@ory/gemini-cli 0.14.0 → 1.0.1

package/README.md

@@ -2,9 +2,12 @@
 
 Security and developer experience for [Gemini CLI](https://github.com/google-gemini/gemini-cli), powered by [Ory](https://ory.com).
 
-**Security.** Gemini runs real actions on your machine — editing files, running shell commands, calling APIs. The extension gives every session a verifiable identity (you sign in once; Gemini and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
+Gemini runs real actions on your machine — editing files, running shell commands, calling APIs. This plugin gives those actions an identity, a permission check, and an audit trail.
 
-**Developer experience.** A single command installs the extension and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
+One command installs two independent halves:
+
+- **Developer experience** — the Ory skill catalog, `/ory:` slash commands, the local Ory dev stack, an MCP server, and activity logging. No account, no keys, nothing to configure: it works the moment it's installed.
+- **Ory Agent Security** — browser sign-in, brokered permission checks before tool calls, and the delegation trail. Opt-in connection details from the [Ory Console](https://console.ory.sh) switch it on, and it takes nothing away from the half above. See [Connect to Ory Agent Security](#connect-to-ory-agent-security).
 
 ## What you'll need
 
@@ -15,127 +18,123 @@ Security and developer experience for [Gemini CLI](https://github.com/google-gem
 
 ## Get started
 
-Run one command. It installs the extension and walks you through connecting:
+Run one command It installs the extension:
 
 ```bash
 npx -y -p @ory/gemini-cli ory-gemini install
 ```
 
-This registers the extension — its hooks, skills, `/ory:` slash commands, and the bundled Ory MCP server — then opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
-
-- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
-- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
-- **Audit-only** — skip Ory entirely and just log what Gemini does.
-
-> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
-
-That's it. Confirm everything landed with:
+This registers the extension — its hooks, skills, `/ory:` slash commands, and the bundled Ory MCP server. Confirm everything landed with:
 
 ```bash
 npx -y -p @ory/gemini-cli ory-gemini status
 ```
 
-`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the extension and skills registered, and recent activity. Anything not set up yet shows as `(unset)`.
+`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the extension and skills registered, and recent activity. Until you connect Agent Security, the identity and permission rows say so and name what's missing.
+
+> Prefer to install the extension natively? Run `gemini extensions install https://github.com/ory/gemini-cli-extension`. That registers the extension the same way, with Agent Security not connected. If the `gemini` binary isn't on your `PATH`, `npx -y -p @ory/gemini-cli ory-gemini-setup` writes the extension config straight into your project's `.gemini/settings.json`.
+
+## Skills and commands
+
+Installing the extension drops the full Ory playbook catalog into Gemini CLI. **Skills** are model-invoked — just say what you want in plain language and the matching one takes over.
+
+| Skill | What it does for you |
+|---|---|
+| `ory-auth-setup` | Adds a complete auth system to your app — login, registration, recovery, verification, settings — on [Ory Elements](https://github.com/ory/elements) |
+| `ory-login-flow` | Builds just the pages, wired to Ory's self-service flows |
+| `ory-social-login` | "Sign in with…" for Google, GitHub, Apple, Microsoft, Discord, Slack, GitLab, Facebook |
+| `ory-local-dev` | Develops and tests login/permission flows against a local Ory — no project, no account, offline |
+| `ory-permissions-onboarding` | Walks a fresh install from observe mode to enforced per-tool permissions without getting blocked |
+| `ory-build-agent` | Drops `@ory/argus` into an agent *you* own — Claude Agent SDK, OpenAI Agents, Mastra, Vercel AI, LangGraph/PydanticAI |
+| `ory-build-integration` | Wires Ory into your app: Action webhooks, JWT validation at a gateway, live event streams |
+| `ory-contribute-integration` | Authors and submits an integration to the public `ory/integrates` registry |
+| `ory-e2b-sandbox` | Scaffolds an E2B sandbox template that boots with this plugin preinstalled |
+| `ory-temporal-worker` | Scaffolds a Temporal TypeScript worker where every Activity is authenticated, authorized, and audited |
+
+**Slash commands** run the local stack directly:
+
+| Command | What it does |
+|---|---|
+| `/ory:local-up` | Starts a local Ory (Identities, OAuth2, Permissions) in Docker and seeds a test user — it prints the email + password to sign in with |
+| `/ory:local-down` | Stops it, keeping your data volumes |
+| `/ory:temporal-up` | Starts a local Temporal dev server for the `ory-temporal-worker` scaffold |
+
+The local stack runs entirely on your laptop: Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and the Ory Console on `:4100`.
 
-> Prefer to install the extension natively? Run `gemini extensions install https://github.com/ory/gemini-cli-extension`. That registers the extension but skips the guided setup — run `ory-gemini install` (or `configure`) in a terminal afterwards to connect. Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard. If the `gemini` binary isn't on your `PATH`, `npx -y -p @ory/gemini-cli ory-gemini-setup` writes the extension config straight into your project's `.gemini/settings.json`.
+A built-in **Ory MCP server** rounds it out — Gemini can manage identities, projects, and permissions straight from chat.
+
+So: ask Gemini *"add Ory login to this app"* and it scaffolds the pages, starts a local Ory, and wires them together.
 
 ## What you get
 
-Once connected, every tool Gemini runs is governed by Ory — three things happen automatically:
+Out of the box, every tool Gemini runs produces a privacy-safe structured activity event in the unified local log.
+
+Once you connect to Ory Agent Security, two more things happen automatically:
 
-- **Who's driving.** You sign in once in your browser; Gemini gets its own identity too, and registers it automatically on first run (no tokens to copy around). The "who acted on whose behalf" trail stays queryable later.
-- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
-- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to Jaeger, Honeycomb, Grafana, or just a file.
+- **Who's driving.** You sign in once in your browser; each Gemini session and typed sub-agent gets its own identity and registers automatically on first use. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later.
+- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **observe mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
 
 If Ory is ever unreachable, the extension gets out of the way and lets Gemini keep working — so it can't lock you out.
 
