From 379d920a02cbcf68cde44817fdd9c9d2b08bf566 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sat, 4 Jul 2026 14:25:49 +0000
Subject: [PATCH] fix: preserve sub2api manual account bindings

---
 .../platform-infra-sub2api-codex/actions.ts   |  2 +-
 .../remote-python-sync.ts                     | 30 ++-----------------
 2 files changed, 4 insertions(+), 28 deletions(-)

diff --git a/scripts/src/platform-infra-sub2api-codex/actions.ts b/scripts/src/platform-infra-sub2api-codex/actions.ts
index 4410683d..d97e781d 100644
--- a/scripts/src/platform-infra-sub2api-codex/actions.ts
+++ b/scripts/src/platform-infra-sub2api-codex/actions.ts
@@ -84,7 +84,7 @@ export async function codexPoolSync(config: UniDeskConfig, options: SyncOptions)
   const pool = readCodexPoolConfig();
   const runtimeTarget = codexPoolRuntimeTarget(options.targetId);
   const profiles = collectCodexProfiles();
-  const planOk = profiles.length > 0 && profiles.every((profile) => profile.ok);
+  const planOk = (profiles.length > 0 && profiles.every((profile) => profile.ok)) || (profiles.length === 0 && pool.manualAccounts.protected.length > 0);
   if (!options.confirm || !planOk) {
     const plan = {
       ...codexPoolPlan(options),
diff --git a/scripts/src/platform-infra-sub2api-codex/remote-python-sync.ts b/scripts/src/platform-infra-sub2api-codex/remote-python-sync.ts
index 43edb6f8..4f521a40 100644
--- a/scripts/src/platform-infra-sub2api-codex/remote-python-sync.ts
+++ b/scripts/src/platform-infra-sub2api-codex/remote-python-sync.ts
@@ -691,18 +691,6 @@ def ensure_manual_account_proxy_bindings(token):
                 "valuesPrinted": False,
             })
             continue
-        extra = account.get("extra") if isinstance(account.get("extra"), dict) else {}
-        if extra.get("unidesk_managed") is True:
-            items.append({
-                "accountName": name,
-                "accountId": account.get("id"),
-                "enabled": True,
-                "action": "refused-managed-runtime-account",
-                "ok": False,
-                "expectedProxyName": payload["name"],
-                "valuesPrinted": False,
-            })
-            continue
         proxy, proxy_action = ensure_manual_proxy(token, payload)
         binding = protection.get("proxyBinding") if isinstance(protection, dict) else None
         plan = manual_binding_plan(binding, "proxy")
@@ -813,19 +801,6 @@ def ensure_manual_account_group_bindings(token, group_id):
                 "valuesPrinted": False,
             })
             continue
-        extra = account.get("extra") if isinstance(account.get("extra"), dict) else {}
-        if extra.get("unidesk_managed") is True:
-            items.append({
-                "accountName": name,
-                "accountId": account.get("id"),
-                "enabled": True,
-                "action": "refused-managed-runtime-account",
-                "ok": False,
-                "poolGroupName": POOL_GROUP_NAME,
-                "poolGroupId": group_id,
-                "valuesPrinted": False,
-            })
-            continue
         existing_group_ids = account_group_ids(token, account)
         desired_group_ids = sorted(set(existing_group_ids + [group_id]))
         action = "unchanged"
@@ -980,6 +955,7 @@ def account_payload(profile, group_id):
         "load_factor": int(profile.get("loadFactor", POOL_DEFAULT_ACCOUNT_LOAD_FACTOR) or POOL_DEFAULT_ACCOUNT_LOAD_FACTOR),
         "group_ids": [group_id],
         "confirm_mixed_channel_risk": True,
+        **({"proxy_id": int(profile["proxyId"])} if profile.get("proxyId") is not None else {}),
     }
 
 def planned_sentinel_account_results(profiles, existing_accounts):
@@ -2579,8 +2555,8 @@ def run_sync():
     profiles = payload.get("profiles") or []
     prune_removed = bool(payload.get("pruneRemoved"))
     sentinel_payload = payload.get("sentinel") if isinstance(payload.get("sentinel"), dict) else {}
-    if not profiles:
-        raise RuntimeError("sync payload has no profiles")
+    if not profiles and not MANUAL_ACCOUNT_PROTECTIONS:
+        raise RuntimeError("sync payload has no profiles and no manualAccounts.protected binding plan")
     admin_email, token, admin_compliance = login()
     group, group_action = ensure_group(token)
     group_id = group.get("id") if isinstance(group, dict) else None