What causes "Command '${command}' returned empty output" in google-gemini/gemini-cli?

Run the command manually in the same shell/environment and confirm it prints the secret to stdout.

google-gemini/gemini-cli · error · Error

Command '${command}' returned empty output

Error message

Command '${command}' returned empty output

What it means

Thrown by resolveAuthValue after a shell command (the ! sigil) executed and exited successfully but stdout was empty or whitespace-only after trimming. The command ran without throwing, so this is an output-content failure, not a process failure.

Source

Thrown at packages/core/src/agents/auth-provider/value-resolver.ts:69

      throw new Error('Empty command in auth value. Expected format: !command');
    }

    debugLogger.debug(`[AuthValueResolver] Executing command for auth value`);

    const shellConfig = getShellConfiguration();
    try {
      const { stdout } = await spawnAsync(
        shellConfig.executable,
        [...shellConfig.argsPrefix, command],
        {
          signal: AbortSignal.timeout(COMMAND_TIMEOUT_MS),
          windowsHide: true,
        },
      );

      const trimmed = stdout.trim();
      if (!trimmed) {
        throw new Error(`Command '${command}' returned empty output`);
      }
      return trimmed;
    } catch (error) {
      if (error instanceof Error && error.name === 'AbortError') {
        throw new Error(
          `Command '${command}' timed out after ${COMMAND_TIMEOUT_MS / 1000} seconds`,
        );
      }
      throw error;
    }
  }

  // Literal value - return as-is
  return value;
}

/**
 * Check if a value needs resolution (is an env var or command reference).

View on GitHub (pinned to 5024443c72)

Solutions

Run the command manually in the same shell/environment and confirm it prints the secret to stdout.
Re-authenticate the credential helper (e.g. gcloud auth login, op signin).
If the secret is on stderr, wrap the command to redirect: '!gcloud ... 2>&1' or rewrite to stdout.
Verify any required args / context flags are present in the command string.
Prefer reading from an env var ($VAR) if the command is flaky.

Example fix

# before
accessToken: '!gcloud auth print-access-token'   # empty when logged out

# after: ensure stdout output and auth state
gcloud auth login
accessToken: '!gcloud auth print-access-token'

Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight: run the command and assert non-empty stdout before relying on it.
import { spawnSync } from 'node:child_process';
function preflightCmd(cmd) {
  const { stdout } = spawnSync(cmd, { shell: true });
  if (!stdout.toString().trim())
    throw new Error(`Auth command produced no output: ${cmd}`);
}

Try / catch

try {
  const val = await resolveAuthValue('!gcloud auth print-access-token');
} catch (e) {
  if (e instanceof Error && /returned empty output/.test(e.message)) {
    // run `gcloud auth login` then retry
  }
  throw e;
}

Prevention

Run each !-command manually once to confirm stdout output.
Ensure the credential helper is authenticated before the agent starts.
Redirect stderr to stdout if the helper writes the secret to stderr.

When it happens

Trigger: resolveAuthValue('!some-command') where some-command exits 0 and prints nothing to stdout (or only whitespace). Typical with credential helpers that silently produce no output when unauthenticated.

Common situations: Credential helper not logged in (e.g. '!gcloud auth print-access-token' before `gcloud auth login`; '!op get item ...' when 1Password CLI session expired); command writes the secret to stderr instead of stdout; command needs arguments that were omitted; command echoes to a file rather than stdout; region/account context not set so the helper yields empty.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/25955d29b9c2ca19. Report an issue: GitHub.