Configuration

ArmorGemini ships with one configurable knob: your ArmorIQ API key. Everything else is hardcoded to the value we have tested as the right default. If you need a different behavior, you can edit scripts/lib/config.mjs in the ArmorGemini install directory, that file is the config.

Authentication

ArmorGemini requires an ArmorIQ API key. The key unlocks audit logs, signed tokens, and dashboard visibility, and is required for the plugin to evaluate tool calls.

armoriq login --product armorgemini

Runs the OAuth device-code flow, opens your browser, saves the key to ~/.armoriq/credentials.json.

Via Environment Variable

export ARMORIQ_API_KEY=ak_live_...

Resolution Order

ArmorGemini looks for the API key in this order:

ARMORIQ_API_KEY environment variable
~/.armoriq/credentials.json (written by armoriq login)

If no key is found, the plugin refuses to evaluate and Gemini surfaces a "no credentials" error. Run armoriq login --product armorgemini to recover.

`~/.gemini/settings.json`

The installer merges a hooks block into your existing ~/.gemini/settings.json. It is idempotent, existing keys are preserved, only the four ArmorGemini hooks are added or updated. The merged block looks like this (with <install-dir> rewritten to the actual path on your machine):

{
  "hooks": {
    "SessionStart": [
      {
        "matcher": "*",
        "hooks": [
          {
            "name": "armorgemini-session-start",
            "type": "command",
            "command": "node <install-dir>/scripts/hook-router.mjs session-start"
          }
        ]
      }
    ],
    "BeforeTool": [
      {
        "matcher": "*",
        "hooks": [
          {
            "name": "armorgemini-before-tool",
            "type": "command",
            "command": "node <install-dir>/scripts/hook-router.mjs before-tool"
          }
        ]
      }
    ],
    "AfterTool": [
      {
        "matcher": "*",
        "hooks": [
          {
            "name": "armorgemini-after-tool",
            "type": "command",
            "command": "node <install-dir>/scripts/hook-router.mjs after-tool"
          }
        ]
      }
    ],
    "SessionEnd": [
      {
        "matcher": "*",
        "hooks": [
          {
            "name": "armorgemini-session-end",
            "type": "command",
            "command": "node <install-dir>/scripts/hook-router.mjs session-end"
          }
        ]
      }
    ]
  }
}

This is the Gemini CLI's native hook format:

Event key (SessionStart, BeforeTool, AfterTool, SessionEnd) is one of the CLI's lifecycle events.
matcher filters which invocations trigger the hook. "*" matches every tool.
hooks[] is an array of hooks that run in order. Each has a name, a type (only command is used here), and a command string that is exec'd with the event payload on stdin.
The command writes a JSON { decision: "allow" | "deny", reason?: string } to stdout. deny blocks the tool call.

Environment Variables

Most behavior is hardcoded to the tested-good default. The ones below still influence behavior:

Variable	Default	Description
`ARMORIQ_API_KEY`	(none)	ArmorIQ API key. Required.
`ARMORGEMINI_DATA_DIR`	`~/.gemini/armorgemini`	Runtime data + policy storage.
`ARMORGEMINI_POLICY_FILE`	`<dataDir>/policy.json`	Override the policy file path.
`ARMORGEMINI_RUNTIME_FILE`	`<dataDir>/runtime.json`	Override the runtime state path.
`ARMORGEMINI_DEBUG`	`false`	Print plugin trace logs to stderr.
`GEMINI_SESSION_ID`	(injected by Gemini CLI)	Per-session routing (not user-set).

If you previously set variables like ARMORGEMINI_MODE, ARMORGEMINI_INTENT_REQUIRED, ARMORGEMINI_VALIDITY_SECONDS, or CSRG_VERIFY_ENABLED, they are no longer read. The plugin uses the tested-good defaults for all behavior toggles. To customize, edit scripts/lib/config.mjs in the ArmorGemini install directory.

Managing the Plugin

ArmorGemini is not a marketplace-managed extension yet, it lives as a hook block in your Gemini settings and a set of TOML slash commands. To manage it, edit those files directly, or use the installer / uninstaller.

Update

cd ~/.armoriq/armorGemini
git pull

Disable temporarily

Comment out (or delete) the ArmorGemini entries under hooks in ~/.gemini/settings.json. Gemini CLI reloads settings on the next gemini invocation.

Uninstall

Remove the four ArmorGemini hook entries from ~/.gemini/settings.json, remove ~/.gemini/commands/armor/, and delete ~/.armoriq/armorGemini if you no longer want the checkout.

# Optional, also remove the ArmorIQ CLI (shared with other Armor* products)
npm uninstall -g @armoriq/sdk
rm -rf ~/.armoriq

Configuration

On this page