[VS Code Extension 4.1.17] Removed provider entries are silently re-imported by the legacy import on every ProviderSettingsManager construction #14322

Cline Surface

VS Code Extension

Cline Version

4.1.17

Beta version

• I am using a beta version of Cline

What happened?

Removing a provider entry from providers.json does not stick: the entry is silently re-imported and reappears in Settings → Providers.

This is the general (non-desktop) case of the root cause the maintainers already identified in #14040 and #14090:

ProviderSettingsManager re-runs the legacy globalState.json / secrets.json import in its constructor ... Sign-out (save_provider_settings with enabled: false) deletes the provider entry from providers.json. The next sidecar command saw openai-codex missing, found openai-codex-oauth-credentials still in the legacy extension's secrets.json, and re-imported the tokens.

Those two fixes are desktop-only and cover only openai-codex, cline, and cline-pass. On the VS Code extension (4.1.17) the same mechanism resurrects any provider whose legacy key still exists in ~/.cline/data/secrets.json (e.g. zaiApiKey for Z.AI), so a provider the user removed keeps showing up as configured.

Steps to reproduce

1. Classic extension had Z.AI configured (legacy secrets.json contains zaiApiKey).
2. Update to the v4 extension (4.1.17). The one-time migration writes a zai entry into ~/.cline/data/settings/providers.json with "tokenSource": "migration".
3. Remove the zai entry from providers.json (or use any removal / sign-out flow available in the UI).
4. Reload the VS Code window, or trigger any action that constructs ProviderSettingsManager.
5. The zai entry is back, still tagged "tokenSource": "migration", with a fresh updatedAt.

Observed on my machine: the migration ran at install time (Sep 16), yet the zai entry's updatedAt is Sep 19 while keeping tokenSource: "migration" — i.e. it was re-written after the initial migration had already fired, which matches the "import re-runs on every construction" behavior.

Expected behavior

• Deleting a provider entry sticks.
• The legacy import runs once (gated by the migration version) instead of on every ProviderSettingsManager construction — the "fuller cleanup" already described in fix(desktop): clear legacy Codex credentials on ChatGPT sign-out #14040: "stop re-running the import on every manager construction".

Additional context

Evidence from ~/.cline/data/ (secrets masked):

// ~/.cline/data/settings/providers.json (excerpt)
"zai": {
  "settings": {
    "provider": "zai",
    "model": "glm-5.2",
    "baseUrl": "https://api.z.ai/api/paas/v4",
    "reasoning": { "budgetTokens": 1024 },
    "apiLine": "china"
  },
  "updatedAt": "2026-09-19T07:15:27.743Z",
  "tokenSource": "migration"
}

// ~/.cline/data/secrets.json (values masked)
{ "openAiApiKey": "sk-***", "zaiApiKey": "***", "openRouterApiKey": "sk-or-v1-***", "moonshotApiKey": "sk-***" }

Suggested fixes (any of):

1. Gate the legacy import behind the migration version so it runs exactly once, as already hinted at in fix(desktop): clear legacy Codex credentials on ChatGPT sign-out #14040.
2. Generalize the fix(desktop): clear legacy Codex credentials on ChatGPT sign-out #14040 stopgap: when a provider entry is deleted, also remove the corresponding legacy key from secrets.json — for all providers and all surfaces, not just Codex on desktop.

Related: #14040, #14090, #14105 (dangling lastUsedProvider read-path guard).