fix(vscode): give the seeded dev profile its own tree

Both launch profiles pointed at the same user-data, extensions, and home
directories, so a seeded run left its real credentials behind for the isolated
profile to inherit, which defeated the point of the isolated default.

Author: elkaix

apps/vscode/.vscode/launch.json

@@ -18,7 +18,10 @@
       "env": {
         "PYTHINKER_CODE_HOME": "${workspaceFolder}/../../.tmp/vscode-extension-dev/pythinker-home"
       },
-      "outFiles": ["${workspaceFolder}/dist/**/*.js", "${workspaceFolder}/dist/**/*.mjs"],
+      "outFiles": [
+        "${workspaceFolder}/dist/**/*.js",
+        "${workspaceFolder}/dist/**/*.mjs"
+      ],
       "sourceMaps": true,
       "resolveSourceMapLocations": [
         "${workspaceFolder}/**",
@@ -32,17 +35,20 @@
       "preLaunchTask": "vscode: dev (seeded)",
       "args": [
         "--extensionDevelopmentPath=${workspaceFolder}",
-        "--user-data-dir=${workspaceFolder}/../../.tmp/vscode-extension-dev/user-data",
-        "--extensions-dir=${workspaceFolder}/../../.tmp/vscode-extension-dev/extensions",
+        "--user-data-dir=${workspaceFolder}/../../.tmp/seeded/vscode-extension-dev/user-data",
+        "--extensions-dir=${workspaceFolder}/../../.tmp/seeded/vscode-extension-dev/extensions",
         "--disable-workspace-trust",
         "--skip-welcome",
         "--skip-release-notes",
-        "${workspaceFolder}/../../.tmp/vscode-extension-dev/workspace"
+        "${workspaceFolder}/../../.tmp/seeded/vscode-extension-dev/workspace"
       ],
       "env": {
-        "PYTHINKER_CODE_HOME": "${workspaceFolder}/../../.tmp/vscode-extension-dev/pythinker-home"
+        "PYTHINKER_CODE_HOME": "${workspaceFolder}/../../.tmp/seeded/vscode-extension-dev/pythinker-home"
       },
-      "outFiles": ["${workspaceFolder}/dist/**/*.js", "${workspaceFolder}/dist/**/*.mjs"],
+      "outFiles": [
+        "${workspaceFolder}/dist/**/*.js",
+        "${workspaceFolder}/dist/**/*.mjs"
+      ],
       "sourceMaps": true,
       "resolveSourceMapLocations": [
         "${workspaceFolder}/**",

apps/vscode/README.md

@@ -37,10 +37,14 @@ read your real `~/.pythinker-code/config.toml`.
 
 To start the dev extension with your real providers and models, use the
 "(seeded config)" launch profile or `pnpm run dev:prepare:seeded`. It copies your
-real `config.toml` verbatim into the disposable dev home, which duplicates every
+real `config.toml` verbatim into a disposable dev home, which duplicates every
 secret it contains — API keys and any embedded provider auth metadata — into a
 file under `.tmp/` (mode `0600` where supported). Credential stores, session
-data, and `mcp.json` stay in the real home. The isolated default remains unchanged.
+data, and `mcp.json` stay in the real home.
+
+The seeded profile lives in its own tree (`.tmp/seeded/vscode-extension-dev`)
+with its own user-data and extensions directories, so the isolated profile never
+inherits the seeded run's configuration or stored credentials.
 
 Note: the engine watches `config.toml` and reloads itself on change, but the
 extension has no config-change subscription. The model picker and Models section

apps/vscode/package.json

@@ -311,7 +311,7 @@
     "vscode:prepublish": "pnpm run build",
     "dev": "pnpm run dev:prepare && pnpm run \"/^dev:(extension|webview)$/\"",
     "dev:prepare": "node scripts/prepare-dev.mjs",
-    "dev:prepare:seeded": "node scripts/prepare-dev.mjs --seed-config",
+    "dev:prepare:seeded": "node scripts/prepare-dev.mjs --seed-config --base-dir ../../.tmp/seeded/vscode-extension-dev",
     "dev:extension": "node scripts/watch-extension.mjs",
     "dev:webview": "vite build --config webview-ui/vite.config.ts --watch --sourcemap",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p webview-ui/tsconfig.json --noEmit",