feat(webview): durable per-view viewStates pipeline (N2, split 2/3 of #1546)

packages/types/src/__tests__/global-settings.test.ts

@@ -39,6 +39,49 @@ describe("alwaysDenyUnapprovedCommands global setting", () => {
 	})
 })
 
+describe("viewStates global setting", () => {
+	it("parses a valid per-view record", () => {
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", currentApiConfigName: "profile-a", updatedAt: 1730000000000 },
+				"stable-view-2": {},
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]).toEqual({
+			mode: "code",
+			currentApiConfigName: "profile-a",
+			updatedAt: 1730000000000,
+		})
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({})
+		expect(GLOBAL_SETTINGS_KEYS).toContain("viewStates")
+	})
+
+	it("parses an entry that carries the host-minted claim token", () => {
+		// The claim binds the entry to the webview that wrote it; a legacy entry without one
+		// still parses, because refusing it is setViewStateId's job, not the schema's.
+		const parsed = globalSettingsSchema.parse({
+			viewStates: {
+				"stable-view-1": { mode: "code", updatedAt: 1730000000000, claimToken: "7f9c-host-minted" },
+				"stable-view-2": { mode: "code" },
+			},
+		})
+		expect(parsed.viewStates?.["stable-view-1"]?.claimToken).toBe("7f9c-host-minted")
+		expect(parsed.viewStates?.["stable-view-2"]).toEqual({ mode: "code" })
+	})
+
+	it("rejects invalid field values inside a view entry", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { mode: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { currentApiConfigName: 42 } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { updatedAt: "soon" } } })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: { claimToken: 42 } } })).toThrow()
+	})
+
+	it("rejects non-object viewStates values", () => {
+		expect(() => globalSettingsSchema.parse({ viewStates: "not-a-record" })).toThrow()
+		expect(() => globalSettingsSchema.parse({ viewStates: { v: "not-an-entry" } })).toThrow()
+	})
+})
+
 describe("collapseCommandOutputByDefault global setting", () => {
 	it.each([true, false, undefined])("round-trips %s through the export/import schema", (value) => {
 		const settings = globalSettingsSchema.parse({ collapseCommandOutputByDefault: value })

packages/types/src/__tests__/index.test.ts

@@ -3,6 +3,10 @@
 import { GLOBAL_STATE_KEYS } from "../index.js"
 
 describe("GLOBAL_STATE_KEYS", () => {
+	it("should contain registered durable per-view state", () => {
+		expect(GLOBAL_STATE_KEYS).toContain("viewStates")
+	})
+
 	it("should contain provider settings keys", () => {
 		expect(GLOBAL_STATE_KEYS).toContain("autoApprovalEnabled")
 	})
@@ -13,6 +17,7 @@ describe("GLOBAL_STATE_KEYS", () => {
 
 	it("should not contain secret state keys", () => {
 		expect(GLOBAL_STATE_KEYS).not.toContain("openRouterApiKey")
+		expect(GLOBAL_STATE_KEYS).not.toContain("apiKey")
 	})
 
 	it("should contain OpenAI Compatible base URL setting", () => {

packages/types/src/global-settings.ts

@@ -114,6 +114,17 @@ export const MAX_CHECKPOINT_TIMEOUT_SECONDS = 60
  */
 export const DEFAULT_CHECKPOINT_TIMEOUT_SECONDS = 15
 
+/**
+ * Persisted non-secret selections for a stable webview instance.
+ */
+export const viewStateSchema = z.object({
+	mode: z.string().optional(),
+	currentApiConfigName: z.string().optional(),
+	updatedAt: z.number().optional(),
+	/** Host-minted token binding this entry to the webview that wrote it. */
+	claimToken: z.string().optional(),
+})
+
 /**
  * GlobalSettings
  */
@@ -122,6 +133,7 @@ export const globalSettingsSchema = z.object({
 	currentApiConfigName: z.string().optional(),
 	listApiConfigMeta: z.array(providerSettingsEntrySchema).optional(),
 	pinnedApiConfigs: z.record(z.string(), z.boolean()).optional(),
+	viewStates: z.record(z.string(), viewStateSchema).optional(),
 
 	lastShownAnnouncementId: z.string().optional(),
 	customInstructions: z.string().optional(),

packages/types/src/vscode-extension-host.ts

@@ -112,6 +112,7 @@ export interface ExtensionMessage {
 		| "originalContent"
 		| "rooHistoryImportProgress"
 		| "themeFixtureProbeRequest"
+		| "viewStateClaim"
 		| "diagnosticsRequest"
 	text?: string
 	/** For fileContent: { path, content, error? } */
@@ -171,6 +172,13 @@ export interface ExtensionMessage {
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	values?: Record<string, any>
 	requestId?: string
+	/**
+	 * For `viewStateClaim`: the durable `viewStates` key the delivered claim governs. The
+	 * message is only ever sent to the webview that key belongs to.
+	 */
+	viewStateId?: string
+	/** For `viewStateClaim`: the host-minted token the webview stores and echoes on launch. */
+	viewStateClaim?: string
 	themeFixture?: WebviewThemeFixture
 	diagnostics?: WebviewDiagnosticsSnapshot
 	promptText?: string
@@ -712,6 +720,9 @@ export interface WebviewMessage {
 		| "themeFixtureProbeResponse"
 		| "diagnosticsResponse"
 	text?: string
+	viewStateId?: string
+	/** For `webviewDidLaunch`: the claim delivered for `viewStateId`, enforced by setViewStateId. */
+	viewStateClaim?: string
 	taskId?: string
 	editedMessageContent?: string
 	tab?: "settings" | "history" | "mcp" | "modes" | "chat" | "marketplace" | "cloud"

