google-gemini/gemini-cli · error · Error

Installing extensions from remote sources is disallowed by y

Error message

Installing extensions from remote sources is disallowed by your current settings.

What it means

Thrown when `allowedExtensions` is empty/unset, the install type is `git` or `github-release`, and `settings.security.blockGitExtensions` is true. This is the deny-remote policy: with the allowlist disabled and remote installs explicitly blocked, any non-local source is rejected.

Source

Thrown at packages/cli/src/config/extension-manager.ts:209

            );
          } catch (e) {
            throw new Error(
              `Invalid regex pattern in allowedExtensions setting: "${pattern}. Error: ${getErrorMessage(e)}`,
            );
          }
        },
      );
      if (!extensionAllowed) {
        throw new Error(
          `Installing extension from source "${installMetadata.source}" is not allowed by the "allowedExtensions" security setting.`,
        );
      }
    } else if (
      (installMetadata.type === 'git' ||
        installMetadata.type === 'github-release') &&
      this.settings.security.blockGitExtensions
    ) {
      throw new Error(
        'Installing extensions from remote sources is disallowed by your current settings.',
      );
    }

    const isUpdate = !!previousExtensionConfig;
    let newExtensionConfig: ExtensionConfig | null = null;
    let localSourcePath: string | undefined;
    let extension: GeminiCLIExtension | null;
    try {
      if (!isWorkspaceTrusted(this.settings).isTrusted) {
        if (
          await this.requestConsent(
            `The current workspace at "${this.workspaceDir}" is not trusted. Do you want to trust this workspace to install extensions?`,
          )
        ) {
          const trustedFolders = loadTrustedFolders();
          await trustedFolders.setValue(
            this.workspaceDir,

View on GitHub (pinned to 5024443c72)

Solutions

1. Set `security.blockGitExtensions` to `false` (or remove the key) in settings.json to permit remote installs.
2. Install from a local directory or symlink instead (`type: local`/`link`), which bypasses this check.
3. If you also need a source filter, switch to using `allowedExtensions` rather than the blanket block.

Example fix

// before
{ "security": { "blockGitExtensions": true } }
// after
{ "security": { "blockGitExtensions": false } }

const isRemote = installMetadata.type === 'git' || installMetadata.type === 'github-release';
if (isRemote && settings.security?.blockGitExtensions) {
  throw new Error('Remote extension installs blocked by blockGitExtensions.');
}

function isRemoteType(t: unknown): boolean {
  return t === 'git' || t === 'github-release';
}

When it happens

Trigger: Running `gemini extensions install owner/repo` or installing from a github-release URL while `security.blockGitExtensions: true` is set in settings.json; a managed policy that flips this flag centrally.

Common situations: Airgapped or high-security deployments; enterprise policy; user enabled the flag for safety then forgot it was on; CI runners that share a strict settings file.

Related errors

• Installing extension from source "${installMetadata.source}"
• Installation aborted: Folder "${absolutePath}" is not truste
• YOLO mode is disabled by your administrator. To enable it, p
• Invalid regex pattern in allowedExtensions setting: "${patte
• Could not install extension because the current workspace at

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/cad5177eb4e9b234. Report an issue: GitHub.