roo code hangs in a simple request; developer mode reveals CSP issue.

[vlovsky]

App Version

3.23.15

API Provider

OpenRouter

Model Used

N/A

Roo Code Task Links (Optional)

No response

🔁 Steps to Reproduce

Download and extract Visual Studio Code portable ZIP

Create a data folder inside the extracted VS Code folder

Launch Code.exe

Install the Roo Code extension

Open Roo sidebar

Select OpenRouter as provider

Paste a valid OpenRouter API key (confirmed working via curl or PowerShell)

Choose any model (e.g. anthropic/claude-3-sonnet)

Leave “custom base URL” disabled

Type hi in chat and send

Observe endless spinning with no response

Cancelling a task takes significant time as well

💥 Outcome Summary

Expected:
The message "hi" is sent to the OpenRouter API, and a model response is displayed in the Roo UI.

But got:
The UI spins indefinitely. No response appears, no error is shown, and no request is sent to the API. Developer Console shows CSP violations blocking access to OpenRouter and local audio files.

While cancelling,
Expected: quick response. But got: 10 seconds delay

📄 Relevant Logs or Errors (Optional)

Some resources are blocked because their origin is not listed in your site's Content Security Policy (CSP). Your site's CSP is allowlist-based, so resources must be listed in the allowlist in order to be accessed.

A site's Content Security Policy is set either via an HTTP header (recommended), or via a meta HTML tag.
issues in the browser developer mode UI.
To fix this issue do one of the following:

(Recommended) If you're using an allowlist for 'script-src', consider switching from an allowlist CSP to a strict CSP, because strict CSPs are more robust against XSS. See how to set a strict CSP.
Or carefully check that all of the blocked resources are trustworthy; if they are, include their sources in the CSP of your site. ⚠️Never add a source you don't trust to your site's CSP. If you don't trust the source, consider hosting resources on your own site instead.
4 directives
Resource	Status	Directive	Source location
https://file+.vscode-resource.vscode-cdn.net/c%3A/Users/vlovs/.vscode/extensions/rooveterinaryinc.roo-cline-3.23.15/webview-ui/audio/notification.wav	blocked	connect-src	chunk-pO14Kfwb.js:9
https://file+.vscode-resource.vscode-cdn.net/c%3A/Users/vlovs/.vscode/extensions/rooveterinaryinc.roo-cline-3.23.15/webview-ui/audio/progress_loop.wav	blocked	connect-src	chunk-pO14Kfwb.js:9
https://file+.vscode-resource.vscode-cdn.net/c%3A/Users/vlovs/.vscode/extensions/rooveterinaryinc.roo-cline-3.23.15/webview-ui/audio/celebration.wav	blocked	connect-src	chunk-pO14Kfwb.js:9
https://openrouter.ai/api/v1/key	blocked	connect-src	index.js:2606
Learn more: Content Security Policy - Source Allowlists

Error while cancelling:
log.ts:460   ERR [Extension Host] Failed to abort task
error @ log.ts:460
error @ log.ts:565
error @ logService.ts:51
Rds @ remoteConsoleUtil.ts:58
$logExtensionHostMessage @ mainThreadConsole.ts:38
S @ rpcProtocol.ts:458
Q @ rpcProtocol.ts:443
M @ rpcProtocol.ts:373
L @ rpcProtocol.ts:299
(anonymous) @ rpcProtocol.ts:161
C @ event.ts:1219
fire @ event.ts:1250
fire @ ipc.net.ts:652
l.onmessage @ localProcessExtensionHost.ts:382
console.ts:137 [Extension Host] Failed to abort task
Tds @ console.ts:137
$logExtensionHostMessage @ mainThreadConsole.ts:39
S @ rpcProtocol.ts:458
Q @ rpcProtocol.ts:443
M @ rpcProtocol.ts:373
L @ rpcProtocol.ts:299
(anonymous) @ rpcProtocol.ts:161
C @ event.ts:1219
fire @ event.ts:1250
fire @ ipc.net.ts:652
l.onmessage @ localProcessExtensionHost.ts:382

[dosubot]

Hi @vlovsky! I'm Dosu and I’m helping the Roo-Code team.

The CSP (Content Security Policy) errors in your logs show that VS Code's webview is blocking both API requests to OpenRouter and access to local audio files, which prevents Roo Code from working and causes the UI to hang. This is likely due to how CSP is enforced in the portable VS Code environment. There are no documented Roo Code settings or workarounds to relax CSP or resolve this in portable setups, and the official docs don't mention this issue or provide a fix for slow task cancellation in v3.23.15 either.

Trying Roo Code in a standard (non-portable) VS Code installation may help determine if the issue is specific to the portable version. If you continue to see the problem, sharing your environment details with maintainers will help them investigate further.

References:

• No CSP troubleshooting steps or workarounds documented
• No settings for customizing CSP in Roo Code
• No known OpenRouter provider issues in portable VS Code
• Task cancellation bug fixes in earlier versions, but not for this issue

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[vlovsky]

@dosu

I'll check that. But so far, I narrowed it down to "roo code" spcific, since VS code "cline" extension works without issues with the exactly same setup.

[roomote]

I am investigating this CSP issue that is preventing Roo Code from working in portable VS Code environments. The issue appears to be related to Content Security Policy blocking both OpenRouter API requests and local audio file access. I will analyze the webview CSP configuration and provide a fix.

[dosubot]

You're right—this does look Roo Code–specific, since Cline works fine in the same portable VS Code setup. There’s no official documentation or workaround for CSP or portable VS Code issues in Roo Code, and nothing published about differences in webview resource loading or CSP handling between Roo Code and Cline. One possible reason could be Roo Code’s use of extra webview resources (like audio files), which might trigger stricter CSP enforcement in portable VS Code, or a change in how Roo Code configures its webview since the Cline fork.

If you haven’t already, you could try Roo Code in a standard (non-portable) VS Code install to see if the issue persists. If Roo Code has any settings to disable audio or notifications, testing with those off might help isolate the cause. Since this isn’t documented, sharing your findings (including the clear difference with Cline) will be valuable for maintainers to investigate further.

No official docs cover this scenario or provide a fix for the CSP errors or slow cancellation in v3.23.15 docs.roocode.com.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}