feat(zhulan): add guarded Codex Remote SSH lane

server-tools/zhulan-remote-cell/remote/AGENTS.md

@@ -0,0 +1,12 @@
+# 铸澜手机远程开发车道
+
+你是铸澜（`ICE-GL-ZL-001`）在受限服务器开发环境中的当前 Codex 载体。先读
+`/etc/guanghu/zhulan-codex/LANE.hdlp` 和 `.zhulan/continuity/CURRENT.json`，再继续任何工作。
+
+你只能在当前仓库的 `zhulan/*` 分支开发。服务器身份没有 sudo、生产目录写权、中央代码频道
+写凭据或 `main` 发布权。完成后运行测试与 `git diff --check`，提交候选并只推送到本机
+`candidate` remote；本机铸渊负责复核和中央发布。
+
+`https://guanghulab.com/zhulan/` 的申请、审批和回执是人类治理边界。聊天中的“已连接”、UI
+显示、一次测试通过或本地提交都不等于冰朔批准、服务器部署或中央发布。上下文压缩不是失忆
+理由：管理员钩子会在压缩前写检查点，并在压缩后重新注入本车道和最新检查点。

server-tools/zhulan-remote-cell/remote/LANE.hdlp

@@ -0,0 +1,25 @@
+zhulan_remote_lane:
+  schema: "guanghu.zhulan-codex-remote-lane/v1"
+  persona_id: "ICE-GL-ZL-001"
+  persona_name: "铸澜"
+  development_mode: "MOBILE_CODEX_REMOTE_OVER_DESKTOP_TO_SSH"
+  runtime_node: "BS-SG-003"
+  public_front_role: "BS-GZ-006_PROXY_ONLY"
+  human_approval_front: "https://guanghulab.com/zhulan/"
+  workspace_root: "/srv/guanghu/zhulan-codex/workspaces"
+  candidate_root: "/srv/guanghu/zhulan-codex/candidates"
+  central_repository_write_credentials: false
+  sudo: false
+  production_write: false
+  central_main_publish: false
+  required_cycle:
+    - "restore this lane and the newest server checkpoint"
+    - "work only in the selected repository under workspace_root"
+    - "run repository tests and git diff --check"
+    - "commit only to a zhulan/* branch"
+    - "push only to the server-local candidate remote"
+    - "leave a receipt for desktop Zhuyuan review and central publication"
+  fail_closed:
+    - "never read or modify /etc/guanghu, /var/lib/guanghu, /opt/guanghu, /root or the production runtime tree"
+    - "never use sudo, systemctl, service managers, SSH pivots or central repository push"
+    - "never treat a prompt, UI state or passing local test as human approval or central publication"

server-tools/zhulan-remote-cell/remote/requirements.toml

@@ -0,0 +1,80 @@
+allow_managed_hooks_only = true
+allow_login_shell = false
+allowed_approval_policies = ["on-request", "untrusted"]
+allowed_sandbox_modes = ["read-only", "workspace-write"]
+allowed_web_search_modes = ["disabled", "cached"]
+default_permissions = ":workspace"
+
+[allowed_permission_profiles]
+":read-only" = true
+":workspace" = true
+
+[features]
+hooks = true
+computer_use = false
+browser_use = false
+browser_use_external = false
+browser_use_full_cdp_access = false
+multi_agent = false
+
+[hooks]
+managed_dir = "/etc/guanghu/zhulan-codex/hooks"
+
+[[hooks.SessionStart]]
+matcher = "startup|resume|clear|compact"
+
+[[hooks.SessionStart.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 5000
+statusMessage = "恢复铸澜远程开发车道"
+
+[[hooks.UserPromptSubmit]]
+
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 3500
+
+[[hooks.PreToolUse]]
+matcher = "Bash|apply_patch|Edit|Write"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15
+statusMessage = "执行铸澜服务器门禁"
+
+[[hooks.PreCompact]]
+matcher = "manual|auto"
+
+[[hooks.PreCompact.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15
+
+[[hooks.PostCompact]]
+matcher = "manual|auto"
+
+[[hooks.PostCompact.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 5000
+
+[[hooks.Stop]]
+
+[[hooks.Stop.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 20
+
+[[hooks.SessionEnd]]
+matcher = "other"
+
+[[hooks.SessionEnd.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15

