export ATM_REPO="$HOME/dev/atm"
export HERMES_SOURCE="$HOME/.hermes/hermes-agent"
export HERMES_HOME="$HOME/.hermes/profiles/soma"
export PYTHONPATH="$HERMES_SOURCE"
test -d "$HERMES_HOME" && test -x "$HERMES_SOURCE/venv/bin/python"
test -r "$HERMES_HOME/plugins/model-providers/chatgpt-accounts/__init__.py"

"$HERMES_SOURCE/venv/bin/python" - <<'PY'
import contextlib, hashlib, importlib.util, io, json, logging, os, re, time
from datetime import datetime, timezone
from pathlib import Path
 
os.umask(0o077)
logging.disable(logging.CRITICAL)
class Stop(Exception):
    pass
def require(ok, category):
    if not ok:
        raise Stop(category)
def digest(path):
    require(not path.is_symlink(), 'SYMLINK_REQUIRES_REVIEW')
    return hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None
def run():
    home = Path(os.environ['HERMES_HOME']).resolve()
    repo = Path(os.environ['ATM_REPO']).resolve()
    live = home / 'plugins/model-providers/chatgpt-accounts'
    mirror = repo / 'integrations/hermes/chatgpt-accounts'
    manifest = json.loads((repo / 'integrations/manifest.json').read_text())
    checked = {}
    for name in ('__init__.py', 'plugin.yaml'):
        source = 'integrations/hermes/chatgpt-accounts/' + name
        expected = next(r['sha256'] for r in manifest['files'] if r['source'] == source)
        require(digest(mirror / name) == expected == digest(live / name), 'PLUGIN_HASH_DRIFT')
        checked[str(live / name)] = expected
    mapping = live / 'accounts.json'
    require(mapping.stat().st_mode & 0o777 == 0o600, 'PRIVATE_MAPPING_PERMISSIONS')
    checked[str(mapping)] = digest(mapping)
    spec = importlib.util.spec_from_file_location('chatgpt_catalog_guide', live / '__init__.py')
    plugin = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(plugin)
    accounts = plugin.configured_accounts()
    aliases = ('chatgpt-cn', 'chatgpt-com')
    require(all(a in accounts for a in aliases), 'MISSING_PINNED_MAPPING')
    require(len({accounts[a].strip().casefold() for a in aliases}) == 2, 'DUPLICATE_ACCOUNT_MAPPING')
    from agent.codex_headers import codex_cloudflare_headers, is_official_codex_base_url
    from agent.model_metadata import fetch_codex_catalog_entries
    from hermes_cli.codex_models import _ranked_slugs, _finalize_codex_models
    import httpx
    targets = {a: digest(home / 'cache' / (a + '-models.json')) for a in aliases}
    routes = []
    for alias in aliases:
        entries = plugin.account_pool(accounts[alias], alias).entries()
        entry = next((e for e in entries if e.last_status in (None, 'ok')
                      and plugin.token_expiry(e.access_token) > time.time() + 120), None)
        require(entry is not None, alias + ': NO_READY_CREDENTIAL')
        require(plugin.email_of(entry.access_token) == accounts[alias], alias + ': ACCOUNT_MISMATCH')
        headers = {'Authorization': 'Bearer ' + entry.access_token,
                   **codex_cloudflare_headers(entry.access_token)}
        require(bool(headers.get('ChatGPT-Account-ID')), alias + ': MISSING_WORKSPACE_HEADER')
        with httpx.Client(timeout=10, follow_redirects=False) as client:
            def get(url):
                require(is_official_codex_base_url(url), 'UNEXPECTED_ENDPOINT')
                response = client.get(url, headers=headers)
                if response.status_code in (401, 403, 429):
                    raise Stop(alias + ': HTTP_' + str(response.status_code))
                return response
            rows, status = fetch_codex_catalog_entries(get)
        server = _ranked_slugs(rows)
        require(status == 200 and bool(server), alias + ': EMPTY_OR_FAILED_CATALOG')
        models = _finalize_codex_models(server)
        require(all(re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}', m)
                    for m in models), 'UNEXPECTED_MODEL_ID_FORMAT')
        routes.append(dict(provider=alias, cost='subscription', source='account-scoped catalog GET',
                           server_models=server, models=models,
                           derived_models=[m for m in models if m not in server],
                           quota_checked=False, inference_verified=False))
    stamp = datetime.now(timezone.utc)
    output = Path.home() / 'var/atm/chatgpt-model-lists' / (stamp.strftime('%Y%m%dT%H%M%SZ') + '-' + str(os.getpid()))
    output.mkdir(parents=True, mode=0o700, exist_ok=False)
    catalog = dict(kind='subscription-account-routes', public_free_api=False, auth_copied=False,
                   checked_at=stamp.isoformat(), routes=routes)
    catalog_text = json.dumps(catalog, ensure_ascii=False, indent=2) + '\n'
    plan = dict(home=str(home), inputs=checked, targets=targets, created_at=time.time(),
                catalog_sha256=hashlib.sha256(catalog_text.encode()).hexdigest())
    for name, value in (('catalog.json', catalog), ('plan.json', plan)):
        (output / name).write_text(json.dumps(value, ensure_ascii=False, indent=2) + '\n')
    return output
 
