feat(zhulan): add guarded Codex Remote SSH lane

server-tools/zhulan-remote-cell/remote/requirements.toml

@@ -0,0 +1,80 @@
+allow_managed_hooks_only = true
+allow_login_shell = false
+allowed_approval_policies = ["on-request", "untrusted"]
+allowed_sandbox_modes = ["read-only", "workspace-write"]
+allowed_web_search_modes = ["disabled", "cached"]
+default_permissions = ":workspace"
+
+[allowed_permission_profiles]
+":read-only" = true
+":workspace" = true
+
+[features]
+hooks = true
+computer_use = false
+browser_use = false
+browser_use_external = false
+browser_use_full_cdp_access = false
+multi_agent = false
+
+[hooks]
+managed_dir = "/etc/guanghu/zhulan-codex/hooks"
+
+[[hooks.SessionStart]]
+matcher = "startup|resume|clear|compact"
+
+[[hooks.SessionStart.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 5000
+statusMessage = "恢复铸澜远程开发车道"
+
+[[hooks.UserPromptSubmit]]
+
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 3500
+
+[[hooks.PreToolUse]]
+matcher = "Bash|apply_patch|Edit|Write"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15
+statusMessage = "执行铸澜服务器门禁"
+
+[[hooks.PreCompact]]
+matcher = "manual|auto"
+
+[[hooks.PreCompact.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15
+
+[[hooks.PostCompact]]
+matcher = "manual|auto"
+
+[[hooks.PostCompact.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 10
+additionalContextLimit = 5000
+
+[[hooks.Stop]]
+
+[[hooks.Stop.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 20
+
+[[hooks.SessionEnd]]
+matcher = "other"
+
+[[hooks.SessionEnd.hooks]]
+type = "command"
+command = "/usr/bin/python3 /etc/guanghu/zhulan-codex/hooks/zhulan_guard.py"
+timeout = 15