registry / thinkpool-pair / 0.7.157

thinkpool-pair@0.7.157

Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malware or unconsented install-time control-surface mutation was found. The package is a powerful ThinkPool agent bridge that can expose local coding-agent sessions to a web room and optionally install a persistent service when explicitly invoked.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs thinkpool-pair, login/account mode, or install-service/restart-service CLI commands.

Impact

Dangerous agent-facing capability: remote room participants can drive local coding agents within the package's permission gates; explicit service install can persist the bridge across logins/reboots.

Mechanism

Runtime agent bridge with optional user-invoked OS service persistence and Claude SDK MCP tools.

Policy narrative

A user-invoked bridge connects local Claude/Codex/Gemini/Aider-style agents to a ThinkPool web room over Supabase and injects package-owned MCP tools for cross-terminal/session coordination. The risky behavior is real agent orchestration plus optional OS service persistence, but source inspection shows no npm lifecycle hook, no unconsented writes to foreign AI-agent config, and no broad credential harvesting.

Rationale

This is not malicious under the install-control policy because dangerous agent and persistence capabilities are package-aligned and user-invoked, with no lifecycle-triggered mutation of foreign/broad agent surfaces. It still warrants a warn-level verdict due to remote agent-control surface and optional persistent service behavior.

Evidence

package.jsonbridge.mjsclaude-session.mjsaccount.mjsservice.mjsauth-store.mjsprovider.mjsbyok-detect.mjs~/.thinkpool-pair/auth.json~/.thinkpool-pair/provider.json~/Library/LaunchAgents/io.thinkpool.pair.*.plist~/.config/systemd/user/io.thinkpool.pair.*.service%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/thinkpool-pair-*.cmd

Network endpoints5

daytvtakmlixpfbbqzjd.supabase.cothinkpool.ioregistry.npmjs.org/thinkpool-pair/latestapi.anthropic.comopenrouter.ai/api

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bridge.mjs is the bin entry and starts a live ThinkPool room bridge to local coding agents.
bridge.mjs creates an in-process Claude SDK MCP server with cross-terminal/session read, post, close, and spawn_terminal tools.
claude-session.mjs supports bypassPermissions and auto-allows low-risk/read-only MCP tools; spawned lanes may inherit bypass mode.
service.mjs can install boot-persistent launchd/systemd/Startup services, but only via install-service CLI.
account.mjs can spawn detached npx thinkpool-pair@latest install-service during dashboard restart of an active service.

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks.
Persistence writes are behind explicit install-service/uninstall-service/restart-service commands, not import/install time.
service.mjs validates room codes before shell/service interpolation and defaults services to a pinned package version unless --auto-update is used.
Provider/auth tokens are saved under ~/.thinkpool-pair for the package's own account/provider workflow, not harvested broadly.
No code plants CLAUDE.md, .mcp.json, .claude commands, Codex/Cursor settings, or foreign AI-agent config files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 29 file(s), 589 KB of source, external domains: api.anthropic.com, api.z.ai, daytvtakmlixpfbbqzjd.supabase.co, openrouter.ai, registry.npmjs.org, thinkpool.io, www.apple.com

Source & flagged code

6 flagged

bridge.mjsView file

Lines 75-115javascript

75// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

76// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

77// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

78// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

79const flowRedispatch = new Map()

80// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

81// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

82// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

83// broadcasts; without persistent state the cap can never bite.

84const flowBudgets = new Map()

85import { formatPeek, PEEK, siblingsOf, resolveSibling, crossPostDecision, CROSSPOST, spawnDecision, SPAWN, CROSSROOM, formatPairRoster, crossRoomPostDecision, formatRoomNow } from './cross-terminal.mjs'

86import { turnInFlight } from './update-gate.mjs'

87import { saveSession, flushSession, deleteSession, loadAll, canResume, loadPtyId, savePtyId, loadNames, saveNames, appendDurableEvents, seedDurableEvents, readDurablePage, readDurableOldestSeq } from './session-store.mjs'

88import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'

89import { makeThrottledTrack } from './presence.mjs'

91// Public client creds (the same anon values the web app ships — safe to embed).

92// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

93const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

94const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

95const SUPABASE_ANON = process.env.TP_SUPABASE_ANON || 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRheXR2dGFrbWxpeHBmYmJxempkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzgwNTMxNzEsImV4cCI6MjA5MzYyOTE3MX0.zYmz8bHUNEY4STUr2JuXChAsKwxNwkwFHe1Hd0Betqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

97// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

98// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

99// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

100// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

101// directly-started bridge with no account login — those writes go unattributed,

102// never owner-spoofed (the server treats a missing/!owner token accordingly).

