goldron1 · Sep 16, 2026 · Sep 16, 2026
@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "JFrog Platform plugins for Cursor",
-    "version": "0.6.11",
+    "version": "0.6.12",
     "pluginRoot": "plugins"
   },
   "plugins": [

@@ -1,7 +1,7 @@
 {
   "name": "jfrog",
   "displayName": "JFrog Platform",
-  "version": "0.6.11",
+  "version": "0.6.12",
   "description": "JFrog Platform integration with MCP, security skills, Agent Package Resolution, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.",
   "author": {
     "name": "JFrog",

@@ -26,7 +26,7 @@ Pick the row matching the user's intent and read that reference file.
 | Intent | Read |
 |--------|------|
 | "What skills are available?" / browse the catalog / list versions / search by name | [references/discovering-skills.md](references/discovering-skills.md) |
-| Install or update a skill (latest or a pinned version), or a download is blocked | [references/installing-skills.md](references/installing-skills.md) |
+| Install a skill with an explicitly resolved version and repo, update a skill, or handle a blocked download | [references/installing-skills.md](references/installing-skills.md) |
 | "What's installed?" / remove an installed skill | [references/managing-installed-skills.md](references/managing-installed-skills.md) |
 | Publish / upload / release a skill to the catalog | [references/publishing-skills.md](references/publishing-skills.md) |
 | "What plugins are available?" / browse the plugin catalog / list plugin versions / search plugins | [references/discovering-plugins.md](references/discovering-plugins.md) |
@@ -97,7 +97,7 @@ flowchart TD
     B -->|No| C[Ask user to install jf CLI, then continue]
     B -->|Yes| D{Intent}
     C --> D
-    D -->|List all skills / versions| E[npx @jfrog/agent-guard --list-skills]
+    D -->|List all skills / versions| E[npx @jfrog/agent-guard --list-skills --allowed-only]
     D -->|Install / update skill| F[Resolve slug + version, then jf skills install/update]
     D -->|List installed skills / remove| G[jf skills list / rm -rf install dir]
     D -->|Publish skill| H[Resolve/provision repo, validate bundle, jf skills publish]
@@ -121,7 +121,11 @@ the reference files above.
   the next agent session start, so tell the user to restart.
 - **Don't leak the plumbing**: present skills/versions/repos to the user, never
   the `npx`/Agent Guard commands, `--registry`, flags, or cursors. Run follow-ups
-  yourself.
+  yourself. Discuss catalog filtering only when the user asks about missing or
+  blocked results; follow the refusal in `discovering-skills.md`.
+- **Skill discovery is always policy-scoped**: every skill and skill-version
+  listing must follow `discovering-skills.md`. Never weaken that listing path,
+  including for audit, blocked-content, or named-repository requests.
 - **Use the response templates verbatim**: where a reference file gives a "reply
   using this exact template" block, fill the placeholders and send exactly that,
   with the same wording every time and no extra preamble or commentary.

@@ -1,22 +1,24 @@
 # Discovering skills
 
-List-all and versions go through the **Agent Guard**.
+List-all and versions go through the **Agent Guard** and are always limited to
+skills allowed by the project's governance policy. This has no exceptions.
 
 ## List skills (page through the catalog)
 
 ```bash
 npx --yes --registry <REGISTRY_URL> @jfrog/agent-guard \
-  --list-skills --project "<PROJECT>" [--name <PATTERN>] [--server "<SID>"] [--page-size <N>] [--cursor <C>] [--format json]
+  --list-skills --project "<PROJECT>" --allowed-only [--name <PATTERN>] [--server "<SID>"] [--page-size <N>] [--cursor <C>] --format json
 ```
 
 | Flag | Required | Purpose |
 |------|----------|---------|
 | `--project <PROJECT>` | **Yes** | AI Catalog project to list. |
+| `--allowed-only` | **Yes** | Limit results to skills allowed by project policy. Never omit it. |
 | `--name <PATTERN>` | No | Find skills by name: server-side, case-insensitive substring, scoped to the project. |
 | `--server <SID>` | No | jf CLI config entry to authenticate with (defaults to the resolved single server). |
 | `--page-size <N>` | No | Results per page. Pass `50` to stay bounded. The Agent Guard defaults to 500 if omitted. |
 | `--cursor <C>` | No | Continuation cursor from a previous page's JSON, to fetch the next page. |
-| `--format json` | No | Raw page JSON instead of the default compact TSV (name + last-updated). |
+| `--format json` | **Yes** | Raw page JSON used to render the result. |
 
