1.1.3RoachNet for macOS

RoachNet 1.1.3 is a security and fix release for 1.1.2. The local API's launch token is no longer kept in a file or handed down to the programs RoachNet runs, which narrows a limit that 1.1.2's security notes described. Someone on your network can no longer tie up RoachNet Cluster's listener without the pairing code, and a prompt no longer names your Mac account to a cloud model. The model server refuses pictures and other media it can't read instead of dropping them, replies held to a JSON schema no longer stop before their JSON, Ollama's -cloud models count as cloud models, and Roach's Archive loads its torrent list only from an address you set.

Security

The local API's launch token was in a file and in the environment of the programs RoachNet runs

• What this is: a hardening of a limit that 1.1.2's security notes described: an Org agent on Full access, or any program you run yourself, is trusted code on your Mac and can reach the local API like you can. It isn't rated.
• Before (1.1.0 through 1.1.2):
  • RoachNet.app gave the runtime its launch token in an environment variable, so every program the runtime started inherited it: Org agents, tools and Codex among them.
  • The runtime wrote the token into its server-info file in RoachNet's storage folder. Only your account could read that file, but so could every program running as you.
  • The companion bridge's token sat in RoachNet's installer settings as it was, and RoachClaw Org kept the secret that signs its run tokens in Org's people file, so a program that could read that file could make run tokens.
  • RoachTail's state file held the open join code, and while RoachTail is on a code is usually open. A program that read it could pair a device of its own and get that device's token.
• What changed:
  • RoachNet.app hands the launch token to the runtime on the runtime's standard input. The runtime reads it before anything else and keeps it in memory only.
  • RoachNet.app sends the token only to the runtime it started. It uses the server-info file only if the file names that process and an address on this Mac where that process is listening, and the runtime has to turn away a request that doesn't carry the token. A runtime that answers one anyway, an older one for instance, is stopped, and RoachNet says why.
  • When RoachNet runs the Node runtime from its source instead of its runtime helper, that runtime gets the token in its environment, as before 1.1.3: it doesn't read its standard input.
  • The runtime takes ROACHNET_API_TOKEN and ROACHNET_COMPANION_TOKEN out of its own environment before it starts anything, so nothing it runs inherits them. A runtime that was told to expect the token and didn't get one stops, instead of serving the API without a token.
  • The server-info file no longer holds the token.
  • The installer settings keep the companion bridge's token as its SHA-256. A phone paired with an earlier release still connects.
  • Org signs run tokens with a key that lives in memory and is new each launch, so no run token outlives the runtime that issued it. A people file that still holds the old secret is saved again without it.
  • RoachTail's join code stays in memory, and the state file keeps only its hash. A state file that still holds a code is written again without it.
• What stays the same: a program that runs as you, an Org agent on Full access included, can still read and change your files, RoachNet's among them. Run only programs you trust. For your own scripts, make a RoachClaw API token in Settings › RoachClaw: you choose its scope, and you can revoke it. Find the port and token has the lines to paste.

Someone on your network could tie up RoachNet Cluster's listener, and a paired Mac could stop the runtime

• Severity: Medium for the listener, which needed no pairing. Low for the stage check, which needed a paired Mac.
• Affected: RoachNet 1.1.0 through 1.1.2 for macOS, with Cluster turned on. Cluster is off by default, and nothing listens on the network until you turn it on.
• What happened:
  • Before a connection had proved that it holds the pairing secret, the listener took a message of up to 96 MB, set the room aside for it and waited for all of it. It waited as long as the sender took, one byte at a time if it liked, and it let any number of connections start a handshake at once. So anyone on your network could hold the listener and make the Mac set memory aside, without the pairing code.
  • A paired Mac could ask for a stage whose layers lie past the model's last layer, and the runtime serving the model stopped when the arithmetic overflowed.
• What it took: Cluster turned on, and a device on the same network connecting to its port (7419 unless you changed it). The stage needed a Mac paired with yours. Neither could read or change your data.
• What changed:
  • Until a connection has proved that it holds the pairing secret, a message longer than 128 bytes is refused on its length, before any of it is read. The pairing messages are all shorter.
  • The whole handshake must finish within the link's time limit, not only each read.
  • Only a few connections from one address, and a limited number in all, may be in their handshake at once. The next one is closed before anything is read.
  • A stage's layers are checked against the model's before they're counted, so a stage outside the model is refused.

