Avoid parsing skill metadata rejected by effective policy
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Refactor
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- node.js, typescript
- Domain
- cli, performance
Research direction
Start with packages/intent/src/core/source-policy.ts at scanForPolicedIntents and packages/intent/src/discovery/register.ts around registration. Reproduce the synthetic-fixture measurements for package reads, skill-file reads, output, and elapsed time, then trace policy resolution and transitive traversal. Done means denied skill files are not parsed, permitted results and diagnostics remain unchanged, and the measured reduction is documented by tests or fixtures.
Written by the indexing model from the issue text.
Description
Problem
Policy-controlled discovery scans skill metadata before applying permission and exclusion rules, doing work for content that will never be exposed.
Evidence
With intent.skills: [] and 100 installed skill packages, listIntentSkills returned zero skills but reported 101 package manifest reads. scanForPolicedIntents calls the raw scanner before policy resolution, and registration discovers skills before filtering.
Sources: scan ordering, registration.
Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.
Acceptance criteria
- Measure package reads, skill-file reads, output, and elapsed time before and after on the same fixtures.
- Resolve and validate policy before policy-controlled metadata parsing.
- Agent-visible discovery does not parse denied skill files.
- Preserve traversal needed to locate permitted transitive packages through unlisted parents.
- Preserve human review of hidden candidates and current policy diagnostics through an explicit appropriate discovery path.
- Show identical permitted results and a measured reduction in denied-content work, with no weakening of path or policy checks.
Scope and priority
Priority: Medium. Type: performance.
Follow-up optimization after policy correctness fixes. No persistent cache, broad scanner rewrite, or new dependency solely to optimize this path.
- Dominant language
- TypeScript
- Stars
- 331
- Forks
- 22
- Avg merge
- 12h 17m
- Merged PRs (30d)
- 51
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TanStack/intent
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 42/100
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100