litellm - ✅(Solved) Fix [Feature]: Add support for git-subdir source type in claude-code/plugins marketplace API [1 pull requests, 1 comments, 1 participants]

manamana88 · 2026-03-20T17:52:54Z

[litellm] Claude Code's official plugin marketplace spec supports a git-subdir source type for plugins hosted in a subdirectory of a monorepo . LiteLLM's POST… Claude Code's official plugin marketplace spec supports a `git-subdir` source type for plugins hosted in a **subdirectory of a monorepo**. LiteLLM's `POST /claude-code/plugins` endpoint currently only accepts `github` and `url` source types — `git-subdir` is silently rejected with HTTP 400. # PR #24223: feat: add git-subdir source type to claude-code/plugins API - Repository: BerriAI/litellm - Author: manamana88 - State: closed | merged: True - Link: https://github.com/BerriAI/litellm/pull/24223 ## Description (problem / solution / changelog) ## Relevant issues Fixes #24228 ## Pre-Submission checklist - [x] I have Added testing in the [`tests/test_litellm/`](https://github.com/BerriAI/litellm/tree/main/tests/test_litellm) directory - [x] My PR passes all unit tests on `make test-unit` - [x] My PR's scope is as isolated as possible, it only solves 1 specific problem ## Type ✨ New Feature ## Changes Add support for the git-subdir plugin source type in the POST /claude-code/plugins API, as documented in the [official Claude Code plugin marketplaces spec](https://code.claude.com/docs/en/plugin-marketplaces#git-subdirectories). **New source format:** ```json { "source": "git-subdir", "url": "https://github.com/org/monorepo.git", "path": "plugins/plugin-name" } ``` **Path validation** uses a simple allowlist regex that only permits alphanumeric characters, dots, hyphens, and underscores — one or more `/`-separated segments. This blocks path traversal (`..`), absolute paths (`/`), backslashes, percent-encoded sequences, and any other unsafe characters without needing URL decoding. **Changes:** - `litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py`: add `git-subdir` branch with allowlist regex validation - `litellm/types/proxy/claude_code_endpoints.py`: document all three source types in `RegisterPluginRequest.source` - `tests/test_litellm/proxy/anthropic_endpoints/test_claude_code_marketplace.py`: 8 unit tests (success, update, missing url, empty url, missing path, empty path, path traversal × 7 variants, unknown source type) - `ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.tsx`: add "Git Subdir" option with URL + path fields - `ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.test.tsx`: 4 UI tests ## Changed files - `litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py` (modified, +34/-1) - `litellm/types/proxy/claude_code_endpoints.py` (modified, +2/-1) - `tests/pass_through_unit_tests/test_claude_code_marketplace.py` (modified, +46/-0) - `tests/test_litellm/proxy/anthropic_endpoints/test_claude_code_marketplace.py` (added, +222/-0) - `ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.test.tsx` (added, +131/-0) - `ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.tsx` (modified, +41/-6) ## Fixed - Fixed by PR: feat: add git-subdir source type to claude-code/plugins API (https://github.com/BerriAI/litellm/pull/24223) ## Summary Claude Code's official plugin marketplace spec supports a `git-subdir` source type for plugins hosted in a **subdirectory of a monorepo**. LiteLLM's `POST /claude-code/plugins` endpoint currently only accepts `github` and `url` source types — `git-subdir` is silently rejected with HTTP 400. ## Official Feature Reference This is a first-class source type documented in the Claude Code plugin marketplaces spec: > **[Git Subdirectories — Claude Code Plugin Marketplaces](https://code.claude.com/docs/en/plugin-marketplaces#git-subdirectories)** Monorepos are a common pattern for hosting multiple Claude Code plugins in a single repository. Without `git-subdir` support, operators cannot register such plugins through LiteLLM's marketplace. ## Expected Behaviour `POST /claude-code/plugins` should accept the following source format and store it correctly so that `GET /claude-code/marketplace.json` returns it verbatim for Claude Code to clone from: ```json { "name": "my-plugin", "source": { "source": "git-subdir", "url": "https://github.com/org/monorepo.git", "path": "plugins/my-plugin" } } ``` ## Current Behaviour Sending the above payload returns: ```json { "error": "source.source must be 'github' or 'url'" } ``` ## Acceptance Criteria - [ ] `POST /claude-code/plugins` accepts `source.source == "git-subdir"` with required `url` and `path` fields - [ ] `path` is validated to prevent path traversal (allowlist: alphanumeric, dots, hyphens, underscores, `/` separator) - [ ] `GET /claude-code/marketplace.json` returns the `git-subdir` source unchanged so Claude Code can use it - [ ] UI form (`/claude-code` dashboard) exposes the new source type with URL and subdirectory path fields - [ ] Unit tests cover success, missing/empty fields, and path traversal variants

