Marketplace plugin cloning should default to HTTPS instead of SSH

[pmatos]

Problem

When installing a marketplace plugin via /plugin marketplace add owner/repo, Claude Code clones the repository using SSH (git@github.com:...). This fails for users who don't have SSH keys configured for GitHub:

Error: Failed to clone marketplace repository: SSH authentication failed. Please ensure your
SSH keys are configured for GitHub, or use an HTTPS URL instead.

Original error: Cloning into '/Users/user/.claude/plugins/marketplaces/owner-repo'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Why this is a problem

• Marketplace repositories are public and read-only — SSH authentication is unnecessary.
• HTTPS works out of the box with no configuration for public repos.
• Many users don't have SSH keys set up for GitHub, especially on fresh machines or if they primarily use HTTPS for their own repos.
• Most tools that clone public repos default to HTTPS for this reason (e.g., go get, cargo install, npm install from git URLs).

Current workaround

Users must either:

1. Set up SSH keys for GitHub, or
2. Configure Git globally to rewrite SSH to HTTPS: git config --global url."https://github.com/".insteadOf git@github.com:

Both are unnecessary friction for a read-only clone of a public repo.

Suggested fix

Default to HTTPS (https://github.com/owner/repo.git) when cloning marketplace repositories. SSH could optionally be supported via a flag or configuration for users behind corporate proxies that block HTTPS but allow SSH.

[DanielLaberge]

This is EXTREMELY annoying because it Prompts the 1Password CLI to use my GitHub key EVERY time I sent a first message in a new Claude Session, even though my repos are set to use HTTPS auth.

Codex doesn't have that issue.

[DanHam]

I have a similar (and equally annoying!) issue to Daniel Laberge.

Every time a marketplace update runs my pinentry program pops up as the ssh-based update command tries to access my (protected) ssh keys. The marketplace update runs every time I quit Claude Code. I am aware that I can remove the marketplace or disable auto-updates. However, that does not seem like a very satisfactory solution.

An additional annoyance is that (as other have reported) if you are using a terminal based pinentry program e.g. pinentry-curses you cannot see the prompt because "Claude Code's Ink renderer holds exclusive control of the terminal". Note that I also use tmux, so any command/process that causes my pinentry program to start also needs to tell the gpg agent what tty to start the pinentry program in. The conflict over control of the terminal between Claude and pinentry can lead to corruption of the terminal / weird behaviour after I quit.

The suggested workarounds will not work for me:

• I already have ssh keys set up for github but run in to the issue that I cannot see the pinentry prompt to unlock keys.
• I use ssh authentication for github so cannot rewrite ssh -> https

As the original reporter said, this all seems a bit unnecessary if the marketplace update can be handled over https.

[sw1nn]

it seems that even setting up a ssh -> https rewrite for git is not enough, because claude does a connectivity check with

ssh -T git@github.com

on session start and that will prompt for ssh key passphrase via whatever configured agent / pinentry setup you have

You can work around that by adding this to ~/.ssh/config

# ~/.ssh/config
Host github.com
  IdentityAgent none

which fails silently, but that is problematic if you need ssh auth with agent elsewhere