diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index bc44b45..80fcfce 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -2,7 +2,7 @@
   "name": "jfrog",
   "displayName": "JFrog",
   "description": "Official JFrog plugin. Connect Claude Code to JFrog to manage, secure, and govern your software supply chain. Give agents the context to build secure, compliant software.",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "author": {
     "name": "JFrog Ltd.",
     "email": "devrel@jfrog.com",
diff --git a/.github/scripts/sync-modules-vendor.json b/.github/scripts/sync-modules-vendor.json
index 4ca704b..639c8c9 100644
--- a/.github/scripts/sync-modules-vendor.json
+++ b/.github/scripts/sync-modules-vendor.json
@@ -1,6 +1,6 @@
 {
   "repo": "JFROG/jfrog-agent-hooks",
-  "pin": "jfrog-agent-hooks/v0.8.1",
+  "pin": "jfrog-agent-hooks/v0.9.0",
   "paths": [
     "modules"
   ]
diff --git a/modules/core/jf-identity.mjs b/modules/core/jf-identity.mjs
index b910d39..33367d1 100644
--- a/modules/core/jf-identity.mjs
+++ b/modules/core/jf-identity.mjs
@@ -2,18 +2,24 @@
 // we auth to it?". Used by feature-flag.mjs and resolver.mjs.
 //
 // Identity ALWAYS comes from `jf config`. `jf config export [serverId]` returns
-// base64(JSON({ url, accessToken, serverId, ... })) for the chosen (or default)
-// server. We require both `url` AND `accessToken` (Bearer-only path).
+// base64(JSON({ url, accessToken, user, password, serverId, ... })) for the
+// chosen (or default) server. A usable identity needs a platform `url` plus a
+// credential: an access token (Bearer) OR username + password / API key
+// (Basic). Access token wins when both are present (mirrors `jf setup`).
+//
+// After credentials parse, an optional readiness probe (Artifactory ping)
+// rejects expired/revoked/unreachable credentials so the feature flag can
+// fall into pending instead of "routing with empty repos".
 //
 // If `jf` is not on PATH, has no configured servers, or the chosen server has
-// no access token, identity is null and the feature flag falls into the
-// `missing-identity` path (hook goes no-op, fail closed). Same behaviour as
-// before — only the configuration mechanism is simpler.
+// no usable credential (e.g. SSH-key-only), identity is null and the feature
+// flag falls into the `missing-identity` path (hook goes no-op, fail closed).
 //
-// One subprocess per hook process. Cached after first call within the same
-// process (feature-flag + resolver share one export). Not persisted across
-// sessions — `jf config export` is local and fast enough to run every time.
+// Config export is cached per process. Probe results are cached separately
+// (async) so feature-flag can await readiness without making getPlatformIdentity
+// async.
 
+import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import process from "node:process";
 
@@ -21,35 +27,37 @@ import { createLogger } from "./logger.mjs";
 
 const log = createLogger("jf-identity");
 
-// Wire-format cause codes for getPlatformIdentity() / pending remediation.
-// Single source of truth — import this instead of repeating string literals.
+/** Wire-format cause codes for getPlatformIdentity() / pending remediation. */
 export const IdentityCause = Object.freeze({
   OK: "ok",
   JF_NOT_INSTALLED: "jf-not-installed",
   JF_NOT_CONFIGURED: "jf-not-configured",
+  /** Server present but credential shape unusable (e.g. SSH-key-only). */
+  JF_UNSUPPORTED_AUTH: "jf-unsupported-auth",
+  /** Credential present but Artifactory rejected it (401/403). */
+  JF_AUTH_FAILED: "jf-auth-failed",
+  /** Probe timed out / network / non-auth HTTP failure. */
+  JF_UNREACHABLE: "jf-unreachable",
 });
 
+const PROBE_TIMEOUT_MS = 3_000;
+
 // Module-scope cache. Keyed by the requested serverId hint (`undefined`
 // means "whatever jf considers default"). Stores the full resolved object,
 // including null when jf config produced nothing usable.
 const CACHE = new Map();
+// Probe results are cached for the process lifetime (each hook is a fresh
+// process, so there's nothing to expire within one). Both ok and non-ok
+// results are memoized so feature-flag + resolver share one round-trip.
+/** @type {Map<string, { ok: boolean, cause: string }>} */
+const PROBE_CACHE = new Map();
 
 function normalizeUrl(u) {
   if (!u) return "";
   return String(u).replace(/\/+$/, "");
 }
 
-// Resolution cause. OK means identity is present; the two failure causes
-// drive cause-aware remediation in the pending path:
-//   JF_NOT_INSTALLED  — `jf` is not on PATH / could not be executed.
-//   JF_NOT_CONFIGURED — `jf` ran but produced no usable server identity
-//                       (non-zero exit, empty/undecodable export, or a
-//                       server entry missing url/accessToken).
 function jfConfigIdentity(serverId) {
-  // `jf config export` writes base64(JSON) to stdout for the requested
-  // server (or the default when no arg). We split the failure space into
-  // "jf could not be run" (not-installed) vs "jf ran but has no usable
-  // server" (not-configured) so the caller can give targeted remediation.
   const args = ["config", "export"];
   if (serverId) args.push(serverId);
 
@@ -57,8 +65,6 @@ function jfConfigIdentity(serverId) {
   try {
     result = spawnSync("jf", args, {
       encoding: "utf8",
-      // jf config export reads no stdin and writes a single base64 line
-      // (no terminal interaction). 2s is plenty even for cold spawns.
       timeout: 2000,
       stdio: ["ignore", "pipe", "pipe"],
     });
@@ -68,9 +74,10 @@ function jfConfigIdentity(serverId) {
   }
 
   if (result.error) {
-    // ENOENT (and any other spawn error) means the binary could not be
-    // executed — treat as not installed.
-    log.debug("jf spawn error", { code: result.error.code, message: result.error.message });
+    log.debug("jf spawn error", {
+      code: result.error.code,
+      message: result.error.message,
+    });
     return { identity: null, cause: IdentityCause.JF_NOT_INSTALLED };
   }
   if (result.status !== 0) {
@@ -92,32 +99,219 @@ function jfConfigIdentity(serverId) {
     const json = Buffer.from(blob, "base64").toString("utf8");
     parsed = JSON.parse(json);
   } catch (err) {
-    log.warn("jf config export blob not decodable", { error: err?.message ?? String(err) });
+    log.warn("jf config export blob not decodable", {
+      error: err?.message ?? String(err),
+    });
     return { identity: null, cause: IdentityCause.JF_NOT_CONFIGURED };
   }
 
   const url = normalizeUrl(parsed?.url);
   const token = parsed?.accessToken ?? "";
+  const user = parsed?.user ?? "";
+  const password = parsed?.password ?? "";
   const resolvedServerId = parsed?.serverId ?? serverId ?? null;
 
