ai-install-guard 0.3.0 → 0.3.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "ai-install-guard",
       "source": "./",
-      "version": "0.3.0",
+      "version": "0.3.2",
       "description": "Scans plugins, mods, skills and MCP servers without running them, shows a PASS / WARN / FAIL verdict, and installs nothing until you approve.",
       "category": "security",
       "keywords": [

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-install-guard",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A pre-install security gate for Claude Code: scans plugins, mods, skills and MCP servers without running them, and installs nothing until you approve.",
   "author": {
     "name": "Boaz Ziniman",

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to ai-install-guard. Ordered newest to oldest.
 
 ---
 
+## v0.3.2  ·  2026-10-23
+
+**`pane`** - The held command, the verdict's reasons and the title wrap instead of being cut off at the pane's edge, so a long reason can be read in a narrow pane. A Could not verify reason shows as a sentence of its own under the banner
+
+**`/plugin install`** - When the guard could not verify an install, the command's answer says why, and names the button that installs it anyway; a scan's own findings stay in the pane. `/plugin install <name> --marketplace <source>` is now scanned like any install: for a marketplace on GitHub, its catalog is read at the commit Claude Code would add, and the folder or repository it names for the plugin is scanned. Claude's own `claude plugin install … --marketplace` must name the marketplace by its https address or full path
+
+---
+
+## v0.3.1 &nbsp;·&nbsp; 2026-10-23
+
+**`README`** - An Uninstall section, linked from the top: how to remove or pause the guard in Claude Code or from a terminal, how to turn it off from outside Claude Code if it ever holds something it should not, how to clear your decisions before you go, and that the guard never holds an uninstall or a disable
+
+**`ci`** - The workflows use the current Node 24 releases of checkout, setup-node and upload-artifact, pinned to their commits, instead of Node 20 ones the runners now force onto Node 24, and npm no longer warns about the `always-auth` setting the old setup-node wrote
+
+---
+
 ## v0.3.0 &nbsp;·&nbsp; 2026-10-23
 
 **`/plugin install`** - The guard now holds installs. `/plugin install <name>@<marketplace>` and `/plugin marketplace add <source>` are looked up (the repository, folder and commit Claude Code would install from), scanned at that commit and answered in the command's place, so nothing installs until you press Install in the pane. Install records your approval for that commit and tree hash, looks the plugin up once more, and runs your command again; a commit that moved since the scan is not installed. A version you already approved installs without asking again unless a new scan judges it worse, a rejected one stays refused, and what the guard cannot pin (an npm package, a plugin no marketplace lists, a name two marketplaces share) is Could not verify, with Install anyway behind a second confirmation that lets that one command through once. The `/plugin` menu itself is not gated yet, and says so when it opens

package/README.md

@@ -16,6 +16,8 @@
 /plugin install ai-install-guard --marketplace ziniman/ai-install-guard
 ```
 
+To turn it off or remove it, see [Uninstall](#uninstall).
+
 </div>
 
 > **Status: early development.** `/plugin install` and `/plugin marketplace add`, and the same installs when Claude runs `claude plugin` itself, are held until you approve the exact version the guard scanned. `/guard scan` checks a folder or a repository before you install it anywhere. The other gates are being built in stages; see [Where it steps in](#where-it-steps-in) and [Roadmap](#roadmap).
@@ -28,7 +30,7 @@ AI Install Guard is a Claude Code mod that stops every new plugin, mod, skill, M
 
 You, before you add something to Claude Code. It runs inside your own session, needs no account, server or agent, and is open source, so you can read every check it makes. It reaches the network only to fetch the candidate from where it lives and to read that repository's public details; any outside lookup stays optional and off by default.
 
-Company security platforms such as AIR, Pluto and Neo watch a whole fleet of agents and enforce policy across it. The guard does not replace them: it is an open, local check for one developer's installs, and it works the same whether or not your company runs one.
