What causes "${event.value.systemMessage?.trim() || event.value.reason}" in google-gemini/gemini-cli?

Read event.value.systemMessage for the exact blocked action and grant that specific permission.

AGENT_EXECUTION_BLOCKED

AGENT_EXECUTION_BLOCKED

Error message

${event.value.systemMessage?.trim() || event.value.reason}

What it means

AGENT_EXECUTION_BLOCKED is emitted as a non-fatal PERMISSION_DENIED error when the model attempted an action blocked by the agent's policy/sandbox. The message is the server's systemMessage (preferred) or its reason string.

Source

Thrown at packages/core/src/agent/event-translator.ts:215

      ensureStreamStart(state, out);
      out.push(
        makeEvent('agent_end', state, {
          reason: 'completed',
          data: {
            message: event.value.systemMessage?.trim() || event.value.reason,
          },
        }),
      );
      break;

    case GeminiEventType.AgentExecutionBlocked:
      ensureStreamStart(state, out);
      out.push(
        makeEvent('error', state, {
          status: 'PERMISSION_DENIED',
          message: event.value.systemMessage?.trim() || event.value.reason,
          fatal: false,
          _meta: { code: 'AGENT_EXECUTION_BLOCKED' },
        }),
      );
      break;

    case GeminiEventType.InvalidStream:
      ensureStreamStart(state, out);
      out.push(
        makeEvent('error', state, {
          status: 'INTERNAL',
          message:
            event.value?.message?.trim() ||
            'Invalid stream received from model',
          fatal: true,
          _meta: {
            code: 'INVALID_STREAM',
            errorType: event.value?.type,
            rawMessage: event.value?.message,
          },

View on GitHub (pinned to 5024443c72)

Solutions

Read event.value.systemMessage for the exact blocked action and grant that specific permission.
Broaden the tool/policy allowlist for the session (e.g. allow the path the agent needs).
If the action should stay blocked, steer the prompt away from it.

Example fix

// before
policies: [policy.denyShell()]
// after
policies: [policy.allowShell({ commands: ['git','npm'] })]

Defensive patterns

Strategy: validation

Validate before calling

// before running, confirm the action set the agent may need is allowed
const needed = ['shell:git', 'fs:write:src/**'];
for (const n of needed) if (!policy.allows(n)) policy.grant(n);

Type guard

function isExecutionBlocked(ev: unknown): boolean {
  return typeof ev === 'object' && ev !== null && (ev as any)._meta?.code === 'AGENT_EXECUTION_BLOCKED';
}

Try / catch

if (ev.type === 'error' && ev._meta?.code === 'AGENT_EXECUTION_BLOCKED') {
  // read ev.message, grant the specific permission, then resume the session
}

Prevention

Scope the policy to the actions the task actually needs rather than allow_all.
Surface systemMessage to the user so they can approve the blocked action.

When it happens

Trigger: translateEvent() receives GeminiEventType.AgentExecutionBlocked -> pushes makeEvent('error', { status:'PERMISSION_DENIED', message: event.value.systemMessage?.trim() || event.value.reason, fatal:false, _meta.code:'AGENT_EXECUTION_BLOCKED' }).

Common situations: Agent tries to run a shell command, write outside the workspace, or call a disallowed tool; Code Assist server policy rejects the action; sandbox tool-allowlist is too narrow.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/ad595dbd953ff1fc. Report an issue: GitHub.