-  if (!url || !token) {
-    log.debug("jf config export missing url or accessToken", {
+  if (!url) {
+    log.debug("jf config export missing url", {
       serverId: resolvedServerId,
-      hasUrl: Boolean(url),
+      hasUrl: false,
       hasToken: Boolean(token),
+      hasUser: Boolean(user),
+      hasPassword: Boolean(password),
     });
     return { identity: null, cause: IdentityCause.JF_NOT_CONFIGURED };
   }
 
+  // Access token wins when both are present (mirrors jf setup precedence).
+  let auth = null;
+  if (token) {
+    auth = { kind: "bearer", token };
+  } else if (user && password) {
+    auth = { kind: "basic", user, password };
+  }
+
+  if (!auth) {
+    log.debug("jf config export has url but no usable credential", {
+      serverId: resolvedServerId,
+      hasUrl: true,
+      hasToken: Boolean(token),
+      hasUser: Boolean(user),
+      hasPassword: Boolean(password),
+    });
+    return { identity: null, cause: IdentityCause.JF_UNSUPPORTED_AUTH };
+  }
+
+  log.debug("jf config export identity accepted", {
+    serverId: resolvedServerId,
+    hasUrl: true,
+    authKind: auth.kind,
+  });
+
   return {
-    identity: { url, token, serverId: resolvedServerId, source: "jf-config" },
+    identity: {
+      url,
+      serverId: resolvedServerId,
+      source: "jf-config",
+      auth,
+    },
     cause: IdentityCause.OK,
   };
 }
 
-// Public — returns { identity, cause }:
-//   identity: { url, token, serverId, source } | null
-//   cause:    IdentityCause.OK | JF_NOT_INSTALLED | JF_NOT_CONFIGURED
+/**
+ * HTTP Authorization header value for Artifactory API calls, or null.
+ * Rejects credentials with CR/LF so Node never throws a header error that
+ * echoes the secret in `err.message`.
+ */
+export function authHeader(identity) {
+  const auth = identity?.auth;
+  if (!auth) return null;
+  if (auth.kind === "bearer") {
+    const token = String(auth.token ?? "");
+    if (!token || /[\r\n]/.test(token)) return null;
+    return `Bearer ${token}`;
+  }
+  if (auth.kind === "basic") {
+    const user = String(auth.user ?? "");
+    const password = String(auth.password ?? "");
+    if (!user || !password || /[\r\n]/.test(user) || /[\r\n]/.test(password)) {
+      return null;
+    }
+    return `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+  }
+  return null;
+}
+
+/** Strip credential material from error strings before logging. */
+export function safeErrorMessage(err) {
+  const raw = err?.message ?? String(err ?? "");
+  return raw
+    .replace(/Bearer\s+\S+/gi, "Bearer <redacted>")
+    .replace(/Basic\s+\S+/gi, "Basic <redacted>");
+}
+
+function probeCacheKey(identity) {
+  const auth = identity?.auth;
+  if (!auth) return "none";
+  const url = identity.url ?? "";
+  if (auth.kind === "bearer") {
+    const digest = createHash("sha256")
+      .update(`bearer\0${auth.token ?? ""}`)
+      .digest("hex")
+      .slice(0, 16);
+    return `${url}|bearer|${digest}`;
+  }
+  const digest = createHash("sha256")
+    .update(`basic\0${auth.user ?? ""}\0${auth.password ?? ""}`)
+    .digest("hex")
+    .slice(0, 16);
+  return `${url}|basic|${digest}`;
+}
+
+/** Test hooks only apply when the unit/integration harness sets this. */
+function testHarnessActive() {
+  return process.env.JFROG_TEST_HARNESS === "1";
+}
+
+function syntheticProbeResult() {
+  if (!testHarnessActive()) return null;
+  const mode = process.env.JFROG_TEST_IDENTITY_PROBE;
+  if (!mode || mode === "skip") return null;
+  if (mode === "ok") return { ok: true, cause: IdentityCause.OK };
+  if (mode === "401" || mode === "403" || mode === "auth-failed") {
+    return { ok: false, cause: IdentityCause.JF_AUTH_FAILED };
+  }
+  if (mode === "error" || mode === "unreachable") {
+    return { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+  }
+  return null;
+}
+
+/**
+ * Probe Artifactory with the resolved credentials. Fail-closed: any non-OK
+ * response or network error means the identity is not ready for routing.
+ *
+ * Test hooks (require `JFROG_TEST_HARNESS=1` — never honored in production):
+ *   JFROG_TEST_IDENTITY_PROBE=skip — do not probe; treat as ok
+ *   ok / 401 / error — synthetic results
+ *
+ * Production kill switch: `JF_AGENT_IDENTITY_PROBE=0` skips the probe.
+ *
+ * @param {object | null} identity
+ * @returns {Promise<{ ok: boolean, cause: string }>}
+ */
+export async function probePlatformIdentity(identity) {
+  if (!identity) {
+    return { ok: false, cause: IdentityCause.JF_NOT_CONFIGURED };
+  }
+
+  const synthetic = syntheticProbeResult();
+  if (synthetic) return synthetic;
+
+  if (testHarnessActive() && process.env.JFROG_TEST_IDENTITY_PROBE === "skip") {
+    return { ok: true, cause: IdentityCause.OK };
+  }
+  if (process.env.JF_AGENT_IDENTITY_PROBE === "0") {
+    return { ok: true, cause: IdentityCause.OK };
+  }
+
+  const key = probeCacheKey(identity);
+  const cached = PROBE_CACHE.get(key);
+  if (cached) {
+    return { ok: cached.ok, cause: cached.cause };
+  }
+
+  const authorization = authHeader(identity);
+  if (!authorization) {
+    const result = { ok: false, cause: IdentityCause.JF_UNSUPPORTED_AUTH };
+    PROBE_CACHE.set(key, result);
+    return result;
+  }
+
+  // Auth-required endpoint: `system/ping` is anonymous-capable, so a
+  // revoked/expired token would still return 200 and wrongly pass readiness.
+  // `system/version` requires an authenticated (non-anonymous) caller.
+  const pingUrl = `${identity.url}/artifactory/api/system/version`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  /** @type {{ ok: boolean, cause: string }} */
+  let result;
+  try {
+    const res = await fetch(pingUrl, {
+      method: "GET",
+      headers: { Authorization: authorization },
+      signal: controller.signal,
+    });
+    if (res.status === 401 || res.status === 403) {
+      result = { ok: false, cause: IdentityCause.JF_AUTH_FAILED };
+    } else if (!res.ok) {
+      result = { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+    } else {
+      result = { ok: true, cause: IdentityCause.OK };
+    }
+  } catch (err) {
+    log.debug("identity probe failed", {
+      url: pingUrl,
+      error: safeErrorMessage(err),
+    });
+    result = { ok: false, cause: IdentityCause.JF_UNREACHABLE };
+  } finally {
+    clearTimeout(timer);
+  }
+
+  log.debug("identity probe result", {
+    url: identity.url,
+    ok: result.ok,
+    cause: result.cause,
+  });
+  PROBE_CACHE.set(key, result);
+  return result;
+}
+
+/**
+ * Config-only identity (sync). Does not probe reachability.
+ * @returns {{ identity: object | null, cause: string }}
+ */
 export function getPlatformIdentity() {
   const hint = undefined;
   if (CACHE.has(hint)) return CACHE.get(hint);
@@ -127,6 +321,7 @@ export function getPlatformIdentity() {
     log.debug("identity from jf-config", {
       serverId: status.identity.serverId,
       url: status.identity.url,
+      authKind: status.identity.auth?.kind,
     });
   } else {
     log.debug("no platform identity", { cause: status.cause });
@@ -135,20 +330,102 @@ export function getPlatformIdentity() {
   return status;
 }
 