 ### See what's happening
 
-Everything the plugin does is observable out of the box — no configuration required:
+Everything the extension does is observable out of the box:
 
-- **Status at a glance.** `npx -y -p @ory/gemini-cli ory-gemini status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
-- **Live dashboard.** `npx -y -p @ory/gemini-cli ory-gemini dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
-- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
+- **Activity log.** Privacy-safe activity is always appended to `~/.config/ory-agent-plugins/gemini-cli/ory-agent-debug.log`. View events, decisions, and errors live with:
 
   ```bash
   npx -y -p @ory/gemini-cli ory-gemini watch
   ```
 
-  Spans are also written to `~/.config/ory-agent-plugins/gemini-cli/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
-- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/gemini-cli/ory-agent-debug.log`.
+  Set `ORY_AGENT_LOG_FILE` to override the path; set it empty to disable file persistence.
+- **Live debug.** Launch Gemini CLI with `ORY_AGENT_DEBUG=true` to add verbose local diagnostics, including raw shell commands, to the watched log and stderr. Secrets are recursively redacted; pass `watch --json` for NDJSON.
 
 ### Ready to enforce?
 
-When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
+Once connected, the deny posture lives on the Ory project: when the observe-mode activity looks right, an admin promotes it to **enforce** in the **Ory Console** (Agent Security). Every session reads that posture live, so nothing has to be reinstalled.
 
 ```bash
-npx -y -p @ory/gemini-cli ory-gemini permissions enforce
+npx -y -p @ory/gemini-cli ory-gemini permissions   # what the project grants, and the live mode
 ```
 
-Now a denied tool is actually blocked and Gemini shows why. Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask Gemini in chat, e.g. *"grant me use of the shell tool."*
-
-## Also: add login to your own app
+Then a denied tool is actually blocked and Gemini shows why.
 
-Beyond securing Gemini, the extension helps you build Ory into whatever you're working on. Ask Gemini *"add Ory login to this app"* and it scaffolds the login, registration, recovery, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory with `/ory:local-up` (it prints a test email + password to sign in with) and tear it down with `/ory:local-down`.
+## Connect to Ory Agent Security
 
-Bundled **skills** (just ask in plain language) cover more: `ory-auth-setup`, `ory-login-flow`, `ory-social-login` (Google, GitHub, Apple…), `ory-permissions-onboarding`, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers. Real `/ory:` **slash commands** run the local stack (`/ory:local-up`, `/ory:local-down`, `/ory:temporal-up`). And a built-in **Ory MCP server** lets Gemini manage identities, projects, and permissions straight from chat.
+Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
 
-The local stack runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to avoid Next.js port conflicts), and Jaeger (the trace viewer) on `:16686`. Everything works offline.
-
-## Configure by hand (CI / advanced)
-
-The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins and extensions; environment variables win when both are set.
+| Value | Flag | Environment variable |
+|---|---|---|
+| Project URL | `--project-url` | `ORY_PROJECT_URL` |
+| Agent Security URL | `--agent-security-url` | `ORY_AGENT_SECURITY_URL` |
+| Sign-in client id override (default `ory-agent-security-login`) | `--oauth2-client-id` | `ORY_OAUTH2_CLIENT_ID` |
 
 ```bash
 npx -y -p @ory/gemini-cli ory-gemini configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <login client id>
+  --agent-security-url https://agents.console.ory.com
 ```
 
-Gemini's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs, so `configure` won't save a project URL without it; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`. The interactive user login runs every session (always on, non-blocking) and only needs `ORY_OAUTH2_CLIENT_ID` to complete the browser flow. The matching env vars are `ORY_PROJECT_URL`, `ORY_OAUTH2_CLIENT_ID`, and `ORY_AGENT_API_KEY`.
-
-<details>
-<summary>Create the sign-in client by hand</summary>
+`install` accepts the same flags, so you can register the plugin **and** connect in one shot (`install --project-url <URL> --agent-security-url <URL>`). The login client defaults to `ory-agent-security-login`; custom deployments can override it with `--oauth2-client-id`. Existing configurations fall back to the project URL when the Agent Security URL is unset. To turn sign-in and checks back off later, use `configure --disconnect`.
 
-The guided setup normally does this. To do it yourself, create a **public** OAuth2 client (no secret) listing all four loopback URLs — the extension tries each in turn so sign-in survives a busy port:
-
-- `http://127.0.0.1:47823/callback`
-- `http://127.0.0.1:47824/callback`
-- `http://127.0.0.1:47825/callback`
-- `http://127.0.0.1:47826/callback`
-
-Create it with the [Ory CLI](https://www.ory.com/docs/guides/cli/installation):
-
-```bash
-ory create oauth2-client --project <project-id> \
-  --name "Ory Agent Security · user login (PKCE)" \
-  --grant-type authorization_code,refresh_token \
-  --response-type code \
-  --scope openid,offline_access \
-  --token-endpoint-auth-method none \
-  --redirect-uri http://127.0.0.1:47823/callback \
-  --redirect-uri http://127.0.0.1:47824/callback \
-  --redirect-uri http://127.0.0.1:47825/callback \
-  --redirect-uri http://127.0.0.1:47826/callback
-```
+**Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-…or make one in the [Ory Console](https://console.ory.sh) under *OAuth2* → *Clients* → *Create client* (pick "Public client", "Authorization Code" + "Refresh Token" grants, scopes `openid offline_access`, paste the four URLs). Pass the resulting id to `configure --oauth2-client-id`. Running headless with a session token already? Set `ORY_USER_SESSION_TOKEN` and skip the browser step entirely.
+**There is nothing else for you to create.** The sign-in client, the permission model, the per-tool grants and blocks, and the observe/enforce posture are all provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions — it has no write path into your project, which is why installing it needs no workspace privilege. Each Gemini session registers its own identity automatically on first use.
 
