feat(webview): durable per-view viewStates pipeline (N2, split 2/3 of #1546)

packages/types/src/__tests__/global-settings.test.ts

@@ -39,6 +39,49 @@ describe("alwaysDenyUnapprovedCommands global setting", () => {
 	})
 })
 
+describe("viewStates global setting", () => {
+	it("parses a valid per-view record", () => {
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", currentApiConfigName: "profile-a", updatedAt: 1730000000000 },
+				"stable-view-2": {},
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]).toEqual({
+			mode: "code",
+			currentApiConfigName: "profile-a",
+			updatedAt: 1730000000000,
+		})
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({})
+		expect(GLOBAL_SETTINGS_KEYS).toContain("viewStates")
+	})
+
+	it("parses an entry that carries the host-minted claim token", () => {
+		// The claim binds the entry to the webview that wrote it; a legacy entry without one
+		// still parses, because refusing it is setViewStateId's job, not the schema's.
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", updatedAt: 1730000000000, claimToken: "7f9c-host-minted" },
+				"stable-view-2": { mode: "code" },
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]?.claimToken).toBe("7f9c-host-minted")
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({ mode: "code" })
+	})
+
+	it("rejects invalid field values inside a view entry", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { mode: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { currentApiConfigName: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { updatedAt: "soon" } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { claimToken: 42 } } })).toThrow()
+	})
+
+	it("rejects non-object viewStates values", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: "not-a-record" })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: "not-an-entry" } })).toThrow()
+	})
+})
+
 describe("collapseCommandOutputByDefault global setting", () => {
 	it.each([true, false, undefined])("round-trips %s through the export/import schema", (value) => {
 		const settings = globalSettingsSchema.parse({ collapseCommandOutputByDefault: value })

packages/types/src/__tests__/index.test.ts

@@ -3,6 +3,10 @@
 import { GLOBAL_STATE_KEYS } from "../index.js"
 
 describe("GLOBAL_STATE_KEYS", () => {
+	it("should contain registered durable per-view state", () => {
+		expect(GLOBAL_STATE_KEYS).toContain("viewStates")
+	})
+
 	it("should contain provider settings keys", () => {
 		expect(GLOBAL_STATE_KEYS).toContain("autoApprovalEnabled")
 	})
@@ -13,6 +17,7 @@ describe("GLOBAL_STATE_KEYS", () => {
 
 	it("should not contain secret state keys", () => {
 		expect(GLOBAL_STATE_KEYS).not.toContain("openRouterApiKey")
+		expect(GLOBAL_STATE_KEYS).not.toContain("apiKey")
 	})
 
 	it("should contain OpenAI Compatible base URL setting", () => {

packages/types/src/global-settings.ts

@@ -114,6 +114,17 @@ export const MAX_CHECKPOINT_TIMEOUT_SECONDS = 60
  */
 export const DEFAULT_CHECKPOINT_TIMEOUT_SECONDS = 15
 
+/**
+ * Persisted non-secret selections for a stable webview instance.
+ */
+export const viewStateSchema = z.object({
+	mode: z.string().optional(),
+	currentApiConfigName: z.string().optional(),
+	updatedAt: z.number().optional(),
+	/** Host-minted token binding this entry to the webview that wrote it. */
+	claimToken: z.string().optional(),
+})
+
 /**
  * GlobalSettings
  */
@@ -122,6 +133,7 @@ export const globalSettingsSchema = z.object({
 	currentApiConfigName: z.string().optional(),
 	listApiConfigMeta: z.array(providerSettingsEntrySchema).optional(),
 	pinnedApiConfigs: z.record(z.string(), z.boolean()).optional(),
+	viewStates: z.record(z.string(), viewStateSchema).optional(),
 
 	lastShownAnnouncementId: z.string().optional(),
 	customInstructions: z.string().optional(),