+Company-wide security platforms watch a whole fleet of agents and enforce policy across it. The guard does not replace them: it is an open, local check for one developer's installs, and it works the same whether or not your company runs one.
 
 ## How it works
 
@@ -43,7 +45,7 @@ Approvals are remembered by commit and content hash, so the same version is neve
 
 | Layer | Catches | What happens | Today |
 |-------|---------|--------------|-------|
-| Slash command | `/plugin install <name>@<marketplace>`, `/plugin marketplace add <source>` | Held until you press Install | Yes |
+| Slash command | `/plugin install <name>@<marketplace>`, `/plugin install <name> --marketplace <source>`, `/plugin marketplace add <source>` | Held until you press Install | Yes |
 | Claude's own commands | `claude plugin install`, `claude plugin update`, `claude plugin marketplace add`, also inside `sh -c`, `eval` or a here-document | Refused, with a note telling Claude the install waits for your decision | Yes |
 | Claude's own commands | `claude mcp add`, copies into skills folders, edits to `.mcp.json` or settings, `npx -y`, `curl \| sh` | Refused until scanned | Next stage |
 | Mod loading | Any mod about to load, however it got there, including plugins picked from the `/plugin` menu | Refused if its files do not match what you approved | Later |
@@ -52,7 +54,9 @@ Approvals are remembered by commit and content hash, so the same version is neve
 
 ### Installing with the guard on
 
-Run `/plugin install notes@acme` as usual. The guard looks up where Claude Code would install it from (the repository, folder and commit its marketplace names), scans that commit, and answers in the command's place, so nothing is installed yet. The pane shows the verdict and the command it is holding.
+Run `/plugin install notes@acme` as usual. The guard looks up where Claude Code would install it from (the repository, folder and commit its marketplace names), scans that commit, and answers in the command's place, so nothing is installed yet. The pane shows the verdict and the command it is holding. When it could not verify the install, the command's answer says why too.
+
+To install from a marketplace you have not added yet, `/plugin install rtl-toggle --marketplace owner/repo` works the same way: for a marketplace on GitHub, the guard reads its catalog at the commit Claude Code would add and scans the folder or repository that catalog names for the plugin. A marketplace hosted elsewhere is Could not verify until you add it with `/plugin marketplace add`, which the guard scans.
 
 - **Install** (`i`) records your approval for that exact commit and tree hash, looks the plugin up once more, and runs your `/plugin` command again. If the commit moved since the scan, nothing is installed and the next `/plugin install` scans the new one.
 - **Reject** (`r`) records the rejection. The same version is refused from then on; `/guard forget notes@acme` judges it again.
@@ -141,7 +145,7 @@ A security tool should be held to its own rules, so here is everything this mod
 | `command.register` | Adds the `/guard` command. |
 | `store`, `state` | Remembers your decisions and the last report, holds what the pane shows, and keeps a one-time pass for an install you allowed anyway. |
 | `ui` | The verdict pane, its status line and toasts, and copying the report. |
-| `http.fetch` | For a repository on GitHub, reads its public metadata from GitHub's API: age, owner, stars, contributors, and whether the scanned commit is signed and on the default branch. GitHub is where the code came from, so this tells it nothing new. With **outside lookups** on, also sends package names to [OSV](https://osv.dev) and reads Anthropic's [official plugin list](https://github.com/anthropics/claude-plugins-official). |
+| `http.fetch` | For a repository on GitHub, reads its public metadata from GitHub's API: age, owner, stars, contributors, and whether the scanned commit is signed and on the default branch. For `/plugin install <name> --marketplace <owner>/<repo>`, reads that marketplace's catalog from GitHub at the commit that would be added, to find where the plugin is. GitHub is where the code came from, so this tells it nothing new. With **outside lookups** on, also sends package names to [OSV](https://osv.dev) and reads Anthropic's [official plugin list](https://github.com/anthropics/claude-plugins-official). |
 
 A later stage adds, optionally, `model.complete` (a review that can only add warnings).
