Models and Secrets on the Wire

Asking for one

A program asks for one by its path (GET /_link/...), or, sending every request through its proxy, at the proxy's own address (GET http://127.0.0.1:<port>/_link/..., with the run's proxy secret), the same call, and a page's refused as by its path.

Handed to its bridge

For a call to a route the proxy checks the URL secret, when the route needs one, and hands the call to the route's bridge on a Unix socket, proving each call as the agent it was bound to call as, with that agent's key (a run with no agent is run-<name>, bound for the run alone): the request's head, what the route is given (a key, secrets, tools), then the body as it comes.

Its verdict

The bridge says its verdict before anything else, which the wire's log keeps, then answers; a call whose program hangs up is cut off at the bridge too.

One bridge a plugin, for each user

Its socket is in Link's settings (bridges/<plugin>.sock), which no sandbox sees. The first proxy that needs it starts it, as the proxy's user, with an environment of its own (the system's PATH, and the settings' HOME), never the program's; a lock keeps it to one, and it exits once no call has come for a while, or when its socket is no longer its own.

Only proved calls, and nothing held

Every call is proved against the machine's keyring before its action is read, as every bridge's is (contracts): another program on the machine, or an agent once stopped, gets nothing. A key or secret is given with each call, from the bind the proxy holds, and the bridge keeps it no longer than the call.

On each OS

On Linux it is a network namespace of its own, the ports relayed in through a socket in the folder loopback names (700), by a relay that checks each port outside and carries nothing else. On macOS it is Seatbelt's rules allowing those ports alone.

One kind of network

A confinement's network is one kind of link_sandbox_client::Net (closed, the loopback, its proxy, other sandboxes' proxies, or the host's), so the loopback alone beside a proxy, the internet, [lan] or [browser] can't be written.

One request a connection

Each is rewritten to close its connection after its response, so the next one is read too, with no protocol switch and one way to tell its body's length.

On the proxy itself

The same filter answers on the proxy at /_link/s/<secret>/local/<port> ($LNK_LOCAL_MODEL_<PORT>), where the secret must be the proxy's and the port one of the spec's model ports, else a 403.

On macOS

That's the only way to the runtime: Seatbelt can't filter a port, so the model's port is closed to the sandbox. An agent's harness is set up with the proxy's address, with Host set to the runtime's. Its proxy is on a loopback port fixed per agent, the last of its block: main's is 40781.

Its placeholder

The program reaches http://127.0.0.1:<its proxy's port>/_link/model with a placeholder key: the key's prefix (sk-ant-api03-, ...), link-wire- and a tag, none of the key itself.

What its bridge does

The route's bridge (the models plugin's) is handed each call, and:

• refuses a request without that placeholder as its key, so another program on the machine gets no key added;
• reads each request: a head of at most 16 KiB, a body with a length (never chunked), at most 32 MB, arriving within 2 minutes, and JSON;
• passes only inference, by exact method and path: Anthropic's messages, token counts and models; OpenAI's chat completions, responses, embeddings and models; OpenRouter's the same and its completions, under /api;
• drops whatever credentials, Host and hop-by-hop headers the program sent;
• adds the real key and speaks TLS to the provider, checking its certificate against the machine's trust store;
• answers one request per connection from the program, and keeps its own connection to the provider open for the next.

Server-side tools

It removes the provider's server-side tools by allow-list, with MCP servers, containers and OpenRouter's web plugins, :online on a model or any of its fallbacks (models), and refuses OpenRouter's presets (@preset/...), which can bring their own.

A URL to fetch

It refuses a request asking the provider to fetch a URL: a web address, in any case, under any key ending in url or _data (image_url, OpenRouter's file_data), in any block. Only the input of a tool's call (tool_use, function_call and the like) is left out, never the request's own.

Its usage

For a request for a model's answer (messages, chat completions, completions, responses), it asks for it uncompressed (Accept-Encoding: identity), and reads the usage the answer gives as it passes it on, unchanged and never held back: the numbers of its tokens, added to the agent's count for lnk measure (~/.lnk/measure/tokens/<agent ID>.json, 600), never a word of the answer.

The key itself

The route names the key, the caller's model's or fallback's: the models plugin's bridge reads it at each call from your secrets granted the caller (routes.json holds none), refusing a caller granted none. It is never in the sandbox, its environment or a command line.

Its rule

Each secret comes with its rule, data the plugin owning the service gives (lnk-telegram rule --json, contracts): one host, the paths a call may take, where the secret goes (in a path, or a header), and the paths refused.

Its placeholder

The harness is set up with http://127.0.0.1:<its proxy's port>/_link/secret/<name> as the service's root, and in place of the secret a placeholder: link-wire- and a tag made as a model key's is, random for each run and holder, after the part the rule says isn't secret (a bot's id, digits only).

What its bridge does

The proxy hands each call to its secret route, whose bridge (the secret plugin's):

• refuses a call without that placeholder in its path or header, so another program on the machine can't use the secret;
• reads each request's head, as for any request, and passes only GET and POST (or the rule's methods) of the rule's paths, taken as sent: a name of letters and digits (Telegram's /bot<token>/<method>), or a path of plain parts (/file/bot<token>/<path>), no encoded, relative or empty part;
• refuses the rule's refused paths, whatever their case (Telegram's setWebhook, logOut and close, which would hand the bot's updates, or the bot, elsewhere);
• puts the real secret in the path or header, drops whatever Host, Authorization and hop-by-hop headers the program sent, closes the program's connection after its answer, and passes the body as it comes, long polls and uploads too.

Its host

It speaks TLS to the rule's one host (a name, never a wildcard or an address), checking its certificate against the machine's trust store, and keeps that connection open for the next call when the request's body has one length. A chunked upload is the last call on its connection. The host is dialed like any host, whatever hosts the spec lists.

Its routes, never written

An agent's proxy, which its service starts again, reads its routes from ~/.lnk/sandbox/<name>.routes.json (600), which names each secret and holds none: the bridge reads it from the store, granted the caller, at each call. A secret is never in the sandbox, its environment or a command line.

Sent again

A model request on a kept connection that the provider closed with nothing back is sent again, on a new connection, only when it wasn't written, or the connection closed within half a second of it: the provider was closing it as it was taken. One closed later may have been run, and is answered as a failure, never sent twice.