feat(webview): setValues batch persistence and reset cleanup (N4, split 4/5 of #1546)

packages/types/src/__tests__/global-settings.test.ts

@@ -39,6 +39,49 @@ describe("alwaysDenyUnapprovedCommands global setting", () => {
 	})
 })
 
+describe("viewStates global setting", () => {
+	it("parses a valid per-view record", () => {
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", currentApiConfigName: "profile-a", updatedAt: 1730000000000 },
+				"stable-view-2": {},
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]).toEqual({
+			mode: "code",
+			currentApiConfigName: "profile-a",
+			updatedAt: 1730000000000,
+		})
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({})
+		expect(GLOBAL_SETTINGS_KEYS).toContain("viewStates")
+	})
+
+	it("parses an entry that carries the host-minted claim token", () => {
+		// The claim binds the entry to the webview that wrote it; a legacy entry without one
+		// still parses, because refusing it is setViewStateId's job, not the schema's.
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", updatedAt: 1730000000000, claimToken: "7f9c-host-minted" },
+				"stable-view-2": { mode: "code" },
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]?.claimToken).toBe("7f9c-host-minted")
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({ mode: "code" })
+	})
+
+	it("rejects invalid field values inside a view entry", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { mode: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { currentApiConfigName: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { updatedAt: "soon" } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { claimToken: 42 } } })).toThrow()
+	})
+
+	it("rejects non-object viewStates values", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: "not-a-record" })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: "not-an-entry" } })).toThrow()
+	})
+})
+
 describe("collapseCommandOutputByDefault global setting", () => {
 	it.each([true, false, undefined])("round-trips %s through the export/import schema", (value) => {
 		const settings = globalSettingsSchema.parse({ collapseCommandOutputByDefault: value })

packages/types/src/__tests__/index.test.ts

@@ -3,6 +3,10 @@
 import { GLOBAL_STATE_KEYS } from "../index.js"
 
 describe("GLOBAL_STATE_KEYS", () => {
+	it("should contain registered durable per-view state", () => {
+		expect(GLOBAL_STATE_KEYS).toContain("viewStates")
+	})
+
 	it("should contain provider settings keys", () => {
 		expect(GLOBAL_STATE_KEYS).toContain("autoApprovalEnabled")
 	})
@@ -13,6 +17,7 @@ describe("GLOBAL_STATE_KEYS", () => {
 
 	it("should not contain secret state keys", () => {
 		expect(GLOBAL_STATE_KEYS).not.toContain("openRouterApiKey")
+		expect(GLOBAL_STATE_KEYS).not.toContain("apiKey")
 	})
 
 	it("should contain OpenAI Compatible base URL setting", () => {

packages/types/src/global-settings.ts

@@ -114,6 +114,17 @@ export const MAX_CHECKPOINT_TIMEOUT_SECONDS = 60
  */
 export const DEFAULT_CHECKPOINT_TIMEOUT_SECONDS = 15
 
+/**
+ * Persisted non-secret selections for a stable webview instance.
+ */
+export const viewStateSchema = z.object({
+	mode: z.string().optional(),
+	currentApiConfigName: z.string().optional(),
+	updatedAt: z.number().optional(),
+	/** Host-minted token binding this entry to the webview that wrote it. */
+	claimToken: z.string().optional(),
+})
+
 /**
  * GlobalSettings
  */
@@ -122,6 +133,7 @@ export const globalSettingsSchema = z.object({
 	currentApiConfigName: z.string().optional(),
 	listApiConfigMeta: z.array(providerSettingsEntrySchema).optional(),
 	pinnedApiConfigs: z.record(z.string(), z.boolean()).optional(),
+	viewStates: z.record(z.string(), viewStateSchema).optional(),
 
 	lastShownAnnouncementId: z.string().optional(),
 	customInstructions: z.string().optional(),

