Plugin install fails for third parties: evals submodule points to a private SSH repo #1778

New issue

Closed

opened 2026-06-17 03:36:22 +00:00 by juanra · 0 comments

juanra commented

2026-06-17 03:36:22 +00:00

(Migrated from github.com)

Summary

Installing the superpowers plugin via the Claude Code marketplace (claude plugin install superpowers@claude-plugins-official) fails for anyone who isn't a member of prime-radiant-inc. The repo pins an evals submodule whose URL is a private, SSH-only repository, so submodule initialization during checkout aborts the install.

Error

✘ Failed to update plugin "superpowers@claude-plugins-official":
Failed to checkout commit 284be5905ed540d34ce5bcde24728b9b7f413ea0:
fatal: not a git repository: ../.git/modules/evals
fatal: could not reset submodule index
ERROR Updating plugin superpowers@claude-plugins-official failed

Root cause

.gitmodules (present in both the pinned SHA 284be59 and current main) declares:

[submodule "evals"]
	path = evals
	url = git@github.com:prime-radiant-inc/superpowers-evals.git

Two problems for external installers:

SSH URL (git@github.com:…) — requires an SSH key; fails in the non-interactive context Claude Code's plugin installer runs in.
Private repo — prime-radiant-inc/superpowers-evals is not publicly accessible, so even with SSH configured, third parties get a permission error.

The Claude Code marketplace installs superpowers via source: url against https://github.com/obra/superpowers.git at SHA 284be59, then recurses submodules → hits the private evals → install aborts. Every fresh install / claude plugin update of this plugin fails for non-maintainers.

Impact

Plugin is effectively uninstallable from the official marketplace for the public. Auto-update via tools like topgrade reports a persistent FAILED for the Claude Code step.

Suggested fixes (any one resolves it)

Make evals a public repo and switch the submodule URL to HTTPS (https://github.com/…), or
Remove evals from the published/release artifact (it's test infrastructure, not needed by consumers of the plugin), or
Move evals out of the packaged plugin entirely (separate dev-only repo), so the marketplace checkout never references it.

Environment

Claude Code 2.1.179
git 2.50.1 (Apple Git-155)
macOS 26.5.1
Marketplace: claude-plugins-official, pinned SHA 284be5905ed540d34ce5bcde24728b9b7f413ea0

Workaround (for other affected users)

Clone without submodules, strip the evals reference, register as a local marketplace:

git clone --no-recurse-submodules https://github.com/obra/superpowers.git ~/.claude/plugins/local/superpowers
cd ~/.claude/plugins/local/superpowers
rm -f .gitmodules && rm -rf evals
claude plugin marketplace add ~/.claude/plugins/local/superpowers
claude plugin install superpowers@superpowers-dev --scope user

(Note: this pins to a manual clone and disables auto-update for the plugin.)

## Summary Installing the `superpowers` plugin via the Claude Code marketplace (`claude plugin install superpowers@claude-plugins-official`) fails for anyone who isn't a member of `prime-radiant-inc`. The repo pins an `evals` submodule whose URL is a **private, SSH-only** repository, so submodule initialization during checkout aborts the install. ## Error ``` ✘ Failed to update plugin "superpowers@claude-plugins-official": Failed to checkout commit 284be5905ed540d34ce5bcde24728b9b7f413ea0: fatal: not a git repository: ../.git/modules/evals fatal: could not reset submodule index ERROR Updating plugin superpowers@claude-plugins-official failed ``` ## Root cause `.gitmodules` (present in both the pinned SHA `284be59` and current `main`) declares: ```ini [submodule "evals"] path = evals url = git@github.com:prime-radiant-inc/superpowers-evals.git ``` Two problems for external installers: 1. **SSH URL** (`git@github.com:…`) — requires an SSH key; fails in the non-interactive context Claude Code's plugin installer runs in. 2. **Private repo** — `prime-radiant-inc/superpowers-evals` is not publicly accessible, so even with SSH configured, third parties get a permission error. The Claude Code marketplace installs `superpowers` via `source: url` against `https://github.com/obra/superpowers.git` at SHA `284be59`, then recurses submodules → hits the private `evals` → install aborts. Every fresh install / `claude plugin update` of this plugin fails for non-maintainers. ## Impact Plugin is effectively uninstallable from the official marketplace for the public. Auto-update via tools like `topgrade` reports a persistent `FAILED` for the Claude Code step. ## Suggested fixes (any one resolves it) 1. Make `evals` a **public** repo and switch the submodule URL to **HTTPS** (`https://github.com/…`), or 2. Remove `evals` from the published/release artifact (it's test infrastructure, not needed by consumers of the plugin), or 3. Move `evals` out of the packaged plugin entirely (separate dev-only repo), so the marketplace checkout never references it. ## Environment - Claude Code `2.1.179` - git `2.50.1` (Apple Git-155) - macOS `26.5.1` - Marketplace: `claude-plugins-official`, pinned SHA `284be5905ed540d34ce5bcde24728b9b7f413ea0` ## Workaround (for other affected users) Clone without submodules, strip the `evals` reference, register as a local marketplace: ```bash git clone --no-recurse-submodules https://github.com/obra/superpowers.git ~/.claude/plugins/local/superpowers cd ~/.claude/plugins/local/superpowers rm -f .gitmodules && rm -rf evals claude plugin marketplace add ~/.claude/plugins/local/superpowers claude plugin install superpowers@superpowers-dev --scope user ``` (Note: this pins to a manual clone and disables auto-update for the plugin.)

👍 1