-</details>
+Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
-With nothing configured, the extension still loads and runs in **pass-through mode**: skills, slash commands, and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
+Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
 
 ## Commands
 
 ```
-ory-gemini install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
+ory-gemini install | uninstall        Install (add --project-url to also connect Agent Security) / remove
 ory-gemini status                     Show configuration, identities, permission coverage, recent activity
-ory-gemini dashboard                  Open the live browser dashboard (status + service health + Change stack)
-ory-gemini watch                      Tail the live trace stream (OTel spans)
-ory-gemini permissions <cmd>          status | bootstrap | observe (watch) | enforce (block)
-ory-gemini configure <flags>          Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
+ory-gemini permissions <cmd>          status  (read-only; grants + posture live in the Ory Console)
+ory-gemini configure <flags>          Connect a project (--project-url) or --disconnect
 ory-gemini agent <status|unregister>  Manage Gemini's own auto-created identity
 ory-gemini local <up|down|status|…>   Run / manage a local Ory in Docker
+ory-gemini version                    Print plugin, core, and Node versions (--json for machine-readable)
 ```
 
 All prefixed with `npx -y -p @ory/gemini-cli`.
@@ -143,9 +142,8 @@ All prefixed with `npx -y -p @ory/gemini-cli`.
 ## Troubleshooting
 
 - **`/ory:local-up` fails** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** — reset with `ory-gemini agent unregister` and try again.
-- **Install ran but never asked how to connect** — you're almost certainly on a stale `npx` cache. `npx -p @ory/gemini-cli` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest, so an older CLI whose install predates the setup wizard can run while you believe you're on the current release. The install banner prints the running version; confirm it with `npx -y -p @ory/gemini-cli ory-gemini version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/gemini-cli ory-gemini install`. Pinning an exact version (`@ory/gemini-cli@<version>`) also bypasses the cached copy.
-- **Want to see what's happening** — `npx -y -p @ory/gemini-cli ory-gemini status` for a snapshot, `npx -y -p @ory/gemini-cli ory-gemini watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/gemini-cli/` (see [See what's happening](#see-whats-happening)).
+- **Browser sign-in loops** (after connecting) — reset with `ory-gemini agent unregister` and try again.
+- **Running an older CLI than expected** — `npx -p @ory/gemini-cli` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/gemini-cli ory-gemini version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/gemini-cli ory-gemini install`. Pinning an exact version (`@ory/gemini-cli@<version>`) also bypasses the cached copy.
 
 ## Learn more
 

package/dist/cli/assets.d.ts

@@ -3,10 +3,17 @@
  * registration, and extension manifest for the Gemini CLI plugin.
  *
  * The manifest and hooks.json are rendered at install time (not shipped
- * static) so the version pin baked into the hook command always matches
- * the installed package, and the mcpServers entry stays in sync with the
- * @ory/mcp-server package we depend on.
+ * static) because they carry the paths this machine's runtime resolved to:
+ * the hook command and the MCP server both point at shims written by
+ * {@link wireGeminiRuntime}, so nothing is re-resolved at run time.
  */
+import { type PreparedRuntime } from "@ory/argus";
+/**
+ * Resolve this install's runtime and write its shims. Both entry points (the
+ * bundled extension in `main.ts` and the manual `.gemini` fallback in
+ * `setup.ts`) go through here so they wire the same runtime.
+ */
+export declare function wireGeminiRuntime(args: readonly string[]): PreparedRuntime;
 /**
  * Write all Ory skills, TOML slash commands, the rendered manifest, and
  * the rendered hooks.json under a Gemini-conventional root containing
@@ -14,6 +21,6 @@
  * `GEMINI.md`. For the bundled extension that's the `gemini-extension`
  * directory; for the manual-setup fallback it's `<projectDir>/.gemini`.
  */
-export declare function installGeminiOryAssets(root: string): void;
+export declare function installGeminiOryAssets(root: string, runtime: PreparedRuntime): void;
 /** Remove every skill + command this plugin installed under `root`. */
 export declare function uninstallGeminiOryAssets(root: string): void;