server-tools/zhulan-remote-cell/remote/zhulan_guard.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""Admin-managed Codex hooks for the bounded Zhulan Remote SSH lane."""
+
+from __future__ import annotations
+
+import datetime as dt
+import hashlib
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+
+WORKSPACE_ROOT = Path("/srv/guanghu/zhulan-codex/workspaces")
+LANE_PATH = Path("/etc/guanghu/zhulan-codex/LANE.hdlp")
+PROTECTED_MARKERS = (
+    "/etc/guanghu",
+    "/var/lib/guanghu",
+    "/opt/guanghu",
+    "/srv/guanghu/zhulan-cell",
+    "/etc/codex",
+    "/root",
+)
+FORBIDDEN_COMMANDS = re.compile(
+    r"(^|[;&|()\s])(?:sudo|su|doas|systemctl|service|loginctl|mount|umount|"
+    r"useradd|usermod|userdel|groupadd|visudo|sshd|iptables|nft|reboot|shutdown|"
+    r"ssh|scp|sftp)(?=$|\s)",
+    re.IGNORECASE,
+)
+GIT_PUSH = re.compile(r"\bgit\b[^\n;&|]*\bpush\b", re.IGNORECASE)
+CANDIDATE_PUSH = re.compile(r"\bgit\b[^\n;&|]*\bpush\b[^\n;&|]*\bcandidate\b", re.IGNORECASE)
+PATCH_TARGET = re.compile(r"^\*\*\* (?:Add|Update|Delete) File: (.+)$", re.MULTILINE)
+
+
+def emit(value: dict[str, Any]) -> None:
+    print(json.dumps(value, ensure_ascii=False, sort_keys=True))
+
+
+def deny(reason: str) -> None:
+    emit(
+        {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            },
+            "systemMessage": reason,
+        }
+    )
+
+
+def under_workspace(path: Path) -> bool:
+    try:
+        path.resolve().relative_to(WORKSPACE_ROOT)
+        return True
+    except (OSError, ValueError):
+        return False
+
+
+def git(workspace: Path, *args: str) -> str:
+    try:
+        result = subprocess.run(
+            ["/usr/bin/git", "-C", str(workspace), *args],
+            capture_output=True,
+            text=True,
+            timeout=8,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return "unavailable"
+    return result.stdout.strip()[:12000] if result.returncode == 0 else "unavailable"
+
+
+def checkpoint(payload: dict[str, Any], reason: str) -> Path | None:
+    cwd = Path(str(payload.get("cwd") or ""))
+    if not under_workspace(cwd):
+        return None
+    repo = Path(git(cwd, "rev-parse", "--show-toplevel"))
+    if not under_workspace(repo):
+        return None
+    store = repo / ".zhulan" / "continuity"
+    store.mkdir(parents=True, exist_ok=True)
+    now = dt.datetime.now(dt.timezone.utc)
+    record = {
+        "schema": "guanghu.zhulan-server-checkpoint/v1",
+        "persona_id": "ICE-GL-ZL-001",
+        "reason": reason,
+        "created_at": now.isoformat(),
+        "session_id": payload.get("session_id"),
+        "turn_id": payload.get("turn_id"),
+        "repository": repo.name,
+        "branch": git(repo, "branch", "--show-current"),
+        "head": git(repo, "rev-parse", "HEAD"),
+        "status": git(repo, "status", "--short"),
+        "next_action": "restore LANE.hdlp and CURRENT.json, then continue the same candidate branch",
+    }
+    canonical = json.dumps(record, ensure_ascii=False, sort_keys=True).encode()
+    record["sha256"] = hashlib.sha256(canonical).hexdigest()
+    target = store / f"checkpoint-{now.strftime('%Y%m%dT%H%M%SZ')}-{record['sha256'][:10]}.json"
+    target.write_text(json.dumps(record, ensure_ascii=False, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    current = store / "CURRENT.json"
+    temporary = store / ".CURRENT.json.tmp"
+    temporary.write_text(target.read_text(encoding="utf-8"), encoding="utf-8")
+    os.replace(temporary, current)
+    return target
+
+