 
@@ -160,6 +164,40 @@ claude plugin configure ai-install-guard
 
 A lookup that fails or hits a rate limit is noted in the report and never fails the scan.
 
+## Uninstall
+
+The guard holds installs, never removals: uninstalling or disabling it, or any other plugin, goes straight through when the command says so plainly. One whose action is only known as it runs, such as `claude plugin "$ACTION" …`, is held, since it could as well be an install.
+
+**Remove it** in Claude Code:
+
+```
+/plugin uninstall ai-install-guard@ai-install-guard
+```
+
+or from a terminal:
+
+```bash
+claude plugin uninstall ai-install-guard@ai-install-guard
+```
+
+If you installed it for one project only (`--scope project` or `--scope local`), add the same `--scope`. To remove its marketplace as well, run `/plugin marketplace remove ai-install-guard`. A session that is already open may keep the guard loaded until you restart it.
+
+**Turn it off for a while** with `/plugin disable ai-install-guard@ai-install-guard`, and back on with `/plugin enable ai-install-guard@ai-install-guard`.
+
+**If it ever gets in your way.** The guard fails closed: when it cannot check something, it stops it. So a bug in the guard could hold an install, or a shell command it mistakes for one, that should have gone through. You can always turn it off from a terminal outside Claude Code, where the guard sees nothing:
+
+```bash
+claude plugin disable ai-install-guard@ai-install-guard
+```
+
+If even that fails, set `"ai-install-guard@ai-install-guard": false` under `enabledPlugins` in `~/.claude/settings.json` (or in the project's `.claude/settings.json` if you installed it there). Then [open an issue](https://github.com/ziniman/ai-install-guard/issues) with the command it stopped, so it can be fixed.
+
+**Your decisions.** Approvals and rejections are kept in the store Claude Code gives the plugin, which can outlast an uninstall, so a later reinstall may find them again. To start clean, run `/guard list` before you uninstall and `/guard forget <name>` for each one. The guard writes no files of its own: its only folder is the temporary one it fetches into, removed after each scan.
+
+**If your organization installed it** through managed settings, it is theirs to remove; ask whoever manages your Claude Code settings.
+
+**In Claude chat,** remove the skill under **Settings > Capabilities > Skills**.
+
 ## What it is not
 
 - **Not a proof of safety.** Static analysis raises the bar and makes every capability visible; a determined attacker can still evade it.

package/hooks/gate/gate.ts

@@ -13,6 +13,7 @@ import { sourceRoot } from '../guard/view'
 import { modHost } from '../mod-host'
 import { resolvePin } from '../scan/remote'
 import { safeLine } from '../scan/safe-text'
+import type { VerdictKind } from '../scan/verdict'
 import type { InstallRequest, Reading } from './requests'
 import { targetOf } from './resolve'
 
@@ -31,7 +32,8 @@ export async function judge($: EngineInterface, reading: Exclude<Reading, { kind
   const options = { action: 'install' as const, request, lookups }
   if (reading.kind === 'unreadable') {
     const shown = await showUnverified($, reading.label, reading.reason, options)
-    return shown.superseded ? superseded(request) : hold(request, 'Could not verify', '', shown.placed)
+    // The reason is the guard's own reading of the command, so Claude may read it too.
+    return shown.superseded ? superseded(request) : hold(request, UNVERIFIED, '', shown.placed, { why: reading.reason, toClaude: true })
   }
   const name = nameOf(reading.request)
   const host = modHost($)
@@ -41,7 +43,8 @@ export async function judge($: EngineInterface, reading: Exclude<Reading, { kind
       return { kind: 'allow', note: BROWSE_NOTE }
     case 'unverifiable': {
       const shown = await showUnverified($, name, target.reason, options)
-      return shown.superseded ? superseded(request) : hold(request, 'Could not verify', '', shown.placed)
+      // This reason can quote a marketplace's own catalog: the person reads it, Claude does not.
