google-gemini/gemini-cli · error · Error

Empty command in auth value. Expected format: !command

Error message

Empty command in auth value. Expected format: !command

What it means

Thrown by resolveAuthValue when a value starts with '!' (the shell-command sigil) but slicing off the '!' and trimming yields an empty string. This is a pure config-validation guard: there is no command to run.

Source

Thrown at packages/core/src/agents/auth-provider/value-resolver.ts:51

  // Environment variable: $MY_VAR
  if (value.startsWith('$')) {
    const envVar = value.slice(1);
    const resolved = process.env[envVar];
    if (resolved === undefined || resolved === '') {
      throw new Error(
        `Environment variable '${envVar}' is not set or is empty. ` +
          `Please set it before using this agent.`,
      );
    }
    debugLogger.debug(`[AuthValueResolver] Resolved env var: ${envVar}`);
    return resolved;
  }

  // Shell command: !command arg1 arg2
  if (value.startsWith('!')) {
    const command = value.slice(1).trim();
    if (!command) {
      throw new Error('Empty command in auth value. Expected format: !command');
    }

    debugLogger.debug(`[AuthValueResolver] Executing command for auth value`);

    const shellConfig = getShellConfiguration();
    try {
      const { stdout } = await spawnAsync(
        shellConfig.executable,
        [...shellConfig.argsPrefix, command],
        {
          signal: AbortSignal.timeout(COMMAND_TIMEOUT_MS),
          windowsHide: true,
        },
      );

      const trimmed = stdout.trim();
      if (!trimmed) {
        throw new Error(`Command '${command}' returned empty output`);

View on GitHub (pinned to 5024443c72)

Solutions

1. Provide a real command after the bang, e.g. '!op read op://vault/item/credential'.
2. If the value should be literal text starting with !, escape it as !!VALUE.
3. Remove the field entirely if no command-based credential is intended.

Example fix

// before
auth: { type: 'apiKey', apiKey: '!' }

// after
auth: { type: 'apiKey', apiKey: '!op read op://vault/item/credential' }

function validateAuthCommand(value) {
  if (value.startsWith('!') && !value.startsWith('!!')) {
    if (value.slice(1).trim() === '')
      throw new Error('Auth command is empty after "!"');
  }
}

function isEmptyAuthCommand(v: string): boolean {
  return v.startsWith('!') && !v.startsWith('!!') && v.slice(1).trim() === '';
}

When it happens

Trigger: resolveAuthValue('!') or resolveAuthValue('! ') (bang followed by only whitespace). Any agent auth field whose value is literally '!' or whitespace after the bang.

Common situations: Config typo such as token: '!' left as a placeholder; YAML/JSON mis-indentation producing an empty command; copy-paste of a template where the command body was never filled in; trailing whitespace only.

Related errors

• Invalid approval mode: ${rawApprovalMode}. Valid values are:
• Invalid telemetry configuration: ${err.message}.
• Invalid regex pattern in allowedExtensions setting: "${patte
• Invalid environment variable name: "${key}". Must contain on
• Invalid environment variable value for "${key}". Values cann

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/6e7eef2296a32ecd. Report an issue: GitHub.