fix(wrangler): do not query the GitHub skills API when telemetry is disabled

[Om-singhaI]

Fixes #15344

Telemetry events carry a currentAgentSkillsInstalled property, resolved by telemetryCurrentAgentSkillsInstalled(), which can query the GitHub Contents API for cloudflare/skills. In getMetricsDispatcher, both sendAdhocEvent and sendCommandEvent started that lookup at the head of the dispatch promise chain, while the telemetry permission was only checked afterwards inside dispatch(). So a user who opted out via WRANGLER_SEND_METRICS=false, DO_NOT_TRACK, or send_metrics in the Wrangler config still generated GitHub requests on behalf of telemetry; the payload was built and then discarded. That is the firewall prompt reported in the issue.

The dispatcher now resolves the property through a small helper that consults getMetricsConfig(options).enabled first and short circuits to a resolved null when telemetry is disabled, so the lookup only starts when the event will actually be sent. These are the only two call sites of telemetryCurrentAgentSkillsInstalled() outside its own module and tests. Behaviour with telemetry enabled is unchanged, and so is the "Dispatching disabled" debug log, whose inline snapshot in metrics.test.ts is untouched.

Tests (packages/wrangler/src/__tests__/metrics.test.ts): two tests added beside the existing disabled dispatcher test. They restore the real telemetryCurrentAgentSkillsInstalled implementation (vitest.setup.ts normally stubs it out) and register msw handlers for the two GitHub endpoints so requests are observable:

• dispatcher disabled: one adhoc and one command event produce zero requests to the skills API, the lookup is never invoked, and nothing is posted to the metrics endpoint.
• dispatcher enabled: the skills listing is fetched exactly once across the same two events (the result is memoised) and both events still post to the metrics endpoint.

On unmodified main both tests fail: the disabled case invokes the lookup twice (expected "telemetryCurrentAgentSkillsInstalled" to not be called at all, but actually been called 2 times), and the enabled case then sees zero fetches because the opted out run already memoised the result. With the fix, metrics.test.ts passes 58 tests, and agents-skills-install.test.ts, metrics/sanitization.test.ts and register-yargs-command-skills.test.ts stay green (160 tests across the four files, vitest 4.1.0). tsc, oxlint --deny-warnings --type-aware and oxfmt --check are clean on the changed files.

A patch changeset for wrangler is included.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this restores the documented behaviour of the telemetry opt outs; no user facing interface changes.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: a2d238e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/skip-skills-lookup-when-opted-out.md: [@cloudflare/wrangler]
• packages/wrangler/src/tests/metrics.test.ts: [@cloudflare/wrangler]
• packages/wrangler/src/metrics/metrics-dispatcher.ts: [@cloudflare/wrangler]

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@15382

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@15382

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@15382

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@15382

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@15382

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@15382

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@15382

miniflare

npm i https://pkg.pr.new/miniflare@15382

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@15382

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@15382

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@15382

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@15382

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@15382

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@15382

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@15382

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@15382

wrangler

npm i https://pkg.pr.new/wrangler@15382

commit: a2d238e

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[workers-devprod]

Codeowners reviews satisfied