[FEATURE] Allow pinning Git refs in plugin marketplaces (ref for branch/tag/commit)

[setouchi-h]

Preflight Checklist

• I have searched existing requests and this feature hasn't been requested yet
• This is a single feature request (not multiple features)

Problem Statement

We can add a plugin marketplace by repository or raw URL, but can’t pin a specific Git ref (branch, tag, or commit). As a result, installs aren’t reproducible—different machines runs may pull different revisions. This makes staged rollouts (staging vs. production) hard to control and audits/rollbacks risky. Today, /plugin marketplace add owner/repo always uses the repo’s default branch, and .claude/settings.json offers no way to lock versions. We may unknowingly install newer or older builds, creating drift and sometimes breaking work.

Proposed Solution

Add optional ref support to plugin marketplace sources (and settings), allowing branch / tag / commit SHA pinning:

{
  "plugins": [
    {
      "name": "statusline",
      "version": "1.2.3",
      "source": {
        "source": "github",
        "repo": "your-org/statusline-plugin",
        "ref": "v1.2.3"   // tag, branch, or full SHA
      },
    }
  ]
}

Alternative Solutions

No response

Priority

Medium - Would be very helpful

Feature Category

CLI commands and flags

Use Case Example

1. The github repo owner/repo uses develop as the default branch.
2. For production, I want installs to come from the stable main branch; for staging, I'm fine with develop.
3. Today, a marketplace installation /plugin marketplace add owner/repo implicitly resolves to the default branch (develop), so production machines may pull bleeding-edge changes.
4. With the proposed ref field: Claude Code resolves main/develop to commit SHAs, and install it.

Additional Context

No response

[bobular]

Furthermore I can't find a way to develop and test a skills marketplace in a branch on github. I have to merge to main before I can test.

[github-actions]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

[MartinP7r]

Looks similar to

• [FEATURE] Support ref and path parameters in plugin source schema #15439

[setouchi-h]

Thanks for the claude code update!

Claude Code v2.1.14 added support for pinning plugins to a specific Git commit SHA, which partially addresses this issue.

This already helps a lot with reproducibility and safe rollbacks.
For completeness, it would be great to eventually support branch/tag refs as well (resolved to SHAs at install time), but this is a solid step forward.

Thanks again for implementing this!

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.