feat(cli)!: add MCP-managed shared gateway for coding agents

.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
   "plugins": [
     {
       "name": "nemo-relay-plugin",
-      "description": "Forward Claude Code lifecycle hooks to a local NeMo Relay sidecar.",
+      "description": "Run the shared native Relay gateway and capture Claude Code lifecycle events.",
       "source": "./integrations/coding-agents/claude-code",
       "category": "development"
     }

.config/nextest.toml

@@ -3,3 +3,11 @@
 
 [profile.ci]
 junit = { path = "rust_junit_report.xml" }
+
+[[profile.ci.overrides]]
+filter = 'test(windows_supervision_assigns_before_a_wrapper_can_spawn_a_descendant)'
+slow-timeout = { period = "20s", terminate-after = 2 }
+
+[[profile.ci.overrides]]
+filter = 'test(cli_hook_recovery_consumes_the_same_restart_as_an_overlapping_mcp)'
+slow-timeout = { period = "20s", terminate-after = 2 }

codecov.yml

@@ -69,7 +69,7 @@ component_management:
         - "crates/cli/src"
       statuses:
         - type: project
-          target: 88%
+          target: 90%
           threshold: 0.5%
           base: auto
           if_ci_failed: error
@@ -137,8 +137,9 @@ ignore:
   - "crates/cli/tests/"
   # CLI TTY shells are exercised by smoke tests, but their prompt loops are
   # intentionally split away from testable model modules.
-  - "crates/cli/src/plugins.rs"
-  - "crates/cli/src/setup.rs"
+  - "crates/cli/src/plugins/mod.rs"
+  - "crates/cli/src/plugins/dynamic_editor.rs"
+  - "crates/cli/src/commands/configure/wizard.rs"
   - "**/tests-js/**"
   # The Node binding currently reports JS package coverage separately; exclude the
   # native Rust bridge until we have direct Rust-side coverage for this crate.

crates/cli/Cargo.toml

@@ -34,34 +34,52 @@ async-stream = "0.3"
 axum = "0.8"
 base64 = "0.22"
 bytes = "1"
+chrono = "0.4"
 clap = { version = "4", features = ["derive", "env"] }
 clap_complete = "4"
 console = "0.16"
 futures-util = "0.3"
+fs2 = "0.4"
 http = "1"
 http-body-util = "0.1"
+hyper = "1"
+hyper-util = { version = "0.1", features = ["tokio"] }
 dialoguer = { version = "0.11", default-features = false, features = ["password"] }
 jsonschema = { version = "0.46.6", default-features = false }
 percent-encoding = "2"
 reqwest = { version = "0.12", default-features = false, features = ["charset", "http2", "json", "rustls-tls-native-roots", "stream"] }
 regex = "1"
+rcgen = "0.13"
 ring = "0.17"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
+semver = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
 sha2 = "0.11"
 strum = { version = "0.27", features = ["derive"] }
+subtle = "2"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { version = "1", features = ["io-std", "io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 tokio-tungstenite = { version = "0.27", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
 toml = "0.9"
 toml_edit = "0.23"
 uuid = { workspace = true, features = ["serde", "v7"] }
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_JobObjects", "Win32_System_SystemInformation", "Win32_System_Threading"] }
+
 [dev-dependencies]
 opentelemetry = { workspace = true, features = ["trace"] }
 opentelemetry_sdk = { workspace = true, features = ["trace", "testing"] }
+shell-words = "1"
+syn = { version = "2", features = ["full", "visit"] }
 tempfile = "3"
+tokio = { version = "1", features = ["test-util"] }
 tower = { version = "0.5", features = ["util"] }
 
 [[test]]

crates/cli/src/adapters/claude_code.rs → crates/cli/src/agents/claude/adapter.rs

@@ -4,10 +4,10 @@
 use axum::http::HeaderMap;
 use serde_json::{Value, json};
 
-use crate::adapters::{
+use crate::agents::shared::adapters::{
     AdapterOutcome, CLAUDE_CODE_PAYLOAD_EXTRACTOR, ClassificationRules, classify,
 };
-use crate::model::{AgentKind, NormalizedEvent};
+use crate::events::{AgentKind, NormalizedEvent};
 
 /// Normalizes Claude Code hook payloads and returns the hook response Claude expects.
 ///

crates/cli/src/alignment/claude_code.rs → crates/cli/src/agents/claude/alignment.rs

@@ -11,9 +11,9 @@ use axum::http::HeaderMap;
 use nemo_relay::api::llm::LlmRequest;
 use serde_json::Value;
 
-use crate::alignment::json_string_at;
-use crate::config::header_string;
-use crate::model::{AgentKind, ToolEvent};
+use crate::agents::shared::alignment::json_string_at;
+use crate::configuration::header_string;
+use crate::events::{AgentKind, ToolEvent};
 
 // Identifies gateway providers that should be labeled as Claude-owned when an Anthropic request
 // arrives before a SessionStart hook. Other providers are left generic so mixed gateway traffic
@@ -109,5 +109,5 @@ fn has_terminal_agent_tool_evidence(result: &serde_json::Value) -> bool {
 }
 
 #[cfg(test)]
-#[path = "../../tests/coverage/alignment_claude_code_tests.rs"]
+#[path = "../../../tests/coverage/agents/alignment_claude_code_tests.rs"]
 mod tests;

crates/cli/src/agents/claude/assets.rs

@@ -0,0 +1,42 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use serde_json::{Value, json};
+
+use crate::mcp::SERVER_NAME;
+
+pub(crate) fn marketplace_manifest(marketplace: &str, plugin: &str) -> Value {
+    json!({
+        "name": marketplace,
+        "metadata": { "description": "Local NeMo Relay plugins for Claude Code." },
+        "owner": { "name": "NVIDIA Corporation and Affiliates", "email": "noreply@nvidia.com" },
+        "plugins": [{
+            "name": plugin,
+            "description": "Run the shared native Relay gateway and capture Claude Code lifecycle events.",
+            "source": "./plugins/nemo-relay-plugin",
+            "category": "development"
+        }]
+    })
+}
+
+pub(crate) fn plugin_manifest(plugin: &str) -> Value {
+    json!({
+        "name": plugin,
+        "version": env!("CARGO_PKG_VERSION"),
+        "description": "Native Relay gateway lifecycle and Claude Code hooks for complete local observability.",
+        "author": { "name": "NVIDIA Corporation and Affiliates", "url": "https://github.com/NVIDIA/NeMo-Relay" },
+        "homepage": "https://github.com/NVIDIA/NeMo-Relay",
+        "repository": "https://github.com/NVIDIA/NeMo-Relay",
+        "license": "Apache-2.0",
+        "keywords": ["nemo-relay", "claude-code", "hooks", "observability"],
+        "mcpServers": "./.mcp.json"
+    })
+}
+
+pub(crate) fn mcp_config(mut server: Value) -> Value {
+    server
+        .as_object_mut()
+        .expect("persistent MCP server is a JSON object")
+        .insert("alwaysLoad".into(), json!(true));
+    json!({ "mcpServers": { (SERVER_NAME): server } })
+}

crates/cli/src/agents/claude/doctor.rs

@@ -0,0 +1,6 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+pub(crate) fn hook_status() -> Result<String, String> {
+    Ok("hooks: injected during run".into())
+}