feat: reject skill links that leave the package

[LadyBluenotes]

🎯 Changes

• intent validate now reports Link target is outside the package: <target> when a relative Markdown link in a SKILL.md resolves to a path outside the package that owns the skill.
• Before, the link check only tested that the target exists, so a monorepo link such as ../../../docs/guide.md passed. Only the package is installed in a consumer project, so such a link is dead for every consumer.
• The boundary is the package root directory, tested the same way intent load tests it, so validate rejects the links that load leaves unrewritten. The files list in package.json and .npmignore are not consulted.
• Each link gets one finding, and the outside-the-package error takes precedence over the not-found error. An absolute path target is now reported as outside the package.
• No added file system call or import. A link outside the package skips the existence check. The built package grows by 191 bytes.
• Docs: the intent validate reference describes the check.
• Adds a patch changeset.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm run test:pr (run pnpm build:all first).

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

[changeset-bot]

🦋 Changeset detected

Latest commit: 7b40b6d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@tanstack/intent	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 54 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c3cfdf7b-a9a5-41f8-bda5-b2d542eb1120

📥 Commits

Reviewing files that changed from the base of the PR and between 7a30838 and 7b40b6d.

📒 Files selected for processing (4)

• .changeset/validate-links-inside-package.md
• docs/cli/intent-validate.md
• packages/intent/src/validate/blocks.ts
• packages/intent/tests/validate-blocks.test.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 7b40b6d

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:sherif,t...	✅ Succeeded	1m 4s	View ↗
nx run-many --targets=build	✅ Succeeded	3s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-10-04 21:52:41 UTC

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@tanstack/intent@316

commit: 7b40b6d

[codspeed]

Merging this PR will not alter performance

✅ 12 untouched benchmarks

---

_{Comparing feat/validate-links-inside-package (7b40b6d) with main (71cd72c)}