fix(codex): stabilize plugin gateway bootstrap

README.md

@@ -120,10 +120,15 @@ and provider settings for that launched process, then shuts the gateway down
 when the agent exits.
 
 > [!WARNING]
-> If generated hooks are inactive, Codex users must review and activate them
-> before events appear. The Codex Desktop App has additional limitations.
+> `nemo-relay install codex` automatically trusts only the exact hooks owned by
+> `nemo-relay-plugin@nemo-relay-local`. It does not trust unrelated user,
+> project, or plugin hooks. Manual or source-marketplace installs can still
+> require review. Restart an already running Codex app after persistent
+> installation. On Windows, a restrictive host Job Object can keep the shared
+> Relay gateway scoped to the host process lifetime.
+> The Codex Desktop App has additional limitations.
 > Refer to the [Codex CLI guide](https://docs.nvidia.com/nemo/relay/nemo-relay-cli/codex) for the
-> current hook activation caveat and troubleshooting steps.
+> current lifecycle, startup, and troubleshooting details.
 
 #### 4. Verify the Run
 
@@ -287,7 +292,7 @@ coverage.
 | Agent | Observability | Security | Optimization | Notes |
 |:--|:--:|:--:|:--:|:--|
 | Claude Code | Yes | Yes | Partial | Hook forwarding, pre-tool blocking, and gateway-routed LLM observability are supported. |
-| Codex | Yes | Yes | Partial | Hook activation is required; missing session-end behavior limits trajectory finalization and full optimization coverage. |
+| Codex | Yes | Yes | Partial | Persistent install verifies the exact plugin hooks. Each `Stop` finalizes a turn snapshot; `SessionEnd` availability remains Codex-version-dependent. |
 | Hermes Agent | Yes | Yes | Partial | Hook forwarding, pre-tool blocking, and gateway-routed or hook-backed LLM observability are supported. |
 
 ### Public API Integrations

crates/cli/Cargo.toml

@@ -36,6 +36,7 @@ clap = { version = "4", features = ["derive", "env"] }
 clap_complete = "4"
 console = "0.16"
 futures-util = "0.3"
+fs2 = "0.4"
 http = "1"
 http-body-util = "0.1"
 dialoguer = { version = "0.11", default-features = false, features = ["password"] }
@@ -44,18 +45,26 @@ percent-encoding = "2"
 reqwest = { version = "0.12", default-features = false, features = ["charset", "http2", "json", "rustls-tls-native-roots", "stream"] }
 regex = "1"
 ring = "0.17"
+semver = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
 sha2 = "0.11"
 strum = { version = "0.27", features = ["derive"] }
+subtle = "2"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { version = "1", features = ["io-std", "io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
 tokio-tungstenite = { version = "0.27", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
 toml = "0.9"
 toml_edit = "0.23"
 uuid = { workspace = true, features = ["serde", "v7"] }
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security", "Win32_System_JobObjects", "Win32_System_Threading"] }
+
 [dev-dependencies]
 opentelemetry = { workspace = true, features = ["trace"] }
 opentelemetry_sdk = { workspace = true, features = ["trace", "testing"] }