pikasTech-unidesk/scripts/src/platform-infra-sub2api-codex/remote-python-sync-validate.ts

export const remotePythonSyncValidateScript = `def run_sync():
    global MANUAL_ACCOUNT_PROTECTIONS
    payload = json.loads(base64.b64decode(PAYLOAD_B64).decode("utf-8"))
    manual_accounts_payload = payload.get("manualAccounts") if isinstance(payload.get("manualAccounts"), dict) else {}
    resolved_manual_protections = manual_accounts_payload.get("protected")
    if not isinstance(resolved_manual_protections, list):
        raise RuntimeError("sync payload has no manualAccounts.protected binding plan")
    MANUAL_ACCOUNT_PROTECTIONS = resolved_manual_protections
    profiles = payload.get("profiles") or []
    prune_removed = bool(payload.get("pruneRemoved"))
    sentinel_payload = payload.get("sentinel") if isinstance(payload.get("sentinel"), dict) else {}
    if not profiles and not MANUAL_ACCOUNT_PROTECTIONS:
        raise RuntimeError("sync payload has no profiles and no manualAccounts.protected binding plan")
    admin_email, token, admin_compliance = login()
    group, group_action = ensure_group(token)
    group_id = group.get("id") if isinstance(group, dict) else None
    if group_id is None:
        raise RuntimeError("pool group id missing after ensure")
    existing_accounts = list_accounts(token)
    planned_account_results = planned_sentinel_account_results(profiles, existing_accounts)
    sentinel_quality_prepare = ensure_sentinel_state_for_sync(planned_account_results, True)
    if sentinel_quality_prepare.get("ok") is not True:
        raise RuntimeError("prepare sentinel pending probe failed: " + json.dumps(sentinel_quality_prepare, ensure_ascii=False))
    protected_frozen_names = active_sentinel_quarantine_names()
    account_results, pruned_account_results = ensure_accounts(token, profiles, group_id, prune_removed, protected_frozen_names, existing_accounts)
    manual_account_proxy_bindings = ensure_manual_account_proxy_bindings(token)
    manual_account_group_bindings = ensure_manual_account_group_bindings(token, group_id)
    manual_account_protections = manual_account_protection_status(token, group_id)
    capacity_status = account_capacity_status(token)
    load_factor_status = account_load_factor_status(token)
    ws_v2_status = account_ws_v2_status(token)
    temp_unschedulable_status = account_temp_unschedulable_status(token)
    api_key, secret_action, secret_apply_stdout = ensure_api_key_secret(group_id, token)
    api_key_result = ensure_sub2api_api_key(token, api_key, group_id)
    owner_balance = ensure_pool_owner_balance(token, api_key_result["userId"])
    owner_concurrency = ensure_pool_owner_concurrency(token, api_key_result["userId"])
    gateway = validate_gateway(api_key)
    responses_smoke = validate_gateway_responses(api_key)
    compact_evidence = recent_compact_gateway_evidence()
    responses_evidence = recent_responses_gateway_evidence()
    runtime_capabilities = validate_runtime_capabilities(token)
    sentinel = apply_sentinel_manifest(sentinel_payload.get("manifest"))
    sentinel_quality = ensure_sentinel_state_for_sync(account_results)
    sentinel_reassert = reassert_sentinel_freezes_after_sync(token)
    return {
        "ok": gateway["ok"] is True and responses_smoke["ok"] is True and owner_concurrency["ok"] is True and capacity_status["ok"] is True and load_factor_status["ok"] is True and ws_v2_status["ok"] is True and temp_unschedulable_status["ok"] is True and manual_account_proxy_bindings.get("ok") is True and manual_account_group_bindings.get("ok") is True and manual_account_protections.get("ok") is True and sentinel.get("ok") is True and sentinel_quality_prepare.get("ok") is True and sentinel_quality.get("ok") is True and sentinel_reassert.get("ok") is True and runtime_capabilities.get("ok") is True,
        "degraded": bool(responses_smoke.get("degraded")) or bool(compact_evidence.get("degraded")) or bool(responses_evidence.get("degraded")) or runtime_capabilities.get("ok") is not True,
        "mode": "sync",
        "namespace": NAMESPACE,
        "serviceDns": SERVICE_DNS,
        "appPod": APP_POD,
        "admin": {"email": admin_email, "tokenPrinted": False, "compliance": admin_compliance},
        "pool": {"name": POOL_GROUP_NAME, "id": group_id, "action": group_action, "platform": group.get("platform") if isinstance(group, dict) else "openai"},
        "accounts": {
            "desired": len(profiles),
            "created": sum(1 for item in account_results if item["action"] == "created"),
            "updated": sum(1 for item in account_results if item["action"] == "updated"),
            "pruned": len(pruned_account_results),
            "pruneMode": "explicit" if prune_removed else "disabled-by-default",
            "items": account_results,
            "prunedItems": pruned_account_results,
            "processControl": {"schedulableRestore": "sentinel marker probe only; sync does not restore schedulable for existing accounts", "durableConfig": False},
            "valuesPrinted": False,
        },
        "manualAccounts": {**manual_account_protections, "proxySync": manual_account_proxy_bindings, "groupSync": manual_account_group_bindings},
        "capacity": capacity_status,
        "loadFactor": load_factor_status,
        "webSocketsV2": ws_v2_status,
        "tempUnschedulable": temp_unschedulable_status,
        "apiKey": {
            "ok": True,
            "name": POOL_API_KEY_NAME,
            "secret": pool_api_key_secret_location(),
            "secretAction": secret_action,
            "secretApply": secret_apply_stdout,
            "sub2apiAction": api_key_result["action"],
            "sub2apiId": api_key_result["id"],
            "groupId": api_key_result["groupId"],
            "userId": api_key_result["userId"],
            "apiKeyFingerprint": secret_fingerprint(api_key),
            "valuesPrinted": False,
        },
        "ownerBalance": owner_balance,
        "ownerConcurrency": owner_concurrency,
        "sentinel": {**sentinel, "qualityGatePrepare": sentinel_quality_prepare, "qualityGate": sentinel_quality, "freezeReassert": sentinel_reassert},
        "runtimeCapabilities": runtime_capabilities,
        "validation": {"gatewayModels": gateway, "gatewayResponses": responses_smoke, "gatewayResponsesRecent": responses_evidence, "gatewayCompactRecent": compact_evidence},
    }

