Merge upstream main into vps2/f5-api-wiring

Author: easonliang28

.coderabbit.yaml

@@ -11,6 +11,8 @@ chat:
 knowledge_base:
     web_search:
         enabled: true
+    learnings:
+        scope: local
 
 reviews:
     profile: assertive
@@ -46,21 +48,28 @@ reviews:
           instructions: >-
               Act as an adversarial second-opinion reviewer. Verify PR claims against implementation and
               contracts. Trace changed inputs through normal, boundary, error, cancellation, retry, and
-              default paths and their consumers. Seek plausible counterexamples and regressions from removed
-              safeguards. Identify assumptions in changed code that depend on facts outside the diff. First
-              verify repository conventions, tests, and related implementations. When a potential finding
-              depends on external behavior, use web search and prefer official documentation, specifications,
-              or upstream repositories. Report only concrete, actionable conflicts or failure modes, citing
-              the relevant repository location or external source. Prioritize correctness, security, data loss,
-              lifecycle, and test gaps. Do not report generic best practices, unsupported concerns, speculative
-              style comments, or unrelated refactors. Search for existing helpers before suggesting abstractions.
+              default paths and their direct test counterparts. Do not flag defects in files not changed by
+              this PR unless the defect is directly triggered by changed code and cannot be detected in the
+              changed file alone. Seek plausible counterexamples and regressions from removed safeguards.
+              Identify assumptions in changed code that depend on facts outside the diff. First verify
+              repository conventions, tests, and related implementations. When a potential finding depends on
+              external behavior, use web search and prefer official documentation, specifications, or upstream
+              repositories. Report only concrete, actionable conflicts or failure modes, citing the relevant
+              repository location or external source. Prioritize correctness, security, data loss, lifecycle,
+              and test gaps. Do not report generic best practices, unsupported concerns, speculative style
+              comments, or unrelated refactors. When changed code introduces a local implementation of a
+              cross-cutting concern, check whether it bypasses or duplicates an established repository
+              abstraction or nearby convention. Report only a concrete inconsistency with behavioral or
+              maintenance impact, and allow intentional deviations.
 
         - path: "**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}"
           instructions: >-
               Check strict typing and exhaustive behavior across normal, boundary, error,
               cancellation, retry, and compatibility paths. Verify promises and errors are handled,
               existing helpers are reused, and new code introduces no `any`, unjustified double
               assertions, floating promises, duplicated helpers, or increased lint suppressions.
+              When a refactor adds early-return guards that redirect a subset of inputs to a new
+              code path, confirm the old branches for those inputs are removed or unreachable.
 
         - path: "{**/*.{test,spec}.{ts,tsx,js,jsx},**/__tests__/**}"
           instructions: >-
@@ -76,6 +85,11 @@ reviews:
               Flag tests that assert in-flight behavior only after the call completes — these cannot
               prove the behavior fires during execution. Check that describe block names match the
               actual subjects of the tests they contain.
+              For tests that assert only mock call counts, confirm a corresponding return-value
+              assertion exists; a regression that silently returns stale fallback data can satisfy
+              a call-count check. For code with fallback behavior, verify both the cold-start case
+              (no prior state) and the warm case (prior state exists) are covered, as they exercise
+              different branches.
 
         - path: "apps/vscode-e2e/**"
           instructions: >-
@@ -115,6 +129,9 @@ reviews:
               Check persistence and lifecycle invariants: awaited atomic writes, rollback or explicit
               partial-failure behavior, cross-window state consistency, stale listeners/watchers,
               cancellation, idempotency, and safe restart/resume without lost or duplicated state.
+              For async functions that read shared mutable state before an `await` and write it back
+              after, verify the captured reference is still valid when the write executes; a concurrent
+              mutation during the await can cause a stale snapshot to overwrite a newer state.
 
         - path: ".github/**"
           instructions: >-
@@ -128,8 +145,20 @@ reviews:
               during release preparation. Verify documentation describes real behavior and contracts,
               and deprioritize prose-only nits that do not affect correctness or usability.
 
+    finishing_touches:
+        docstrings:
+            enabled: false
+
     pre_merge_checks:
         override_requested_reviewers_only: true
+        docstrings:
+            mode: off
+        title:
+            mode: warning
+        description:
+            mode: warning
+        issue_assessment:
+            mode: error
         custom_checks:
             - name: Regression evidence
               mode: warning
@@ -140,18 +169,32 @@ reviews:
                   snapshot. Do not demand tests for unchanged behavior, mechanical configuration, or every
                   branch without a plausible regression scenario. Cite the changed behavior and missing
                   evidence.
-            - name: Trust and persistence invariants
+            - name: Security boundaries
+              mode: error
+              instructions: >-
+                  Fail only when a concrete changed path leaks secrets or PII, trusts or executes
+                  unvalidated input, or bypasses approval or allowlist controls. Cite the changed path
+                  and a plausible triggering scenario; pass when no such changed path exists.
+            - name: Persistence integrity
               mode: error
               instructions: >-
-                  Fail only for a concrete changed path that leaks secrets or PII, trusts or executes
-                  unvalidated input, bypasses approval or allowlist controls, can lose persisted state due
-                  to a missing await, non-atomic write, or omitted default propagation, or leaks lifecycle
-                  resources. Cite the path and a plausible triggering scenario; pass when no such changed
-                  path exists.
+                  Fail only when a concrete changed persistence path can lose or corrupt state because an
+                  operation is not awaited, a write is non-atomic, rollback or explicit partial-failure
+                  behavior is missing, or a persisted default is not propagated to a consumer. Cite the
+                  changed path and a plausible triggering scenario; pass when no such changed path exists.
+            - name: Lifecycle resource cleanup
+              mode: warning
+              instructions: >-
+                  Fail only when a concrete changed lifecycle path can leak a listener, watcher, provider,
+                  timer, task, or other resource, or can duplicate work after cancellation, disposal, or
+                  restart. Cite the changed path and a plausible triggering scenario; pass when no such
+                  changed path exists.
 
