Safety and limits

Browser only

Roost does what you could do by hand in Fruit Bat, and nothing else. It can't run programs, open a system terminal, or read your files. The only command that writes a file is save, which goes to your Downloads folder and asks first. Roost Script runs in its own small interpreter with no eval and no way to reach Node, the network or the disk.

Questions

Roost asks before:

• closing more than 3 tabs, or opening more than 5;
• clicking things like Buy, Pay, Delete, Send, Submit or Sign out, and pressing Enter in risky places;
• forgetting history, deleting scripts, downloading files and saving files.

Saved scripts and jobs can't stop to ask, so they need --yes. Outside scripts can never use it.

Limits

Everywhere: lists hold 2,000 items, text 10,000 characters, wait a minute at most, and Roost Script functions can call each other 200 deep. Ctrl C always stops a script, and none of these can be caught by try.

Outside scripts

Scripts from Echo and from .roost files are outside scripts. They're shown to you, checked line by line, and run only when you say so, with Echo's list of commands. To give one every command, open it in the editor and save it as your own.

Money, chat and torrents

• wallet send only prepares a payment, only when you type it (never from scripts, jobs, Echo or files), and nothing is sent until you press Approve in the wallet panel.
• Chirp sends at most 5 messages a minute from Roost, and asks every time when an outside script sends one.
• Outside scripts can pause and resume torrents, but never add or remove them.

Private and Vampire Bat windows

Roost only sees that window and keeps what you type in memory only. Chirp, the wallet and Colony aren't available there, and in Vampire Bat windows Roost can't see your history or bookmarks.

Turning Roost off

Settings › General › Roost browser shell turns it off everywhere, including Echo's scripts and .roost files.