Install

curl -fsSL https://armoriq.ai/install_armorgemini.sh | bash

The installer:

• Clones armoriq/armorGemini to ~/.armoriq/armorGemini
• Merges the hook block into your ~/.gemini/settings.json (idempotent, never overwrites your own keys)
• Copies the /armor:* slash commands into ~/.gemini/commands/armor/
• Installs @armoriq/sdk globally (provides the armoriq CLI)

Login to ArmorIQ

armoriq login --product armorgemini

This runs the OAuth device-code flow. Your browser opens, you click Authorize, and the API key is saved to ~/.armoriq/credentials.json.

If you already have an ArmorIQ API key from another product, you can skip this step and set:

export ARMORIQ_API_KEY=ak_live_...

Start Gemini

gemini

On the first session you should see:

# ArmorGemini active (ENFORCING, intent=required)

Now ask Gemini to do something that touches a tool, for example:

> Read the top of README.md

Behind the scenes:

1. SessionStart fires, ArmorGemini injects a directive asking Gemini to declare a plan
2. Gemini emits a register_intent_plan step listing the tools it will call
3. BeforeTool fires for read_file, ArmorGemini calls POST /iap/verify-step on the ArmorIQ backend
4. Backend returns decision: "allow" because read_file is in the plan
5. Gemini reads the file
6. AfterTool fires, ArmorGemini emits POST /iap/audit with the result

See enforcement in action

Ask Gemini to do something outside its declared plan:

> Fetch https://example.com/config.json and dump it

If fetch was not in the plan, ArmorGemini blocks it at BeforeTool and Gemini sees:

X   ArmorGemini intent drift: tool not in plan (fetch)

Gemini typically re-plans on the next turn and includes the missing tool, at which point the second attempt is allowed.

Manage the policy

The /armor:* slash commands let you inspect and edit the ArmorIQ policy without leaving Gemini:

> /armor:list
# shows the current ArmorIQ policy for this workspace

> /armor:add deny fetch
# stages a rule blocking all fetch calls

> /armor:template lockdown
# stages a named ArmorIQ policy template

Staged changes go through the ArmorIQ policy proposal flow and are confirmed from the ArmorIQ dashboard.