fix: use task workspace for codebase search

.coderabbit.yaml

@@ -48,17 +48,19 @@ reviews:
           instructions: >-
               Act as an adversarial second-opinion reviewer. Verify PR claims against implementation and
               contracts. Trace changed inputs through normal, boundary, error, cancellation, retry, and
-              default paths and their consumers. Seek plausible counterexamples and regressions from removed
-              safeguards. Identify assumptions in changed code that depend on facts outside the diff. First
-              verify repository conventions, tests, and related implementations. When a potential finding
-              depends on external behavior, use web search and prefer official documentation, specifications,
-              or upstream repositories. Report only concrete, actionable conflicts or failure modes, citing
-              the relevant repository location or external source. Prioritize correctness, security, data loss,
-              lifecycle, and test gaps. Do not report generic best practices, unsupported concerns, speculative
-              style comments, or unrelated refactors. When changed code introduces a local implementation of a
-              cross-cutting concern, check whether it bypasses or duplicates an established repository abstraction
-              or nearby convention. Report only a concrete inconsistency with behavioral or maintenance impact,
-              and allow intentional deviations.
+              default paths and their direct test counterparts. Do not flag defects in files not changed by
+              this PR unless the defect is directly triggered by changed code and cannot be detected in the
+              changed file alone. Seek plausible counterexamples and regressions from removed safeguards.
+              Identify assumptions in changed code that depend on facts outside the diff. First verify
+              repository conventions, tests, and related implementations. When a potential finding depends on
+              external behavior, use web search and prefer official documentation, specifications, or upstream
+              repositories. Report only concrete, actionable conflicts or failure modes, citing the relevant
+              repository location or external source. Prioritize correctness, security, data loss, lifecycle,
+              and test gaps. Do not report generic best practices, unsupported concerns, speculative style
+              comments, or unrelated refactors. When changed code introduces a local implementation of a
+              cross-cutting concern, check whether it bypasses or duplicates an established repository
+              abstraction or nearby convention. Report only a concrete inconsistency with behavioral or
+              maintenance impact, and allow intentional deviations.
 
         - path: "**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}"
           instructions: >-

.github/workflows/code-qa.yml

@@ -90,6 +90,8 @@ jobs:
               run: pnpm lint
             - name: Check types
               run: pnpm check-types
+            - name: Validate Code QA workflow
+              run: pnpm test:code-qa-ci
             - name: Model-check task lifecycle protocols
               run: pnpm lifecycle:model-check
             - name: Validate MCP OAuth integration
@@ -135,11 +137,11 @@ jobs:
                     - os: ubuntu-latest
                       name: ubuntu-latest
                       codecov-flag: ubuntu
-                      upload-coverage: true
+                      collect-coverage: true
                     - os: windows-latest
                       name: windows-latest
                       codecov-flag: windows
-                      upload-coverage: false
+                      collect-coverage: false
         steps:
             - name: Checkout code
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -154,25 +156,56 @@ jobs:
                   restore-keys: |
                       ${{ runner.os }}-turbo-${{ hashFiles('**/pnpm-lock.yaml') }}-
                       ${{ runner.os }}-turbo-
+            # Windows never uploads coverage, so Windows runs the same test
+            # suites through the uninstrumented Turbo tasks. Ubuntu stays the
+            # authoritative coverage lane.
             - name: Run non-extension package coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
+            - name: Run non-extension package tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
             - name: Run extension coverage lanes
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:api test:coverage:core test:coverage:services test:coverage:misc test:coverage:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
+            - name: Run extension test lanes
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:api test:core test:services test:misc test:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
             - name: Verify extension coverage contract
+              if: matrix.collect-coverage
               run: pnpm --dir src run verify:coverage-contract
             - name: Run extension dist smoke test
               run: pnpm turbo run test:dist --filter="zoo-code" --log-order grouped --output-logs new-only
             - name: Run core unit coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Run core unit tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
             - name: Run core integration coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Run core integration tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
             - name: Verify extension coverage reports
+              if: matrix.collect-coverage
               run: |
                   node src/scripts/verify-lcov.mjs src/coverage/api/lcov.info
                   node src/scripts/verify-lcov.mjs src/coverage/core/lcov.info
                   node src/scripts/verify-lcov.mjs src/coverage/services/lcov.info
                   node src/scripts/verify-lcov.mjs src/coverage/misc/lcov.info
                   node src/scripts/verify-lcov.mjs src/coverage/tree-sitter/lcov.info
+            - name: Merge extension coverage reports
+              if: matrix.collect-coverage
+              run: |
+                  mkdir -p src/coverage/merged
+                  pnpm --dir src run merge:coverage
+                  node src/scripts/verify-lcov.mjs src/coverage/merged/lcov.info
+            # Validate cache boundaries before publishing any new Turbo entries.
+            - name: Verify coverage cache inputs
+              if: matrix.collect-coverage
+              run: pnpm --dir src run verify:coverage-cache-inputs
             - name: Save Turbo cache
               if: steps.turbo-cache.outputs.cache-hit != 'true'
               uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -184,53 +217,48 @@ jobs:
             # there mostly adds Codecov overhead without changing pass/fail
             # behavior.
             # Coverage is uploaded in separate steps so each LCOV gets the
-            # correct flag set. Codecov double-counts overlapping lines when a
-            # single upload carries multiple flags whose paths overlap, so the
-            # core lanes and webview lane must be uploaded individually with
-            # their own flag.
+            # correct flag set. Extension lanes instrument the same sources, so
+            # union them before upload; a line is covered when any lane executes
+            # it. Core and webview reports retain their independent flags.
             # See https://docs.codecov.com/docs/flags
             - name: Upload non-core coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: >-
-                      src/coverage/api/lcov.info,
-                      src/coverage/core/lcov.info,
-                      src/coverage/services/lcov.info,
-                      src/coverage/misc/lcov.info,
-                      src/coverage/tree-sitter/lcov.info,
+                      src/coverage/merged/lcov.info,
                       packages/cloud/coverage/lcov.info,
                       packages/telemetry/coverage/lcov.info,
                       apps/cli/coverage/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }}
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload webview JSDOM coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: webview-ui/coverage/lcov.info
                   disable_search: true
                   flags: webview-ui
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core unit coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/unit/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-unit
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core integration coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/integration/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-integration
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload coverage reports to GitHub
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: coverage-reports-${{ matrix.name }}
@@ -240,6 +268,7 @@ jobs:
                       src/coverage/services/lcov.info
                       src/coverage/misc/lcov.info
                       src/coverage/tree-sitter/lcov.info
+                      src/coverage/merged/lcov.info
                       webview-ui/coverage/lcov.info
                       packages/cloud/coverage/lcov.info
                       packages/telemetry/coverage/lcov.info