+      return shown.superseded ? superseded(request) : hold(request, UNVERIFIED, '', shown.placed, { why: target.reason, toClaude: false })
     }
     case 'remote': {
       // The commit the install would take now. A rejection of it stands
@@ -70,8 +73,11 @@ function nameOf(request: InstallRequest): string {
   return safeLine(request.marketplace === undefined ? request.plugin : `${request.plugin}@${request.marketplace}`)
 }
 
+/** How a held install that could not be checked is described. */
+const UNVERIFIED = { kind: 'unverified', recommendation: 'Could not verify' } as const
+
 function afterScan(request: GuardRequest, name: string, shown: Shown): Judgement {
-  if (shown.kind === 'failed') return shown.superseded ? superseded(request) : hold(request, 'Could not verify', '', shown.placed)
+  if (shown.kind === 'failed') return shown.superseded ? superseded(request) : hold(request, UNVERIFIED, '', shown.placed)
   const sha = shown.report.source?.sha
   const where = sha === undefined ? '' : ` at commit ${sha.slice(0, 12)}`
   // The same files approved before (through /guard scan, or an earlier install), and judged no
@@ -79,7 +85,7 @@ function afterScan(request: GuardRequest, name: string, shown: Shown): Judgement
   if (shown.view.decision === 'approved') return { kind: 'allow', note: `AI Install Guard: you approved ${name}${where} on ${day(shown.view.decidedAt ?? Date.now())}; installing it` }
   if (shown.view.decision === 'rejected') return rejected(request, name, where, shown.view.decidedAt)
   if (shown.superseded) return superseded(request)
-  return hold(request, shown.report.verdict.recommendation, where, shown.placed, shown.text)
+  return hold(request, shown.report.verdict, where, shown.placed, { report: shown.text })
 }
 
 /** Another scan took the pane before this one finished: nothing to press, so nothing installs. */
@@ -96,19 +102,34 @@ function rejected(request: GuardRequest, name: string, where: string, decidedAt:
   return { kind: 'hold', text: `AI Install Guard: you rejected ${name}${where}${when}. Nothing was installed. /guard forget ${name} judges it again.` }
 }
 
-/** The answer while an install waits for the person's decision in the pane. */
-function hold(request: GuardRequest, recommendation: string, where: string, placed: boolean, report?: string): Judgement {
-  const what = `${recommendation} for ${request.label}${where}`
+/**
+ * The answer while an install waits for the person's decision in the pane.
+ * `why` says why it could not be checked; Claude reads it only when it is the
+ * guard's own reading of Claude's command, never words from a catalog.
+ */
+function hold(
+  request: GuardRequest,
+  verdict: { kind: VerdictKind; recommendation: string },
+  where: string,
+  placed: boolean,
+  more: { report?: string; why?: string; toClaude?: boolean } = {},
+): Judgement {
+  const unverified = verdict.kind === 'unverified'
+  const why = more.why === undefined ? '' : `: ${safeLine(more.why)}`
+  const what = unverified ? `could not verify ${request.label}${where}` : `${verdict.recommendation} for ${request.label}${where}`
+  // Do not install and Could not verify install only through Install anyway, which asks twice.
+  const button = unverified || verdict.kind === 'reject' ? 'Install anyway (it asks you to confirm)' : 'Install'
   if (request.origin === 'tool') {
     const next = placed
       ? 'The verdict and the Install and Reject buttons are in the guard\'s pane. Tell the person the install waits for their decision there, and run the same command again only after they say they approved it.'
       : 'This session cannot show the guard\'s pane, so the person cannot approve it here.'
