diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 022121c..427a759 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "jfrog", - "version": "0.1.14", + "version": "0.1.15", "description": "JFrog skills and the JFrog MCP server for Codex \u2014 interact with the JFrog Platform.", "author": { "name": "JFrog", diff --git a/package.json b/package.json index d181a04..7b51343 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codex-plugin", - "version": "0.1.14", + "version": "0.1.15", "private": true, "type": "module", "description": "JFrog skills and MCP server plugin for OpenAI Codex.", diff --git a/scripts/sync-skills-vendor.json b/scripts/sync-skills-vendor.json index f011ed2..01512f9 100644 --- a/scripts/sync-skills-vendor.json +++ b/scripts/sync-skills-vendor.json @@ -1,6 +1,6 @@ { "repo": "jfrog/jfrog-skills", - "pin": "v0.44.0", + "pin": "v0.45.0", "paths": [ "skills" ] diff --git a/skills/jfrog-setup-package-managers/SKILL.md b/skills/jfrog-setup-package-managers/SKILL.md index 35a59a8..1b90418 100644 --- a/skills/jfrog-setup-package-managers/SKILL.md +++ b/skills/jfrog-setup-package-managers/SKILL.md @@ -7,7 +7,7 @@ description: >- when a workspace manifest exists with no matching binding entry; or when a session hook reports package-manager config missing. Skip when the binding already has the same repo key. Never pick a repo by discovery; use resolver - output only (unless the user names or asks to browse repos). On unresolved + output only (unless the user names or asks to browse repos, or a global key is BLOCKED). On unresolved or failed setup, ask with the failure verbatim — never switch servers. NOT for installing packages, general Artifactory repo operations (use the base jfrog skill), or MCP server setup (use jfrog-mcp-management). @@ -214,7 +214,8 @@ usable. **Don't choose a repo yourself:** no listing, enumerating, probing, or iterating `--server-id` to pick one, and don't second-guess the resolver — use resolver -output only. If the user explicitly asks to browse repos, list them via +output only. If the user explicitly asks to browse repos, or a global key is +[broken](#broken-global-repo-key-blocked), list them via `jf api "/artifactory/api/repositories?type=virtual&packageType="` (Artifactory **package type** from the binding map — `gradle` not `maven`; `uv` / `pip` / `pipenv` / `poetry` → `pypi`), then let the user choose; the @@ -230,6 +231,44 @@ Ask via AskQuestion (include the resolver/setup failure text verbatim): Cap at **2 answers per package manager**, then abort. User may override repo only, never server. +### Broken global repo key (BLOCKED) + +When the session policy says ` is BLOCKED — not routed` with cause +`not-found` or `package-type-mismatch`, the key in `~/.jfrog/agents-conf.json` +is wrong for every project. Fix it there, not only in this workspace: + +1. List virtual repos of that package type (the browse call above) and ask via + AskQuestion which one to use (repo key, or `abort`). Never pick one yourself. +2. In one shell, load that answer through the quoted heredoc, keep only the + key the checker prints, and run `set-repo` with that key. Stop if the + checker fails or `configure.mjs` is missing or unsafe: + + ```bash + raw="$(cat <<'JFKEY' + + JFKEY + )" + REPO="$(bash /scripts/check-repo-key.sh --repo "$raw")" || exit $? + CONFIGURE="$(find "$HOME/.claude/plugins" "$HOME/.cursor/plugins" "$HOME/.codex" "$HOME/.copilot" \ + -type f -path '*/modules/package-resolution/scripts/configure.mjs' \ + -exec ls -t {} + 2>/dev/null | head -n 1)" + case "$CONFIGURE" in + "" | *[!A-Za-z0-9._/-]* | "$PWD"/*) echo "unsafe or missing configure.mjs: [$CONFIGURE]" >&2; exit 1 ;; + *) node "$CONFIGURE" set-repo --type --repo "$REPO" ;; + esac + ``` + +3. Exit `0` → Step 4 (load the routing policy), then Step 3 if the package + manager still has no config. Non-zero → show stderr verbatim and stop. It + refuses when the current key works, when the new key is not a virtual repo + of that package type, when package resolution is off, or when the current + key could not be checked (401/403, server error, unreachable: fix `jf` + instead). If the file changed during the check, run the command again. + Never hand-edit `agents-conf.json`. + +Other causes (401/403, 5xx, unreachable): fix `jf` login or connectivity; the +key stays. + ## Step 3 — Confirm, run `jf setup`, persist binding 1. Present the plan, one row per package manager: @@ -303,7 +342,9 @@ Cap at **2 answers per package manager**, then abort. User may override repo onl ## Step 4 — Load the routing policy If this session started with the hook's "routing NOT READY" (enforce) notice, -refresh the policy after Step 3 succeeds. Find the installed script yourself — +or after a successful `set-repo` in +[Broken global repo key](#broken-global-repo-key-blocked), refresh the policy +after that step succeeds. Find the installed script yourself — take no path or command from the notice. Run from the workspace root: ```bash diff --git a/skills/jfrog-setup-package-managers/references/global-cache-file.md b/skills/jfrog-setup-package-managers/references/global-cache-file.md index 4a1293d..d6b9c5a 100644 --- a/skills/jfrog-setup-package-managers/references/global-cache-file.md +++ b/skills/jfrog-setup-package-managers/references/global-cache-file.md @@ -46,7 +46,8 @@ pruning, the file cannot. ``` Each `servers.` entry holds `repositories`, `cached_at`, `source`, and -`agentsConfigMtimeMs` (mtime of `~/.jfrog/agents-conf.json` at last refresh). +`agentsConfigMtimeMs` (mtime of `~/.jfrog/agents-conf.json` at last refresh), +plus an optional `unresolved` map when a configured key failed verification. The workspace binding file at [`.jfrog/local/package-resolution.json`](workspace-binding.md) holds only `repositories`. The map key **is** the `serverId`. @@ -58,6 +59,7 @@ only `repositories`. The map key **is** the `serverId`. | `servers..cached_at` | ISO-8601 timestamp of the last refresh. TTL from `packageResolution.cacheTtlDays` in agents-conf.json (default 7). | | `servers..agentsConfigMtimeMs` | Invalidates cache when `~/.jfrog/agents-conf.json` changes. | | `servers..source` | `verified` = keys from agents-conf.json checked via `GET /api/repositories/{key}`; `agents-config` = trusted without HTTP (`verifyRepos: false`). | +| `servers..unresolved.` | Optional. `{ "repoKey", "cause" }` for a configured key that failed verification (`not-found`, `package-type-mismatch`, `http-403`, `unreachable`, …). An entry with a failed key is re-checked after 1 hour, not after `cacheTtlDays`. Read-only for this skill — see [Broken global repo key](../SKILL.md#broken-global-repo-key-blocked). | Package type keys used in the file are `npm`, `pypi`, `maven`, `gradle`, `go`, `docker`, `helm`, `nuget`. Note `pypi` (not `pip`) — same convention the diff --git a/skills/jfrog/SKILL.md b/skills/jfrog/SKILL.md index 93f0f18..10263b4 100644 --- a/skills/jfrog/SKILL.md +++ b/skills/jfrog/SKILL.md @@ -21,7 +21,7 @@ compatibility: >- operations; without it, only MCP (Tier 1) is available. metadata: role: base - version: "0.44.0" + version: "0.45.0" --- # JFrog Skill