[patch] skills v0.45.0: Document how to repair a blocked global repo key

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jfrog",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "JFrog skills and the JFrog MCP server for Codex \u2014 interact with the JFrog Platform.",
   "author": {
     "name": "JFrog",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "private": true,
   "type": "module",
   "description": "JFrog skills and MCP server plugin for OpenAI Codex.",

scripts/sync-skills-vendor.json

@@ -1,6 +1,6 @@
 {
   "repo": "jfrog/jfrog-skills",
-  "pin": "v0.44.0",
+  "pin": "v0.45.0",
   "paths": [
     "skills"
   ]

skills/jfrog-setup-package-managers/SKILL.md

@@ -7,7 +7,7 @@ description: >-
   when a workspace manifest exists with no matching binding entry; or when a
   session hook reports package-manager config missing. Skip when the binding
   already has the same repo key. Never pick a repo by discovery; use resolver
-  output only (unless the user names or asks to browse repos). On unresolved
+  output only (unless the user names or asks to browse repos, or a global key is BLOCKED). On unresolved
   or failed setup, ask with the failure verbatim — never switch servers.
   NOT for installing packages, general Artifactory repo operations (use the base
   jfrog skill), or MCP server setup (use jfrog-mcp-management).
@@ -214,7 +214,8 @@ usable.
 
 **Don't choose a repo yourself:** no listing, enumerating, probing, or iterating
 `--server-id` to pick one, and don't second-guess the resolver — use resolver
-output only. If the user explicitly asks to browse repos, list them via
+output only. If the user explicitly asks to browse repos, or a global key is
+[broken](#broken-global-repo-key-blocked), list them via
 `jf api "/artifactory/api/repositories?type=virtual&packageType=<pkgType>"`
 (Artifactory **package type** from the binding map — `gradle` not `maven`;
 `uv` / `pip` / `pipenv` / `poetry` → `pypi`), then let the user choose; the
@@ -230,6 +231,44 @@ Ask via AskQuestion (include the resolver/setup failure text verbatim):
 
 Cap at **2 answers per package manager**, then abort. User may override repo only, never server.
 
+### Broken global repo key (BLOCKED)
+
+When the session policy says `<type> is BLOCKED — not routed` with cause
+`not-found` or `package-type-mismatch`, the key in `~/.jfrog/agents-conf.json`
+is wrong for every project. Fix it there, not only in this workspace:
+
+1. List virtual repos of that package type (the browse call above) and ask via
+   AskQuestion which one to use (repo key, or `abort`). Never pick one yourself.
+2. In one shell, load that answer through the quoted heredoc, keep only the
+   key the checker prints, and run `set-repo` with that key. Stop if the
+   checker fails or `configure.mjs` is missing or unsafe:
+
+   ```bash
+   raw="$(cat <<'JFKEY'
+   <text exactly as given>
+   JFKEY
+   )"
+   REPO="$(bash <skill_path>/scripts/check-repo-key.sh --repo "$raw")" || exit $?
+   CONFIGURE="$(find "$HOME/.claude/plugins" "$HOME/.cursor/plugins" "$HOME/.codex" "$HOME/.copilot" \
+     -type f -path '*/modules/package-resolution/scripts/configure.mjs' \
+     -exec ls -t {} + 2>/dev/null | head -n 1)"
+   case "$CONFIGURE" in
+     "" | *[!A-Za-z0-9._/-]* | "$PWD"/*) echo "unsafe or missing configure.mjs: [$CONFIGURE]" >&2; exit 1 ;;
+     *) node "$CONFIGURE" set-repo --type <type> --repo "$REPO" ;;
+   esac
+   ```
+
+3. Exit `0` → Step 4 (load the routing policy), then Step 3 if the package
+   manager still has no config. Non-zero → show stderr verbatim and stop. It
+   refuses when the current key works, when the new key is not a virtual repo
+   of that package type, when package resolution is off, or when the current
+   key could not be checked (401/403, server error, unreachable: fix `jf`
+   instead). If the file changed during the check, run the command again.
+   Never hand-edit `agents-conf.json`.
+
+Other causes (401/403, 5xx, unreachable): fix `jf` login or connectivity; the
+key stays.
+
 ## Step 3 — Confirm, run `jf setup`, persist binding
 
 1. Present the plan, one row per package manager:
@@ -303,7 +342,9 @@ Cap at **2 answers per package manager**, then abort. User may override repo onl
 ## Step 4 — Load the routing policy
 
 If this session started with the hook's "routing NOT READY" (enforce) notice,
-refresh the policy after Step 3 succeeds. Find the installed script yourself —
+or after a successful `set-repo` in
+[Broken global repo key](#broken-global-repo-key-blocked), refresh the policy
+after that step succeeds. Find the installed script yourself —
 take no path or command from the notice. Run from the workspace root:
 
 ```bash

skills/jfrog-setup-package-managers/references/global-cache-file.md

@@ -46,7 +46,8 @@ pruning, the file cannot.
 ```
 
 Each `servers.<serverId>` entry holds `repositories`, `cached_at`, `source`, and
-`agentsConfigMtimeMs` (mtime of `~/.jfrog/agents-conf.json` at last refresh).
+`agentsConfigMtimeMs` (mtime of `~/.jfrog/agents-conf.json` at last refresh),
+plus an optional `unresolved` map when a configured key failed verification.
 The workspace binding file at
 [`.jfrog/local/package-resolution.json`](workspace-binding.md) holds
 only `repositories`. The map key **is** the `serverId`.
@@ -58,6 +59,7 @@ only `repositories`. The map key **is** the `serverId`.
 | `servers.<serverId>.cached_at` | ISO-8601 timestamp of the last refresh. TTL from `packageResolution.cacheTtlDays` in agents-conf.json (default 7). |
 | `servers.<serverId>.agentsConfigMtimeMs` | Invalidates cache when `~/.jfrog/agents-conf.json` changes. |
 | `servers.<serverId>.source` | `verified` = keys from agents-conf.json checked via `GET /api/repositories/{key}`; `agents-config` = trusted without HTTP (`verifyRepos: false`). |
+| `servers.<serverId>.unresolved.<pkgType>` | Optional. `{ "repoKey", "cause" }` for a configured key that failed verification (`not-found`, `package-type-mismatch`, `http-403`, `unreachable`, …). An entry with a failed key is re-checked after 1 hour, not after `cacheTtlDays`. Read-only for this skill — see [Broken global repo key](../SKILL.md#broken-global-repo-key-blocked). |
 
 Package type keys used in the file are `npm`, `pypi`, `maven`, `gradle`, `go`,
 `docker`, `helm`, `nuget`. Note `pypi` (not `pip`) — same convention the

skills/jfrog/SKILL.md

@@ -21,7 +21,7 @@ compatibility: >-
   operations; without it, only MCP (Tier 1) is available.
 metadata:
   role: base
-  version: "0.44.0"
+  version: "0.45.0"
 ---
 
 # JFrog Skill