-    return { kind: 'hold', text: `AI Install Guard held this install for the person to review: ${what}. Nothing was installed. Do not retry it or install it another way. ${next}` }
+    return { kind: 'hold', text: `AI Install Guard held this install for the person to review: ${unverified ? `it ${what}${more.toClaude === true ? why : ''}` : what}. Nothing was installed. Do not retry it or install it another way. ${next}` }
   }
+  const said = unverified ? `AI Install Guard ${what}${why}.` : `AI Install Guard: ${what}.`
   if (!placed) {
-    return { kind: 'hold', text: `${report === undefined ? '' : `${report}\n\n`}AI Install Guard: ${what}. Nothing was installed: approving an install needs the guard's pane, which this session cannot show.` }
+    return { kind: 'hold', text: `${more.report === undefined ? '' : `${more.report}\n\n`}${said} Nothing was installed: approving an install needs the guard's pane, which this session cannot show.` }
   }
-  return { kind: 'hold', text: `AI Install Guard: ${what}. Nothing is installed yet: press Install in the guard's pane to install it, or Reject.` }
+  return { kind: 'hold', text: `${said} Nothing is installed yet: press ${button} in the guard's pane to install it, or Reject.` }
 }
 
 function day(time: number): string {

package/hooks/gate/requests.ts

@@ -6,7 +6,8 @@ import { safeLine } from '../scan/safe-text'
 
 /** One thing to add to Claude Code: a plugin from a marketplace, or a marketplace. */
 export type InstallRequest =
-  | { kind: 'plugin'; verb: 'install' | 'update'; plugin: string; marketplace?: string }
+  /** `marketplaceSource` is the marketplace `--marketplace` adds first: a repository or a folder. */
+  | { kind: 'plugin'; verb: 'install' | 'update'; plugin: string; marketplace?: string; marketplaceSource?: string }
   | { kind: 'marketplace'; source: string }
 
 export type Reading =
@@ -70,11 +71,12 @@ function readShell(command: string): Reading {
     if (others > 0) return { kind: 'unreadable', label: only.label, reason: `the command runs more than the install; run ${only.label} as a command of its own, so approving it approves only the install` }
     // The guard cannot see the shell's current folder, so a source named
     // relative to it could be another folder than the one the guard scans.
-    if (only.request.kind === 'marketplace' && !/^(?:https:\/\/|\/|~\/)/i.test(only.request.source)) {
+    const source = only.request.kind === 'marketplace' ? only.request.source : only.request.marketplaceSource
+    if (source !== undefined && !/^(?:https:\/\/|\/|~\/)/i.test(source)) {
       return {
         kind: 'unreadable',
         label: only.label,
-        reason: `"${safeLine(only.request.source)}" could be a folder in the shell's current folder or a repository; name it as a full path or as https://github.com/<owner>/<repo>, so the guard scans what is added`,
+        reason: `"${safeLine(source)}" could be a folder in the shell's current folder or a repository; name it as a full path or as https://github.com/<owner>/<repo>, so the guard scans what is added`,
       }
     }
     return only
@@ -386,23 +388,22 @@ function programName(word: string | undefined): string {
 function readInstall(words: readonly string[], verb: 'install' | 'update', command: string): Reading {
   const options = readOptions(words, INSTALL_VALUES, INSTALL_FLAGS)
   const named = options.positionals[0]
-  const label = `${command}${named === undefined ? '' : ` ${safeLine(named)}`}`
+  const marketplaceSource = options.values.get('--marketplace')
+  const label = `${command}${named === undefined ? '' : ` ${safeLine(named)}`}${marketplaceSource === undefined ? '' : ` --marketplace ${safeLine(marketplaceSource)}`}`
   if (options.unknown !== undefined) return { kind: 'unreadable', label, reason: `the guard does not know the option ${safeLine(options.unknown)}` }
   // With no plugin named, Claude Code shows its menu to pick one from.
