feat(parser): migrate qwen provider

[mariusvniekerk]

Qwen uses a nested project/chats JSONL source shape, so it is a good next provider facade slice after the shallow and directory JSONL migrations. Moving it behind a concrete provider keeps discovery, lookup, fingerprinting, and parse output explicit without introducing another source framework.

Legacy discovery accepts any one-level .jsonl file under chats while raw-session lookup still validates the requested ID before matching filename-derived IDs. The provider keeps that asymmetry, symlinked project directory and file behavior, project hints, and existing parser normalization intact.

[roborev-ci]

roborev: Combined Review (4d719cd)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (claude-code/default, done, 4m13s), codex_security (claude-code/security, done, 49s) | Total: 5m2s

[roborev-ci]

roborev: Combined Review (186dc79)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (claude-code/default, done, 3m45s), codex_security (claude-code/security, done, 1m0s) | Total: 4m45s

[roborev-ci]

roborev: Combined Review (f82fab1)

Summary verdict: one medium correctness issue should be fixed before relying on Qwen provider shadow comparisons.

Medium

• internal/parser/qwen_provider.go:113 - Qwen is opted into ProviderMigrationShadowCompare, but its source set does not enable Hash, so provider.Fingerprint leaves Hash empty and qwenProvider.Parse stores an empty Session.File.Hash. The legacy processQwen path computes and stores a SHA-256 hash, so real shadow comparisons will report every parsed Qwen session as different. The new shadow test masks this by copying the empty observation hash into the legacy session.
  • Fix: Add Hash: true to the Qwen JSONLSourceSetOptions and update the Qwen shadow/provider tests to assert a non-empty fingerprint hash that matches the legacy file hash.

---

Panel: ci_default_security | Synthesis: codex, 7s | Members: codex_default (codex/default, done, 5m21s), codex_security (codex/security, done, 1m2s) | Total: 6m30s

[mariusvniekerk]

This change is part of the following stack:

• Design parser provider facade layer #748
  • Add parser provider facade core #751
    • Add JSONL source set helper #752
      • feat(parser): migrate commandcode and iflow providers #757
        • Migrate gptme to parser provider facade #753
          • feat(parser): migrate deepseek tui provider #758
            • feat(parser): migrate amp and zencoder providers #759
              • feat(parser): migrate pi provider #760
                • feat(parser): migrate qwen provider #761 ◀
                  • feat(parser): migrate workbuddy provider #762
                  • feat(parser): migrate cortex provider #763
                  • feat(parser): migrate kimi provider #764
                  • feat(parser): migrate claw providers #766
                  • feat(parser): migrate qwenpaw provider #767
                  • feat(parser): migrate openhands provider #768
                  • feat(parser): migrate cursor provider #769
                  • feat(parser): migrate vibe provider #770
                  • feat(parser): migrate hermes provider #771
                  • feat(parser): migrate claude provider #772
                  • feat(parser): migrate cowork provider #773
                  • feat(parser): migrate opencode-family providers #774
                  • feat(parser): migrate codex provider #775
                  • feat(parser): migrate gemini copilot providers #776
                  • feat(parser): migrate copilot ide providers #778
                  • feat(parser): migrate positron provider #779
                  • feat(parser): migrate zed shelley providers #780
                  • feat(parser): migrate kiro providers #781
                  • feat(parser): migrate antigravity providers #782
                  • feat(parser): migrate db-backed providers #783
                  • fix(parser): require explicit provider factories #784

_{Change managed by git-spice.}

[roborev-ci]

roborev: Combined Review (6b3c03f)

Review verdict: one Medium issue remains; no High or Critical findings.

Medium

• internal/parser/qwen_provider.go:113: The Qwen source set does not enable content hashing, so qwenProvider.Parse leaves Session.File.Hash empty during normal provider observation. Legacy processQwen computes and stores the file hash, and this PR opts Qwen into shadow comparison, so successful Qwen sessions will produce caller-level shadow mismatches and would lose file_hash if promoted to provider-authoritative.
  • Fix: Set Hash: true in JSONLSourceSetOptions for Qwen, or otherwise compute the same SHA-256 hash before returning the parse result, and add a caller-level shadow test that compares through processFile.

---

Panel: ci_default_security | Synthesis: codex, 6s | Members: codex_default (codex/default, done, 3m17s), codex_security (codex/security, done, 1m52s) | Total: 5m15s

[roborev-ci]

roborev: Combined Review (ae746c8)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (claude-code/default, done, 7m52s), codex_security (claude-code/security, done, 1m57s) | Total: 9m49s

[roborev-ci]

roborev: Combined Review (6f4b43e)

Summary verdict: one medium regression blocks full Qwen provider parity; no security issues were found.

Medium

• internal/parser/types.go:335 - Dropping Qwen's DiscoverFunc/FindSourceFunc leaves provider-unaware paths blind to unsynced Qwen sessions. resolveRawSessionID still probes disk only through FindSourceFunc, and SSH remote directory resolution only includes agents with DiscoverFunc, so session usage qwen:<id> and remote sync discovery regress for Qwen.
  • Fix: Add provider-backed probing to those call sites, or keep Qwen compatibility hooks until all downstream discovery/lookup paths use providers.

---

Panel: ci_default_security | Synthesis: codex, 7s | Members: codex_default (codex/default, done, 5m15s), codex_security (codex/security, done, 1m33s) | Total: 6m55s

[roborev-ci]

roborev: Combined Review (dba161b)

High-severity compile failure; medium-severity Qwen hash regression. No security issues reported.

High

• internal/parser/qwen_provider_test.go:47 - The new test references sourceDisplayPaths and sourceProjects, but those helpers are not defined in the parser package, so the test package will not compile. Add shared/local helper functions for these projections or inline the extracted slices in the test.

Medium

• internal/parser/qwen_provider.go:23 - The Qwen source set does not enable content hashing, so qwenParseFile will never receive req.Fingerprint.Hash during normal provider processing. The legacy path computed and persisted File.Hash, so this migration will clear file_hash for Qwen sessions. Add withContentHashing() to newQwenSourceSet and cover the real Fingerprint + Parse path in the provider test.

---

Panel: ci_default_security | Synthesis: codex, 9s | Members: codex_default (codex/default, done, 4m1s), codex_security (codex/security, done, 1m10s) | Total: 5m20s