-/** Test-only — reset module cache between in-process scenarios. */
+/**
+ * Config identity + readiness probe. Prefer this from async session paths
+ * (feature-flag) so dead tokens fail closed to pending.
+ * @returns {Promise<{ identity: object | null, cause: string }>}
+ */
+export async function getReadyPlatformIdentity() {
+  const status = getPlatformIdentity();
+  if (!status.identity) return status;
+
+  const probe = await probePlatformIdentity(status.identity);
+  if (probe.ok) return status;
+
+  // Rejected / structurally-unusable credentials are a stable fact → fail
+  // closed to pending so we don't inject "routing" with an unusable identity.
+  if (
+    probe.cause === IdentityCause.JF_AUTH_FAILED ||
+    probe.cause === IdentityCause.JF_UNSUPPORTED_AUTH
+  ) {
+    log.debug("identity not ready after probe", { cause: probe.cause });
+    return { identity: null, cause: probe.cause };
+  }
+
+  // Transient failure (timeout / network / 5xx): keep routing best-effort
+  // rather than downgrading a healthy setup to pending on a blip. The resolver
+  // already fails safe per-repo (keeps prior cache, skips empty writes).
+  log.warn("identity probe unreachable — routing best-effort", {
+    cause: probe.cause,
+  });
+  return status;
+}
+
+/** Test-only — reset module caches between in-process scenarios. */
 export function clearPlatformIdentityCache() {
   CACHE.clear();
+  PROBE_CACHE.clear();
 }
 
-// Short label for log lines / status output, e.g. "jf-config:<your-server-id>".
 export function identityLabel(identity) {
   if (!identity) return "none";
   return identity.serverId ? `jf-config:${identity.serverId}` : "jf-config";
 }
 
-// CLI:
-//   node lib/jf-identity.mjs           — JSON with token redacted
-//   node lib/jf-identity.mjs --label   — single line: "<label>\t<url>"  (or "none")
+/** Redact credential material for CLI / harness stdout (keeps kind + user). */
+export function redactIdentity(identity) {
+  if (!identity) return null;
+  const auth = identity.auth;
+  if (!auth) return { ...identity, auth: null };
+  if (auth.kind === "bearer") {
+    return {
+      ...identity,
+      auth: {
+        kind: "bearer",
+        token: auth.token ? `<${auth.token.length} chars>` : "",
+      },
+    };
+  }
+  return {
+    ...identity,
+    // Preserve the real kind — redactIdentity is exported and the harness may
+    // pass shapes other than "basic"; reporting them all as "basic" misleads.
+    auth: {
+      kind: auth.kind ?? "unknown",
+      user: auth.user ?? "",
+      password: auth.password ? `<${auth.password.length} chars>` : "",
+    },
+  };
+}
+
+function noIdentityHint(cause) {
+  if (cause === IdentityCause.JF_NOT_INSTALLED) {
+    return "`jf` is not installed. Install the JFrog CLI, then run `jf config add`.";
+  }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "Configured server auth method is not supported. Use an access token " +
+      "or username + password / API key (`jf config add`)."
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return (
+      "Configured credentials were rejected by Artifactory (expired, revoked, " +
+      "or wrong). Refresh with `jf config add` / re-login."
+    );
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return (
+      "Artifactory did not respond to a readiness probe. Check network / " +
+      "platform URL, then retry."
+    );
+  }
+  return (
+    "No configured JFrog server. Run `jf config add` (access token or " +
+    "username + password / API key)."
+  );
+}
+
 const isMain = import.meta.url === `file://${process.argv[1]}`;
 if (isMain) {
   const labelOnly = process.argv.includes("--label");
@@ -162,13 +439,8 @@ if (isMain) {
     process.exit(0);
   }
   if (!identity) {
-    const hint =
-      cause === IdentityCause.JF_NOT_INSTALLED
-        ? "`jf` is not installed. Install the JFrog CLI, then run `jf config add`."
-        : "No configured JFrog server. Run `jf config add` (must use access-token auth).";
-    console.error(`No platform identity (${cause}). ${hint}`);
+    console.error(`No platform identity (${cause}). ${noIdentityHint(cause)}`);
     process.exit(2);
   }
-  const safe = { ...identity, token: identity.token ? `<${identity.token.length} chars>` : "" };
-  console.log(JSON.stringify(safe, null, 2));
+  console.log(JSON.stringify(redactIdentity(identity), null, 2));
 }
diff --git a/modules/core/run-capability.mjs b/modules/core/run-capability.mjs
index 742fb94..4d79593 100644
--- a/modules/core/run-capability.mjs
+++ b/modules/core/run-capability.mjs
@@ -64,8 +64,10 @@ export async function runCapability(name, ctx = {}) {
     const text = await cap.sessionStart(ctx);
     const trimmed = text?.trim() ? text : "";
 
+    // EVENT (visible at default info): one summary line per invocation so a
+    // cache-hit / quiet routing path is distinguishable from "hook never fired".
     if (trimmed) {
-      log.debug("sessionStart injected", {
+      log.event("sessionStart injected", {
         enabled: true,
         capabilities: name,
         mode: cap.mode,
@@ -74,7 +76,12 @@ export async function runCapability(name, ctx = {}) {
         durMs: hookDurMs(ctx),
       });
     } else {
-      log.debug("sessionStart no-op", { capabilities: name, durMs: hookDurMs(ctx) });
+      log.event("sessionStart no-op", {
+        capabilities: name,
+        mode: cap.mode,
+        ...(cap.meta ?? {}),
+        durMs: hookDurMs(ctx),
+      });
     }
 
     return trimmed;
diff --git a/modules/package-resolution/scripts/eager-setup.mjs b/modules/package-resolution/scripts/eager-setup.mjs
index 50c16b0..29510fa 100644
--- a/modules/package-resolution/scripts/eager-setup.mjs
+++ b/modules/package-resolution/scripts/eager-setup.mjs
@@ -53,6 +53,7 @@ import {
   packageManagersForType,
   packageManagerBinaryOnPath,
 } from "./package-manager-family.mjs";
+import { detectSetupConflict } from "./setup-conflict.mjs";
 
 const log = createLogger("eager-setup");
 