   if (named === undefined) return verb === 'install' ? BROWSE : PASS
   if (options.positionals.length > 1) return { kind: 'unreadable', label, reason: 'it names more than one plugin; install one at a time' }
-  if (options.values.has('--marketplace')) {
-    return {
-      kind: 'unreadable',
-      label,
-      reason: `it installs from a marketplace that is not added yet. Add it first with /plugin marketplace add ${safeLine(options.values.get('--marketplace') ?? '<source>')}, which the guard scans, then install ${safeLine(named)}@<marketplace>`,
-    }
-  }
   const id = PLUGIN_ID.exec(named)
   if (id === null) return { kind: 'unreadable', label, reason: `"${safeLine(named)}" is not a plugin name the guard can look up` }
   const plugin = id[1] as string
   const marketplace = id[2]
   if (options.values.has('--registry') || marketplace?.toLowerCase() === 'npm') return { kind: 'unreadable', label, reason: 'it installs a package from npm, which the guard cannot read yet' }
+  if (marketplaceSource !== undefined) {
+    // The plugin is looked up in the marketplace --marketplace adds, by its name alone.
+    if (marketplace !== undefined) return { kind: 'unreadable', label, reason: `with --marketplace, name the plugin alone (${safeLine(plugin)}), not as ${safeLine(named)}` }
+    return { kind: 'install', request: { kind: 'plugin', verb, plugin, marketplaceSource }, label }
+  }
   return { kind: 'install', request: { kind: 'plugin', verb, plugin, ...(marketplace === undefined ? {} : { marketplace }) }, label }
 }
 

package/hooks/gate/resolve.ts

@@ -4,7 +4,7 @@
 // the candidate runs.
 
 import type { Host } from '../scan/host'
-import { looksRemote, parseRemote, type RemoteSpec } from '../scan/remote'
+import { looksRemote, parseRemote, resolvePin, type RemoteSpec } from '../scan/remote'
 import { safeLine } from '../scan/safe-text'
 import type { InstallRequest } from './requests'
 
@@ -33,6 +33,7 @@ export async function targetOf(host: Host, request: InstallRequest): Promise<Tar
 }
 
 async function pluginTarget(host: Host, request: Extract<InstallRequest, { kind: 'plugin' }>): Promise<Target> {
+  if (request.marketplaceSource !== undefined) return fromNewMarketplace(host, request.plugin, request.marketplaceSource)
   const listing = await claudeJson(host, ['plugin', 'list', '--available', '--json'], 'the plugin list')
   const available: Listed[] = isRecord(listing) && Array.isArray(listing.available) ? (listing.available as Listed[]) : []
   const installed = isRecord(listing) && Array.isArray(listing.installed) ? (listing.installed as { id?: unknown }[]) : []
@@ -112,7 +113,7 @@ async function sourceTarget(host: Host, entry: Listed, marketOf: () => Promise<M
     case 'github':
       return remote(text(source.repo) === undefined ? undefined : `https://github.com/${text(source.repo)}.git`, ref)
     default:
-      return { kind: 'unverifiable', reason: `it installs from a ${safeLine(source.source)} source, which the guard cannot read yet` }
+      return { kind: 'unverifiable', reason: `it installs from ${/^(?:[aeiou]|npm)/i.test(source.source) ? 'an' : 'a'} ${safeLine(source.source)} source, which the guard cannot read yet` }
   }
 }
 
@@ -136,6 +137,66 @@ async function marketplaceTarget(host: Host, source: string): Promise<Target> {
   return { kind: 'remote', spec }
 }
 
+/**
+ * A plugin from a marketplace `--marketplace` adds first: the marketplace's
+ * catalog is read at the commit that would be added (from GitHub, for a
+ * repository there) or from its folder, and the plugin's own entry names
+ * the folder or repository to scan.
