registry / thinkpool-pair / 0.7.156

thinkpool-pair@0.7.156

Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs thinkpool-pair CLI or explicitly invokes install-service/account/flow features.

Impact

Can run local agent sessions, share terminal/agent output to ThinkPool rooms, spawn additional Claude lanes, and persist as an OS user service when requested.

Mechanism

package-aligned agent bridge with optional persistent service and autonomous lane spawning

Policy narrative

Static inspection supports a legitimate but powerful ThinkPool local-agent bridge: it connects to ThinkPool/Supabase, starts Claude/other CLI sessions, can spawn autonomous lanes, and can install a user service when explicitly requested. I did not find npm lifecycle execution, unconsented foreign agent control-surface mutation, credential harvesting, or off-domain exfiltration.

Rationale

The risky primitives are package-aligned and user-invoked, with no lifecycle hook or concrete unconsented attack behavior. Because it provides agent orchestration and permission-bypass-capable lanes, warn rather than block.

Evidence

package.jsonbridge.mjsaccount.mjsservice.mjsauth-store.mjsbyok-detect.mjsflow-worktree.mjsflow-assembly.mjs~/.thinkpool-pair/auth.json~/.thinkpool-pair/dirs.json~/.thinkpool-pair/served.json~/.thinkpool-pair/default-dir~/Library/LaunchAgents/io.thinkpool.pair*.plist~/.config/systemd/user/io.thinkpool.pair*.service%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/thinkpool-pair-*.cmd.claude/worktrees

Network endpoints7

daytvtakmlixpfbbqzjd.supabase.cothinkpool.ioregistry.npmjs.org/thinkpool-pair/latestapi.anthropic.comapi.anthropic.com/v1/modelsopenrouter.ai/apiopenrouter.ai/api/v1/models

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bridge.mjs exposes agent tools that can spawn additional Claude lanes and may inherit bypassPermissions.
bridge.mjs flow dispatch opens autonomous flow lanes with mode 'bypassPermissions'.
service.mjs can create boot-persistent LaunchAgent/systemd/Startup entries, but only through installService CLI path.
account.mjs can spawn child bridge processes and auto-update via npx @latest when service env is set.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; only bin thinkpool-pair.
Public Supabase anon key is labeled client credential, not a private secret.
service.mjs validates room codes before interpolating into service labels/commands.
auth-store.mjs stores only this package's account files under ~/.thinkpool-pair.
Network calls target package-aligned ThinkPool/Supabase/npm/model-provider endpoints.
No import-time foreign AI-agent config writes such as .mcp.json, CLAUDE.md, or global agent settings found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 29 file(s), 588 KB of source, external domains: api.anthropic.com, api.z.ai, daytvtakmlixpfbbqzjd.supabase.co, openrouter.ai, registry.npmjs.org, thinkpool.io, www.apple.com

Source & flagged code

6 flagged

bridge.mjsView file

Lines 75-115javascript

75// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

76// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

77// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

78// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

79const flowRedispatch = new Map()

80// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

81// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

82// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

83// broadcasts; without persistent state the cap can never bite.

84const flowBudgets = new Map()

85import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'

86import { turnInFlight } from './update-gate.mjs'

87import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'

88import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'

89import { makeThrottledTrack } from './presence.mjs'

91// Public client creds (the same anon values the web app ships — safe to embed).

92// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

93const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

94const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

95const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

97// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

98// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

99// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

100// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

101// directly-started bridge with no account login — those writes go unattributed,

102// never owner-spoofed (the server treats a missing/!owner token accordingly).

103let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

104

105// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

106// Kept comfortably under realtime payload limits once base64'd.

107const SCROLLBACK_MAX = 120_000

108

109// node-pty is a native module — loaded lazily so a friendly message shows

110// if it isn't built yet.

111// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

112// so a failed node-pty build must not block the bridge — it only disables the

113// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

114let pty = null

115try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

•matchType = previous_version_dangerous_delta matchedPackage = thinkpool-pair@0.7.154 matchedIdentity = npm:dGhpbmtwb29sLXBhaXI:0.7.154 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

flow-assembly.mjsView file

Lines 1-34javascript

1// Thinkpool Flow — Step 7: assembly + delivery.

2//

3// Lanes each built a DISJOINT slice in its own git worktree (flow-worktree.mjs).

4// Assembly collects those slices into one final app, then delivers it. The MVP

5// artifact ("BLEAK SWORD") is a SINGLE self-contained index.html — no build step,

6// no external assets — but lanes own separate module files (audio.js, sprites.js,

7// combat.js, render.js + an index.html shell that imports them). So assembly must

8// INLINE those modules back into one index.html.

9//

10// Export-destination decision (locked with the spec): a finished Flow ships as a

11// per-Flow git repo (initRepo) + a zip Buffer (zipDir) + an OPTIONAL best-effort

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

account.mjsView file

Lines 1-21javascript

1/* account.mjs — account-mode bridge (Phase 1).