package/dist/cli/assets.js

@@ -4,9 +4,9 @@
  * registration, and extension manifest for the Gemini CLI plugin.
  *
  * The manifest and hooks.json are rendered at install time (not shipped
- * static) so the version pin baked into the hook command always matches
- * the installed package, and the mcpServers entry stays in sync with the
- * @ory/mcp-server package we depend on.
+ * static) because they carry the paths this machine's runtime resolved to:
+ * the hook command and the MCP server both point at shims written by
+ * {@link wireGeminiRuntime}, so nothing is re-resolved at run time.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -42,15 +42,29 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.wireGeminiRuntime = wireGeminiRuntime;
 exports.installGeminiOryAssets = installGeminiOryAssets;
 exports.uninstallGeminiOryAssets = uninstallGeminiOryAssets;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const PACKAGE_NAME = "@ory/gemini-cli";
-const MCP_PACKAGE_NAME = "@ory/mcp-server";
-const MCP_BIN_NAME = "ory-mcp-server";
 const EXTENSION_NAME = "ory";
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
+/**
+ * Resolve this install's runtime and write its shims. Both entry points (the
+ * bundled extension in `main.ts` and the manual `.gemini` fallback in
+ * `setup.ts`) go through here so they wire the same runtime.
+ */
+function wireGeminiRuntime(args) {
+    return (0, argus_1.wireRuntime)({
+        harness: "gemini-cli",
+        packageName: PACKAGE_NAME,
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/gemini-cli ory-gemini install",
+        args,
+    });
+}
 const RENDER_OPTS = {
     binName: "ory-gemini",
     packageName: PACKAGE_NAME,
@@ -78,12 +92,17 @@ function readPackageVersion() {
 }
 /**
  * Render the hooks.json that Gemini CLI registers when it copies the
- * extension into ~/.gemini/extensions/ory. The hook command is a
- * self-contained `npx -y -p @ory/gemini-cli@<version> ory-gemini-hook`
- * so the binary doesn't have to be on PATH after install.
+ * extension into ~/.gemini/extensions/ory. The command points at the runtime
+ * shim resolved at install time, so no package resolution happens per tool
+ * call.
  */
-function renderHooks(version) {
-    const command = `npx -y -p ${PACKAGE_NAME}@${version} ory-gemini-hook`;
+// Gemini CLI's hook timeout is in MILLISECONDS (its runner defaults to 6e4 and
+// reports "Hook timed out after ${timeout}ms"). The previous 10000 therefore
+// meant 10 SECONDS on session start — a sixth of the harness's own default and
+// far short of the interactive login, which it killed mid-flow (#220).
+function renderHooks(command) {
+    const sessionStartMs = (0, argus_1.sessionStartHookTimeout)("gemini-cli", "milliseconds");
+    const toolMs = (0, argus_1.toolHookTimeout)("gemini-cli", "milliseconds");
     const entry = (name, description, timeout) => [
         {
             matcher: "",
@@ -92,13 +111,13 @@ function renderHooks(version) {
     ];
     return {
         hooks: {
-            SessionStart: entry("ory-session-start", "Verify the user and agent identities via Ory", 10000),
-            SessionEnd: entry("ory-session-end", "Record session termination via Ory tracing", 5000),
-            BeforeTool: entry("ory-before-tool", "Check tool permissions via Ory Permissions", 5000),
-            AfterTool: entry("ory-after-tool", "Record trace spans for tool executions via Ory", 5000),
-            BeforeToolSelection: entry("ory-before-tool-selection", "Audit-only span for the upcoming tool-selection decision", 5000),
-            Notification: entry("ory-notification", "Audit permission and notification prompts", 5000),
-            PreCompress: entry("ory-pre-compress", "Audit history compaction events", 5000),
+            SessionStart: entry("ory-session-start", "Verify the user and agent identities via Ory", sessionStartMs),
+            SessionEnd: entry("ory-session-end", "Record session termination in the Ory activity log", toolMs),
+            BeforeTool: entry("ory-before-tool", "Check tool permissions via Ory Permissions", toolMs),
+            AfterTool: entry("ory-after-tool", "Record structured activity for tool executions via Ory", toolMs),
+            BeforeToolSelection: entry("ory-before-tool-selection", "Activity event for the upcoming tool-selection decision", toolMs),
+            Notification: entry("ory-notification", "Audit permission and notification prompts", toolMs),
+            PreCompress: entry("ory-pre-compress", "Audit history compaction events", toolMs),
         },
     };
 }
@@ -109,25 +128,21 @@ function renderHooks(version) {
  *    package and tracks updates.
  *  - `contextFileName: GEMINI.md` for the model-facing context briefing.
  *  - `mcpServers.ory` so the Ory MCP server is auto-registered alongside
- *    the hooks. Resolved via npx for the same reason as the hook command:
- *    the binary needn't be on PATH.
+ *    the hooks, started from the resolved runtime via its shim.
  *  - A minimal `settings` block. Only `ORY_PROJECT_URL` is prompted now —
  *    the agent identity is resolved via Dynamic Client Registration, and
  *    the legacy ORY_API_KEY / ORY_SESSION_TOKEN prompts were teaching
  *    users the deprecated path.
  */
-function renderManifest(version) {
+function renderManifest(version, mcpServer) {
     return {
         name: EXTENSION_NAME,
         version,
-        description: "Ory authentication, authorization, and distributed tracing for Gemini CLI",
+        description: "Ory authentication, authorization, and activity auditing for Gemini CLI",
         contextFileName: "GEMINI.md",
-        mcpServers: {
-            [EXTENSION_NAME]: {
-                command: "npx",
-                args: ["-y", "-p", `${MCP_PACKAGE_NAME}@${version}`, MCP_BIN_NAME],
-            },
-        },
+        // Registered only when the resolved runtime ships an MCP server — better
+        // no registration than one pointing at a server that cannot start.
+        ...(mcpServer ? { mcpServers: { [EXTENSION_NAME]: mcpServer } } : {}),
         settings: [
             {
                 name: "Ory Project URL",
@@ -145,7 +160,7 @@ function renderManifest(version) {
  * `GEMINI.md`. For the bundled extension that's the `gemini-extension`
  * directory; for the manual-setup fallback it's `<projectDir>/.gemini`.
  */
-function installGeminiOryAssets(root) {
+function installGeminiOryAssets(root, runtime) {
     const version = readPackageVersion();
     fs.mkdirSync(root, { recursive: true });
     const skillsDir = path.join(root, "skills");
@@ -159,8 +174,8 @@ function installGeminiOryAssets(root) {
     }
     const hooksDir = path.join(root, "hooks");
     fs.mkdirSync(hooksDir, { recursive: true });
-    fs.writeFileSync(path.join(hooksDir, "hooks.json"), JSON.stringify(renderHooks(version), null, 2) + "\n");
-    fs.writeFileSync(path.join(root, "gemini-extension.json"), JSON.stringify(renderManifest(version), null, 2) + "\n");
+    fs.writeFileSync(path.join(hooksDir, "hooks.json"), JSON.stringify(renderHooks((0, argus_1.requireHookCommand)(runtime)), null, 2) + "\n");
+    fs.writeFileSync(path.join(root, "gemini-extension.json"), JSON.stringify(renderManifest(version, runtime.mcpServer), null, 2) + "\n");
 }
 function safeRmEmpty(dir) {
     try {

