fix(api): wire task controls and sidebar-targeted configuration (vps2 F5)

.gitignore

@@ -59,3 +59,5 @@ qdrant_storage/
 plans/
 
 roo-cli-*.tar.gz*
+.merge-*
+.zdt-*

packages/types/src/__tests__/global-settings.test.ts

@@ -1,5 +1,6 @@
 import {
 	DEFAULT_ALWAYS_DENY_UNAPPROVED_COMMANDS,
+	SECRET_STATE_KEYS,
 	DEFAULT_DESTRUCTIVE_COMMAND_GUARD_ENABLED,
 	GLOBAL_SETTINGS_KEYS,
 	globalSettingsSchema,
@@ -22,6 +23,13 @@ describe("destructive command guard global setting", () => {
 	})
 })
 
+describe("provider api-key secret registration", () => {
+	it("stores mimo and poe api keys in secret storage, not plaintext global state", () => {
+		expect(SECRET_STATE_KEYS).toContain("mimoApiKey")
+		expect(SECRET_STATE_KEYS).toContain("poeApiKey")
+	})
+})
+
 describe("alwaysDenyUnapprovedCommands global setting", () => {
 	it("is opt-in by default", () => {
 		expect(DEFAULT_ALWAYS_DENY_UNAPPROVED_COMMANDS).toBe(false)
@@ -39,6 +47,35 @@ describe("alwaysDenyUnapprovedCommands global setting", () => {
 	})
 })
 
+describe("viewStates global setting", () => {
+	it("parses a valid per-view record", () => {
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", currentApiConfigName: "profile-a", updatedAt: 1730000000000 },
+				"stable-view-2": {},
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]).toEqual({
+			mode: "code",
+			currentApiConfigName: "profile-a",
+			updatedAt: 1730000000000,
+		})
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({})
+		expect(GLOBAL_SETTINGS_KEYS).toContain("viewStates")
+	})
+
+	it("rejects invalid field values inside a view entry", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { mode: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { currentApiConfigName: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { updatedAt: "soon" } } })).toThrow()
+	})
+
+	it("rejects non-object viewStates values", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: "not-a-record" })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: "not-an-entry" } })).toThrow()
+	})
+})
+
 describe("collapseCommandOutputByDefault global setting", () => {
 	it.each([true, false, undefined])("round-trips %s through the export/import schema", (value) => {
 		const settings = globalSettingsSchema.parse({ collapseCommandOutputByDefault: value })

packages/types/src/__tests__/index.test.ts

@@ -3,6 +3,10 @@
 import { GLOBAL_STATE_KEYS } from "../index.js"
 
 describe("GLOBAL_STATE_KEYS", () => {
+	it("should contain registered durable per-view state", () => {
+		expect(GLOBAL_STATE_KEYS).toContain("viewStates")
+	})
+
 	it("should contain provider settings keys", () => {
 		expect(GLOBAL_STATE_KEYS).toContain("autoApprovalEnabled")
 	})
@@ -13,6 +17,7 @@ describe("GLOBAL_STATE_KEYS", () => {
 
 	it("should not contain secret state keys", () => {
 		expect(GLOBAL_STATE_KEYS).not.toContain("openRouterApiKey")
+		expect(GLOBAL_STATE_KEYS).not.toContain("apiKey")
 	})
 
 	it("should contain OpenAI Compatible base URL setting", () => {

packages/types/src/api.ts

@@ -2,7 +2,7 @@ import type { EventEmitter } from "events"
 import type { Socket } from "net"
 
 import type { RooCodeEvents } from "./events.js"
-import type { RooCodeSettings } from "./global-settings.js"
+import type { GlobalState, RooCodeSettings } from "./global-settings.js"
 import type { HistoryItem } from "./history.js"
 import type { ProviderSettingsEntry, ProviderSettings } from "./provider-settings.js"
 import type { IpcMessage, IpcServerEvents } from "./ipc.js"
@@ -21,18 +21,21 @@ export interface RooCodeAPI extends EventEmitter<RooCodeAPIEvents> {
 	 * Starts a new task with an optional initial message and images.
 	 * @param task Optional initial task message.
 	 * @param images Optional array of image data URIs (e.g., "data:image/webp;base64,...").
+	 * @param preserveOpenTabs When true, skips the new-tab editor cleanup (revert + close-all), preserving open tabs and dirty/unsaved editors.
 	 * @returns The ID of the new task.
 	 */
 	startNewTask({
 		configuration,
 		text,
 		images,
 		newTab,
+		preserveOpenTabs,
 	}: {
 		configuration?: RooCodeSettings
 		text?: string
 		images?: string[]
 		newTab?: boolean
+		preserveOpenTabs?: boolean
 	}): Promise<string>
 	/**
 	 * Resumes a task with the given ID.
@@ -128,7 +131,9 @@ export interface RooCodeAPI extends EventEmitter<RooCodeAPIEvents> {
 	 */
 	getConfiguration(): RooCodeSettings
 	/**
-	 * Sets the configuration for the current task.
+	 * Sets the configuration for the extension. Writes target the extension-host (sidebar) view:
+	 * view-local values are pinned to the sidebar's per-view state, while global values are
+	 * written to the shared ContextProxy.
 	 * @param values An object containing key-value pairs to set.
 	 */
 	setConfiguration(values: RooCodeSettings): Promise<void>
@@ -195,6 +200,52 @@ export interface RooCodeAPI extends EventEmitter<RooCodeAPIEvents> {
 	setTerminalProfile(name: string | undefined): void
 }
 
