thinkpool-pair 0.7.292 → 0.7.293

package/README.md

@@ -144,12 +144,25 @@ npx thinkpool-pair@latest <ROOM> -- claude           # structured Claude, no TTY
 - `pty-in` — keystrokes/prompts from the web → written to that terminal's PTY.
 - `term-open` / `term-close` / `term-exit` — web-driven terminal lifecycle.
 - `replay-request` / `pty-replay` — each terminal keeps a rolling ~120 KB
-  scrollback buffer; joining/reloading clients get it replayed, so the room
-  never opens blank while the bridge is up. **Nothing is stored server-side** —
-  history lives exactly as long as the bridge runs.
+  scrollback buffer for live recovery. Thinkpool also stores the cleaned reader
+  transcript and room events so members can reopen the room. It does not store
+  a copy of the repository or the raw PTY byte stream.
 - `resize` — web viewport size → headless PTYs only (the attached terminal
   follows your own TTY).
 
+## Inspect the privacy boundary
+
+Run a local report before pairing a repository:
+
+```bash
+npx thinkpool-pair@latest privacy-report
+```
+
+It lists the project directories configured for this bridge, the local records
+present under `~/.thinkpool-pair`, known outbound service domains, what
+Thinkpool stores remotely, and the limits of the report. It never prints a
+provider key, refresh token, or bridge private key.
+
 ## Run any model
 
 ThinkPool Code runs **any model you choose** — not just Anthropic. The agent

package/bridge.mjs

@@ -226,6 +226,12 @@ const pickAgent = (installed) => new Promise((resolve) => {
 
 const argv = process.argv.slice(2)
 
+if (argv[0] === 'privacy-report') {
+  const { runPrivacyReport } = await import('./privacy-report.mjs')
+  runPrivacyReport()
+  process.exit(0)
+}
+
 // Boot-persistent service install (cross-platform: launchd / systemd / Windows
 // Startup). Subcommand form: `thinkpool-pair install-service <ROOM> [-- <cmd>]`.
 if (argv[0] === 'install-service' || argv[0] === 'uninstall-service') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.292",
+  "version": "0.7.293",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "sdk-admission.mjs",
     "sdk-admission.mjs",
     "launcher.mjs",
+    "privacy-report.mjs",
     "byok-detect.mjs",
     "context-windows.mjs",
     "claude-session.mjs",

