fix(mothership): settle every open desktop call on Stop and answer 410 after it

Stop also settles delivered desktop calls and reads of granted local
folders. Authorize checks admission before the call's status, so a call
Stop already settled answers 410 rather than 404.

Author: waleedlatif1

apps/sim/app/api/desktop/tool/authorize/route.ts

@@ -59,17 +59,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   if (!parsed.success) return parsed.response
 
   const toolCall = await getAsyncToolCall(parsed.data.body.toolCallId)
-  if (!toolCall || (toolCall.status !== 'pending' && toolCall.status !== 'running')) {
-    return createNotFoundResponse('Pending client tool call not found')
-  }
+  if (!toolCall) return createNotFoundResponse('Pending client tool call not found')
   const run = await getRunSegment(toolCall.runId)
   if (!run || run.userId !== userId) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
+  // Ahead of the status checks: Stop settles the run's open calls in the same commit.
+  if (run.toolAdmissionClosedAt) return admissionClosedResponse()
+  if (toolCall.status !== 'pending' && toolCall.status !== 'running') {
+    return createNotFoundResponse('Pending client tool call not found')
+  }
   if (run.status === 'complete' || run.status === 'error' || run.status === 'cancelled') {
     return createNotFoundResponse('Pending client tool call not found')
   }
-  if (run.toolAdmissionClosedAt) return admissionClosedResponse()
 
   const args = isRecordLike(toolCall.args) ? (toolCall.args as Record<string, unknown>) : {}
   const isBrowserTool = isCurrentBrowserToolName(toolCall.toolName)

apps/sim/lib/mothership/async-runs/repository.ts

@@ -58,6 +58,7 @@ import {
 } from '@/lib/mothership/observability/database'
 import type { BillingAdmission } from '@/lib/mothership/request/lifecycle/recovery-config'
 import { markSpanForError } from '@/lib/mothership/request/otel'
+import { USER_LOCAL_VFS_ROOT } from '@/lib/mothership/tools/local-filesystem'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 
 const logger = createLogger('CopilotAsyncRunsRepo')
@@ -216,6 +217,22 @@ export async function requestRunStop(
  * none can be claimed afterwards and none is left looking live. A call nobody claimed never
  * started; one the desktop claimed may already have acted.
  */
+function isUserLocalVfsPath(path: SQL): SQL {
+  return sql`(${path} = ${USER_LOCAL_VFS_ROOT} OR ${path} LIKE ${`${USER_LOCAL_VFS_ROOT}/%`})`
+}
+
+/** The SQL form of `isUserLocalVfsToolCall`: a VFS read of a granted local folder. */
+const isUserLocalVfsCall = or(
+  and(
+    inArray(copilotAsyncToolCalls.toolName, ['read', 'grep']),
+    isUserLocalVfsPath(sql`${copilotAsyncToolCalls.args}->>'path'`)
+  ),
+  and(
+    eq(copilotAsyncToolCalls.toolName, 'glob'),
+    isUserLocalVfsPath(sql`${copilotAsyncToolCalls.args}->>'pattern'`)
+  )
+)
+
 async function cancelOpenDesktopToolCalls(
   tx: RunAdmissionTransaction,
   stoppedRuns: SQL | undefined
@@ -247,8 +264,9 @@ async function cancelOpenDesktopToolCalls(
         inArray(copilotAsyncToolCalls.status, [
           ASYNC_TOOL_STATUS.pending,
           ASYNC_TOOL_STATUS.running,
+          ASYNC_TOOL_STATUS.delivered,
         ]),
-        inArray(copilotAsyncToolCalls.toolName, [...DESKTOP_TOOL_NAMES])
+        or(inArray(copilotAsyncToolCalls.toolName, [...DESKTOP_TOOL_NAMES]), isUserLocalVfsCall)
       )
     )
 }

apps/sim/lib/mothership/tools/client/desktop-tool-authorization.integration.ts

@@ -16,7 +16,7 @@ const { redisUrl, inheritedEnv } = await vi.hoisted(async () => {
     COPILOT_TOOL_PERMISSIONS_ENABLED: process.env.COPILOT_TOOL_PERMISSIONS_ENABLED,
   }
   /** The real Redis module, the confirmation channel and the permission flag read these at import. */
-  process.env.REDIS_URL = url
+  if (url) process.env.REDIS_URL = url
   process.env.COPILOT_TOOL_PERMISSIONS_ENABLED = 'true'
   return { redisUrl: url, inheritedEnv }
 })
@@ -253,7 +253,7 @@ describe.runIf(Boolean(redisUrl))('desktop tool calls the server no longer admit
 
     await requestRunStop({ userId, workspaceId, streamId, chatId })
 
-    expect((await desktopClaims(toolCallId)).ok).toBe(false)
+    expect((await desktopClaims(toolCallId)).status).toBe(410)
     expect(await storedCall(toolCallId)).toMatchObject({
       status: 'cancelled',
       claimedBy: null,
@@ -267,7 +267,7 @@ describe.runIf(Boolean(redisUrl))('desktop tool calls the server no longer admit
 
     await closeStreamToolAdmission(streamId, userId)
 
-    expect((await desktopClaims(toolCallId)).ok).toBe(false)
+    expect((await desktopClaims(toolCallId)).status).toBe(410)
     expect(await storedCall(toolCallId)).toMatchObject({ status: 'pending', claimedBy: null })
   })
 
@@ -277,7 +277,17 @@ describe.runIf(Boolean(redisUrl))('desktop tool calls the server no longer admit
 
     await closeStreamToolAdmission(streamId, userId)
 
-    expect((await desktopClaims(toolCallId)).ok).toBe(false)
+    expect((await desktopClaims(toolCallId)).status).toBe(410)
+  })
+
+  it('settles a read of a granted local folder when the user stops', async () => {
+    const { runId, streamId } = await startRun()
+    const toolCallId = await agentCalls(runId, 'read', { path: 'user-local/Project--mount-1/a.md' })
+
+    await requestRunStop({ userId, workspaceId, streamId, chatId })
+
+    expect(await storedCall(toolCallId)).toMatchObject({ status: 'cancelled' })
+    expect((await desktopClaims(toolCallId)).status).toBe(410)
   })
 
   it('refuses the claim itself once admission closed, so a claim racing Stop cannot win', async () => {