From 00ea1c1f92bc3e1d06ea264e59ed4a59137570b7 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Tue, 7 Jul 2026 11:34:21 +0300 Subject: [PATCH 1/2] AX-1579 - Don't guess a single shell rc file for secret persistence $SHELL only reports the user's OS login shell, not the shell Cursor actually uses to launch hooks/MCP servers, so a single-file guess can silently miss (confirmed: bash and zsh never source each other's rc files, in login or non-login mode). Persist to every common startup file instead, and verify afterward via the existing 4a/troubleshooting checks rather than assuming the write was sourced. Bump plugin version 0.5.1 -> 0.5.2. --- .cursor-plugin/marketplace.json | 2 +- plugins/jfrog/.cursor-plugin/plugin.json | 2 +- .../jfrog/templates/jfrog-mcp-management.md | 33 ++++++++++++------- 3 files changed, 24 insertions(+), 13 deletions(-) diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json index 499cffb..db19002 100644 --- a/.cursor-plugin/marketplace.json +++ b/.cursor-plugin/marketplace.json @@ -6,7 +6,7 @@ }, "metadata": { "description": "JFrog Platform plugins for Cursor", - "version": "0.5.1", + "version": "0.5.2", "pluginRoot": "plugins" }, "plugins": [ diff --git a/plugins/jfrog/.cursor-plugin/plugin.json b/plugins/jfrog/.cursor-plugin/plugin.json index 070de6d..0fb9e09 100644 --- a/plugins/jfrog/.cursor-plugin/plugin.json +++ b/plugins/jfrog/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "jfrog", "displayName": "JFrog Platform", - "version": "0.5.1", + "version": "0.5.2", "description": "JFrog Platform integration with MCP, security skills, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.", "author": { "name": "JFrog", diff --git a/plugins/jfrog/templates/jfrog-mcp-management.md b/plugins/jfrog/templates/jfrog-mcp-management.md index 7792187..d45d5c9 100644 --- a/plugins/jfrog/templates/jfrog-mcp-management.md +++ b/plugins/jfrog/templates/jfrog-mcp-management.md @@ -167,19 +167,30 @@ For each input in Step 4: - **Secrets** (`isSecret=true`): use `${env:VAR_NAME}` in the config; tell the user to export it for the current session via `read -rs VAR_NAME && export VAR_NAME && echo exported`. - For persistence, the right startup file depends on the user's - **shell**, not their OS — macOS and Linux both commonly run zsh or - bash. Detect the shell (e.g. `echo "$SHELL"`) and add the export to - the file that shell loads on startup: - - **zsh** (the macOS default) → `~/.zshrc` - - **bash** → `~/.bashrc`; note macOS login shells read - `~/.bash_profile`, which usually sources `~/.bashrc` - - **fish** → `~/.config/fish/config.fish` (use `set -gx`) + For persistence, do NOT rely on `$SHELL` (or any other single-shell + guess) to pick ONE startup file — Cursor may resolve environment + for spawned MCP servers/hooks via a different mechanism than + whatever shell reported `$SHELL`, so a single-file guess can + silently fail to be sourced (this is exactly how it breaks: the + user's login shell is zsh, `~/.zshrc` gets the export, but Cursor's + hook/MCP-launch process runs under bash and never reads it). Add + the export to EVERY startup file below that exists on the machine + (create the one matching `$SHELL` if none exist yet) — redundant + entries in unused files are harmless, and covering all of them is + the only way to be correct without knowing Cursor's internal + resolution mechanism: + - `~/.zshrc` (zsh) + - `~/.bashrc` and `~/.bash_profile` (bash; macOS login shells read + `.bash_profile`, which usually sources `.bashrc`) + - `~/.config/fish/config.fish` (fish — use `set -gx VAR_NAME value` + instead of `export`) - **Windows** → use `setx VAR_NAME ""` (PowerShell/CMD) instead of the `read`/`export` snippet - If unsure which file the shell sources, ask the user. Values are - picked up on next launch (4a). NEVER take secrets in chat, echo them - back, or write raw values into config. + Values are picked up on next launch — after the user restarts + Cursor, confirm the var actually reached the MCP process (4a / + Troubleshooting "401/403 with `${env:VAR}`") rather than assuming + the persisted file was sourced. NEVER take secrets in chat, echo + them back, or write raw values into config. - **Non-secrets**: literal in `env` or `${env:VAR_NAME}` — ask if unclear. From dae2c67e940312a6bf5f1a700bce75e425a6b121 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:12:02 +0300 Subject: [PATCH 2/2] Bump plugin version to 0.5.7 Co-Authored-By: Claude Sonnet 5 --- .cursor-plugin/marketplace.json | 2 +- plugins/jfrog/.cursor-plugin/plugin.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json index e30f8ae..7e28aad 100644 --- a/.cursor-plugin/marketplace.json +++ b/.cursor-plugin/marketplace.json @@ -6,7 +6,7 @@ }, "metadata": { "description": "JFrog Platform plugins for Cursor", - "version": "0.5.6", + "version": "0.5.7", "pluginRoot": "plugins" }, "plugins": [ diff --git a/plugins/jfrog/.cursor-plugin/plugin.json b/plugins/jfrog/.cursor-plugin/plugin.json index 3aa316a..9616d42 100644 --- a/plugins/jfrog/.cursor-plugin/plugin.json +++ b/plugins/jfrog/.cursor-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "jfrog", "displayName": "JFrog Platform", - "version": "0.5.6", + "version": "0.5.7", "description": "JFrog Platform integration with MCP, security skills, supply-chain best practices, and JFrog Agent Guard governance for adding, removing, and listing MCP servers.", "author": { "name": "JFrog",