Marketplace and packages

Fixes for package installs, versions that do not change, and tools that are missing in a space. Only an admin can install or update packages. For the full list of packages, see the package catalog.

Install fails: admin role needed

You see: marketplace install requires admin role

Cause: Only admins and owners can install or uninstall packages. For members, the buttons are disabled with the note Read-only: only admins and owners can make changes.

Fix: Ask an admin or owner to install the package. See Roles and permissions.

Install fails with a version requirement

You see: Requires Marshal <range> (you have <version>) on the package card.

Cause: This package version needs a newer Marshal than your install runs.

Fix: Install an older version of the package, or have the person who runs your Marshal install upgrade it.

Install fails with a package check reason

You see: A reason such as marketplace images must be hosted at ...

Cause: Marshal checked the package and refused it. The check applies to packages that Marshal has not verified. For example, a package may carry an image hosted outside the registry that Marshal allows.

Fix: Use a package that Marshal has verified. For your own package, fix the item the reason names, such as moving its image to the allowed registry, and publish it again.

A package cannot be installed or removed

You see: The package card shows Built-in · always installed and has no install button.

Cause: Some packages are part of every space, such as the base tools and the package that teaches agents how to work in a Marshal space.

Fix: Every space already has them. Add other packages to your stack as usual.

New spaces still use the old version

You see: A package shows a newer version in the Marketplace, but new spaces still run the old one.

Cause: An installed package is a pinned copy. A newer version replaces it only when an admin updates it, or when Auto-update is ticked on the package, and then only for patch and minor versions. A version marked Needs approval and any new major version wait for an admin. A stack also keeps its own copy of each package version.

Fix:

To have patch and minor versions follow automatically, tick Auto-update on the package’s card on the Installed tab. See Keep packages up to date automatically.
An admin chooses Update to X on the package card in the Marketplace page.
Open the stack and choose Upgrade all.
Publish a new stack version.
Create a new space, or stop and resume an existing one. A running space keeps its setup until it stops. A resumed space picks up the manifest’s current packages, unless your admin set Refresh Spaces On Resume to never.

Marketplace page shows no API configured

You see: The marketplace public API isn't configured on this deployment.

Cause: The install has no marketplace address set.

Fix: The person who runs your Marshal install sets the marketplace address in the install’s configuration.

A new package is missing from Marketplace

You see: A package that was just published does not appear in the Marketplace page.

Cause: The marketplace refreshes its catalog on a timer, and a new package appears after the next refresh. This takes a few minutes.

Fix: Wait a few minutes and reload the Marketplace page.

Toolchain version missing or not downloading

You see: A toolchain version you need is not offered, or a space does not download it.

Cause: The version has no ready-made image, and on-demand downloads are off.

Fix: An admin turns on Allow On-Demand Toolchain Downloads in Settings, Configuration. A space then downloads the version when it starts, checks its checksum, and unpacks it in the agent’s home directory.

A native module fails to build

You see: A build error that gcc or a header such as ruby.h is missing.

Cause: Spaces start lean, with no C compiler.

Fix: Add the build-tools package to the stack. It provides gcc, g++, make, and binutils. Then create a new space.

Privacy settings block Artifact publishing

You see: Claude Code prints Publishing is off while nonessential traffic is disabled. Nothing was sent.

Cause: The Claude Code package has two privacy options, Disable telemetry and Disable non-essential traffic. While they are on, Claude Code sends only essential traffic, and publishing an Artifact is not essential.

Fix: To publish Artifacts, an admin turns both options off in the Claude Code package configuration for the stack. Create a new space. Check this against your security rules first, because it lets Claude Code send telemetry and make non-essential requests.

Docker Hub pull is blocked

You see: docker pull from Docker Hub fails, and the Audit page lists the Docker Hub host with status Blocked.

Cause: Egress is deny-by-default. Each package adds the hosts it needs, and other hosts stay blocked.

Fix: Add the egress-dockerhub package to the stack, or docker-hub to also sign in and raise the pull-rate limit. See Network and egress.

Start refused: blocked version

You see: “Start refused: blocked version” when you start a space, or a launch that names a package, a version and a reason.

Cause: An admin blocked that package version in the Security Center, and your space or manifest still holds it.

Fix: Open the manifest from the link in the message and move it to a version that is not blocked. Then start the space again. If there is no clean version to move to, an admin installs one and runs Fix affected. See Security Center.

Start refused: the space has no package record

You see: “Start refused” when you start a space, with a message that the space has no package record.

Cause: The space was created before Marshal recorded each space’s packages, and your organization has blocked package versions. Marshal checks such a space by resolving its manifest again as it starts. When the manifest was deleted, or no longer resolves for the space owner, the space stays stopped.

Fix: Fix the manifest so it resolves for the space owner, then start the space again. When the manifest was deleted, start a new space from a current manifest.

Launch refused: security check unavailable

You see: “security_check_unavailable: the organization’s blocked versions could not be checked; try again in a moment” when you start a space or run, or launch a deputy.

Cause: Marshal could not read your organization’s list of blocked package versions at that moment. It refuses the launch rather than risk starting a blocked version.

Fix: Try again in a moment. The launch goes through once the list can be read. If it keeps happening, ask an admin to check that the install is healthy.