basecamp init plugin install fails when GitHub SSH not configured (skill OK, plugin step bombs)

[tadelv]

Summary

The first-run setup wizard detects Claude Code and installs both an agent skill and a Claude Code plugin. The skill install succeeds, but the plugin install fails on machines without a working GitHub SSH key, because claude plugin install clones via git@github.com: and there is no fallback to HTTPS. basecamp-cli's own marketplace clone already handles this case ("SSH not configured, cloning via HTTPS"), but the workaround does not propagate to the plugin install step it shells out to.

Environment

• basecamp-cli v0.7.2
• Claude Code (latest)
• macOS 15 (Darwin 25.4.0)
• ~/.ssh/ contains keys for other hosts but no GitHub key registered
• HTTPS to github.com works fine; gh auth valid

Reproduction

1. Fresh machine, no GitHub SSH key (or key not added to GitHub).
2. Install basecamp-cli, run first-time setup.
3. Authenticate, pick account/project, accept "Coding Agent Setup".
4. Observe: marketplace add succeeds via HTTPS fallback; plugin install fails; setup still prints "Setup complete!".

Actual output

✓ Agent skill installed
Adding marketplace...
SSH not configured, cloning via HTTPS: https://github.com/basecamp/claude-plugins.git
...
✔ Successfully added marketplace: 37signals (declared in user settings)
✓ Marketplace registered
Installing plugin "basecamp@37signals"...
✘ Failed to install plugin "basecamp@37signals": Failed to clone repository: Cloning into '/Users/vid/.claude/plugins/cache/temp_github_1776021105042_tyffci'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
...
✗ Claude Code Plugin
✓ Claude Code Skill

Expected

Either:

• The plugin install also falls back to HTTPS when SSH is unavailable, or
• Setup detects missing GitHub SSH up front and uses an HTTPS-compatible install path from the start, or
• Setup prints a clear preflight error explaining the SSH requirement before doing partial work, with a one-line fix and non-zero exit.

Root cause

The 37signals marketplace metadata declares the plugin source neutrally:

"source": { "source": "github", "repo": "basecamp/basecamp-cli" }

Claude Code's claude plugin install resolves source: github to git@github.com:<repo>.git (SSH) and does not fall back to HTTPS on auth failure. The SSH requirement is undocumented: the official Claude Code plugin and plugin-marketplace docs describe the github source type as only needing repo: "owner/repo", with no mention of git transport, SSH keys, or prerequisites. The related git source type, by contrast, explicitly accepts both HTTPS and SSH URLs. Users installing a source: github plugin have no way to know SSH is required.

So the failure happens inside claude plugin install, but basecamp-cli is the layer that invokes it and owns the end-to-end setup UX, and it already has a working HTTPS fallback for its own marketplace clone.

Workaround

git config --global url."https://github.com/basecamp/".insteadOf git@github.com:basecamp/
claude plugin install basecamp@37signals

Scoped to the basecamp/ org; covers basecamp-cli, hey-cli, fizzy-cli, and house-skills. No SSH key needed.

Suggested fixes

1. Before invoking claude plugin install, run a quick SSH preflight (e.g. ssh -T git@github.com or git ls-remote git@github.com:...); if it fails, set the insteadOf rewrite for the install duration (or in user git config) and note it in the output, matching what the marketplace clone already does.
2. File an upstream request against Claude Code to document the SSH requirement for source: github plugins, or make the installer fall back to HTTPS on SSH auth failure.
3. Surface the SSH requirement in setup output up front, and exit non-zero on the plugin step instead of half-completing setup. The wizard currently prints "Setup complete!" with a single ✗, which is easy to miss.

Notes

• The skill at ~/.agents/skills/basecamp/SKILL.md and the basecamp CLI itself work fine without the plugin, so the impact is "MCP tools missing in Claude Code" rather than "CLI broken". The wizard advertises the plugin install, though, so a partial failure deserves a louder signal.