litellm2026-03-20 17:52:54

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

BerriAI/litellm#24228•Fetched 2026-04-08 01:09:12

View on GitHub

Comments

Participants

Timeline

Reactions

Author

manamana88

Participants

manamana88

Timeline (top)

cross-referenced ×2renamed ×2commented ×1labeled ×1

Claude Code's official plugin marketplace spec supports a git-subdir source type for plugins hosted in a subdirectory of a monorepo. LiteLLM's POST /claude-code/plugins endpoint currently only accepts github and url source types — git-subdir is silently rejected with HTTP 400.

Error Message

"error": "source.source must be 'github' or 'url'"

Root Cause

Fix Action

Fixed

Fixed by PR: feat: add git-subdir source type to claude-code/plugins API (https://github.com/BerriAI/litellm/pull/24223)

PR fix notes

PR #24223: feat: add git-subdir source type to claude-code/plugins API

Repository: BerriAI/litellm
Author: manamana88
State: closed | merged: True
Link: https://github.com/BerriAI/litellm/pull/24223

Description (problem / solution / changelog)

Relevant issues

Fixes #24228

Pre-Submission checklist

I have Added testing in the tests/test_litellm/ directory
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

✨ New Feature

Changes

Add support for the git-subdir plugin source type in the POST /claude-code/plugins API, as documented in the official Claude Code plugin marketplaces spec.

New source format:

{
  "source": "git-subdir",
  "url": "https://github.com/org/monorepo.git",
  "path": "plugins/plugin-name"
}

Path validation uses a simple allowlist regex that only permits alphanumeric characters, dots, hyphens, and underscores — one or more /-separated segments. This blocks path traversal (..), absolute paths (/), backslashes, percent-encoded sequences, and any other unsafe characters without needing URL decoding.

Changes:

litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py: add git-subdir branch with allowlist regex validation
litellm/types/proxy/claude_code_endpoints.py: document all three source types in RegisterPluginRequest.source
tests/test_litellm/proxy/anthropic_endpoints/test_claude_code_marketplace.py: 8 unit tests (success, update, missing url, empty url, missing path, empty path, path traversal × 7 variants, unknown source type)
ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.tsx: add "Git Subdir" option with URL + path fields
ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.test.tsx: 4 UI tests

Changed files

litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py (modified, +34/-1)
litellm/types/proxy/claude_code_endpoints.py (modified, +2/-1)
tests/pass_through_unit_tests/test_claude_code_marketplace.py (modified, +46/-0)
tests/test_litellm/proxy/anthropic_endpoints/test_claude_code_marketplace.py (added, +222/-0)
ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.test.tsx (added, +131/-0)
ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.tsx (modified, +41/-6)

Code Example

{
  "name": "my-plugin",
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/org/monorepo.git",
    "path": "plugins/my-plugin"
  }
}

---

{
  "error": "source.source must be 'github' or 'url'"
}

RAW_BUFFERClick to expand / collapse

Summary

Official Feature Reference

This is a first-class source type documented in the Claude Code plugin marketplaces spec:

Git Subdirectories — Claude Code Plugin Marketplaces

Monorepos are a common pattern for hosting multiple Claude Code plugins in a single repository. Without git-subdir support, operators cannot register such plugins through LiteLLM's marketplace.

