From 580a544ac39b36ae55815616fa44de2e0909c45d Mon Sep 17 00:00:00 2001
From: "jfrog-skills-release-bot[bot]"
 <276080306+jfrog-skills-release-bot[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 10:51:06 +0000
Subject: [PATCH] chore: sync modules to v0.9.0

---
 .cursor-plugin/marketplace.json               |   2 +-
 .github/scripts/sync-modules-vendor.json      |   2 +-
 plugins/jfrog/.cursor-plugin/plugin.json      |   2 +-
 .../modules/assets/agents-default-conf.json   |  11 +-
 .../jfrog/modules/claude-session-start.mjs    |  12 +-
 .../jfrog/modules/copilot-session-start.mjs   |  90 ++
 plugins/jfrog/modules/core/agents-config.mjs  |   9 +-
 plugins/jfrog/modules/core/io.mjs             |  37 +-
 plugins/jfrog/modules/core/jf-identity.mjs    | 362 +++++++-
 plugins/jfrog/modules/core/logger.mjs         |  18 +-
 plugins/jfrog/modules/core/run-capability.mjs |  20 +-
 .../jfrog/modules/cursor-session-start.mjs    |  12 +-
 .../scripts/eager-setup-receipt.mjs           |   7 +-
 .../scripts/eager-setup.mjs                   | 148 +++-
 .../scripts/feature-flag.mjs                  |  33 +-
 .../scripts/render-instruction.mjs            |  64 +-
 .../package-resolution/scripts/repo-types.mjs |   6 +
 .../package-resolution/scripts/resolver.mjs   | 251 ++++--
 .../scripts/setup-conflict.mjs                | 807 ++++++++++++++++++
 .../scripts/workspace-config.mjs              |   3 +-
 .../templates/package-resolution.md           |  10 +
 21 files changed, 1730 insertions(+), 176 deletions(-)
 create mode 100644 plugins/jfrog/modules/copilot-session-start.mjs
 create mode 100644 plugins/jfrog/modules/package-resolution/scripts/setup-conflict.mjs

diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json
index 52db49a..8e1d4f1 100644
--- a/.cursor-plugin/marketplace.json
+++ b/.cursor-plugin/marketplace.json
@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "JFrog Platform plugins for Cursor",
-    "version": "0.5.12",
+    "version": "0.5.13",
     "pluginRoot": "plugins"
   },
   "plugins": [
diff --git a/.github/scripts/sync-modules-vendor.json b/.github/scripts/sync-modules-vendor.json
index 4ca704b..639c8c9 100644
--- a/.github/scripts/sync-modules-vendor.json
+++ b/.github/scripts/sync-modules-vendor.json
@@ -1,6 +1,6 @@
 {
   "repo": "JFROG/jfrog-agent-hooks",
-  "pin": "jfrog-agent-hooks/v0.8.1",
+  "pin": "jfrog-agent-hooks/v0.9.0",
   "paths": [
     "modules"
   ]
diff --git a/plugins/jfrog/.cursor-plugin/plugin.json b/plugins/jfrog/.cursor-plugin/plugin.json
index 45628dc..693fbe1 100644
--- a/plugins/jfrog/.cursor-plugin/plugin.json
+++ b/plugins/jfrog/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "jfrog",
   "displayName": "JFrog Platform",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "description": "JFrog Platform integration with MCP, security skills, Agent Package Resolution, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.",
   "author": {
     "name": "JFrog",
diff --git a/plugins/jfrog/modules/assets/agents-default-conf.json b/plugins/jfrog/modules/assets/agents-default-conf.json
index 3d13fce..e2b035c 100644
--- a/plugins/jfrog/modules/assets/agents-default-conf.json
+++ b/plugins/jfrog/modules/assets/agents-default-conf.json
@@ -4,16 +4,7 @@
     "enabled": false,
     "verifyRepos": true,
     "cacheTtlDays": 7,
-    "defaultGlobalRepos": {
-      "npm": "npm-virtual",
-      "pypi": "pypi-virtual",
-      "maven": "maven-virtual",
-      "gradle": "gradle-virtual",
-      "go": "go-virtual",
-      "docker": "docker-virtual",
-      "helm": "helm-virtual",
-      "nuget": "nuget-virtual"
-    },
+    "defaultGlobalRepos": {},
     "autoSetup": []
   }
 }
diff --git a/plugins/jfrog/modules/claude-session-start.mjs b/plugins/jfrog/modules/claude-session-start.mjs
index d7e688b..9a0f81b 100644
--- a/plugins/jfrog/modules/claude-session-start.mjs
+++ b/plugins/jfrog/modules/claude-session-start.mjs
@@ -9,8 +9,16 @@
 import process from "node:process";
 
 import { runCapability } from "./core/run-capability.mjs";
-import { ensureAgentsConfigScaffold, agentsConfigLoadWarnings } from "./core/agents-config.mjs";
-import { readStdin, parseSessionId, detectHarness, parseWorkspaceRoots } from "./core/io.mjs";
+import {
+  ensureAgentsConfigScaffold,
+  agentsConfigLoadWarnings,
+} from "./core/agents-config.mjs";
+import {
+  readStdin,
+  parseSessionId,
+  detectHarness,
+  parseWorkspaceRoots,
+} from "./core/io.mjs";
 import { setLogContext, createLogger } from "./core/logger.mjs";
 
 const HARNESS_ID = "claude_code";
diff --git a/plugins/jfrog/modules/copilot-session-start.mjs b/plugins/jfrog/modules/copilot-session-start.mjs
new file mode 100644
index 0000000..9d0c275
--- /dev/null
+++ b/plugins/jfrog/modules/copilot-session-start.mjs
@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// GitHub Copilot Chat SessionStart hook runner (installed via the VS Code
+// Copilot plugin — see jfrog/vscode-plugin).
+//
+// Usage: node copilot-session-start.mjs <capability>
+// Example: node copilot-session-start.mjs package-resolution
+//
+// stdout: JSON with hookSpecificOutput.additionalContext. "{}" is a no-op.
+
+import process from "node:process";
+
+import { runCapability } from "./core/run-capability.mjs";
+import {
+  ensureAgentsConfigScaffold,
+  agentsConfigLoadWarnings,
+} from "./core/agents-config.mjs";
+import {
+  readStdin,
+  parseSessionId,
+  detectHarness,
+  parseWorkspaceRoots,
+} from "./core/io.mjs";
+import { setLogContext, createLogger } from "./core/logger.mjs";
+
+const HARNESS_ID = "copilot";
+const log = createLogger("session-start");
+
+/** @returns {string | null} JSON stdout payload, or null when there is nothing to inject. */
+function formatSessionStartStdout(text) {
+  if (!text?.trim()) return null;
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "SessionStart",
+      additionalContext: text,
+    },
+  });
+}
+
+function writeStdout(payload) {
+  if (payload === null) {
+    writeNoOp();
+    return;
+  }
+  process.stdout.write(payload);
+}
+
+function writeNoOp() {
+  process.stdout.write("{}");
+}
+
+async function main() {
+  const capability = process.argv[2];
+  if (!capability) {
+    writeNoOp();
+    return;
+  }
+
+  const startedAtMs = Date.now();
+  const stdinRaw = await readStdin();
+  const harness = detectHarness(stdinRaw);
+  if (harness && harness !== HARNESS_ID) {
+    setLogContext({ ide: HARNESS_ID, sessionId: parseSessionId(stdinRaw) });
+    log.warn("harness mismatch; wrong adapter invoked", {
+      expected: HARNESS_ID,
+      detected: harness,
+      adapter: "copilot-session-start",
+    });
+    writeNoOp();
+    return;
+  }
+  const sessionId = parseSessionId(stdinRaw);
+  const workspaceRoots = parseWorkspaceRoots(stdinRaw);
+  setLogContext({ ide: HARNESS_ID, sessionId });
+  ensureAgentsConfigScaffold();
+  for (const w of agentsConfigLoadWarnings()) {
+    log.warn(w.message, { path: w.path });
+  }
+  const text = await runCapability(capability, {
+    ide: HARNESS_ID,
+    sessionId,
+    workspaceRoots,
+    startedAtMs,
+  });
+  writeStdout(formatSessionStartStdout(text));
+}
+
+main().catch(() => {
+  writeNoOp();
+  process.exit(0);
+});
diff --git a/plugins/jfrog/modules/core/agents-config.mjs b/plugins/jfrog/modules/core/agents-config.mjs
index 64a43df..bf10d77 100644
--- a/plugins/jfrog/modules/core/agents-config.mjs
+++ b/plugins/jfrog/modules/core/agents-config.mjs
@@ -13,6 +13,7 @@ import {
 import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { isSafeRepoKey } from "../package-resolution/scripts/repo-types.mjs";
 
 /** modules bundle root (parent of core/ and assets/). */
 const PLUGIN_ROOT = path.resolve(
@@ -174,9 +175,9 @@ export function getGlobalLogLevel() {
 }
 
 /**
- * Package types the admin declares globally (governance source). Governance is
- * the UNION of these and any workspace `.jfrog/local` repositories; the workspace
- * side is added by the resolver (workspace-dependent, per-session).
+ * Package types the admin declares globally (the governance boundary).
+ * Workspace files may override repository keys for these types but cannot add
+ * new governed types.
  * @returns {string[]} defaultGlobalRepos keys (unordered)
  */
 export function globalDeclaredTypes() {
@@ -233,7 +234,7 @@ export function normalizeRepoMap(raw) {
   if (!raw || typeof raw !== "object") return {};
   const out = {};
   for (const [type, key] of Object.entries(raw)) {
-    if (typeof key === "string" && key.trim()) out[type] = key.trim();
+    if (isSafeRepoKey(key?.trim())) out[type] = key.trim();
   }
   return out;
 }
diff --git a/plugins/jfrog/modules/core/io.mjs b/plugins/jfrog/modules/core/io.mjs
index 13db450..230acaf 100644
--- a/plugins/jfrog/modules/core/io.mjs
+++ b/plugins/jfrog/modules/core/io.mjs
@@ -1,4 +1,4 @@
-// Shared stdin helpers for the subprocess-style adapters (Claude, Cursor).
+// Shared stdin helpers for subprocess-style adapters (Claude, Cursor, VS Code).
 //
 // Hooks deliver their JSON payload on stdin immediately; in non-hook contexts
 // (CI, npm scripts, terminal smoke tests) nothing arrives, so we bail out after
@@ -71,29 +71,47 @@ export function parseSessionId(stdinRaw) {
   }
 }
 
+// Claude's documented SessionStart sources. VS Code Copilot documents only
+// "new", so the two sets stay disjoint and neither can claim the other's
+// sessions.
+const CLAUDE_SESSION_SOURCES = new Set([
+  "startup",
+  "resume",
+  "clear",
+  "compact",
+]);
+
 // Positively identify the harness that invoked this hook from its stdin
-// payload. Returns "cursor", "claude_code", or null when it can't tell
-// (no stdin — e.g. terminal smoke tests — or an unrecognized shape).
+// payload. Returns "cursor", "copilot", "claude_code", or null when no harness
+// left a fingerprint (no stdin — e.g. terminal smoke tests — or a shape none of
+// them own).
 //
 // Why this matters: Cursor reads sessionStart hooks from BOTH
 // ~/.cursor/hooks.json AND ~/.claude/settings.json. Without this, a Cursor
 // session fires the Claude adapter too, double-injecting the policy. Each
 // adapter uses this to no-op when a different harness invoked it.
 //
-// Cursor: cursor_version / agent_type. Claude: transcript_path / hook_event_name /
-// session_id. Cursor also reads ~/.claude/settings.json, so each adapter no-ops
-// when a different harness invoked it.
+// Every branch below is a signal exactly one harness documents, and null means
+// "can't tell". An adapter is only ever registered by the harness it serves, so
+// a payload no harness claims is left to whichever adapter was invoked.
 export function detectHarness(stdinRaw) {
   if (!stdinRaw) return null;
   try {
     const p = JSON.parse(stdinRaw);
     if (!p) return null;
+    // Cursor stamps its own version/agent on every hook payload.
     if (p.cursor_version || p.agent_type === "cursor") {
       return "cursor";
     }
-    if (p.transcript_path || p.hook_event_name || p.session_id) {
-      return "claude_code";
+    if (p.hook_event_name === "SessionStart") {
+      // Copilot's documented `new` source is decisive. Current VS Code payloads
+      // also include a transcript_path, so path presence cannot classify Claude
+      // before the source is checked.
+      if (p.source === "new") return "copilot";
+      if (CLAUDE_SESSION_SOURCES.has(p.source)) return "claude_code";
     }
+    // Claude writes a transcript for non-SessionStart hooks too.
+    if (p.transcript_path) return "claude_code";
   } catch {
     // stdin wasn't JSON — can't tell.
   }
@@ -102,7 +120,8 @@ export function detectHarness(stdinRaw) {
 