@@ -143,6 +144,9 @@ export function computeEligibleJobs(governed, resolvedByType) {
  *   pending: string[],
  *   deferred: string[],
  *   skippedMissing?: string[],
+ *   skippedConflict?: string[],
+ *   skippedUnsupported?: string[],
+ *   skippedUnparsed?: string[],
  *   setupBusy?: boolean,
  * }} parts
  * @returns {string} markdown note or ""
@@ -152,6 +156,9 @@ function statusNote({
   pending,
   deferred,
   skippedMissing,
+  skippedConflict,
+  skippedUnsupported,
+  skippedUnparsed,
   setupBusy,
 }) {
   const parts = [];
@@ -180,6 +187,25 @@ function statusNote({
       `skipped (package manager binary not on PATH): ${skippedMissing.join(", ")}`,
     );
   }
+  if (skippedConflict?.length) {
+    parts.push(
+      `skipped (existing config points at another registry — will not overwrite): ` +
+        `${skippedConflict.join(", ")}`,
+    );
+  }
+  if (skippedUnsupported?.length) {
+    parts.push(
+      `skipped (your installed JFrog CLI has no \`jf setup\` support for ` +
+        `${skippedUnsupported.join(", ")} — update the JFrog CLI to the latest ` +
+        `version to enable zero-touch setup for these)`,
+    );
+  }
+  if (skippedUnparsed?.length) {
+    parts.push(
+      `skipped (could not parse \`jf setup --help\` output to confirm support for ` +
+        `${skippedUnparsed.join(", ")} — update or reinstall the JFrog CLI)`,
+    );
+  }
   if (!parts.length) return "";
   return `> **Zero-touch package-manager setup** — ${parts.join("; ")}.`;
 }
@@ -259,10 +285,19 @@ export async function orchestrateEagerSetup(ctx = {}) {
     const serverId = identity.serverId ?? "default";
     const url = identity.url;
 
+    // Intersect the type→package-manager ceiling with what the *installed*
+    // `jf setup` supports, so an outdated CLI (e.g. one without `jf setup uv`)
+    // surfaces an actionable "update the JFrog CLI" note instead of silently
+    // sitting in the background worker's skip log.
+    const supported = supportedPackageManagers();
+
     const configured = [];
     const pending = [];
     const deferred = [];
     const skippedMissing = [];
+    const skippedConflict = [];
+    const skippedUnsupported = [];
+    const skippedUnparsed = [];
     const toRun = [];
     for (const job of jobs) {
       // Binary probe in the orchestrator so the injected note can list skips
@@ -275,6 +310,37 @@ export async function orchestrateEagerSetup(ctx = {}) {
         });
         continue;
       }
+      // Fail-closed: an unparseable `jf setup --help` means we cannot confirm
+      // support, so skip rather than bypass the filter and risk running an
+      // unsupported `jf setup <pm>`.
+      if (supported === null) {
+        skippedUnparsed.push(job.packageManager);
+        log.warn(
+          "eager skip: could not parse `jf setup --help` output — failing closed",
+          { type: job.type, packageManager: job.packageManager },
+        );
+        continue;
+      }
+      if (!supported.has(job.packageManager)) {
+        skippedUnsupported.push(job.packageManager);
+        log.warn("eager skip: package manager unsupported by installed jf setup", {
+          type: job.type,
+          packageManager: job.packageManager,
+          hint: "update the JFrog CLI to the latest version",
+        });
+        continue;
+      }
+      const conflict = detectSetupConflict(job.packageManager, url);
+      if (conflict.conflict) {
+        skippedConflict.push(job.packageManager);
+        log.warn("eager skip: existing package-manager config points elsewhere", {
+          type: job.type,
+          packageManager: job.packageManager,
+          existingHost: conflict.existingHost,
+          targetHost: conflict.targetHost,
+        });
+        continue;
+      }
       const need = evaluateSetupNeed(receipt, {
         serverId,
         url,
@@ -321,6 +387,9 @@ export async function orchestrateEagerSetup(ctx = {}) {
       pending,
       deferred,
       skippedMissing,
+      skippedConflict,
+      skippedUnsupported,
+      skippedUnparsed,
       setupBusy,
     });
   } catch (err) {
@@ -522,7 +591,9 @@ export function releaseLock() {
 // ---------------------------------------------------------------------------
 
 /**
- * Parse the `Supported package managers are: a, b, c` line from `jf setup --help`.
+ * Parse the `Supported package managers are: a, b, c.` line from `jf setup --help`.
+ * Real `jf` ends the list with a period, so the capture stops at `.`/newline —
+ * otherwise the last token keeps a trailing dot (e.g. `uv.`) and never matches.
  * @returns {Set<string>|null} lowercase tokens, or null if help could not be parsed
  */
 function supportedPackageManagers() {
@@ -532,7 +603,7 @@ function supportedPackageManagers() {
       timeout: 5000,
     });
     const out = `${res.stdout ?? ""}\n${res.stderr ?? ""}`;
-    const m = out.match(/Supported package managers are:\s*([^\n]+)/i);
+    const m = out.match(/Supported package managers are:\s*([^.\n]+)/i);
     if (!m) return null;
     return new Set(
       m[1]
@@ -632,7 +703,16 @@ export async function runWorker(payload) {
         });
         continue;
       }
-      if (supported && !supported.has(job.packageManager)) {
+      // Fail-closed: an unparseable `jf setup --help` means we cannot confirm
+      // support, so skip rather than bypass the filter (mirrors orchestrator).
+      if (supported === null) {
+        log.warn(
+          "worker skip: could not parse `jf setup --help` output — failing closed",
+          { type: job.type, packageManager: job.packageManager },
+        );
+        continue;
+      }
+      if (!supported.has(job.packageManager)) {
         log.warn("worker skip: package manager unsupported by jf setup", {
           type: job.type,
           packageManager: job.packageManager,
@@ -640,6 +720,24 @@ export async function runWorker(payload) {
         continue;
       }
 
