foldrun 2.9.0 → 2.9.1

package/docs/agents.md

@@ -370,6 +370,10 @@ All three are **hard ceilings**:
   whole machine from the steps beside it. When every core is busy, a bigger
   class gets a bigger share.
 - **Disk:** a step over it is evicted rather than the node filling up.
+  This is the step's scratch space, not the account's storage: the
+  sandbox's copy of the workspace and whatever the step writes while it
+  runs. When the step ends, the files it changed are copied back to the
+  workspace and the sandbox, scratch space included, is deleted.
 
 Pick `small` for an agent that mostly waits on an API, `heavy` for one that
 renders a browser or holds real data. The step's `resources:` line reports CPU

package/docs/api.md

@@ -428,7 +428,7 @@ X-Foldrun-Cli: 0.6.0               # the CLI released with this version (absent
 
 | Route | Methods | |
 |---|---|---|
-| `/api/auth/signup` | POST | `email`, `password`, `account`, `invite`. Rate limited per address and per caller. With signups closed every address gets the same refusal, so the form cannot be used to discover which addresses are registered |
+| `/api/auth/signup` | POST | `email`, `password`, `account`, `invite`, `setup`. An install with `FOLDRUN_SETUP_TOKEN` set creates its first account only with `setup` equal to it (403 otherwise); once an account exists the token does nothing. Rate limited per address and per caller. With signups closed every address gets the same refusal, so the form cannot be used to discover which addresses are registered |
 | `/api/auth/login` | POST | `email`, `password` |
 | `/api/auth/logout` | POST | ends the session |
 | `/api/auth/session` | GET | who am I |

package/docs/self-hosting.md

@@ -32,9 +32,52 @@ curl -fsSL https://foldrun.io/install.sh | sh
 
 It checks Docker, puts `docker-compose.yml` in `~/foldrun`, writes `.env`
 there once (a fresh secret key, the address, the version), pulls the
-ready-made images and starts foldrun on port 3900. Then open
-`http://localhost:3900/signup` in a browser — the first account to
-sign up becomes the owner — then sign the CLI in and deploy:
+ready-made images for your machine's chip and starts foldrun on port 3900.
+
+**No Docker yet?** The installer offers to set it up, and asks before each
+step (`[y/N]`):
+
+| on | Docker missing | Docker stopped | Docker not reachable by you |
+|---|---|---|---|
+| **macOS** | installs Colima (a small Linux VM), `docker` and `docker-compose` with [Homebrew](https://brew.sh), then starts Colima with up to 4 CPUs and 8 GiB — enough for a `heavy` step | starts Colima, or opens Docker Desktop | — |
+| **Linux** | runs Docker's official script ([get.docker.com](https://get.docker.com): the engine and the Compose plugin) as root, through `sudo` | `sudo systemctl start docker` | adds you to the `docker` group (root-equivalent), and uses `sudo` for the rest of that run; the group applies from your next login |
+
+Answer after each question appears: anything typed ahead is lost while
+Docker installs.
+
+**What it checks first.** The install folder and every file Compose reads
+there (`.env`, `docker-compose.yml`, `docker-compose.override.yml`) must be
+yours alone — owned by you, writable by nobody else, no access control list,
+no symlinks — because Docker runs what they say with root's reach. The
+override must stand alone: no `include` or `extends`, and no `env_file` —
+put settings in `.env` or in the override's own `environment:`. Anything
+else it names, such as a secret's file, is your own configuration to
+protect, as is a key written to slip past these checks.
+
+`FOLDRUN_DATA_DIR` (a host folder instead of the data volume) holds the
+accounts and the vault, so it must be private: the installer makes it
+owner-only when it does not exist, refuses one that others can read or
+write, and keeps its real path (symlinks resolved) in `.env`.
+
+The installer sets foldrun up on the machine it runs on, and refuses a
+remote Docker (`DOCKER_HOST` or a context pointing at another machine): run
+it on the Docker host itself.
+Compose is always given these files by name, so a `compose.yaml` beside them
+or a `COMPOSE_FILE` in `.env` cannot stand in. Before starting, it checks
+that the Docker the platform will be given (`FOLDRUN_DOCKER_SOCK`) is the
+same daemon it installed into. With no terminal (a provisioning script), nothing is
+installed unless you say so in advance with `FOLDRUN_INSTALL_DOCKER=yes`;
+`FOLDRUN_INSTALL_DOCKER=no` never asks. Without Homebrew on a Mac, install
+it or [Docker Desktop](https://docs.docker.com/desktop/setup/install/mac-install/)
+first. Then open the signup link it prints —
+`http://127.0.0.1:3900/signup?setup=…` (127.0.0.1, not `localhost`, which a browser may send to IPv6 where another user could be listening) — in a browser. The first account
+becomes the owner, and only that link can create it: anyone else using the
+same machine can reach `localhost` too, so the installer ties the owner to
+whoever ran it (the token is `FOLDRUN_SETUP_TOKEN` in `~/foldrun/.env`, and
+does nothing once the owner exists). With `FOLDRUN_BIND` set to one address
+the link uses that address; from another machine, open it through the
+tunnel the installer prints (`ssh -o ExitOnForwardFailure=yes -L …`), never
+over plain http. Then sign the CLI in and deploy:
 
 ```sh
 npm install -g foldrun
@@ -67,6 +110,8 @@ edit `~/foldrun/.env` and run `docker compose up -d` there.
 | `ANTHROPIC_API_KEY` | none | the install's model key. Without one, each account adds its own in Settings → Model; a step with neither is refused with what to set |
 | `FOLDRUN_DIR` | `~/foldrun` | where the install lives (installer only) |
 | `FOLDRUN_DOCKER_SOCK` | `/var/run/docker.sock` | the Docker socket; rootless Docker is found by the installer |
+| `FOLDRUN_SETUP_TOKEN` | made once | the first account (the owner) is created only with this, through the printed `/signup?setup=…` link |
+| `FOLDRUN_INSTALL_DOCKER` | ask | `yes` installs or starts Docker without asking (for a script with no terminal); `no` never offers to |
 | `FOLDRUN_EGRESS_BIND` | `0.0.0.0` | the egress proxy's port 8090, which steps reach through `host.docker.internal`. On a server that faces a network, bind it to the Docker bridge (`172.17.0.1`); Docker-published ports skip host firewalls such as ufw |
 | `FOLDRUN_DATA_DIR` | a named volume | a host path for the data instead |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foldrun",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "description": "Agents are just folders. Write them, check them, run them — on your machine.",
   "license": "FSL-1.1-ALv2",
   "type": "module",