package/dist/cli/main.js

@@ -57,10 +57,73 @@ const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
  * finds via the shell. POSIX shells resolve the bare name directly.
  */
 const SPAWN_VIA_SHELL = process.platform === "win32";
+/**
+ * How long to let `gemini extensions install|link` run before giving up.
+ *
+ * Gemini CLI prompts for **folder trust** on a local-path source, and that
+ * prompt does not respect a closed stdin — it blocks indefinitely rather than
+ * defaulting to "no" and exiting. With `stdio: "inherit"` and no timeout the
+ * install hung forever in any non-interactive context (#219), which is worse
+ * than failing: CI and scripted installs stall until something external kills
+ * them, and no shim is ever generated.
+ *
+ * Note this is *not* fixed by `--consent`, which covers extension security, a
+ * separate mechanism from folder trust (verified: the prompt still appears with
+ * `--consent` and with `--consent --skip-settings`).
+ */
+const GEMINI_CLI_TIMEOUT_MS = 45_000;
+/**
+ * True when there is a human who could answer an interactive prompt.
+ *
+ * With no TTY on stdin nobody can respond to the folder-trust prompt, so we
+ * never start a command that will sit on it — we go straight to `manualSetup`,
+ * which produces the same working install without the harness CLI.
+ */
+function canAnswerPrompts() {
+    return Boolean(process.stdin.isTTY);
+}
+/**
+ * Run a `gemini extensions …` subcommand, returning whether it succeeded.
+ *
+ * Any non-success — a real failure, a timeout, or the binary not being
+ * spawnable — is reported as `false` so every caller degrades to `manualSetup`
+ * rather than leaving the user with a half-finished install.
+ */
+function runGeminiExtensions(argv) {
+    const result = (0, node_child_process_1.spawnSync)("gemini", [...argv], {
+        stdio: "inherit",
+        shell: SPAWN_VIA_SHELL,
+        timeout: GEMINI_CLI_TIMEOUT_MS,
+    });
+    if (result.status === 0)
+        return { ok: true };
+    // spawnSync reports a timeout by killing the child: `signal` is set (and
+    // `error.code` is ETIMEDOUT), with `status` null rather than a real exit code.
+    if (result.signal || result.error?.code === "ETIMEDOUT") {
+        return {
+            ok: false,
+            reason: `timed out after ${GEMINI_CLI_TIMEOUT_MS / 1000}s — Gemini CLI is most likely ` +
+                `waiting on its folder-trust prompt for the extension directory`,
+        };
+    }
+    if (result.error)
+        return { ok: false, reason: result.error.message };
+    return { ok: false, reason: `exited with status ${result.status}` };
+}
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
         case "install":
+            if (args.includes("--print")) {
+                process.argv = ["node", "setup.js", ...args];
+                require("./setup.js");
+                break;
+            }
             (0, argus_1.beginDeferNextSteps)();
             install(args);
             (0, argus_1.runPostInstall)("ory-gemini", "gemini-cli", args).then(() => process.exit(0), (err) => {
@@ -70,7 +133,10 @@ function main() {
             break;
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "gemini-cli",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -79,7 +145,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-gemini", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-gemini", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-gemini", "gemini-cli", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -99,17 +165,11 @@ function main() {
                 process.exit(1);
             });
             break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-gemini", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
         case "watch":
-            (0, argus_1.runWatchCommand)("gemini-cli", args);
+            (0, argus_1.runWatchCommand)("ory-gemini", "gemini-cli", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
             break;
-        case "dashboard":
-            (0, argus_1.runDashboardCommand)("ory-gemini", "gemini-cli", args).then((code) => process.exit(code), (err) => {
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-gemini", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -137,46 +197,53 @@ function install(args) {
     // extension dir before handing it to `gemini extensions install/link`,
     // which copies/symlinks the whole tree into ~/.gemini/extensions/ory.
     console.log("Materializing Ory skills and commands into the extension...");
-    (0, assets_js_1.installGeminiOryAssets)(EXTENSION_DIR);
+    const runtime = (0, assets_js_1.wireGeminiRuntime)(args);
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
+    (0, assets_js_1.installGeminiOryAssets)(EXTENSION_DIR, runtime);
     const geminiAvailable = (0, node_child_process_1.spawnSync)("gemini", ["--version"], {
         stdio: "pipe",
         shell: SPAWN_VIA_SHELL,
     }).status === 0;
-    if (geminiAvailable) {
-        if (isLink) {
-            console.log("Linking Ory extension for development...");
-            const result = (0, node_child_process_1.spawnSync)("gemini", ["extensions", "link", EXTENSION_DIR], { stdio: "inherit", shell: SPAWN_VIA_SHELL });
-            if (result.status === 0) {
-                console.log("");
-                console.log("Ory extension linked for development.");
-                printQuickstart();
-                (0, argus_1.printEnvHelp)("ory-gemini");
-            }
-            else {
-                console.error("gemini extensions link failed. Falling back to manual setup...");
-                manualSetup(args);
-            }
-        }
-        else {
-            console.log("Installing Ory extension...");
-            const result = (0, node_child_process_1.spawnSync)("gemini", ["extensions", "install", EXTENSION_DIR], { stdio: "inherit", shell: SPAWN_VIA_SHELL });
-            if (result.status === 0) {
-                console.log("");
-                console.log("Ory extension installed.");
-                printQuickstart();
-                (0, argus_1.printEnvHelp)("ory-gemini");
-            }
-            else {
-                console.error("");
-                console.error("gemini extensions install failed. Falling back to manual setup...");
-                manualSetup(args);
-            }
-        }
-    }
-    else {
+    if (!geminiAvailable) {
         console.log("Gemini CLI not found on PATH. Using manual setup...");
         manualSetup(args);
+        return;
+    }
+    // Gemini CLI prompts for folder trust on a local-path source and will sit on
+    // that prompt forever with no one to answer it. Don't start it (#219).
+    if (!canAnswerPrompts()) {
+        console.log("No interactive terminal — skipping the Gemini CLI extension command, " +
+            "which would wait on its folder-trust prompt. Using manual setup...");
+        manualSetup(args);
+        return;
+    }
+    const verb = isLink ? "link" : "install";
+    console.log(isLink ? "Linking Ory extension for development..." : "Installing Ory extension...");
+    // `--consent` acknowledges the extension-security prompt. It does not cover
+    // folder trust, but the user opted in by running this command, so there is no
+    // reason to ask them twice.
+    const outcome = runGeminiExtensions([
+        "extensions",
+        verb,
+        EXTENSION_DIR,
+        "--consent",
+    ]);
+    if (outcome.ok) {
+        console.log("");
+        console.log(isLink ? "Ory extension linked for development." : "Ory extension installed.");
+        printQuickstart();
+        (0, argus_1.printEnvHelp)("ory-gemini");
+        return;
     }
+    console.error("");
+    console.error(`gemini extensions ${verb} failed (${outcome.reason}).`);
+    console.error("Falling back to manual setup...");
+    manualSetup(args);
 }
 function uninstall(args) {
     const geminiAvailable = (0, node_child_process_1.spawnSync)("gemini", ["--version"], {
@@ -237,11 +304,11 @@ Commands:
   uninstall              Remove the Ory extension from Gemini CLI
   configure              Set or view Ory project URL and API key
   agent <cmd>            Manage the agent's OAuth2 (DCR) identity (status, unregister)
-  permissions <cmd>      Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
+  permissions            Show the live permission mode and per-tool coverage
   setup [--project-dir]  Write hooks directly to settings.json (fallback)
   status                 Show plugin status and configuration
-  dashboard            Open the Ory Agent dashboard (system health + configuration)
-  watch [trace-file]     Tail the trace stream (OTel spans) live
+  watch [--json] [--lines <count>]
+                         Follow the live activity/debug log
   version                Show version and the ory-agent-plugins build commit
   local <cmd>            Manage local Ory dev environment (up, down, status, seed, ...)
 

