Plugins for only the parts you use

lnk is a small core, and each part of Link is a plugin, so you have only what you use and one plugin can't break another. The core only installs, runs, updates and removes them. You need lnk, which is free and which Install covers, picking your first ones.

lnk plugin list                                 # what is installed
lnk plugin show telegram                        # where it comes from, and if it is installed
lnk plugin add telegram                         # add one, with what it needs
lnk upgrade                                     # lnk and its plugins, to the latest release

What each choice installs

Picking a part installs only its plugins, and a few more come when you use them.

You pick	Plugins	`lnk` groups
agents	`sandbox`, `harness`, `link-harness`	`agent`, `sandbox`
models	`models`	`model`
tunnels	`tunnel`, `accounts`	`tunnel`, `auth`
buckets	`bucket`	`bucket`
boxes	`cloud`, `accounts`, `box`, `exit`, `sandbox`	`cloud`, `auth`, `box`, `exit`, `sandbox`
memory	`link-memory`, `models` (and `sandbox`, `harness`)	`agent memory`

The rest come when you need them:

A harness (openclaw, hermes, deepseek) when you lnk agent use it.
A connection plugin (telegram, slack, discord, signal) when you connect one.
link-memory when you turn on your agent's memory (lnk agent memory start) without picking memory.
link-web with lnk plugin add link-web, for Link Web.
link-browser with lnk agent tool add browser, for Link Browser.
link-desktop with lnk agent tool add desktop, for Link Desktop.
remote with lnk plugin add remote, to see and control your agents from your Local Link account in the browser (Remote).
aws or gcp when you connect that cloud.
secret when you first keep a secret (lnk secret create), for an agent to be granted it (Secrets).

Add or remove a plugin

lnk plugin lists, adds and removes plugins, each with the plugins it needs, and lnk offers a plugin when a command needs one.

lnk plugin list             # every plugin, and which are installed
lnk plugin add telegram     # also installs harness and sandbox, which it needs
lnk plugin remove bucket    # stops what it runs, deletes the program, but its settings and files stay

add installs from the release of lnk's own version, with the plugins it needs:

Plugin	Needs
A harness, a connection or `link-memory`	`harness`, which needs `sandbox`
`aws` and `gcp`	`cloud`
`tunnel`	`accounts`, whose `lnk auth login` it connects with
`box`	`cloud` and `accounts`, whose login tags your boxes as yours
`exit`	`sandbox`, whose proxy is its exit's home side

remove also removes what needs the plugin. remove harness takes every harness (link-harness, openclaw, hermes, deepseek), link-memory and the connections, and remove cloud takes aws, gcp and box. Each stops what it runs first, so remove harness stops your agents.

A plugin a command needs

Run a command whose plugin you don't have, and lnk offers to install it. Outside a terminal, typed or in your script, it installs it without asking and says so: the command named what you wanted. The same goes for a plugin it needs that isn't installed, such as accounts for box or tunnel.

Plugins that go together

Some plugins go with others: a box with exit and sandbox, a tunnel with models, Link harness with link-memory, link-web and measure. lnk up takes them along, and the first command of a plugin whose companions you don't have asks once in a terminal; a no is kept in ~/.lnk/offered.toml and not asked again, and lnk plugin add adds one later. Without a terminal it says once what adds them. Link harness's scheduler, run and file are its needs, so they come with it.

A feature that needs another plugin

A feature that needs another plugin installs it the same way: lnk agent backup and restore the bucket plugin, lnk agent move <cloud> the box and cloud plugins, a bucket in a cloud account (not a folder's) the cloud plugin. In a terminal it asks first, naming everything it will install; a command naming the plugin itself (lnk agent connect slack, lnk agent use hermes, lnk agent tool add web) doesn't ask. A plugin's own call to lnk underneath installs nothing: a missing plugin there is named, with the command that installs it.

Add a plugin from outside Link

A harness Link doesn't ship comes from its own GitHub repository, signed by its maker's key, not Link's. The harnesses Link ships are in Use another harness.

lnk plugin add --url https://github.com/example/lnk-example          # shows its key and asks
lnk plugin add --url https://github.com/example/lnk-example --yes    # in a script: trusts the key without asking
lnk plugin list                                           # the plugins of Link, then those from outside, with where from
lnk plugin remove example                                 # the program, and the trust lnk puts in its key

add installs the plugin from the repository's latest release. The first time, it shows the release's key and asks, and lnk then keeps the repository and the key in ~/.lnk/settings.toml.
lnk upgrade updates it from the same repository, and only with a release signed by that key.
Only a plugin can be added this way: its lnk-<name> must answer --link-describe as itself, a plugin and not a program of its own, and its name can't be one of Link's plugins'. A harness adapter is one (Harness adapters).
It runs as you, like any program you install. Link's sandbox confines the harness it installs, not the plugin itself (Security).
lnk agent move to a box adds it there from the same repository, trusting only the key this computer trusted.