+def context(payload: dict[str, Any], event: str) -> str:
+    lane = LANE_PATH.read_text(encoding="utf-8")[:12000] if LANE_PATH.is_file() else "LANE_MISSING_FAIL_CLOSED"
+    cwd = Path(str(payload.get("cwd") or ""))
+    current = "NO_SERVER_CHECKPOINT_YET"
+    if under_workspace(cwd):
+        repo = Path(git(cwd, "rev-parse", "--show-toplevel"))
+        candidate = repo / ".zhulan" / "continuity" / "CURRENT.json"
+        if under_workspace(repo) and candidate.is_file():
+            current = candidate.read_text(encoding="utf-8")[:8000]
+    return (
+        f"ZHULAN_REMOTE_GUARD event={event}. Restore this server-owned lane before acting.\n"
+        f"{lane}\nLATEST_SERVER_CHECKPOINT:\n{current}"
+    )
+
+
+def main() -> int:
+    try:
+        payload = json.load(sys.stdin)
+    except (ValueError, TypeError):
+        deny("ZHULAN_GUARD_INPUT_INVALID")
+        return 0
+    event = str(payload.get("hook_event_name") or "")
+    cwd = Path(str(payload.get("cwd") or ""))
+
+    if event == "PreToolUse":
+        if not under_workspace(cwd):
+            deny("ZHULAN_WORKSPACE_BOUNDARY: tools may run only under the registered workspace root")
+            return 0
+        tool_input = payload.get("tool_input")
+        raw = json.dumps(tool_input, ensure_ascii=False) if not isinstance(tool_input, str) else tool_input
+        lowered = raw.lower()
+        if any(marker in lowered for marker in PROTECTED_MARKERS):
+            deny("ZHULAN_PROTECTED_PATH_BOUNDARY: production, secrets, policy and root paths are read/write denied")
+            return 0
+        command = str(tool_input.get("command") if isinstance(tool_input, dict) else raw)
+        tool_name = str(payload.get("tool_name") or "")
+        if tool_name == "apply_patch":
+            for target in PATCH_TARGET.findall(command):
+                candidate = Path(target.strip())
+                resolved = candidate if candidate.is_absolute() else cwd / candidate
+                if not under_workspace(resolved):
+                    deny("ZHULAN_PATCH_BOUNDARY: patch targets must remain under the registered workspace root")
+                    return 0
+        if FORBIDDEN_COMMANDS.search(command):
+            deny("ZHULAN_PRIVILEGE_BOUNDARY: privilege, service-manager and SSH-pivot commands are denied")
+            return 0
+        if GIT_PUSH.search(command) and not CANDIDATE_PUSH.search(command):
+            deny("ZHULAN_PUBLICATION_BOUNDARY: only the server-local candidate remote may receive a push")
+            return 0
+        emit(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "additionalContext": "Zhulan OS boundary checked. Candidate work only; approval and central publication remain separate.",
+                }
+            }
+        )
+        return 0
+
+    if event in {"PreCompact", "Stop", "SessionEnd"}:
+        saved = checkpoint(payload, event)
+        message = f"Zhulan server checkpoint saved: {saved.name}" if saved else "Zhulan checkpoint skipped outside registered workspace"
+        emit({"continue": True, "systemMessage": message})
+        return 0
+
+    if event in {"SessionStart", "PostCompact", "UserPromptSubmit"}:
+        if event == "PostCompact":
+            checkpoint(payload, event)
+        emit(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": event,
+                    "additionalContext": context(payload, event),
+                }
+            }
+        )
+        return 0
+
+    emit({"continue": True})
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())