[BUG] Plugin auto-update hangs entire session when HTTPS git credentials are missing

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a plugin has autoUpdate: true and references a private GitHub repo via HTTPS, Claude Code spawns a background git clone/fetch without setting GIT_TERMINAL_PROMPT=0. If HTTPS credentials are unavailable (e.g., revoked PAT, SSH-only auth configured via gh auth), git blocks indefinitely waiting for interactive credential input on a TTY that doesn't exist.

This hangs the entire Claude Code session — the user can send one message, get one response, and then the session is completely frozen with no error message or recovery path. Killing and restarting reproduces it immediately.

A temp_git_* directory is created in the plugin cache at session start with zero commits — the clone begins but never completes. The git process is visible in ps aux, stuck waiting for credential input.

What Should Happen?

• Git subprocesses for plugin operations should set GIT_TERMINAL_PROMPT=0 so they fail fast instead of blocking on interactive prompts
• Plugin auto-update operations should have a reasonable timeout (e.g., 30 seconds)
• A failed plugin update should log a warning and allow the session to continue — it should never freeze the entire session

Error Messages/Logs

# No error is shown to the user — the session silently freezes.
# The underlying git failure (reproducible manually) is:
$ GIT_TERMINAL_PROMPT=0 git ls-remote https://github.com/<org>/<private-repo>.git
fatal: could not read Username for 'https://github.com': terminal prompts disabled

Steps to Reproduce

1. Install a plugin with autoUpdate: true pointing to a private GitHub repo via HTTPS
2. Ensure no valid HTTPS credentials exist for github.com (e.g., revoke a PAT, or have only SSH auth configured)
3. Start a Claude Code session in a directory where that plugin is active
4. Send a message — session freezes after the first response
5. Observe a temp_git_* directory in the plugin cache with zero commits (clone started, never finished)

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.94

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

Workaround: Running gh auth setup-git resolves the HTTPS credential gap by configuring git to use gh's OAuth token for HTTPS operations. Removing stuck temp_git_* directories from the plugin cache clears the jammed state.

Suggested fix: Set GIT_TERMINAL_PROMPT=0 (and ideally a timeout) on all git subprocesses spawned for plugin auto-update operations. Handle the failure gracefully instead of allowing it to block the session.