feat(intent): review existing skill permissions during install

[LadyBluenotes]

🎯 Changes

Configured projects could only refresh guidance with intent install; revisiting permissions required editing JSON. Add intent install --review to start from existing rules, add packages/scopes/skills, remove selected rules, inspect current access, and review individual skills before one save confirmation.

Preserve undiscovered and excluded rules, raw unchanged entries, and existing exclusions. An unchanged inherited review keeps inheritance; confirmed changes create a local override in the nearest owning package.json. Reject policy changes made while review is open. Cancellation and dry runs leave permissions and guidance untouched, and guidance failures are reported separately from saved permissions.

Plain configured installs retain their guidance-only path. Review requires a terminal and rejects mapping/global/prompt mode combinations.

Performance: reuse one local discovery result throughout review and completion. Reuse the existing compiled policy once per selection pass rather than recompiling it for each skill. The regression fixture has 1,000 skills and 100 wildcard rules: the previous implementation compiled 100,000 matchers; the new check caps compilation at 100. This is an operation-count result, not an end-to-end latency claim. Searchable lists show at most six options and descriptions are inspected on demand. No new dependencies.

Part of #221, with the agreed narrower scope of reviewing current permission configuration. Historical “newly discovered since last install” reporting needs a discovery baseline and remains deferred; this PR does not close #221. Content hashes, content-change notifications, delivery state, and #222's standalone list/JSON explanation surface remain outside this change. Saved exclusions can still be removed through the existing intent exclude command.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm run test:pr.

Verified: 681 unit tests and 73 integration tests, types, lint, build, Knip, Sherif, docs links, formatting, and git diff --check. Tests cover unchanged rules, non-TTY rejection, incompatible options, cancellation/dry run, inheritance, policy changes during prompts, missing/excluded exact rules, rule explanations, one discovery scan, and compilation count. Lint passes with require-await warnings in test stubs.

Exercised the built CLI in a macOS terminal: selected a package for individual review, excluded one skill, confirmed the preview, and verified the saved policy and generated guidance. Automated keyboard tests exercise Clack. Windows/Linux terminal interaction was not verified locally.

Local checks used NX_NO_CLOUD=true, NX_DAEMON=false, pnpm_config_verify_deps_before_run=false, existing dependency links, and a temporary npm cache. Integration tests required local-port access for their test registry.

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: e6dc5260-5b65-4d95-82e3-b4d312403aa2

📥 Commits

Reviewing files that changed from the base of the PR and between b069294 and 5098d1e.

📒 Files selected for processing (12)

• .changeset/review-current-permissions.md
• docs/cli/intent-install.md
• docs/concepts/trust-model.md
• packages/intent/src/cli.ts
• packages/intent/src/commands/install/command.ts
• packages/intent/src/commands/install/permission-prompts.ts
• packages/intent/src/commands/install/permissions.ts
• packages/intent/src/core/source-policy.ts
• packages/intent/tests/cli.test.ts
• packages/intent/tests/permission-prompts.test.ts
• packages/intent/tests/permissions.test.ts
• packages/intent/tests/review-cost.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 5098d1e

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:sherif,t...	✅ Succeeded	32s	View ↗
nx run-many --targets=build	✅ Succeeded	3s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-09-05 03:17:36 UTC

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@tanstack/intent@255

commit: 5098d1e

[codspeed-hq]

Merging this PR will not alter performance

✅ 8 untouched benchmarks

---

_{Comparing feat/review-installed-permissions (5098d1e) with main (b069294)}