package/privacy-report.mjs

@@ -0,0 +1,108 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const cleanHost = (value) => {
+  try { return new URL(value).host } catch { return null }
+}
+
+const readJson = (file, fallback) => {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return fallback }
+}
+
+const displayPath = (value, home) => {
+  const resolved = path.resolve(String(value || ''))
+  return resolved === home ? '~' : resolved.startsWith(`${home}${path.sep}`) ? `~${resolved.slice(home.length)}` : resolved
+}
+
+export function buildPrivacyReport({
+  home = os.homedir(),
+  cwd = process.cwd(),
+  env = process.env,
+  exists = fs.existsSync,
+  read = readJson,
+} = {}) {
+  const configDir = path.join(home, '.thinkpool-pair')
+  const dirs = read(path.join(configDir, 'dirs.json'), {}) || {}
+  const served = read(path.join(configDir, 'served.json'), {}) || {}
+  const providers = read(path.join(configDir, 'providers.json'), []) || []
+  const legacyProvider = read(path.join(configDir, 'provider.json'), null)
+  let defaultDir = ''
+  try { defaultDir = fs.readFileSync(path.join(configDir, 'default-dir'), 'utf8').trim() } catch { /* not configured */ }
+
+  const projectDirs = new Set([cwd, defaultDir, ...Object.values(dirs), ...Object.values(served)].filter(Boolean).map((p) => displayPath(p, home)))
+  const providerHosts = new Set([
+    ...providers.map((provider) => cleanHost(provider?.baseUrl)),
+    cleanHost(legacyProvider?.baseUrl),
+  ].filter(Boolean))
+  const supabaseHost = cleanHost(env.TP_SUPABASE_URL || 'https://daytvtakmlixpfbbqzjd.supabase.co')
+  const webHost = cleanHost(env.TP_WEB_BASE || 'https://thinkpool.io')
+
+  const localRecords = [
+    ['Saved login', 'auth.json', exists(path.join(configDir, 'auth.json')), 'refresh token and account identity'],
+    ['Provider registry', 'providers.json', exists(path.join(configDir, 'providers.json')), 'provider endpoint, model, and API key'],
+    ['Bridge keypair', 'bridge-key.json', exists(path.join(configDir, 'bridge-key.json')), 'private key used to open browser-sealed provider keys'],
+    ['Room directories', 'dirs.json / served.json', exists(path.join(configDir, 'dirs.json')) || exists(path.join(configDir, 'served.json')), 'room-to-project directory mappings'],
+    ['Bridge logs', 'update.log and service logs', exists(path.join(configDir, 'update.log')), 'update and background-service diagnostics'],
+  ]
+
+  return {
+    generatedAt: new Date().toISOString(),
+    configDir: displayPath(configDir, home),
+    projectDirs: [...projectDirs].sort(),
+    localRecords,
+    outbound: [
+      [webHost, 'Thinkpool configuration, linking, version checks, and product APIs'],
+      [supabaseHost, 'authentication, room database, storage, and realtime transport'],
+      ['registry.npmjs.org', 'package installation and updates initiated with npm or npx'],
+      ...[...providerHosts].sort().map((host) => [host, 'AI provider selected on this bridge']),
+    ].filter(([host]) => host),
+    remote: [
+      ['Thinkpool cloud receives', 'account/profile data; room membership and metadata; room chat; cleaned terminal output; terminal and room events; attachments; operational request metadata'],
+      ['Thinkpool cloud does not receive as a repository', 'a crawled copy of the project directory or repository file tree'],
+      ['Readable provider key', 'stored locally by the bridge; Thinkpool relays only a browser-sealed envelope'],
+      ['AI prompts and code context', 'sent by the local coding agent to the selected AI provider; content depends on that runtime and the task'],
+    ],
+    limits: [
+      'Coding-agent runtimes and commands can contact domains beyond the bridge list above.',
+      'Thinkpool room transcripts are readable by Thinkpool infrastructure today; they are not end-to-end encrypted.',
+      'This report describes configured access. It is not a packet capture or a guarantee that a third-party agent obeys the same boundary.',
+    ],
+  }
+}
+
+export function formatPrivacyReport(report) {
+  const yn = (value) => value ? 'present' : 'not present'
+  const lines = [
+    '',
+    '  THINKPOOL PRIVACY REPORT',
+    `  generated ${report.generatedAt}`,
+    '',
+    '  LOCAL ACCESS',
+    `  Bridge configuration: ${report.configDir}`,
+    ...report.projectDirs.map((dir) => `  Project directory:     ${dir}`),
+    '',
+    '  LOCAL RECORDS',
+    ...report.localRecords.map(([label, file, present, contains]) => `  ${label}: ${yn(present)} (${file})\n    contains: ${contains}`),
+    '',
+    '  OUTBOUND DOMAINS',
+    ...report.outbound.map(([host, reason]) => `  ${host}\n    ${reason}`),
+    '',
+    '  REMOTE DATA',
+    ...report.remote.map(([label, detail]) => `  ${label}:\n    ${detail}`),
+    '',
+    '  IMPORTANT LIMITS',
+    ...report.limits.map((line) => `  - ${line}`),
+    '',
+    '  Full data map: https://thinkpool.io/data',
+    '',
+  ]
+  return lines.join('\n')
+}
+
+export function runPrivacyReport(options) {
+  const report = buildPrivacyReport(options)
+  process.stdout.write(formatPrivacyReport(report))
+  return report
+}
+