+      // Re-check for a foreign registry conflict under the lock — mirrors the
+      // orchestrator's check, closing the race where a developer runs a
+      // manual `npm config set registry` between the foreground spawn and
+      // this worker acquiring the lock.
+      const conflict = detectSetupConflict(job.packageManager, url);
+      if (conflict.conflict) {
+        log.warn(
+          "worker skip: existing package-manager config points elsewhere",
+          {
+            type: job.type,
+            packageManager: job.packageManager,
+            existingHost: conflict.existingHost,
+            targetHost: conflict.targetHost,
+          },
+        );
+        continue;
+      }
+
       const result = runJfSetup(job.packageManager, serverId, job.repoKey);
       if (result.ok) {
         applySetupResult(root, {
diff --git a/modules/package-resolution/scripts/feature-flag.mjs b/modules/package-resolution/scripts/feature-flag.mjs
index ce3ef42..7efdf97 100644
--- a/modules/package-resolution/scripts/feature-flag.mjs
+++ b/modules/package-resolution/scripts/feature-flag.mjs
@@ -6,17 +6,18 @@
 //   1. JF_AGENT_PACKAGE_RESOLUTION_DISABLE=1 → mode="off" (env kill switch)
 //   2. packageResolution.enabled !== true in      → mode="off" (file-primary gate;
 //      ~/.jfrog/agents-conf.json                   default off in shipped template)
-//   3. jf config (via jf-identity)                → mode="routing" when identity is
-//      usable; otherwise mode="pending" with a `cause` (jf-not-installed /
-//      jf-not-configured) so the session hook can inject a targeted,
-//      remediation-focused advisory notice.
+//   3. jf config + readiness probe (via jf-identity)
+//      → mode="routing" when identity is usable and Artifactory accepts it;
+//      otherwise mode="pending" with a `cause`:
+//        jf-not-installed | jf-not-configured | jf-unsupported-auth |
+//        jf-auth-failed | jf-unreachable
 //
 // Modes:
 //   "off"     — do nothing (no injection).
 //   "routing" — inject resolved Artifactory URLs + routing policy.
-//   "pending" — jf missing/unconfigured: inject the advisory "routing not
-//               ready" notice (no resolved URLs). This is advisory steering,
-//               not a hard block — real enforcement is durable PM config
+//   "pending" — identity missing/unusable/rejected: inject the advisory
+//               "routing not ready" notice (no resolved URLs). Advisory
+//               steering only — real enforcement is durable PM config
 //               (jf setup) + server-side Curation.
 //
 // Repo keys come from agents-conf.json defaultGlobalRepos (resolver.mjs).
@@ -26,7 +27,7 @@ import process from "node:process";
 import { createLogger } from "../../core/logger.mjs";
 import { getAgentsConfigSection } from "../../core/agents-config.mjs";
 import {
-  getPlatformIdentity,
+  getReadyPlatformIdentity,
   identityLabel,
   IdentityCause,
 } from "../../core/jf-identity.mjs";
@@ -63,7 +64,9 @@ export async function isPackageResolutionEnabled() {
     };
   }
 
-  const { identity, cause } = getPlatformIdentity();
+  // Probe credentials so expired/revoked tokens fail closed to pending
+  // instead of "routing" with every row unresolved.
+  const { identity, cause } = await getReadyPlatformIdentity();
   if (!identity) {
     log.debug("pending", { reason: "missing-identity", cause });
     return { mode: "pending", reason: "missing-identity", identity: "none", cause };
diff --git a/modules/package-resolution/scripts/render-instruction.mjs b/modules/package-resolution/scripts/render-instruction.mjs
index d55c9c9..0a8d721 100644
--- a/modules/package-resolution/scripts/render-instruction.mjs
+++ b/modules/package-resolution/scripts/render-instruction.mjs
@@ -44,6 +44,22 @@ function causeIntro(cause) {
   if (cause === IdentityCause.JF_NOT_INSTALLED) {
     return "`jf` is not installed (or not on PATH)";
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "`jf` has a configured server, but its auth method is not supported " +
+      "(need an access token or username + password / API key)"
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return (
+      "`jf` credentials were rejected by Artifactory (expired, revoked, or wrong)"
+    );
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return (
+      "Artifactory did not respond to a readiness probe (network / URL / outage)"
+    );
+  }
   return "`jf` has no configured server";
 }
 
@@ -56,6 +72,28 @@ function causeRemediation(cause) {
       "`jfrog` skill."
     );
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Agent " +
+      "Package Resolution only supports access-token or username + password " +
+      "/ API-key auth. Reconfigure with `jf config add` using one of those " +
+      "methods (SSH-key-only servers are not supported)."
+    );
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Artifactory " +
+      "rejected the credentials. Refresh the access token or password / API " +
+      "key with `jf config add` / re-login, then retry."
+    );
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return (
+      "The JFrog CLI is installed and a server is configured, but Artifactory " +
+      "did not answer a readiness probe. Confirm the platform URL, network, " +
+      "and that Artifactory is up, then retry."
+    );
+  }
   return (
     "The JFrog CLI is installed and ready. Configure a JFrog server by " +
     "following the login flow in the base `jfrog` skill to finish enabling " +
@@ -67,8 +105,19 @@ function causeRemediation(cause) {
 // "Confirm jf is installed" step so it does not contradict remediation.
 function causeChecklist(cause) {
   const configure =
-    "Configure a JFrog server (login flow or `jf config add` with access token);\n" +
+    "Configure a JFrog server (login flow or `jf config add` with access " +
+    "token or username + password / API key);\n" +
+    "   confirm with `jf config show`.";
+  const reconfigure =
+    "Reconfigure the server with a supported auth method (`jf config add` " +
+    "with access token or username + password / API key);\n" +
     "   confirm with `jf config show`.";
+  const refreshCreds =
+    "Refresh credentials (`jf config add` / re-login) and confirm with " +
+    "`jf config show`.";
+  const checkReachable =
+    "Confirm the platform URL is reachable and Artifactory is healthy, " +
+    "then retry.";
   const setup =
     "Invoke **`jfrog-setup-package-managers`** to bind package managers this workspace needs.";
   if (cause === IdentityCause.JF_NOT_INSTALLED) {
@@ -78,6 +127,15 @@ function causeChecklist(cause) {
       `3. ${setup}`
     );
   }
+  if (cause === IdentityCause.JF_UNSUPPORTED_AUTH) {
+    return `1. ${reconfigure}\n2. ${setup}`;
+  }
+  if (cause === IdentityCause.JF_AUTH_FAILED) {
+    return `1. ${refreshCreds}\n2. ${setup}`;
+  }
+  if (cause === IdentityCause.JF_UNREACHABLE) {
+    return `1. ${checkReachable}\n2. ${setup}`;
+  }
   return `1. ${configure}\n2. ${setup}`;
 }
 
diff --git a/modules/package-resolution/scripts/resolver.mjs b/modules/package-resolution/scripts/resolver.mjs
index 94ab701..9f8337f 100644
--- a/modules/package-resolution/scripts/resolver.mjs
+++ b/modules/package-resolution/scripts/resolver.mjs
@@ -21,7 +21,11 @@ import {
   loadAgentsConfig,
   globalDeclaredTypes,
 } from "../../core/agents-config.mjs";
-import { getPlatformIdentity } from "../../core/jf-identity.mjs";
+import {
+  getPlatformIdentity,
+  authHeader,
+  safeErrorMessage,
+} from "../../core/jf-identity.mjs";
 import { PACKAGE_TYPES, repoMatchesPackageType } from "./repo-types.mjs";
 import {
   pickWorkspaceConfigRoot,
@@ -170,12 +174,18 @@ async function fetchRepoConfig(repoKey) {
   // Network call on session start (cache miss + verifyRepos) — log at info so a
   // fresh session's Artifactory calls are visible without enabling debug.
   log.info("verifying repo via Artifactory API", { repoKey, url });
+  const authorization = authHeader(id);
+  if (!authorization) return null;
+  // Bound the call so a stalled Artifactory can't hang session start.
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 5_000);
   try {
     const res = await fetch(url, {
       headers: {
-        Authorization: `Bearer ${id.token}`,
+        Authorization: authorization,
         Accept: "application/json",
       },
+      signal: controller.signal,
     });
     if (!res.ok) {
       log.debug("repo verify miss", { repoKey, status: res.status });
@@ -185,9 +195,11 @@ async function fetchRepoConfig(repoKey) {
   } catch (err) {
     log.warn("repo verify threw", {
       repoKey,
-      error: err?.message ?? String(err),
+      error: safeErrorMessage(err),
     });
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -223,6 +235,7 @@ async function refreshServerCache(serverId) {
   const verifyRepos = pr.verifyRepos;
   const adminRepos = pr.defaultGlobalRepos ?? {};
   const agentsConfigMtimeMs = getAgentsConfigMtimeMs();
+  let adminConfiguredCount = 0;
 