packages/types/src/vscode-extension-host.ts

@@ -111,6 +111,7 @@ export interface ExtensionMessage {
 		| "originalContent"
 		| "rooHistoryImportProgress"
 		| "themeFixtureProbeRequest"
+		| "viewStateClaim"
 	text?: string
 	/** For fileContent: { path, content, error? } */
 	fileContent?: { path: string; content: string | null; error?: string }
@@ -169,6 +170,13 @@ export interface ExtensionMessage {
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	values?: Record<string, any>
 	requestId?: string
+	/**
+	 * For `viewStateClaim`: the durable `viewStates` key the delivered claim governs. The
+	 * message is only ever sent to the webview that key belongs to.
+	 */
+	viewStateId?: string
+	/** For `viewStateClaim`: the host-minted token the webview stores and echoes on launch. */
+	viewStateClaim?: string
 	themeFixture?: WebviewThemeFixture
 	promptText?: string
 	results?:
@@ -670,6 +678,9 @@ export interface WebviewMessage {
 		| "openRulesDirectory"
 		| "themeFixtureProbeResponse"
 	text?: string
+	viewStateId?: string
+	/** For `webviewDidLaunch`: the claim delivered for `viewStateId`, enforced by setViewStateId. */
+	viewStateClaim?: string
 	taskId?: string
 	editedMessageContent?: string
 	tab?: "settings" | "history" | "mcp" | "modes" | "chat" | "marketplace" | "cloud"

src/core/config/ContextProxy.ts

@@ -36,12 +36,16 @@
 	taskHistory: true,
 	listApiConfigMeta: true,
 	currentApiConfigName: true,
+	// Per-view selection state is machine-local: it keeps flowing through the
+	// normal runtime and pruning paths but must not transfer between settings.
+	viewStates: true,
 })
 
 export class ContextProxy {
 	private readonly originalContext: vscode.ExtensionContext
 
 	private stateCache: GlobalState
+	private stateWriteGenerations = new Map<GlobalStateKey, number>()
 	private secretCache: SecretState
 	private _isInitialized = false
 
@@ -360,13 +364,25 @@
 		return value !== undefined ? value : defaultValue
 	}
 
-	updateGlobalState<K extends GlobalStateKey>(key: K, value: GlobalState[K]) {
+	async updateGlobalState<K extends GlobalStateKey>(key: K, value: GlobalState[K]) {
 		if (isPassThroughStateKey(key)) {
 			return this.originalContext.globalState.update(key, value)
 		}
 
+		const previousCachedValue = this.stateCache[key]
+		const generation = (this.stateWriteGenerations.get(key) ?? 0) + 1
+		this.stateWriteGenerations.set(key, generation)
 		this.stateCache[key] = value
-		return this.originalContext.globalState.update(key, value)
+
+		try {
+			return await this.originalContext.globalState.update(key, value)
+		} catch (error) {
+			// Only undo this write while it is still the newest for the key.
+			if (this.stateWriteGenerations.get(key) === generation) {
+				this.stateCache[key] = previousCachedValue
+			}
+			throw error
+		}
 	}
 
 	private getAllGlobalState(): GlobalState {
@@ -590,6 +606,10 @@
 		// Clear in-memory caches
 		this.stateCache = {}
 		this.secretCache = {}
+		// Advance every tracked generation so a pending write cannot restore pre-reset state.
+		for (const key of this.stateWriteGenerations.keys()) {
+			this.stateWriteGenerations.set(key, (this.stateWriteGenerations.get(key) ?? 0) + 1)
+		}
 
 		await Promise.all([
 			...GLOBAL_STATE_KEYS.map((key) => this.originalContext.globalState.update(key, undefined)),

src/core/config/ProviderSettingsManager.ts

@@ -55,6 +55,14 @@
 
 export type ProviderProfiles = z.infer<typeof providerProfilesSchema>
 
+/** Already-deleted profile: callers branch on this type instead of matching message text. */
+export class ProviderSettingsNotFoundError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "ProviderSettingsNotFoundError"
+	}
+}
+
 export class ProviderSettingsManager {
 	private static readonly SCOPE_PREFIX = "roo_cline_config_"
 	private readonly defaultConfigId = this.generateId()
@@ -511,7 +519,7 @@
 				const providerProfiles = await this.load()
 