packages/types/src/vscode-extension-host.ts

@@ -113,7 +113,14 @@ export interface ExtensionMessage {
 		| "rooHistoryImportProgress"
 		| "themeFixtureProbeRequest"
 		| "diagnosticsRequest"
+		| "viewStateClaim"
 	text?: string
+	/**
+	 * For `viewStateClaim`: the durable `viewStates` key the delivered claim governs.
+	 */
+	viewStateId?: string
+	/** For `viewStateClaim`: the host-minted token the webview stores and echoes on launch. */
+	viewStateClaim?: string
 	/** For fileContent: { path, content, error? } */
 	fileContent?: { path: string; content: string | null; error?: string }
 	/** For originalContent: the pre-edit file content of the requested tool message (null when unavailable) */

src/core/config/ContextProxy.ts

@@ -63,18 +63,35 @@ const withinReadBackDeadline = <T>(read: PromiseLike<T>, key: string): Promise<T
 
 export const isPassThroughStateKey = (key: string) => PASS_THROUGH_STATE_KEYS.includes(key)
 
+// A parsed payload can carry these as own keys. Writing one through a computed assignment
+// re-points the target object's prototype instead of storing a setting, so they are never
+// accepted as state keys.
+const UNSAFE_STATE_KEYS = ["__proto__", "constructor", "prototype"]
+
+export const isUnsafeStateKey = (key: string) => UNSAFE_STATE_KEYS.includes(key)
+
 const globalSettingsExportSchema = globalSettingsSchema.omit({
 	taskHistory: true,
 	listApiConfigMeta: true,
 	currentApiConfigName: true,
+	// Per-view selection state is machine-local: it keeps flowing through the
+	// normal runtime and pruning paths but must not transfer between settings.
+	viewStates: true,
 })
 
 export class ContextProxy {
 	private readonly originalContext: vscode.ExtensionContext
 
 	private stateCache: GlobalState
+	private stateWriteGenerations = new Map<GlobalStateKey, number>()
 	private secretCache: SecretState
 	private _isInitialized = false
+	// Raised for the whole duration of a reset and cleared in a finally, so a reset that fails
+	// mid-way cannot leave the store refusing every later secret write; see resetAllState.
+	private resetting = false
+	// A reset that is already running. Overlapping callers join it instead of starting a second
+	// delete pass whose end could lower the guard while the first one is still writing.
+	private resetInFlight: Promise<void> | null = null
 
 	constructor(context: vscode.ExtensionContext) {
 		this.originalContext = context
@@ -401,6 +418,10 @@ export class ContextProxy {
 	private readonly secretWriteCount = new Map<string, number>()
 
 	updateGlobalState<K extends GlobalStateKey>(key: K, value: GlobalState[K]) {
+		if (isUnsafeStateKey(key)) {
+			return Promise.resolve()
+		}
+
 		if (isPassThroughStateKey(key)) {
 			return this.originalContext.globalState.update(key, value)
 		}
@@ -413,6 +434,8 @@ export class ContextProxy {
 		// writes that are in flight. An update that throws at once is turned into a rejection, so it is handled the same.
 		const owner = {}
 		this.stateWriteOwner.set(key, owner)
+		const generation = (this.stateWriteGenerations.get(key) ?? 0) + 1
+		this.stateWriteGenerations.set(key, generation)
 		this.stateCache[key] = value
 		const release = () => {
 			if (this.stateWriteOwner.get(key) === owner) this.stateWriteOwner.delete(key)
@@ -429,6 +452,32 @@ export class ContextProxy {
 		})
 	}
 
+	/**
+	 * The write generation the next `setValue`/`setValues` of this key will produce, or
+	 * `undefined` when the key's write path records no generation at all - a secret, or a
+	 * pass-through key that bypasses the state cache. Capture it before awaiting the write.
+	 */
+	public beginStateWriteGeneration<K extends RooCodeSettingsKey>(key: K): number | undefined {
+		if (!this.recordsWriteGeneration(key)) {
+			return undefined
+		}
+
+		return (this.stateWriteGenerations.get(key as GlobalStateKey) ?? 0) + 1
+	}
+
+	/**
+	 * Current write generation for a key, or `undefined` when its write path records none. A
+	 * caller that may have to undo its own write compares it against the value captured from
+	 * `beginStateWriteGeneration`: a newer write for the same key has already advanced it.
+	 */
+	public getStateWriteGeneration<K extends RooCodeSettingsKey>(key: K): number | undefined {
+		return this.recordsWriteGeneration(key) ? this.stateWriteGenerations.get(key as GlobalStateKey) : undefined
+	}
+
+	private recordsWriteGeneration<K extends RooCodeSettingsKey>(key: K): boolean {
+		return !isSecretStateKey(key) && !isPassThroughStateKey(key)
+	}
+
 	private getAllGlobalState(): GlobalState {
 		return Object.fromEntries(GLOBAL_STATE_KEYS.map((key) => [key, this.getGlobalState(key)]))
 	}
@@ -443,6 +492,13 @@ export class ContextProxy {
 	}
 
