registry / thinkpool-pair / 0.7.140

thinkpool-pair@0.7.140

Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package is a CLI bridge for ThinkPool rooms that intentionally connects local coding-agent CLIs to ThinkPool/Supabase services and can optionally install an autoupdate service.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs thinkpool-pair CLI or explicit service/provider/auth commands.

Impact

Runtime shares terminal/session events with configured ThinkPool room; optional persistence keeps the bridge running when requested.

Mechanism

User-invoked local agent bridge with optional supervised service install.

Rationale

Suspicious primitives are consistent with the declared CLI bridge: networking, token use, child-process spawning, and optional service persistence are visible and user-invoked. I found no install-time execution, covert exfiltration, destructive behavior, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonbridge.mjsservice.mjsauth-store.mjsprovider.mjssession-store.mjsclaude-session.mjsbyok-detect.mjs~/.thinkpool-pair~/.config/systemd/user/thinkpool-pair-<room>.service~/Library/LaunchAgents/io.thinkpool.pair.<room>.plist%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/thinkpool-pair-<room>.cmd

Network endpoints6

thinkpool.iodaytvtakmlixpfbbqzjd.supabase.coregistry.npmjs.org/thinkpool-pair/latestapi.anthropic.comopenrouter.ai/apiapi.z.ai/api/anthropic

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json exposes bin bridge.mjs, no install/preinstall/postinstall hooks.
bridge.mjs has embedded Supabase anon JWT and sends bearer tokens to ThinkPool/Supabase APIs during explicit bridge runtime.
service.mjs can install launchd/systemd/Windows startup persistence, but only through service commands, not install-time.
bridge.mjs/claude-session.mjs spawn local agent CLI sessions and can auto-approve bounded spawned lanes as part of the product behavior.

Evidence against

No lifecycle scripts execute on npm install; only release script is present.
Network hosts are package-aligned: thinkpool.io, daytvtakmlixpfbbqzjd.supabase.co, registry.npmjs.org, provider model APIs.
Auth-store/provider/session files write under ~/.thinkpool-pair or user-selected service paths for local state, not harvested secrets.
No evidence of credential harvesting, arbitrary exfiltration, destructive action, or hidden payload loading in inspected source.
Service persistence is user-invoked and room-code labels are validated in service.mjs.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 27 file(s), 543 KB of source, external domains: api.anthropic.com, api.z.ai, daytvtakmlixpfbbqzjd.supabase.co, openrouter.ai, registry.npmjs.org, thinkpool.io, www.apple.com

Source & flagged code

3 flagged

bridge.mjsView file

Lines 74-114javascript

74// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

75// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

76// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

77// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

78const flowRedispatch = new Map()

79// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

80// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

81// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

82// broadcasts; without persistent state the cap can never bite.

83const flowBudgets = new Map()

84import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision } from './cross-terminal.mjs'

85import { turnInFlight } from './update-gate.mjs'

86import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, loadSummary, saveSummary } from './session-store.mjs'

87import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'

88import { makeThrottledTrack } from './presence.mjs'

90// Public client creds (the same anon values the web app ships — safe to embed).

91// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

92const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

93const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

94const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

96// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

97// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

98// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

99// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

100// directly-started bridge with no account login — those writes go unattributed,

101// never owner-spoofed (the server treats a missing/!owner token accordingly).

102let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

103

104// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

105// Kept comfortably under realtime payload limits once base64'd.

106const SCROLLBACK_MAX = 120_000

107

108// node-pty is a native module — loaded lazily so a friendly message shows

109// if it isn't built yet.

110// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

111// so a failed node-pty build must not block the bridge — it only disables the

112// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

113let pty = null

114try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

Source & flagged code

3 flagged · loading source

bridge.mjsView file

94patternName = supabase_service_key severity = critical line = 94 matchedText = const SU...tqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

94patternName = supabase_service_key severity = critical line = 94 matchedText = const SU...tqo'

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

service.mjsView file

22import path from 'node:path' L23: import { execSync } from 'node:child_process' L24: ... L26: // exactly one account service per machine (a second install replaces it). L27: // Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so L28: // this is the security chokepoint: reject anything that isn't a plain alnum code ... L44: // `home` is the platform-correct, runtime-expanded home token ("$HOME" on darwin under L45: // /bin/bash; "$$HOME" inside a systemd unit so systemd emits a literal $HOME to bash). L46: const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/*/node_modules/thinkpool-pair 2>/dev/null` ... L48: // The version installing the service. By DEFAULT the service is pinned to this exact L49: // version (not @latest) so a future bad npm publish can't auto-roll to every machine's L50: // always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

service.mjsView on unpkg · L22

Findings

2 Critical3 Medium5 Low

CriticalCritical Secretbridge.mjs

CriticalSecret Patternbridge.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceservice.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bridge.mjsView file

Lines 74-114javascript

74// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

75// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

76// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

77// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

78const flowRedispatch = new Map()

79// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

80// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

81// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

82// broadcasts; without persistent state the cap can never bite.

83const flowBudgets = new Map()

84import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision } from './cross-terminal.mjs'

85import { turnInFlight } from './update-gate.mjs'

87import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'

88import { makeThrottledTrack } from './presence.mjs'

90// Public client creds (the same anon values the web app ships — safe to embed).

91// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

92const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

93const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

96// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

97// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

98// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

99// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

100// directly-started bridge with no account login — those writes go unattributed,

101// never owner-spoofed (the server treats a missing/!owner token accordingly).

102let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

103

104// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

105// Kept comfortably under realtime payload limits once base64'd.

106const SCROLLBACK_MAX = 120_000

107

108// node-pty is a native module — loaded lazily so a friendly message shows

109// if it isn't built yet.

110// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

111// so a failed node-pty build must not block the bridge — it only disables the

112// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

113let pty = null

114try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running