@mseep/open-computer-use 1.0.0

package/tests/orchestrator/test_runtime_cli_endpoint.py

@@ -0,0 +1,108 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Phase 9.5 — pin the /api/runtime/cli endpoint contract.
+
+The endpoint surfaces the resolved SUBAGENT_CLI plus the per-CLI default
+model so the Preview SPA can render an active-CLI badge. Pure additive,
+no auth — but the shape MUST stay byte-stable because the SPA falls back
+silently on missing fields.
+
+Contract:
+  GET /api/runtime/cli -> 200
+  body.cli            in {"claude", "codex", "opencode"}
+  body.default_model  non-empty string for claude (canonical 'sonnet' fallback);
+                      null for codex/opencode when no per-CLI default env is set
+                      (Phase 2 D-02 dropped the hardcoded fallback for those CLIs)
+  body.supports_cost  bool, true ONLY for claude
+  Cache-Control: no-store
+  Method allowlist: GET only (HEAD/POST/PUT/DELETE -> 405)
+"""
+
+import sys
+import unittest
+from importlib import reload
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent.parent
+sys.path.insert(0, str(ROOT / "computer-use-server"))
+
+# The full server stack (mcp, pptx, docx, ...) is heavy and not installed
+# in every dev venv. Skip cleanly if any server import fails — CI has the
+# full requirements installed and will exercise the contract there.
+pytest.importorskip("mcp", reason="server stack not available in this venv")
+pytest.importorskip("httpx", reason="fastapi.testclient needs httpx")
+
+from fastapi.testclient import TestClient  # noqa: E402
+
+
+def _client_with_cli(cli: str) -> TestClient:
+    """Reload docker_manager + app under SUBAGENT_CLI=<cli> and return a TestClient.
+
+    docker_manager reads SUBAGENT_CLI at import time (module-load validation
+    is a project invariant — see Pitfall E in cli_runtime RESEARCH.md), so
+    the env var must be patched before the module is imported. We use a
+    single env patch + reload pair per CLI value.
+    """
+    with patch.dict("os.environ", {"SUBAGENT_CLI": cli}, clear=False):
+        import docker_manager  # noqa: F401
+        reload(docker_manager)
+        # cli_runtime binds `from docker_manager import SUBAGENT_CLI` at
+        # import time — must reload after docker_manager so resolve_cli()
+        # sees the patched value, not the first-import snapshot.
+        import cli_runtime
+        reload(cli_runtime)
+        import app as app_module
+        reload(app_module)
+        return TestClient(app_module.app)
+
+
+class RuntimeCliEndpointContract(unittest.TestCase):
+
+    def test_default_claude(self):
+        client = _client_with_cli("claude")
+        resp = client.get("/api/runtime/cli")
+        self.assertEqual(resp.status_code, 200)
+        body = resp.json()
+        self.assertEqual(body["cli"], "claude")
+        self.assertTrue(body["default_model"], "default_model must be non-empty")
+        self.assertIs(body["supports_cost"], True)
+        self.assertEqual(resp.headers.get("cache-control"), "no-store")
+
+    def test_codex(self):
+        # Phase 2: codex has no hardcoded default — without
+        # CODEX_SUB_AGENT_DEFAULT_MODEL env, default_model is null. The
+        # endpoint surfaces this as None instead of crashing on the
+        # ValueError raised by resolve_subagent_model.
+        client = _client_with_cli("codex")
+        body = client.get("/api/runtime/cli").json()
+        self.assertEqual(body["cli"], "codex")
+        self.assertIs(body["supports_cost"], False)
+        self.assertIsNone(body["default_model"])
+
+    def test_opencode(self):
+        # Phase 2: opencode has no hardcoded default — without
+        # OPENCODE_SUB_AGENT_DEFAULT_MODEL env, default_model is null.
+        client = _client_with_cli("opencode")
+        body = client.get("/api/runtime/cli").json()
+        self.assertEqual(body["cli"], "opencode")
+        self.assertIs(body["supports_cost"], False)
+        self.assertIsNone(body["default_model"])
+
+    def test_method_allowlist(self):
+        client = _client_with_cli("claude")
+        self.assertEqual(client.post("/api/runtime/cli").status_code, 405)
+        self.assertEqual(client.put("/api/runtime/cli").status_code, 405)
+        self.assertEqual(client.delete("/api/runtime/cli").status_code, 405)
+
+    def test_response_shape_is_minimal(self):
+        """No leaked internals — only the three documented keys."""
+        client = _client_with_cli("claude")
+        body = client.get("/api/runtime/cli").json()
+        self.assertEqual(set(body.keys()), {"cli", "default_model", "supports_cost"})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/orchestrator/test_single_user_mode.py

@@ -0,0 +1,212 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for single-user mode and default chat_id fallback.
+
+Three modes via SINGLE_USER_MODE env var:
+- Not set (default): lenient — use 'default' container + warning in response
+- true: single-user — always 'default', no warnings
+- false: strict multi-user — error if no X-Chat-Id
+
+Run: cd computer-use-server && python -m pytest ../tests/orchestrator/test_single_user_mode.py -v
+"""
+
+import os
+import sys
+import unittest
+from unittest.mock import patch, MagicMock, AsyncMock
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', 'computer-use-server'))
+
+from context_vars import current_chat_id
+
+
+def _mock_container():
+    """Create a mock Docker container."""