 /**
  * Workspace roots for this hook invocation.
- * Cursor: workspace_roots[]. Claude: payload cwd. Fallback: process.cwd().
+ * Cursor: workspace_roots[]. Claude and VS Code Copilot: payload cwd.
+ * Fallback: process.cwd().
  *
  * @param {string} [stdinRaw]
  * @returns {string[]}
diff --git a/plugins/jfrog/modules/core/jf-identity.mjs b/plugins/jfrog/modules/core/jf-identity.mjs
index b910d39..33367d1 100644
--- a/plugins/jfrog/modules/core/jf-identity.mjs
+++ b/plugins/jfrog/modules/core/jf-identity.mjs
@@ -2,18 +2,24 @@
 // we auth to it?". Used by feature-flag.mjs and resolver.mjs.
 //
 // Identity ALWAYS comes from `jf config`. `jf config export [serverId]` returns
-// base64(JSON({ url, accessToken, serverId, ... })) for the chosen (or default)
-// server. We require both `url` AND `accessToken` (Bearer-only path).
+// base64(JSON({ url, accessToken, user, password, serverId, ... })) for the
+// chosen (or default) server. A usable identity needs a platform `url` plus a
+// credential: an access token (Bearer) OR username + password / API key
+// (Basic). Access token wins when both are present (mirrors `jf setup`).
+//
+// After credentials parse, an optional readiness probe (Artifactory ping)
+// rejects expired/revoked/unreachable credentials so the feature flag can
+// fall into pending instead of "routing with empty repos".
 //
 // If `jf` is not on PATH, has no configured servers, or the chosen server has
-// no access token, identity is null and the feature flag falls into the
-// `missing-identity` path (hook goes no-op, fail closed). Same behaviour as
-// before — only the configuration mechanism is simpler.
+// no usable credential (e.g. SSH-key-only), identity is null and the feature
+// flag falls into the `missing-identity` path (hook goes no-op, fail closed).
 //
-// One subprocess per hook process. Cached after first call within the same
-// process (feature-flag + resolver share one export). Not persisted across
-// sessions — `jf config export` is local and fast enough to run every time.
+// Config export is cached per process. Probe results are cached separately
+// (async) so feature-flag can await readiness without making getPlatformIdentity
+// async.
 
+import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import process from "node:process";
 
@@ -21,35 +27,37 @@ import { createLogger } from "./logger.mjs";
 
 const log = createLogger("jf-identity");
 
-// Wire-format cause codes for getPlatformIdentity() / pending remediation.
-// Single source of truth — import this instead of repeating string literals.
+/** Wire-format cause codes for getPlatformIdentity() / pending remediation. */
 export const IdentityCause = Object.freeze({
   OK: "ok",
   JF_NOT_INSTALLED: "jf-not-installed",
   JF_NOT_CONFIGURED: "jf-not-configured",
+  /** Server present but credential shape unusable (e.g. SSH-key-only). */
+  JF_UNSUPPORTED_AUTH: "jf-unsupported-auth",
+  /** Credential present but Artifactory rejected it (401/403). */
+  JF_AUTH_FAILED: "jf-auth-failed",
+  /** Probe timed out / network / non-auth HTTP failure. */
+  JF_UNREACHABLE: "jf-unreachable",
 });
 
+const PROBE_TIMEOUT_MS = 3_000;
+
 // Module-scope cache. Keyed by the requested serverId hint (`undefined`
 // means "whatever jf considers default"). Stores the full resolved object,
 // including null when jf config produced nothing usable.
 const CACHE = new Map();
+// Probe results are cached for the process lifetime (each hook is a fresh
+// process, so there's nothing to expire within one). Both ok and non-ok
+// results are memoized so feature-flag + resolver share one round-trip.
+/** @type {Map<string, { ok: boolean, cause: string }>} */
+const PROBE_CACHE = new Map();
 
 function normalizeUrl(u) {
   if (!u) return "";
   return String(u).replace(/\/+$/, "");
 }
 
-// Resolution cause. OK means identity is present; the two failure causes
-// drive cause-aware remediation in the pending path:
-//   JF_NOT_INSTALLED  — `jf` is not on PATH / could not be executed.
-//   JF_NOT_CONFIGURED — `jf` ran but produced no usable server identity
-//                       (non-zero exit, empty/undecodable export, or a
-//                       server entry missing url/accessToken).
 function jfConfigIdentity(serverId) {
-  // `jf config export` writes base64(JSON) to stdout for the requested
-  // server (or the default when no arg). We split the failure space into
-  // "jf could not be run" (not-installed) vs "jf ran but has no usable
-  // server" (not-configured) so the caller can give targeted remediation.
   const args = ["config", "export"];
   if (serverId) args.push(serverId);
 
@@ -57,8 +65,6 @@ function jfConfigIdentity(serverId) {
   try {
     result = spawnSync("jf", args, {
       encoding: "utf8",
-      // jf config export reads no stdin and writes a single base64 line
-      // (no terminal interaction). 2s is plenty even for cold spawns.
       timeout: 2000,
       stdio: ["ignore", "pipe", "pipe"],
     });
@@ -68,9 +74,10 @@ function jfConfigIdentity(serverId) {
   }
 
   if (result.error) {
-    // ENOENT (and any other spawn error) means the binary could not be
-    // executed — treat as not installed.
-    log.debug("jf spawn error", { code: result.error.code, message: result.error.message });
+    log.debug("jf spawn error", {
+      code: result.error.code,
+      message: result.error.message,
+    });
     return { identity: null, cause: IdentityCause.JF_NOT_INSTALLED };
   }
   if (result.status !== 0) {
@@ -92,32 +99,219 @@ function jfConfigIdentity(serverId) {
     const json = Buffer.from(blob, "base64").toString("utf8");
     parsed = JSON.parse(json);
   } catch (err) {
-    log.warn("jf config export blob not decodable", { error: err?.message ?? String(err) });
+    log.warn("jf config export blob not decodable", {
+      error: err?.message ?? String(err),
+    });
     return { identity: null, cause: IdentityCause.JF_NOT_CONFIGURED };
   }
 
   const url = normalizeUrl(parsed?.url);
   const token = parsed?.accessToken ?? "";
+  const user = parsed?.user ?? "";
+  const password = parsed?.password ?? "";
   const resolvedServerId = parsed?.serverId ?? serverId ?? null;
 
-  if (!url || !token) {
-    log.debug("jf config export missing url or accessToken", {
+  if (!url) {
+    log.debug("jf config export missing url", {
       serverId: resolvedServerId,
-      hasUrl: Boolean(url),
+      hasUrl: false,
       hasToken: Boolean(token),
+      hasUser: Boolean(user),
+      hasPassword: Boolean(password),
     });
     return { identity: null, cause: IdentityCause.JF_NOT_CONFIGURED };
   }
 
+  // Access token wins when both are present (mirrors jf setup precedence).
+  let auth = null;
+  if (token) {
+    auth = { kind: "bearer", token };
+  } else if (user && password) {
+    auth = { kind: "basic", user, password };
+  }
+
+  if (!auth) {
+    log.debug("jf config export has url but no usable credential", {
+      serverId: resolvedServerId,
+      hasUrl: true,
+      hasToken: Boolean(token),
+      hasUser: Boolean(user),
+      hasPassword: Boolean(password),
+    });
+    return { identity: null, cause: IdentityCause.JF_UNSUPPORTED_AUTH };
+  }
+
+  log.debug("jf config export identity accepted", {
+    serverId: resolvedServerId,
+    hasUrl: true,
+    authKind: auth.kind,
+  });
+
   return {
-    identity: { url, token, serverId: resolvedServerId, source: "jf-config" },
+    identity: {
+      url,
+      serverId: resolvedServerId,
+      source: "jf-config",
+      auth,
+    },
     cause: IdentityCause.OK,
   };
 }
 
-// Public — returns { identity, cause }:
-//   identity: { url, token, serverId, source } | null
-//   cause:    IdentityCause.OK | JF_NOT_INSTALLED | JF_NOT_CONFIGURED
+/**
+ * HTTP Authorization header value for Artifactory API calls, or null.
+ * Rejects credentials with CR/LF so Node never throws a header error that
+ * echoes the secret in `err.message`.
+ */
+export function authHeader(identity) {
+  const auth = identity?.auth;
+  if (!auth) return null;
+  if (auth.kind === "bearer") {
+    const token = String(auth.token ?? "");
+    if (!token || /[\r\n]/.test(token)) return null;
+    return `Bearer ${token}`;
+  }
+  if (auth.kind === "basic") {
+    const user = String(auth.user ?? "");
+    const password = String(auth.password ?? "");
+    if (!user || !password || /[\r\n]/.test(user) || /[\r\n]/.test(password)) {
+      return null;
+    }
+    return `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+  }
+  return null;
+}
+
+/** Strip credential material from error strings before logging. */
+export function safeErrorMessage(err) {
+  const raw = err?.message ?? String(err ?? "");
+  return raw
+    .replace(/Bearer\s+\S+/gi, "Bearer <redacted>")
+    .replace(/Basic\s+\S+/gi, "Basic <redacted>");
+}
+
+function probeCacheKey(identity) {
+  const auth = identity?.auth;
+  if (!auth) return "none";
+  const url = identity.url ?? "";
+  if (auth.kind === "bearer") {
+    const digest = createHash("sha256")
+      .update(`bearer\0${auth.token ?? ""}`)
+      .digest("hex")
+      .slice(0, 16);
+    return `${url}|bearer|${digest}`;
+  }
+  const digest = createHash("sha256")
+    .update(`basic\0${auth.user ?? ""}\0${auth.password ?? ""}`)
+    .digest("hex")
+    .slice(0, 16);
+  return `${url}|basic|${digest}`;
+}
+
+/** Test hooks only apply when the unit/integration harness sets this. */
+function testHarnessActive() {
+  return process.env.JFROG_TEST_HARNESS === "1";
+}
+
+function syntheticProbeResult() {
+  if (!testHarnessActive()) return null;
+  const mode = process.env.JFROG_TEST_IDENTITY_PROBE;
+  if (!mode || mode === "skip") return null;
+  if (mode === "ok") return { ok: true, cause: IdentityCause.OK };
+  if (mode === "401" || mode === "403" || mode === "auth-failed") {
+    return { ok: false, cause: IdentityCause.JF_AUTH_FAILED };
+  }
+  if (mode === "error" || mode === "unreachable") {
+    return { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+  }
+  return null;
+}
+
+/**
+ * Probe Artifactory with the resolved credentials. Fail-closed: any non-OK
+ * response or network error means the identity is not ready for routing.
+ *
+ * Test hooks (require `JFROG_TEST_HARNESS=1` — never honored in production):
+ *   JFROG_TEST_IDENTITY_PROBE=skip — do not probe; treat as ok
+ *   ok / 401 / error — synthetic results
+ *
+ * Production kill switch: `JF_AGENT_IDENTITY_PROBE=0` skips the probe.
+ *
+ * @param {object | null} identity
+ * @returns {Promise<{ ok: boolean, cause: string }>}
+ */
+export async function probePlatformIdentity(identity) {
+  if (!identity) {
+    return { ok: false, cause: IdentityCause.JF_NOT_CONFIGURED };
+  }
+
+  const synthetic = syntheticProbeResult();
+  if (synthetic) return synthetic;
+
+  if (testHarnessActive() && process.env.JFROG_TEST_IDENTITY_PROBE === "skip") {
+    return { ok: true, cause: IdentityCause.OK };
+  }
+  if (process.env.JF_AGENT_IDENTITY_PROBE === "0") {
+    return { ok: true, cause: IdentityCause.OK };
+  }
+
+  const key = probeCacheKey(identity);
+  const cached = PROBE_CACHE.get(key);
+  if (cached) {
+    return { ok: cached.ok, cause: cached.cause };
+  }
+
+  const authorization = authHeader(identity);
+  if (!authorization) {
+    const result = { ok: false, cause: IdentityCause.JF_UNSUPPORTED_AUTH };
+    PROBE_CACHE.set(key, result);
+    return result;
+  }
+
+  // Auth-required endpoint: `system/ping` is anonymous-capable, so a
+  // revoked/expired token would still return 200 and wrongly pass readiness.
+  // `system/version` requires an authenticated (non-anonymous) caller.
+  const pingUrl = `${identity.url}/artifactory/api/system/version`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  /** @type {{ ok: boolean, cause: string }} */
+  let result;
+  try {
+    const res = await fetch(pingUrl, {
+      method: "GET",
+      headers: { Authorization: authorization },
+      signal: controller.signal,
+    });
+    if (res.status === 401 || res.status === 403) {
+      result = { ok: false, cause: IdentityCause.JF_AUTH_FAILED };
+    } else if (!res.ok) {
+      result = { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+    } else {
+      result = { ok: true, cause: IdentityCause.OK };
+    }
+  } catch (err) {
+    log.debug("identity probe failed", {
+      url: pingUrl,
+      error: safeErrorMessage(err),
+    });
+    result = { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+  } finally {
+    clearTimeout(timer);
+  }
+
+  log.debug("identity probe result", {
+    url: identity.url,
+    ok: result.ok,
+    cause: result.cause,
+  });
+  PROBE_CACHE.set(key, result);
+  return result;
+}
+
+/**
+ * Config-only identity (sync). Does not probe reachability.
+ * @returns {{ identity: object | null, cause: string }}
+ */
 export function getPlatformIdentity() {
   const hint = undefined;
   if (CACHE.has(hint)) return CACHE.get(hint);
@@ -127,6 +321,7 @@ export function getPlatformIdentity() {
     log.debug("identity from jf-config", {
       serverId: status.identity.serverId,
       url: status.identity.url,
+      authKind: status.identity.auth?.kind,
     });
   } else {
     log.debug("no platform identity", { cause: status.cause });
@@ -135,20 +330,102 @@ export function getPlatformIdentity() {
   return status;
 }
 
