feat(zhulan): add guarded Codex Remote SSH lane

server-tools/zhulan-remote-cell/tests/test_codex_remote.py

@@ -0,0 +1,78 @@
+import json
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+GUARD = ROOT / "remote" / "zhulan_guard.py"
+
+
+def run_guard(event: str, command: str = "git status", cwd: str = "/srv/guanghu/zhulan-codex/workspaces/repo"):
+    payload = {
+        "hook_event_name": event,
+        "session_id": "test-session",
+        "cwd": cwd,
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
+    }
+    return subprocess.run(
+        ["python3", str(GUARD)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+
+
+class CodexRemoteContractTest(unittest.TestCase):
+    def test_managed_requirements_are_fail_closed(self):
+        requirements = (ROOT / "remote" / "requirements.toml").read_text(encoding="utf-8")
+        self.assertIn("allow_managed_hooks_only = true", requirements)
+        self.assertIn('default_permissions = ":workspace"', requirements)
+        self.assertIn('":workspace" = true', requirements)
+        self.assertIn('managed_dir = "/etc/guanghu/zhulan-codex/hooks"', requirements)
+        self.assertIn("[[hooks.PreCompact]]", requirements)
+        self.assertIn("[[hooks.PostCompact]]", requirements)
+        self.assertIn("[[hooks.PreToolUse]]", requirements)
+
+    def test_privilege_and_central_push_are_denied(self):
+        for command in (
+            "sudo id",
+            "systemctl restart ssh",
+            "git push origin main",
+            "git -C /tmp/repo push origin main",
+            "ssh another-host",
+        ):
+            result = run_guard("PreToolUse", command)
+            self.assertEqual(result.returncode, 0)
+            data = json.loads(result.stdout)
+            self.assertEqual(data["hookSpecificOutput"]["permissionDecision"], "deny")
+
+    def test_candidate_push_and_normal_development_are_allowed(self):
+        for command in ("git status", "git diff --check", "git push candidate zhulan/test"):
+            result = run_guard("PreToolUse", command)
+            self.assertEqual(result.returncode, 0)
+            data = json.loads(result.stdout)
+            self.assertNotIn("permissionDecision", data["hookSpecificOutput"])
+
+    def test_protected_paths_and_outside_workspace_are_denied(self):
+        result = run_guard("PreToolUse", "sed -n 1p /etc/guanghu/private")
+        self.assertEqual(json.loads(result.stdout)["hookSpecificOutput"]["permissionDecision"], "deny")
+        result = run_guard("PreToolUse", "git status", cwd="/tmp")
+        self.assertEqual(json.loads(result.stdout)["hookSpecificOutput"]["permissionDecision"], "deny")
+
+    def test_installer_removes_privilege_and_central_push(self):
+        installer = (ROOT / "deploy" / "install-codex-remote-ssh.sh").read_text(encoding="utf-8")
+        self.assertIn('gpasswd -d "$REMOTE_USER" sudo', installer)
+        self.assertIn("remote set-url --push origin DISABLED_CENTRAL_PUSH", installer)
+        self.assertIn('"$REMOTE_HOME/.codex/AGENTS.md"', installer)
+        self.assertIn("'/.zhulan/'", installer)
+        self.assertIn("AllowTcpForwarding no", installer)
+        self.assertIn("central_push_credentials\": false", installer)
+        self.assertNotIn("NOPASSWD", installer)
+
+
+if __name__ == "__main__":
+    unittest.main()