   for (const type of PACKAGE_TYPES) {
     const repoKey = adminRepos[type];
@@ -230,6 +243,7 @@ async function refreshServerCache(serverId) {
       log.debug("unconfigured type", { type });
       continue;
     }
+    adminConfiguredCount += 1;
 
     if (verifyRepos) {
       const config = await fetchRepoConfig(repoKey);
@@ -247,6 +261,71 @@ async function refreshServerCache(serverId) {
 
   const source = verifyRepos ? "verified" : "agents-config";
 
+  const { data: cacheRoot, file } = await readCacheFile();
+  const root = normalizeCacheRoot(cacheRoot);
+  const priorEntry = root.servers[serverId];
+  const priorHasRepos = Boolean(
+    priorEntry?.repositories && Object.keys(priorEntry.repositories).length,
+  );
+
+  // A total verify failure (every admin-configured type failed the repo
+  // check — e.g. Artifactory briefly unreachable) must not pin an empty
+  // `repositories: {}` with a fresh `cached_at` for the full TTL:
+  // - prior good entry → keep it (and its cached_at)
+  // - no prior → skip writeCacheFile so the next session retries verify
+  if (
+    verifyRepos &&
+    adminConfiguredCount > 0 &&
+    Object.keys(repositories).length === 0
+  ) {
+    if (priorHasRepos) {
+      log.warn(
+        "repo verify failed for every configured type — keeping prior cache " +
+          "entry instead of pinning an empty one",
+        { serverId, configuredCount: adminConfiguredCount },
+      );
+      SESSION.serverId = serverId;
+      SESSION.byType = entryToByType(priorEntry, base);
+      SESSION.meta = buildResolveMeta(serverId, priorEntry, {
+        via: "refresh-verify-failed-kept-prior",
+        cacheFile: file,
+      });
+      return;
+    }
+    log.warn(
+      "repo verify failed for every configured type — skipping empty cache " +
+        "write so the next session retries verification",
+      { serverId, configuredCount: adminConfiguredCount },
+    );
+    const empty = {
+      repositories: {},
+      cached_at: new Date().toISOString(),
+      source,
+      agentsConfigMtimeMs,
+    };
+    SESSION.serverId = serverId;
+    SESSION.byType = {};
+    SESSION.meta = buildResolveMeta(serverId, empty, {
+      via: "refresh-verify-failed-no-cache",
+      cacheFile: file,
+    });
+    return;
+  }
+
+  // Partial verify failure: keep prior keys for admin-configured types that
+  // failed this round so a transient blip on one type does not ungover that
+  // type for the full cache TTL.
+  if (verifyRepos && priorHasRepos) {
+    for (const [type, repoKey] of Object.entries(priorEntry.repositories)) {
+      if (repositories[type] || !adminRepos[type]) continue;
+      repositories[type] = repoKey;
+      log.warn(
+        "repo verify failed — keeping prior cache value for type",
+        { type, repoKey, serverId },
+      );
+    }
+  }
+
   const entry = {
     repositories,
     cached_at: new Date().toISOString(),
@@ -254,13 +333,10 @@ async function refreshServerCache(serverId) {
     agentsConfigMtimeMs,
   };
 
-  const { data: cacheRoot } = await readCacheFile();
-  const root = normalizeCacheRoot(cacheRoot);
   root.servers[serverId] = entry;
   await writeCacheFile(root);
 