-/** Test-only — reset module cache between in-process scenarios. */
+/**
+ * Config identity + readiness probe. Prefer this from async session paths
+ * (feature-flag) so dead tokens fail closed to pending.
+ * @returns {Promise<{ identity: object | null, cause: string }>}
+ */
+export async function getReadyPlatformIdentity() {
+  const status = getPlatformIdentity();
+  if (!status.identity) return status;
+
+  const probe = await probePlatformIdentity(status.identity);
+  if (probe.ok) return status;
+
+  // Rejected / structurally-unusable credentials are a stable fact → fail
+  // closed to pending so we don't inject "routing" with an unusable identity.
+  if (
+    probe.cause === IdentityCause.JF_AUTH_FAILED ||
+    probe.cause === IdentityCause.JF_UNSUPPORTED_AUTH
+  ) {
+    log.debug("identity not ready after probe", { cause: probe.cause });
+    return { identity: null, cause: probe.cause };
+  }
+
+  // Transient failure (timeout / network / 5xx): keep routing best-effort
+  // rather than downgrading a healthy setup to pending on a blip. The resolver
+  // already fails safe per-repo (keeps prior cache, skips empty writes).
+  log.warn("identity probe unreachable — routing best-effort", {
+    cause: probe.cause,
+  });
+  return status;
+}
+
+/** Test-only — reset module caches between in-process scenarios. */
 export function clearPlatformIdentityCache() {
   CACHE.clear();
+  PROBE_CACHE.clear();
 }
 
-// Short label for log lines / status output, e.g. "jf-config:<your-server-id>".
 export function identityLabel(identity) {
   if (!identity) return "none";
   return identity.serverId ? `jf-config:${identity.serverId}` : "jf-config";
 }
 
-// CLI:
-//   node lib/jf-identity.mjs           — JSON with token redacted
-//   node lib/jf-identity.mjs --label   — single line: "<label>\t<url>"  (or "none")
+/** Redact credential material for CLI / harness stdout (keeps kind + user). */
+export function redactIdentity(identity) {
+  if (!identity) return null;
+  const auth = identity.auth;
+  if (!auth) return { ...identity, auth: null };
+  if (auth.kind === "bearer") {
+    return {
+      ...identity,
+      auth: {
+        kind: "bearer",
+        token: auth.token ? `<${auth.token.length} chars>` : "",
+      },
+    };
+  }
+  return {
+    ...identity,
+    // Preserve the real kind — redactIdentity is exported and the harness may
+    // pass shapes other than "basic"; reporting them all as "basic" misleads.
+    auth: {
+      kind: auth.kind ?? "unknown",
+      user: auth.user ?? "",
+      password: auth.password ? `<${auth.password.length} chars>` : "",
+    },
+  };
+}
+
+function noIdentityHint(cause) {
+  if (cause === IdentityCause.JF_NOT_INSTALLED) {
+    return "`jf` is not installed. Install the JFrog CLI, then run `jf config add`.";
+  }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "Configured server auth method is not supported. Use an access token " +
+      "or username + password / API key (`jf config add`)."
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return (
+      "Configured credentials were rejected by Artifactory (expired, revoked, " +
+      "or wrong). Refresh with `jf config add` / re-login."
+    );
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return (
+      "Artifactory did not respond to a readiness probe. Check network / " +
+      "platform URL, then retry."
+    );
+  }
+  return (
+    "No configured JFrog server. Run `jf config add` (access token or " +
+    "username + password / API key)."
+  );
+}
+
 const isMain = import.meta.url === `file://${process.argv[1]}`;
 if (isMain) {
   const labelOnly = process.argv.includes("--label");
@@ -162,13 +439,8 @@ if (isMain) {
     process.exit(0);
   }
   if (!identity) {
-    const hint =
-      cause === IdentityCause.JF_NOT_INSTALLED
-        ? "`jf` is not installed. Install the JFrog CLI, then run `jf config add`."
-        : "No configured JFrog server. Run `jf config add` (must use access-token auth).";
-    console.error(`No platform identity (${cause}). ${hint}`);
+    console.error(`No platform identity (${cause}). ${noIdentityHint(cause)}`);
     process.exit(2);
   }
-  const safe = { ...identity, token: identity.token ? `<${identity.token.length} chars>` : "" };
-  console.log(JSON.stringify(safe, null, 2));
+  console.log(JSON.stringify(redactIdentity(identity), null, 2));
 }
diff --git a/plugins/jfrog/modules/core/logger.mjs b/plugins/jfrog/modules/core/logger.mjs
index 0878bb5..77682b2 100644
--- a/plugins/jfrog/modules/core/logger.mjs
+++ b/plugins/jfrog/modules/core/logger.mjs
@@ -38,7 +38,14 @@ function logFile() {
 }
 
 // `silent` is a sentinel above every numeric level — nothing matches it.
-const LEVELS = { debug: 10, info: 20, event: 25, warn: 30, error: 40, silent: 1000 };
+const LEVELS = {
+  debug: 10,
+  info: 20,
+  event: 25,
+  warn: 30,
+  error: 40,
+  silent: 1000,
+};
 
 let minLevelResolved = false;
 let minLevel = LEVELS.info;
@@ -100,7 +107,7 @@ const COL_LEVEL = 5;
 const COL_COMPONENT = 20;
 const COL_IDE = 12;
 const COL_SESSION = 13; // "sess:" (5) + 8-char shortId
-const COL_TRACE = 14;   // "trace:" (6) + 8-char shortId
+const COL_TRACE = 14; // "trace:" (6) + 8-char shortId
 
 function fitCol(s, width) {
   if (s.length === width) return s;
@@ -159,7 +166,12 @@ function write(level, component, message, kv) {
   const lvl = fitCol(level.toUpperCase(), COL_LEVEL);
   const comp = fitCol(`[${component}]`, COL_COMPONENT);
 
-  const allKv = { trace: TRACE_ID, ide: CONTEXT.ide, sessionId: CONTEXT.sessionId, ...kv };
+  const allKv = {
+    trace: TRACE_ID,
+    ide: CONTEXT.ide,
+    sessionId: CONTEXT.sessionId,
+    ...kv,
+  };
   const prefix = bracketPrefixes(allKv);
 
   // Strip promoted tags from the kv tail so we don't print them twice.
diff --git a/plugins/jfrog/modules/core/run-capability.mjs b/plugins/jfrog/modules/core/run-capability.mjs
index 742fb94..8286cbc 100644
--- a/plugins/jfrog/modules/core/run-capability.mjs
+++ b/plugins/jfrog/modules/core/run-capability.mjs
@@ -15,7 +15,10 @@ import { setLogContext, createLogger } from "./logger.mjs";
 const log = createLogger("run-capability");
 
 /** modules bundle root (parent of core/ and package-resolution/). */
-const PLUGIN_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PLUGIN_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "..",
+);
 
 /** Shipped capabilities — add a name here; folder layout must match convention. */
 const ALLOWLIST = new Set(["package-resolution"]);
@@ -36,7 +39,9 @@ function loadCapabilityModule(name) {
 }
 
 function hookDurMs(ctx) {
-  return typeof ctx.startedAtMs === "number" ? Date.now() - ctx.startedAtMs : undefined;
+  return typeof ctx.startedAtMs === "number"
+    ? Date.now() - ctx.startedAtMs
+    : undefined;
 }
 
 /**
@@ -64,8 +69,10 @@ export async function runCapability(name, ctx = {}) {
     const text = await cap.sessionStart(ctx);
     const trimmed = text?.trim() ? text : "";
 
+    // EVENT (visible at default info): one summary line per invocation so a
+    // cache-hit / quiet routing path is distinguishable from "hook never fired".
     if (trimmed) {
-      log.debug("sessionStart injected", {
+      log.event("sessionStart injected", {
         enabled: true,
         capabilities: name,
         mode: cap.mode,
@@ -74,7 +81,12 @@ export async function runCapability(name, ctx = {}) {
         durMs: hookDurMs(ctx),
       });
     } else {
-      log.debug("sessionStart no-op", { capabilities: name, durMs: hookDurMs(ctx) });
+      log.event("sessionStart no-op", {
+        capabilities: name,
+        mode: cap.mode,
+        ...(cap.meta ?? {}),
+        durMs: hookDurMs(ctx),
+      });
     }
 
     return trimmed;
diff --git a/plugins/jfrog/modules/cursor-session-start.mjs b/plugins/jfrog/modules/cursor-session-start.mjs
index 85a184b..c5c796c 100644
--- a/plugins/jfrog/modules/cursor-session-start.mjs
+++ b/plugins/jfrog/modules/cursor-session-start.mjs
@@ -9,8 +9,16 @@
 import process from "node:process";
 
 import { runCapability } from "./core/run-capability.mjs";
-import { ensureAgentsConfigScaffold, agentsConfigLoadWarnings } from "./core/agents-config.mjs";
-import { readStdin, parseSessionId, detectHarness, parseWorkspaceRoots } from "./core/io.mjs";
+import {
+  ensureAgentsConfigScaffold,
+  agentsConfigLoadWarnings,
+} from "./core/agents-config.mjs";
+import {
+  readStdin,
+  parseSessionId,
+  detectHarness,
+  parseWorkspaceRoots,
+} from "./core/io.mjs";
 import { setLogContext, createLogger } from "./core/logger.mjs";
 
 const HARNESS_ID = "cursor";
diff --git a/plugins/jfrog/modules/package-resolution/scripts/eager-setup-receipt.mjs b/plugins/jfrog/modules/package-resolution/scripts/eager-setup-receipt.mjs
index ad44582..8f3c00a 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/eager-setup-receipt.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/eager-setup-receipt.mjs
@@ -147,15 +147,16 @@ export async function writeReceipt(root) {
 
 /**
  * Whether `configuredAt` is still within `ttlDays`.
- * `ttlDays <= 0` means no time-based expiry (only repo/server change invalidates).
+ * `ttlDays === 0` means always re-check (never trust time-based state).
  * @param {string|null} configuredAt
  * @param {number} ttlDays
  * @returns {boolean}
  */
 function receiptWithinTtl(configuredAt, ttlDays) {
   if (!configuredAt) return false;
-  if (typeof ttlDays !== "number" || !Number.isFinite(ttlDays) || ttlDays <= 0)
-    return true;
+  if (ttlDays === 0) return false;
+  if (typeof ttlDays !== "number" || !Number.isFinite(ttlDays) || ttlDays < 0)
+    return false;
   const ttlMs = ttlDays * 24 * 60 * 60 * 1000;
   const age = Date.now() - new Date(configuredAt).getTime();
   return age >= 0 && age < ttlMs;
diff --git a/plugins/jfrog/modules/package-resolution/scripts/eager-setup.mjs b/plugins/jfrog/modules/package-resolution/scripts/eager-setup.mjs
index 50c16b0..c1fe710 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/eager-setup.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/eager-setup.mjs
@@ -32,10 +32,7 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 
 import { createLogger } from "../../core/logger.mjs";
-import {
-  loadAgentsConfig,
-  isAutoSetup,
-} from "../../core/agents-config.mjs";
+import { loadAgentsConfig, isAutoSetup } from "../../core/agents-config.mjs";
 import { getPlatformIdentity } from "../../core/jf-identity.mjs";
 import {
   prepareSessionResolve,
@@ -53,6 +50,7 @@ import {
   packageManagersForType,
   packageManagerBinaryOnPath,
 } from "./package-manager-family.mjs";
+import { detectSetupConflict } from "./setup-conflict.mjs";
 
 const log = createLogger("eager-setup");
 
