fix(mothership): refuse desktop claims for unapproved or stopped calls (

#8643) * fix(mothership): refuse desktop claims for unapproved or stopped calls The desktop authorize route claimed any pending call, so a gated terminal run that was still awaiting approval, or a call on a run the user had stopped, could be claimed and executed. The claim now locks the run row and refuses once tool admission has closed (Stop, a newer turn, or the run's end), and refuses a call held for the user's decision until they allow it. Whether a call is gated depends on the turn, so pre-persist records it on the row (permission_requested_at). Stop now settles the stopped runs' open desktop calls in the transaction that closes admission: unclaimed calls as never started, claimed calls as outcome unknown. A result for an already-settled call (a retry, or one that lost to Stop) is acknowledged with the stored outcome instead of 404/500. * fix(mothership): settle every open desktop call on Stop and answer 410 after it Stop also settles delivered desktop calls and reads of granted local folders. Authorize checks admission before the call's status, so a call Stop already settled answers 410 rather than 404. * test(mothership): assert the acknowledged outcome, not the publish mock * test(mothership): give the hand-built tool call table the new permission column * refactor(mothership): one claim primitive, one desktop-tool classifier, sealed Stop results The desktop claim is now an option of the run-locked tool execution claim (claimSimToolExecution becomes claimToolExecution) instead of a second copy of the admission check. Stop picks the open desktop calls with the shared TS classifier, which moves to lib/mothership/tools/desktop-tools.ts, instead of a SQL restatement of it, and seals each result the way the confirm route does, so a waiter restores what Stop did rather than failing to unseal it. * fix(mothership): a declined call stays unclaimable without its gate marker Calls gated before permission_requested_at existed carry no marker, so a recorded decision that does not allow the call now disqualifies it too. * test(mothership): assert authorize outcomes, not claim mock calls
waleedlatif1 · Oct 8, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
commit 46cd710f60c161a0e29ea9993970d415aa6d1916
diff --git a/apps/sim/app/api/copilot/confirm/route.test.ts b/apps/sim/app/api/copilot/confirm/route.test.ts
@@ -624,6 +624,25 @@ describe('Copilot Confirm API Route', () => {
     )
   })
 
+  it.each([
+    ['client_tool', 'running', 'success', completeAsyncToolCall],
+    ['browser_snapshot', 'pending', 'error', completePendingAsyncToolCall],
+  ] as const)(
+    'acknowledges a %s result whose write lost to a settlement that landed first',
+    async (toolName, storedStatus, status, completion) => {
+      const row = { ...existingRow, toolName, claimedBy: null }
+      getAsyncToolCall
+        .mockResolvedValueOnce({ ...row, status: storedStatus })
+        .mockResolvedValueOnce({ ...row, status: 'failed' })
+      completion.mockResolvedValueOnce(null)
+
+      const response = await POST(createMockPostRequest({ toolCallId: 'tool-call-123', status }))
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toMatchObject({ toolCallId: 'tool-call-123', status: 'error' })
+    }
+  )
+
   it('does not publish when another terminal confirmation already won', async () => {
     completeAsyncToolCall.mockResolvedValueOnce(null)
 

diff --git a/apps/sim/app/api/copilot/confirm/route.ts b/apps/sim/app/api/copilot/confirm/route.ts
@@ -1,4 +1,5 @@
-import { isBrowserToolName, isCurrentBrowserToolName } from '@sim/browser-protocol'
+import type { Span } from '@opentelemetry/api'
+import { isBrowserToolName } from '@sim/browser-protocol'
 import { createLogger } from '@sim/logger'
 import { isTerminalToolName } from '@sim/terminal-protocol'
 import { getErrorMessage, toError } from '@sim/utils/errors'
@@ -12,7 +13,7 @@ import {
   ASYNC_TOOL_STATUS,
   type AsyncCompletionData,
   type AsyncConfirmationStatus,
-  DESKTOP_TOOL_CLAIM_OWNER,
+  type AsyncTerminalStatus,
   isDeliveredAsyncStatus,
   isTerminalAsyncStatus,
   isWorkflowToolExecutionClaimable,
@@ -38,11 +39,9 @@ import {
   createUnauthorizedResponse,
 } from '@/lib/mothership/request/http'
 import { withIncomingGoSpan } from '@/lib/mothership/request/otel'
-import {
-  retainSealedClientToolContext,
-  sealClientToolCompletion,
-} from '@/lib/mothership/request/tools/client-completion-seal.server'
+import { sealClientToolSettlement } from '@/lib/mothership/request/tools/client-completion-seal.server'
 import { isWorkflowToolName } from '@/lib/mothership/tools/client-executed-tools'
+import { getDesktopToolClaimOwner } from '@/lib/mothership/tools/desktop-tools'
 import {
   createStructuralWorkflowToolCompletionData,
   getWorkflowToolCompletionExecutionId,
@@ -83,6 +82,24 @@ function createConfirmationResponse(
   return NextResponse.json({ success: true, message, toolCallId, status })
 }
 
