Decisions

How the Signal plugin connects an agent, through signal-cli.

How is Signal connected?

Linked as a device through signal-cli, which both harnesses speak to. Link installs it as a pinned, checked release into the harness's home: the native build on Linux x86-64, else the Java build with a pinned Java runtime.

Link installing it is one command instead of asking you to install it and Java, and nothing outside the home for the sandbox to open. signal-cli is GPL-3.0, so Link downloads it from its releases and runs it as its own program, never built into Link. It reads Java's proxy settings, not HTTPS_PROXY, so Link's wrapper passes the proxy on.

Where it runs

The Signal plugin installs and links it (lnk-signal cli install, cli link), for the adapters as for its own bridge, so nothing about signal-cli is in the library every plugin links. For a harness speaking Signal, the harness plugin runs both in that harness's sandbox, reaching its adapter's hosts, rather than outside it: the program lands in a home the harness can write, so running it outside the sandbox would run what the harness wrote. The adapter is handed the program's path in Signal's settings.

Over its stdin

Link's own Signal bridge speaks to signal-cli over JSON-RPC on its stdin and stdout, not its HTTP daemon, which would listen on the loopback, where any user of the machine could send as the agent.