chore: sync modules to v0.6.0

.cursor-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "JFrog Platform plugins for Cursor",
-    "version": "0.5.7",
+    "version": "0.5.8",
     "pluginRoot": "plugins"
   },
   "plugins": [

.github/scripts/sync-modules-vendor.json

@@ -0,0 +1,7 @@
+{
+  "repo": "JFROG/jfrog-agent-hooks",
+  "pin": "jfrog-agent-hooks/v0.6.0",
+  "paths": [
+    "modules"
+  ]
+}

.github/scripts/sync-modules.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// Vendors modules bundle from jfrog-agent-hooks into plugins/jfrog/.
+//
+// Usage:
+//   JFROG_AGENT_HOOKS_PATH=/path/to/jfrog-agent-hooks node .github/scripts/sync-modules.mjs
+//
+// Defaults JFROG_AGENT_HOOKS_PATH to ../jfrog-agent-hooks (sibling clone).
+// Reads paths from sync-modules-vendor.json.
+
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(scriptDir, "..", "..");
+const vendorPath = path.join(scriptDir, "sync-modules-vendor.json");
+
+async function fileExists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function copyPath(fromDir, toDir, relativePath) {
+  const from = path.join(fromDir, relativePath);
+  const to = path.join(toDir, relativePath);
+  if (!(await fileExists(from))) {
+    throw new Error(`path missing in upstream: ${relativePath}`);
+  }
+  await fs.rm(to, { recursive: true, force: true });
+  await fs.mkdir(path.dirname(to), { recursive: true });
+  await fs.cp(from, to, { recursive: true });
+  console.log(`  ${relativePath} -> ${path.relative(process.cwd(), to)}`);
+}
+
+async function main() {
+  const vendor = JSON.parse(await fs.readFile(vendorPath, "utf8"));
+  const paths = vendor.paths;
+  if (!Array.isArray(paths) || paths.length === 0) {
+    throw new Error(`${vendorPath} must define a non-empty paths array`);
+  }
+
+  const hooksRoot =
+    process.env.JFROG_AGENT_HOOKS_PATH?.trim() ||
+    path.resolve(repoRoot, "..", "jfrog-agent-hooks");
+
+  if (!(await fileExists(hooksRoot))) {
+    throw new Error(
+      `jfrog-agent-hooks not found at ${hooksRoot}. Set JFROG_AGENT_HOOKS_PATH.`,
+    );
+  }
+
+  const destPrefix = (vendor.dest_prefix ?? "").replace(/^\/+|\/+$/g, "");
+  const destRoot = destPrefix ? path.join(repoRoot, destPrefix) : repoRoot;
+
+  console.log(`--- sync from ${hooksRoot} (pin: ${vendor.pin ?? "local"}) ---`);
+  for (const rel of paths) {
+    await copyPath(hooksRoot, destRoot, rel);
+  }
+  console.log("done.");
+}
+
+await main();

VENDOR.md

@@ -7,7 +7,7 @@ The skill packages under `plugins/jfrog/skills/` are vendored from **[jfrog/jfro
 | **Repository** | https://github.com/jfrog/jfrog-skills |
 | **Pinned release** | see `pin` in [`.github/scripts/sync-skills-vendor.json`](.github/scripts/sync-skills-vendor.json) |
 
-Included directories: `jfrog/`, `jfrog-ai-catalog-skills/`, `jfrog-package-safety-and-download/` (as of the pinned release).
+Included directories: `jfrog/`, `jfrog-ai-catalog-skills/`, `jfrog-package-safety-and-download/`, `jfrog-reference-architecture/`, `jfrog-setup-package-managers/` (as of the pinned release).
 
