feat(zhulan): add restricted remote development cell

server-tools/zhulan-remote-cell/tests/test_code_gate.py

@@ -0,0 +1,32 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
+from zhulan_code_gate import scan_file, within  # noqa: E402
+
+
+class CodeGateTest(unittest.TestCase):
+    def test_paths_fail_closed(self):
+        self.assertTrue(within("server-tools/zhulan-remote-cell/ui/app.js", ["server-tools/zhulan-remote-cell"]))
+        self.assertFalse(within("server-tools/lake-lamp-authz/server.js", ["server-tools/zhulan-remote-cell"]))
+
+    def test_private_key_is_rejected(self):
+        with tempfile.TemporaryDirectory() as root:
+            workspace = Path(root)
+            target = workspace / "leak.txt"
+            target.write_text("-----BEGIN OPENSSH PRIVATE KEY-----\nnot-real\n", encoding="utf-8")
+            self.assertIn("possible_secret", scan_file(workspace, target, 1024 * 1024))
+
+    def test_symlink_outside_workspace_is_rejected(self):
+        with tempfile.TemporaryDirectory() as root, tempfile.TemporaryDirectory() as outside:
+            workspace = Path(root)
+            target = workspace / "outside-link"
+            target.symlink_to(Path(outside) / "secret")
+            self.assertIn("symlink_outside_workspace", scan_file(workspace, target, 1024 * 1024))
+
+
+if __name__ == "__main__":
+    unittest.main()