@@ -143,6 +141,9 @@ export function computeEligibleJobs(governed, resolvedByType) {
  *   pending: string[],
  *   deferred: string[],
  *   skippedMissing?: string[],
+ *   skippedConflict?: string[],
+ *   skippedUnsupported?: string[],
+ *   skippedUnparsed?: string[],
  *   setupBusy?: boolean,
  * }} parts
  * @returns {string} markdown note or ""
@@ -152,36 +153,55 @@ function statusNote({
   pending,
   deferred,
   skippedMissing,
+  skippedConflict,
+  skippedUnsupported,
+  skippedUnparsed,
   setupBusy,
 }) {
   const parts = [];
   if (setupBusy && pending.length) {
     parts.push(
-      `zero-touch deferred (another jf setup is in progress) — will retry next session: ${pending.join(", ")}`,
+      `waiting to set up (another setup is already running; will try again next session): ${pending.join(", ")}`,
     );
   } else if (pending.length) {
+    parts.push(`setting up in the background: ${pending.join(", ")}`);
+  }
+  if (configured.length) {
+    parts.push(`already set up: ${configured.join(", ")}`);
+  }
+  if (deferred.length) {
     parts.push(
-      `configuring in the background via \`jf setup\`: ${pending.join(", ")}`,
+      `could not set up last time (will try again later): ${deferred.join(", ")}`,
     );
   }
-  if (configured.length) {
+  if (skippedMissing?.length) {
     parts.push(
-      `already configured (cached, skipping re-setup): ${configured.join(", ")}`,
+      `skipped (not installed on this machine): ${skippedMissing.join(", ")}`,
     );
   }
-  if (deferred.length) {
+  if (skippedConflict?.length) {
     parts.push(
-      `previously failed for ${deferred.join(", ")} — will retry after the cache ` +
-        `expires or once the repo/permission is fixed`,
+      `left unchanged (already using another JFrog / registry): ` +
+        `${skippedConflict.join(", ")}. Ask the user: "Switch to this JFrog ` +
+        `instance?" If they say yes, run \`jf setup <package-manager>\` ` +
+        `(with \`--server-id\` / \`--repo\` as needed) only for each approved ` +
+        `package manager — not bare \`jf setup\``,
     );
   }
-  if (skippedMissing?.length) {
+  if (skippedUnsupported?.length) {
     parts.push(
-      `skipped (package manager binary not on PATH): ${skippedMissing.join(", ")}`,
+      `skipped (update the JFrog CLI to enable setup for): ` +
+        `${skippedUnsupported.join(", ")}`,
+    );
+  }
+  if (skippedUnparsed?.length) {
+    parts.push(
+      `skipped (could not check JFrog CLI setup support for): ` +
+        `${skippedUnparsed.join(", ")} — try updating the JFrog CLI`,
     );
   }
   if (!parts.length) return "";
-  return `> **Zero-touch package-manager setup** — ${parts.join("; ")}.`;
+  return `> **Package manager setup** — ${parts.join("; ")}.`;
 }
 
 /**
@@ -259,10 +279,19 @@ export async function orchestrateEagerSetup(ctx = {}) {
     const serverId = identity.serverId ?? "default";
     const url = identity.url;
 
+    // Intersect the type→package-manager ceiling with what the *installed*
+    // `jf setup` supports, so an outdated CLI (e.g. one without `jf setup uv`)
+    // surfaces an actionable "update the JFrog CLI" note instead of silently
+    // sitting in the background worker's skip log.
+    const supported = supportedPackageManagers();
+
     const configured = [];
     const pending = [];
     const deferred = [];
     const skippedMissing = [];
+    const skippedConflict = [];
+    const skippedUnsupported = [];
+    const skippedUnparsed = [];
     const toRun = [];
     for (const job of jobs) {
       // Binary probe in the orchestrator so the injected note can list skips
@@ -275,6 +304,47 @@ export async function orchestrateEagerSetup(ctx = {}) {
         });
         continue;
       }
+      // Fail-closed: an unparseable `jf setup --help` means we cannot confirm
+      // support, so skip rather than bypass the filter and risk running an
+      // unsupported `jf setup <pm>`.
+      if (supported === null) {
+        skippedUnparsed.push(job.packageManager);
+        log.warn(
+          "eager skip: could not parse `jf setup --help` output — failing closed",
+          { type: job.type, packageManager: job.packageManager },
+        );
+        continue;
+      }
+      if (!supported.has(job.packageManager)) {
+        skippedUnsupported.push(job.packageManager);
+        log.warn(
+          "eager skip: package manager unsupported by installed jf setup",
+          {
+            type: job.type,
+            packageManager: job.packageManager,
+            hint: "update the JFrog CLI to the latest version",
+          },
+        );
+        continue;
+      }
+      const conflict = detectSetupConflict(job.packageManager, url);
+      if (conflict.conflict) {
+        const hostHint =
+          conflict.existingHost && conflict.targetHost
+            ? ` (${conflict.existingHost} → ${conflict.targetHost})`
+            : "";
+        skippedConflict.push(`${job.packageManager}${hostHint}`);
+        log.warn(
+          "eager skip: existing package-manager config points elsewhere",
+          {
+            type: job.type,
+            packageManager: job.packageManager,
+            existingHost: conflict.existingHost,
+            targetHost: conflict.targetHost,
+          },
+        );
+        continue;
+      }
       const need = evaluateSetupNeed(receipt, {
         serverId,
         url,
@@ -285,7 +355,8 @@ export async function orchestrateEagerSetup(ctx = {}) {
       if (need.skip) {
         // "failed-deferred" = a still-failing entry within its TTL: don't retry
         // this session (no jf setup, no WARN), but surface it in the note.
-        if (need.reason === "failed-deferred") deferred.push(job.packageManager);
+        if (need.reason === "failed-deferred")
+          deferred.push(job.packageManager);
         else configured.push(job.packageManager);
         continue;
       }
@@ -321,6 +392,9 @@ export async function orchestrateEagerSetup(ctx = {}) {
       pending,
       deferred,
       skippedMissing,
+      skippedConflict,
+      skippedUnsupported,
+      skippedUnparsed,
       setupBusy,
     });
   } catch (err) {
@@ -522,7 +596,9 @@ export function releaseLock() {
 // ---------------------------------------------------------------------------
 
 /**
- * Parse the `Supported package managers are: a, b, c` line from `jf setup --help`.
+ * Parse the `Supported package managers are: a, b, c.` line from `jf setup --help`.
+ * Real `jf` ends the list with a period, so the capture stops at `.`/newline —
+ * otherwise the last token keeps a trailing dot (e.g. `uv.`) and never matches.
  * @returns {Set<string>|null} lowercase tokens, or null if help could not be parsed
  */
 function supportedPackageManagers() {
@@ -532,7 +608,7 @@ function supportedPackageManagers() {
       timeout: 5000,
     });
     const out = `${res.stdout ?? ""}\n${res.stderr ?? ""}`;
-    const m = out.match(/Supported package managers are:\s*([^\n]+)/i);
+    const m = out.match(/Supported package managers are:\s*([^.\n]+)/i);
     if (!m) return null;
     return new Set(
       m[1]
@@ -576,7 +652,14 @@ function extractJfError(stdout, stderr) {
  * @returns {{ ok: true } | { ok: false, reason: string }}
  */
 function runJfSetup(packageManager, serverId, repoKey) {
-  const args = ["setup", packageManager, "--server-id", serverId, "--repo", repoKey];
+  const args = [
+    "setup",
+    packageManager,
+    "--server-id",
+    serverId,
+    "--repo",
+    repoKey,
+  ];
   const res = spawnSync("jf", args, {
     encoding: "utf8",
     timeout: PER_PACKAGE_MANAGER_TIMEOUT_MS,
@@ -632,7 +715,16 @@ export async function runWorker(payload) {
         });
         continue;
       }
-      if (supported && !supported.has(job.packageManager)) {
+      // Fail-closed: an unparseable `jf setup --help` means we cannot confirm
+      // support, so skip rather than bypass the filter (mirrors orchestrator).
+      if (supported === null) {
+        log.warn(
+          "worker skip: could not parse `jf setup --help` output — failing closed",
+          { type: job.type, packageManager: job.packageManager },
+        );
+        continue;
+      }
+      if (!supported.has(job.packageManager)) {
         log.warn("worker skip: package manager unsupported by jf setup", {
           type: job.type,
           packageManager: job.packageManager,
@@ -640,6 +732,24 @@ export async function runWorker(payload) {
         continue;
       }
 
+      // Re-check for a foreign registry conflict under the lock — mirrors the
+      // orchestrator's check, closing the race where a developer runs a
+      // manual `npm config set registry` between the foreground spawn and
+      // this worker acquiring the lock.
+      const conflict = detectSetupConflict(job.packageManager, url);
+      if (conflict.conflict) {
+        log.warn(
+          "worker skip: existing package-manager config points elsewhere",
+          {
+            type: job.type,
+            packageManager: job.packageManager,
+            existingHost: conflict.existingHost,
+            targetHost: conflict.targetHost,
+          },
+        );
+        continue;
+      }
+
       const result = runJfSetup(job.packageManager, serverId, job.repoKey);
       if (result.ok) {
         applySetupResult(root, {
diff --git a/plugins/jfrog/modules/package-resolution/scripts/feature-flag.mjs b/plugins/jfrog/modules/package-resolution/scripts/feature-flag.mjs
index ce3ef42..23cf036 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/feature-flag.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/feature-flag.mjs
@@ -6,17 +6,18 @@
 //   1. JF_AGENT_PACKAGE_RESOLUTION_DISABLE=1 → mode="off" (env kill switch)
 //   2. packageResolution.enabled !== true in      → mode="off" (file-primary gate;
 //      ~/.jfrog/agents-conf.json                   default off in shipped template)
-//   3. jf config (via jf-identity)                → mode="routing" when identity is
-//      usable; otherwise mode="pending" with a `cause` (jf-not-installed /
-//      jf-not-configured) so the session hook can inject a targeted,
-//      remediation-focused advisory notice.
+//   3. jf config + readiness probe (via jf-identity)
+//      → mode="routing" when identity is usable and Artifactory accepts it;
+//      otherwise mode="pending" with a `cause`:
+//        jf-not-installed | jf-not-configured | jf-unsupported-auth |
+//        jf-auth-failed | jf-unreachable
 //
 // Modes:
 //   "off"     — do nothing (no injection).
 //   "routing" — inject resolved Artifactory URLs + routing policy.
-//   "pending" — jf missing/unconfigured: inject the advisory "routing not
-//               ready" notice (no resolved URLs). This is advisory steering,
-//               not a hard block — real enforcement is durable PM config
+//   "pending" — identity missing/unusable/rejected: inject the advisory
+//               "routing not ready" notice (no resolved URLs). Advisory
+//               steering only — real enforcement is durable PM config
 //               (jf setup) + server-side Curation.
 //
 // Repo keys come from agents-conf.json defaultGlobalRepos (resolver.mjs).
@@ -26,7 +27,7 @@ import process from "node:process";
 import { createLogger } from "../../core/logger.mjs";
 import { getAgentsConfigSection } from "../../core/agents-config.mjs";
 import {
-  getPlatformIdentity,
+  getReadyPlatformIdentity,
   identityLabel,
   IdentityCause,
 } from "../../core/jf-identity.mjs";
@@ -63,13 +64,23 @@ export async function isPackageResolutionEnabled() {
     };
   }
 