103let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

104

105// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

106// Kept comfortably under realtime payload limits once base64'd.

107const SCROLLBACK_MAX = 120_000

108

109// node-pty is a native module — loaded lazily so a friendly message shows

110// if it isn't built yet.

111// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

112// so a failed node-pty build must not block the bridge — it only disables the

113// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

114let pty = null

115try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

•matchType = previous_version_dangerous_delta matchedPackage = thinkpool-pair@0.7.159 matchedIdentity = npm:dGhpbmtwb29sLXBhaXI:0.7.159 similarity = 0.931 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

flow-assembly.mjsView file

Lines 1-34javascript

1// Thinkpool Flow — Step 7: assembly + delivery.

2//

3// Lanes each built a DISJOINT slice in its own git worktree (flow-worktree.mjs).

4// Assembly collects those slices into one final app, then delivers it. The MVP

5// artifact ("BLEAK SWORD") is a SINGLE self-contained index.html — no build step,

6// no external assets — but lanes own separate module files (audio.js, sprites.js,

7// combat.js, render.js + an index.html shell that imports them). So assembly must

8// INLINE those modules back into one index.html.

9//

10// Export-destination decision (locked with the spec): a finished Flow ships as a

11// per-Flow git repo (initRepo) + a zip Buffer (zipDir) + an OPTIONAL best-effort

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

account.mjsView file

Lines 1-21javascript

1/* account.mjs — account-mode bridge (Phase 1).

2 One `npx thinkpool-pair` per ACCOUNT instead of per room:

3 login — link this device to your ThinkPool account (realtime handoff).

4 bind — map a room code → a working directory on THIS machine.

5 account — discover your code sessions and serve each one (a headless child

6 bridge per room, run in its bound directory). Reuses the proven

7 single-room bridge verbatim; the supervisor only adds discovery.

8 Spec: docs/specs/2026-06-16-account-bridge.md */

9import { spawn } from 'node:child_process'

10import

Source & flagged code

6 flagged · loading source

bridge.mjsView file

95patternName = supabase_service_key severity = critical line = 95 matchedText = const SU...tqo'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

95patternName = supabase_service_key severity = critical line = 95 matchedText = const SU...tqo'

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

flow-assembly.mjsView file

14// L15: // Node built-ins ONLY (fs, path, child_process, zlib) — bridge ships as npm L16: // thinkpool-pair with no new deps. Pure over injected fs/git/gh/readFile so the

High

Child Process

Package source references child process execution.

flow-assembly.mjsView on unpkg · L14

service.mjsView file

22import path from 'node:path' L23: import { execSync } from 'node:child_process' L24: ... L26: // exactly one account service per machine (a second install replaces it). L27: // Room codes flow UNESCAPED into launchctl/systemd shell strings + plist paths, so L28: // this is the security chokepoint: reject anything that isn't a plain alnum code ... L44: // `home` is the platform-correct, runtime-expanded home token ("$HOME" on darwin under L45: // /bin/bash; "$$HOME" inside a systemd unit so systemd emits a literal $HOME to bash). L46: const cacheWipe = (home) => `rm -rf ${home}/.npm/_npx/*/node_modules/thinkpool-pair 2>/dev/null` ... L48: // The version installing the service. By DEFAULT the service is pinned to this exact L49: // version (not @latest) so a future bad npm publish can't auto-roll to every machine's L50: // always-on bridge — that's what spread the broken 0.7.49 on 2026-06-22. Updates become

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

service.mjsView on unpkg · L22

account.mjsView file

1/* account.mjs — account-mode bridge (Phase 1). L2: One `npx thinkpool-pair` per ACCOUNT instead of per room: L3: login — link this device to your ThinkPool account (realtime handoff). ... L8: Spec: docs/specs/2026-06-16-account-bridge.md */ L9: import { spawn } from 'node:child_process' L10: import { fileURLToPath } from 'node:url'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

account.mjsView on unpkg · L1

Findings

3 Critical3 High4 Medium5 Low

CriticalCritical Secretbridge.mjs

CriticalPrevious Version Dangerous Deltabridge.mjs

CriticalSecret Patternbridge.mjs

HighChild Processflow-assembly.mjs

HighShell

HighRuntime Package Installaccount.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceservice.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

bridge.mjsView file

Lines 75-115javascript

75// a flow-revert kill and the next dispatch wave loses the pending resume record, so the task

76// re-dispatches COLD (fresh lane, no resume). That's safe: the healed transcript survives on

77// disk (sanitizeSession wrote it), so a cold re-dispatch can't 400 on a dangling tool_use — it

78// just loses the resume/revert-target carry. Not worth persisting for that narrow window.

