fix(sync): require Windsurf hash freshness

VALID (fixed): kenn-io#1 -- Windsurf same-size/same-mtime SQLite rewrites need to compare the provider file_hash before taking skip-cache or stored-freshness shortcuts.

Windsurf now uses a component-labeled content digest for state.vscdb, WAL/SHM, and workspace.json so the fingerprint is stable across roots while still moving when parsed source content changes. The sync freshness allowlist now requires that hash for Windsurf, matching the composite fingerprint contract.

The commit also includes the repository hook's automatic Qoder slices.Backward modernization; without staging that generated fix, the pre-commit hook re-applies it and aborts before the Windsurf fix can be committed.

Author: wesm

internal/parser/qoder.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 )
@@ -165,9 +166,9 @@ func DecodeQoderProjectDir(encoded string) string {
 			}
 		}
 	}
-	for i := len(parts) - 1; i >= 0; i-- {
-		if parts[i] != "" {
-			return NormalizeName(parts[i])
+	for _, v := range slices.Backward(parts) {
+		if v != "" {
+			return NormalizeName(v)
 		}
 	}
 	return NormalizeName(encoded)

internal/parser/windsurf_provider.go

@@ -814,15 +814,23 @@ func windsurfWorkspaceProject(dbPath string) string {
 
 func windsurfSourceHash(dbPath, workspacePath string) (string, error) {
 	h := sha256.New()
-	for _, path := range []string{dbPath, dbPath + "-wal", dbPath + "-shm", workspacePath} {
-		if path == "" || !IsRegularFile(path) {
+	for _, component := range []struct {
+		label string
+		path  string
+	}{
+		{label: "db", path: dbPath},
+		{label: "wal", path: dbPath + "-wal"},
+		{label: "shm", path: dbPath + "-shm"},
+		{label: "workspace", path: workspacePath},
+	} {
+		if component.path == "" || !IsRegularFile(component.path) {
 			continue
 		}
-		hash, err := hashJSONLSourceFile(path)
+		hash, err := hashJSONLSourceFile(component.path)
 		if err != nil {
 			return "", err
 		}
-		_, _ = h.Write([]byte(path))
+		_, _ = h.Write([]byte(component.label))
 		_, _ = h.Write([]byte{0})
 		_, _ = h.Write([]byte(hash))
 		_, _ = h.Write([]byte{0})

internal/parser/windsurf_provider_test.go

@@ -58,6 +58,32 @@ func TestWindsurfProviderDiscoversAndParsesWorkspaceSQLiteChat(t *testing.T) {
 	assert.Equal(t, "Use the existing parser.", result.Messages[1].Content)
 }
 
+func TestWindsurfProviderFingerprintHashIsContentBased(t *testing.T) {
+	payload := windsurfVSCodeSessionJSON(
+		"windsurf-session-hash",
+		"Hash this",
+		"Same content.",
+	)
+	rootA, _ := windsurfProviderFixture(t, payload)
+	rootB, _ := windsurfProviderFixture(t, payload)
+	providerA := newTestWindsurfProvider(rootA)
+	providerB := newTestWindsurfProvider(rootB)
+
+	sourcesA, err := providerA.Discover(context.Background())
+	require.NoError(t, err)
+	require.Len(t, sourcesA, 1)
+	sourcesB, err := providerB.Discover(context.Background())
+	require.NoError(t, err)
+	require.Len(t, sourcesB, 1)
+	fpA, err := providerA.Fingerprint(context.Background(), sourcesA[0])
+	require.NoError(t, err)
+	fpB, err := providerB.Fingerprint(context.Background(), sourcesB[0])
+	require.NoError(t, err)
+
+	require.NotEmpty(t, fpA.Hash)
+	assert.Equal(t, fpA.Hash, fpB.Hash)
+}
+
 func TestWindsurfProviderParsesTabContainerChatData(t *testing.T) {
 	root, _ := windsurfProviderFixture(t, `{
 		"tabs": [{

internal/sync/engine.go

@@ -4197,7 +4197,7 @@ func providerProcessCacheKeyWithHash(
 
 func providerFingerprintHashRequiredForFreshness(agent parser.AgentType) bool {
 	switch agent {
-	case parser.AgentDevin, parser.AgentQoder:
+	case parser.AgentDevin, parser.AgentQoder, parser.AgentWindsurf:
 		return true
 	default:
 		return false

internal/sync/windsurf_integration_test.go

@@ -55,6 +55,85 @@ func TestSourceMtimeWindsurfUsesProviderFingerprint(t *testing.T) {
 	assert.Greater(t, after, before)
 }
 
