@mseep/open-computer-use 1.0.0

package/tests/orchestrator/test_mcp_tools.py

@@ -0,0 +1,224 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for MCP tools — output truncation, command semantics, uniqueness check.
+
+Uses mock Docker to test tool logic without real containers.
+
+Run: cd computer-use-server && python -m pytest ../tests/orchestrator/test_mcp_tools.py -v
+"""
+
+import os
+import sys
+import unittest
+from unittest.mock import patch, MagicMock, AsyncMock
+
+# Add computer-use-server to path for imports
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', 'computer-use-server'))
+
+from context_vars import current_chat_id
+
+
+def _mock_exec_result(output="", exit_code=0, success=True):
+    """Create a mock execute_bash result."""
+    return {"output": output, "exit_code": exit_code, "success": success}
+
+
+def _mock_container():
+    """Create a mock Docker container."""
+    c = MagicMock()
+    c.id = "mock-container-id"
+    c.name = "owui-chat-test"
+    c.status = "running"
+    return c
+
+
+class TestBashToolOutputTruncation(unittest.IsolatedAsyncioTestCase):
+    """Tests for bash_tool output truncation (Claude Code best practice: maxResultSizeChars=30K)."""
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_large_output_is_truncated(self, mock_container, mock_token):
+        """Output >30K chars should be truncated with head+tail and a message."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        big_output = "x" * 60_000  # 60K chars
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": big_output, "exit_code": 0, "success": True}):
+            result = await bash_tool("cat big_file", "read big file", ctx)
+
+        self.assertIn("truncated", result.lower())
+        self.assertLessEqual(len(result), 32_000)  # 30K + truncation message
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_short_output_not_truncated(self, mock_container, mock_token):
+        """Output <30K chars should be returned as-is."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        short_output = "hello world\n" * 100  # ~1.2K chars
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": short_output, "exit_code": 0, "success": True}):
+            result = await bash_tool("echo hello", "test", ctx)
+
+        self.assertEqual(result, short_output)
+        self.assertNotIn("truncated", result.lower())
+
+
+class TestBashToolCommandSemantics(unittest.IsolatedAsyncioTestCase):
+    """Tests for command semantics (grep/find/diff exit code 1 != error)."""
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_grep_exit1_returns_no_matches(self, mock_container, mock_token):
+        """grep exit code 1 should return 'No matches found', not an error."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": "", "exit_code": 1, "success": False}):
+            result = await bash_tool("grep -r TODO /repo", "search", ctx)
+
+        self.assertIn("No matches found", result)
+        self.assertNotIn("Exit code", result)
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_grep_exit2_is_error(self, mock_container, mock_token):
+        """grep exit code 2+ should be reported as error."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": "grep: invalid option", "exit_code": 2, "success": False}):
+            result = await bash_tool("grep --bad-flag /repo", "search", ctx)
+
+        self.assertIn("grep: invalid option", result)
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_diff_exit1_returns_files_differ(self, mock_container, mock_token):
+        """diff exit code 1 should return 'Files differ', not an error."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": "", "exit_code": 1, "success": False}):
+            result = await bash_tool("diff a.txt b.txt", "compare", ctx)
+
+        self.assertIn("Files differ", result)
+        self.assertNotIn("Exit code", result)
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_regular_command_exit1_is_error(self, mock_container, mock_token):
+        """Non-semantic commands: exit code 1 remains an error."""
+        from mcp_tools import bash_tool
+        current_chat_id.set("test-chat")
+        ctx = MagicMock()
+        ctx.report_progress = AsyncMock()
+
+        with patch("mcp_tools.execute_bash_streaming",
+                   return_value={"output": "", "exit_code": 1, "success": False}):
+            result = await bash_tool("python3 script.py", "run script", ctx)
+
+        self.assertIn("Exit code: 1", result)
+
+
+class TestViewTruncation(unittest.IsolatedAsyncioTestCase):
+    """Tests for view output truncation at 30K (increased from 16K)."""
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_view_truncation_at_30k(self, mock_container, mock_token):
+        """Output >30K should be truncated with head+tail."""
+        from mcp_tools import view
+        current_chat_id.set("test-chat")
+
+        big_output = "line\n" * 10_000  # ~50K chars
+        with patch("mcp_tools._execute_bash",
+                   return_value={"output": big_output, "exit_code": 0}):
+            result = await view("read big file", "/tmp/big.log")
+
+        self.assertIn("truncated", result.lower())
+        self.assertLessEqual(len(result), 32_000)
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_view_no_truncation_under_30k(self, mock_container, mock_token):
+        """Output of 20K (between old 16K and new 30K) should NOT be truncated."""