-  const { identity, cause } = getPlatformIdentity();
+  // Probe credentials so expired/revoked tokens fail closed to pending
+  // instead of "routing" with every row unresolved.
+  const { identity, cause } = await getReadyPlatformIdentity();
   if (!identity) {
     log.debug("pending", { reason: "missing-identity", cause });
-    return { mode: "pending", reason: "missing-identity", identity: "none", cause };
+    return {
+      mode: "pending",
+      reason: "missing-identity",
+      identity: "none",
+      cause,
+    };
   }
 
-  log.debug("routing", { reason: "jf-config", identity: identityLabel(identity) });
+  log.debug("routing", {
+    reason: "jf-config",
+    identity: identityLabel(identity),
+  });
   return {
     mode: "routing",
     reason: "jf-config",
diff --git a/plugins/jfrog/modules/package-resolution/scripts/render-instruction.mjs b/plugins/jfrog/modules/package-resolution/scripts/render-instruction.mjs
index d55c9c9..4c81347 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/render-instruction.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/render-instruction.mjs
@@ -44,6 +44,18 @@ function causeIntro(cause) {
   if (cause === IdentityCause.JF_NOT_INSTALLED) {
     return "`jf` is not installed (or not on PATH)";
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "`jf` has a configured server, but its auth method is not supported " +
+      "(need an access token or username + password / API key)"
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return "`jf` credentials were rejected by Artifactory (expired, revoked, or wrong)";
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return "Artifactory did not respond to a readiness probe (network / URL / outage)";
+  }
   return "`jf` has no configured server";
 }
 
@@ -56,6 +68,28 @@ function causeRemediation(cause) {
       "`jfrog` skill."
     );
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Agent " +
+      "Package Resolution only supports access-token or username + password " +
+      "/ API-key auth. Reconfigure with `jf config add` using one of those " +
+      "methods (SSH-key-only servers are not supported)."
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Artifactory " +
+      "rejected the credentials. Refresh the access token or password / API " +
+      "key with `jf config add` / re-login, then retry."
+    );
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Artifactory " +
+      "did not answer a readiness probe. Confirm the platform URL, network, " +
+      "and that Artifactory is up, then retry."
+    );
+  }
   return (
     "The JFrog CLI is installed and ready. Configure a JFrog server by " +
     "following the login flow in the base `jfrog` skill to finish enabling " +
@@ -67,8 +101,19 @@ function causeRemediation(cause) {
 // "Confirm jf is installed" step so it does not contradict remediation.
 function causeChecklist(cause) {
   const configure =
-    "Configure a JFrog server (login flow or `jf config add` with access token);\n" +
+    "Configure a JFrog server (login flow or `jf config add` with access " +
+    "token or username + password / API key);\n" +
     "   confirm with `jf config show`.";
+  const reconfigure =
+    "Reconfigure the server with a supported auth method (`jf config add` " +
+    "with access token or username + password / API key);\n" +
+    "   confirm with `jf config show`.";
+  const refreshCreds =
+    "Refresh credentials (`jf config add` / re-login) and confirm with " +
+    "`jf config show`.";
+  const checkReachable =
+    "Confirm the platform URL is reachable and Artifactory is healthy, " +
+    "then retry.";
   const setup =
     "Invoke **`jfrog-setup-package-managers`** to bind package managers this workspace needs.";
   if (cause === IdentityCause.JF_NOT_INSTALLED) {
@@ -78,6 +123,15 @@ function causeChecklist(cause) {
       `3. ${setup}`
     );
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return `1. ${reconfigure}\n2. ${setup}`;
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return `1. ${refreshCreds}\n2. ${setup}`;
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return `1. ${checkReachable}\n2. ${setup}`;
+  }
   return `1. ${configure}\n2. ${setup}`;
 }
 
@@ -207,8 +261,8 @@ function buildPendingGovernedScope() {
 function buildGovernedScope(governed) {
   if (!governed.length) {
     return (
-      "**This policy governs no package managers** (none declared in `defaultGlobalRepos` " +
-      "or the workspace file). Install packages normally; no JFrog routing required."
+      "**This policy governs no package managers** (none declared in " +
+      "`defaultGlobalRepos`). Install packages normally; no JFrog routing required."
     );
   }
   return (
@@ -269,8 +323,8 @@ export async function renderInstruction(flag, ctx = {}) {
     };
   }
 
-  // routing: resolve only the GOVERNED types (admin defaultGlobalRepos keys UNION
-  // workspace-declared keys) and build the table / bullets / docker section
+  // routing: resolve only the GOVERNED types (admin defaultGlobalRepos keys)
+  // and build the table / bullets / docker section
   // dynamically so ungoverned types disappear entirely (not blocked).
   await prepareSessionResolve({ workspaceRoots: ctx.workspaceRoots });
   const governed = governedPackageTypes();
diff --git a/plugins/jfrog/modules/package-resolution/scripts/repo-types.mjs b/plugins/jfrog/modules/package-resolution/scripts/repo-types.mjs
index 1c34282..e72f0d0 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/repo-types.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/repo-types.mjs
@@ -11,6 +11,12 @@ export const PACKAGE_TYPES = [
   "nuget",
 ];
 
+const SAFE_REPO_KEY = /^[A-Za-z0-9._-]+$/;
+
+export function isSafeRepoKey(value) {
+  return typeof value === "string" && SAFE_REPO_KEY.test(value);
+}
+
 const TYPE_PACKAGE_TYPE = {
   npm: "npm",
   pypi: "pypi",
diff --git a/plugins/jfrog/modules/package-resolution/scripts/resolver.mjs b/plugins/jfrog/modules/package-resolution/scripts/resolver.mjs
index 94ab701..68cda81 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/resolver.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/resolver.mjs
@@ -21,7 +21,11 @@ import {
   loadAgentsConfig,
   globalDeclaredTypes,
 } from "../../core/agents-config.mjs";
-import { getPlatformIdentity } from "../../core/jf-identity.mjs";
+import {
+  getPlatformIdentity,
+  authHeader,
+  safeErrorMessage,
+} from "../../core/jf-identity.mjs";
 import { PACKAGE_TYPES, repoMatchesPackageType } from "./repo-types.mjs";
 import {
   pickWorkspaceConfigRoot,
@@ -38,26 +42,29 @@ function cacheFile() {
   return path.join(cacheDir(), "package-resolution.json");
 }
 
-const CACHE_SCHEMA_VERSION = 1;
+const CACHE_SCHEMA_VERSION = 2;
+// One shared window covers admin and workspace verification. Keeping the
+// window below the shortest existing harness timeout prevents sequential
+// verification phases from consuming the entire SessionStart budget.
+const REPO_VERIFY_BUDGET_MS = 5_000;
 
 /** In-process snapshot after first resolve pass in this hook invocation. */
 const SESSION = {
   serverId: null,
   meta: null,
   byType: null,
-  // Package types DECLARED by the workspace `.jfrog/local` overlay (keys with a
-  // repo, regardless of whether verification would pass). Union with the global
-  // declared types gives the governed set.
-  workspaceDeclaredTypes: [],
 };
 
 function identityOrNull() {
   return getPlatformIdentity().identity;
 }
 
-function effectiveServerId(hint) {
+function effectiveServerId(hint, identity = identityOrNull()) {
   if (hint) return hint;
-  return identityOrNull()?.serverId ?? "default";
+  if (identity?.serverId) return identity.serverId;
+  // A URL is stable for an identity with no JFrog CLI server id, unlike a
+  // shared literal "default" key that can leak cache state across servers.
+  return identity?.url ? `url:${identity.url}` : "default";
 }
 
 function packageResolveSource(serverId, { via } = {}) {
@@ -124,13 +131,17 @@ function normalizeServerEntry(entry) {
     cached_at: entry.cached_at,
     source: entry.source,
     agentsConfigMtimeMs: entry.agentsConfigMtimeMs,
+    url: typeof entry.url === "string" ? entry.url : null,
   };
 }
 
-function isEntryFresh(entry, agentsConfigMtimeMs, cacheTtlDays) {
+function isEntryFresh(entry, agentsConfigMtimeMs, cacheTtlDays, url) {
   if (!entry?.cached_at) return false;
   if (cacheTtlDays === 0) return false;
   if (entry.agentsConfigMtimeMs !== agentsConfigMtimeMs) return false;
+  // Schema-1 entries have no URL. Refresh them once instead of trusting an
+  // entry verified against a server the user may have switched away from.
+  if (!entry.url || entry.url !== url) return false;
   const ttlMs = cacheTtlDays * 24 * 60 * 60 * 1000;
   const age = Date.now() - new Date(entry.cached_at).getTime();
   return age >= 0 && age < ttlMs;
@@ -163,19 +174,25 @@ function normalizeCacheRoot(data) {
   return { schemaVersion: CACHE_SCHEMA_VERSION, servers };
 }
 
-async function fetchRepoConfig(repoKey) {
-  const id = identityOrNull();
+async function fetchRepoConfig(repoKey, id, deadline) {
   if (!id) return null;
   const url = `${id.url}/artifactory/api/repositories/${encodeURIComponent(repoKey)}`;
   // Network call on session start (cache miss + verifyRepos) — log at info so a
   // fresh session's Artifactory calls are visible without enabling debug.
   log.info("verifying repo via Artifactory API", { repoKey, url });
+  const authorization = authHeader(id);
+  if (!authorization) return null;
+  // Bound the call so a stalled Artifactory can't hang session start.
+  const controller = new AbortController();
+  const remaining = Math.max(0, deadline - Date.now());
+  const timer = setTimeout(() => controller.abort(), remaining);
   try {
     const res = await fetch(url, {
       headers: {
-        Authorization: `Bearer ${id.token}`,
+        Authorization: authorization,
         Accept: "application/json",
       },
+      signal: controller.signal,
     });
     if (!res.ok) {
       log.debug("repo verify miss", { repoKey, status: res.status });
@@ -185,9 +202,11 @@ async function fetchRepoConfig(repoKey) {
   } catch (err) {
     log.warn("repo verify threw", {
       repoKey,
-      error: err?.message ?? String(err),
+      error: safeErrorMessage(err),
     });
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -215,31 +234,51 @@ function entryToByType(entry, base) {
   return byType;
 }
 
-async function refreshServerCache(serverId) {
-  const id = identityOrNull();
+async function refreshServerCache(
+  serverId,
+  id = identityOrNull(),
+  verifyDeadline = Date.now() + REPO_VERIFY_BUDGET_MS,
+) {
   const base = id ? `${id.url}/artifactory` : "";
   const repositories = {};
   const pr = loadAgentsConfig().packageResolution;
   const verifyRepos = pr.verifyRepos;
   const adminRepos = pr.defaultGlobalRepos ?? {};
   const agentsConfigMtimeMs = getAgentsConfigMtimeMs();
-
-  for (const type of PACKAGE_TYPES) {
+  const configured = PACKAGE_TYPES.flatMap((type) => {
     const repoKey = adminRepos[type];
     if (!repoKey) {
       log.debug("unconfigured type", { type });
-      continue;
+      return [];
     }
-
-    if (verifyRepos) {
-      const config = await fetchRepoConfig(repoKey);
-      if (!config || !repoMatchesPackageType(config, type)) {
+    return [{ type, repoKey }];
+  });
+  const adminConfiguredCount = configured.length;
+
+  if (verifyRepos) {
+    // Each repository lookup is independent. Parallel verification keeps a
+    // cold session within the hook's 15-second budget instead of multiplying
+    // the five-second request timeout by every configured package type.
+    const verified = await Promise.all(
+      configured.map(async ({ type, repoKey }) => {
+        const config = await fetchRepoConfig(repoKey, id, verifyDeadline);
+        return {
+          type,
+          repoKey,
+          verified: Boolean(config && repoMatchesPackageType(config, type)),
+        };
+      }),
+    );
+    for (const { type, repoKey, verified: isVerified } of verified) {
+      if (!isVerified) {
         log.warn("repo verify failed", { type, repoKey, serverId });
         continue;
       }
       repositories[type] = repoKey;
       log.debug("resolved from agents-conf.json (verified)", { type, repoKey });
-    } else {
+    }
+  } else {
+    for (const { type, repoKey } of configured) {
       repositories[type] = repoKey;
       log.debug("resolved from agents-conf.json (trusted)", { type, repoKey });
     }
@@ -247,20 +286,85 @@ async function refreshServerCache(serverId) {
 
   const source = verifyRepos ? "verified" : "agents-config";
 