     tools:
         eslint:
             enabled: true
+        github-checks:
+            enabled: true
         actionlint:
             enabled: true
         shellcheck:

.github/workflows/code-qa.yml

@@ -90,8 +90,12 @@ jobs:
               run: pnpm lint
             - name: Check types
               run: pnpm check-types
+            - name: Validate Code QA workflow
+              run: pnpm test:code-qa-ci
             - name: Model-check task lifecycle protocols
               run: pnpm lifecycle:model-check
+            - name: Validate MCP OAuth integration
+              run: pnpm mcp:integration-check
 
     build-vsix:
         name: Build test VSIX
@@ -123,17 +127,21 @@ jobs:
     unit-test:
         name: platform-unit-test (${{ matrix.name }})
         runs-on: ${{ matrix.os }}
+        concurrency:
+            # Duplicate runs for one commit must not race the OS-specific Turbo cache save.
+            group: unit-test-${{ github.repository }}-${{ github.sha }}-${{ matrix.name }}
+            cancel-in-progress: false
         strategy:
             matrix:
                 include:
                     - os: ubuntu-latest
                       name: ubuntu-latest
                       codecov-flag: ubuntu
-                      upload-coverage: true
+                      collect-coverage: true
                     - os: windows-latest
                       name: windows-latest
                       codecov-flag: windows
-                      upload-coverage: false
+                      collect-coverage: false
         steps:
             - name: Checkout code
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -148,12 +156,56 @@ jobs:
                   restore-keys: |
                       ${{ runner.os }}-turbo-${{ hashFiles('**/pnpm-lock.yaml') }}-
                       ${{ runner.os }}-turbo-
-            - name: Run non-core coverage
-              run: pnpm turbo run test:coverage --filter="!@roo-code/core" --log-order grouped --output-logs new-only
+            # Windows never uploads coverage, so Windows runs the same test
+            # suites through the uninstrumented Turbo tasks. Ubuntu stays the
+            # authoritative coverage lane.
+            - name: Run non-extension package coverage
+              if: matrix.collect-coverage
+              run: pnpm turbo run test:coverage --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
+            - name: Run non-extension package tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
+            - name: Run extension coverage lanes
+              if: matrix.collect-coverage
+              run: pnpm turbo run test:coverage:api test:coverage:core test:coverage:services test:coverage:misc test:coverage:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
+            - name: Run extension test lanes
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:api test:core test:services test:misc test:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
+            - name: Verify extension coverage contract
+              if: matrix.collect-coverage
+              run: pnpm --dir src run verify:coverage-contract
+            - name: Run extension dist smoke test
+              run: pnpm turbo run test:dist --filter="zoo-code" --log-order grouped --output-logs new-only
             - name: Run core unit coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Run core unit tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
             - name: Run core integration coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Run core integration tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Verify extension coverage reports
+              if: matrix.collect-coverage
+              run: |
+                  node src/scripts/verify-lcov.mjs src/coverage/api/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/core/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/services/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/misc/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/tree-sitter/lcov.info
+            - name: Merge extension coverage reports
+              if: matrix.collect-coverage
+              run: |
+                  mkdir -p src/coverage/merged
+                  pnpm --dir src run merge:coverage
+                  node src/scripts/verify-lcov.mjs src/coverage/merged/lcov.info
+            # Validate cache boundaries before publishing any new Turbo entries.
+            - name: Verify coverage cache inputs
+              if: matrix.collect-coverage
+              run: pnpm --dir src run verify:coverage-cache-inputs
             - name: Save Turbo cache
               if: steps.turbo-cache.outputs.cache-hit != 'true'
               uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -165,54 +217,58 @@ jobs:
             # there mostly adds Codecov overhead without changing pass/fail
             # behavior.
             # Coverage is uploaded in separate steps so each LCOV gets the
-            # correct flag set. Codecov double-counts overlapping lines when a
-            # single upload carries multiple flags whose paths overlap, so the
-            # core lanes and webview lane must be uploaded individually with
-            # their own flag.
+            # correct flag set. Extension lanes instrument the same sources, so
+            # union them before upload; a line is covered when any lane executes
+            # it. Core and webview reports retain their independent flags.
             # See https://docs.codecov.com/docs/flags
             - name: Upload non-core coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: >-
-                      src/coverage/lcov.info,
+                      src/coverage/merged/lcov.info,
                       packages/cloud/coverage/lcov.info,
                       packages/telemetry/coverage/lcov.info,
                       apps/cli/coverage/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }}
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload webview JSDOM coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: webview-ui/coverage/lcov.info
                   disable_search: true
                   flags: webview-ui
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core unit coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/unit/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-unit
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core integration coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/integration/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-integration
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload coverage reports to GitHub
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: coverage-reports-${{ matrix.name }}
                   path: |
-                      src/coverage/lcov.info
+                      src/coverage/api/lcov.info
+                      src/coverage/core/lcov.info
+                      src/coverage/services/lcov.info
+                      src/coverage/misc/lcov.info
+                      src/coverage/tree-sitter/lcov.info
+                      src/coverage/merged/lcov.info
                       webview-ui/coverage/lcov.info
                       packages/cloud/coverage/lcov.info
                       packages/telemetry/coverage/lcov.info