mirror of
https://github.com/chainbase-labs/Agentkey.git
synced 2026-09-20 14:20:23 +08:00
zzAllenn
fbec683e87
## Summary - preserve the existing `agentkey.skill` GitHub Release asset and add platform-named Gemini extension archives for macOS, Linux, and Windows - opt the Gemini extension into native first-connect OAuth with `oauth.enabled`, while keeping `/mcp auth agentkey` as the manual retry path - add explicit Gemini, Antigravity 2.0, and Antigravity CLI authentication and connection-verification guidance - explain Gemini's user-Skill precedence warning and avoid duplicate MCP registrations when an extension or plugin already owns the server entry - add regression coverage and trigger the scripts test workflow when authentication guidance or release packaging changes ## Root causes Gemini CLI treats a lone generic GitHub Release asset as the extension archive. AgentKey releases currently publish only `agentkey.skill`, but Gemini CLI extracts only `.tar.gz` and `.zip` extension archives. After that extraction failure, Gemini retries Git clone in the same non-empty temporary directory and fails again. Separately, the Gemini manifest omitted `oauth.enabled`. Gemini discovered that AgentKey required OAuth, but only reported `/mcp auth agentkey` instead of starting the browser flow automatically. A pre-existing user Skill at `~/.agents/skills/agentkey` can also override the extension-bundled Skill, hiding new setup guidance even though the extension MCP entry is active. ## Authentication design - Gemini uses `httpUrl` plus `oauth.enabled: true`; OAuth endpoints and client registration remain dynamically discovered. - Antigravity keeps the documented credential-free `serverUrl` configuration and uses DCR through its native Authenticate controls. - No static access token, Authorization header, OAuth client secret, or hard-coded authorization endpoint is added to either package. ## Validation - Bats suite: 27/27 passing - `gemini extensions validate .` - built and inspected `agentkey.skill`, `darwin.agentkey.tar.gz`, `linux.agentkey.tar.gz`, and `win32.agentkey.zip` - verified both Gemini platform archive formats contain `oauth.enabled: true`, `gemini-extension.json`, and `skills/agentkey/SKILL.md` - validated workflow YAML, shell syntax, archive roots, manifest invariants, and `git diff --check` - verified the live AgentKey endpoint advertises protected-resource metadata, PKCE, and a dynamic client registration endpoint ## Release coordination Merge this fix before release PR #92 so the first Gemini-enabled release publishes compatible archives and the corrected first-connect OAuth behavior. --------- Co-authored-by: Allen <0xfatdog@gmail.com>