+  const { data: cacheRoot, file } = await readCacheFile();
+  const root = normalizeCacheRoot(cacheRoot);
+  const priorEntry = root.servers[serverId];
+  const priorHasRepos = Boolean(
+    priorEntry?.repositories && Object.keys(priorEntry.repositories).length,
+  );
+
+  // A total verify failure (every admin-configured type failed the repo
+  // check — e.g. Artifactory briefly unreachable) must not pin an empty
+  // `repositories: {}` with a fresh `cached_at` for the full TTL:
+  // - prior good entry → keep it (and its cached_at)
+  // - no prior → skip writeCacheFile so the next session retries verify
+  if (
+    verifyRepos &&
+    adminConfiguredCount > 0 &&
+    Object.keys(repositories).length === 0
+  ) {
+    if (priorHasRepos) {
+      log.warn(
+        "repo verify failed for every configured type — keeping prior cache " +
+          "entry instead of pinning an empty one",
+        { serverId, configuredCount: adminConfiguredCount },
+      );
+      SESSION.serverId = serverId;
+      SESSION.byType = entryToByType(priorEntry, base);
+      SESSION.meta = buildResolveMeta(serverId, priorEntry, {
+        via: "refresh-verify-failed-kept-prior",
+        cacheFile: file,
+      });
+      return;
+    }
+    log.warn(
+      "repo verify failed for every configured type — skipping empty cache " +
+        "write so the next session retries verification",
+      { serverId, configuredCount: adminConfiguredCount },
+    );
+    const empty = {
+      repositories: {},
+      cached_at: new Date().toISOString(),
+      source,
+      agentsConfigMtimeMs,
+      url: id?.url ?? null,
+    };
+    SESSION.serverId = serverId;
+    SESSION.byType = {};
+    SESSION.meta = buildResolveMeta(serverId, empty, {
+      via: "refresh-verify-failed-no-cache",
+      cacheFile: file,
+    });
+    return;
+  }
+
+  // Partial verify failure: keep prior keys for admin-configured types that
+  // failed this round so a transient blip on one type does not ungover that
+  // type for the full cache TTL.
+  if (verifyRepos && priorHasRepos) {
+    for (const [type, repoKey] of Object.entries(priorEntry.repositories)) {
+      if (repositories[type] || !adminRepos[type]) continue;
+      repositories[type] = repoKey;
+      log.warn("repo verify failed — keeping prior cache value for type", {
+        type,
+        repoKey,
+        serverId,
+      });
+    }
+  }
+
   const entry = {
     repositories,
     cached_at: new Date().toISOString(),
     source,
     agentsConfigMtimeMs,
+    url: id?.url ?? null,
   };
 
-  const { data: cacheRoot } = await readCacheFile();
-  const root = normalizeCacheRoot(cacheRoot);
   root.servers[serverId] = entry;
   await writeCacheFile(root);
 
   const via = verifyRepos ? "refresh-verified" : "refresh-agents-config";
-  const file = cacheFile();
   SESSION.serverId = serverId;
   SESSION.byType = entryToByType(entry, base);
   SESSION.meta = buildResolveMeta(serverId, entry, { via, cacheFile: file });
@@ -272,17 +376,19 @@ async function refreshServerCache(serverId) {
   });
 }
 
-async function loadFreshCacheEntry(serverId) {
+async function loadFreshCacheEntry(serverId, id = identityOrNull()) {
   const pr = loadAgentsConfig().packageResolution;
   const agentsConfigMtimeMs = getAgentsConfigMtimeMs();
   const { data, file } = await readCacheFile();
   const entry = normalizeServerEntry(
     normalizeCacheRoot(data).servers[serverId],
   );
-  if (!entry || !isEntryFresh(entry, agentsConfigMtimeMs, pr.cacheTtlDays))
+  if (
+    !entry ||
+    !isEntryFresh(entry, agentsConfigMtimeMs, pr.cacheTtlDays, id?.url ?? "")
+  )
     return null;
 
-  const id = identityOrNull();
   const base = id ? `${id.url}/artifactory` : "";
   SESSION.serverId = serverId;
   SESSION.byType = entryToByType(entry, base);
@@ -299,14 +405,18 @@ async function loadFreshCacheEntry(serverId) {
   return entry;
 }
 
-async function ensureSessionResolved(serverIdHint) {
-  const serverId = effectiveServerId(serverIdHint);
+async function ensureSessionResolved(
+  serverIdHint,
+  verifyDeadline = Date.now() + REPO_VERIFY_BUDGET_MS,
+) {
+  const id = identityOrNull();
+  const serverId = effectiveServerId(serverIdHint, id);
   if (SESSION.serverId === serverId && SESSION.byType) return;
 
-  const cached = await loadFreshCacheEntry(serverId);
+  const cached = await loadFreshCacheEntry(serverId, id);
   if (cached) return;
 
-  await refreshServerCache(serverId);
+  await refreshServerCache(serverId, id, verifyDeadline);
 }
 
 function workspaceOverlayMetaApplied(workspaceRoots, pick, overridden) {
@@ -317,8 +427,10 @@ function workspaceOverlayMetaApplied(workspaceRoots, pick, overridden) {
   };
 }
 
-async function applyWorkspaceOverlay(workspaceRoots) {
-  SESSION.workspaceDeclaredTypes = [];
+async function applyWorkspaceOverlay(
+  workspaceRoots,
+  verifyDeadline = Date.now() + REPO_VERIFY_BUDGET_MS,
+) {
   const roots = workspaceRoots?.length ? workspaceRoots : [];
   const pick = pickWorkspaceConfigRoot(roots);
 
@@ -346,12 +458,47 @@ async function applyWorkspaceOverlay(workspaceRoots) {
 
   const id = identityOrNull();
   const base = id ? `${id.url}/artifactory` : "";
+  const pr = loadAgentsConfig().packageResolution;
+  const adminRepos = pr.defaultGlobalRepos ?? {};
   const overridden = [];
-  const declared = [];
 
-  for (const [type, repoKey] of Object.entries(ws.config.repositories)) {
-    if (!repoKey || !PACKAGE_TYPES.includes(type)) continue;
-    declared.push(type);
+  const requested = Object.entries(ws.config.repositories).flatMap(
+    ([type, repoKey]) => {
+      if (!repoKey || !PACKAGE_TYPES.includes(type)) return [];
+      if (!adminRepos[type]) {
+        log.warn("workspace repo ignored; type is not admin-approved", {
+          type,
+          repoKey,
+          file: pick.configFile,
+        });
+        return [];
+      }
+      return [{ type, repoKey }];
+    },
+  );
+
+  const validated = pr.verifyRepos
+    ? await Promise.all(
+        requested.map(async ({ type, repoKey }) => {
+          const config = await fetchRepoConfig(repoKey, id, verifyDeadline);
+          return {
+            type,
+            repoKey,
+            verified: Boolean(config && repoMatchesPackageType(config, type)),
+          };
+        }),
+      )
+    : requested.map(({ type, repoKey }) => ({ type, repoKey, verified: true }));
+
+  for (const { type, repoKey, verified } of validated) {
+    if (!verified) {
+      log.warn("workspace repo verify failed", {
+        type,
+        repoKey,
+        file: pick.configFile,
+      });
+      continue;
+    }
     SESSION.byType[type] = {
       type,
       repoKey,
@@ -360,8 +507,6 @@ async function applyWorkspaceOverlay(workspaceRoots) {
     overridden.push(`${type}:${repoKey}`);
   }
 
-  SESSION.workspaceDeclaredTypes = declared;
-
   if (!overridden.length) {
     log.debug("workspace overlay skipped", {
       reason: "no-repositories",
@@ -389,25 +534,22 @@ async function applyWorkspaceOverlay(workspaceRoots) {
  * Call once per sessionStart before resolve(type) loops.
  */
 export async function prepareSessionResolve({ serverId, workspaceRoots } = {}) {
-  await ensureSessionResolved(serverId);
-  await applyWorkspaceOverlay(workspaceRoots);
+  const verifyDeadline = Date.now() + REPO_VERIFY_BUDGET_MS;
+  await ensureSessionResolved(serverId, verifyDeadline);
+  await applyWorkspaceOverlay(workspaceRoots, verifyDeadline);
 }
 
 /**
  * Governed (handled) package types for this session = admin-declared
- * (`defaultGlobalRepos` keys) UNION workspace-declared (`.jfrog/local` keys),
- * ordered by PACKAGE_TYPES. "Declared" — not "resolved": a governed type whose
- * repo fails to resolve/verify stays governed (and blocks) rather than falling
- * through to a public registry. MUST be called after prepareSessionResolve so
- * the workspace side is populated.
+ * (`defaultGlobalRepos` keys), ordered by PACKAGE_TYPES. Workspace files may
+ * override only these administrator-approved types. A governed type whose repo
+ * fails to resolve/verify stays governed (and blocks) rather than falling
+ * through to a public registry.
  * @returns {string[]}
  */
 export function governedPackageTypes() {
-  const union = new Set([
-    ...globalDeclaredTypes(),
-    ...(SESSION.workspaceDeclaredTypes ?? []),
-  ]);
-  return PACKAGE_TYPES.filter((type) => union.has(type));
+  const declared = new Set(globalDeclaredTypes());
+  return PACKAGE_TYPES.filter((type) => declared.has(type));
 }
 