+    c = MagicMock()
+    c.id = "mock-container-id"
+    c.name = "owui-chat-default"
+    c.status = "running"
+    return c
+
+
+class TestValidateChatId(unittest.TestCase):
+    """Tests for _validate_chat_id() with different SINGLE_USER_MODE values."""
+
+    def test_lenient_mode_no_chat_id_returns_default(self):
+        """Default mode (SINGLE_USER_MODE unset) + no chat_id → returns 'default', no error."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("SINGLE_USER_MODE", None)
+            # Re-import to pick up new env
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "default")
+            self.assertIsNone(error)
+
+    def test_lenient_mode_with_chat_id_returns_it(self):
+        """Default mode + chat_id present → returns that chat_id, no error."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("SINGLE_USER_MODE", None)
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("my-session-123")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "my-session-123")
+            self.assertIsNone(error)
+
+    def test_single_user_mode_always_returns_default(self):
+        """SINGLE_USER_MODE=true → always 'default', even if chat_id was set."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "true"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("should-be-ignored")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "default")
+            self.assertIsNone(error)
+
+    def test_single_user_mode_no_chat_id(self):
+        """SINGLE_USER_MODE=true + no chat_id → 'default', no error."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "true"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "default")
+            self.assertIsNone(error)
+
+    def test_multi_user_mode_no_chat_id_returns_error(self):
+        """SINGLE_USER_MODE=false + no chat_id → error."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "false"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "default")
+            self.assertIsNotNone(error)
+            self.assertIn("required", error.lower())
+
+    def test_multi_user_mode_with_chat_id_works(self):
+        """SINGLE_USER_MODE=false + chat_id present → normal, no error."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "false"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("user-session-456")
+            chat_id, error = mcp_tools._validate_chat_id()
+            self.assertEqual(chat_id, "user-session-456")
+            self.assertIsNone(error)
+
+
+class TestDefaultChatWarning(unittest.TestCase):
+    """Tests for _get_default_chat_warning() helper."""
+
+    def test_lenient_mode_default_chat_returns_warning(self):
+        """Default mode + default chat_id → returns warning text."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("SINGLE_USER_MODE", None)
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            warning = mcp_tools._get_default_chat_warning()
+            self.assertIn("SINGLE_USER_MODE", warning)
+            self.assertIn("X-Chat-Id", warning)
+
+    def test_lenient_mode_real_chat_no_warning(self):
+        """Default mode + real chat_id → no warning."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("SINGLE_USER_MODE", None)
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("real-session")
+            warning = mcp_tools._get_default_chat_warning()
+            self.assertEqual(warning, "")
+
+    def test_single_user_mode_no_warning(self):
+        """SINGLE_USER_MODE=true → no warning ever."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "true"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            warning = mcp_tools._get_default_chat_warning()
+            self.assertEqual(warning, "")
+
+    def test_multi_user_mode_no_warning(self):
+        """SINGLE_USER_MODE=false → no warning (error handled separately)."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "false"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            warning = mcp_tools._get_default_chat_warning()
+            self.assertEqual(warning, "")
+
+
+class TestBashToolSingleUserMode(unittest.IsolatedAsyncioTestCase):
+    """Integration: bash_tool appends warning in lenient mode."""
+
+    async def test_bash_tool_lenient_mode_appends_warning(self):
+        """bash_tool with default chat_id in lenient mode → result + warning."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("SINGLE_USER_MODE", None)
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            ctx = MagicMock()
+            ctx.report_progress = AsyncMock()
+
+            with patch.object(mcp_tools, "_ensure_gitlab_token", new_callable=AsyncMock), \
+                 patch.object(mcp_tools, "_get_or_create_container", side_effect=lambda *a, **k: _mock_container()), \
+                 patch.object(mcp_tools, "execute_bash_streaming",
+                              return_value={"output": "hello\n", "exit_code": 0, "success": True}):
+                result = await mcp_tools.bash_tool("echo hello", "test", ctx)
+
+            self.assertIn("hello", result)
+            self.assertIn("SINGLE_USER_MODE", result)
+
+    async def test_bash_tool_single_user_no_warning(self):
+        """bash_tool with SINGLE_USER_MODE=true → result without warning."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "true"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            ctx = MagicMock()
+            ctx.report_progress = AsyncMock()
+
+            with patch.object(mcp_tools, "_ensure_gitlab_token", new_callable=AsyncMock), \
+                 patch.object(mcp_tools, "_get_or_create_container", side_effect=lambda *a, **k: _mock_container()), \
+                 patch.object(mcp_tools, "execute_bash_streaming",
+                              return_value={"output": "hello\n", "exit_code": 0, "success": True}):
+                result = await mcp_tools.bash_tool("echo hello", "test", ctx)
+
+            self.assertIn("hello", result)
+            self.assertNotIn("SINGLE_USER_MODE", result)
+
+    async def test_bash_tool_multi_user_no_chat_id_returns_error(self):
+        """bash_tool with SINGLE_USER_MODE=false + no chat_id → error."""
