{"record":{"id":"cad5177eb4e9b234","repo":"google-gemini/gemini-cli","slug":"installing-extensions-from-remote-sources-is-disal","errorCode":null,"errorMessage":"Installing extensions from remote sources is disallowed by your current settings.","messagePattern":"Installing extensions from remote sources is disallowed by your current settings\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cli/src/config/extension-manager.ts","lineNumber":209,"sourceCode":"            );\n          } catch (e) {\n            throw new Error(\n              `Invalid regex pattern in allowedExtensions setting: \"${pattern}. Error: ${getErrorMessage(e)}`,\n            );\n          }\n        },\n      );\n      if (!extensionAllowed) {\n        throw new Error(\n          `Installing extension from source \"${installMetadata.source}\" is not allowed by the \"allowedExtensions\" security setting.`,\n        );\n      }\n    } else if (\n      (installMetadata.type === 'git' ||\n        installMetadata.type === 'github-release') &&\n      this.settings.security.blockGitExtensions\n    ) {\n      throw new Error(\n        'Installing extensions from remote sources is disallowed by your current settings.',\n      );\n    }\n\n    const isUpdate = !!previousExtensionConfig;\n    let newExtensionConfig: ExtensionConfig | null = null;\n    let localSourcePath: string | undefined;\n    let extension: GeminiCLIExtension | null;\n    try {\n      if (!isWorkspaceTrusted(this.settings).isTrusted) {\n        if (\n          await this.requestConsent(\n            `The current workspace at \"${this.workspaceDir}\" is not trusted. Do you want to trust this workspace to install extensions?`,\n          )\n        ) {\n          const trustedFolders = loadTrustedFolders();\n          await trustedFolders.setValue(\n            this.workspaceDir,","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/config/extension-manager.ts#L191-L227","documentation":"Thrown when `allowedExtensions` is empty/unset, the install type is `git` or `github-release`, and `settings.security.blockGitExtensions` is true. This is the deny-remote policy: with the allowlist disabled and remote installs explicitly blocked, any non-local source is rejected.","triggerScenarios":"Running `gemini extensions install owner/repo` or installing from a github-release URL while `security.blockGitExtensions: true` is set in settings.json; a managed policy that flips this flag centrally.","commonSituations":"Airgapped or high-security deployments; enterprise policy; user enabled the flag for safety then forgot it was on; CI runners that share a strict settings file.","solutions":["Set `security.blockGitExtensions` to `false` (or remove the key) in settings.json to permit remote installs.","Install from a local directory or symlink instead (`type: local`/`link`), which bypasses this check.","If you also need a source filter, switch to using `allowedExtensions` rather than the blanket block."],"exampleFix":"// before\n{ \"security\": { \"blockGitExtensions\": true } }\n// after\n{ \"security\": { \"blockGitExtensions\": false } }","handlingStrategy":"validation","validationCode":"const isRemote = installMetadata.type === 'git' || installMetadata.type === 'github-release';\nif (isRemote && settings.security?.blockGitExtensions) {\n  throw new Error('Remote extension installs blocked by blockGitExtensions.');\n}","typeGuard":"function isRemoteType(t: unknown): boolean {\n  return t === 'git' || t === 'github-release';\n}","tryCatchPattern":null,"preventionTips":["Surface `blockGitExtensions` in onboarding so users know remote installs are off.","Use `local`/`link` types to bypass the remote block when needed.","Prefer `allowedExtensions` over the blanket block when you still want some remote sources."],"tags":["extensions","security","git","policy"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}