Expected Behaviour

POST /claude-code/plugins should accept the following source format and store it correctly so that GET /claude-code/marketplace.json returns it verbatim for Claude Code to clone from:

{
  "name": "my-plugin",
  "source": {
    "source": "git-subdir",
    "url": "https://github.com/org/monorepo.git",
    "path": "plugins/my-plugin"
  }
}

Current Behaviour

Sending the above payload returns:

{
  "error": "source.source must be 'github' or 'url'"
}

Acceptance Criteria

POST /claude-code/plugins accepts source.source == "git-subdir" with required url and path fields
path is validated to prevent path traversal (allowlist: alphanumeric, dots, hyphens, underscores, / separator)
GET /claude-code/marketplace.json returns the git-subdir source unchanged so Claude Code can use it
UI form (/claude-code dashboard) exposes the new source type with URL and subdirectory path fields
Unit tests cover success, missing/empty fields, and path traversal variants

extent analysis

Fix Plan

To fix the issue, we need to update the POST /claude-code/plugins endpoint to support the git-subdir source type. Here are the steps:

Update the validation logic to accept git-subdir as a valid source type
Add validation for the required url and path fields
Validate the path field to prevent path traversal attacks
Update the UI form to expose the new source type with URL and subdirectory path fields
Add unit tests to cover success, missing/empty fields, and path traversal variants

Example Code

# Update validation logic
if source['source'] not in ['github', 'url', 'git-subdir']:
    return {'error': 'source.source must be "github", "url", or "git-subdir"'}

# Validate required fields for git-subdir
if source['source'] == 'git-subdir':
    if 'url' not in source or 'path' not in source:
        return {'error': 'url and path are required for git-subdir source'}
    if not source['url'] or not source['path']:
        return {'error': 'url and path cannot be empty'}

# Validate path to prevent path traversal
import re
if not re.match('^[a-zA-Z0-9._-/]+$', source['path']):
    return {'error': 'invalid path'}

# Update UI form to expose new source type
# Add a new form field for git-subdir with URL and subdirectory path fields

# Add unit tests
def test_git_subdir_success():
    # Test successful registration with git-subdir source
    pass

def test_git_subdir_missing_fields():
    # Test registration with missing fields
    pass

def test_git_subdir_path_traversal():
    # Test registration with path traversal attempt
    pass

Verification

To verify that the fix worked, test the POST /claude-code/plugins endpoint with a valid git-subdir source payload and check that it returns a successful response. Also, test the GET /claude-code/marketplace.json endpoint to ensure that it returns the git-subdir source unchanged.

Extra Tips

Make sure to update the documentation to reflect the new git-subdir source type.
Consider adding additional validation for the url field to ensure it is a valid GitHub repository URL.
Use a whitelist approach for validating the path field to prevent path traversal attacks.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #ssr #installation #tensor shape #autograd error #parallel task #integration issue #index setup #retrieval issue #search optimization

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

litellm - ✅(Solved) Fix [Feature]: Add support for git-subdir source type in claude-code/plugins marketplace API [1 pull requests, 1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #24223: feat: add git-subdir source type to claude-code/plugins API

Description (problem / solution / changelog)

Relevant issues

Pre-Submission checklist

Type

Changes

Changed files

Code Example

Summary

Official Feature Reference

Expected Behaviour

Current Behaviour

Acceptance Criteria

extent analysis

Fix Plan

Example Code

Verification

Extra Tips

Still need to ship something?

TRENDING

litellm - ✅(Solved) Fix [Feature]: Add support for git-subdir source type in claude-code/plugins marketplace API [1 pull requests, 1 comments, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #24223: feat: add git-subdir source type to claude-code/plugins API

Description (problem / solution / changelog)

Relevant issues

Pre-Submission checklist

Type

Changes

Changed files

Code Example

Summary

Official Feature Reference

Expected Behaviour

Current Behaviour

Acceptance Criteria

extent analysis

Fix Plan

Example Code

Verification

Extra Tips

Still need to ship something?

RELATED_DISCOVERY

TRENDING