 	storeSecret(key: SecretStateKey, value?: string) {
+		// Refused rather than deferred: a deferred secret write would re-store exactly the value the
+		// user asked to erase, and a silently dropped one would lose the save.
+		if (this.resetting) {
+			return Promise.reject(
+				new SettingsWriteError([], [key], new Error("secret writes are refused while state is being reset")),
+			)
+		}
 		// Update cache.
 		const owner = {}
 		this.secretWriteOwner.set(key, owner)
@@ -715,18 +771,46 @@ export class ContextProxy {
 	 * This clears all data from both the in-memory caches and the VSCode storage.
 	 * @returns A promise that resolves when all reset operations are complete
 	 */
-	public async resetAllState() {
-		// Clear in-memory caches
-		this.stateCache = {}
-		this.secretCache = {}
+	public resetAllState(): Promise<void> {
+		// Two resets can overlap (a second webview, or the same command twice). A boolean guard lets the
+		// first pass to finish lower it while the second is still deleting, and a secret stored in that
+		// gap is erased by the pass that is still running - so overlapping callers join the running pass.
+		if (this.resetInFlight) {
+			return this.resetInFlight
+		}
 
-		await Promise.all([
-			...GLOBAL_STATE_KEYS.map((key) => this.originalContext.globalState.update(key, undefined)),
-			...SECRET_STATE_KEYS.map((key) => this.originalContext.secrets.delete(key)),
-			...GLOBAL_SECRET_KEYS.map((key) => this.originalContext.secrets.delete(key)),
-		])
+		this.resetting = true
+		const pass = (async () => {
+			try {
+				this.stateCache = {}
+				this.secretCache = {}
+				// A write that started before this reset must not restore its pre-reset value when it
+				// rejects afterwards, so advance every generation the pending writes still hold.
+				for (const key of this.stateWriteGenerations.keys()) {
+					this.stateWriteGenerations.set(key, (this.stateWriteGenerations.get(key) ?? 0) + 1)
+				}
 
-		await this.initialize()
+				// Promise.all rejects on the first failure while the other updates and deletes are still
+				// pending, and the finally below would then admit a storeSecret that a still-running
+				// delete erases. Settle every delete first, then surface the first failure.
+				const deletions = await Promise.allSettled([
+					...GLOBAL_STATE_KEYS.map((key) => this.originalContext.globalState.update(key, undefined)),
+					...SECRET_STATE_KEYS.map((key) => this.originalContext.secrets.delete(key)),
+					...GLOBAL_SECRET_KEYS.map((key) => this.originalContext.secrets.delete(key)),
+				])
+				const deletionFailure = deletions.find((result) => result.status === "rejected")
+				if (deletionFailure) {
+					throw deletionFailure.reason
+				}
+
+				await this.initialize()
+			} finally {
+				this.resetting = false
+				this.resetInFlight = null
+			}
+		})()
+		this.resetInFlight = pass
+		return pass
 	}
 