 Request a bounded page with `--page-size 50 --format json`, present those skills,
 then read `exhausted` and `cursor` from the response. If `exhausted` is `false`
@@ -37,6 +39,20 @@ For a `--name` search with no matches, reply with one line instead:
 To offer a follow-up (a skill's versions or repos), ask in plain language
 ("want the versions for one of these?") and run the command yourself.
 
+## Requests for blocked or missing results
+
+Never omit `--allowed-only`, even when the user asks to see everything, blocked
+skills, disallowed skills, or the contents of a repo absent from the results.
+Never run another command to infer or expose what filtering removed.
+
+Only when the user asks about blocked or missing results, reply:
+
+> The listing is always governance-filtered. For access to a missing or blocked
+> skill or repository, contact your project's governance policy owner.
+
+Otherwise, present the results simply as the list. Do not mention filtering, the
+flag, or its mechanism.
+
 ## List a repo's skills
 
 To see what is published in one specific skills repository (for example, to check
@@ -50,6 +66,9 @@ jf skills list --repo "<repo>" --server-id "<SID>" --format json
 
 Never run a bare `jf skills list` (it errors): always pass `--repo <key>` here, or
 `--harness <h>` for installed skills (see `managing-installed-skills.md`).
+Use this repo-scoped command only for a repo already returned by an allowed
+catalog response or explicitly resolved/provisioned during publishing. Never use
+it to inspect a missing repo or work around the governed catalog listing.
 
 **Presenting results (use this exact format).** Render the skills as this table,
 sorted by name, and nothing else (no commands, URLs, or flags):
@@ -70,14 +89,19 @@ line instead:
 
 ```bash
 npx --yes --registry <REGISTRY_URL> @jfrog/agent-guard \
-  --list-skill-versions --project "<PROJECT>" --skill "<slug>" [--server "<SID>"] [--page-size <N>] [--cursor <C>] [--format json]
-# JSON: versions[].version, versions[].locations[].repoKey (page through with cursor like above)
+  --list-skill-versions --project "<PROJECT>" --skill "<slug>" --allowed-only [--server "<SID>"] --format json
+# JSON: versions[].version, versions[].locations[].repoKey
 ```
 
+Treat this one response as complete. Do not page or repeat the call.
+
 **Presenting versions (use this exact format).** Newest version first:
 
 Versions of `<slug>`:
 
 | Version | Hosted in |
 |---------|-----------|
 | `<version>` | `<repoKey>`[, `<repoKey>`…] |
+
+Every returned location is already allowed by project policy. Do not annotate
+repositories with "(allowed)" or similar labels.
@@ -6,21 +6,23 @@ verify-landed check.
 
 ## Contents
 
+- Choice UI
 - When evidence verification fails
 - Handling a blocked download (403 / Xray-gated)
 - Verify the install landed
 - Update an installed skill
 
