser.AgentDevin)
 	assert.ElementsMatch(t, sshDirs[parser.AgentAider], goTargets.Dirs[parser.AgentAider])
-	assert.ElementsMatch(t, sshDirs[parser.AgentWindsurf], goTargets.Dirs[parser.AgentWindsurf])
+	assert.ElementsMatch(t, []string{windsurfWorkspaceRoot}, sshDirs[parser.AgentWindsurf])
+	assert.ElementsMatch(t, []string{windsurfUserRoot}, goTargets.Dirs[parser.AgentWindsurf])
+	assert.ElementsMatch(t, []string{
+		windsurfStateDB,
+		windsurfWorkspaceJSON,
+	}, goTargets.Files[parser.AgentWindsurf])
 	assert.ElementsMatch(t, sshExtra, goTargets.ExtraFiles)
 }

internal/remotesync/types.go

@@ -15,6 +15,7 @@ type SyncStats struct {
 
 type TargetSet struct {
 	Dirs       map[parser.AgentType][]string `json:"dirs"`
+	Files      map[parser.AgentType][]string `json:"files,omitempty"`
 	ExtraFiles []string                      `json:"extra_files,omitempty"`
 }