 				if (!providerProfiles.apiConfigs[name]) {
-					throw new Error(`Config '${name}' not found`)
+					throw new ProviderSettingsNotFoundError(`Config '${name}' not found`)
 				}
 
 				if (Object.keys(providerProfiles.apiConfigs).length === 1) {
@@ -522,6 +530,11 @@
 				await this.store(providerProfiles)
 			})
 		} catch (error) {
+			// A missing config is a caller-meaningful signal, not a failure: rethrow it
+			// unwrapped so callers can branch on the type instead of message text.
+			if (error instanceof ProviderSettingsNotFoundError) {
+				throw error
+			}
 			throw new Error(`Failed to delete config: ${error}`)
 		}
 	}

src/core/config/__tests__/ContextProxy.spec.ts

@@ -120,6 +120,39 @@ describe("ContextProxy", () => {
 			expect(result).toBe("deepseek")
 		})
 
+		it("should not let an older rejected write clobber a newer cached value", async () => {
+			let rejectFirst: (error: Error) => void = () => {}
+			const firstWriteResult = new Promise<void>((_, reject) => {
+				rejectFirst = reject
+			})
+
+			mockGlobalState.update.mockReset()
+			mockGlobalState.update.mockReturnValueOnce(firstWriteResult)
+			mockGlobalState.update.mockResolvedValueOnce(undefined)
+
+			const firstWrite = proxy.updateGlobalState("apiProvider", "anthropic")
+			await proxy.updateGlobalState("apiProvider", "openai")
+			rejectFirst(new Error("disk full"))
+			await expect(firstWrite).rejects.toThrow("disk full")
+
+			expect(proxy.getGlobalState("apiProvider")).toBe("openai")
+		})
+
+		it("should not restore a pre-reset value when a pending write rejects after reset", async () => {
+			let rejectPending: (error: Error) => void = () => {}
+			mockGlobalState.update.mockReset()
+			mockGlobalState.update.mockReturnValueOnce(
+				new Promise<void>((_, reject) => {
+					rejectPending = reject
+				}),
+			)
+			const pending = proxy.updateGlobalState("apiProvider", "anthropic")
+			await proxy.resetAllState()
+			rejectPending(new Error("disk full"))
+			await expect(pending).rejects.toThrow("disk full")
+			expect(proxy.getGlobalState("apiProvider")).toBeUndefined()
+		})
+
 		it("should bypass cache for pass-through state keys", async () => {
 			// Setup mock return value
 			mockGlobalState.get.mockReturnValue("pass-through-value")
@@ -740,4 +773,20 @@ Output only the summary of the conversation so far, without any additional comme
 			expect(customSupportPromptsUpdateCalls.length).toBe(0)
 		})
 	})
+
+	describe("export", () => {
+		it("should exclude viewStates from the exported settings", async () => {
+			await proxy.setValue("viewStates", {
+				"stable-sidebar-view": { mode: "architect", currentApiConfigName: "profile-a", updatedAt: 1 },
+			})
+			await proxy.setValue("customInstructions", "global instructions")
+
+			const exported = await proxy.export()
+
+			// Per-view selection state is machine-local and must never transfer
+			// between settings, while ordinary global settings keep round-tripping.
+			expect(exported).not.toHaveProperty("viewStates")
+			expect(exported?.customInstructions).toBe("global instructions")
+		})
+	})
 })

src/core/config/__tests__/ProviderSettingsManager.spec.ts

@@ -12,7 +12,7 @@ import {
 import { clearAllMocks } from "../../../test-utils/reset"
 import { makeExtensionContext } from "../../../test-utils/vscode"
 
-import { ProviderSettingsManager, ProviderProfiles } from "../ProviderSettingsManager"
+import { ProviderSettingsManager, ProviderSettingsNotFoundError, ProviderProfiles } from "../ProviderSettingsManager"
 