package/dist/cli/setup.js

@@ -52,8 +52,7 @@ const PACKAGE_NAME = "@ory/gemini-cli";
 function getSettingsPath(args) {
     return path.join(args.projectDir, ".gemini", "settings.json");
 }
-function generateHooksConfig() {
-    const cmd = (0, argus_1.resolveHookCommand)(PACKAGE_NAME, BIN_NAME);
+function generateHooksConfig(cmd) {
     return {
         SessionStart: (0, argus_1.matcherHookEntry)(cmd),
         SessionEnd: (0, argus_1.matcherHookEntry)(cmd),
@@ -70,9 +69,9 @@ function main() {
         process.exit(0);
     }
     const args = (0, argus_1.parseSetupArgs)();
-    const hooksConfig = generateHooksConfig();
     if (args.print) {
-        console.log(JSON.stringify({ hooks: hooksConfig }, null, 2));
+        // Nothing is resolved or written on a --print run.
+        console.log(JSON.stringify({ hooks: generateHooksConfig('node "<runtime shim>"') }, null, 2));
         return;
     }
     const settingsPath = getSettingsPath(args);
@@ -89,12 +88,26 @@ function main() {
         (0, assets_js_1.uninstallGeminiOryAssets)(geminiDir);
         console.log(`Removed Ory hooks and MCP server from ${settingsPath}`);
         console.log(`Removed Ory skills and commands from ${geminiDir}`);
+        (0, argus_1.removeRuntimeWiring)("gemini-cli");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         return;
     }
+    const runtime = (0, assets_js_1.wireGeminiRuntime)(process.argv.slice(2));
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
+    const hooksConfig = generateHooksConfig((0, argus_1.requireHookCommand)(runtime));
     let merged = (0, argus_1.mergeMatcherHooks)(existing, hooksConfig, BIN_NAME);
-    merged = (0, argus_1.mergeMcpServer)(merged);
+    if (runtime.mcpServer) {
+        merged = (0, argus_1.mergeMcpServer)(merged, runtime.mcpServer);
+    }
     (0, argus_1.writeJsonFile)(settingsPath, merged);
-    (0, assets_js_1.installGeminiOryAssets)(geminiDir);
+    (0, assets_js_1.installGeminiOryAssets)(geminiDir, runtime);
     console.log(`Ory hooks and MCP server installed to ${settingsPath}`);
     console.log(`Ory skills and commands installed to ${geminiDir}`);
     (0, argus_1.printNextSteps)("Gemini CLI", "npx -y -p @ory/gemini-cli ory-gemini-setup --uninstall", {
@@ -107,7 +120,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "gemini-cli",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/handlers.js

