[BUG] Marketplace install fails silently (SIGKILL) on enterprise machines due to upstream clone issue (#27251)

[spiveym]

Update: Root cause identified and filed upstream as anthropics/claude-code#27251.

Since v2.1.7, Claude Code passes --recurse-submodules to git clone for marketplace installs. Because this flag is widely categorized as an unsafe invocation pattern by security vendors, corporate endpoint security tools (CrowdStrike Falcon, Uptycs Protect, etc.) enforce hard blocks by killing any git process whose argv contains --recurse-submodules.

This results in an instant SIGKILL (exit 137) with empty stderr — which is why the error message is always blank:

✘ Failed to add marketplace: Failed to clone marketplace repository:

Confirmed on macOS with CrowdStrike + Uptycs. The kill is argv pattern-based, not behavioral, and even local clones of repos with no submodules get killed. This affects all marketplace installs including this Anthropic marketplace on startup (Failed to install Anthropic marketplace · Will retry on next startup).

Replacing --recurse-submodules with -c "submodule.recurse=true" avoids the kill while achieving the same behavior.

See anthropics/claude-code#27251 for full binary analysis, version-by-version confirmation, reproduction steps, and suggested fixes.

Workaround: Manual clone + registry entry:

git clone [https://github.com/anthropics/knowledge-work-plugins.git](https://github.com/anthropics/knowledge-work-plugins.git) \
~/.claude/plugins/marketplaces/knowledge-work-plugins