src/core/config/ContextProxy.ts

@@ -67,6 +67,9 @@
 	taskHistory: true,
 	listApiConfigMeta: true,
 	currentApiConfigName: true,
+	// Per-view selection state is machine-local: it keeps flowing through the
+	// normal runtime and pruning paths but must not transfer between settings.
+	viewStates: true,
 })
 
 export class ContextProxy {
@@ -78,6 +81,7 @@
 
 	constructor(context: vscode.ExtensionContext) {
 		this.originalContext = context
+
 		this.stateCache = {}
 		this.secretCache = {}
 		this._isInitialized = false
@@ -397,6 +401,15 @@
 	 */
 	private readonly stateWriteOwner = new Map<string, object>()
 	private readonly secretWriteOwner = new Map<string, object>()
+	/**
+	 * The secret writes that are still in flight, each paired with the claim it took,
+	 * so a reset can wait for them to settle before it deletes the keys. Without the
+	 * pairing a reset cannot tell a settled-but-orphaned write from a live one.
+	 */
+	private readonly pendingSecretWrites = new Map<string, Set<{ settle: Promise<void> }>>()
+	// A reset is in progress: the caches are meaningless mid-reset, and a secret write begun
+	// inside it would commit after the delete pass and survive the erase.
+	private resetting = false
 	/** How many writes of each secret were started. Unlike the owners, it is not cleared when a write is over. */
 	private readonly secretWriteCount = new Map<string, number>()
 
@@ -443,6 +456,13 @@
 	}
 
 	storeSecret(key: SecretStateKey, value?: string) {
+		if (this.resetting) {
+			// Refused rather than deferred: a deferred secret write would re-store exactly the
+			// value the user asked to erase, and a silently dropped one would lose the save.
+			return Promise.reject(
+				new SettingsWriteError([], [key], new Error("secret writes are refused while state is being reset")),
+			)
+		}
 		// Update cache.
 		const owner = {}
 		this.secretWriteOwner.set(key, owner)
@@ -454,7 +474,19 @@
 		// cache (it stays empty until the next write, `refreshSecrets` or a restart) rather than being served.
 		// The entry of the key is removed when the write and its read-back are over (if it is still the latest). A store
 		// that throws at once is turned into a rejection, so it is handled the same.
+		const pending = this.pendingSecretWrites.get(key) ?? new Set<{ settle: Promise<void> }>()
+		let settleWrite: () => void = () => {}
+		const entry: { settle: Promise<void> } = {
+			settle: new Promise<void>((resolve) => {
+				settleWrite = resolve
+			}),
+		}
+		pending.add(entry)
+		this.pendingSecretWrites.set(key, pending)
 		const release = () => {
+			pending.delete(entry)
+			if (pending.size === 0) this.pendingSecretWrites.delete(key)
+			settleWrite()
 			if (this.secretWriteOwner.get(key) === owner) this.secretWriteOwner.delete(key)
 		}
 		const stored = (async () =>
@@ -716,9 +748,22 @@
 	 * @returns A promise that resolves when all reset operations are complete
 	 */
 	public async resetAllState() {
+		this.resetting = true
+		// A secret write that is in flight at this moment has already committed nothing, but it will
+		// commit as soon as it settles, and the deletes below cannot un-commit a write that lands
+		// after them. Wait for the pending writes first, then end the claims, then delete, so the
+		// cleared copy is the last one to land in storage and the cache stays empty afterwards.
+		const inFlight = [...this.pendingSecretWrites.values()].flatMap((writes) => [...writes].map((w) => w.settle))
+		await Promise.allSettled(inFlight)
+
 		// Clear in-memory caches
 		this.stateCache = {}
 		this.secretCache = {}
+		// A reset also ends write ownership: a write that is still in flight reads the Memento back
+		// into the cache it just lost, so clearing the caches is not enough to keep pre-reset state
+		// out. Ownership is what the rejection handlers gate on.
+		this.stateWriteOwner.clear()
+		this.secretWriteOwner.clear()
 
 		await Promise.all([
 			...GLOBAL_STATE_KEYS.map((key) => this.originalContext.globalState.update(key, undefined)),
@@ -727,6 +772,7 @@
 		])
 
 		await this.initialize()
+		this.resetting = false
 	}
 
 	private static _instance: ContextProxy | null = null

src/core/config/ProviderSettingsManager.ts

@@ -55,6 +55,14 @@
 
 export type ProviderProfiles = z.infer<typeof providerProfilesSchema>
 
+/** Already-deleted profile: callers branch on this type instead of matching message text. */
+export class ProviderSettingsNotFoundError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "ProviderSettingsNotFoundError"
+	}
+}
+
 export class ProviderSettingsManager {
 	private static readonly SCOPE_PREFIX = "roo_cline_config_"
 	private readonly defaultConfigId = this.generateId()
@@ -511,7 +519,7 @@
 				const providerProfiles = await this.load()
 
 				if (!providerProfiles.apiConfigs[name]) {
-					throw new Error(`Config '${name}' not found`)
+					throw new ProviderSettingsNotFoundError(`Config '${name}' not found`)
 				}
 
 				if (Object.keys(providerProfiles.apiConfigs).length === 1) {
@@ -522,6 +530,11 @@
 				await this.store(providerProfiles)
 			})
 		} catch (error) {
+			// A missing config is a caller-meaningful signal, not a failure: rethrow it
+			// unwrapped so callers can branch on the type instead of message text.
+			if (error instanceof ProviderSettingsNotFoundError) {
+				throw error
+			}
 			throw new Error(`Failed to delete config: ${error}`)
 		}
 	}