+func TestProcessFileWindsurfSameMtimeHashChangeReparses(t *testing.T) {
+	for _, tt := range []struct {
+		name      string
+		seedCache bool
+		freshSync bool
+	}{
+		{name: "skip cache", seedCache: true},
+		{name: "db freshness", freshSync: true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			root := filepath.Join(t.TempDir(), "Windsurf", "User")
+			workspaceDir := filepath.Join(root, "workspaceStorage", "workspace-hash")
+			manifestPath := filepath.Join(workspaceDir, "workspace.json")
+			dbPath := filepath.Join(workspaceDir, "state.vscdb")
+			require.NoError(t, os.MkdirAll(workspaceDir, 0o755))
+			require.NoError(t, os.WriteFile(manifestPath, []byte(`{"folder":"file:///work/demo"}`), 0o644))
+			writeSyncWindsurfStateDB(t, dbPath, windsurfSyncPayload("hash-session", "Alpha reply"))
+			virtualPath := dbPath + "#hash-session"
+			database := dbtest.OpenTestDB(t)
+			engine := NewEngine(database, EngineConfig{
+				AgentDirs: map[parser.AgentType][]string{
+					parser.AgentWindsurf: {root},
+				},
+				Machine: "devbox",
+			})
+			defer engine.Close()
+
+			first := engine.processFile(context.Background(), parser.DiscoveredFile{
+				Path:  virtualPath,
+				Agent: parser.AgentWindsurf,
+			})
+			require.NoError(t, first.err)
+			require.Len(t, first.results, 1)
+			require.Len(t, first.results[0].Messages, 2)
+			assert.Equal(t, "Alpha reply", first.results[0].Messages[1].Content)
+			initialMtime := first.results[0].Session.File.Mtime
+			initialHash := first.results[0].Session.File.Hash
+			require.NotZero(t, initialMtime)
+			require.NotEmpty(t, initialHash)
+			writeSyncWindsurfResult(t, engine, first)
+
+			infoBefore, err := os.Stat(dbPath)
+			require.NoError(t, err)
+			updateSyncWindsurfStateDB(t, dbPath, windsurfSyncPayload("hash-session", "Bravo reply"))
+			initialTime := time.Unix(0, initialMtime)
+			require.NoError(t, os.Chtimes(dbPath, initialTime, initialTime))
+			infoAfter, err := os.Stat(dbPath)
+			require.NoError(t, err)
+			require.Equal(t, infoBefore.Size(), infoAfter.Size(),
+				"test must keep size stable so hash is the only freshness signal")
+
+			if tt.seedCache {
+				engine.cacheSkip(first.cacheKey, initialMtime)
+			}
+			if tt.freshSync {
+				engine.Close()
+				engine = NewEngine(database, EngineConfig{
+					AgentDirs: map[parser.AgentType][]string{
+						parser.AgentWindsurf: {root},
+					},
+					Machine: "devbox",
+				})
+				defer engine.Close()
+			}
+
+			second := engine.processFile(context.Background(), parser.DiscoveredFile{
+				Path:  virtualPath,
+				Agent: parser.AgentWindsurf,
+			})
+			require.NoError(t, second.err)
+			assert.False(t, second.skip)
+			require.Len(t, second.results, 1)
+			require.Len(t, second.results[0].Messages, 2)
+			assert.Equal(t, "Bravo reply", second.results[0].Messages[1].Content)
+			assert.NotEqual(t, initialHash, second.results[0].Session.File.Hash)
+		})
+	}
+}
+
 func writeSyncWindsurfStateDB(t *testing.T, dbPath, payload string) {
 	t.Helper()
 	conn, err := sql.Open("sqlite3", dbPath)
@@ -69,3 +148,46 @@ func writeSyncWindsurfStateDB(t *testing.T, dbPath, payload string) {
 	)
 	require.NoError(t, err)
 }
+
+func updateSyncWindsurfStateDB(t *testing.T, dbPath, payload string) {
+	t.Helper()
+	conn, err := sql.Open("sqlite3", dbPath)
+	require.NoError(t, err)
+	defer conn.Close()
+	_, err = conn.Exec(
+		`UPDATE ItemTable SET value = ? WHERE key = ?`,
+		payload,
+		"workbench.panel.aichat.view.aichat.chatdata",
+	)
+	require.NoError(t, err)
+}
+
+func writeSyncWindsurfResult(t *testing.T, engine *Engine, result processResult) {
+	t.Helper()
+	require.Len(t, result.results, 1)
+	written, _, failed := engine.writeBatch(
+		[]pendingWrite{{
+			sess:         result.results[0].Session,
+			msgs:         result.results[0].Messages,
+			usageEvents:  result.results[0].UsageEvents,
+			forceReplace: result.forceReplace,
+		}},
+		syncWriteDefault,
+		false,
+	)
+	require.Equal(t, 0, failed)
+	require.Equal(t, 1, written)
+}
+
+func windsurfSyncPayload(sessionID, assistant string) string {
+	return `{
+		"version": 1,
+		"sessionId": "` + sessionID + `",
+		"requests": [{
+			"requestId": "request-1",
+			"message": {"text": "Question"},
+			"response": [{"value": "` + assistant + `"}],
+			"timestamp": 1710000000000
+		}]
+	}`
+}