registry / thinkpool-pair / 0.7.147

thinkpool-pair@0.7.147

Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked ThinkPool bridge for sharing local coding-agent terminals to a room; risky primitives are aligned with that advertised function and gated by CLI/login/room actions.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs thinkpool-pair, logs in, joins a room, or explicitly runs install-service/provider/bind commands.

Impact

Local agent activity and selected project context can be relayed to the user's ThinkPool room as intended; no evidence of covert exfiltration, install-time execution, destructive payload, or hidden persistence.

Mechanism

Realtime bridge for local coding-agent sessions with optional user-installed service persistence.

Rationale

Static inspection found powerful network, shell, service, and AI-agent orchestration behavior, but it matches the package's stated bridge functionality and is activated by explicit runtime commands rather than install/import hooks. I found no hardcoded private credential, covert credential/file harvesting, hidden payload, or unconsented lifecycle mutation of AI-agent controls.

Evidence

package.jsonbridge.mjsaccount.mjsservice.mjsauth-store.mjsprovider.mjsclaude-session.mjsbyok-detect.mjsREADME.md~/.thinkpool-pair/auth.json~/.thinkpool-pair/provider.json~/.thinkpool-pair/dirs.json~/.thinkpool-pair/served.json~/Library/LaunchAgents/io.thinkpool.pair.*.plist~/.config/systemd/user/io.thinkpool.pair.*.service%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/thinkpool-pair-*.cmd

Network endpoints7

daytvtakmlixpfbbqzjd.supabase.cothinkpool.ioregistry.npmjs.org/thinkpool-pair/latestapi.anthropic.comopenrouter.ai/apiapi.z.ai/api/anthropiclocalhost:4000

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

bridge.mjs exposes remote room control surfaces that can open terminals, relay input, download room files, and spawn Claude lanes when the user runs the CLI.
service.mjs can write launchd/systemd/Startup persistence, but only via explicit install-service command.
bridge.mjs/account.mjs poll npm registry and can restart/update only in service/update flows.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; only bin thinkpool-pair -> bridge.mjs and release script.
bridge.mjs embedded JWT is documented Supabase anon client key, not a private secret; owner tokens come from user login/env and are not hardcoded.
Network traffic is package-aligned: ThinkPool Supabase, thinkpool.io APIs, npm registry update checks, and user-configured BYOK/model endpoints.
auth-store.mjs/provider.mjs store user-selected auth/provider data under ~/.thinkpool-pair with mode 0600 for sensitive files; no broad credential harvesting found.
service.mjs validates room codes before shell/service interpolation and persistence is user-invoked, not install/import-time.
claude-session.mjs adds ThinkPool-specific agent prompts and permission gates at runtime; no unconsented lifecycle AI-agent control-surface mutation found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 27 file(s), 559 KB of source, external domains: api.anthropic.com, api.z.ai, daytvtakmlixpfbbqzjd.supabase.co, openrouter.ai, registry.npmjs.org, thinkpool.io, www.apple.com

Source & flagged code

3 flagged

bridge.mjsView file

Lines 74-114javascript

74// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

75// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

76// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

77// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

78const flowRedispatch = new Map()

79// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

80// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

81// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

82// broadcasts; without persistent state the cap can never bite.

83const flowBudgets = new Map()

84import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'

85import { turnInFlight } from './update-gate.mjs'

86import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq, loadSummary, saveSummary } from './session-store.mjs'

87import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'

88import { makeThrottledTrack } from './presence.mjs'

90// Public client creds (the same anon values the web app ships — safe to embed).

91// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

92const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

93const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

94const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

96// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

97// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

98// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

99// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

100// directly-started bridge with no account login — those writes go unattributed,

101// never owner-spoofed (the server treats a missing/!owner token accordingly).

102let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

103

104// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

105// Kept comfortably under realtime payload limits once base64'd.

106const SCROLLBACK_MAX = 120_000

107

108// node-pty is a native module — loaded lazily so a friendly message shows

109// if it isn't built yet.

110// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

111// so a failed node-pty build must not block the bridge — it only disables the

112// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

113let pty = null

114try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

Source & flagged code

3 flagged · loading source

bridge.mjsView file

94patternName = supabase_service_key severity = critical line = 94 matchedText = const SU...tqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

94patternName = supabase_service_key severity = critical line = 94 matchedText = const SU...tqo'

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

service.mjsView file

22import path from 'node:path' L23: import { execSync } from 'node:child_process' L24: ... L26: // exactly one account service per machine (a second install replaces it). L27: // Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so L28: // this is the security chokepoint: reject anything that isn't a plain alnum code ... L44: // `home` is the platform-correct, runtime-expanded home token ("$HOME" on darwin under L45: // /bin/bash; "$$HOME" inside a systemd unit so systemd emits a literal $HOME to bash). L46: const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/*/node_modules/thinkpool-pair 2>/dev/null` ... L48: // The version installing the service. By DEFAULT the service is pinned to this exact L49: // version (not @latest) so a future bad npm publish can't auto-roll to every machine's L50: // always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

service.mjsView on unpkg · L22

Findings

2 Critical3 Medium5 Low

CriticalCritical Secretbridge.mjs

CriticalSecret Patternbridge.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceservice.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bridge.mjsView file

Lines 74-114javascript

74// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

75// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

76// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

77// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

78const flowRedispatch = new Map()

79// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

80// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

81// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

82// broadcasts; without persistent state the cap can never bite.

83const flowBudgets = new Map()

84import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'

85import { turnInFlight } from './update-gate.mjs'

87import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks } from './event-id.mjs'

88import { makeThrottledTrack } from './presence.mjs'

90// Public client creds (the same anon values the web app ships — safe to embed).

91// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

92const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

93const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L94

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L94

96// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

97// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

98// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

99// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

100// directly-started bridge with no account login — those writes go unattributed,

101// never owner-spoofed (the server treats a missing/!owner token accordingly).

102let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

103

104// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

105// Kept comfortably under realtime payload limits once base64'd.

106const SCROLLBACK_MAX = 120_000

107

108// node-pty is a native module — loaded lazily so a friendly message shows

109// if it isn't built yet.

110// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

111// so a failed node-pty build must not block the bridge — it only disables the

112// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

113let pty = null

114try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running