Upgrade

lnk upgrade updates lnk and every installed plugin, only from a release whose signature it checked.

lnk upgrade          # lnk and every installed plugin, to the latest release
lnk upgrade 0.14.0   # or to this version
lnk upgrade --check  # only say whether a newer release is out

Each release is checked against its signature first, and if anything fails, what you have stays as it was. Its signed version is read before anything else: a release of the version you have, every plugin included, downloads nothing. lnk up, lnk agent status and lnk tunnel open say when a newer release is out, at most once a day for the first two, and never with --json, off a terminal or with LNK_UPDATE_NOTICE=off. They never wait for the network: a day after the last check, they start lnk upgrade --check in the background, and the next command says what it found.

Installed with Homebrew

Installed with Homebrew, lnk upgrade refuses, saying lnk was installed with Homebrew and to use brew to change it: brew upgrade lnk upgrades it.

Uninstall

lnk uninstall has each plugin stop what it runs, such as your agents and your exits, and removes lnk and its plugins. Everything Link kept stays unless you pick it, so installing again picks it up.

lnk uninstall                               # asks what else should go
lnk uninstall --yes                         # only lnk and its plugins
lnk uninstall --yes --delete agents,relay   # and these parts
lnk uninstall --yes --all                   # and every part

What each part takes

Each plugin names what it keeps, and these are Link's own parts: agents, your agents, their memory, settings and keys, and what agents that left kept (~/Link/History/Agents); personal, your files in ~/Link/Personal; buckets, bucket settings and encrypted buckets' passwords; clouds, cloud keys and Link's SSH key and authority for your boxes; relay, your relay login; rest, everything else in ~/.lnk and ~/Link. --all picks all of them.

Before you pick a part

Back up an agent first with lnk agent backup, because agents deletes its memory and conversations. personal deletes files you never pushed to a cloud, and buckets deletes the only copy of encrypted buckets' passwords. clouds leaves your boxes running, and billing. rest takes folders you made in ~/Link too. On a Mac, each part's Keychain items go with it.

What else goes, and what stays

Another program named lnk-* beside lnk goes too (what it may run). It leaves this machine on your account's list of machines (lnk auth logout first signs it out), anything in your clouds, and the bots and apps you made for connections. Delete a Telegram bot with BotFather's /deletebot, a Slack app at api.slack.com/apps and a Discord application, and unlink Signal on the phone.

Installed another way

Installed with Homebrew, it prints the command that removes the programs. Installed with cargo, it prints cargo uninstall with the crates cargo installed them from, and deletes any it doesn't track.

Get help

lnk help lists every command, and says what each one takes.

lnk help                  # the groups, and the commands of lnk itself
lnk help bucket           # the commands of a group
lnk help bucket push      # one command, with every flag
lnk plugin list           # the plugins, and which are installed

Where things live

Link keeps everything in two folders, never a third. lnk folder shows both, lnk folder move points Link at one that moved and lnk folder create makes a new, empty Link folder.

~/.lnk is this machine's: bin/lnk and bin/lnk-<plugin>, the core and its plugins side by side (LNK_INSTALL_DIR moves them), and Link's settings and each plugin's. In it, settings.toml says where each plugin from outside Link comes from, and its key; cache/ holds what Link can fetch or make again.
The Link folder, ~/Link, is yours: your files (Personal) and your agents' (Agents). A file in it, .link-folder, marks it as a Link folder with an ID of its own.
Outside the two folders, only the system's registrations: services and the PATH line in your shell's startup file.

Move the Link folder

Every path Link stores is relative to its folder, so the Link folder can move. Put it anywhere in your home folder, in Documents or on the Desktop, then run lnk folder move <where it is now>. Link writes its place, relative to your home folder, to ~/.lnk/settings.toml, and points what your agents' harnesses keep at the new place: each path into the old one in their settings and state is rewritten, as it is when an agent moves to another machine.

A Link folder that moved without `lnk`

When the Link folder isn't where it was, the next lnk command asks where it went, or whether to make a new one (lnk folder create). It never searches the disk.

More about it

What to do when a plugin won't install or update is in Troubleshooting. What's checked before anything installs is in Security. Why it works this way is in Decisions. How to build a plugin is in Plugins under Developing.

Docs

Plugin Contracts: A plugin exposes a versioned interface
Install: Install lnk, then pick the parts of Local Link you want
Security: What's protected: what runs as lnk and Link's plugins is what Link released, a plugin from outside Link is what its maker released under the key you trusted, and relay servers run only signed builds
Decisions: Why lnk is installed, split and updated the way it is
Troubleshooting: What to do when lnk doesn't install, or a plugin won't install or update (Install, Plugins)
Command Index: Find the commands declared by the core and registered plugins