Prevents repos from being made public unless a -private counterpart exists on GitHub. Protects internal plans, todos, and development context from accidental exposure.
Every repo that goes public must have a {name}-private repo. The private repo holds ai/ folders with plans, todos, dev updates, and notes. The public repo has the same code without ai/.
Forks of external projects are exempt.
node cli.js check <org>/<repo>
node cli.js audit <org>
Add to ~/.claude/settings.json under hooks.PreToolUse with matcher "Bash".
Copy to ~/.ldm/extensions/wip-repo-permissions-hook/ and restart gateway.
Tools: repo_permissions_check, repo_permissions_audit
Add to .mcp.json:
{
"wip-repo-permissions": {
"command": "node",
"args": ["/path/to/tools/wip-repo-permissions-hook/mcp-server.mjs"]
}
}
共 3 个版本