Security
What lnk-codex installs and runs, beyond what Link's sandbox
guarantees every harness
(Agents Security).
What it installs
Node from nodejs.org, checked against the SHA-256 in its source, and
@agentclientprotocol/codex-acp from npm at its pinned version. npm
resolves that package's own dependencies, Codex's among them, when it
installs: they aren't pinned by Link.
What it runs
lnk-codex serve, and behind it one codex-acp on that Node, in
Link's sandbox. Codex there runs any command its model asks for,
without asking: the sandbox bounds what that reaches.
Its keys
The model's key and the endpoint's are in .lnk/codex/link.env,
mode 600, and the model's reaches Codex in its environment, never on a
command line. With the key held by Link's proxy, the file holds a
placeholder.
What it sends OpenAI
The model's requests, to the address Link gives it. Its update checks and analytics are off in its settings.