+/**
+ * Test-only extension API surface.
+ *
+ * These methods expose raw global-state reads and task ask control by ID that
+ * production callers must not rely on. The implementation is gated at runtime
+ * against VS Code ExtensionMode.Production, so only test hosts and the e2e
+ * harness keep access.
+ */
+/**
+ * GlobalState keys addressable through the test-only API surface.
+ *
+ * `taskHistory` is excluded at the type level because it carries user PII and the
+ * runtime refuses it for both accessors. Credential-bearing keys are still refused
+ * at runtime (a key union cannot express the resolution), and `setGlobalState`
+ * additionally requires the key to have a global-settings value schema.
+ */
+export type TestableGlobalStateKey = Exclude<keyof GlobalState, "taskHistory">
+
+export interface RooCodeTestOnlyApi {
+	/**
+	 * Programmatically approves the pending ask for a task by ID. Intended for use in tests only.
+	 */
+	approveTaskAsk(taskId: string): Promise<boolean>
+	/**
+	 * Programmatically denies the pending ask for a task by ID. Intended for use in tests only.
+	 */
+	denyTaskAsk(taskId: string): Promise<boolean>
+	/**
+	 * Simulates selecting a follow-up suggestion for a task by ID, including its optional mode switch.
+	 * Intended for use in tests only.
+	 */
+	selectTaskFollowupSuggestion(options: { taskId: string; answer: string; mode?: string }): Promise<boolean>
+	/**
+	 * GlobalState keys the test-only accessors can address. `taskHistory` is excluded
+	 * because it carries user PII and both runtime methods reject it; credential-bearing
+	 * keys are rejected at runtime as well, which a key union cannot express.
+	 */
+	getGlobalState<K extends TestableGlobalStateKey>(key: K): GlobalState[K]
+	/**
+	 * Writes a value to VS Code globalState. Intended for use in tests only. The
+	 * implementation additionally requires the key to have a global-settings value
+	 * schema and rejects credential-bearing keys and `taskHistory` at runtime.
+	 */
+	setGlobalState<K extends TestableGlobalStateKey>(key: K, value: GlobalState[K]): Promise<void>
+}
+
 export interface RooCodeTestAPI extends RooCodeAPI {
 	captureWebviewThemeFixture(): Promise<WebviewThemeFixture>
 	getLatestAnnouncementId(): string

packages/types/src/global-settings.ts

@@ -114,6 +114,15 @@ export const MAX_CHECKPOINT_TIMEOUT_SECONDS = 60
  */
 export const DEFAULT_CHECKPOINT_TIMEOUT_SECONDS = 15
 
+/**
+ * Persisted non-secret selections for a stable webview instance.
+ */
+export const viewStateSchema = z.object({
+	mode: z.string().optional(),
+	currentApiConfigName: z.string().optional(),
+	updatedAt: z.number().optional(),
+})
+
 /**
  * GlobalSettings
  */
@@ -122,6 +131,7 @@ export const globalSettingsSchema = z.object({
 	currentApiConfigName: z.string().optional(),
 	listApiConfigMeta: z.array(providerSettingsEntrySchema).optional(),
 	pinnedApiConfigs: z.record(z.string(), z.boolean()).optional(),
+	viewStates: z.record(z.string(), viewStateSchema).optional(),
 
 	lastShownAnnouncementId: z.string().optional(),
 	customInstructions: z.string().optional(),
@@ -368,6 +378,8 @@ export const SECRET_STATE_KEYS = [
 	"ioIntelligenceApiKey",
 	"nanoGptApiKey",
 	"basetenApiKey",
+	"mimoApiKey",
+	"poeApiKey",
 ] as const
 
 // Global secrets that are part of GlobalSettings (not ProviderSettings)
@@ -387,6 +399,26 @@ export type SecretState = Pick<ProviderSettings, Extract<ProviderSecretKey, keyo
 export const isSecretStateKey = (key: string): key is Keys<SecretState> =>
 	SECRET_STATE_KEYS.includes(key as ProviderSecretKey) || GLOBAL_SECRET_KEYS.includes(key as GlobalSecretKey)
 
+/**
+ * Credential-bearing provider settings that do not use an *ApiKey name shape:
+ * header maps that can carry Authorization values, session tokens, service
+ * account JSON, and credential-file paths. They must be excluded from every
+ * flattened configuration surface alongside SECRET_STATE_KEYS.
+ */
+export const SENSITIVE_PROVIDER_CONFIG_KEYS = [
+	"openAiHeaders",
+	"vertexKeyFile",
+	"vertexJsonCredentials",
+	"zooSessionToken",
+	"mimoApiKey",
+	"poeApiKey",
+	"qwenCodeOauthPath",
+	"geminiCliOAuthPath",
+] as const
+
+export const isSensitiveProviderConfigKey = (key: string): boolean =>
+	(SENSITIVE_PROVIDER_CONFIG_KEYS as readonly string[]).includes(key)
+
 /**
  * GlobalState
  */

packages/types/src/vscode-extension-host.ts

@@ -669,6 +669,7 @@ export interface WebviewMessage {
 		| "openRulesDirectory"
 		| "themeFixtureProbeResponse"
 	text?: string
+	viewStateId?: string
 	taskId?: string
 	editedMessageContent?: string
 	tab?: "settings" | "history" | "mcp" | "modes" | "chat" | "marketplace" | "cloud"

packages/types/src/vscode.ts

@@ -35,6 +35,14 @@ export const commandIds = [
 	"popoutButtonClicked",
 	"settingsButtonClicked",
 
+	// Editor-tab (popped-out) surface variants of the title-bar buttons. The
+	// shared ids above target the sidebar click origin, so the tab surface
+	// needs its own ids (see registerCommands.ts getTabProvider).
+	"plusButtonClickedInTab",
+	"settingsButtonClickedInTab",
+	"marketplaceButtonClickedInTab",
+	"historyButtonClickedInTab",
+
 	"openInNewTab",
 
 	"newTask",