fix(webview): isolate parallel mode and provider profile writes (vps2 F3)

packages/types/src/__tests__/index.test.ts

@@ -3,6 +3,10 @@
 import { GLOBAL_STATE_KEYS } from "../index.js"
 
 describe("GLOBAL_STATE_KEYS", () => {
+	it("should contain registered durable per-view state", () => {
+		expect(GLOBAL_STATE_KEYS).toContain("viewStates")
+	})
+
 	it("should contain provider settings keys", () => {
 		expect(GLOBAL_STATE_KEYS).toContain("autoApprovalEnabled")
 	})
@@ -13,6 +17,7 @@ describe("GLOBAL_STATE_KEYS", () => {
 
 	it("should not contain secret state keys", () => {
 		expect(GLOBAL_STATE_KEYS).not.toContain("openRouterApiKey")
+		expect(GLOBAL_STATE_KEYS).not.toContain("apiKey")
 	})
 
 	it("should contain OpenAI Compatible base URL setting", () => {

packages/types/src/global-settings.ts

@@ -99,6 +99,15 @@ export const MAX_CHECKPOINT_TIMEOUT_SECONDS = 60
  */
 export const DEFAULT_CHECKPOINT_TIMEOUT_SECONDS = 15
 
+/**
+ * Persisted non-secret selections for a stable webview instance.
+ */
+export const viewStateSchema = z.object({
+	mode: z.string().optional(),
+	currentApiConfigName: z.string().optional(),
+	updatedAt: z.number().optional(),
+})
+
 /**
  * GlobalSettings
  */
@@ -107,6 +116,7 @@ export const globalSettingsSchema = z.object({
 	currentApiConfigName: z.string().optional(),
 	listApiConfigMeta: z.array(providerSettingsEntrySchema).optional(),
 	pinnedApiConfigs: z.record(z.string(), z.boolean()).optional(),
+	viewStates: z.record(z.string(), viewStateSchema).optional(),
 
 	lastShownAnnouncementId: z.string().optional(),
 	customInstructions: z.string().optional(),

packages/types/src/vscode-extension-host.ts

@@ -647,6 +647,7 @@ export interface WebviewMessage {
 		| "openRulesDirectory"
 		| "themeFixtureProbeResponse"
 	text?: string
+	viewStateId?: string
 	taskId?: string
 	editedMessageContent?: string
 	tab?: "settings" | "history" | "mcp" | "modes" | "chat" | "marketplace" | "cloud"

packages/types/src/vscode.ts

@@ -35,6 +35,14 @@ export const commandIds = [
 	"popoutButtonClicked",
 	"settingsButtonClicked",
 
+	// Editor-tab (popped-out) surface variants of the title-bar buttons. The
+	// shared ids above target the sidebar click origin, so the tab surface
+	// needs its own ids (see registerCommands.ts getTabProvider).
+	"plusButtonClickedInTab",
+	"settingsButtonClickedInTab",
+	"marketplaceButtonClickedInTab",
+	"historyButtonClickedInTab",
+
 	"openInNewTab",
 
 	"newTask",