carpool-mcp 0.1.0

package/dist/consent.js

@@ -0,0 +1,49 @@
+// apps/mcp/src/consent.ts
+var CONSENT_MODES = ["ask", "off"];
+var CONSENT_MODE_ENV = "CARPOOL_PUBLISH_MODE";
+var NON_PROMPTING_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "acceptEdits", "dontAsk", "auto"]);
+var ASK_REASON = "Publishing puts this research on sale. It cannot be recalled once bought \u2014 delisting stops new sales but copies already paid for stay with their buyers. Review the question, sources and stripped items before approving.";
+function decideConsent(input, cfg = {}) {
+  if (input.agent_id) {
+    return {
+      decision: "deny",
+      reason: "carpool_publish is not available to subagents. Publishing is irreversible and needs a human in an interactive session; a subagent cannot be one."
+    };
+  }
+  if (input.permission_mode && NON_PROMPTING_MODES.has(input.permission_mode)) {
+    return {
+      decision: "deny",
+      reason: `carpool_publish is not available in permission mode "${input.permission_mode}", which does not prompt. Publishing cannot be auto-approved.`
+    };
+  }
+  const raw = cfg.mode?.trim();
+  if (raw === "off") {
+    return {
+      decision: "deny",
+      reason: `Publishing is turned off here (${CONSENT_MODE_ENV}=off).`
+    };
+  }
+  if (raw !== void 0 && raw !== "" && raw !== "ask") {
+    return {
+      decision: "deny",
+      reason: `${CONSENT_MODE_ENV} is set to "${raw}", which is not one of ${CONSENT_MODES.join(" | ")}. Refusing rather than guessing at an irreversible action.`
+    };
+  }
+  return { decision: "ask", reason: ASK_REASON };
+}
+function hookOutput(d) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: d.decision,
+      permissionDecisionReason: d.reason
+    }
+  };
+}
+export {
+  ASK_REASON,
+  CONSENT_MODES,
+  CONSENT_MODE_ENV,
+  decideConsent,
+  hookOutput
+};

package/hooks/pre-publish.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook for carpool_publish.
+ *
+ * This exists because an MCP server cannot tell that it is running inside a
+ * subagent. Only the client knows, so only the client can enforce it.
+ *
+ * **It decides nothing itself.** Every rule lives in `src/consent.ts` and is
+ * imported from the compiled `dist/consent.js` below. That is the whole point of
+ * this file's current shape: it used to carry a hand-written subset of those
+ * rules — different reason strings, a different mode vocabulary, no awareness of
+ * the `auto` path — while `decideConsent`'s five tests covered the copy nobody
+ * executed. The tested decision could `allow`; this one always asked. Two
+ * implementations of one security decision, and the tests were pointed at the
+ * wrong one.
+ *
+ * What the decision can actually see, and therefore what it decides on:
+ *   - `agent_id`        — present for a subagent. Deniable, and denied.
+ *   - `permission_mode` — a non-prompting mode must never auto-approve a
+ *                         publish, which is irreversible.
+ *   - `CARPOOL_PUBLISH_MODE` — `ask` (default) or `off`. Nothing else.
+ *
+ * What it cannot see: whether the session is `-p`, headless, or backgrounded.
+ * There is no documented field for that. So the README says what this does —
+ * denies subagents, non-prompting modes and `off`, otherwise asks — and does not
+ * claim "blocked outside interactive sessions", which would be a lie.
+ *
+ * There is no `allow` outcome. Auto-listing always asks first.
+ *
+ * Install:
+ *   "hooks": { "PreToolUse": [{ "matcher": "mcp__carpool__carpool_publish",
+ *              "hooks": [{ "type": "command", "command": "node <path>/pre-publish.mjs" }] }] }
+ *   Run `pnpm --filter @carpool/mcp build` first — this loads dist/consent.js.
+ */
+import { readFileSync } from "node:fs";
+
+/** Emit and exit. Every exit from this file goes through here. */
+function emit(decision, reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: decision,
+        permissionDecisionReason: reason,
+      },
+    }),
+  );
+  process.exit(0);
+}
+
+let input;
+try {
+  input = JSON.parse(readFileSync(0, "utf8"));
+} catch {
+  // Unparseable input is not a reason to let an irreversible action through.
+  emit("deny", "carpool publish hook could not read its input; refusing rather than guessing.");
+}
+
+// Fail closed on a missing build rather than falling back to a second copy of
+// the rules — a fallback is how the two implementations diverged in the first
+// place.
+let decideConsent, hookOutput;
+try {
+  ({ decideConsent, hookOutput } = await import(new URL("../dist/consent.js", import.meta.url).href));
+} catch (e) {
+  emit(
+    "deny",
+    "carpool publish hook could not load its decision module (dist/consent.js): " +
+      `${e.message}. Run \`pnpm --filter @carpool/mcp build\`. Refusing rather than guessing.`,
+  );
+}
+
+const out = hookOutput(decideConsent(input, { mode: process.env.CARPOOL_PUBLISH_MODE }));
+process.stdout.write(JSON.stringify(out));

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "carpool-mcp",
+  "version": "0.1.0",
+  "description": "MCP server for Carpool: search, buy and sell prior agent research over x402 on Hedera.",
+  "type": "module",
+  "bin": {
+    "carpool-mcp": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "hooks",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/RomarioKavin1/carpool.git"
+  },
+  "homepage": "https://carpool-dashboard-plum.vercel.app",
+  "bugs": {
+    "url": "https://github.com/RomarioKavin1/carpool/issues"
+  },
+  "keywords": [
+    "mcp",
+    "claude",
+    "x402",
+    "hedera",
+    "research",
+    "agents"
+  ],
+  "dependencies": {
+    "@hiero-ledger/sdk": "2.88.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@x402/fetch": "2.25.0",
+    "@x402/hedera": "2.25.0",
+    "zod": "3.25.76"
+  }
+}