[ENHANCEMENT] Use objects / dictionaries for allowedCommands & deniedCommands

[Zocker1999NET]

Problem (one or two sentences)

The current problem is that the current implementation for roo-cline.allowedCommands & roo-cline.deniedCommands are based on arrays/lists. This allows (unintended) shadowing / overwriting of globally configured stuff.

Context (who is affected and when)

This means that when a project locally e.g. wants to deny a certain command, this then shadows all commands the user has denied in his/her global VSCode config.

Desired behavior (conceptual, not technical)

Merge both layers of configurations so that project settings only shadow global settings when actually intended, allowing users to share project settings concerned

Constraints / preferences (optional)

This probably breaks the current "simple" editor for those commands. Which is actually just shitty because when global settings are saved, this also induces that the project-specific allowed & denied settings are just (also) saved as global ones, totally overwriting what the user itself had configured before. Hence this UI should be adapted to only show the currently working config & send users to edit the configuration files directly, or direct users to the already in VSCode integrated settings page, which is better at handling that.

Request checklist

• I've searched existing Issues and Discussions for duplicates
• This describes a specific problem with clear context and impact

Roo Code Task Links (optional)

No response

Acceptance criteria (optional)

No response

Proposed approach (optional)

Use the same approach as VSCode currently uses for its files.exclude setting, using JSON objects/directories, where project-specific settings always just extend the global configuration, but where projects can proactively choose to ignore global configurations by setting the according setting to false.
Example setting:

"files.exclude": {
  "**/.git": true,
  "**/.svn": true,
  "**/.hg": true,
  "**/.DS_Store": true,
  "**/Thumbs.db": true
},

Trade-offs / risks (optional)

No response

[roomote-v0]

I've analyzed this issue and here's my proposed implementation plan:

Problem Summary

The roo-cline.allowedCommands and roo-cline.deniedCommands settings are defined as array types in package.json. VSCode's configuration system completely replaces arrays when a more specific scope (e.g. workspace) defines the same setting, meaning workspace-level settings shadow global settings entirely rather than extending them. The existing mergeCommandLists() in ClineProvider.ts tries to work around this by combining global state with workspace config, but vscode.workspace.getConfiguration().get() already returns the resolved (shadowed) value, so the merge is incomplete.

Proposed Approach: Object/Dictionary Format (like files.exclude)

Switch from string[] to Record<string, boolean> for both settings. This leverages VSCode's built-in config merging for objects, where workspace settings only override keys they explicitly set.

Key Changes:

1. src/package.json - Change the configuration schema for both roo-cline.allowedCommands and roo-cline.deniedCommands from { type: "array", items: { type: "string" } } to { type: "object", additionalProperties: { type: "boolean" } } with appropriate defaults (e.g. { "git log": true, "git diff": true, "git show": true })

2. src/core/webview/ClineProvider.ts - Update mergeCommandLists() to read the object format and extract enabled keys (where value is true) into the string[] that the rest of the system expects. This keeps the internal API unchanged.

3. src/core/webview/webviewMessageHandler.ts - Update the settings update handlers to write objects instead of arrays to VSCode configuration.

4. src/extension.ts - Update the initialization logic that reads allowedCommands from configuration.

5. Migration logic in src/utils/migrateSettings.ts - Add a migration step that converts existing array-format settings to the new object format so current users don't lose their configuration.

6. WebView UI (webview-ui/src/components/settings/AutoApproveSettings.tsx, webview-ui/src/components/chat/CommandExecution.tsx, webview-ui/src/components/chat/CommandPatternSelector.tsx) - Update the UI to work with the new format. The internal state passed to the webview can remain as string[] (converted in ClineProvider), so UI changes should be minimal.

7. Tests - Update all affected test files in src/core/auto-approval/__tests__/, src/utils/__tests__/migrateSettings.spec.ts, and webview-ui/src/components/**/__tests__/.

Design Decisions:

• The internal representation passed around (to auto-approval logic, webview state, etc.) stays as string[] for backward compatibility. Only the VSCode configuration layer changes to object format.
• A migration step ensures existing users' array-based settings are converted automatically.
• The UI continues to show command chips with add/remove functionality, but writes back as objects to configuration.
• The auto-approval command matching logic (src/core/auto-approval/commands.ts) remains unchanged since it already operates on string[].

This approach directly mirrors VSCode's own files.exclude pattern as suggested in the issue, and solves the shadowing problem at the configuration level.

Please mention @roomote in a comment saying that you approve this plan, and I'll proceed with the implementation.