def run_validate():
    admin_email, token, admin_compliance = login()
    api_key, key_item, api_key_source = resolve_pool_api_key_for_validate(token)
    api_key_ok = isinstance(key_item, dict) and key_item.get("name") == POOL_API_KEY_NAME
    owner_balance = None
    owner_concurrency = None
    if key_item is not None and key_item.get("user_id") is not None:
        owner_balance = ensure_pool_owner_balance(token, key_item["user_id"])
        owner_concurrency = ensure_pool_owner_concurrency(token, key_item["user_id"])
    capacity_status = account_capacity_status(token)
    load_factor_status = account_load_factor_status(token)
    ws_v2_status = account_ws_v2_status(token)
    temp_unschedulable_status = account_temp_unschedulable_status(token)
    pool_group_id = key_item.get("group_id") if isinstance(key_item, dict) else None
    manual_account_protections = manual_account_protection_status(token, pool_group_id)
    gateway = validate_gateway(api_key)
    responses_smoke = validate_gateway_responses(api_key)
    compact_evidence = recent_compact_gateway_evidence()
    responses_evidence = recent_responses_gateway_evidence()
    runtime_capabilities = validate_runtime_capabilities(token)
    sentinel = sentinel_runtime_status()
    return {
        "ok": api_key_ok is True and gateway["ok"] is True and responses_smoke["ok"] is True and (owner_concurrency is None or owner_concurrency["ok"] is True) and capacity_status["ok"] is True and load_factor_status["ok"] is True and ws_v2_status["ok"] is True and temp_unschedulable_status["ok"] is True and manual_account_protections.get("ok") is True and sentinel.get("ok") is True and runtime_capabilities.get("ok") is True,
        "degraded": bool(responses_smoke.get("degraded")) or bool(compact_evidence.get("degraded")) or bool(responses_evidence.get("degraded")) or runtime_capabilities.get("ok") is not True,
        "mode": "validate",
        "namespace": NAMESPACE,
        "serviceDns": SERVICE_DNS,
        "appPod": APP_POD,
        "admin": {"email": admin_email, "tokenPrinted": False, "compliance": admin_compliance},
        "apiKey": {
            "ok": api_key_ok,
            "name": POOL_API_KEY_NAME,
            "secret": pool_api_key_secret_location(),
            "source": api_key_source,
            "sub2apiId": key_item.get("id") if isinstance(key_item, dict) else None,
            "userId": key_item.get("user_id") if isinstance(key_item, dict) else None,
            "groupId": key_item.get("group_id") if isinstance(key_item, dict) else None,
            "apiKeyFingerprint": secret_fingerprint(api_key),
            "valuesPrinted": False,
        },
        "ownerBalance": owner_balance,
        "ownerConcurrency": owner_concurrency,
        "capacity": capacity_status,
        "loadFactor": load_factor_status,
        "webSocketsV2": ws_v2_status,
        "tempUnschedulable": temp_unschedulable_status,
        "manualAccounts": manual_account_protections,
        "sentinel": sentinel,
        "runtimeCapabilities": runtime_capabilities,
        "validation": {"gatewayModels": gateway, "gatewayResponses": responses_smoke, "gatewayResponsesRecent": responses_evidence, "gatewayCompactRecent": compact_evidence},
    }

`;