+/**
+ * A result for a call that is already settled — a retried delivery, or one that lost to the server
+ * settling the call first (Stop, a fast "not started" failure) — answers with the stored outcome.
+ * Nothing is written or published again, and the reporter stops retrying.
+ */
+function acknowledgeSettledToolCall(
+  span: Span,
+  toolCallId: string,
+  storedStatus: AsyncTerminalStatus
+): NextResponse {
+  const settledStatus = getWorkflowToolConfirmationStatus(storedStatus)
+  span.setAttributes({
+    [TraceAttr.ToolConfirmationStatus]: settledStatus,
+    [TraceAttr.CopilotConfirmOutcome]: CopilotConfirmOutcome.Delivered,
+  })
+  return createConfirmationResponse(toolCallId, settledStatus, 'Tool call was already settled')
+}
+
 /** Atomically finalize or detach a client tool before publishing its wakeup event. */
 async function updateToolCallStatus(
   existing: NonNullable<Awaited<ReturnType<typeof getAsyncToolCall>>>,
@@ -284,26 +301,22 @@ export const POST = withRouteHandler((req: NextRequest) => {
           )
         }
 
+        if (!isWorkflowTool && isTerminalAsyncStatus(existing.status)) {
+          return acknowledgeSettledToolCall(span, toolCallId, existing.status)
+        }
+
         const isErrorOrCancelledOutcome =
           status === ASYNC_TOOL_CONFIRMATION_STATUS.error ||
           status === ASYNC_TOOL_CONFIRMATION_STATUS.cancelled
         const isNativeClientTool =
           isBrowserToolName(existing.toolName) ||
           isTerminalToolName(existing.toolName) ||
           existing.toolName === 'import_local_files'
+        const nativeClaimOwner = getDesktopToolClaimOwner(existing.toolName)
         const isPreclaimNativeTerminalOutcome =
-          (isCurrentBrowserToolName(existing.toolName) ||
-            isTerminalToolName(existing.toolName) ||
-            existing.toolName === 'import_local_files') &&
+          nativeClaimOwner !== undefined &&
           existing.status === ASYNC_TOOL_STATUS.pending &&
           isErrorOrCancelledOutcome
-        const nativeClaimOwner = isCurrentBrowserToolName(existing.toolName)
-          ? DESKTOP_TOOL_CLAIM_OWNER.browser
-          : isTerminalToolName(existing.toolName)
-            ? DESKTOP_TOOL_CLAIM_OWNER.terminal
-            : existing.toolName === 'import_local_files'
-              ? DESKTOP_TOOL_CLAIM_OWNER.files
-              : undefined
         const isIndeterminateNativeExit =
           isPreclaimNativeTerminalOutcome &&
           status === ASYNC_TOOL_CONFIRMATION_STATUS.error &&
@@ -401,27 +414,24 @@ export const POST = withRouteHandler((req: NextRequest) => {
             }
           : {
               message: getClientToolCompletionMessage(status),
-              data: {
-                ...retainSealedClientToolContext(existing.result),
-                ...(await sealClientToolCompletion({
-                  toolCallId,
-                  runId: existing.runId,
-                  userId: authenticatedUserId,
-                  ...(isIndeterminateNativeExit
-                    ? {
-                        message: NATIVE_HANDOFF_INTERRUPTED_MESSAGE,
-                        data: {
-                          error: NATIVE_HANDOFF_INTERRUPTED_MESSAGE,
-                          outcomeUnknown: true,
-                          doNotRetry: true,
-                        },
-                      }
-                    : {
-                        ...(message !== undefined ? { message } : {}),
-                        ...(data !== undefined ? { data } : {}),
-                      }),
-                })),
-              },
+              data: await sealClientToolSettlement(existing.result, {
+                toolCallId,
+                runId: existing.runId,
+                userId: authenticatedUserId,
+                ...(isIndeterminateNativeExit
+                  ? {
+                      message: NATIVE_HANDOFF_INTERRUPTED_MESSAGE,
+                      data: {
+                        error: NATIVE_HANDOFF_INTERRUPTED_MESSAGE,
+                        outcomeUnknown: true,
+                        doNotRetry: true,
+                      },
+                    }
+                  : {
+                      ...(message !== undefined ? { message } : {}),
+                      ...(data !== undefined ? { data } : {}),
+                    }),
+              }),
             }
 
         const updateOutcome = await updateToolCallStatus(
@@ -453,6 +463,13 @@ export const POST = withRouteHandler((req: NextRequest) => {
               )
             : updateOutcome
 