@@ -12,12 +12,7 @@ async function handleHookEvent(input, client, deps = {}) {
         sessionId: input.session_id,
         toolName: input.tool_name,
     });
-    // Set trace context so all spans within this hook invocation correlate
-    client.tracer.setContext({
-        traceId: (0, argus_1.deriveTraceId)(input.session_id),
-        sessionId: input.session_id,
-    });
-    try {
+    return (0, argus_1.withHookContext)(client, { sessionId: input.session_id }, async () => {
         switch (event) {
             case "SessionStart":
                 return await handleSessionStart(input, client, deps);
@@ -35,15 +30,12 @@ async function handleHookEvent(input, client, deps = {}) {
                 return await handlePreCompress(input, client);
             default:
                 client.logger.debug("hook.passthrough", { event });
-                client.tracer.record("hook.passthrough", "skipped", {
+                client.logger.activity("hook.passthrough", "skipped", {
                     attributes: { event },
                 });
                 return {};
         }
-    }
-    finally {
-        client.tracer.clearContext();
-    }
+    });
 }
 // ─── SessionStart ───────────────────────────────────────────────────
 async function handleSessionStart(input, client, deps) {
@@ -52,28 +44,13 @@ async function handleSessionStart(input, client, deps) {
         source: input.source,
         cwd: input.cwd,
     });
-    client.tracer.record("session.start", "ok", {
-        attributes: { source: input.source },
-    });
-    // The user login runs every session and never blocks — it refreshes
-    // persisted tokens, prompts on a TTY when needed, and emits the user.auth
-    // audit span. Enforcement is governed solely by permissionMode at
-    // tool-call time.
-    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    await userGate(client, {
+    await (0, argus_1.sessionStart)(client, {
         binName: "ory-gemini",
         harness: "gemini-cli",
+        userLogin: deps.userLogin,
+        agentGate: deps.agentGate,
+        activityAttributes: { source: input.source },
     });
-    // Resolve the agent identity (machine credentials). Never blocks;
-    // attaches the agent's bearer token to outgoing Ory API calls.
-    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "gemini-cli" });
-    // Record the user→agent delegation so the audit trail captures that
-    // this user authorized this agent for this session. Written at most once
-    // per install. Best-effort: requires both principals to be populated, and
-    // any failure is logged and swallowed (fail-open — delegation tracking is
-    // for audit, not enforcement).
-    await (0, argus_1.writeUserDelegatesAgent)(client);
     return {};
 }
 // ─── BeforeTool ────────────────────────────────────────────────────
@@ -84,106 +61,22 @@ async function handleBeforeTool(input, client) {
         toolName,
         toolInput: input.tool_input,
     });
-    const inputSummary = (0, argus_1.summarizeToolInput)(toolName, input.tool_input);
-    // In audit-only mode, log the invocation but skip permission checks
-    if ((0, argus_1.resolveConfig)().auditOnly) {
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { toolName, ...inputSummary },
-        });
-        return {};
-    }
-    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
-    const subjectId = (0, argus_1.subjectLabel)(subject);
     const mcpTool = (0, argus_1.parseGeminiMcpTool)(toolName, input.mcp_context);
-    try {
-        if (mcpTool) {
-            const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                subject,
-                spanAttributes: { toolName },
-            });
-            const mcpAttrs = {
-                toolName,
-                mcpServer: mcpTool.serverName,
-                mcpTool: mcpTool.toolName,
-                ...inputSummary,
-            };
-            const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                object: mcpTool.serverName,
-                relation: "use",
-                subjectId,
-                ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                spanAttributes: mcpAttrs,
-            });
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs },
-                });
-                return {};
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return {};
-            }
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-            });
-            return {
-                decision: "deny",
-                reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, mcp: mcpTool }),
-                systemMessage: (0, argus_1.formatDenialSummary)({ tool: toolName, subjectId, mcp: mcpTool }),
-            };
-        }
-        const namespace = resolveNamespace();
-        const outcome = await (0, argus_1.gateToolCall)(client, {
-            harness: "gemini-cli",
-            toolName,
-            check: { namespace, object: toolName, relation: "use", ...subject },
-            spanAttributes: { toolName },
-        });
-        // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-        // user.interaction span is already recorded; pass through.
-        if (outcome.kind === "interactive") {
-            return {};
-        }
-        const decision = outcome;
-        if (decision.kind === "fail_open") {
-            return handlePermissionError(decision.error, toolName, client);
-        }
-        const attrs = { toolName, ...inputSummary };
-        const decisionAttrs = decision.spanAttributes;
-        if (decision.kind === "allow") {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: true },
-            });
-            return {};
-        }
-        if (decision.kind === "observe") {
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-            });
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-            });
-            return {};
-        }
-        client.tracer.record("tool.block", "denied", {
-            attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-        });
+    const result = await (0, argus_1.gate)(client, {
+        harness: "gemini-cli",
+        toolName,
+        toolArgs: input.tool_input,
+        subjectFallback: `session:${input.session_id}`,
+        mcpTool: mcpTool ?? undefined,
+    });
+    if (result.blocked && result.denialContext) {
         return {
             decision: "deny",
-            reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }),
-            systemMessage: (0, argus_1.formatDenialSummary)({ tool: toolName, subjectId, namespace }),
+            reason: result.denialMessage,
+            systemMessage: (0, argus_1.formatDenialSummary)(result.denialContext),
         };
     }
-    catch (err) {
-        return handlePermissionError(err, toolName, client);
-    }
+    return {};
 }
 // ─── AfterTool ─────────────────────────────────────────────────────
 async function handleAfterTool(input, client) {
@@ -193,12 +86,10 @@ async function handleAfterTool(input, client) {
         toolName,
         toolResponse: input.tool_response,
     });
-    client.tracer.record("tool.complete", "ok", {
-        attributes: {
-            toolName,
-            ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
-            ...(0, argus_1.summarizeToolOutput)(toolName, input.tool_response),
-        },
+    (0, argus_1.complete)(client, {
+        toolName,
+        input: input.tool_input,
+        output: input.tool_response,
     });
     return {};
 }
@@ -208,7 +99,7 @@ async function handleSessionEnd(input, client) {
         sessionId: input.session_id,
         reason: input.reason,
     });
-    client.tracer.record("session.end", "ok", {
+    client.logger.activity("session.end", "ok", {
         attributes: { reason: input.reason },
     });
     return {};
@@ -219,14 +110,14 @@ async function handleSessionEnd(input, client) {
 // payload (containing the candidate tool list). The hook can return
 // `hookSpecificOutput.toolConfig.{ mode, allowedFunctionNames }` to filter
 // the model's tool surface in one shot, collapsing many BeforeTool denials
-// into one upstream check. We currently emit an audit span only — a future
+// into one upstream check. We currently emit an activity event only — a future
 // enhancement should extract `tools` from `llm_request` and call
 // `client.batchCheckPermissions()` to populate `allowedFunctionNames`.
 async function handleBeforeToolSelection(input, client) {
     client.logger.info("lifecycle.before_tool_selection", {
         sessionId: input.session_id,
     });
-    client.tracer.record("permission.batch_check", "ok", {
+    client.logger.activity("permission.batch_check", "ok", {
         attributes: { stage: "before_tool_selection" },
     });
     return {};
@@ -241,10 +132,10 @@ async function handleNotification(input, client) {
         notificationType: input.notification_type,
         message: input.message,
     });
-    client.tracer.record("notification", "ok", {
+    client.logger.activity("notification", "ok", {
         attributes: {
             notificationType: input.notification_type,
-            message: input.message,
+            messageBytes: input.message ? Buffer.byteLength(input.message, "utf8") : undefined,
         },
     });
     return {};
@@ -255,35 +146,8 @@ async function handlePreCompress(input, client) {
         sessionId: input.session_id,
         trigger: input.trigger,
     });
-    client.tracer.record("compaction", "ok", {
+    client.logger.activity("compaction", "ok", {
         attributes: { trigger: input.trigger, stage: "pre_compress" },
     });
     return {};
 }
-// ─── Helpers ────────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-function handlePermissionError(oryErr, toolName, client) {
-    if (oryErr.code === "network_error") {
-        client.logger.warn("permission.network_error", {
-            toolName,
-            message: "Ory unreachable, failing open",
-        });
-        return {};
-    }
-    if (oryErr.code === "rate_limited") {
-        client.logger.warn("permission.rate_limited", {
-            toolName,
-            message: "Ory rate limited, failing open",
-        });
-        return {};
-    }
-    // For other errors, also fail open but log prominently
-    client.logger.error("permission.check.error", {
-        toolName,
-        code: oryErr.code,
-        message: oryErr.message,
-    });
-    return {};
-}

