## Summary
- preserve the existing `agentkey.skill` GitHub Release asset and add
platform-named Gemini extension archives for macOS, Linux, and Windows
- opt the Gemini extension into native first-connect OAuth with
`oauth.enabled`, while keeping `/mcp auth agentkey` as the manual retry
path
- add explicit Gemini, Antigravity 2.0, and Antigravity CLI
authentication and connection-verification guidance
- explain Gemini's user-Skill precedence warning and avoid duplicate MCP
registrations when an extension or plugin already owns the server entry
- add regression coverage and trigger the scripts test workflow when
authentication guidance or release packaging changes
## Root causes
Gemini CLI treats a lone generic GitHub Release asset as the extension
archive. AgentKey releases currently publish only `agentkey.skill`, but
Gemini CLI extracts only `.tar.gz` and `.zip` extension archives. After
that extraction failure, Gemini retries Git clone in the same non-empty
temporary directory and fails again.
Separately, the Gemini manifest omitted `oauth.enabled`. Gemini
discovered that AgentKey required OAuth, but only reported `/mcp auth
agentkey` instead of starting the browser flow automatically. A
pre-existing user Skill at `~/.agents/skills/agentkey` can also override
the extension-bundled Skill, hiding new setup guidance even though the
extension MCP entry is active.
## Authentication design
- Gemini uses `httpUrl` plus `oauth.enabled: true`; OAuth endpoints and
client registration remain dynamically discovered.
- Antigravity keeps the documented credential-free `serverUrl`
configuration and uses DCR through its native Authenticate controls.
- No static access token, Authorization header, OAuth client secret, or
hard-coded authorization endpoint is added to either package.
## Validation
- Bats suite: 27/27 passing
- `gemini extensions validate .`
- built and inspected `agentkey.skill`, `darwin.agentkey.tar.gz`,
`linux.agentkey.tar.gz`, and `win32.agentkey.zip`
- verified both Gemini platform archive formats contain `oauth.enabled:
true`, `gemini-extension.json`, and `skills/agentkey/SKILL.md`
- validated workflow YAML, shell syntax, archive roots, manifest
invariants, and `git diff --check`
- verified the live AgentKey endpoint advertises protected-resource
metadata, PKCE, and a dynamic client registration endpoint
## Release coordination
Merge this fix before release PR #92 so the first Gemini-enabled release
publishes compatible archives and the corrected first-connect OAuth
behavior.
---------
Co-authored-by: Allen <0xfatdog@gmail.com>
zzAllenn