+        if (reconciledOutcome === 'conflict' && !isWorkflowTool) {
+          const settled = await getAsyncToolCall(toolCallId).catch(() => null)
+          if (settled && isTerminalAsyncStatus(settled.status)) {
+            return acknowledgeSettledToolCall(span, toolCallId, settled.status)
+          }
+        }
+
         if (reconciledOutcome === 'conflict' && isPreclaimNativeTerminalOutcome) {
           span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.ToolCallNotFound)
           return createNotFoundResponse('Pending client tool call not found')

diff --git a/apps/sim/app/api/desktop/tool/authorize/route.test.ts b/apps/sim/app/api/desktop/tool/authorize/route.test.ts
@@ -17,7 +17,7 @@ vi.mock('@/lib/mothership/async-runs/repository', () => mothershipAsyncRunsMock)
 
 import { POST } from './route'
 
-const claimPendingAsyncToolCall = mothershipAsyncRunsMockFns.mockClaimPendingAsyncToolCall
+const claimToolExecution = mothershipAsyncRunsMockFns.mockClaimToolExecution
 const getAsyncToolCall = mothershipAsyncRunsMockFns.mockGetAsyncToolCall
 const getRunSegment = mothershipAsyncRunsMockFns.mockGetRunSegment
 const resolveInvocationWorkspace = mothershipWorkspaceTargetMockFns.mockResolveInvocationWorkspace
@@ -50,7 +50,7 @@ describe('desktop tool authorization', () => {
       userId: 'user-1',
       status: 'active',
     })
-    claimPendingAsyncToolCall.mockResolvedValue({ toolCallId: 'browser-tool', status: 'running' })
+    claimToolExecution.mockResolvedValue({ outcome: 'claimed' })
   })
 
   it('never returns presentation activity as an executable browser argument', async () => {
@@ -84,7 +84,6 @@ describe('desktop tool authorization', () => {
     const response = await POST(request('retired-browser-tool'))
 
     expect(response.status).toBe(403)
-    expect(claimPendingAsyncToolCall).not.toHaveBeenCalled()
   })
 
   it('rejects a replayed browser action after its pending row was claimed', async () => {
@@ -98,7 +97,6 @@ describe('desktop tool authorization', () => {
 
     const response = await POST(request('browser-tool'))
     expect(response.status).toBe(404)
-    expect(claimPendingAsyncToolCall).not.toHaveBeenCalled()
   })
 
   it('rejects workspace VFS calls and mutating legacy local tools', async () => {
@@ -176,13 +174,11 @@ describe('desktop tool authorization', () => {
       { userId: 'user-1', chatId: 'chat-1', organizationId: 'org-1', workspaceId: undefined },
       'target'
     )
-    expect(claimPendingAsyncToolCall).toHaveBeenCalledExactlyOnceWith('import-1', 'desktop-files')
     getAsyncToolCall.mockResolvedValue({ ...tool, status: 'running', claimedBy: 'desktop-files' })
     expect((await POST(request('import-1', true))).status).toBe(409)
     expect((await POST(request('import-1'))).status).toBe(200)
     getAsyncToolCall.mockResolvedValue({ ...tool, status: 'running', claimedBy: 'sim-stream' })
     expect((await POST(request('import-1'))).status).toBe(404)
-    expect(claimPendingAsyncToolCall).toHaveBeenCalledOnce()
   })
 
   it('rejects inaccessible destinations and lost import claims before exposing files', async () => {
@@ -197,8 +193,7 @@ describe('desktop tool authorization', () => {
       new OrchestrationError('not_found', 'Workspace not found')
     )
     expect((await POST(request('import-1', true))).status).toBe(404)
-    expect(claimPendingAsyncToolCall).not.toHaveBeenCalled()
-    claimPendingAsyncToolCall.mockResolvedValueOnce(null)
+    claimToolExecution.mockResolvedValueOnce({ outcome: 'existing' })
     expect((await POST(request('import-1', true))).status).toBe(409)
   })
 

diff --git a/apps/sim/app/api/desktop/tool/authorize/route.ts b/apps/sim/app/api/desktop/tool/authorize/route.ts
@@ -9,9 +9,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import { DESKTOP_TOOL_CLAIM_OWNER } from '@/lib/mothership/async-runs/lifecycle'
 import {
-  claimPendingAsyncToolCall,
+  claimToolExecution,
   getAsyncToolCall,
   getRunSegment,
+  type ToolExecutionClaim,
 } from '@/lib/mothership/async-runs/repository'
 import {
   authenticateCopilotRequestSessionOnly,
@@ -20,12 +21,33 @@ import {
 } from '@/lib/mothership/request/http'
 import { isUserLocalVfsToolCall } from '@/lib/mothership/tools/local-filesystem'
 