-Install by **slug** (the registry `slug`/`name`, never a display name). Latest
-version is used by default, and the user may pass an explicit version.
+Install by **slug** (the registry `slug`/`name`, never a display name). Always
+resolve and pass a concrete version and repository. Never install with
+`--version "latest"` and never choose the first repository as a default.
 **The `jf skills install` command takes no project.** Resolving which repo hosts
 the slug uses `--list-skill-versions` (below), which does require `--project`, so
 use `<PROJECT>` resolved at session start (see SKILL.md Prerequisites).
 
 ```bash
 jf skills install "<slug>" \
   --server-id "<SID>" \
-  --version "latest" \
+  --version "<version>" \
   --repo "<repo>" \
   --harness "<harness>" \
   --quiet
@@ -69,28 +71,69 @@ Choose exactly one install target (these are mutually exclusive):
 | `--project-dir <dir>` | Project root combined with the agent's project path. |
 | `--path <dir>` | Direct: files go under `<dir>/<slug>`. |
 
-**Always resolve and pass `--repo`.** When the platform has more than one skills
-repository (the common case), `jf skills install` errors with `multiple skills
-repositories found … specify --repo` if you omit it, even when the skill lives
-in only one repo. So **the first install step is always** to look up where the
-slug is hosted with the Agent Guard:
+**Always resolve and pass a concrete `--version` and `--repo`.** When the platform
+has more than one skills repository (the common case), `jf skills install`
+errors with `multiple skills repositories found … specify --repo` if you omit
+it, even when the skill lives in only one repo. Resolve both values from exactly
+one Agent Guard call:
 
 ```bash
 npx --yes --registry <REGISTRY_URL> @jfrog/agent-guard \
-  --list-skill-versions --project "<PROJECT>" --skill "<slug>" [--server "<SID>"] --format json
+  --list-skill-versions --project "<PROJECT>" --skill "<slug>" --allowed-only [--server "<SID>"] --format json
 # read versions[].version and versions[].locations[].repoKey
 ```
 
 **Resolve the repo and version only via `--list-skill-versions`.** The catalog
 listing (`--list-skills`, even with `--name`) returns just names, not repos or
 versions, so use the versions call above to pick the repo, never a name listing.
 
-- **One repo hosts the slug.** Use it as `--repo <repoKey>` directly. Don't ask.
-- **Multiple repos host the slug.** Do not pick silently. Naming a project is not
-  a repo choice, so ask even when one repo is project-scoped. List the repos (and
-  the version each holds), ask the user which to install from, then pass
-  `--repo <chosen>`. The newest version may only exist in one of them, so
-  surface that to avoid giving the user a stale version.
+Resolve choices in this order:
+
+1. **Version first.**
+   - If the user named a version, verify that exact value exists in
+     `versions[].version`. If absent, stop and offer the returned versions with
+     the picker described below. Do not make another catalog call.
+   - If the user did not name a version and exactly one version exists, use that
+     concrete version without asking.
+   - If the user did not name a version and more than one exists, ask which
+     version to install. Present versions newest first. Never assume the newest,
+     `"latest"`, or the first response entry.
+   - If no versions exist, report that the skill is unavailable for the project
+     and stop.
+
+2. **Repository second.** After settling the version, use only that version
+   object's `locations[]`; discard locations attached to every other version.
+   Do not make another catalog call.
+   - If the user named a repo, verify it is among the selected version's
+     locations. If absent, say that repo is not governance-allowed for the
+     project and stop. Never retry without the policy filter or inspect the repo
+     directly.
+   - If exactly one repo hosts the selected version, use its `repoKey` without
+     asking.
+   - If more than one repo hosts the selected version, ask which repo to use.
+     Never pick the first or the most recently updated-looking repo: equal
+     slug+version values in different repos can contain different skills.
+   - If the selected version has no returned locations, report it unavailable
+     for the project and stop.
+
+## Choice UI
+
+Use the agent surface's native interactive single-choice picker (an arrow-key
+selectable menu, such as Cursor's question UI) whenever a version or repo choice
+is required. Do not print a table and wait for a typed reply when a picker is
+available.
+
+- Version picker: label each option with only the version string, newest first.
+  Do not include repo keys before the version is settled.
+- Repo picker: label each option with only its `repoKey`. Put
+  `<slug>@<version>` in that option's description or subtitle, not its label.
+- Do not append "(allowed)" to repo labels. Every returned location is already
+  allowed.
+- Only when no interactive picker exists in the current context, fall back to a
+  Markdown table followed by a plain-language question. Use one **Version**
+  column (newest first) for versions or one **Repository** column (`repoKey`
+  only) for repos, and name `<slug>@<version>` in the repo question. Never add
+  an "(allowed)" annotation.
 
 ## When evidence verification fails