+        from mcp_tools import view
+        current_chat_id.set("test-chat")
+
+        # 20K chars -- above old 16K threshold but below new 30K
+        normal_output = "x" * 20_000
+        with patch("mcp_tools._execute_bash",
+                   return_value={"output": normal_output, "exit_code": 0}):
+            result = await view("read file", "/tmp/file.py")
+
+        self.assertEqual(result, normal_output)
+        self.assertNotIn("truncated", result.lower())
+
+
+class TestStrReplaceUniqueness(unittest.IsolatedAsyncioTestCase):
+    """Tests for str_replace uniqueness check."""
+
+    @patch("mcp_tools._ensure_gitlab_token", new_callable=AsyncMock)
+    @patch("mcp_tools._get_or_create_container", return_value=_mock_container())
+    async def test_multiple_matches_returns_error(self, mock_container, mock_token):
+        """str_replace should error when old_str appears multiple times."""
+        from mcp_tools import str_replace
+        current_chat_id.set("test-chat")
+
+        # The Python script inside container should detect multiple occurrences
+        error_output = "Error: Found 3 occurrences of old_str in /tmp/test.py. Add more context to make it unique."
+        with patch("mcp_tools._execute_python_with_stdin",
+                   return_value={"output": error_output, "exit_code": 1, "success": False}):
+            result = await str_replace("fix", "print('hello')", "/tmp/test.py", "print('world')")
+
+        self.assertIn("occurrences", result.lower())
+
+
+class TestHelperFunctions(unittest.TestCase):
+    """Tests for helper functions: _get_first_command, _apply_command_semantics, _truncate_output."""
+
+    def test_get_first_command_simple(self):
+        from mcp_tools import _get_first_command
+        self.assertEqual(_get_first_command("grep -r TODO ."), "grep")
+
+    def test_get_first_command_with_path(self):
+        from mcp_tools import _get_first_command
+        self.assertEqual(_get_first_command("/usr/bin/grep pattern"), "grep")
+
+    def test_get_first_command_with_env_vars(self):
+        from mcp_tools import _get_first_command
+        self.assertEqual(_get_first_command("FOO=bar python3 script.py"), "python3")
+
+    def test_get_first_command_with_sudo(self):
+        from mcp_tools import _get_first_command
+        self.assertEqual(_get_first_command("sudo grep pattern"), "grep")
+
+    def test_truncate_output_short(self):
+        from mcp_tools import _truncate_output
+        self.assertEqual(_truncate_output("hello", 100), "hello")
+
+    def test_truncate_output_long(self):
+        from mcp_tools import _truncate_output
+        result = _truncate_output("x" * 100, 50)
+        self.assertIn("truncated", result.lower())
+        self.assertLessEqual(len(result), 200)  # 50 + message overhead
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/orchestrator/test_passthrough_isolation.py

@@ -0,0 +1,201 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Pitfall 1 regression guard — per-CLI auth allowlist isolation.
+
+When SUBAGENT_CLI selects a runtime, only that runtime's passthrough tuple
+crosses the orchestrator->sandbox boundary. Other runtimes' auth env vars
+must NOT leak into the container's `Env`, even if the operator has them
+set on the host (common in mixed-deployment environments).
+
+Also verifies the OPENCODE_CONFIG pin (Plan 06-01 Edit 1c) — when
+SUBAGENT_CLI=opencode, extra_env["OPENCODE_CONFIG"] must equal
+"/tmp/opencode.json" so docker exec'd subprocesses inherit it and OpenCode
+never falls back to ~/.local/share/opencode/auth.json (Pitfall 7 reopen).
+
+Mirrors tests/orchestrator/test_docker_manager.py pattern: monkeypatch.setenv
++ importlib.reload(docker_manager) + mocked docker client + capture
+`containers.create(environment=...)` kwargs (the actual sandbox container is
+created via `client.containers.create(**config)` — `containers.run` is only
+used for the ephemeral directory-setup shim).
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+# Make `computer-use-server` importable (project layout puts it as a sibling
+# directory, not a Python package on sys.path by default).
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+_SERVER_DIR = _REPO_ROOT / "computer-use-server"
+if str(_SERVER_DIR) not in sys.path:
+    sys.path.insert(0, str(_SERVER_DIR))
+
+
+def _build_mock_docker_client():
+    """Mock docker client wired for the _create_container call path.
+
+    Mirrors tests/orchestrator/test_docker_manager.py::_build_mock_docker_client
+    so the SUT's exception-tolerant fallbacks (network attach, save_container_meta,
+    README write, MCP resource sync, defensive scrub) are all silently satisfied.