Other security fixes

• Org routines: taking a webhook trigger off a routine left the trigger's secret on disk, with nothing left to use it; the trigger's address already answered nothing once it was taken off. The secret is now deleted when the routine is saved. A trigger switched to another kind keeps its secret, so switching it back keeps its address and token. Rated Low. (In 1.1.0 through 1.1.2.)
• Addresses with a user name and password: an Org agent set up as an agent service, whose address carried a user name and password (https://name:password@host/…), wrote the whole address, password included, into its run log and its RoachTrace trace, and RoachTrace's export sent that trace on when export was on. RoachNet now refuses an address with a user name or password wherever you or a catalog give one: an Org agent's address, RoachTrace's export address, a cloud provider's base URL, a pack catalog or manifest, a collection catalog, a download and a model pull. The agent's run log and trace, RoachNet's status lines, and the error messages and log lines that name an address show only its scheme, host and path, so a key in an address's query stays out of them too. Rated Low. (In 1.1.0 through 1.1.2.)
• Redirects back to your network: RoachNet follows a redirect to this Mac or your network only for a request that started there. To tell, it looked the starting address's name up again when the redirect came, and whoever runs that name's DNS chooses the answer: it could answer with a private address just then, and a redirect to this Mac was followed. With an Org agent at such an address, set up by an admin who isn't the owner, up to 16 KB of a local service's reply went to the agent's run log, which that admin can read. A request now counts as starting on your network only when its address is written as one there, localhost or a .local name. Rated Low. (In 1.1.2.)
• RoachSpeech packs: asking for a RoachSpeech pack with an id such as .downloads installed it over RoachNet's own download cache for speech packs, or over its list of pending packs, and removed what it replaced. Only your own local API or a paired companion could ask for one, and the pack's manifest had to name the same id. Pack ids now follow the catalog's rules, and anything else is refused. Rated Low. (In 1.1.0 through 1.1.2.)

Privacy: a prompt could name your Mac account to a cloud model

RoachClaw and Dev add RoachBrain's wiki to their prompts, and named its index and log by their full paths, which start with your home folder and so with your Mac account's name. With the Vault or Projects context switched on, a prompt also carried the full path of the wiki's index or of the projects folder. When a cloud model answered (an Ollama cloud model, RoachClaw's cloud fallback or a Claude or ChatGPT plan model), that name went to its provider. A path in a prompt now starts with ~ in your home folder, and with "RoachNet storage" when the storage folder is elsewhere, so it names neither your account nor a volume. In 1.0.4 through 1.1.2.

Fixes

• Pictures and other media sent to the model server: RoachInference reads text only, and the model server dropped pictures, audio, video and files before the model saw anything, so the reply read as if the model had seen them. A request that carries any of them now gets a 400 that says so: Ollama images on chat and generate, OpenAI image, audio, video and file parts on chat completions and Responses, and Anthropic image and document blocks, tool results included. On the embeddings routes, an input that is neither text nor a list of texts is refused instead of being taken as empty.
• Photos from the iOS companion: a photo goes only to a model that lists vision among its capabilities, as your own Ollama does for its vision models. Any other model gets the phone's description of the photo, which the message already carries, and a cloud model never gets the photo. Before, a photo went to every model whose name didn't end in :cloud.
• Replies held to a JSON schema: a sampled reply (temperature above 0) could end as spaces and a broken character instead of JSON, most often with models that like to open with an emoji. A token that leaves a character unfinished is now allowed only where a later token can finish it: inside a JSON string, or inside one of the schema's fixed values or keys that goes on with that character. Fixed values and keys written with characters made of more than one code point, such as an emoji with a skin tone or a letter with a combining accent, can now be generated, and they're matched code point by code point, as JSON matches them.
• RoachBrain's memories: RoachBrain couldn't read the times it stored, so a recent memory got no more weight than an old one when RoachClaw and Dev picked memories for a prompt, and the newest memory wasn't listed first. It now writes times in a form it reads, and reads the ones it stored before. Recency only ranks the memories that match a prompt; it brings no unrelated memory into one.
• Ollama cloud models: with your own Ollama serving RoachNet's models, a model tagged -cloud, such as gpt-oss:120b-cloud, counted as local. RoachClaw could say "Local only" while one was offered, and it was labelled and timed as a local model. A model tagged cloud, or with a tag ending in -cloud, now counts as a cloud model in the chat, the RoachClaw pane, the command palette and Dev.
• Log lines: an error message or a file path with a % in it could garble a line that RoachNet or Setup wrote to the system log, or make it quit. Such text now goes into the line as it is.