 	private static _instance: ContextProxy | null = null

src/core/config/CustomModesManager.ts

@@ -353,6 +353,28 @@ export class CustomModesManager {
 		}
 	}
 
+	/**
+	 * Every definition of a mode, per source file, without the project-over-global hiding that
+	 * `getCustomModes` applies. A rollback has to restore both: a batch that overwrites a global
+	 * definition through a slug that also exists as a project mode would otherwise leave the global
+	 * copy permanently replaced by the batch's version.
+	 */
+	public async getCustomModeDefinitions(slugs: readonly string[]): Promise<ModeConfig[]> {
+		const wanted = new Set(slugs)
+		const settingsPath = await this.getCustomModesFilePath()
+		const settingsModes = await this.loadModesFromFile(settingsPath)
+		const roomodesPath = await this.getWorkspaceRoomodes()
+		const roomodesModes = roomodesPath ? await this.loadModesFromFile(roomodesPath) : []
+
+		return [
+			...roomodesModes
+				.filter((mode) => wanted.has(mode.slug))
+				.map((mode) => ({ ...mode, source: "project" as const })),
+			...settingsModes
+				.filter((mode) => wanted.has(mode.slug))
+				.map((mode) => ({ ...mode, source: "global" as const })),
+		]
+	}
 	public async getCustomModes(): Promise<ModeConfig[]> {
 		// Check if we have a valid cached result.
 		const now = Date.now()
@@ -553,6 +575,44 @@ export class CustomModesManager {
 		}
 	}
 
+	/**
+	 * Removes a mode's entry from the mode files and refreshes the merged state, without
+	 * touching its rules folder. Rollback paths need this variant: `deleteCustomMode` also
+	 * deletes `.roo/rules-<slug>` (or `~/.roo/rules-<slug>`), and a rollback cannot know
+	 * whether that folder predates the batch whose registration it is undoing - deleting it
+	 * would discard rules the user wrote earlier.
+	 *
+	 * Returns whether an entry was actually removed so a caller can report a miss instead of
+	 * assuming cleanup happened. Errors propagate; rollback callers decide how loud to be.
+	 */
+	public async removeCustomModeEntry(slug: string): Promise<boolean> {
+		const settingsPath = await this.getCustomModesFilePath()
+		const roomodesPath = await this.getWorkspaceRoomodes()
+		const projectModes = roomodesPath ? await this.loadModesFromFile(roomodesPath) : []
+		const settingsModes = await this.loadModesFromFile(settingsPath)
+		const inProjectFile = projectModes.some((mode) => mode.slug === slug)
+		const inSettingsFile = settingsModes.some((mode) => mode.slug === slug)
+
+		if (!inProjectFile && !inSettingsFile) {
+			return false
+		}
+
+		await this.queueWrite(async () => {
+			if (roomodesPath && inProjectFile) {
+				await this.updateModesInFile(roomodesPath, (modes) => modes.filter((m) => m.slug !== slug))
+			}
+
+			if (inSettingsFile) {
+				await this.updateModesInFile(settingsPath, (modes) => modes.filter((m) => m.slug !== slug))
+			}
+
+			this.clearCache()
+			await this.refreshMergedState()
+		})
+
+		return true
+	}
+
 	/**
 	 * Deletes the rules folder for a specific mode
 	 * @param slug - The mode slug

src/core/config/ProviderSettingsManager.ts

@@ -55,6 +55,14 @@ export const providerProfilesSchema = z.object({
 
 export type ProviderProfiles = z.infer<typeof providerProfilesSchema>
 
+/** Already-deleted profile: callers branch on this type instead of matching message text. */
+export class ProviderSettingsNotFoundError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "ProviderSettingsNotFoundError"
+	}
+}
+
 export class ProviderSettingsManager {
 	private static readonly SCOPE_PREFIX = "roo_cline_config_"
 	private readonly defaultConfigId = this.generateId()
@@ -511,7 +519,7 @@ export class ProviderSettingsManager {
 				const providerProfiles = await this.load()
 
 				if (!providerProfiles.apiConfigs[name]) {
-					throw new Error(`Config '${name}' not found`)
+					throw new ProviderSettingsNotFoundError(`Config '${name}' not found`)
 				}
 
 				if (Object.keys(providerProfiles.apiConfigs).length === 1) {
@@ -522,6 +530,11 @@ export class ProviderSettingsManager {
 				await this.store(providerProfiles)
 			})
 		} catch (error) {
+			// A missing config is a caller-meaningful signal, not a failure: rethrow it
+			// unwrapped so callers can branch on the type instead of message text.
+			if (error instanceof ProviderSettingsNotFoundError) {
+				throw error
+			}
 			throw new Error(`Failed to delete config: ${error}`)
 		}
 	}