@ory/gemini-cli 1.2.4 → 1.3.1

package/README.md

@@ -119,7 +119,7 @@ npx -y -p @ory/gemini-cli ory-gemini configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions, so installing it needs no workspace privilege. Each Gemini session registers its own identity automatically on first use.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Gemini's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
@@ -132,7 +132,7 @@ ory-gemini install | uninstall        Install (add --project-url to also connect
 ory-gemini status                     Show configuration, identities, native tool access, recent activity
 ory-gemini permissions <cmd>          status  (read-only; blocks + posture live in the Ory Console)
 ory-gemini configure <flags>          Connect a project (--project-url) or --disconnect
-ory-gemini agent <status|unregister>  Manage Gemini's own auto-created identity
+ory-gemini agent <status|unregister>  Inspect runtime status / clear legacy OAuth state
 ory-gemini local <up|down|status|…>   Run / manage a local Ory in Docker
 ory-gemini version                    Print plugin, core, and Node versions (--json for machine-readable)
 ```
@@ -142,7 +142,7 @@ All prefixed with `npx -y -p @ory/gemini-cli`.
 ## Troubleshooting
 
 - **`/ory:local-up` fails** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** (after connecting) — reset with `ory-gemini agent unregister` and try again.
+- **Browser sign-in loops** (after connecting) — confirm the reserved login client has all four documented loopback redirect URIs; `agent unregister` only clears legacy agent OAuth state.
 - **Running an older CLI than expected** — `npx -p @ory/gemini-cli` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/gemini-cli ory-gemini version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/gemini-cli ory-gemini install`. Pinning an exact version (`@ory/gemini-cli@<version>`) also bypasses the cached copy.
 
 ## Learn more

package/dist/cli/assets.js

@@ -129,10 +129,9 @@ function renderHooks(command) {
  *  - `contextFileName: GEMINI.md` for the model-facing context briefing.
  *  - `mcpServers.ory` so the Ory MCP server is auto-registered alongside
  *    the hooks, started from the resolved runtime via its shim.
- *  - A minimal `settings` block. Only `ORY_PROJECT_URL` is prompted now —
- *    the agent identity is resolved via Dynamic Client Registration, and
- *    the legacy ORY_API_KEY / ORY_SESSION_TOKEN prompts were teaching
- *    users the deprecated path.
+ *  - A minimal `settings` block. Only `ORY_PROJECT_URL` is prompted; session
+ *    start resolves or enrolls the Talos runtime identity, and legacy admin
+ *    key/session-token prompts taught users the wrong path.
  */
 function renderManifest(version, mcpServer) {
     return {

package/dist/cli/main.js

@@ -132,11 +132,11 @@ function main() {
             });
             break;
         case "uninstall":
-            uninstall(args);
+            const geminiUninstalled = uninstall(args);
             (0, argus_1.clearCredentialsForUninstall)({
                 harness: "gemini-cli",
                 purge: args.includes("--purge"),
-            }).then(() => process.exit(0), (err) => {
+            }).then(() => process.exit(geminiUninstalled ? 0 : 1), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -250,18 +250,19 @@ function uninstall(args) {
         stdio: "pipe",
         shell: SPAWN_VIA_SHELL,
     }).status === 0;
+    let nativeUninstalled = true;
     if (geminiAvailable) {
         console.log("Uninstalling Ory extension...");
-        (0, node_child_process_1.spawnSync)("gemini", ["extensions", "uninstall", "ory"], {
-            stdio: "inherit",
-            shell: SPAWN_VIA_SHELL,
-        });
-    }
-    else {
-        const setupArgs = ["--uninstall", ...args];
-        process.argv = ["node", "setup.js", ...setupArgs];
-        require("./setup.js");
+        const outcome = runGeminiExtensions(["extensions", "uninstall", "ory"]);
+        if (!outcome.ok) {
+            nativeUninstalled = false;
+            console.error(`gemini extensions uninstall failed (${outcome.reason}). Continuing with manual cleanup...`);
+        }
     }
+    const setupArgs = ["--uninstall", ...args];
+    process.argv = ["node", "setup.js", ...setupArgs];
+    require("./setup.js");
+    return nativeUninstalled;
 }
 function manualSetup(args) {
     process.argv = ["node", "setup.js", ...args];
@@ -303,7 +304,7 @@ Commands:
   install [--link]       Install the Ory extension into Gemini CLI
   uninstall              Remove the Ory extension from Gemini CLI
   configure              Set or view Ory project URL and API key
-  agent <cmd>            Manage the agent's OAuth2 (DCR) identity (status, unregister)
+  agent <cmd>            Inspect runtime status or clear legacy OAuth state
   permissions            Show live mode and native allowed/blocked state
   setup [--project-dir]  Write hooks directly to settings.json (fallback)
   status                 Show plugin status and configuration

package/dist/cli/setup.js

@@ -78,15 +78,16 @@ function main() {
     const existing = (0, argus_1.readJsonFile)(settingsPath);
     const geminiDir = path.join(args.projectDir, ".gemini");
     if (args.uninstall) {
-        if (!fs.existsSync(settingsPath)) {
-            console.log("No settings file found. Nothing to uninstall.");
-            return;
+        if (fs.existsSync(settingsPath)) {
+            let updated = (0, argus_1.removeMatcherHooks)(existing, BIN_NAME);
+            updated = (0, argus_1.removeMcpServer)(updated);
+            (0, argus_1.writeJsonFile)(settingsPath, updated);
+            console.log(`Removed Ory hooks and MCP server from ${settingsPath}`);
+        }
+        else {
+            console.log("No settings file found. Skipping hook and MCP cleanup.");
         }
-        let updated = (0, argus_1.removeMatcherHooks)(existing, BIN_NAME);
-        updated = (0, argus_1.removeMcpServer)(updated);
-        (0, argus_1.writeJsonFile)(settingsPath, updated);
         (0, assets_js_1.uninstallGeminiOryAssets)(geminiDir);
-        console.log(`Removed Ory hooks and MCP server from ${settingsPath}`);
         console.log(`Removed Ory skills and commands from ${geminiDir}`);
         (0, argus_1.removeRuntimeWiring)("gemini-cli");
         for (const pruned of (0, argus_1.pruneRuntimeStores)()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/gemini-cli",
-  "version": "1.2.4",
+  "version": "1.3.1",
   "description": "Ory extension for Gemini CLI: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -71,7 +71,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.2.4"
+    "@ory/argus": "1.3.1"
   },
   "engines": {
     "node": ">=22"