RooCode Security Middleware - Enterprise take on security, Proposed by DreamHost.

apps/web-roo-code/src/app/privacy/page.tsx

@@ -86,8 +86,8 @@ export default function Privacy() {
 								Your source code does not transit Roo Code servers unless you explicitly choose Roo Code
 								as a model provider (proxy mode).
 							</strong>{" "}
-							When Roo Code Cloud is your model provider, your code briefly transits Roo Code servers only to
-							forward it to the upstream model, is not stored, and is deleted immediately after
+							When Roo Code Cloud is your model provider, your code briefly transits Roo Code servers only
+							to forward it to the upstream model, is not stored, and is deleted immediately after
 							forwarding. Otherwise, your code is sent <strong>directly</strong>—via client‑to‑provider
 							TLS—to the model you select. Roo Code never stores, inspects, or trains on your code.
 						</li>

packages/types/src/experiment.ts

@@ -9,6 +9,7 @@ import type { Keys, Equals, AssertEqual } from "./type-fu.js"
 export const experimentIds = [
 	"powerSteering",
 	"multiFileApplyDiff",
+	"securityMiddleware",
 	"preventFocusDisruption",
 	"imageGeneration",
 	"runSlashCommand",
@@ -25,6 +26,7 @@ export type ExperimentId = z.infer<typeof experimentIdsSchema>
 export const experimentsSchema = z.object({
 	powerSteering: z.boolean().optional(),
 	multiFileApplyDiff: z.boolean().optional(),
+	securityMiddleware: z.boolean().optional(),
 	preventFocusDisruption: z.boolean().optional(),
 	imageGeneration: z.boolean().optional(),
 	runSlashCommand: z.boolean().optional(),

packages/types/src/global-settings.ts

@@ -67,6 +67,7 @@ export const globalSettingsSchema = z.object({
 	alwaysAllowFollowupQuestions: z.boolean().optional(),
 	followupAutoApproveTimeoutMs: z.number().optional(),
 	alwaysAllowUpdateTodoList: z.boolean().optional(),
+	securityCustomConfigPath: z.string().optional(),
 	allowedCommands: z.array(z.string()).optional(),
 	deniedCommands: z.array(z.string()).optional(),
 	commandExecutionTimeout: z.number().optional(),

src/api/providers/featherless.ts

@@ -1,4 +1,9 @@
-import { DEEP_SEEK_DEFAULT_TEMPERATURE, type FeatherlessModelId, featherlessDefaultModelId, featherlessModels } from "@roo-code/types"
+import {
+	DEEP_SEEK_DEFAULT_TEMPERATURE,
+	type FeatherlessModelId,
+	featherlessDefaultModelId,
+	featherlessModels,
+} from "@roo-code/types"
 import { Anthropic } from "@anthropic-ai/sdk"
 import OpenAI from "openai"
 

src/core/prompts/__tests__/custom-system-prompt.spec.ts

@@ -39,6 +39,23 @@ vi.mock("../../../utils/fs", () => ({
 	createDirectoriesForFile: vi.fn().mockResolvedValue([]),
 }))
 
+vi.mock("../../../services/code-index/manager", () => ({
+	CodeIndexManager: {
+		getInstance: vi.fn().mockReturnValue({
+			isFeatureEnabled: false,
+			isFeatureConfigured: false,
+			isInitialized: false,
+			getCurrentStatus: vi.fn().mockReturnValue({
+				systemStatus: "Standby",
+				message: "",
+			}),
+			searchIndex: vi.fn().mockResolvedValue([]),
+			dispose: vi.fn(),
+		}),
+		disposeAll: vi.fn(),
+	},
+}))
+
 import { SYSTEM_PROMPT } from "../system"
 import { defaultModeSlug, modes } from "../../../shared/modes"
 import * as vscode from "vscode"
@@ -62,7 +79,7 @@ const mockContext = {
 	globalState: {
 		get: () => undefined,
 		update: () => Promise.resolve(),
-		setKeysForSync: () => {},
+		setKeysForSync: () => { },
 	},
 	extensionUri: { fsPath: "mock/extension/path" },
 	globalStorageUri: { fsPath: "mock/settings/path" },
@@ -114,7 +131,7 @@ describe("File-Based Custom System Prompt", () => {
 		expect(prompt).toContain("CAPABILITIES")
 		expect(prompt).toContain("MODES")
 		expect(prompt).toContain("Test role definition")
-	})
+	}, 50000) // 50 second timeout for Windows CI
 
 	it("should use file-based custom system prompt when available", async () => {
 		// Mock the readFile to return content from a file