Plugin and marketplace git clones fall back between HTTPS and SSH

What

A plugin is an add-on for Claude Code, and a marketplace is a catalogue of plugins that Claude Code downloads with git. Downloads from GitHub can use SSH, which needs keys set up, or HTTPS, which does not. Claude Code now tries one of these and falls back to the other.

• GitHub plugin installs build both an SSH and an HTTPS address. If SSH to GitHub is not set up, the clone uses HTTPS and tells you so (SSH not configured, cloning via HTTPS:). If the HTTPS clone fails, the folder is cleared and the clone is retried over SSH. If both fail, the error says The retry over SSH failed too.
• The check for SSH now answers configured, not configured, or unknown.
• Plugin install takes a new gitHubHttpsFallback option. It collects these fallback notices and adds them to the success or error output of plugin install.
• Marketplace clone and refresh choose a transport from your SSH setup, try it, and then try the other one. If both fail, one combined error holds both failures, and the log line now includes the failure detail.
• A bulk marketplace refresh now lists failed directory-based marketplaces separately as builtInSkipped instead of mixing them into the general failures.
• The git fallback for the official marketplace is controlled by tengu_plugin_official_mkt_git_fallback, which defaults to on. If that gate is off and the main download (GCS) fails, the refresh is skipped. The flag server returned on for this site's account and for the anonymous baseline, but no reading has been taken under this release yet.
• Plugins taken from a subfolder of a git repository (git-subdir sources) are now checked out with read-tree -u --reset instead of checkout. The error text is now git read-tree after sparse-checkout failed, and the commit (sha) is checked as well as the ref.

Why

Installing a GitHub plugin no longer requires working SSH keys, and a setup that works only over SSH still has a fallback. When a clone fails both ways, the error shows what went wrong with each attempt instead of only the last one.