google-gemini/gemini-cli · critical · FatalUntrustedWorkspaceError

Gemini CLI is not running in a trusted directory. To proceed

Error message

Gemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode. For more details, see https://geminicli.com/docs/cli/trusted-folders/#headless-and-automated-environments

What it means

Thrown by the high-priority folder-trust warning check during startup when folder trust is enabled, the current workspace is not in the trusted set, and the process is running headlessly (no TTY). Because headless mode cannot prompt the user to confirm trust, the check escalates to a `FatalUntrustedWorkspaceError` that stops startup. The message enumerates the three supported escapes: `--skip-trust`, the `GEMINI_CLI_TRUST_WORKSPACE=true` env var, or pre-trusting the folder interactively.

Source

Thrown at packages/cli/src/utils/userStartupWarnings.ts:98

    }
  },
};

const folderTrustCheck: WarningCheck = {
  id: 'folder-trust',
  priority: WarningPriority.High,
  check: async (workspaceRoot: string, settings: Settings) => {
    if (!isFolderTrustEnabled(settings)) {
      return null;
    }

    const { isTrusted } = isWorkspaceTrusted(settings, workspaceRoot);
    if (isTrusted === true) {
      return null;
    }

    if (isHeadlessMode()) {
      throw new FatalUntrustedWorkspaceError(
        'Gemini CLI is not running in a trusted directory. To proceed, either use `--skip-trust`, ' +
          'set the `GEMINI_CLI_TRUST_WORKSPACE=true` environment variable, or trust this directory in interactive mode. ' +
          'For more details, see https://geminicli.com/docs/cli/trusted-folders/#headless-and-automated-environments',
      );
    }

    return null;
  },
};

// All warning checks
const WARNING_CHECKS: readonly WarningCheck[] = [
  homeDirectoryCheck,
  rootDirectoryCheck,
  folderTrustCheck,
];

export async function getUserStartupWarnings(

View on GitHub (pinned to 5024443c72)

Solutions

Set `GEMINI_CLI_TRUST_WORKSPACE=true` in the environment for that invocation (best for CI).
Pass `--skip-trust` on the command line for a one-off headless run.
Run the CLI once interactively as the same user to add the directory to the trust store, then re-run headlessly.
Confirm the trust settings file is writable and being read by the same UID that runs the headless command.

Example fix

# before
$ gemini -p 'summarize this'  # in a fresh repo in CI

# after
$ GEMINI_CLI_TRUST_WORKSPACE=true gemini -p 'summarize this'
# or
$ gemini --skip-trust -p 'summarize this'

Defensive patterns

Strategy: validation

Validate before calling

function assertTrustedOrSkipped(env: NodeJS.ProcessEnv, argv: string[]) {
  const trusted =
    env.GEMINI_CLI_TRUST_WORKSPACE === 'true' ||
    argv.includes('--skip-trust');
  if (!trusted && !process.stdout.isTTY) {
    throw new Error('Set GEMINI_CLI_TRUST_WORKSPACE=true or pass --skip-trust for headless runs');
  }
}

assertTrustedOrSkipped(process.env, process.argv);

Type guard

function isHeadlessAndUntrusted(env: NodeJS.ProcessEnv): boolean {
  return !process.stdout.isTTY && env.GEMINI_CLI_TRUST_WORKSPACE !== 'true';
}

Try / catch

try {
  await runGemini(opts);
} catch (e) {
  if (e instanceof FatalUntrustedWorkspaceError) {
    // surface a CI-friendly hint and exit non-zero but distinctly
    console.error('Trust this workspace: set GEMINI_CLI_TRUST_WORKSPACE=true');
    process.exit(78); // EX_CONFIG
  }
  throw e;
}

Prevention

Bake `GEMINI_CLI_TRUST_WORKSPACE=true` into CI env templates for repos that are meant to run headlessly.
Document the trust-once-interactive flow in onboarding so first runs establish trust.
Audit the trust store location when running under different service accounts.

When it happens

Trigger: Running the Gemini CLI non-interactively (piped stdin, CI, scheduled task, container) inside a workspace that has not been marked trusted while folder-trust enforcement is on. `isWorkspaceTrusted` returns `isTrusted !== true` and `isHeadlessMode()` is true, so the function throws instead of returning a warning.

Common situations: First run of the CLI in a freshly cloned repo in CI; running inside Docker where no interactive trust prompt ever ran; policy flipped folder-trust on by default after an upgrade; the trust store lives in a home directory that differs between users (e.g. `sudo` or a service account).

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/a3b8eb04de4339d1. Report an issue: GitHub.