[BUG] Plugin install uses SSH for public GitHub repos, fails without SSH keys configured

Status Closed — not planned

Reported on v2.1.6

Maintainer reply None cached

Activity 7 comments · opened Jan 13, 2026 · closed May 19, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report
[x] I am using the latest version of Claude Code

What's Wrong?

Plugin installation uses SSH URLs for public GitHub repos, failing for users without SSH keys configured.

| Command | Protocol | Result |
|---------|----------|--------|
| claude plugin marketplace add https://github.com/... | HTTPS | ✓ Works |
| claude plugin install plugin@marketplace | SSH | ✗ Fails |

Steps to Reproduce

Use a system without GitHub SSH keys (e.g., clean Docker container)
Add a public marketplace:

``claude plugin marketplace add https://github.com/heathdutton/claude-d2-diagrams``

Install the plugin:

``claude plugin install d2@claude-d2-diagrams``

Error Message

Installing plugin "d2@claude-d2-diagrams"...
✘ Failed to install plugin "d2@claude-d2-diagrams": Failed to clone repository: 
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Root Cause

The github source type in marketplace.json gets converted to SSH URL (git@github.com:) for cloning, but public repos work fine with HTTPS (https://github.com/) without authentication.

Expected Behavior

Use HTTPS for public GitHub repos. SSH should only be a fallback when HTTPS fails AND SSH is configured.

Environment

Claude Code: 2.1.6
macOS and Docker (clean container, no SSH keys)

#13553 (private repo credential issues - different problem)

View original on GitHub ↗

7 Comments

heathdutton · 9 months ago

Found the bug in cli.js - when isSSHConfigured() returns false, the code tries HTTPS first but falls back TO SSH on any failure, showing the confusing Permission denied (publickey) error.

The marketplace refresh function also has this issue (SSH-only, no HTTPS fallback).

Proposed Fix

case 'github': {
  const httpsUrl = `https://github.com/${source.repo}.git`;
  try {
    await clone(httpsUrl, destPath, source.ref);
  } catch (httpsError) {
    if (await isSSHConfigured()) {
      try {
        await clone(`git@github.com:${source.repo}.git`, destPath, source.ref);
        return;
      } catch { /* SSH failed too */ }
    }
    throw httpsError;  // Show HTTPS error, not SSH
  }
  break;
}

Changes: HTTPS first always, SSH fallback only if configured, preserve relevant error message.

spiveym · 7 months ago

Update: Root cause identified and filed as #27251.

--recurse-submodules (added in v2.1.7) gets SIGKILL'd by corporate endpoint security tools (CrowdStrike, Uptycs, etc.) that pattern-match on git's argv.

The process dies in ~7ms with empty stderr, which is why the error message is blank. Replacing --recurse-submodules with -c "submodule.recurse=true" avoids the kill while achieving the same behavior.

See #27251 for full reproduction steps, binary analysis, and suggested fixes.

ChrisTowles · 7 months ago

I had this same issue 2-3 weeks ago. This morning retesting with v2.1.72 i found no issues cloning plugins with only https:// and no ssh keys configured and private repos.

replete · 6 months ago

Having this problem, unable to install plugins without changing my global git config.

github-actions[bot] · 4 months ago

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

ironbelly · 4 months ago

I know this is closed but leaving this here for future people

git config --global --show-origin --get-regexp '^url\.' || true
git config --global url."https://github.com/".insteadOf "git@github.com:"

Verify Git now rewrites the exact failing clone target to HTTPS.
GIT_TRACE=1 git ls-remote git@github.com:danielrosehill/Claude-Sysadmin-Homelab-Plugin.git HEAD

github-actions[bot] · 2 months ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.