backupRoswaal has moved to roswaal.app. These pages are a backup copy.Go to roswaal.app

0.144.x✎

Every context menu and dropdown is one menu, and works from the keyboard.

0.144.xSecurity fixes2026-10-06

SecurityFeatureChangeBugfixEditorDesignerDocs

Every context menu and dropdown is one menu, and works from the keyboard.

Releases

  1. 0.144.4Roswaal keeps to the project it has open.SecurityNew2026-10-06
  2. 0.144.3The website runs scripts from itself only.SecurityNew2026-10-06
  3. 0.144.2The local editor answers its own pages, and only shows in its own windows.SecurityNew2026-10-06
  4. 0.144.1Text from a graph lands in the generated Luau as the text it is, and Luau nested too deeply is an error.SecurityNew2026-10-06
  5. 0.144.0Every context menu and dropdown is one menu, and works from the keyboard.New2026-10-06

Warning

Worth knowing before you upgrade.
  • 0.144.4A project whose roswaal.json names a folder outside it, or that keeps its graphs or its output behind a link to somewhere else, no longer opens or compiles that way. Move the folder into the project.

Added

  • 0.144.0Menus work from the keyboard: Up and Down move through what can be chosen, Home and End jump to either end, Enter chooses, and Escape or Tab closes the menu and puts focus back where it was.

Changed

  • 0.144.4A symbolic link in a project that leads outside it is not read, written or removed through, and says so. A link that stays inside the project works as before, and so does a project that is itself reached through a link.
  • 0.144.4sourceDir, outDir and nodePaths in roswaal.json must be folders inside the project.
  • 0.144.4Removing a Wally package only ever removes folders in its _Index.
  • 0.144.3Every page of the website -- the editor, Node Design and the docs -- carries a Content-Security-Policy, the same one the local editor sends: scripts and requests from the site itself, and nothing else.
  • 0.144.2roswaal serve answers requests from the pages it serves itself and no others. A page served by another program on this machine -- a notebook, a dev server -- is treated like any other website. In development, the daemon run by npm run dev also answers Vite's port.
  • 0.144.2The local editor cannot be shown inside another site's frame, and loads scripts only from itself.
  • 0.144.0Every context menu and dropdown is drawn by one menu, which opens over everything and stays on screen: the project tree's, a pin's, the node palette, a card's ⋯, the open documents, More, Project, and a pack's ⋯ in Node Design.
  • 0.144.0More's dividers show. They were there, and drawn as nothing.
  • 0.144.0Menus are divided where their entries are different kinds of thing. The project tree's: making things, then Show in file manager, then Rename and Delete. A pin's: Promote to Variable, then splitting or recombining, then breaking links. More: the project, the graph's tools on a phone, the files, then the other windows. A card's: where it goes, then the card itself, then what is closed. Project: opening, then importing and exporting, then Start again. A pack's: copies, then Show in file manager, then Delete. The node palette sets Comment apart from the nodes, and Node Design's More sets its two pages to read apart from where to go.
  • 0.144.0Remove package… is the last entry of a package's menu, below the ways to add one, where every other menu keeps its red entry.
  • 0.144.0A pin's dropdown of known values has a rule above Other…, which turns the pin into a field to type into.
  • 0.144.0The docs draw More, the Wally menu and the Project menu as the editor draws them, dividers and all. Controls has a section on the menu keys.

Fixed

  • 0.144.4On macOS, Show in file manager selects a folder in Finder, as it does a file, rather than opening it.
  • 0.144.1A variable's description that runs to more than one line is written as a block comment, as a comment on the graph is, and the graph's name and id stay on their own lines of the file's header.
  • 0.144.1A path's starting point that is not game, script, workspace or shared is looked up as a service by name, so Workspace works. A path from one of those four, such as script.Parent, is written as before.
  • 0.144.1A Lune Function whose call is not a function's name is an error rather than being written as it stands.
  • 0.144.1A comment holding every long-bracket closer up to sixteen = gets one more, so it still closes.
  • 0.144.1Luau nested more than 500 deep -- brackets, blocks, tables or types inside one another -- is reported as an error by checking, completion and Import as graph, which read the rest of the file, instead of stopping them.