+
+    The actual sandbox is created via `client.containers.create(**config)` — that
+    is the call we inspect for the `environment` kwarg. `containers.run` is the
+    ephemeral mkdir shim and irrelevant to the assertion target.
+    """
+    client = MagicMock()
+    client.containers.run.return_value = None
+    fake_container = MagicMock()
+    # Defensive scrub call (Plan 06-01 D4) — return a (exit_code, output) tuple
+    # so any unpacking in the SUT does not raise.
+    fake_container.exec_run = MagicMock(return_value=(0, b""))
+    client.containers.create.return_value = fake_container
+    client.networks.list.return_value = []
+    client.volumes.list.return_value = []
+    client.images.get.return_value = MagicMock()
+    return client, fake_container
+
+
+def _clear_phase6_auth_env():
+    """Pop every Phase-6 auth env var so the parametrize starts from a clean slate.
+
+    Without this, a stale OPENAI_API_KEY from a sibling test (or the developer's
+    shell) would survive `monkeypatch.setenv` only for the keys we explicitly
+    set, but the module-level tuples are built at import time from os.getenv —
+    `importlib.reload` re-runs them, so the pre-reload os.environ state IS the
+    test fixture. Be explicit.
+    """
+    for key in (
+        "ANTHROPIC_AUTH_TOKEN",
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_API_KEY",
+        "OPENAI_API_KEY",
+        "OPENAI_BASE_URL",
+        "OPENROUTER_API_KEY",
+        "CODEX_MODEL",
+        "OPENCODE_MODEL",
+        "AZURE_OPENAI_API_KEY",
+        "AZURE_OPENAI_ENDPOINT",
+        "AZURE_OPENAI_API_VERSION",
+        "CODEX_CONFIG_EXTRA",
+        "OPENCODE_CONFIG_EXTRA",
+        "SUBAGENT_CLI",
+    ):
+        os.environ.pop(key, None)
+
+
+@pytest.mark.parametrize(
+    "cli,expected_keys,forbidden_keys,expected_opencode_config",
+    [
+        (
+            "claude",
+            {"ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"},
+            {"OPENAI_API_KEY", "OPENROUTER_API_KEY", "OPENAI_BASE_URL", "OPENCODE_CONFIG", "OPENCODE_CONFIG_EXTRA", "CODEX_CONFIG_EXTRA"},
+            None,  # OPENCODE_CONFIG must NOT be set for non-opencode runtimes
+        ),
+        (
+            "codex",
+            {"OPENAI_API_KEY", "OPENAI_BASE_URL", "CODEX_CONFIG_EXTRA"},
+            {"ANTHROPIC_AUTH_TOKEN", "OPENROUTER_API_KEY", "OPENCODE_CONFIG", "OPENCODE_CONFIG_EXTRA"},
+            None,
+        ),
+        (
+            "opencode",
+            {"OPENROUTER_API_KEY", "OPENAI_API_KEY", "OPENCODE_CONFIG_EXTRA"},
+            {"ANTHROPIC_AUTH_TOKEN", "CODEX_CONFIG_EXTRA"},
+            "/tmp/opencode.json",  # Plan 06-01 Edit 1c — ROADMAP success #2
+        ),
+    ],
+)
+def test_passthrough_isolation(
+    cli, expected_keys, forbidden_keys, expected_opencode_config
+):
+    """With all three host auth env vars set, only the active CLI's allowlist
+    crosses into extra_env. Closes Pitfall 1 (auth bleed across CLIs).
+
+    For opencode, additionally verifies OPENCODE_CONFIG=/tmp/opencode.json is
+    pinned in the container Env so docker exec subprocesses inherit it
+    (Pitfall 7 — entrypoint export alone is insufficient)."""
+    overrides = {
+        "SUBAGENT_CLI": cli,
+        # Set ALL three families of auth env vars on the "host" (test process).
+        "ANTHROPIC_AUTH_TOKEN": "sk-ant-stub",
+        "ANTHROPIC_BASE_URL": "https://api.anthropic.example",
+        "ANTHROPIC_API_KEY": "sk-ant-api-stub",
+        "OPENAI_API_KEY": "sk-oai-stub",
+        "OPENAI_BASE_URL": "https://gateway.example",
+        "OPENROUTER_API_KEY": "sk-or-stub",
+        "OPENCODE_CONFIG_EXTRA": '{"stub":"opencode"}',
+        "CODEX_CONFIG_EXTRA": "[stub-codex]",
+    }
+
+    with patch.dict(os.environ, {}, clear=False):
+        _clear_phase6_auth_env()
+        for k, v in overrides.items():
+            os.environ[k] = v
+
+        # Re-import docker_manager so module-level os.getenv() reads (which build
+        # _PASSTHROUGH_BY_CLI and SUBAGENT_CLI) pick up the new env.
