[BUG] Regression since 2.1.174: plugin installation from HTTP marketplace fails with "fatal: transport 'http' not allowed"

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?

Starting with Claude Code 2.1.174, installing plugins from an HTTP-backed plugin marketplace appears to be broken.

The exact same marketplace, plugin, machine, and Git installation work correctly with Claude Code 2.1.173.

Versions tested

| Claude Code | Result |
|-------------|--------|
| 2.1.173 | ✅ Works |
| 2.1.174 | ❌ Fails |
| 2.1.280 | ❌ Fails |

Environment

• macOS
• Git 2.50.1 (Apple Git-155)

Steps to reproduce

1. Add a plugin marketplace served over HTTP.

claude plugin marketplace add http://localhost:<port>/marketplace.json

1. Install any plugin from that marketplace.

claude plugin install <plugin>@<marketplace>

Expected behavior

The plugin installs successfully.

Actual behavior

The installation fails during checkout with:

Failed to install plugin "...": git checkout after sparse-checkout failed:

fatal: transport 'http' not allowed

fatal: could not fetch <commit-sha> from promisor remote

Investigation

The failure occurs during git checkout HEAD, which internally invokes a partial fetch:

git fetch origin --filter=blob:none --stdin

The fetch immediately fails with:

fatal: transport 'http' not allowed

No HTTP request appears to be attempted before Git aborts.

Setting:

GIT_ALLOW_PROTOCOL=http:https:ssh

does not change the behavior.

Additional observations

• The marketplace itself is added successfully.
• The failure only occurs while installing a plugin.
• Installing plugins from a Git SSH marketplace continues to work correctly on the same machine.
• The behavior changes between Claude Code 2.1.173 (working) and 2.1.174 (failing), suggesting a regression introduced in or after 2.1.174.

I'm happy to provide additional traces or test a fix if needed.

What Should Happen?

When installing a plugin from a plugin marketplace, Claude Code should successfully clone the plugin repository, complete the sparse checkout, and install the plugin without requiring any additional Git configuration.

The behavior should be consistent with Claude Code 2.1.173, where the same marketplace, environment, and plugin install successfully.

Error Messages/Logs

Installing plugin "<plugin>@<marketplace>"...

Failed to install plugin "<plugin>@<marketplace>": git checkout after sparse-checkout failed:

fatal: transport 'http' not allowed

fatal: could not fetch 79aca3c205cf3a57d057c4b0105d1ec3dbb383ff from promisor remote

Steps to Reproduce

1. Start a local HTTP plugin marketplace.

1. Add the marketplace:

claude plugin marketplace add http://localhost:<port>/marketplace.json

1. Install a plugin from that marketplace:

claude plugin install <plugin>@<marketplace>

1. Observe that the installation fails during the checkout phase with:

fatal: transport 'http' not allowed

1. Repeat the exact same steps with Claude Code 2.1.173. The installation succeeds.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.173

Claude Code Version

2.1.280

Platform

Google Vertex AI

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

I investigated the issue using Git tracing.

The failure occurs during the checkout phase, when Claude Code internally executes a partial fetch similar to:

git checkout HEAD
git fetch origin --filter=blob:none --stdin

Git immediately aborts with:

fatal: transport 'http' not allowed

before attempting any HTTP request.

Additional observations:

• The marketplace itself is added successfully.
• The failure only occurs while installing plugins.
• Installing plugins from an SSH Git marketplace still works correctly on the same machine.
• Setting GIT_ALLOW_PROTOCOL=http:https:ssh does not change the behavior.
• The behavior changes between Claude Code 2.1.173 (working) and 2.1.174 (failing).

If helpful, I can provide the complete GIT_TRACE2_EVENT logs or test a debug build.