simplify(pairing): address review findings — constants, TOCTOU, nesting

- Remove TOCTOU exists() check in _load(); rely on FileNotFoundError
- Define PAIRING_CODE_META_KEY and PAIRING_COMMAND_META_KEY constants
  in nanobot.pairing, replacing magic strings across base.py, slack.py,
  and builtin.py
- Flatten nested revoke logic in handle_pairing_command()
- Trim redundant docstring/comment noise in is_allowed() and generate_code()

nanobot/pairing/__init__.py

@@ -13,6 +13,10 @@ from nanobot.pairing.store import (
     revoke,
 )
 
+# Metadata keys used by channels and commands to tag pairing-related messages.
+PAIRING_CODE_META_KEY = "_pairing_code"
+PAIRING_COMMAND_META_KEY = "_pairing_command"
+
 __all__ = [
     "approve_code",
     "deny_code",
@@ -24,4 +28,6 @@ __all__ = [
     "is_approved",
     "list_pending",
     "revoke",
+    "PAIRING_CODE_META_KEY",
+    "PAIRING_COMMAND_META_KEY",
 ]

nanobot/pairing/store.py

@@ -35,11 +35,11 @@ def _store_path() -> Path:
 
 def _load() -> dict[str, Any]:
     path = _store_path()
-    if not path.exists():
-        return {"approved": {}, "pending": {}}
     try:
         with open(path, encoding="utf-8") as f:
             data = json.load(f)
+    except FileNotFoundError:
+        return {"approved": {}, "pending": {}}
     except (json.JSONDecodeError, OSError):
         logger.warning("Corrupted pairing store, resetting")
         return {"approved": {}, "pending": {}}
@@ -82,8 +82,6 @@ def generate_code(
     with _LOCK:
         data = _load()
         _gc_pending(data)
-        # Collision probability is negligible (~1e-12 with 20 pending codes),
-        # so we skip an existence check for simplicity.
         raw = "".join(secrets.choice(_ALPHABET) for _ in range(_CODE_LENGTH))
         code = f"{raw[:4]}-{raw[4:]}"
 
@@ -236,22 +234,19 @@ def handle_pairing_command(channel: str, subcommand_text: str) -> str:
         return f"Pairing code `{arg}` not found or already expired"
 
     elif sub == "revoke":
-        if arg is None:
-            return "Usage: `/pairing revoke <user_id>` or `/pairing revoke <channel> <user_id>`"
-        elif len(parts) == 2:
+        if len(parts) == 2:
             return (
                 f"Revoked {arg} from {channel}"
                 if revoke(channel, arg)
                 else f"{arg} was not in the approved list for {channel}"
             )
-        elif len(parts) == 3:
+        if len(parts) == 3:
             return (
                 f"Revoked {parts[2]} from {arg}"
                 if revoke(arg, parts[2])
                 else f"{parts[2]} was not in the approved list for {arg}"
             )
-        else:
-            return "Usage: `/pairing revoke <user_id>` or `/pairing revoke <channel> <user_id>`"
+        return "Usage: `/pairing revoke <user_id>` or `/pairing revoke <channel> <user_id>`"
 
     return (
         "Unknown pairing command.\n"