+ */
+async function fromNewMarketplace(host: Host, plugin: string, source: string): Promise<Target> {
+  const market = await marketplaceTarget(host, source)
+  if (market.kind !== 'remote' && market.kind !== 'local') return market.kind === 'browse' ? { kind: 'unverifiable', reason: 'it names no marketplace' } : market
+  if (market.kind === 'local') {
+    const entry = await catalogEntry(host, { name: safeLine(source), installLocation: market.path }, plugin)
+    if (entry === undefined) return { kind: 'unverifiable', reason: `${safeLine(plugin)} is not in the marketplace at ${safeLine(source)}` }
+    return sourceTarget(host, entry, async () => ({ name: safeLine(source), installLocation: market.path }))
+  }
+  // Only a GitHub marketplace's catalog can be read before it is added: anything else needs no lookup to say so.
+  if (githubRepo(market.spec.url) === undefined) return { kind: 'unverifiable', reason: NOT_ON_GITHUB }
+  const pin = await resolvePin(host, market.spec)
+  const catalog = await remoteCatalog(host, market.spec.url, pin.sha, pin.subdir)
+  if (typeof catalog === 'string') return { kind: 'unverifiable', reason: catalog }
+  const found = catalog.find(item => isRecord(item) && item.name === plugin)
+  if (!isRecord(found)) return { kind: 'unverifiable', reason: `${safeLine(plugin)} is not in the marketplace at ${safeLine(source)}` }
+  if (typeof found.source === 'string') {
+    // A folder of the marketplace's own repository, at the same commit.
+    if (!found.source.startsWith('./')) return { kind: 'unverifiable', reason: 'its source is not a folder inside its marketplace' }
+    const parts = [pin.subdir ?? '', found.source].join('/').split('/').filter(part => part !== '' && part !== '.')
+    if (parts.includes('..')) return { kind: 'unverifiable', reason: 'its source leads outside its marketplace' }
+    return { kind: 'remote', spec: { url: market.spec.url, ref: pin.sha, ...(parts.length === 0 ? {} : { subdir: parts.join('/') }) } }
+  }
+  return sourceTarget(host, { name: plugin, source: found.source }, async () => undefined)
+}
+
+/**
+ * A marketplace's catalog at one commit of its repository, read from GitHub;
+ * a string says why it could not be read. Other hosts are not read before
+ * the marketplace is added.
+ */
+async function remoteCatalog(host: Host, url: string, sha: string, subdir: string | undefined): Promise<unknown[] | string> {
+  const repo = githubRepo(url)
+  if (repo === undefined) return NOT_ON_GITHUB
+  if (host.fetch === undefined) return 'the catalog of its marketplace cannot be read here'
+  const path = `${subdir === undefined ? '' : `${subdir}/`}.claude-plugin/marketplace.json`
+  const answer = await host.fetch(`https://raw.githubusercontent.com/${repo.owner}/${repo.name}/${sha}/${path.split('/').map(encodeURIComponent).join('/')}`).catch(() => undefined)
+  if (answer === undefined || !answer.ok) return 'the catalog of its marketplace could not be read from GitHub'
+  if (answer.text.length > MAX_CATALOG_BYTES) return 'the catalog of its marketplace is too large to read'
+  try {
+    const parsed: unknown = JSON.parse(answer.text)
+    return isRecord(parsed) && Array.isArray(parsed.plugins) ? parsed.plugins : 'the catalog of its marketplace lists no plugins'
+  } catch {
+    return 'the catalog of its marketplace is not valid JSON'
+  }
+}
+
+const NOT_ON_GITHUB = 'its marketplace is not on GitHub, so its catalog cannot be read before it is added; add it first with /plugin marketplace add'
+
+/** The owner and name of a GitHub repository's https address, as `parseRemote` writes it. */
+function githubRepo(url: string): { owner: string; name: string } | undefined {
+  const match = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)\.git$/.exec(url)
+  return match === null ? undefined : { owner: match[1] as string, name: match[2] as string }
+}
+
 async function marketplaceList(host: Host): Promise<Marketplace[]> {