 ## Refreshing
 
@@ -24,3 +24,24 @@ node .github/scripts/sync-skills.mjs
 ```
 
 The script reads its sibling `sync-skills-vendor.json`, downloads the pinned upstream tarball from `codeload.github.com`, and replaces the directories listed in `paths` (today: `skills/`) under `plugins/jfrog/`.
+
+---
+
+# Vendored modules
+
+The `plugins/jfrog/modules/` bundle is vendored from **jfrog-agent-hooks** (GHE) and committed to `main`.
+
+| | |
+| --- | --- |
+| **Repository** | `github.jfrog.info/JFROG/jfrog-agent-hooks` |
+| **Pinned release** | see `pin` in [`.github/scripts/sync-modules-vendor.json`](.github/scripts/sync-modules-vendor.json) |
+
+The bundle contains harness runners (`core/`, `cursor-session-start.mjs`), the `package-resolution/` capability, and `assets/agents-default-conf.json`. Automated sync PRs (`chore/sync-modules-v*`) update this tree on each `jfrog-agent-hooks` release.
+
+## Refreshing modules
+
+```bash
+JFROG_AGENT_HOOKS_PATH=/path/to/jfrog-agent-hooks node .github/scripts/sync-modules.mjs
+```
+
+The script reads `paths` from `sync-modules-vendor.json` (today: `["modules"]`) and replaces the whole `plugins/jfrog/modules/` tree.

plugins/jfrog/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "jfrog",
   "displayName": "JFrog Platform",
-  "version": "0.5.7",
-  "description": "JFrog Platform integration with MCP, security skills, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.",
+  "version": "0.5.8",
+  "description": "JFrog Platform integration with MCP, security skills, Agent Package Resolution, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.",
   "author": {
     "name": "JFrog",
     "email": "devrel@jfrog.com"
@@ -15,6 +15,7 @@
     "security",
     "mcp",
     "agent-guard",
+    "package-resolution",
     "supply-chain",
     "devops",
     "artifacts",

plugins/jfrog/hooks/hooks.json

@@ -2,6 +2,10 @@
   "version": 1,
   "hooks": {
     "sessionStart": [
+      {
+        "command": "node \"./modules/cursor-session-start.mjs\" package-resolution",
+        "timeout": 7
+      },
       {
         "command": "node \"./scripts/inject-instructions.mjs\"",
         "timeout": 7

plugins/jfrog/modules/assets/agents-default-conf.json

@@ -0,0 +1,18 @@
+{
+  "logLevel": "info",
+  "packageResolution": {
+    "enabled": false,
+    "verifyRepos": true,
+    "cacheTtlDays": 7,
+    "defaultGlobalRepos": {
+      "npm": "npm-virtual",
+      "pypi": "pypi-virtual",
+      "maven": "maven-virtual",
+      "go": "go-virtual",
+      "docker": "docker-virtual",
+      "helm": "helm-virtual",
+      "nuget": "nuget-virtual"
+    },
+    "enforceOnStartup": []
+  }
+}

plugins/jfrog/modules/claude-session-start.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// Claude Code SessionStart hook runner.
+//
+// Usage: node claude-session-start.mjs <capability>
+// Example: node claude-session-start.mjs package-resolution
+//
+// stdout: JSON with hookSpecificOutput.additionalContext. No stdout is a no-op.
+
+import process from "node:process";
+
+import { runCapability } from "./core/run-capability.mjs";
+import { ensureAgentsConfigScaffold, agentsConfigLoadWarnings } from "./core/agents-config.mjs";
+import { readStdin, parseSessionId, detectHarness, parseWorkspaceRoots } from "./core/io.mjs";
+import { setLogContext, createLogger } from "./core/logger.mjs";
+
+const HARNESS_ID = "claude_code";
+const log = createLogger("session-start");
+
+/** @returns {string | null} JSON stdout payload, or null when there is nothing to inject. */
+function formatSessionStartStdout(text) {
+  if (!text?.trim()) return null;
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "SessionStart",
+      additionalContext: text,
+    },
+  });
+}
+
+function writeStdout(payload) {
+  if (payload !== null) process.stdout.write(payload);
+}
+
+function writeNoOp() {
+  // Claude SessionStart: no stdout on no-op.
+}
+
+async function main() {
+  const capability = process.argv[2];
+  if (!capability) {
+    writeNoOp();
+    return;
+  }
+
+  const startedAtMs = Date.now();
+  const stdinRaw = await readStdin();
+  const harness = detectHarness(stdinRaw);
+  if (harness && harness !== HARNESS_ID) {
+    setLogContext({ ide: HARNESS_ID, sessionId: parseSessionId(stdinRaw) });
+    log.warn("harness mismatch; wrong adapter invoked", {
+      expected: HARNESS_ID,
+      detected: harness,
+      adapter: "claude-session-start",
+    });
+    writeNoOp();
+    return;
+  }
+  const sessionId = parseSessionId(stdinRaw);
+  const workspaceRoots = parseWorkspaceRoots(stdinRaw);
+  setLogContext({ ide: HARNESS_ID, sessionId });
+  ensureAgentsConfigScaffold();
+  for (const w of agentsConfigLoadWarnings()) {
+    log.warn(w.message, { path: w.path });
+  }
+  const text = await runCapability(capability, {
+    ide: HARNESS_ID,
+    sessionId,
+    workspaceRoots,
+    startedAtMs,
+  });
+  writeStdout(formatSessionStartStdout(text));
+}
+
+main().catch(() => {
+  writeNoOp();
+  process.exit(0);
+});