 export async function resolve(type, { serverId: serverIdHint } = {}) {
@@ -439,7 +581,6 @@ export async function invalidateResolveCache(serverIdHint) {
   SESSION.serverId = null;
   SESSION.byType = null;
   SESSION.meta = null;
-  SESSION.workspaceDeclaredTypes = [];
   const serverId = effectiveServerId(serverIdHint);
   const { data } = await readCacheFile();
   const root = normalizeCacheRoot(data);
@@ -461,7 +602,7 @@ if (isMain) {
   if (!result) {
     console.error(`No repo resolved for type=${type}.`);
     console.error(
-      "Live mode needs a configured `jf` server with an access token (run `jf c add`).",
+      "Live mode needs a configured `jf` server (access token or username + password / API key; run `jf c add`).",
     );
     process.exit(2);
   }
diff --git a/plugins/jfrog/modules/package-resolution/scripts/setup-conflict.mjs b/plugins/jfrog/modules/package-resolution/scripts/setup-conflict.mjs
new file mode 100644
index 0000000..65ac06c
--- /dev/null
+++ b/plugins/jfrog/modules/package-resolution/scripts/setup-conflict.mjs
@@ -0,0 +1,807 @@
+// Detect when zero-touch `jf setup` would silently repoint an existing
+// user-level package-manager config at a different Artifactory (or public
+// registry). Fail-safe: skip that package manager and surface it in the
+// session note — never auto-overwrite; the note tells the agent to ask the
+// user, then run explicit `jf setup` only after they confirm.
+//
+// Ownership: this is an APR/hooks-layer guard. Do NOT "fix" silent-repoint
+// by changing jfrog-cli-artifactory / jfrog-cli-core `jf setup` writers —
+// those commands intentionally overwrite when the user (or skill) asks.
+// autoSetup is the unattended path that must refuse foreign hosts here.
+
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+import { createLogger } from "../../core/logger.mjs";
+
+const log = createLogger("setup-conflict");
+
+/**
+ * @param {string} [home]
+ * @returns {string}
+ */
+function resolveHome(home) {
+  if (home) return home;
+  // Match agents-config: Node `homedir()` (USERPROFILE on Windows). Preferring
+  // process.env.HOME on win32 breaks under MSYS/Git Bash path shapes.
+  if (process.platform === "win32") return homedir();
+  return process.env.HOME || homedir();
+}
+
+/**
+ * Strip matching single/double quotes wrapping an npmrc value.
+ * @param {string} raw
+ * @returns {string}
+ */
+export function stripWrappedQuotes(raw) {
+  const s = String(raw ?? "").trim();
+  if (
+    (s.startsWith('"') && s.endsWith('"') && s.length >= 2) ||
+    (s.startsWith("'") && s.endsWith("'") && s.length >= 2)
+  ) {
+    return s.slice(1, -1).trim();
+  }
+  return s;
+}
+
+/**
+ * Host (lowercase, no port) from a URL or registry string, or "".
+ * @param {string} raw
+ * @returns {string}
+ */
+export function registryHost(raw) {
+  if (!raw) return "";
+  let s = stripWrappedQuotes(raw);
+  if (!s) return "";
+  try {
+    if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(s)) {
+      s = `https://${s}`;
+    }
+    return new URL(s).hostname.toLowerCase();
+  } catch {
+    return s
+      .replace(/^https?:\/\//i, "")
+      .split("/")[0]
+      .split(":")[0]
+      .toLowerCase();
+  }
+}
+
+/**
+ * Parse registry URLs from an npmrc body. Returns the default `registry=`
+ * value(s) when present; only falls back to `@scope:registry=` values when no
+ * default is set (a foreign scoped registry is not a `jf setup` conflict).
+ * @param {string} body
+ * @returns {string[]} registry URL values
+ */
+export function parseNpmrcRegistries(body) {
+  /** @type {string[]} */
+  const def = [];
+  /** @type {string[]} */
+  const scoped = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";"))
+      continue;
+    const m = trimmed.match(/^(@[^\s:]+:)?registry\s*=\s*(.+)$/i);
+    if (m) (m[1] ? scoped : def).push(stripWrappedQuotes(m[2]));
+  }
+  // `jf setup` only repoints the DEFAULT registry, so a foreign default is a
+  // real conflict but a foreign `@scope:registry=` is not (setup won't touch
+  // it). Prefer the default; fall back to scoped only when no default is set.
+  return def.length ? def : scoped;
+}
+
+/**
+ * Parse pip `index-url` / `extra-index-url` values from a pip.conf body.
+ * Mirrors paths used by jfrog-cli-artifactory setup (PIP_CONFIG_FILE or
+ * ~/.config/pip/pip.conf / %APPDATA%/pip/pip.ini).
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parsePipIndexUrls(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";"))
+      continue;
+    if (trimmed.startsWith("[")) continue;
+    const m = trimmed.match(/^(?:extra-)?index-url\s*=\s*(.+)$/i);
+    if (m) out.push(stripWrappedQuotes(m[1]));
+  }
+  return out;
+}
+
+/**
+ * Candidate pip config file paths (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pipConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.PIP_CONFIG_FILE) out.push(process.env.PIP_CONFIG_FILE);
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "pip", "pip.ini"));
+  }
+  if (process.platform === "darwin") {
+    // pip reads the macOS per-user path ahead of the XDG fallback.
+    out.push(path.join(h, "Library", "Application Support", "pip", "pip.conf"));
+  }
+  out.push(path.join(h, ".config", "pip", "pip.conf"));
+  out.push(path.join(h, ".pip", "pip.conf"));
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readPipIndexes(home) {
+  const h = resolveHome(home);
+  for (const file of pipConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parsePipIndexUrls(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Parse GOPROXY list from a go env file body (`key = value` lines).
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseGoProxyList(body) {
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const m = line.trim().match(/^GOPROXY\s*=\s*(.+)$/i);
+    if (!m) continue;
+    return m[1]
+      .split(",")
+      .map((s) => stripWrappedQuotes(s.trim()))
+      .filter(
+        (s) => s && s.toLowerCase() !== "direct" && s.toLowerCase() !== "off",
+      );
+  }
+  return [];
+}
+
+/**
+ * @param {string} targetUrl Artifactory base or package-type URL
+ * @param {string[]} existingRegistries
+ * @returns {{ conflict: boolean, existing?: string, targetHost?: string, existingHost?: string }}
+ */
+export function conflictAgainstTarget(targetUrl, existingRegistries) {
+  const targetHost = registryHost(targetUrl);
+  if (!targetHost) return { conflict: false };
+  for (const existing of existingRegistries) {
+    const existingHost = registryHost(existing);
+    if (!existingHost) continue;
+    if (existingHost !== targetHost) {
+      return { conflict: true, existing, targetHost, existingHost };
+    }
+  }
+  return { conflict: false, targetHost };
+}
+
+/**
+ * Prefer explicit registry URL lines; fall back to scoped-auth hosts only when
+ * no `registry=` / YAML registry is set (auth-only configs still conflict).
+ * Avoids leftover public `_authToken` lines false-conflicting when the live
+ * registry already points at Artifactory.
+ * @param {string[]} registryUrls
+ * @param {string[]} authHosts
+ * @returns {string[]}
+ */
+function preferRegistryUrls(registryUrls, authHosts) {
+  return registryUrls.length ? registryUrls : authHosts;
+}
+
+/**
+ * Candidate npmrc paths (first existing wins). Honor NPM_CONFIG_USERCONFIG
+ * the same way pip honors PIP_CONFIG_FILE — live isolation redirects there.
+ * pnpm does NOT read this file for its own config (see
+ * {@link pnpmConfigFileCandidates}) — this is npm only.
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function npmrcFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.NPM_CONFIG_USERCONFIG) {
+    out.push(process.env.NPM_CONFIG_USERCONFIG);
+  }
+  out.push(path.join(h, ".npmrc"));
+  return out;
+}
+
+/**
+ * Read npm user config registries (NPM_CONFIG_USERCONFIG or $HOME/.npmrc).
+ * Includes `registry=` lines and scoped-auth hosts (`//host/:_authToken=`) so
+ * auth-only npmrc (default registry = public npm) still conflicts.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readNpmRegistries(home) {
+  for (const file of npmrcFileCandidates(resolveHome(home))) {
+    if (!existsSync(file)) continue;
+    try {
+      const body = readFileSync(file, "utf8");
+      return preferRegistryUrls(
+        parseNpmrcRegistries(body),
+        parseAuthIniHosts(body),
+      );
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Extract registry hosts from npmrc-style scoped-auth lines
+ * (`//hostname[:port]/path:_authToken=…`, `:_auth=…`, `:_password=…`). pnpm's
+ * `auth.ini` stores credentials this way without a `registry=` line, so a
+ * conflict can only be detected from the host in the auth key.
+ * @param {string} body
+ * @returns {string[]} hostnames (with port, if present — registryHost strips it)
+ */
+export function parseAuthIniHosts(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";"))
+      continue;
+    const m = trimmed.match(
+      /^\/\/([^/\s]+)\/\S*:_(?:authToken|auth|password)\b/i,
+    );
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+
+/**
+ * Extract registry URLs from a pnpm `config.yaml` body (`registry: https://…`
+ * or quoted). Nested `registries:` maps are out of scope.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parsePnpmConfigYamlRegistries(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^registry\s*:\s*(.+)$/i);
+    if (m) out.push(stripWrappedQuotes(m[1]));
+  }
+  return out;
+}
+
+/**
+ * pnpm global config directories, in the order pnpm itself resolves them
+ * (first that exists is authoritative for pnpm; here we scan every one since
+ * auth vs. registry settings can be split across sibling files).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pnpmConfigDirCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.XDG_CONFIG_HOME) {
+    out.push(path.join(process.env.XDG_CONFIG_HOME, "pnpm"));
+  }
+  out.push(path.join(h, ".config", "pnpm"));
+  if (process.platform === "darwin") {
+    out.push(path.join(h, "Library", "Preferences", "pnpm"));
+  }
+  if (process.platform === "win32") {
+    const localAppData =
+      process.env.LOCALAPPDATA || path.join(h, "AppData", "Local");
+    out.push(path.join(localAppData, "pnpm"));
+  }
+  return out;
+}
+
+/** File names pnpm may keep global config/auth in, under a config dir. */
+const PNPM_CONFIG_FILE_NAMES = ["auth.ini", "rc", "config.yaml", ".npmrc"];
+
+/**
+ * Candidate pnpm config file paths — every `{dir}/{name}` combination across
+ * {@link pnpmConfigDirCandidates} × {@link PNPM_CONFIG_FILE_NAMES}. Unlike
+ * {@link npmrcFileCandidates}, pnpm does NOT honor `NPM_CONFIG_USERCONFIG`
+ * for its own writes/reads — that env var is npm-only.
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pnpmConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  for (const dir of pnpmConfigDirCandidates(h)) {
+    for (const name of PNPM_CONFIG_FILE_NAMES) {
+      out.push(path.join(dir, name));
+    }
+  }
+  return out;
+}
+
+/**
+ * Read pnpm registries from every existing pnpm config file (auth.ini / rc /
+ * config.yaml / .npmrc under the pnpm config dir). Registries come from
+ * `registry=` lines (config/rc files) and scoped-auth hostnames (auth.ini).
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readPnpmRegistries(home) {
+  const h = resolveHome(home);
+  /** @type {string[]} */
+  const registryUrls = [];
+  /** @type {string[]} */
+  const authHosts = [];
+  for (const file of pnpmConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      const body = readFileSync(file, "utf8");
+      registryUrls.push(...parseNpmrcRegistries(body));
+      authHosts.push(...parseAuthIniHosts(body));
+      if (
+        file.endsWith(`${path.sep}config.yaml`) ||
+        file.endsWith("config.yaml")
+      ) {
+        registryUrls.push(...parsePnpmConfigYamlRegistries(body));
+      }
+    } catch {
+      // try next file
+    }
+  }
+  return preferRegistryUrls(registryUrls, authHosts);
+}
+
+/**
+ * Parse index / extra-index URLs from a uv.toml (or uv config) body.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseUvIndexUrls(body) {
+  const out = [];
+  // Bare `url = …` only counts as a registry inside an [[index]] / [[tool.uv.index]]
+  // table — elsewhere it could be an unrelated key. `index-url` / `extra-index-url`
+  // are top-level and always count.
+  let inIndexTable = false;
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("[")) {
+      inIndexTable = /^\[\[(?:tool\.uv\.)?index\]\]/i.test(trimmed);
+      continue;
+    }
+    const flat = trimmed.match(/^(?:extra-)?index-url\s*=\s*(.+)$/i);
+    if (flat) {
+      const raw = stripWrappedQuotes(flat[1]);
+      if (raw) out.push(raw);
+      continue;
+    }
+    if (inIndexTable) {
+      const urlLine = trimmed.match(/^url\s*=\s*(.+)$/i);
+      if (urlLine) {
+        const raw = stripWrappedQuotes(urlLine[1]);
+        if (raw) out.push(raw);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Candidate uv config paths (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function uvConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.UV_CONFIG_FILE) out.push(process.env.UV_CONFIG_FILE);
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "uv", "uv.toml"));
+  }
+  out.push(path.join(h, ".config", "uv", "uv.toml"));
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readUvIndexes(home) {
+  const h = resolveHome(home);
+  for (const file of uvConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parseUvIndexUrls(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Candidate GOENV file paths for this platform (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function goEnvFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.GOENV) out.push(process.env.GOENV);
+  if (process.platform === "darwin") {
+    out.push(path.join(h, "Library", "Application Support", "go", "env"));
+  } else if (process.platform === "win32") {
+    const appData = process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "go", "env"));
+  }
+  // Linux XDG + common fallback on all platforms
+  out.push(path.join(h, ".config", "go", "env"));
+  return out;
+}
+
+/**
+ * Read GOPROXY from platform GOENV locations.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readGoProxies(home) {
+  const h = resolveHome(home);
+  for (const file of goEnvFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parseGoProxyList(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * ID used by `jf setup maven` for the Artifactory mirror in settings.xml
+ * (jfrog-cli-core `maven.ArtifactoryMirrorID`). Setup repoints this mirror
+ * in place — it does not add a second one.
+ */
+export const ARTIFACTORY_MAVEN_MIRROR_ID = "artifactory-mirror";
+
+/**
+ * Strip XML comments so commented-out mirror blocks are not treated as active.
+ * @param {string} xml
+ * @returns {string}
+ */
+function stripXmlComments(xml) {
+  return String(xml || "").replace(/<!--[\s\S]*?-->/g, "");
+}
+
+/**
+ * Text content of a simple XML element body (plain text or one CDATA section).
+ * @param {string} inner
+ * @returns {string}
+ */
+function xmlElementText(inner) {
+  const s = String(inner || "");
+  const cdata = s.match(/<!\[CDATA\[([\s\S]*?)\]\]>/);
+  if (cdata) return cdata[1].trim();
+  // Drop nested markup if present; mirror id/url are text nodes in practice.
+  return s.replace(/<[^>]+>/g, "").trim();
+}
+
+/**
+ * Extract the Artifactory mirror URL from a Maven settings.xml body.
+ * Only the mirror with id {@link ARTIFACTORY_MAVEN_MIRROR_ID} counts —
+ * that is what `jf setup maven` overwrites.
+ * @param {string} body
+ * @returns {string[]} zero or one URL
+ */
+export function parseMavenArtifactoryMirrorUrls(body) {
+  // Not a full XML DOM — strip comments + CDATA text extraction covers the
+  // failure modes that matter for conflict detection without a new dependency.
+  const xml = stripXmlComments(String(body || ""));
+  /** @type {string[]} */
+  const out = [];
+  const mirrorRe = /<mirror\b[^>]*>([\s\S]*?)<\/mirror>/gi;
+  let m;
+  while ((m = mirrorRe.exec(xml)) !== null) {
+    const block = m[1];
+    const idMatch = block.match(/<id\b[^>]*>([\s\S]*?)<\/id>/i);
+    if (!idMatch) continue;
+    if (xmlElementText(idMatch[1]) !== ARTIFACTORY_MAVEN_MIRROR_ID) continue;
+    const urlMatch = block.match(/<url\b[^>]*>([\s\S]*?)<\/url>/i);
+    if (urlMatch) {
+      const url = stripWrappedQuotes(xmlElementText(urlMatch[1]));
+      if (url) out.push(url);
+    }
+  }
+  return out;
+}
+
+/**
+ * Candidate Maven settings.xml paths (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function mavenSettingsFileCandidates(h) {
+  return [path.join(h, ".m2", "settings.xml")];
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readMavenMirrorUrls(home) {
+  const h = resolveHome(home);
+  for (const file of mavenSettingsFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parseMavenArtifactoryMirrorUrls(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * @param {string} child
+ * @param {string} parent
+ * @returns {boolean}
+ */
+function pathIsUnderOrEqual(child, parent) {
+  const c = path.resolve(child);
+  const p = path.resolve(parent);
+  return c === p || c.startsWith(p + path.sep);
+}
+
+/**
+ * True when `h` is the process home (production). Temp test homes must not
+ * inherit ambient GRADLE_USER_HOME / XDG_CONFIG_HOME outside the sandbox.
+ * @param {string} h
+ * @returns {boolean}
+ */
+function isProcessHome(h) {
+  return path.resolve(h) === path.resolve(resolveHome());
+}
+
+/**
+ * Fixed filename written by `jf setup gradle` under `$GRADLE_USER_HOME/init.d/`.
+ * (jfrog-cli-artifactory `gradle.InitScriptName`).
+ */
+export const ARTIFACTORY_GRADLE_INIT_SCRIPT = "jfrog.init.gradle";
+
+/**
+ * Drop Groovy/Java-style comments so commented-out `def artifactoryUrl`
+ * lines are not treated as active (same idea as Maven XML comment stripping).
+ * @param {string} body
+ * @returns {string}
+ */
+function stripGroovyComments(body) {
+  let s = String(body || "");
+  s = s.replace(/\/\*[\s\S]*?\*\//g, "");
+  s = s.replace(/^\s*\/\/.*$/gm, "");
+  return s;
+}
+
+/**
+ * Parse `def artifactoryUrl = '…'` / `"…"` from a jfrog.init.gradle body.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseGradleArtifactoryUrls(body) {
+  /** @type {string[]} */
+  const out = [];
+  for (const line of stripGroovyComments(body).split(/\r?\n/)) {
+    // Allow optional trailing `// …` after the closing quote. Do not strip
+    // bare `//` inside the line — that would corrupt `https://` in the URL.
+    const m = line.match(
+      /^\s*def\s+artifactoryUrl\s*=\s*(['"])(.+?)\1\s*(?:\/\/.*)?$/,
+    );
+    if (m) {
+      const url = stripWrappedQuotes(m[2]);
+      if (url) out.push(url);
+    }
+  }
+  return out;
+}
+
+/**
+ * Candidate paths for the JFrog Gradle init script (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function gradleInitFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  const guh = process.env.GRADLE_USER_HOME;
+  if (guh && (pathIsUnderOrEqual(guh, h) || isProcessHome(h))) {
+    out.push(path.join(guh, "init.d", ARTIFACTORY_GRADLE_INIT_SCRIPT));
+  }
+  const fallback = path.join(
+    h,
+    ".gradle",
+    "init.d",
+    ARTIFACTORY_GRADLE_INIT_SCRIPT,
+  );
+  if (!out.includes(fallback)) out.push(fallback);
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readGradleArtifactoryUrls(home) {
+  const h = resolveHome(home);
+  for (const file of gradleInitFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      const urls = parseGradleArtifactoryUrls(readFileSync(file, "utf8"));
+      if (urls.length) return urls;
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Source name used by `jf setup nuget` / `jf setup dotnet`
+ * (jfrog-cli-artifactory `dotnet.SourceName`).
+ */
+export const ARTIFACTORY_NUGET_SOURCE_NAME = "JFrogCli";
+
+/** @param {string} s */
+function escapeRegExp(s) {
+  return String(s).replace(/[\\^$*+?.()|[\]{}]/g, "\\$&");
+}
+
+/**
+ * Extract the JFrogCli package source URL from a NuGet.Config body.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseNugetJFrogCliSourceUrls(body) {
+  // Same as Maven: ignore commented-out <add …/> blocks.
+  const xml = stripXmlComments(String(body || ""));
+  /** @type {string[]} */
+  const out = [];
+  const key = escapeRegExp(ARTIFACTORY_NUGET_SOURCE_NAME);
+  // <add key="…" value="https://…" …/>  (attribute order may vary)
+  const re = new RegExp(
+    `<add\\b[^>]*\\bkey\\s*=\\s*["']${key}["'][^>]*\\bvalue\\s*=\\s*["']([^"']+)["'][^>]*\\/?>`,
+    "gi",
+  );
+  let m;
+  while ((m = re.exec(xml)) !== null) {
+    const url = stripWrappedQuotes(m[1]);
+    if (url) out.push(url);
+  }
+  // value before key
+  const re2 = new RegExp(
+    `<add\\b[^>]*\\bvalue\\s*=\\s*["']([^"']+)["'][^>]*\\bkey\\s*=\\s*["']${key}["'][^>]*\\/?>`,
+    "gi",
+  );
+  while ((m = re2.exec(xml)) !== null) {
+    const url = stripWrappedQuotes(m[1]);
+    if (url) out.push(url);
+  }
+  return [...new Set(out)];
+}
+
+/**
+ * Candidate NuGet.Config paths (scan all that exist; first hit with JFrogCli wins via reader).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function nugetConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  // dotnet default
+  out.push(path.join(h, ".nuget", "NuGet", "NuGet.Config"));
+  // nuget / XDG-style — only ambient XDG when under sandbox home or real HOME
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (xdg && (pathIsUnderOrEqual(xdg, h) || isProcessHome(h))) {
+    out.push(path.join(xdg, "NuGet", "NuGet.Config"));
+  }
+  out.push(path.join(h, ".config", "NuGet", "NuGet.Config"));
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    if (pathIsUnderOrEqual(appData, h) || isProcessHome(h)) {
+      out.push(path.join(appData, "NuGet", "NuGet.Config"));
+    } else {
+      out.push(path.join(h, "AppData", "Roaming", "NuGet", "NuGet.Config"));
+    }
+  }
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readNugetJFrogCliUrls(home) {
+  const h = resolveHome(home);
+  for (const file of nugetConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      const urls = parseNugetJFrogCliSourceUrls(readFileSync(file, "utf8"));
+      if (urls.length) return urls;
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Whether running `jf setup <packageManager>` for `targetUrl` would repoint
+ * an existing user-level registry away from another host.
+ *
+ * Covered today: npm (`NPM_CONFIG_USERCONFIG` / `$HOME/.npmrc`), pnpm
+ * (own `auth.ini`/`rc`/`config.yaml` under the pnpm config dir **plus**
+ * npm's userconfig — some `jf setup pnpm` builds still write via
+ * `NPM_CONFIG_USERCONFIG`, so a foreign `.npmrc` must block pnpm too),
+ * pip/pipenv (`PIP_CONFIG_FILE` / platform pip.conf), uv
+ * (`UV_CONFIG_FILE` / uv.toml), go (platform GOENV paths), maven
+ * (`$HOME/.m2/settings.xml` mirror id `artifactory-mirror`), gradle
+ * (`$GRADLE_USER_HOME/init.d/jfrog.init.gradle`), nuget/dotnet
+ * (`JFrogCli` source in NuGet.Config).
+ * docker/podman/helm are additive logins (not default-registry overwrite) —
+ * left uncovered until product treats multi-host auth as a conflict.
+ *
+ * @param {string} packageManager
+ * @param {string} targetUrl platform or package URL whose host is the target
+ * @param {{ home?: string }} [opts]
+ * @returns {{ conflict: boolean, existing?: string, targetHost?: string, existingHost?: string }}
+ */
+export function detectSetupConflict(packageManager, targetUrl, opts = {}) {
+  const pm = String(packageManager || "").toLowerCase();
+  let existing = [];
+  if (pm === "npm") {
+    existing = readNpmRegistries(opts.home);
+  } else if (pm === "pnpm") {
+    // Union: native pnpm config + npm userconfig. Native-only misses
+    // CLI builds that still configure pnpm by rewriting NPM_CONFIG_USERCONFIG.
+    existing = [
+      ...readPnpmRegistries(opts.home),
+      ...readNpmRegistries(opts.home),
+    ];
+  } else if (pm === "pip" || pm === "pipenv") {
+    existing = readPipIndexes(opts.home);
+  } else if (pm === "uv") {
+    existing = readUvIndexes(opts.home);
+  } else if (pm === "go") {
+    existing = readGoProxies(opts.home);
+  } else if (pm === "maven" || pm === "mvn") {
+    existing = readMavenMirrorUrls(opts.home);
+  } else if (pm === "gradle") {
+    existing = readGradleArtifactoryUrls(opts.home);
+  } else if (pm === "nuget" || pm === "dotnet") {
+    existing = readNugetJFrogCliUrls(opts.home);
+  } else {
+    // docker / podman / helm: additive registry login — not a silent default rewrite
+    return { conflict: false };
+  }
+
+  if (!existing.length) return { conflict: false };
+
+  const result = conflictAgainstTarget(targetUrl, existing);
+  if (result.conflict) {
+    log.info("eager setup conflict: existing registry points elsewhere", {
+      packageManager: pm,
+      existingHost: result.existingHost,
+      targetHost: result.targetHost,
+    });
+  }
+  return result;
+}
diff --git a/plugins/jfrog/modules/package-resolution/scripts/workspace-config.mjs b/plugins/jfrog/modules/package-resolution/scripts/workspace-config.mjs
index 7a38a40..177e443 100644
--- a/plugins/jfrog/modules/package-resolution/scripts/workspace-config.mjs
+++ b/plugins/jfrog/modules/package-resolution/scripts/workspace-config.mjs
@@ -6,6 +6,7 @@
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { isSafeRepoKey } from "./repo-types.mjs";
 
