foldrun 3.0.0 → 4.0.0

package/docs/security.md

@@ -61,6 +61,16 @@ and the generated index of a knowledge bundle.
 Refusals are counted per step and shown on the run page. Each one is a
 wasted turn; a prompt that names the exact path brings the count to zero.
 
+**A run does not change its own configuration or code.** What a step
+writes to `AGENTS.md`, `agents/`, `flows/`, `tools/`, `hooks/`, `skills/`,
+`evals/` or `scripts/` is not kept: the workspace keeps its own copy, and
+the run page lists each such path under "Not kept". A prompt injection
+cannot widen what later runs may do. Data comes back as before — `state/`,
+`storage/`, `memory/`, `knowledge/`. The one exception is a step a person
+approved before it ran (`!` or `approve: true`): the person read what it
+would do, so its changes to configuration and code are kept, and listed
+on the trail as "kept with approval". That is how an approved fix lands.
+
 ## Secrets
 
 An agent names a secret in `secrets:`; the model never sees the value — it

package/docs/self-hosting.md

@@ -186,6 +186,9 @@ What is different from the platform, and why:
 - **No sandbox by default.** Steps run as your user, in your workspace. Set
   `FOLDRUN_RUN_ISOLATION=container` with Docker installed to get one hardened
   container per step, the same executor the platform's single-box shape uses.
+  Without one, a step's file tools may not write the workspace's configuration
+  or code (`AGENTS.md`, agents, flows, tools, skills, evals, scripts), but its
+  shell is not confined: only a sandbox keeps those files out of a step's reach.
 - **Gates wait in the terminal.** A `!` step parks the run; `foldrun run`
   shows the approval and waits for your answer.
 - **Budgets cap, and nothing meters.** `budget:` stops a run at its cap; the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foldrun",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Agents are just folders. Write them, check them, run them — on your machine.",
   "license": "FSL-1.1-ALv2",
   "type": "module",
@@ -11,7 +11,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@foldrun/core": "^2.14.2"
+    "@foldrun/core": "^3.0.0"
   },
   "files": [
     "bin",