   const via = verifyRepos ? "refresh-verified" : "refresh-agents-config";
-  const file = cacheFile();
   SESSION.serverId = serverId;
   SESSION.byType = entryToByType(entry, base);
   SESSION.meta = buildResolveMeta(serverId, entry, { via, cacheFile: file });
@@ -461,7 +537,7 @@ if (isMain) {
   if (!result) {
     console.error(`No repo resolved for type=${type}.`);
     console.error(
-      "Live mode needs a configured `jf` server with an access token (run `jf c add`).",
+      "Live mode needs a configured `jf` server (access token or username + password / API key; run `jf c add`).",
     );
     process.exit(2);
   }
diff --git a/modules/package-resolution/scripts/setup-conflict.mjs b/modules/package-resolution/scripts/setup-conflict.mjs
new file mode 100644
index 0000000..d0e0fe7
--- /dev/null
+++ b/modules/package-resolution/scripts/setup-conflict.mjs
@@ -0,0 +1,513 @@
+// Detect when zero-touch `jf setup` would silently repoint an existing
+// user-level package-manager config at a different Artifactory (or public
+// registry). Fail-safe: skip that package manager and surface it in the
+// session note — never overwrite without an explicit product "ask/overwrite"
+// path (not implemented here).
+
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+import { createLogger } from "../../core/logger.mjs";
+
+const log = createLogger("setup-conflict");
+
+/**
+ * @param {string} [home]
+ * @returns {string}
+ */
+function resolveHome(home) {
+  if (home) return home;
+  // Match agents-config: Node `homedir()` (USERPROFILE on Windows). Preferring
+  // process.env.HOME on win32 breaks under MSYS/Git Bash path shapes.
+  if (process.platform === "win32") return homedir();
+  return process.env.HOME || homedir();
+}
+
+/**
+ * Strip matching single/double quotes wrapping an npmrc value.
+ * @param {string} raw
+ * @returns {string}
+ */
+export function stripWrappedQuotes(raw) {
+  const s = String(raw ?? "").trim();
+  if (
+    (s.startsWith('"') && s.endsWith('"') && s.length >= 2) ||
+    (s.startsWith("'") && s.endsWith("'") && s.length >= 2)
+  ) {
+    return s.slice(1, -1).trim();
+  }
+  return s;
+}
+
+/**
+ * Host (lowercase, no port) from a URL or registry string, or "".
+ * @param {string} raw
+ * @returns {string}
+ */
+export function registryHost(raw) {
+  if (!raw) return "";
+  let s = stripWrappedQuotes(raw);
+  if (!s) return "";
+  try {
+    if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(s)) {
+      s = `https://${s}`;
+    }
+    return new URL(s).hostname.toLowerCase();
+  } catch {
+    return s
+      .replace(/^https?:\/\//i, "")
+      .split("/")[0]
+      .split(":")[0]
+      .toLowerCase();
+  }
+}
+
+/**
+ * Parse registry URLs from an npmrc body. Returns the default `registry=`
+ * value(s) when present; only falls back to `@scope:registry=` values when no
+ * default is set (a foreign scoped registry is not a `jf setup` conflict).
+ * @param {string} body
+ * @returns {string[]} registry URL values
+ */
+export function parseNpmrcRegistries(body) {
+  /** @type {string[]} */
+  const def = [];
+  /** @type {string[]} */
+  const scoped = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    const m = trimmed.match(/^(@[^\s:]+:)?registry\s*=\s*(.+)$/i);
+    if (m) (m[1] ? scoped : def).push(stripWrappedQuotes(m[2]));
+  }
+  // `jf setup` only repoints the DEFAULT registry, so a foreign default is a
+  // real conflict but a foreign `@scope:registry=` is not (setup won't touch
+  // it). Prefer the default; fall back to scoped only when no default is set.
+  return def.length ? def : scoped;
+}
+
+/**
+ * Parse pip `index-url` / `extra-index-url` values from a pip.conf body.
+ * Mirrors paths used by jfrog-cli-artifactory setup (PIP_CONFIG_FILE or
+ * ~/.config/pip/pip.conf / %APPDATA%/pip/pip.ini).
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parsePipIndexUrls(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    if (trimmed.startsWith("[")) continue;
+    const m = trimmed.match(/^(?:extra-)?index-url\s*=\s*(.+)$/i);
+    if (m) out.push(stripWrappedQuotes(m[1]));
+  }
+  return out;
+}
+
+/**
+ * Candidate pip config file paths (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pipConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.PIP_CONFIG_FILE) out.push(process.env.PIP_CONFIG_FILE);
+  if (process.platform === "win32") {
+    const appData =
+      process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "pip", "pip.ini"));
+  }
+  if (process.platform === "darwin") {
+    // pip reads the macOS per-user path ahead of the XDG fallback.
+    out.push(
+      path.join(h, "Library", "Application Support", "pip", "pip.conf"),
+    );
+  }
+  out.push(path.join(h, ".config", "pip", "pip.conf"));
+  out.push(path.join(h, ".pip", "pip.conf"));
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readPipIndexes(home) {
+  const h = resolveHome(home);
+  for (const file of pipConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parsePipIndexUrls(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Parse GOPROXY list from a go env file body (`key = value` lines).
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseGoProxyList(body) {
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const m = line.trim().match(/^GOPROXY\s*=\s*(.+)$/i);
+    if (!m) continue;
+    return m[1]
+      .split(",")
+      .map((s) => stripWrappedQuotes(s.trim()))
+      .filter(
+        (s) => s && s.toLowerCase() !== "direct" && s.toLowerCase() !== "off",
+      );
+  }
+  return [];
+}
+
+/**
+ * @param {string} targetUrl Artifactory base or package-type URL
+ * @param {string[]} existingRegistries
+ * @returns {{ conflict: boolean, existing?: string, targetHost?: string, existingHost?: string }}
+ */
+export function conflictAgainstTarget(targetUrl, existingRegistries) {
+  const targetHost = registryHost(targetUrl);
+  if (!targetHost) return { conflict: false };
+  for (const existing of existingRegistries) {
+    const existingHost = registryHost(existing);
+    if (!existingHost) continue;
+    if (existingHost !== targetHost) {
+      return { conflict: true, existing, targetHost, existingHost };
+    }
+  }
+  return { conflict: false, targetHost };
+}
+
+/**
+ * Prefer explicit registry URL lines; fall back to scoped-auth hosts only when
+ * no `registry=` / YAML registry is set (auth-only configs still conflict).
+ * Avoids leftover public `_authToken` lines false-conflicting when the live
+ * registry already points at Artifactory.
+ * @param {string[]} registryUrls
+ * @param {string[]} authHosts
+ * @returns {string[]}
+ */
+function preferRegistryUrls(registryUrls, authHosts) {
+  return registryUrls.length ? registryUrls : authHosts;
+}
+
+/**
+ * Candidate npmrc paths (first existing wins). Honor NPM_CONFIG_USERCONFIG
+ * the same way pip honors PIP_CONFIG_FILE — live isolation redirects there.
+ * pnpm does NOT read this file for its own config (see
+ * {@link pnpmConfigFileCandidates}) — this is npm only.
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function npmrcFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.NPM_CONFIG_USERCONFIG) {
+    out.push(process.env.NPM_CONFIG_USERCONFIG);
+  }
+  out.push(path.join(h, ".npmrc"));
+  return out;
+}
+
+/**
+ * Read npm user config registries (NPM_CONFIG_USERCONFIG or $HOME/.npmrc).
+ * Includes `registry=` lines and scoped-auth hosts (`//host/:_authToken=`) so
+ * auth-only npmrc (default registry = public npm) still conflicts.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readNpmRegistries(home) {
+  for (const file of npmrcFileCandidates(resolveHome(home))) {
+    if (!existsSync(file)) continue;
+    try {
+      const body = readFileSync(file, "utf8");
+      return preferRegistryUrls(
+        parseNpmrcRegistries(body),
+        parseAuthIniHosts(body),
+      );
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Extract registry hosts from npmrc-style scoped-auth lines
+ * (`//hostname[:port]/path:_authToken=…`, `:_auth=…`, `:_password=…`). pnpm's
+ * `auth.ini` stores credentials this way without a `registry=` line, so a
+ * conflict can only be detected from the host in the auth key.
