[BUG] Plugin caching git clone hangs indefinitely for private repos (no timeout, no GIT_TERMINAL_PROMPT=0)

Environment

• Claude Code Version: 2.1.27
• Platform: macOS (Darwin 24.3.0)
• Terminal: Claude Code CLI

Summary

When a plugin marketplace references a private GitHub repository via HTTPS URL, the plugin caching step (git clone) hangs indefinitely on session startup. This happens because:

1. The clone subprocess has no timeout
2. GIT_TERMINAL_PROMPT is not set to 0, so git may wait for interactive authentication that can never be provided (no TTY in the subprocess)

The hang is intermittent — it depends on whether git credentials are cached in the macOS Keychain. After a reboot, sleep, or token expiry, the clone blocks waiting for auth input.

Reproduction Steps

1. Create a plugin marketplace that references a private GitHub repo via HTTPS:

``json
"source": {
"source": "url",
"url": "https://github.com/some-org/private-repo.git"
}
``

1. Ensure git credential cache is cold (e.g., after reboot)
2. Start a new Claude Code session
3. Session hangs at plugin caching — spinner stops, never becomes interactive

Evidence from Debug Logs

The smallest debug files in ~/.claude/debug/ correspond to hung sessions. Every one has the same last log entry:

Caching plugin from source: {"source":"url","url":"https://github.com/<org>/<repo>.git"}
to temporary path /Users/<user>/.claude/plugins/cache/temp_git_...

Sessions never progress past this step.

Timeline showing repeated hang-and-retry pattern

| Time | Session ID | Lines | Last log entry |
|------------|-------------|-------|-----------------------------------------|
| 08:27:36 | 96ff47cd | 4 | Init complete, then nothing |
| 08:27:39 | e29b0d2d | 5 | Stuck at "Caching plugin from source" |
| 08:27:45 | 0a982ab0 | 9 | Stuck at "Caching plugin from source" |

Suggested Fix

In the plugin caching code that runs git clone:

1. Set GIT_TERMINAL_PROMPT=0 in the subprocess environment — prevents git from blocking on interactive auth when there's no TTY
2. Add a timeout (e.g., 30 seconds) on the clone operation — if the clone doesn't complete in time, fail gracefully with an error message rather than hanging forever
3. Optionally: detect authentication failures and surface a clear error like "Plugin repo requires authentication. Clone it manually or use SSH."

Related Issues

• #9297 — Same root cause (plugin clone hang), different trigger (SSH vs HTTPS). Closed and locked.
• #22041 — Session hang on startup (different cause: large .jsonl files)

Workaround

Make the plugin repo public, or manually edit the cached marketplace.json to use "source": "path" pointing to a local clone.