Run programs, each in a sandbox of its own
Your agent runs programs in its files folder, each in a sandbox of its own. Ask it to work something out in Python, convert a file or check a repository, and Link Harness has it on already.
lnk agent start # Link Harness, with run
lnk agent show --instructions # You may run sh, python3, ... in its environmentAsk it to run something
Ask it "what's 2 to the power of 100, in Python?" and it runs
python3 -c 'print(2**100)', in its files folder and in a sandbox of
its own.
What it needs
You need the agents plugins, which lnk up agents installs and which
bring Link Run, and Link Harness. There's nothing to set up, because
each start gives the agent its run. Nothing costs anything: the
programs run on your computer.
Choose what it may run
Your agent may run the programs its sandbox file's [commands] names,
of those your computer has. Link's are a shell, Python, Node, git, curl,
jq and the usual file tools, and the language servers Link
Code starts with the builds
they run (cargo, rustc, go).
# ~/Link/Agents/main/Config/sandbox.toml
[commands]
allow = ["sh", "python3", "/opt/tools/bin/convert"] # ["*"]: any program; []: no runlnk agent start --sandbox sandbox.toml # yours, kept for the agentFound on the PATH
A name is found on the system's PATH, and a program your computer
doesn't have isn't offered, so without Python your agent is never
told it has Python. There's no asking: [commands] allows or refuses.
Permissions
has the whole file.
How your agent calls it
Your agent sees one tool, run__command, which takes a program, its
arguments as they are, what it reads on its input, and the folder of
its files it runs in. A pipeline is sh -c. The answer is the exit
status and what the program printed.
Its own sandbox
Each call runs in a sandbox of its own, made from the agent's sandbox file, which ends with the call. Nothing it starts outlives the call, and the next call starts afresh.
What it reads and writes
It reads the files folder, its Home, and its instructions, skills and
conversations in its own folder (~/Link/Agents/<agent>/Agent), and
writes only the folders its [files] lets it write, work/ among
them, never chats/.
What it reaches
It reaches what the file grants: the internet through a proxy of its
own with [internet], only the hosts it names unless "*", and its
tools. With the agent's route (lnk agent route, the exit here), its
proxy goes out through it, as the agent's does, and the network as it
is and the LAN reach nothing past it.
Run a command in the background
A build, a test suite or a download runs on after the turn that started it, and your agent is told in the same conversation when it ends.
Ask for one
Ask it to "run the tests in the background and tell me how they went".
It calls run__start, which answers at once with the command's id, and
goes on with its turn. When the command ends, a message from it, never
from you, tells the agent how it ended and the end of its output, and
the agent answers in your chat. Background commands are offered to a
harness that takes messages from others, which Link Harness does.
run__start
Starts a command as run__command would, the same program, arguments,
input and folder, and answers with its id at once.
run__list, run__read and run__stop
run__list gives each command this conversation started, running or
ended: its state, how long it ran, its output's size. run__read gives
its output from a byte you give, or its end, and run__stop stops it,
with everything it started.
Only its own conversation's
Each conversation reaches only the commands it started: another's id is answered as no command of this conversation's.
Its sandbox and output
A background command runs in the same sandbox a run__command call
gets, and its output, both streams as one, is background/<id>.out in
the files folder, which the agent reads but can't write. Its ports are
its own sandbox's, so start a server and its tests in one command (sh -c "server & tests").
How long it lives
It lives as long as your agent runs: stopping or restarting the agent, or the computer, ends it, and the agent is told it was lost when it's back. Moving or deleting the agent stops every one, and none moves with it.
Its limits and settings
A command runs for at most two minutes, and 16 KB are kept of each of
its output and its errors, their start and their end. Both are keys of
your agent's spec under [tool.run], timeout and output, and
Agent Spec lists
them all.
Its background commands
Four background commands run at once, each for at most an hour, and
at most 100 start in a day, since each one's ending starts a turn. The
last 16 MB of each one's output are kept, and an ended one's record and
output stay a day once the agent was told. The keys are background
(0 turns them off), background_timeout, background_output,
background_keep and background_per_day.
More about it
Agents Security has the guarantees and gaps, and Decisions why it works this way. To work on its code, see Developing Link Run, and when it can't run a program or a command stops, Troubleshooting.
Docs
- Developing:
lnk-link-runis Link Run: an MCP server over stdio that runs an agent's programs, each call in a sandbox of its own - Decisions: Why each
runcall gets a sandbox of its own, which programs it offers, and how a command runs in the background - Troubleshooting: What to do when your agent can't run a program, reach a host, or keep a command running (Link Run)