+ * @param {string} body
+ * @returns {string[]} hostnames (with port, if present — registryHost strips it)
+ */
+export function parseAuthIniHosts(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+    const m = trimmed.match(/^\/\/([^/\s]+)\/\S*:_(?:authToken|auth|password)\b/i);
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+
+/**
+ * Extract registry URLs from a pnpm `config.yaml` body (`registry: https://…`
+ * or quoted). Nested `registries:` maps are out of scope.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parsePnpmConfigYamlRegistries(body) {
+  const out = [];
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^registry\s*:\s*(.+)$/i);
+    if (m) out.push(stripWrappedQuotes(m[1]));
+  }
+  return out;
+}
+
+/**
+ * pnpm global config directories, in the order pnpm itself resolves them
+ * (first that exists is authoritative for pnpm; here we scan every one since
+ * auth vs. registry settings can be split across sibling files).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pnpmConfigDirCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.XDG_CONFIG_HOME) {
+    out.push(path.join(process.env.XDG_CONFIG_HOME, "pnpm"));
+  }
+  out.push(path.join(h, ".config", "pnpm"));
+  if (process.platform === "darwin") {
+    out.push(path.join(h, "Library", "Preferences", "pnpm"));
+  }
+  if (process.platform === "win32") {
+    const localAppData =
+      process.env.LOCALAPPDATA || path.join(h, "AppData", "Local");
+    out.push(path.join(localAppData, "pnpm"));
+  }
+  return out;
+}
+
+/** File names pnpm may keep global config/auth in, under a config dir. */
+const PNPM_CONFIG_FILE_NAMES = ["auth.ini", "rc", "config.yaml", ".npmrc"];
+
+/**
+ * Candidate pnpm config file paths — every `{dir}/{name}` combination across
+ * {@link pnpmConfigDirCandidates} × {@link PNPM_CONFIG_FILE_NAMES}. Unlike
+ * {@link npmrcFileCandidates}, pnpm does NOT honor `NPM_CONFIG_USERCONFIG`
+ * for its own writes/reads — that env var is npm-only.
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function pnpmConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  for (const dir of pnpmConfigDirCandidates(h)) {
+    for (const name of PNPM_CONFIG_FILE_NAMES) {
+      out.push(path.join(dir, name));
+    }
+  }
+  return out;
+}
+
+/**
+ * Read pnpm registries from every existing pnpm config file (auth.ini / rc /
+ * config.yaml / .npmrc under the pnpm config dir). Registries come from
+ * `registry=` lines (config/rc files) and scoped-auth hostnames (auth.ini).
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readPnpmRegistries(home) {
+  const h = resolveHome(home);
+  /** @type {string[]} */
+  const registryUrls = [];
+  /** @type {string[]} */
+  const authHosts = [];
+  for (const file of pnpmConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      const body = readFileSync(file, "utf8");
+      registryUrls.push(...parseNpmrcRegistries(body));
+      authHosts.push(...parseAuthIniHosts(body));
+      if (file.endsWith(`${path.sep}config.yaml`) || file.endsWith("config.yaml")) {
+        registryUrls.push(...parsePnpmConfigYamlRegistries(body));
+      }
+    } catch {
+      // try next file
+    }
+  }
+  return preferRegistryUrls(registryUrls, authHosts);
+}
+
+/**
+ * Parse index / extra-index URLs from a uv.toml (or uv config) body.
+ * @param {string} body
+ * @returns {string[]}
+ */
+export function parseUvIndexUrls(body) {
+  const out = [];
+  // Bare `url = …` only counts as a registry inside an [[index]] / [[tool.uv.index]]
+  // table — elsewhere it could be an unrelated key. `index-url` / `extra-index-url`
+  // are top-level and always count.
+  let inIndexTable = false;
+  for (const line of String(body || "").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("[")) {
+      inIndexTable = /^\[\[(?:tool\.uv\.)?index\]\]/i.test(trimmed);
+      continue;
+    }
+    const flat = trimmed.match(/^(?:extra-)?index-url\s*=\s*(.+)$/i);
+    if (flat) {
+      const raw = stripWrappedQuotes(flat[1]);
+      if (raw) out.push(raw);
+      continue;
+    }
+    if (inIndexTable) {
+      const urlLine = trimmed.match(/^url\s*=\s*(.+)$/i);
+      if (urlLine) {
+        const raw = stripWrappedQuotes(urlLine[1]);
+        if (raw) out.push(raw);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Candidate uv config paths (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function uvConfigFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.UV_CONFIG_FILE) out.push(process.env.UV_CONFIG_FILE);
+  if (process.platform === "win32") {
+    const appData =
+      process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "uv", "uv.toml"));
+  }
+  out.push(path.join(h, ".config", "uv", "uv.toml"));
+  return out;
+}
+
+/**
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readUvIndexes(home) {
+  const h = resolveHome(home);
+  for (const file of uvConfigFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parseUvIndexUrls(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Candidate GOENV file paths for this platform (first existing wins).
+ * @param {string} h home directory
+ * @returns {string[]}
+ */
+export function goEnvFileCandidates(h) {
+  /** @type {string[]} */
+  const out = [];
+  if (process.env.GOENV) out.push(process.env.GOENV);
+  if (process.platform === "darwin") {
+    out.push(path.join(h, "Library", "Application Support", "go", "env"));
+  } else if (process.platform === "win32") {
+    const appData =
+      process.env.APPDATA || path.join(h, "AppData", "Roaming");
+    out.push(path.join(appData, "go", "env"));
+  }
+  // Linux XDG + common fallback on all platforms
+  out.push(path.join(h, ".config", "go", "env"));
+  return out;
+}
+
+/**
+ * Read GOPROXY from platform GOENV locations.
+ * @param {string} [home]
+ * @returns {string[]}
+ */
+function readGoProxies(home) {
+  const h = resolveHome(home);
+  for (const file of goEnvFileCandidates(h)) {
+    if (!existsSync(file)) continue;
+    try {
+      return parseGoProxyList(readFileSync(file, "utf8"));
+    } catch {
+      // try next
+    }
+  }
+  return [];
+}
+
+/**
+ * Whether running `jf setup <packageManager>` for `targetUrl` would repoint
+ * an existing user-level registry away from another host.
+ *
+ * Covered today: npm (`NPM_CONFIG_USERCONFIG` / `$HOME/.npmrc`), pnpm
+ * (own `auth.ini`/`rc`/`config.yaml` under the pnpm config dir **plus**
+ * npm's userconfig — some `jf setup pnpm` builds still write via
+ * `NPM_CONFIG_USERCONFIG`, so a foreign `.npmrc` must block pnpm too),
+ * pip/pipenv (`PIP_CONFIG_FILE` / platform pip.conf), uv
+ * (`UV_CONFIG_FILE` / uv.toml), go (platform GOENV paths).
+ * Other package managers → no conflict detected (setup proceeds).
+ *
+ * @param {string} packageManager
+ * @param {string} targetUrl platform or package URL whose host is the target
+ * @param {{ home?: string }} [opts]
+ * @returns {{ conflict: boolean, existing?: string, targetHost?: string, existingHost?: string }}
+ */
+export function detectSetupConflict(packageManager, targetUrl, opts = {}) {
+  const pm = String(packageManager || "").toLowerCase();
+  let existing = [];
+  if (pm === "npm") {
+    existing = readNpmRegistries(opts.home);
+  } else if (pm === "pnpm") {
+    // Union: native pnpm config + npm userconfig. Native-only misses
+    // CLI builds that still configure pnpm by rewriting NPM_CONFIG_USERCONFIG.
+    existing = [
+      ...readPnpmRegistries(opts.home),
+      ...readNpmRegistries(opts.home),
+    ];
+  } else if (pm === "pip" || pm === "pipenv") {
+    existing = readPipIndexes(opts.home);
+  } else if (pm === "uv") {
+    existing = readUvIndexes(opts.home);
+  } else if (pm === "go") {
+    existing = readGoProxies(opts.home);
+  } else {
+    return { conflict: false };
+  }
+
+  if (!existing.length) return { conflict: false };
+
+  const result = conflictAgainstTarget(targetUrl, existing);
+  if (result.conflict) {
+    log.info("eager setup conflict: existing registry points elsewhere", {
+      packageManager: pm,
+      existingHost: result.existingHost,
+      targetHost: result.targetHost,
+    });
+  }
+  return result;
+}