try:
    with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
        output = run()
except Stop as exc:
    print('STOP:', str(exc))  # 仅本片段定义的安全类别
    raise SystemExit(1)
except Exception as exc:
    print('STOP:', type(exc).__name__)  # 不打印异常正文、响应或堆栈
    raise SystemExit(1)
print('CANDIDATES_READY:', output)
PY

export ATM_MODEL_STAGE='/absolute/path/printed/as/CANDIDATES_READY'
"$HERMES_SOURCE/venv/bin/python" - <<'PY'
import hashlib, json, os, tempfile, time
from pathlib import Path
 
os.umask(0o077)
def digest(path):
    if path.is_symlink():
        raise RuntimeError('SYMLINK')
    return hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None
def require(ok):
    if not ok:
        raise RuntimeError('PLAN_OR_HASH_CHECK_FAILED')
try:
    stage = Path(os.environ['ATM_MODEL_STAGE'])
    plan = json.loads((stage / 'plan.json').read_text())
    catalog = json.loads((stage / 'catalog.json').read_text())
    home = Path(os.environ['HERMES_HOME']).resolve()
    require(str(home) == plan['home'] and 0 <= time.time() - plan['created_at'] <= 3600)
    require(digest(stage / 'catalog.json') == plan['catalog_sha256'])
    require(len(catalog['routes']) == 2
            and {r['provider'] for r in catalog['routes']} == {'chatgpt-cn', 'chatgpt-com'})
    require(set(plan['targets']) == {'chatgpt-cn', 'chatgpt-com'})
    for name, expected in plan['inputs'].items():
        require(digest(Path(name)) == expected)
    for alias, expected in plan['targets'].items():
        require(digest(home / 'cache' / (alias + '-models.json')) == expected)
    for route in catalog['routes']:
        alias, models = route['provider'], route['models']
        require(models and all(isinstance(m, str) and m for m in models))
        path = home / 'cache' / (alias + '-models.json')
        if path.exists():
            with (stage / (alias + '-models.before.json')).open('xb') as backup:
                backup.write(path.read_bytes())
    for route in catalog['routes']:
        path = home / 'cache' / (route['provider'] + '-models.json')
        path.parent.mkdir(parents=True, exist_ok=True)
        payload = (json.dumps(route['models'], ensure_ascii=False) + '\n').encode()
        fd, temporary = tempfile.mkstemp(dir=path.parent, prefix='.models-')
        try:
            with os.fdopen(fd, 'wb') as stream:
                stream.write(payload)
                stream.flush()
                os.fsync(stream.fileno())
            os.replace(temporary, path)
            require(path.read_bytes() == payload)
        finally:
            if os.path.exists(temporary):
                os.unlink(temporary)
except Exception as exc:
    print('APPLY_STOP:', type(exc).__name__, '(inspect local state; may be partially applied)')
    raise SystemExit(1)
print('CACHE_WRITE_VERIFIED: chatgpt-cn, chatgpt-com')
PY

cd "$ATM_REPO"
"$HERMES_SOURCE/venv/bin/python" -m unittest discover \
  -s tests/integrations -p test_chatgpt_accounts.py -q