package/dist/hook.js

@@ -10,6 +10,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const argus_1 = require("@ory/argus");
 const handlers_js_1 = require("./handlers.js");
+const EVENT_FLUSH_TIMEOUT_MS = 750;
+let client;
+async function flushEvents() {
+    try {
+        await client?.flushEvents(EVENT_FLUSH_TIMEOUT_MS);
+    }
+    catch {
+        // The hook decision must not depend on activity delivery.
+    }
+}
 /**
  * Read all of stdin as a string.
  *
@@ -43,7 +53,7 @@ function readStdin() {
     });
 }
 async function main() {
-    const client = argus_1.OryAgentClient.fromEnv("gemini-cli");
+    client = argus_1.OryAgentClient.fromEnv("gemini-cli");
     const raw = await readStdin();
     let input;
     try {
@@ -51,13 +61,12 @@ async function main() {
     }
     catch {
         client.logger.error("hook.stdin.parse_failed", { raw: raw.slice(0, 200) });
-        await client.tracer.shutdown();
         process.exit(0); // Don't block on parse errors
     }
     const output = await (0, handlers_js_1.handleHookEvent)(input, client);
     if (output.decision === "deny" || output.decision === "block") {
         process.stdout.write(JSON.stringify(output));
-        await client.tracer.shutdown();
+        await flushEvents();
         process.exit(2);
     }
     if (output.hookSpecificOutput ||
@@ -65,10 +74,11 @@ async function main() {
         output.decision === "allow") {
         process.stdout.write(JSON.stringify(output));
     }
-    await client.tracer.shutdown();
+    await flushEvents();
     process.exit(0);
 }
-main().catch((err) => {
+main().catch(async (err) => {
     process.stderr.write(`[ory-agent] fatal: ${err}\n`);
+    await flushEvents();
     process.exit(0); // Fail open
 });

package/gemini-extension/GEMINI.md

@@ -24,25 +24,29 @@ tool call.
 ## Slash commands
 
 - `/ory:local-up` — start a local Ory instance in Docker (Identities, OAuth2,
-  Permissions, plus a login UI on `:4455` (not :3000, to avoid Next.js port conflicts) and Jaeger on `:16686`, reachable
+  Permissions, plus a login UI on `:4455` (not :3000, to avoid Next.js port conflicts), reachable
   through `http://localhost:4000`). Prints seeded test-user credentials.
 - `/ory:local-down` — tear it all down.
 
 ## Permission mode
 
 After install the extension runs in **observe** mode by default: permission
-denies are recorded as audit spans but tools still execute. Tell the user to
-run `npx -y -p @ory/gemini-cli ory-gemini permissions enforce` once their
-permission set is correct.
+denies are recorded as activity events but tools still execute. The mode is a
+property of the Ory project, read on every session — tell the user that someone
+with access to the project promotes it to **enforce** in the Ory Console (Agent
+Security) once the permission set is correct. There is no CLI command that sets
+it; the plugin only reads it.
 
 If a tool call *is* blocked, the denial reason names the missing relation.
-Suggest `npx -y -p @ory/gemini-cli ory-gemini permissions bootstrap` (grants
-`use` on every built-in tool to the current user) or ask the Ory MCP server
-to write a specific relation tuple.
+Suggest `npx -y -p @ory/gemini-cli ory-gemini permissions` to see exactly
+which tools lack a grant, then have the grant added in the Ory Console (or via
+the Ory MCP server, which can write relations on the user's behalf).
 
 ## Diagnostics
 
 - `npx -y -p @ory/gemini-cli ory-gemini status` — show configuration and
   installation state.
-- Set `ORY_AGENT_DEBUG=true` and `ORY_AGENT_LOG_FILE=~/.config/ory-agent-plugins/ory.log`
-  to capture structured logs.
+- Privacy-safe activity is always appended to the default
+  `~/.config/ory-agent-plugins/gemini-cli/ory-agent-debug.log`; tail it with `jq`.
+- Launch Gemini CLI with `ORY_AGENT_DEBUG=true` for the complete live JSON stream
+  on stderr plus verbose local diagnostics. Secrets are recursively redacted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/gemini-cli",
-  "version": "0.14.0",
+  "version": "1.0.1",
   "description": "Ory extension for Gemini CLI: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -36,8 +36,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -48,6 +47,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -63,13 +66,12 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo",
     "gemini-extension"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.1"
   },
   "engines": {
     "node": ">=22"
@@ -79,7 +81,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }