Configuration
The files lnk sandbox keeps, and what each one holds.
Sandbox (lnk sandbox)
A program run by lnk sandbox run keeps only PATH, HOME, TERM,
COLORTERM, LANG, LC_ALL, LC_CTYPE, TZ, USER, LOGNAME and
SHELL from your shell. lnk help <command> lists the environment
variables each command reads, as plugin.toml
declares them.
A proxied policy's files
What ~/.lnk/sandbox/ (700) holds for each policy: its rules, one
Seatbelt profile per policy, and these.
~/.lnk/sandbox/<name>.routes.json (600)
A proxied policy's routes (its tools, models, secrets, pages it opens)
and who calls them, which its proxy hands each call's route to its
bridge with. Never for lnk sandbox run, which hands its proxy them on
a pipe.
Nothing secret
A hosted model's key and the secrets are named, each read by its bridge from your secrets at each call; one holding a value is refused, written or read.
~/.lnk/sandbox/<name>.url-secret (600)
The secret the URLs of a proxied policy's routes carry, which its proxy requires on each of them.
Bridges
~/.lnk/bridges/<plugin>.sock is a plugin's bridge for its proxies'
routes (models, secret, sandbox), this user's. Its calls are
proved against the machine's keyring.
How long it runs
It's started by the first proxy that needs it, and gone once idle, or as soon as the keyring binds no one (the last agent stopped, the last sandbox ended), ending any call still open there, a long poll's among them; a lock beside it keeps it to one.
The wire
What the proxies log, count and wait on.
wire.log and asks/<id>.json
~/.lnk/sandbox/wire.log (600) is lnk sandbox log's: one JSON object
per proxied call. ~/.lnk/sandbox/asks/<id>.json (600) is a question a
proxy is waiting on (lnk sandbox asks).
~/.lnk/sandbox/traffic/<pid>.json (600)
lnk sandbox traffic: the bytes a running proxy has carried each way,
written every 5 seconds while it changes, with when its proxy started.
Read only by lnk sandbox traffic, whose --json other plugins read.
When it goes
Its proxy removes it when its program ends, or lnk sandbox traffic
does once its proxy is gone.
~/.lnk/sandbox/stopped and paused/<sandbox>
While stopped exists, every proxy refuses every call. While
paused/<sandbox> (600) exists, that sandbox's proxy refuses every
call.
Tools
The tools that run outside, and the hubs of those shared.
~/.lnk/sandbox/tools/<name>.json (600)
A tool that runs outside (lnk sandbox tool add): its command, or
mcp-remote and its URL, and its environment, headers included.
~/.lnk/sandbox/tools/<name>-<key>.sock (600), .lock, .log
A shared tool's hub (--shared): its socket while it runs, its lock,
and its log.
<key>
It names the tool as it's defined, signed with tools/.key (600), a
secret made once on this machine, so the name gives away none of the
tool's tokens.
~/.lnk/sandbox/settings.toml
The sandbox plugin's settings, over Link's. A proxy, the sandbox's
bridge and a shared tool's hub read it from the folder they're handed,
never through the HOME they run with, which for an agent is its
harness's. A file that can't be read is said, and Link's are used.
ask_wait
How long a question waits for your answer: "120s", at most "24h";
silence is no. An agent's sandbox waits as its spec's [connections] ask_wait says instead.
tool_starts and tool_sessions
tool_starts is the tool servers the sandbox's bridge starts at once
(2), and tool_sessions the tool sessions one sandbox keeps (8).
tool_idle and shared_idle
tool_idle is how long a tool's session stays, its server with it,
with no call ("5m"), and shared_idle how long a shared tool's server
stays up with no session open ("10m").
On Linux
What a sandbox keeps of this machine and of its runs, on Linux alone.
~/.lnk/sandbox/placeholders.json (600)
The empty placeholders made where a project's dot file isn't, while sandboxes run, and which runs hold each; removed with the last.
~/.lnk/sandbox/bwrap-version (600)
What a sandbox's start found of this machine, so the next doesn't ask
again: whether its bubblewrap can refuse user namespaces inside, and
the checks that passed (bubblewrap makes a sandbox here, and wrap's
requirements hold). lnk sandbox ready removes it and checks afresh.
When it's asked again
It holds for this boot, kernel and user, the kernel's user namespace
settings, and these copies of bubblewrap and lnk-sandbox: any of
those changed, or a file that isn't a plain one only you may write, and
they're asked again.
~/.lnk/specs/sandbox.toml (600)
The sandbox specs run here, each by its path and a hash of what it opens (spec).