Security and limits

Folio is a reader: it serves files and writes only its model of the folder, what you have read, the versions it saw, its health results, when each document's text first appeared, the vectors it related blocks by, its data engine's spill files and the port it serves on, kept in ~/.local/state/folio/ - $XDG_STATE_HOME/folio/ when that variable holds an absolute path - and rebuilt from the files whenever they are missing. The one exception is a folder that asks for it: a save declaration lets Folio write query results into the regions a document marks for them, and a digests declaration lets it write the digest documents it names, and nowhere else. That store is outside the served folder, with one exception: a served folder that contains ~/.local/state, such as your home folder, holds the store in that hidden folder. A related declaration also has Folio fetch its embedding model's runtime from npm and the model from Hugging Face once, into ~/.cache/folio/ - $XDG_CACHE_HOME/folio/ when that variable holds an absolute path - shared by every folder it serves.

• Localhost only. The server binds to 127.0.0.1 and refuses any request whose Host header is not a localhost name, so a page on another site cannot reach it through a DNS name pointing at your machine. The live-update socket also requires a localhost Origin. The model API refuses a request another site's page sends, and --socket serves it on a unix socket only its owner may open.
• One folder. Every path is resolved through symlinks and must land inside the served folder; anything else is not found. Dot-folders and node_modules are never listed.
• Git, read only. History comes from git log and git cat-file in the repository a document belongs to - which may lie above the served folder, the one place Folio reads outside it, but only when its git directory is inside the served folder or is the .git of a folder holding it, so a .git file pointing elsewhere lends no other repository - with optional locks off, so no repository is written, and with every setting that could run a program - a filesystem monitor, a signature checker, an external diff, a pager, hooks - overridden on the command line, so no repository's config runs anything. Paths are passed literally, never as patterns, and a version's text is read only for a blob the document's own log names. A symlink is followed only to a file inside the served folder.
• Queries only read. The data engine may read only inside the served folder and write only its spill files into Folio's store; a query is one SELECT, and the engine's settings are locked before any query runs.
• No script from content. Markdown may carry inline HTML, but scripts, event handlers and other executable markup are stripped before a page is drawn, and diagrams render with mermaid's strict security level.
• One folder per process. Serve another folder by starting Folio again on another port.
• Reading, not editing. Pages are edited in your own editor; Folio shows the result.
• Linux-first. Developed and tested on Linux; on other systems Folio cannot tell whether another program still holds a file open before writing a saved view into it, and waits for the file to be still instead.