[BUG] Auto-approve state is not persistent

[adrichman]

Problem (one or two sentences)

Every time I exit the settings, Auto-Approve loses all of my Allowed Auto-Execute Commands. (Yes, I am remembering to Save) Tried exporting the settings and I can observe that the values are not in the export.

Context (who is affected and when)

Happens whenever I edit settings, usually trying to add to my auto-approve list.

Reproduction steps

Mac OS 26.2
Roo 3.41.3
VSCode Version: 1.108.1 (Universal)
Commit: 585eba7c0c34fd6b30faac7c62a42050bfbc0086
Date: 2026-01-14T14:55:44.241Z (4 days ago)
Electron: 39.2.7
ElectronBuildId: 12953945
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Darwin arm64 25.2.0

Open settings, navigate to Auto-Approve, add items to auto-approval list. Pills appear to be added in the UI. Hit Save button. Navigate back to tasks. Navigate back to settings -> Auto-Approve, all pills back to the original 3 that were there before I added more (git log,git diff, git show)

Expected result

Expected the values to persist and be auto-approved

Actual result

The items are missing from the list when returning and they are not auto-approved.

Variations tried (optional)

No response

App Version

3.41.3

API Provider (optional)

Roo Code Router

Model Used (optional)

opus 4.5

Roo Code Task Links (optional)

No response

Relevant logs or errors (optional)

[roomote]

I've analyzed this issue and here's my proposed implementation plan:

Root Cause Analysis

After tracing through the code, I've identified the issue. When commands are added to the Auto-Approve list:

1. The webview calls updateSettings with the new allowedCommands array

2. The backend stores the commands in two places:

   • VS Code workspace configuration (ConfigurationTarget.Global)
   • ContextProxy global state

3. When settings are loaded back, mergeAllowedCommands() merges commands from both sources

The problem is that while VS Code configuration is updated correctly, the ContextProxy cache is updated but the global state write may not complete before the view changes. The allowedCommands case in the updateSettings handler updates VS Code config but the global state update at line 647 uses the general setValue path.

Additionally, looking at the getState() function in ClineProvider.ts, the allowedCommands are read from stateValues.allowedCommands (global state), but then getStateToPostToWebview() calls mergeAllowedCommands(allowedCommands) which re-reads from VS Code config. If there's any inconsistency between these two sources, or if the global state write didn't complete, the merge could return stale data.

Proposed Implementation Plan

1. Ensure consistent async handling in the updateSettings handler for allowedCommands and deniedCommands:

   • Make sure the VS Code config update and global state update are both properly awaited
   • Consider updating both atomically to prevent partial state

2. Add explicit state refresh when navigating back to settings:

   • When the settings view becomes visible or mounts, trigger a state refresh to ensure the latest persisted values are loaded

3. Verify the export includes allowedCommands:

   • The export() function in ContextProxy uses globalSettingsExportSchema which includes allowedCommands
   • Ensure the values are being read from the correct source (persisted storage, not just cache)

4. Add test coverage to verify:

   • Commands are persisted correctly after add/remove operations
   • Commands survive navigation away and back
   • Commands are included in settings export

This approach will solve both the navigation persistence issue and the export issue reported.

Please mention @roomote in a comment saying that you approve this plan, and I'll proceed with the implementation.