chore: lint cleanup and notice-suppressibility fix (#185)

* chore: add eslint test script to package.json

* chore: update file paths and imports in various modules for consistency

* chore: refactor async functions to synchronous in command execution and tests

* chore: add warnings for allow-all mode and update tests accordingly

* chore: update ALLOW_ALL_NOTICE handling to ensure visibility in notices and adjust related tests

* chore: ensure allow-all risk warning is always displayed in intent list

Author: LadyBluenotes

.changeset/forty-heads-fly.md

@@ -0,0 +1,7 @@
+---
+'@tanstack/intent': patch
+---
+
+Fix `intent list` suppressing the allow-all risk warning.
+
+When `intent.skills` is set to allow-all (`"*"`), `intent list --no-notices` and `INTENT_NO_NOTICES=1` no longer hide the warning that all skill sources are permitted. This banner is a security-relevant signal, not a migration tip, so it's now excluded from suppression while other notices remain suppressible as before.

eslint.config.js

@@ -49,7 +49,7 @@ const config = [
   {
     name: 'intent/static-discovery',
     files: [
-      'packages/intent/src/scanner.ts',
+      'packages/intent/src/discovery/scanner.ts',
       'packages/intent/src/lockfile.ts',
       'packages/intent/src/manifest.ts',
       'packages/intent/src/mcp/**/*.ts',

packages/intent/package.json

@@ -43,6 +43,7 @@
     "test:smoke": "pnpm run build && node dist/cli.mjs --help > /dev/null && node dist/cli.mjs load --help > /dev/null",
     "test:lib": "vitest run --exclude 'tests/integration/**'",
     "test:integration": "vitest run tests/integration/",
-    "test:types": "tsc --noEmit"
+    "test:types": "tsc --noEmit",
+    "test:eslint": "eslint ."
   }
 }

packages/intent/src/commands/exclude.ts

@@ -126,11 +126,11 @@ function printExcludes(excludes: Array<string>, json?: boolean): void {
   }
 }
 
-export async function runExcludeCommand(
+export function runExcludeCommand(
   actionArg: string | undefined,
   patternArg: string | undefined,
   options: ExcludeCommandOptions,
-): Promise<void> {
+): void {
   const action = normalizeAction(actionArg)
   const cwd = process.cwd()
   const pkg = readPackageJson(cwd)

packages/intent/src/commands/list.ts

@@ -1,13 +1,13 @@
+import { detectIntentAudience } from '../shared/environment.js'
+import { formatIntentCommand } from '../shared/command-runner.js'
+import { listIntentSkills } from '../core/index.js'
 import {
   coreOptionsFromGlobalFlags,
   noticeOptionsFromGlobalFlags,
   printDebugInfo,
   printNotices,
   printWarnings,
 } from './support.js'
-import { detectIntentAudience } from '../shared/environment.js'
-import { formatIntentCommand } from '../shared/command-runner.js'
-import { listIntentSkills } from '../core/index.js'
 import type { GlobalScanFlags } from './support.js'
 import type {
   IntentPackageSummary,

packages/intent/src/commands/load.ts

@@ -32,10 +32,10 @@ function printLoadDebug(loaded: LoadedIntentSkill | ResolvedIntentSkill): void {
   ])
 }
 
-export async function runLoadCommand(
+export function runLoadCommand(
   use: string | undefined,
   options: LoadCommandOptions,
-): Promise<void> {
+): void {
   if (!use) {
     fail('Missing skill use. Expected: intent load <package>#<skill>')
   }

packages/intent/src/core/source-policy.ts

@@ -1,5 +1,6 @@
 import { scanForIntents } from '../discovery/scanner.js'
 import { detectIntentAudience } from '../shared/environment.js'
+import { ALLOW_ALL_NOTICE } from '../shared/cli-output.js'
 import {
   compileExcludePatterns,
   getConfigDirs,
@@ -22,8 +23,7 @@ import type {
   IntentHiddenSourceSummary,
 } from './types.js'
 
-export const ALLOW_ALL_NOTICE =
-  'All skill sources allowed (intent.skills: ["*"]) — unvetted skills may be surfaced into agent guidance.'
+export { ALLOW_ALL_NOTICE }
 
 export const MIGRATION_NOTICE =
   'intent.skills is not set — all discovered skill sources are surfaced. A future version will require an explicit intent.skills allowlist; add one to opt in to specific sources.'

packages/intent/src/hooks/install.ts

@@ -548,7 +548,7 @@ function isIntentHook(value: unknown): boolean {
 }
 
 function isIntentGateScriptReference(value: string): boolean {
-  return /(?:^|[\s"'\/])(?:old-)?intent-(claude|codex|copilot)-gate\.mjs(?:$|[?#\s"'])/i.test(
+  return /(?:^|[\s"'/])(?:old-)?intent-(claude|codex|copilot)-gate\.mjs(?:$|[?#\s"'])/i.test(
     value,
   )
 }

packages/intent/src/shared/cli-output.ts

@@ -1,3 +1,8 @@
+// Lives here (not core/source-policy.ts) so printNotices can enforce
+// non-suppressibility by identity without core importing this module.
+export const ALLOW_ALL_NOTICE =
+  'All skill sources allowed (intent.skills: ["*"]) — unvetted skills may be surfaced into agent guidance.'
+
 export function printWarnings(warnings: Array<string>): void {
   if (warnings.length === 0) return
 
@@ -27,10 +32,17 @@ export function printNotices(
   options: NoticeOutputOptions = {},
 ): void {
   if (notices.length === 0) return
-  if (shouldSuppressNotices(options)) return
+
+  // ALLOW_ALL_NOTICE stays visible even when suppressed: agent hooks read
+  // warnings/conflicts but never notices, so keeping it here (rather than in
+  // warnings) also keeps it out of agent-injected context automatically.
+  const visible = shouldSuppressNotices(options)
+    ? notices.filter((notice) => notice === ALLOW_ALL_NOTICE)
+    : notices
+  if (visible.length === 0) return
 
   console.error('Notices:')
-  for (const notice of notices) {
+  for (const notice of visible) {
     console.error(`  ℹ ${notice}`)
   }
 }

packages/intent/src/staleness/check.ts

@@ -1,13 +1,13 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { isAbsolute, join, relative, resolve } from 'node:path'
 import semver from 'semver'
-import { readIntentArtifacts } from './artifact-coverage.js'
 import {
   findSkillFiles,
   parseFrontmatter,
   readScalarField,
   toPosixPath,
 } from '../shared/utils.js'
+import { readIntentArtifacts } from './artifact-coverage.js'
 import type {
   IntentArtifactSet,
   IntentArtifactSkill,