fix potential credential seeding race (#4148)

* Fix: serialize upsertApiConfiguration during webview flush to persist provider settings

* fixup types

* Add changeset

Author: pandemicsyn

.changeset/fuzzy-singers-prove.md

@@ -0,0 +1,5 @@
+---
+"@kilocode/cli": minor
+---
+
+fix potential credential seeding race

cli/src/host/ExtensionHost.ts

@@ -1016,20 +1016,28 @@ export class ExtensionHost extends EventEmitter {
 		this.webviewInitialized = true
 		this.isInitialSetup = false
 		logs.info("Webview marked as ready, flushing pending messages", "ExtensionHost")
-		this.flushPendingMessages()
+		void this.flushPendingMessages()
 	}
 
 	/**
 	 * Flush all pending messages that were queued before webview was ready
 	 */
-	private flushPendingMessages(): void {
-		const messages = [...this.pendingMessages]
+	private async flushPendingMessages(): Promise<void> {
+		const upsertMessages = this.pendingMessages.filter((m) => m.type === "upsertApiConfiguration")
+		const otherMessages = this.pendingMessages.filter((m) => m.type !== "upsertApiConfiguration")
 		this.pendingMessages = []
 
-		logs.info(`Flushing ${messages.length} pending messages`, "ExtensionHost")
-		for (const message of messages) {
+		logs.info(`Flushing ${upsertMessages.length + otherMessages.length} pending messages`, "ExtensionHost")
+
+		// Ensure the API configuration is applied before anything tries to read it
+		for (const message of upsertMessages) {
+			logs.debug(`Flushing pending message: ${message.type}`, "ExtensionHost")
+			// Serialize upserts so provider settings are persisted before readers run
+			await this.sendWebviewMessage(message)
+		}
+
+		for (const message of otherMessages) {
 			logs.debug(`Flushing pending message: ${message.type}`, "ExtensionHost")
-			// Use void to explicitly ignore the promise
 			void this.sendWebviewMessage(message)
 		}
 	}