[BUG] Claude desktop app clones private plugin repos via a bundled SSH git, ignoring managed `env.GITHUB_TOKEN`

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

On the Claude desktop app, installing plugins from a managed marketplace whose sources are
private GitHub repositories fails for any user who does not have a personal GitHub SSH key
configured. Tracing shows the app clones plugin repositories with a bundled JavaScript SSH/git
library (inside app.asar), over SSH (git@github.com:) — not the system git binary. As a
result it ignores the system git configuration, credential helpers, the macOS login Keychain, and
the GITHUB_TOKEN supplied via server-managed settings. The documented managed-settings path
for distributing private plugins is therefore unusable for non-technical desktop users, who have no
SSH key. Users who happen to have an SSH key succeed, which makes the failure look intermittent.

Environment

• Client: Claude desktop app, macOS (app version 1.19367.0; embedded Claude Code 2.1.x).
• Plan: Claude for Teams.
• Delivery: server-managed settings via the claude.ai admin console

(Admin Settings > Claude Code > Managed settings).

• Marketplace and plugins are private repositories in a private GitHub org

(BenaroyaResearch/*).

Managed settings payload (redacted)

{
  "extraKnownMarketplaces": {
    "bri": { "source": { "source": "github", "repo": "BenaroyaResearch/bri-plugins" }, "autoUpdate": true }
  },
  "enabledPlugins": {
    "bri-onthisday@bri": true, "bri-samplerep@bri": true
  },
  "env": { "GITHUB_TOKEN": "<read-only fine-grained PAT>" }
}

Observed behavior

The /plugin Errors tab reports git@github.com: Permission denied (publickey) /
Could not read from remote repository for each plugin. Launching the app binary with git tracing
(GIT_TRACE=/tmp/trace.log /Applications/Claude.app/Contents/MacOS/Claude) and reproducing the
install shows the failure originates inside the app's own bundled code, not system git:

Failed to install plugin "<plugin>@<mkt>": Failed to clone repository:
Cloning into '<home>/.claude/plugins/cache/temp_github_...'...
No ED255
    at /Applications/Claude.app/Contents/Resources/app.asar/.vite/build/index.chunk-*.js:...
  code: 'SSH_HOST_KEY'

Key points:

• The stack trace and code: 'SSH_HOST_KEY' indicate a bundled JavaScript SSH library

(ssh2-style), not the system git/ssh binaries. GIT_TRACE (which only instruments system
git) captures nothing from the clone — consistent with the app not shelling out to system git.

• The clone target is an SSH URL (git@github.com:). Because GITHUB_TOKEN is an HTTPS

credential, it cannot apply.

• The app only attempts SSH — it never falls through to an HTTPS attempt with the token.
• The specific failure is SSH host-key verification (SSH_HOST_KEY / missing ED25519 host

key), reached after deleting ~/.ssh; with a ~/.ssh present but no authorized key, the failure
is instead Permission denied (publickey). Both confirm the app reads ~/.ssh for SSH auth.

What we ruled out (with evidence)

• Policy delivery: ~/.claude/remote-settings.json present and correct; signed into the managed

org; marketplace registers (/plugin marketplace list shows it).

• Token validity / scope / SSO: the read-only PAT returns HTTP 200 for all repos via

curl https://api.github.com/repos/... (no x-github-sso header), and an explicit
git clone https://x-access-token:<TOKEN>@github.com/... succeeds from the same machine.

• System git credentials are irrelevant to the app: a bare git clone https://github.com/...

succeeds in the shell via the osxkeychain credential helper, yet the app still fails —
proving the app does not use the user's system git, ~/.gitconfig, credential helper, or Keychain.

• Storing the deploy token in the Keychain (git credential-osxkeychain store, 93-char PAT

verified) has no effect on the app.

• No local URL rewrite: git config --global/--system --get-regexp insteadof is empty; the SSH

URL is emitted by the app itself.

Expected behavior

For a private github plugin source with a GITHUB_TOKEN present in managed settings, the desktop
app should clone over HTTPS using the token, consistent with the documented private-repository
support for plugin marketplaces. It should not require each user to have a personal SSH key.

Impact

Distributing private plugins to non-technical desktop users via the supported managed-settings path
does not work. The only users who succeed are those who independently have a GitHub SSH key — which
is exactly the population an enterprise rollout is trying to avoid depending on.

Current workaround (for reference)

Because the app authenticates via ~/.ssh, we are deploying a read-only service-account SSH key
plus a known_hosts file to each machine via MDM. This works but is a workaround for the token
mechanism not functioning.

Questions for Anthropic

1. Is the desktop app intended to clone private github plugin sources with a bundled SSH library

rather than the system git + GITHUB_TOKEN path the docs describe?

1. Should managed env.GITHUB_TOKEN authenticate desktop plugin clones over HTTPS? If so, this is a

bug; if not, the private-plugin documentation is misleading for desktop.

1. Is there a supported way to make the desktop app clone plugin sources over HTTPS with the token?
2. Separately: on desktop, should managed enabledPlugins auto-install without a manual click?

(Behavior differs from the CLI and is undocumented.)

Related issues

• #13553 — "Failed to clone marketplace

repository for both HTTPs and SSH" (open, area:auth, stale; regression 2.0.62 → 2.0.64). Same
auth/SSH clone-failure cluster; this report adds the bundled-SSH-git root cause and the specific
finding that managed GITHUB_TOKEN is never applied.

Reproduction

1. Create a private GitHub marketplace repo with a private github plugin source.
2. Deploy server-managed settings with extraKnownMarketplaces, enabledPlugins, and

env.GITHUB_TOKEN (read-only PAT with access to both repos).

1. On a macOS machine with no GitHub SSH key, signed into the managed org, open the desktop app

Code tab and attempt the install.

1. Observe the SSH Permission denied (publickey) / SSH_HOST_KEY failure despite the valid HTTPS

token, and confirm via GIT_TRACE that system git is not invoked.

### What Should Happen?

For a private github plugin source with a GITHUB_TOKEN present in managed settings, the desktop
app should clone over HTTPS using the token, consistent with the documented private-repository
support for plugin marketplaces. It should not require each user to have a personal SSH key.

### Error Messages/Logs

```shell
Failed to install plugin "<plugin>@<mkt>": Failed to clone repository:
Cloning into '<home>/.claude/plugins/cache/temp_github_...'...
No ED255
    at /Applications/Claude.app/Contents/Resources/app.asar/.vite/build/index.chunk-*.js:...
  code: 'SSH_HOST_KEY'

Steps to Reproduce

Set up managed settings payload per documentation, including a Github key with access to private repos hosting a plugin. Attempt to install any plugin from the marketplace via the Claude Code desktop app on a machine that does not already have a a personal GitHub SSH key.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.218

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_