79const flowRedispatch = new Map()

80// FL-B2 — per-flow HARD budget ledger (flowId → budget). Accumulates each lane's

81// completed-turn output tokens (onEvent 'result') so the autopilot cap stops the next

82// wave BEFORE overrun. Lives bridge-side because waves dispatch across separate

83// broadcasts; without persistent state the cap can never bite.

84const flowBudgets = new Map()

86import { turnInFlight } from './update-gate.mjs'

88import { stampEvent, makeSeqCounter, maxSeq, seqable, capReplayEvents, chunkReplayEvents, boundEventForBroadcast, inlineImageBlocks, usageReportLine } from './event-id.mjs'

89import { makeThrottledTrack } from './presence.mjs'

91// Public client creds (the same anon values the web app ships — safe to embed).

92// Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.

93const SUPABASE_URL = process.env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co'

94const WEB_BASE = process.env.TP_WEB_BASE || 'https://thinkpool.io'

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bridge.mjsView on unpkg · L95

Critical

Secret Pattern

Supabase service role key (JWT) in bridge.mjs

bridge.mjsView on unpkg · L95

97// Owner access token for AUTHED web writes (currently /api/code-mockup, whip L16).

98// The room-bridge is anon by design; the account supervisor (account.mjs) owns the

99// session, so it hands a fresh owner token in at spawn (TP_ACCESS_TOKEN) and pushes

100// a rotated one over IPC ({ t:'token' }) on each refresh. Stays null for a

101// directly-started bridge with no account login — those writes go unattributed,

102// never owner-spoofed (the server treats a missing/!owner token accordingly).

103let codeAuthToken = process.env.TP_ACCESS_TOKEN || null

104

105// Per-terminal rolling scrollback (raw chars). Replayed to joining clients.

106// Kept comfortably under realtime payload limits once base64'd.

107const SCROLLBACK_MAX = 120_000

108

109// node-pty is a native module — loaded lazily so a friendly message shows

110// if it isn't built yet.

111// Structured Claude (the default) runs through the Agent SDK and needs NO PTY,

112// so a failed node-pty build must not block the bridge — it only disables the

113// raw-PTY path (other CLIs / TP_PTY=1), which we flag clearly if it's used.

114let pty = null

115try { pty = (await import('node-pty')).default ?? (await import('node-pty')) }

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bridge.mjsView on unpkg

flow-assembly.mjsView file

Lines 1-34javascript

1// Thinkpool Flow — Step 7: assembly + delivery.

2//

3// Lanes each built a DISJOINT slice in its own git worktree (flow-worktree.mjs).

4// Assembly collects those slices into one final app, then delivers it. The MVP

5// artifact ("BLEAK SWORD") is a SINGLE self-contained index.html — no build step,

6// no external assets — but lanes own separate module files (audio.js, sprites.js,

7// combat.js, render.js + an index.html shell that imports them). So assembly must

8// INLINE those modules back into one index.html.

9//

10// Export-destination decision (locked with the spec): a finished Flow ships as a

11// per-Flow git repo (initRepo) + a zip Buffer (zipDir) + an OPTIONAL best-effort

service.mjsView file

Lines 2-42javascript

2 service.mjs — install the bridge as a boot-persistent OS service

3 so a customer's bridge survives reboot/logout and auto-restarts

4 on crash, on every platform:

5 • macOS → launchd LaunchAgent (KeepAlive)

6 • Linux → systemd --user unit (Restart=always)

7 • Windows → Startup-folder .cmd running

account.mjsView file

Lines 1-21javascript

1/* account.mjs — account-mode bridge (Phase 1).

2 One `npx thinkpool-pair` per ACCOUNT instead of per room:

3 login — link this device to your ThinkPool account (realtime handoff).

4 bind — map a room code → a working directory on THIS machine.

5 account — discover your code sessions and serve each one (a headless child

6 bridge per room, run in its bound directory). Reuses the proven

7 single-room bridge verbatim; the supervisor only adds discovery.

8 Spec: docs/specs/2026-06-16-account-bridge.md */

9import { spawn } from 'node:child_process'

10import