Invalid regex pattern in allowedExtensions setting: "${patte

Error message

Invalid regex pattern in allowedExtensions setting: "${pattern}. Error: ${getErrorMessage(e)}

What it means

Thrown during extension install/update when one of the regex patterns in `settings.security.allowedExtensions` fails to compile via `new RegExp(pattern)`. Each pattern is tested against the resolved real path of `installMetadata.source`; an invalid pattern (unbalanced brackets, bad escape, etc.) breaks the allowlist check entirely.

Source

Thrown at packages/cli/src/config/extension-manager.ts:193

      );
    }
    return this.loadedExtensions;
  }

  async installOrUpdateExtension(
    installMetadata: ExtensionInstallMetadata,
    previousExtensionConfig?: ExtensionConfig,
    requestConsentOverride?: (consent: string) => Promise<boolean>,
  ): Promise<GeminiCLIExtension> {
    if ((this.settings.security?.allowedExtensions?.length ?? 0) > 0) {
      const extensionAllowed = this.settings.security?.allowedExtensions.some(
        (pattern) => {
          try {
            return new RegExp(pattern).test(
              getRealPath(installMetadata.source),
            );
          } catch (e) {
            throw new Error(
              `Invalid regex pattern in allowedExtensions setting: "${pattern}. Error: ${getErrorMessage(e)}`,
            );
          }
        },
      );
      if (!extensionAllowed) {
        throw new Error(
          `Installing extension from source "${installMetadata.source}" is not allowed by the "allowedExtensions" security setting.`,
        );
      }
    } else if (
      (installMetadata.type === 'git' ||
        installMetadata.type === 'github-release') &&
      this.settings.security.blockGitExtensions
    ) {
      throw new Error(
        'Installing extensions from remote sources is disallowed by your current settings.',
      );

View on GitHub (pinned to 5024443c72)

Solutions

Open settings.json and inspect each entry in `security.allowedExtensions`.
Test each pattern in isolation: `node -e "new RegExp('YOUR_PATTERN')"`.
Remember these are regexes, not globs: use `\.git$` rather than `*.git`.

Example fix

// before (settings.json)
{ "security": { "allowedExtensions": ["[unclosed"] } }
// after
{ "security": { "allowedExtensions": ["^https://github\\.com/myorg/"] } }

Defensive patterns

Strategy: validation

Validate before calling

function compilePatterns(patterns: string[]): RegExp[] {
  return patterns.map((p) => {
    try { return new RegExp(p); }
    catch (e) { throw new Error(`Invalid allowedExtensions regex "${p}": ${getErrorMessage(e)}`); }
  });
}

Type guard

function isRegexPattern(v: unknown): v is string {
  if (typeof v !== 'string') return false;
  try { new RegExp(v); return true; } catch { return false; }
}

Prevention

Validate patterns at settings load time, not at install time.
Use a JSON schema with a custom regex-format check for `allowedExtensions`.
Remember the values are regexes, not globs.

When it happens

Trigger: A pattern like `[unclosed`, `(?<name>x` with an engine that rejects it, a stray backslash such as `*\\`, or any malformed regex string in the `allowedExtensions` array in settings.json.

Common situations: Hand-editing settings.json and forgetting to escape a backslash; copy-pasting a glob pattern (which is not a regex) like `*.git` into `allowedExtensions`; an editor that mangles backslashes on save.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/f7ec5392d2f86947. Report an issue: GitHub.