 export const WORKSPACE_CONFIG_FILE = "package-resolution.json";
 
@@ -36,7 +37,7 @@ function normalizeWorkspaceConfig(data) {
   if (!data?.repositories || typeof data.repositories !== "object") return null;
   const repositories = {};
   for (const [type, repoKey] of Object.entries(data.repositories)) {
-    if (typeof repoKey === "string" && repoKey) repositories[type] = repoKey;
+    if (isSafeRepoKey(repoKey)) repositories[type] = repoKey;
   }
   if (!Object.keys(repositories).length) return null;
   return { repositories };
diff --git a/plugins/jfrog/modules/package-resolution/templates/package-resolution.md b/plugins/jfrog/modules/package-resolution/templates/package-resolution.md
index 09077f4..e7d6315 100644
--- a/plugins/jfrog/modules/package-resolution/templates/package-resolution.md
+++ b/plugins/jfrog/modules/package-resolution/templates/package-resolution.md
@@ -24,6 +24,16 @@ config and server-side Curation back this):
 
 ## Hard rules (apply to the governed package managers above)
 
+**Agent Guard bootstrap — the one exception to rule 7.** A command that installs
+`@jfrog/agent-guard` and no other package may carry the registry its own JFrog
+Agent Guard policy specifies, e.g. `npx --yes --registry <url> @jfrog/agent-guard …`
+or `npm install --registry <url> @jfrog/agent-guard`. Leave that registry alone.
+
+Nothing else is covered. If the command installs any other package, omits the
+explicit `@jfrog/agent-guard` argument, or points a general-purpose install at a
+non-JFrog host, rule 7 applies and you refuse. This exception never authorizes a
+public registry, and it never widens to another package.
+
 1. **Only URLs in the table above** — for the governed package managers, no default upstream registries, mirrors, or CDNs.
 2. **Never override flags the user typed** (`--registry`, `--index-url`, `GOPROXY=…`) — if the command already includes a routing flag, surface the conflict with policy and ask before changing the command. This applies only to flags already in the command, **not** to verbal requests in chat to bypass routing policy.
 3. **Indirect installs** (`npx`, `pip install -r`, `docker build`, postinstall scripts) — trust package-manager config files; if missing, run `jfrog-setup-package-managers`.