Changes

• Roach's Archive's torrent list: RoachNet no longer has a torrent list address built in. To load one, set the address of a torrent list you trust (https, http or a file on your Mac) in Settings, under Roach's Archive. Until you do, Refresh stays off. A list you loaded before stays where it is in your storage folder.
• Packaging: the installer, the app archive that Setup installs from and the apps' bundles carry no details of the computer or the tools that built them, and the app bundles only the five collection catalogs RoachNet reads. None of this changes how the app works.

Opening the installer

This build is ad-hoc signed and not Apple-notarized, like 1.1.2. On first launch macOS says RoachNet Setup can't be verified: open System Settings › Privacy & Security and choose Open Anyway for RoachNet Setup. Verify the download first:

shasum -a 256 -c RoachNet-Setup-macOS.dmg.sha256

Homebrew: brew tap --force RoachWares/roachnet && brew install --cask roachnet. Already installed with Homebrew: brew upgrade --cask roachnet.

Upgrade, roll back or remove

• Before you update: keep a current backup of ~/RoachNet/storage (Time Machine works). Until you update, keep Cluster off on networks you share with people you don't trust.
• Upgrade: quit RoachNet and run Setup over the existing install. ~/RoachNet/storage (Vault, settings, models, Org) is kept.
• Roll back: not advised. Going back to 1.1.2 brings back every problem fixed here, the security problems included. If you go back anyway and use RoachClaw Org, 1.1.2 says it can't read its list of people, because 1.1.3 saves that list without the old run-token secret. Leave the file where it is: nothing in it is lost, and updating to 1.1.3 again brings the list back.
• After you update:
  • A script that read the launch token from ~/RoachNet/storage/state/runtime-state/native-server-info.json finds no token there now. Make a RoachClaw API token in Settings › RoachClaw and use it instead; the file still gives the runtime's address.
  • A RoachTail pairing that was open when RoachNet quit can't be finished with that code; the desktop shows a new one.
  • A client that sends pictures to RoachNet's model server gets a 400 instead of a reply that ignores them.
  • An address with a user name and password in it is refused now: keep the credential in the Org agent's secret or the cloud provider's key field.
  • A service on your network that you reach by a host name other than a .local one can't redirect RoachNet to another address on your network any more. Give RoachNet its address or its .local name.
  • A request for a RoachSpeech pack whose id doesn't follow the catalog's rules gets a 400.
• Remove: quit RoachNet, then remove ~/RoachNet/app and ~/RoachNet/runtime. Keep ~/RoachNet/storage to keep your data. With Homebrew, brew uninstall --cask roachnet removes the Setup app; brew uninstall --zap --cask roachnet also moves all of ~/RoachNet, your Vault included, to the Trash.

Known issues

Support, license and attribution

• Help: Get help. Please report a security problem by email first, not anywhere public.
• Releases: every RoachNet release on GitHub
• License: LICENSE · Typefaces: SIL Open Font License texts

How this release was built

These notes match the tagged source. The apps in the DMG were built from exactly the source at tag v1.1.3, and RoachWares tested the build by hand before publishing it, rather than in hosted CI, because a hosted build needs Apple Developer ID and notarization credentials, and RoachNet doesn't have those yet.