+const admissionClosedResponse = () =>
+  NextResponse.json(
+    { error: 'This chat turn ended or was stopped, so the tool call can no longer run' },
+    { status: 410 }
+  )
+
+/** A refused claim answers the same way for every tool, except how each reports a lost race. */
+function refusedClaimResponse(
+  claim: Exclude<ToolExecutionClaim['outcome'], 'claimed'>,
+  notPending: () => NextResponse
+): NextResponse {
+  if (claim === 'closed') return admissionClosedResponse()
+  if (claim === 'awaiting_permission')
+    return NextResponse.json({ error: 'The user has not approved this tool call' }, { status: 403 })
+  return notPending()
+}
+
 /**
  * Electron calls this endpoint from the main process before every privileged
  * native model action. It returns only server-persisted canonical tool args;
  * Electron validates local-file requests against them and uses them directly
  * for browser and terminal tools. The presentation-only `activity` field is
  * dropped: desktop actions reject arguments they do not declare.
+ *
+ * Nothing is handed over once the run's tool admission has closed (Stop, a
+ * newer turn, or the run's end), nor for a call held for the user's decision
+ * that they have not allowed.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
@@ -37,13 +59,16 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   if (!parsed.success) return parsed.response
 
   const toolCall = await getAsyncToolCall(parsed.data.body.toolCallId)
-  if (!toolCall || (toolCall.status !== 'pending' && toolCall.status !== 'running')) {
-    return createNotFoundResponse('Pending client tool call not found')
-  }
+  if (!toolCall) return createNotFoundResponse('Pending client tool call not found')
   const run = await getRunSegment(toolCall.runId)
   if (!run || run.userId !== userId) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
+  // Ahead of the status checks: Stop settles the run's open calls in the same commit.
+  if (run.toolAdmissionClosedAt) return admissionClosedResponse()
+  if (toolCall.status !== 'pending' && toolCall.status !== 'running') {
+    return createNotFoundResponse('Pending client tool call not found')
+  }
   if (run.status === 'complete' || run.status === 'error' || run.status === 'cancelled') {
     return createNotFoundResponse('Pending client tool call not found')
   }
@@ -84,14 +109,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json(projected.body, { status: projected.status })
     }
     if (parsed.data.body.claim) {
-      if (
-        toolCall.status !== 'pending' ||
-        !(await claimPendingAsyncToolCall(toolCall.toolCallId, DESKTOP_TOOL_CLAIM_OWNER.files))
-      )
-        return NextResponse.json(
+      const alreadyStarted = () =>
+        NextResponse.json(
           { error: 'This import was already started; inspect its result before retrying' },
           { status: 409 }
         )
+      if (toolCall.status !== 'pending') return alreadyStarted()
+      const { outcome } = await claimToolExecution({
+        toolCallId: toolCall.toolCallId,
+        runId: toolCall.runId,
+        userId,
+        claimedBy: DESKTOP_TOOL_CLAIM_OWNER.files,
+      })
+      if (outcome !== 'claimed') return refusedClaimResponse(outcome, alreadyStarted)
     } else if (
       toolCall.status !== 'running' ||
       toolCall.claimedBy !== DESKTOP_TOOL_CLAIM_OWNER.files
@@ -104,16 +134,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   // the Electron boundary — a replayed renderer event must not run a command
   // or click a button twice.
   if (isBrowserTool || isTerminalTool) {
-    if (toolCall.status !== 'pending') {
-      return createNotFoundResponse('Pending client tool call not found')
-    }
-    const claimed = await claimPendingAsyncToolCall(
-      toolCall.toolCallId,
-      isBrowserTool ? DESKTOP_TOOL_CLAIM_OWNER.browser : DESKTOP_TOOL_CLAIM_OWNER.terminal
-    )
-    if (!claimed) {
-      return createNotFoundResponse('Pending client tool call not found')
-    }
+    const notPending = () => createNotFoundResponse('Pending client tool call not found')
+    if (toolCall.status !== 'pending') return notPending()
+    const { outcome } = await claimToolExecution({
+      toolCallId: toolCall.toolCallId,
+      runId: toolCall.runId,
+      userId,
+      claimedBy: isBrowserTool
+        ? DESKTOP_TOOL_CLAIM_OWNER.browser
+        : DESKTOP_TOOL_CLAIM_OWNER.terminal,
+    })
+    if (outcome !== 'claimed') return refusedClaimResponse(outcome, notPending)
   }
 
   return NextResponse.json({