+        import docker_manager
+        importlib.reload(docker_manager)
+
+        client, fake_container = _build_mock_docker_client()
+        with patch("docker_manager.get_docker_client", return_value=client):
+            docker_manager._create_container("test-chat", "owui-chat-test")
+
+        # Capture the environment dict from containers.create kwargs (not .run —
+        # `.run` is the ephemeral mkdir shim; the actual sandbox uses .create).
+        assert client.containers.create.call_count == 1, (
+            "expected exactly one containers.create() invocation"
+        )
+        env_dict = client.containers.create.call_args.kwargs["environment"]
+
+        # Active allowlist landed.
+        for key in expected_keys:
+            assert key in env_dict, (
+                f"{cli}: expected {key} in extra_env, got keys={sorted(env_dict)}"
+            )
+
+        # Other CLIs' allowlists did NOT bleed.
+        for key in forbidden_keys:
+            assert key not in env_dict, (
+                f"{cli}: {key} leaked into extra_env (Pitfall 1 — auth bleed). "
+                f"Active allowlist must be _PASSTHROUGH_BY_CLI[{cli!r}] only."
+            )
+
+        # SUBAGENT_CLI itself always lands (Phase 4 invariant — Phase 7 .bashrc
+        # autostart needs it).
+        assert env_dict.get("SUBAGENT_CLI") == cli
+
+        # OPENCODE_CONFIG pin contract (Plan 06-01 Edit 1c — ROADMAP success #2).
+        # For opencode: must equal "/tmp/opencode.json" so docker exec subprocesses
+        # inherit it. For other runtimes: must be ABSENT (no spurious env).
+        if expected_opencode_config is None:
+            assert "OPENCODE_CONFIG" not in env_dict, (
+                f"{cli}: OPENCODE_CONFIG should not be set for non-opencode "
+                f"runtime, got {env_dict.get('OPENCODE_CONFIG')!r}"
+            )
+        else:
+            assert env_dict.get("OPENCODE_CONFIG") == expected_opencode_config, (
+                f"{cli}: expected OPENCODE_CONFIG={expected_opencode_config!r} "
+                f"(so `docker exec opencode ...` inherits the config path and "
+                f"never falls back to ~/.local/share/opencode/auth.json — "
+                f"Pitfall 7), got {env_dict.get('OPENCODE_CONFIG')!r}"
+            )
+
+        # Defensive scrub of OpenCode auth.json was attempted (Plan 06-01 D4).
+        assert fake_container.exec_run.call_count >= 1, (
+            "expected the auth.json scrub exec_run call"
+        )
+        scrub_call_args = [
+            call.args[0] for call in fake_container.exec_run.call_args_list
+        ]
+        assert any(
+            "rm -f /home/assistant/.local/share/opencode/auth.json" in arg
+            for arg in scrub_call_args
+        ), f"defensive scrub call not found in exec_run history: {scrub_call_args}"

package/tests/orchestrator/test_readme_in_container.py

@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""
+Tier 2 — /home/assistant/README.md is written on container creation.
+
+We mock `docker` SDK interactions and just pin that
+`_write_file_to_container` is called with the workdir + rendered prompt.
+Exercising real Docker in unit tests is out of scope; E2E smoke is in the
+verification script.
+"""
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+sys.path.insert(0, str(ROOT / "computer-use-server"))
+
+import docker_manager as dm  # noqa: E402
+
+
+class ReadmeWriterContract(unittest.TestCase):
+    def test_write_file_builds_valid_tar(self):
+        """_write_file_to_container must put_archive a tar with exactly one
+        entry named after the filename, with the supplied body."""
+        container = MagicMock()
+        captured = {}
+
+        def _capture(path, tar_bytes):
+            captured["path"] = path
+            captured["tar"] = tar_bytes
+            # Real put_archive returns True on success; the helper now
+            # raises on False.
