feat(cli): add ADLC extension kinds to hsctl with grouped help

[markturansky]

Summary

• Adds `get`, `list`, `create`, and `delete` subcommands for all six ADLC extension kinds: AgentRuntime, SandboxTemplate, ProviderSpec, ProviderBinding, InferenceRoute, SecretSource
• Extension kinds route to `/api/hypershell/ext/` (constants added to `pkg/urls/urls.go`)
• Uses Cobra command groups on `get`, `list`, `create`, `delete` to visually separate Core from Extension resources in help output
• Extension section header reads: experimental, unsupported, subject to change

Help output

$ hsctl get --help
Get a specific resource by ID

Usage:
  hsctl get [command]

Core (hypershell/v1/):
  gateway         Get a gateway by ID
  managedCluster  Get a managedCluster by ID
  role            Get a role by ID
  roleBinding     Get a roleBinding by ID
  serviceAccount  Get an OpenShell gateway service account
  user            Get a user by ID

Extensions (hypershell/ext/) - experimental, unsupported, subject to change:
  agentRuntime    Get an agent runtime by ID
  inferenceRoute  Get an inference route by ID
  providerBinding Get a provider binding by ID
  providerSpec    Get a provider spec by ID
  sandboxTemplate Get a sandbox template by ID
  secretSource    Get a secret source by ID

Test plan

• hsctl get --help shows two groups
• hsctl list --help shows two groups
• hsctl create --help shows two groups
• hsctl delete --help shows two groups
• go build ./... and go vet ./... pass clean

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: ba224c8c-3e76-4ac5-9e0d-cba7eff59a1a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[hypershell-delivery]

Amber review

Status: Complete

View the submitted review.

[hypershell-delivery]

Verdict

The new hsctl extension subcommands remain clean, and the latest commit resolved both style nits: the agentRuntime args struct is now gofmt-aligned and every new command wraps errors with %w. The one substantive item is unchanged and is a merge-ordering dependency rather than a code defect: all extension commands target /api/hypershell/ext/..., while the server on main still serves these kinds under /api/hypershell/v1/... (and nests secret_sources under agent_runtimes), so the CLI is non-functional until the companion server-side move lands.

Findings

[Major] CLI targets /api/hypershell/ext/, but main's server serves /api/hypershell/v1/ (still present)
components/cli/pkg/urls/urls.go:11-17 defines ExtAPIPrefix = "/api/hypershell/ext" and routes all six extension kinds through it; urls_test.go now also codifies this prefix. On main these kinds are still registered on the /api/hypershell/v1 router (components/api-server/plugins/agentRuntimes/plugin.go:42-46), and secret_sources is registered nested under /agent_runtimes/{agent_runtime_id}/secret_sources (components/api-server/plugins/secretSources/plugin.go:46), not as a flat top-level resource. Merged on its own, all 24 new commands would 404. This is a merge-ordering dependency on the server-side relocation - see Cross-PR coordination. I am not re-posting an inline comment; the existing inline thread tracks this: #466 (comment)

Cross-PR coordination

Two coordination items need a maintainer decision:

• #462 is the server-side counterpart and must land first (or together). It moves all six ADLC extension kinds from /api/hypershell/v1/ to /api/hypershell/ext/ and flattens secret_sources to a top-level route - exactly the surface this CLI assumes (ExtAPIPrefix, flat SecretSourcesPath). If this PR merges before that server move, the new hsctl commands point at endpoints that do not exist on main and will 404. Maintainers should gate this PR on #462 or sequence them together.

• #447 adds gatewayAccess CLI subcommands into the same create/list/delete registration files that this PR restructures. This PR introduces a core/ext help-grouping convention (Cmd.AddGroup(groupCore, groupExt) plus a GroupID on every subcommand in create/cmd.go, list/cmd.go, get/cmd.go, delete/cmd.go). #447 registers its new commands with a plain AddCommand and no GroupID. Whichever PR merges second must assign the other PR's new commands to the correct group, or the un-grouped commands fall outside the Core/Extensions taxonomy as cobra "Additional Commands". The owners should agree on who adds the GroupID wiring and in what order.

Previous concerns

• [Major] CLI routes to /ext/ while the server serves /v1/ (#466 (comment)) - still present. components/cli/pkg/urls/urls.go:11-17 still uses /ext/, and components/api-server/plugins/agentRuntimes/plugin.go:46 / components/api-server/plugins/secretSources/plugin.go:46 still serve /v1 and the nested secret_sources route on main.
• [Minor] create/agentRuntime/cmd.go not gofmt-clean (#466 (comment)) - addressed. The args struct at components/cli/cmd/hsctl/create/agentRuntime/cmd.go:18-27 is now aligned to a single space (commit 225b729).
• [Minor] Error wrapping used %v instead of %w - addressed. The new commands now wrap with %w (e.g. components/cli/cmd/hsctl/create/secretSource/cmd.go:67,91,97,103; same across the other create/get/list/delete commands in commit 225b729).

Findings Summary (ordered by severity, highest first)

1. [Major] CLI routes extension kinds to /ext/ while main's server serves them at /v1/ (and nests secret_sources); depends on the server-side move landing first - Interface / Change Order (urls.go L11-17)

Convention Checklist

Convention	Result
No panic() in production code	Pass
Errors wrapped with fmt.Errorf("...: %w", err)	Pass
gofmt applied	Pass
No secrets in logs or responses	Pass
Secret stored as reference, not inline value	Pass
Conventional commit messages	Pass
CLI paths match server routes	Fail (pending server move)