{"record":{"id":"f7ec5392d2f86947","repo":"google-gemini/gemini-cli","slug":"invalid-regex-pattern-in-allowedextensions-setting","errorCode":null,"errorMessage":"Invalid regex pattern in allowedExtensions setting: \"${pattern}. Error: ${getErrorMessage(e)}","messagePattern":"Invalid regex pattern in allowedExtensions setting: \"(.+?)\\. Error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/config/extension-manager.ts","lineNumber":193,"sourceCode":"      );\n    }\n    return this.loadedExtensions;\n  }\n\n  async installOrUpdateExtension(\n    installMetadata: ExtensionInstallMetadata,\n    previousExtensionConfig?: ExtensionConfig,\n    requestConsentOverride?: (consent: string) => Promise<boolean>,\n  ): Promise<GeminiCLIExtension> {\n    if ((this.settings.security?.allowedExtensions?.length ?? 0) > 0) {\n      const extensionAllowed = this.settings.security?.allowedExtensions.some(\n        (pattern) => {\n          try {\n            return new RegExp(pattern).test(\n              getRealPath(installMetadata.source),\n            );\n          } catch (e) {\n            throw new Error(\n              `Invalid regex pattern in allowedExtensions setting: \"${pattern}. Error: ${getErrorMessage(e)}`,\n            );\n          }\n        },\n      );\n      if (!extensionAllowed) {\n        throw new Error(\n          `Installing extension from source \"${installMetadata.source}\" is not allowed by the \"allowedExtensions\" security setting.`,\n        );\n      }\n    } else if (\n      (installMetadata.type === 'git' ||\n        installMetadata.type === 'github-release') &&\n      this.settings.security.blockGitExtensions\n    ) {\n      throw new Error(\n        'Installing extensions from remote sources is disallowed by your current settings.',\n      );","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/config/extension-manager.ts#L175-L211","documentation":"Thrown during extension install/update when one of the regex patterns in `settings.security.allowedExtensions` fails to compile via `new RegExp(pattern)`. Each pattern is tested against the resolved real path of `installMetadata.source`; an invalid pattern (unbalanced brackets, bad escape, etc.) breaks the allowlist check entirely.","triggerScenarios":"A pattern like `[unclosed`, `(?<name>x` with an engine that rejects it, a stray backslash such as `*\\\\`, or any malformed regex string in the `allowedExtensions` array in settings.json.","commonSituations":"Hand-editing settings.json and forgetting to escape a backslash; copy-pasting a glob pattern (which is not a regex) like `*.git` into `allowedExtensions`; an editor that mangles backslashes on save.","solutions":["Open settings.json and inspect each entry in `security.allowedExtensions`.","Test each pattern in isolation: `node -e \"new RegExp('YOUR_PATTERN')\"`.","Remember these are regexes, not globs: use `\\.git$` rather than `*.git`."],"exampleFix":"// before (settings.json)\n{ \"security\": { \"allowedExtensions\": [\"[unclosed\"] } }\n// after\n{ \"security\": { \"allowedExtensions\": [\"^https://github\\\\.com/myorg/\"] } }","handlingStrategy":"validation","validationCode":"function compilePatterns(patterns: string[]): RegExp[] {\n  return patterns.map((p) => {\n    try { return new RegExp(p); }\n    catch (e) { throw new Error(`Invalid allowedExtensions regex \"${p}\": ${getErrorMessage(e)}`); }\n  });\n}","typeGuard":"function isRegexPattern(v: unknown): v is string {\n  if (typeof v !== 'string') return false;\n  try { new RegExp(v); return true; } catch { return false; }\n}","tryCatchPattern":null,"preventionTips":["Validate patterns at settings load time, not at install time.","Use a JSON schema with a custom regex-format check for `allowedExtensions`.","Remember the values are regexes, not globs."],"tags":["extensions","security","regex","config","validation"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}