+            return True
+
+        container.put_archive.side_effect = _capture
+
+        dm._write_file_to_container(container, "/home/assistant", "README.md", "HELLO WORLD\n")
+
+        self.assertEqual(captured["path"], "/home/assistant")
+        # Decode the tar and assert its contents
+        import io, tarfile
+        tf = tarfile.open(fileobj=io.BytesIO(captured["tar"]), mode="r")
+        names = tf.getnames()
+        self.assertEqual(names, ["README.md"])
+        body = tf.extractfile("README.md").read().decode("utf-8")
+        self.assertEqual(body, "HELLO WORLD\n")
+
+    def test_readme_gets_rendered_prompt(self):
+        """When render_system_prompt_sync is available, the docker_manager
+        writes its output verbatim."""
+        container = MagicMock()
+        captured = {}
+
+        def _capture(container_arg, path, filename, text):
+            captured["path"] = path
+            captured["filename"] = filename
+            captured["text"] = text
+
+        with patch.object(dm, "_write_file_to_container", side_effect=_capture), \
+             patch.object(dm, "render_system_prompt_sync",
+                          return_value="# rendered prompt for chat-test\n"):
+            # Call the exact snippet the hook runs. Re-implement the try-block
+            # shape here rather than invoking the private _create_container
+            # (which would require full Docker env).
+            _, workdir = dm._get_container_user_and_workdir()
+            readme_text = dm.render_system_prompt_sync("chat-test", None)
+            dm._write_file_to_container(container, workdir, "README.md", readme_text)
+
+        self.assertEqual(captured["filename"], "README.md")
+        self.assertIn("chat-test", captured["text"])
+        self.assertIn(captured["path"], ("/home/assistant", "/root"))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/orchestrator/test_render_cache.py

@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""
+render_system_prompt is called on every MCP request (via MCPContextMiddleware
+pre-render for Tier 4). It MUST NOT hit skill_manager's HTTP provider every
+time. Pin the 60s (chat_id, user_email) cache behavior.
+"""
+import asyncio
+import sys
+import time
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+sys.path.insert(0, str(ROOT / "computer-use-server"))
+
+import system_prompt  # noqa: E402
+
+
+class RenderCacheContract(unittest.TestCase):
+    def setUp(self):
+        system_prompt.invalidate_render_cache()
+
+    def test_same_key_hits_cache(self):
+        calls = []
+
+        async def _fake_uncached(chat_id, user_email):
+            calls.append((chat_id, user_email))
+            return f"rendered:{chat_id}:{user_email}"
+
+        with patch.object(system_prompt, "_render_uncached", side_effect=_fake_uncached):
+            t1 = asyncio.run(system_prompt.render_system_prompt("c1", "u@x"))
+            t2 = asyncio.run(system_prompt.render_system_prompt("c1", "u@x"))
+
+        self.assertEqual(t1, t2)
+        self.assertEqual(len(calls), 1, "second call should hit cache")
+
+    def test_different_key_misses_cache(self):
+        async def _fake_uncached(chat_id, user_email):
+            return f"rendered:{chat_id}:{user_email}"
+
+        with patch.object(system_prompt, "_render_uncached", side_effect=_fake_uncached) as m:
+            asyncio.run(system_prompt.render_system_prompt("c1", "u@x"))
+            asyncio.run(system_prompt.render_system_prompt("c2", "u@x"))
+            asyncio.run(system_prompt.render_system_prompt("c1", None))
+        self.assertEqual(m.call_count, 3)
+
+    def test_invalidate_drops_entry(self):
+        calls = []
+
+        async def _fake_uncached(chat_id, user_email):
+            calls.append(1)
+            return "x"
+
+        with patch.object(system_prompt, "_render_uncached", side_effect=_fake_uncached):
+            asyncio.run(system_prompt.render_system_prompt("c1", None))
+            system_prompt.invalidate_render_cache("c1")
+            asyncio.run(system_prompt.render_system_prompt("c1", None))
+
+        self.assertEqual(len(calls), 2, "invalidate_render_cache('c1') must drop the cached entry")
+
+    def test_ttl_expires(self):
+        calls = []
+
+        async def _fake_uncached(chat_id, user_email):
+            calls.append(1)
+            return "y"
+
+        real_ttl = system_prompt._RENDER_TTL_SECONDS
+        try:
+            system_prompt._RENDER_TTL_SECONDS = 0.01  # 10ms for the test
+            with patch.object(system_prompt, "_render_uncached", side_effect=_fake_uncached):
+                asyncio.run(system_prompt.render_system_prompt("c1", None))
+                time.sleep(0.05)
+                asyncio.run(system_prompt.render_system_prompt("c1", None))
+        finally:
+            system_prompt._RENDER_TTL_SECONDS = real_ttl
+
+        self.assertEqual(len(calls), 2, "entry must be re-rendered after TTL")
+
+
+if __name__ == "__main__":
+    unittest.main()