+        with patch.dict(os.environ, {"SINGLE_USER_MODE": "false"}, clear=False):
+            import importlib
+            import mcp_tools
+            importlib.reload(mcp_tools)
+            current_chat_id.set("default")
+            ctx = MagicMock()
+            ctx.report_progress = AsyncMock()
+
+            result = await mcp_tools.bash_tool("echo hello", "test", ctx)
+
+            self.assertIn("required", result.lower())
+            self.assertNotIn("hello", result)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/orchestrator/test_startup_warnings.py

@@ -0,0 +1,123 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for server startup warnings.
+
+Covers #59: emit a one-time warning when PUBLIC_BASE_URL is still the
+hardcoded internal-DNS default, to catch the #43-class "preview panel
+never appears" misconfiguration at boot instead of in silent production
+failure.
+
+Run: cd computer-use-server && python -m pytest ../tests/orchestrator/test_startup_warnings.py -v
+"""
+
+import io
+import os
+import sys
+import unittest
+import importlib
+from contextlib import redirect_stdout
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', 'computer-use-server'))
+
+
+def _reload_docker_manager():
+    """Re-import docker_manager after env changes so module-level PUBLIC_BASE_URL
+    picks up the new value. Returns the freshly loaded module."""
+    # Pop any previously imported version so os.getenv is re-evaluated.
+    for mod in list(sys.modules):
+        if mod == "docker_manager" or mod.startswith("docker_manager."):
+            del sys.modules[mod]
+    return importlib.import_module("docker_manager")
+
+
+class PublicBaseUrlDefaultWarning(unittest.TestCase):
+    """#59: warn_if_public_base_url_is_default() fires iff PUBLIC_BASE_URL is unset."""
+
+    def setUp(self):
+        self._saved = os.environ.get("PUBLIC_BASE_URL")
+
+    def tearDown(self):
+        if self._saved is None:
+            os.environ.pop("PUBLIC_BASE_URL", None)
+        else:
+            os.environ["PUBLIC_BASE_URL"] = self._saved
+
+    def test_warns_when_env_unset(self):
+        os.environ.pop("PUBLIC_BASE_URL", None)
+        dm = _reload_docker_manager()
+        self.assertEqual(dm.PUBLIC_BASE_URL, dm.PUBLIC_BASE_URL_DEFAULT)
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_public_base_url_is_default()
+        self.assertTrue(emitted)
+        out = buf.getvalue()
+        self.assertIn("PUBLIC_BASE_URL is still the hardcoded default", out)
+        self.assertIn(dm.PUBLIC_BASE_URL_DEFAULT, out)
+        self.assertIn("openwebui-filter.md", out)
+
+    def test_silent_when_user_overrides_to_custom_url(self):
+        os.environ["PUBLIC_BASE_URL"] = "http://myhost.example.com:8081"
+        dm = _reload_docker_manager()
+        self.assertEqual(dm.PUBLIC_BASE_URL, "http://myhost.example.com:8081")
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_public_base_url_is_default()
+        self.assertFalse(emitted)
+        self.assertEqual(buf.getvalue(), "")
+
+    def test_warns_when_env_explicitly_set_to_default_value(self):
+        """Matches the exact default string — still warns. The symptom is the
+        value, not the mechanism (unset vs explicit)."""
+        os.environ["PUBLIC_BASE_URL"] = "http://computer-use-server:8081"
+        dm = _reload_docker_manager()
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_public_base_url_is_default()
+        self.assertTrue(emitted)
+
+
+class McpApiKeyMissingWarning(unittest.TestCase):
+    """warn_if_mcp_api_key_missing() fires iff MCP_API_KEY is empty/unset.
+
+    An empty key leaves /mcp endpoints unauthenticated — fine for local dev,
+    dangerous for anything reachable from the internet.
+    """
+
+    def setUp(self):
+        self._saved = os.environ.get("MCP_API_KEY")
+
+    def tearDown(self):
+        if self._saved is None:
+            os.environ.pop("MCP_API_KEY", None)
+        else:
+            os.environ["MCP_API_KEY"] = self._saved
+
+    def test_warns_when_env_unset(self):
+        os.environ.pop("MCP_API_KEY", None)
+        dm = _reload_docker_manager()
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_mcp_api_key_missing()
+        self.assertTrue(emitted)
+        self.assertIn("MCP_API_KEY is empty", buf.getvalue())
+
+    def test_warns_when_env_empty_string(self):
+        os.environ["MCP_API_KEY"] = ""
+        dm = _reload_docker_manager()
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_mcp_api_key_missing()
+        self.assertTrue(emitted)
+
+    def test_silent_when_key_set(self):
+        os.environ["MCP_API_KEY"] = "a-long-random-token"
+        dm = _reload_docker_manager()
+        buf = io.StringIO()
+        with redirect_stdout(buf):
+            emitted = dm.warn_if_mcp_api_key_missing()
+        self.assertFalse(emitted)
+        self.assertEqual(buf.getvalue(), "")
+
+
+if __name__ == "__main__":
+    unittest.main()