{"version":"2.1.238","anchor":"managed-settings-can-refuse-plugin-sources-and-marketplace-u","canonical_anchor":"managed-settings-can-refuse-plugin-sources-and-marketplace-u","heading":"Managed settings can refuse plugin sources and marketplace updates","tier":"use","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/managed-settings-can-refuse-plugin-sources-and-marketplace-u","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Managed settings can refuse plugin sources and marketplace updates\n\nAdmins can block plugins and marketplaces from unlisted sources, with refusals naming the policy.\n\n**What**\n\nAdministrator-managed settings can now block plugins and marketplaces whose entry source is not listed in the managed `extraKnownMarketplaces` policy, so install, update and refresh stop with a policy error instead of running that entry's command for minting auth headers. Refusals are reported separately from ordinary failures, and the messages name the policy rather than looking like a network or catalog fault. Nothing is blocked unless the managed policy sets `disableCommandPluginSources` or `allowManagedHooksOnly`; without those, behaviour is unchanged.\n\n**Details**\n\n- A blocked marketplace update reports `<name> marketplace not updated (managed policy) \u2014 ask your admin` and lists the sources that were refused.\n- The plugin update path explains that `your organization's managed settings forbid its headersHelper (the version shown is from the cached catalog; ask your admin)`, so the displayed version may be stale.\n- Each refusal is classified as either \"lockdown\", meaning the policy forbids the source outright, or \"remote_policy_unconsented\", meaning a remote source whose policy has not been consented to in the current remote session.\n- Two new diagnostic kinds carry these refusals, including an `autoupdate-disabled-by-policy` notice.\n- Refused marketplaces are gathered into their own list during refresh rather than folded in with genuine failures.\n- `headersHelper`, the command that supplies auth headers for a source, is now accepted on plugin entries declared in settings files as well as on marketplace entries, and a validator rejects values that are over-long or contain non-printable ASCII.\n- The message for an inactive plugin no longer says \"or blocked by policy\" and now states only that the plugin is disabled.\n\n**Evidence**\n\n`autoupdate-disabled-by-policy`, `not updated (managed policy)`, `your organization's managed settings forbid its headersHelper (the version shown is from the cached catalog; ask your admin)`\n\n- Area: Plugins\n- Names: `disableCommandPluginSources`, `allowManagedHooksOnly`, `extraKnownMarketplaces`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}