🗂️ LiveFolders v0.22.0 — Now with concurrent shell session isolation — per-session invocation slots, async dispatch, SIGKILL escalation — Landlock (Linux) + sandbox-exec (macOS) — Apache 2.0 — Star us on GitHub! ★

10 Lines vs 18 Lines

Same task: fetch users from a REST API and return markdown. From the peer-reviewed paper, measured on live experiments:

LiveFolders: no Python, no imports, no server lifecycle. The handler is a shell one-liner. The gap grows with tool complexity — every MCP tool must navigate a server framework; every LiveFolders tool is independently a shell command.

Key Features

🔗 Declarative Pipelines — chain tools into one call

Add pipe: [stage1, stage2, stage3] to chain endpoints — stdout of each stage becomes stdin of the next, in a single LLM write. A 5-step chain is one model turn, not five. Per-stage schema validation runs before each handler. Any stage error stops the pipeline immediately.

⚡ Hot-Reload

Edit folder.yaml or a handler script — changes take effect in ~1 second. No restart. No reconnect. The watcher picks it up automatically.

⏱ Handler Timeouts & SIGKILL Escalation

A hung tool receives SIGTERM at the configured timeout (default: 30s), then SIGKILL after a 1-second grace period if it doesn't exit. The endpoint returns an error string. The filesystem never freezes.

🔁 Concurrent Shell Sessions

Two shell pipelines on the same endpoint no longer clobber each other's results. Invocation buffers are scoped by (inode, session-id)echo and cat from the same shell share a sid, so results are always routed to the right caller. Handlers are dispatched asynchronously off the FUSE thread, so parallel pipelines actually run in parallel. Abandoned slots are reaped after a 15-minute idle TTL.

🔑 Secret Management

Declare required env vars in folder.yaml. Users are prompted at install time. Secrets are stored in secrets.env and loaded on every mount.

🩺 livefolders doctor

Built-in diagnostic command. Checks FUSE installation, your config file, and every installed tool's folder.yaml. Prints actionable fixes.

✅ Input Validation

Declare constraints on any endpoint: min_length, max_length, pattern for strings; a schema: block with required fields and property types for JSON. Invalid input is rejected before the handler runs. Auto-documented in how_to.md.

📋 Structured Errors & Logs

All failures return [ERROR:CODE] message (5 parseable codes). Each endpoint also exposes a companion <endpoint>.log file recording duration_ms and stderr from the last run — readable with cat forecast.log.

💾 Stateful Tools

Declare state_file: /path/to/state.db in folder.yaml. The runtime holds an exclusive POSIX lock (flock) for the duration of each call and injects LIVEFOLDERS_STATE_FILE — no handler-side locking needed.

📊 Native Tool Schemas

A virtual anthropic_tools.json is synthesized at read time from folder.yaml, exposing each endpoint as an Anthropic-format tool definition. Hidden endpoints are excluded automatically. Inject into tools=[] directly — 6–10% fewer tokens than MCP across an 8-task benchmark.

🔍 Schema Discovery

A virtual schema.json mirrors MCP's list_tools format: tool names, descriptions, endpoint kinds, and full input constraints — machine-readable by any MCP-aware client or script, alongside the human-readable how_to.md.

🔒 Sandbox Isolation

Every handler runs in an OS-enforced sandbox. On Linux, Landlock LSM + seccomp restricts filesystem paths and blocks outbound sockets. On macOS, sandbox-exec applies equivalent SBPL rules. Network is denied by default — add network: true in folder.yaml for tools that need it. Set mode: strict in livefolders.yaml to refuse to mount if isolation cannot be applied.