 // `export()` builds an API handler per profile to read model capabilities. Mock
 // buildApiHandler with the real @roo-code/types model definitions so the token-field
@@ -973,11 +973,27 @@ describe("ProviderSettingsManager", () => {
 				}),
 			)
 
+			// The typed not-found signal is the contract callers branch on: a profile
+			// name containing "not found" must not be matchable via message text.
+			await expect(providerSettingsManager.deleteConfig("nonexistent")).rejects.toBeInstanceOf(
+				ProviderSettingsNotFoundError,
+			)
 			await expect(providerSettingsManager.deleteConfig("nonexistent")).rejects.toThrow(
 				"Config 'nonexistent' not found",
 			)
 		})
 
+		it('keeps a storage failure whose message mentions "not found" out of the typed not-found signal', async () => {
+			mockSecrets.get.mockRejectedValue(new Error("vault: secret not found"))
+
+			// A message-based classifier would treat this as a missing profile. The typed
+			// signal must stay reserved for a missing config entry.
+			await expect(providerSettingsManager.deleteConfig("default")).rejects.not.toBeInstanceOf(
+				ProviderSettingsNotFoundError,
+			)
+			await expect(providerSettingsManager.deleteConfig("default")).rejects.toThrow("Failed to delete config")
+		})
+
 		it("should throw error when trying to delete last remaining config", async () => {
 			mockSecrets.get.mockResolvedValue(
 				JSON.stringify({

src/core/config/__tests__/importExport.spec.ts

@@ -331,6 +331,50 @@ describe("importExport", () => {
 			])
 		})
 
+		it("should not apply imported viewStates to the context proxy", async () => {
+			const fileContent = JSON.stringify({
+				providerProfiles: {
+					currentApiConfigName: "test",
+					apiConfigs: {
+						test: { apiProvider: providerIdentifiers.openai, apiKey: "test-key", id: "test-id" },
+					},
+				},
+				globalSettings: {
+					mode: "code",
+					viewStates: {
+						"stable-sidebar-view": {
+							mode: "architect",
+							currentApiConfigName: "profile-a",
+							updatedAt: 1,
+						},
+					},
+				},
+			})
+
+			;(fs.readFile as Mock).mockResolvedValue(fileContent)
+
+			mockProviderSettingsManager.export.mockResolvedValue({
+				currentApiConfigName: "default",
+				apiConfigs: { default: { apiProvider: providerIdentifiers.anthropic, id: "default-id" } },
+			})
+
+			mockProviderSettingsManager.listConfig.mockResolvedValue([
+				{ name: "test", id: "test-id", apiProvider: providerIdentifiers.openai },
+				{ name: "default", id: "default-id", apiProvider: providerIdentifiers.anthropic },
+			])
+
+			const result = await importSettingsFromPath("/mock/path/settings.json", {
+				providerSettingsManager: mockProviderSettingsManager,
+				contextProxy: mockContextProxy,
+				customModesManager: mockCustomModesManager,
+			})
+
+			expect(result.success).toBe(true)
+			// Importing must not apply another machine's view pins.
+			expect(mockContextProxy.setValues).toHaveBeenCalledWith({ mode: "code" })
+			expect(result).not.toHaveProperty("globalSettings.viewStates")
+		})
+
 		it("should return success: false when file content is invalid", async () => {
 			;(vscode.window.showOpenDialog as Mock).mockResolvedValue([{ fsPath: "/mock/path/settings.json" }])
 

src/core/config/importExport.ts

@@ -98,6 +98,12 @@ function sanitizeGlobalSettings(rawGlobalSettings: unknown): {
 
 	for (const [key, rawValue] of Object.entries(rawGlobalSettings)) {
 		const path = `globalSettings.${key}`
+
+		// Per-view selections are machine-local: they must not import across machines.
+		if (key === "viewStates") {
+			continue
+		}
+
 		const schema = globalSettingsShape[key as keyof GlobalSettings]
 
 		if (!schema) {