2 One `npx thinkpool-pair` per ACCOUNT instead of per room:

3 login — link this device to your ThinkPool account (realtime handoff).

4 bind — map a room code → a working directory on THIS machine.

5 account — discover your code sessions and serve each one (a headless child

6 bridge per room, run in its bound directory). Reuses the proven

7 single-room bridge verbatim; the supervisor only adds discovery.

8 Spec: docs/specs/2026-06-16-account-bridge.md */

9import { spawn } from 'node:child_process'

10import

Source & flagged code

6 flagged · loading source

bridge.mjsView file

95patternName = supabase_service_key severity = critical line = 95 matchedText = const SU...tqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

95patternName = supabase_service_key severity = critical line = 95 matchedText = const SU...tqo'

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

flow-assembly.mjsView file

14// L15: // Node built-ins ONLY (fs, path, child_process, zlib) — bridge ships as npm L16: // thinkpool-pair with no new deps. Pure over injected fs/git/gh/readFile so the

High

Child Process

Package source references child process execution.

flow-assembly.mjsView on unpkg · L14

service.mjsView file

22import path from 'node:path' L23: import { execSync } from 'node:child_process' L24: ... L26: // exactly one account service per machine (a second install replaces it). L27: // Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so L28: // this is the security chokepoint: reject anything that isn't a plain alnum code ... L44: // `home` is the platform-correct, runtime-expanded home token ("$HOME" on darwin under L45: // /bin/bash; "$$HOME" inside a systemd unit so systemd emits a literal $HOME to bash). L46: const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/*/node_modules/thinkpool-pair 2>/dev/null` ... L48: // The version installing the service. By DEFAULT the service is pinned to this exact L49: // version (not @latest) so a future bad npm publish can't auto-roll to every machine's L50: // always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

service.mjsView on unpkg · L22

account.mjsView file

1/* account.mjs — account-mode bridge (Phase 1). L2: One `npx thinkpool-pair` per ACCOUNT instead of per room: L3: login — link this device to your ThinkPool account (realtime handoff). ... L8: Spec: docs/specs/2026-06-16-account-bridge.md */ L9: import { spawn } from 'node:child_process' L10: import { fileURLToPath } from 'node:url'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

account.mjsView on unpkg · L1

Findings

3 Critical3 High4 Medium5 Low

CriticalCritical Secretbridge.mjs

CriticalPrevious Version Dangerous Deltabridge.mjs

CriticalSecret Patternbridge.mjs

HighChild Processflow-assembly.mjs

HighShell

HighRuntime Package Installaccount.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceservice.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

bridge.mjsView file

Lines 75-115javascript

75// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

76// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

77// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

78// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

79const flowRedispatch = new Map()

80// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

81// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

82// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

83// broadcasts; without persistent state the cap can never bite.

84const flowBudgets = new Map()

86import { turnInFlight } from './update-gate.mjs'

88import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'

89import { makeThrottledTrack } from './presence.mjs'

91// Public client creds (the same anon values the web app ships — safe to embed).

92// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

93const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

94const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

97// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

98// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

99// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

100// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

101// directly-started bridge with no account login — those writes go unattributed,

102// never owner-spoofed (the server treats a missing/!owner token accordingly).

103let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

104

105// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

106// Kept comfortably under realtime payload limits once base64'd.

107const SCROLLBACK_MAX = 120_000

108

109// node-pty is a native module — loaded lazily so a friendly message shows

110// if it isn't built yet.

111// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

112// so a failed node-pty build must not block the bridge — it only disables the

113// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

114let pty = null

115try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

flow-assembly.mjsView file

Lines 1-34javascript

1// Thinkpool Flow — Step 7: assembly + delivery.

2//

3// Lanes each built a DISJOINT slice in its own git worktree (flow-worktree.mjs).

4// Assembly collects those slices into one final app, then delivers it. The MVP

5// artifact ("BLEAK SWORD") is a SINGLE self-contained index.html — no build step,

6// no external assets — but lanes own separate module files (audio.js, sprites.js,

7// combat.js, render.js + an index.html shell that imports them). So assembly must

8// INLINE those modules back into one index.html.

9//

10// Export-destination decision (locked with the spec): a finished Flow ships as a

11// per-Flow git repo (initRepo) + a zip Buffer (zipDir) + an OPTIONAL best-effort

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

account.mjsView file

Lines 1-21javascript

1/* account.mjs — account-mode bridge (Phase 1).

2 One `npx thinkpool-pair` per ACCOUNT instead of per room:

3 login — link this device to your ThinkPool account (realtime handoff).

4 bind — map a room code → a working directory on THIS machine.

5 account — discover your code sessions and serve each one (a headless child

6 bridge per room, run in its bound directory). Reuses the proven

7 single-room bridge verbatim; the supervisor only adds discovery.

8 Spec: docs/specs/2026-06-16-account-bridge.md */

9import { spawn } from 'node:child_process'

10import