Skip to content

Support wildcard patterns in intent.skills allowlists#201

Merged
LadyBluenotes merged 2 commits into
mainfrom
fix-wildcard
Jul 14, 2026
Merged

Support wildcard patterns in intent.skills allowlists#201
LadyBluenotes merged 2 commits into
mainfrom
fix-wildcard

Conversation

@LadyBluenotes

@LadyBluenotes LadyBluenotes commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary

  • Support * package patterns such as @tanstack/* and workspace:@scope/* in intent.skills.
  • Preserve exact "*" as the trust-all entry.
  • Keep npm and workspace patterns source-specific.
  • Report patterns that match no discovered packages.
  • Add parser, policy, list/load integration tests, documentation, and a patch changeset.

Closes #200.

Summary by CodeRabbit

  • New Features
    • Expanded intent.skills allowlists to support wildcard patterns like @scope/* and workspace:@scope/*.
    • Wildcard entries now include all discovered matching packages of the specified type.
  • Bug Fixes
    • Refined handling of the special ["*"] allow-all entry and improved notices for unmatched allowlist patterns/packages.
  • Documentation
    • Updated CLI/configuration, trust model, and quick-start examples to document wildcard matching and reporting.

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fa76694d-3a37-494b-9725-62538cd7e9a7

📥 Commits

Reviewing files that changed from the base of the PR and between da04db4 and 171dd06.

📒 Files selected for processing (2)
  • packages/intent/src/core/source-policy.ts
  • packages/intent/tests/source-policy.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • packages/intent/tests/source-policy.test.ts
  • packages/intent/src/core/source-policy.ts

📝 Walkthrough

Walkthrough

intent.skills allowlists now accept wildcard package patterns for npm and workspace sources. Parsing preserves pattern identities, source policy matches discovered packages by pattern and kind, unmatched entries are reported, and tests and documentation cover the updated behavior.

Changes

Wildcard skill allowlists

Layer / File(s) Summary
Pattern parsing and matching primitives
packages/intent/src/core/excludes.ts, packages/intent/src/core/skill-sources.ts
Wildcard package entries are represented as patterns, exact * retains its special trust-all behavior, and wildcard match predicates are compiled.
Explicit allowlist policy integration
packages/intent/src/core/source-policy.ts
Explicit policy matching supports wildcard package names, preserves npm/workspace kind filtering, and reports patterns that match no discovered package.
Validation, documentation, and release coverage
packages/intent/tests/*, docs/..., .changeset/calm-dingos-match.md
Tests cover npm and workspace patterns, matching and reporting behavior; documentation and the patch changeset describe wildcard allowlists.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant IntentConfig
  participant parseSkillSources
  participant compileSkillSourcePolicy
  participant applySourcePolicy
  participant listIntentSkills
  IntentConfig->>parseSkillSources: parse wildcard allowlist
  parseSkillSources->>compileSkillSourcePolicy: provide pattern and source kind
  compileSkillSourcePolicy->>applySourcePolicy: match discovered packages
  applySourcePolicy-->>listIntentSkills: return permitted skills and notices
Loading

Possibly related issues

Possibly related PRs

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description is helpful but does not follow the required template sections for Changes, Checklist, and Release Impact. Rewrite the PR description using the template headings and add the requested checklist and release-impact details.
Docstring Coverage ⚠️ Warning Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: adding wildcard pattern support to intent.skills allowlists.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-wildcard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@nx-cloud

nx-cloud Bot commented Jul 14, 2026

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit 171dd06

Command Status Duration Result
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 3s View ↗

☁️ Nx Cloud last updated this comment at 2026-07-14 03:34:32 UTC

@nx-cloud

nx-cloud Bot commented Jul 14, 2026

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit da04db4

Command Status Duration Result
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 2s View ↗

☁️ Nx Cloud last updated this comment at 2026-07-14 03:02:46 UTC

@pkg-pr-new

pkg-pr-new Bot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/TanStack/intent/@tanstack/intent@201

commit: 171dd06

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/intent/src/core/source-policy.ts (1)

56-66: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Memoize the compiled wildcard pattern.

sourceMatchesPackage is called repeatedly inside loops over scanResult.packages and config.sources. Calling compileWildcardPattern(source.pattern) on every match check creates a new RegExp each time, which can become a noticeable performance bottleneck in projects with many packages and wildcard sources.

Consider caching the compiled matcher to avoid recompiling the pattern on every invocation.

⚡ Proposed refactor to cache patterns
+const patternCache = new Map<string, (value: string) => boolean>()
+
 function sourceMatchesPackage(
   source: ExplicitSkillSource,
   packageName: string,
   packageKind?: 'npm' | 'workspace',
 ): boolean {
   if (source.kind === 'git') return false
   if (packageKind !== undefined && source.kind !== packageKind) return false
-  return 'pattern' in source
-    ? compileWildcardPattern(source.pattern)(packageName)
-    : source.id === packageName
+  if ('pattern' in source) {
+    let matcher = patternCache.get(source.pattern)
+    if (!matcher) {
+      matcher = compileWildcardPattern(source.pattern)
+      patternCache.set(source.pattern, matcher)
+    }
+    return matcher(packageName)
+  }
+  return source.id === packageName
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/intent/src/core/source-policy.ts` around lines 56 - 66, Memoize
compiled wildcard matchers used by sourceMatchesPackage so each source.pattern
is compiled once and reused across repeated package checks. Update the
pattern-matching path in sourceMatchesPackage with a cache keyed by the wildcard
pattern, while preserving the existing git, packageKind, and exact-id matching
behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/intent/src/core/source-policy.ts`:
- Around line 56-66: Memoize compiled wildcard matchers used by
sourceMatchesPackage so each source.pattern is compiled once and reused across
repeated package checks. Update the pattern-matching path in
sourceMatchesPackage with a cache keyed by the wildcard pattern, while
preserving the existing git, packageKind, and exact-id matching behavior.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f8d28147-36b4-4d43-a1e4-7ec1cd89696e

📥 Commits

Reviewing files that changed from the base of the PR and between 6039a26 and da04db4.

📒 Files selected for processing (11)
  • .changeset/calm-dingos-match.md
  • docs/cli/intent-list.md
  • docs/concepts/configuration.md
  • docs/concepts/trust-model.md
  • docs/getting-started/quick-start-consumers.md
  • packages/intent/src/core/excludes.ts
  • packages/intent/src/core/skill-sources.ts
  • packages/intent/src/core/source-policy.ts
  • packages/intent/tests/integration/source-policy-surfaces.test.ts
  • packages/intent/tests/skill-sources.test.ts
  • packages/intent/tests/source-policy.test.ts

@LadyBluenotes LadyBluenotes merged commit ca0c761 into main Jul 14, 2026
9 checks passed
@LadyBluenotes LadyBluenotes deleted the fix-wildcard branch July 14, 2026 03:40
@github-actions github-actions Bot mentioned this pull request Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Glob patterns not supported for allowlist (like @tanstack/*)

1 participant