{"record":{"id":"04092b4a6bdb7ebc","repo":"xai-org/grok-build","slug":"marketplace-source-blocked","errorCode":null,"errorMessage":"Marketplace source blocked: {}","messagePattern":"Marketplace source blocked: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-pager/src/plugin_cmd.rs","lineNumber":879,"sourceCode":"    if let MarketplaceAddInput::LocalPath(path) = &input\n        && !path.is_dir()\n    {\n        bail!(\n            \"Local marketplace path not found (or is not a directory): {}\",\n            path.display()\n        );\n    }\n\n    let identity = match &input {\n        MarketplaceAddInput::GitUrl(u) => u.clone(),\n        MarketplaceAddInput::LocalPath(p) => p.display().to_string(),\n    };\n\n    // Local paths never match the git-URL allowlist, so a restricted strictKnownMarketplaces policy blocks them; intentionally fail-closed\n    let allowlist =\n        &xai_grok_workspace::permission::resolution::managed_settings().marketplace_allowlist;\n    if allowlist.is_restricted() && !allowlist.is_url_allowed(&identity) {\n        bail!(\"Marketplace source blocked: {}\", allowlist.block_reason());\n    }\n\n    let already_configured = match &input {\n        MarketplaceAddInput::GitUrl(git_url) => {\n            let normalized = git_url.trim_end_matches(\".git\");\n            sources.iter().any(|s| {\n                matches!(&s.kind, SourceKind::Git { url: u, .. }\n                    if u.trim_end_matches(\".git\") == normalized)\n            })\n        }\n        MarketplaceAddInput::LocalPath(path) => sources\n            .iter()\n            .any(|s| matches!(&s.kind, SourceKind::Local { path: p } if p == path)),\n    };\n    if already_configured {\n        bail!(\"Marketplace source already configured: {identity}\");\n    }\n","sourceCodeStart":861,"sourceCodeEnd":897,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-pager/src/plugin_cmd.rs#L861-L897","documentation":"Under a restricted managed-settings marketplace allowlist, adding a marketplace whose source identity is not allowlisted is blocked with 'Marketplace source blocked: {reason}'. Local paths never match the git-URL allowlist, so a strict policy blocks them too — the check intentionally fails closed for security.","triggerScenarios":"Running `grok plugin marketplace add` in an environment where managed_settings defines a restricted marketplace_allowlist and the computed identity (git URL, or any local path) is not on it.","commonSituations":"Corporate/managed workspaces restricting plugin sources to approved URLs; trying to add a local-path marketplace while a strict allowlist is active; typo'd URL failing the allowlist match.","solutions":["Ask your workspace admin to allowlist the marketplace URL in managed settings","Use an approved marketplace URL from the allowlist","Host your marketplace at an already-approved domain/repo","Check the current policy via managed settings to see which URLs are permitted"],"exampleFix":"// before\ngrok plugin marketplace add ./my-local-market   # blocked by strict allowlist\n// after (admin adds to allowlist first)\n# managed settings: marketplace_allowlist: [\"https://github.com/approved/marketplace.git\"]\ngrok plugin marketplace add https://github.com/approved/marketplace.git","handlingStrategy":"try-catch","validationCode":"let allowlist = &xai_grok_workspace::permission::resolution::managed_settings()\n    .marketplace_allowlist;\nif allowlist.is_restricted() && !allowlist.is_url_allowed(&identity) {\n    eprintln!(\"Blocked by policy: {}\", allowlist.block_reason());\n    std::process::exit(1);\n}","typeGuard":"fn is_allowlisted(allowlist: &xai_grok_workspace::permission::resolution::Allowlist, identity: &str) -> bool {\n    !allowlist.is_restricted() || allowlist.is_url_allowed(identity)\n}","tryCatchPattern":"match marketplace_add(url, None, false, false) {\n    Err(e) if e.to_string().contains(\"Marketplace source blocked\") => {\n        eprintln!(\"Request an allowlist exception from your workspace admin: {e}\");\n    }\n    Ok(_) => {}\n    Err(e) => return Err(e),\n}","preventionTips":["Check managed settings for a restricted marketplace_allowlist before attempting adds","Prefer git URLs over local paths in managed environments (local paths fail closed)","Maintain an approved-sources list for your team and add marketplaces only from it","Request policy changes through your admin rather than bypassing the allowlist"],"tags":["permissions","policy","marketplace","allowlist","security"],"backgroundTag":"marketplace-source-blocked","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}