Webhooks let your apps nudge your agent

What checks each post to your agent's webhooks. lnk-webhook is the plugin lnk agent webhook needs: your agent's bridge hands it each post, and only a post it takes reaches your agent (Webhooks).

lnk plugin add webhook    # once, before the first post

Before it's installed

Without it, your agent's bridge answers every post to its webhooks 503, so its sender tries again once it's installed.

What it takes

A post is taken only when all of these hold, and every other post is refused, each with its own answer (Security):

  • It's signed as the webhook's sender signs, with the webhook's secret, or with its previous one while it rolls: Link's scheme, or GitHub's for a webhook added --sender github (Security).
  • Its body is at most 1 MiB.
  • It carries JSON (application/json, or a type ending in +json, whose body is JSON) or text (text/plain, or any text/ type).

A post's id

A post it takes is handed back to your agent's bridge with its id: the post's link-id, or for GitHub, which signs no id, its body's SHA-256. The bridge refuses a post whose id it took before, and hands the rest to your agent as a message from webhook:<name>.

GitHub's content type

GitHub posts a form unless its webhook's content type is application/json, and a form is refused: pick application/json when you add the webhook there.

How it runs

It speaks the pushed connection contract with one command, sift: your agent's bridge runs lnk-webhook sift outside the agent's sandbox and writes it one line for each post, the webhook's name, who signs it and its secrets with the post's headers and body. It answers each with one line, the post taken or refused.

What it never reaches

It reads nothing else, calls nothing, and never reaches your agent: the bridge hands a post it took to your agent itself.

Docs

  • Security: How a post to one of your agent's webhooks is checked (Webhook Plugin), beyond what every webhook's secret gets (Link's Credentials page)