   const listed = await claudeJson(host, ['plugin', 'marketplace', 'list', '--json'], 'the marketplace list')
   if (!Array.isArray(listed)) return []

package/hooks/guard/pane.tsx

@@ -185,17 +185,17 @@ export async function drawPane($: EngineInterface, e: PaneInput): Promise<Render
   const verdict = view.verdict
   return (
     <Box flexDirection="column" width={width}>
-      <Text bold wrap="truncate-end">
+      <Text bold wrap="wrap">
         AI Install Guard · {view.target}
       </Text>
       {header !== '' && (
-        <Text dimColor wrap="truncate-end">
+        <Text dimColor wrap="wrap">
           {header}
         </Text>
       )}
 
       {view.request !== undefined && (
-        <Text dimColor wrap="truncate-end">
+        <Text dimColor wrap="wrap">
           {requestLine(view.request)}
         </Text>
       )}
@@ -210,7 +210,7 @@ export async function drawPane($: EngineInterface, e: PaneInput): Promise<Render
             {verdict.recommendation}
           </Text>
           {verdict.reasons.map(reason => (
-            <Text wrap="truncate-end">
+            <Text wrap="wrap">
               {reason}
             </Text>
           ))}
@@ -223,7 +223,7 @@ export async function drawPane($: EngineInterface, e: PaneInput): Promise<Render
         </Text>
       )}
       {verdict !== undefined && view.rows.length > 0 && (
-        <Text dimColor wrap="truncate-end">
+        <Text dimColor wrap="wrap">
           Quoted text comes from the scanned files and is untrusted.
         </Text>
       )}

package/hooks/guard/run.ts

@@ -92,21 +92,28 @@ export async function showUnverified($: EngineInterface, target: string, reason:
   const placed = await openPane($)
   const scanning = { ...withRequest(scanningView(target, options.action), options.request), scanId }
   if (!(await takePane($, scanning))) return { view: scanning, placed, superseded: true }
-  const failed = await showFailure($, target, `Could not verify ${safeLine(target)}: ${safeLine(reason)}`, options, scanId)
+  // The banner already says Could not verify and the title names the target: the pane shows the reason itself.
+  const failed = await showFailure($, target, `Could not verify ${safeLine(target)}: ${safeLine(reason)}`, options, scanId, sentence(reason))
   return { view: failed.view, placed, superseded: !failed.shown }
 }
 
+/** A reason as a sentence of its own: made safe, its first letter a capital. */
+function sentence(reason: string): string {
+  const safe = safeLine(reason)
+  return safe.charAt(0).toUpperCase() + safe.slice(1)
+}
+
 /**
  * The pane, and the report /guard report reopens, show a failure: never a
  * scanning pane, and never an older verdict in its place. Only while this
  * scan still owns the pane; `shown` says whether it did.
  */
-async function showFailure($: EngineInterface, target: string, reason: string, options: ShowOptions, scanId: string): Promise<{ view: GuardView; shown: boolean }> {
+async function showFailure($: EngineInterface, target: string, reason: string, options: ShowOptions, scanId: string, shownReason = reason): Promise<{ view: GuardView; shown: boolean }> {
   const failed: GuardView = {
     ...withRequest(scanningView(target, options.action), options.request),
     scanId,
     stage: '',
-    verdict: { kind: 'unverified', recommendation: 'Could not verify', reasons: [reason], counts: { pass: 0, warn: 0, fail: 0, info: 0 } },
+    verdict: { kind: 'unverified', recommendation: 'Could not verify', reasons: [shownReason], counts: { pass: 0, warn: 0, fail: 0, info: 0 } },
   }
   if (!(await owns($, scanId).catch(() => false))) return { view: failed, shown: false }
   await saveReport($, scanId, reason)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-install-guard",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A pre-install security gate for Claude Code: scans plugins, mods, skills and MCP servers without running them, and installs nothing until you approve.",
   "scripts": {
     "build:fixtures": "node scripts/build-fixtures.js",