fix(mothership): let the agent copy files between workspaces without Projects

A copy between workspaces needs only the turn's resource admission, but the copy
authorizer required the Projects rollout for every copy and the agent was offered
copies only through Project file-owner negotiation, so with Projects off every
agent copy failed. The authorizer now requires Projects only for a copy that names
a Project owner. Admitted chat turns declare the worker's workspace-file-copy
capability whether or not Projects are on, the recovery marker restoring
admission is written for every admitted turn, and the sandbox lease records and
exports the same so the workbench terminal binds workspace copies under the
paired grant.

Author: waleedlatif1

apps/sim/lib/mothership/application/file-owner-context.ts

@@ -10,18 +10,21 @@ import {
 } from '@/lib/mothership/auth/application-delegation'
 import { getCopilotFileOwnerAdapter } from '@/lib/mothership/file-owners'
 import type { FileOwnerContext } from '@/lib/mothership/generated/file-owner'
+import { WORKSPACE_FILE_COPY_CAPABILITY } from '@/lib/mothership/generated/protocol'
 import { supportsFileOwnerProtocol } from '@/lib/mothership/request/lifecycle/file-owner-protocol'
 import { getCurrentWorkspaceProject } from '@/lib/projects/application'
 import { isProjectsEnabled } from '@/lib/projects/rollout.server'
 
 const logger = createLogger('CopilotFileOwnerContext')
 
 /**
- * Adds current owner hints to admitted authoring turns using the worker's generated contract.
- * Hints are best-effort: a failed Project lookup sends the turn with no Project rather than failing
- * it. Support is probed on the selected worker URL, which may front several worker releases, and a
- * worker that predates the hint keys rejects them; rolling the worker back therefore requires
- * turning the `projects` flag off first.
+ * Adds what admitted authoring turns may do with files, using the worker's generated contract.
+ * Every such turn declares `workspace-file-copy`: copies between workspaces need the turn's
+ * admission but not Projects, and a worker that predates the token ignores it. With Projects on,
+ * it also gets current owner hints. Hints are best-effort: a failed Project lookup sends the turn
+ * with no Project rather than failing it. Support is probed on the selected worker URL, which may
+ * front several worker releases, and a worker that predates the hint keys rejects them; rolling
+ * the worker back therefore requires turning the `projects` flag off first.
  */
 export async function withFileOwnerContext(
   payload: Record<string, unknown>,
@@ -30,14 +33,17 @@ export async function withFileOwnerContext(
   route: string
 ): Promise<Record<string, unknown>> {
   const clean = omit(payload, ['project', 'fileOwnerCapabilities', 'fileOwnerProtocolVersion'])
-  if (
-    !['/api/copilot', '/api/mothership'].includes(route) ||
-    context.requestMode === 'assistant' ||
-    !hasCopilotResourceAdmission(context) ||
-    !(await isProjectsEnabled()) ||
-    !(await supportsFileOwnerProtocol(baseURL))
+  if (!['/api/copilot', '/api/mothership'].includes(route)) return clean
+  const admitted = context.requestMode !== 'assistant' && hasCopilotResourceAdmission(context)
+  const declared = (Array.isArray(clean.clientCapabilities) ? clean.clientCapabilities : []).filter(
+    (capability) => capability !== WORKSPACE_FILE_COPY_CAPABILITY
   )
-    return clean
+  const turn = {
+    ...clean,
+    clientCapabilities: admitted ? [...declared, WORKSPACE_FILE_COPY_CAPABILITY] : declared,
+  }
+  if (!admitted || !(await isProjectsEnabled()) || !(await supportsFileOwnerProtocol(baseURL)))
+    return turn
 
   const hints: FileOwnerContext = {
     fileOwnerProtocolVersion: 1,
@@ -70,5 +76,5 @@ export async function withFileOwnerContext(
         })
     }
   }
-  return { ...clean, ...hints }
+  return { ...turn, ...hints }
 }

apps/sim/lib/mothership/chat/post.ts

@@ -1408,7 +1408,7 @@ export async function handleUnifiedChatPost(req: NextRequest) {
         if (!lease || !sendClaim?.claimToken || sendClaim.storageMethod !== 'database') {
           throw new Error('Chat admission requires its controller and durable send claim')
         }
-        const resourceAuthoringVersion = await durableResourceAuthoringVersion(
+        const resourceAuthoringVersion = durableResourceAuthoringVersion(
           executionContext.copilotResourceAdmission !== undefined
         )
         admittedRun = await admitChatTurn.execute({

apps/sim/lib/mothership/generated/protocol.ts

@@ -303,6 +303,12 @@ export const TOOL_DEADLINE_SETTLE_MARGIN_MS = 90_000;
 /** The `clientCapabilities` token a Sim sends when it honors `StreamToolDeadline`. */
 export const TOOL_DEADLINE_CAPABILITY = "tool-deadline";
 
+/**
+ * The `clientCapabilities` token a Sim sends when this turn may copy files between workspaces
+ * (`files copy`) without negotiated file owners, so also where Projects are off.
+ */
+export const WORKSPACE_FILE_COPY_CAPABILITY = "workspace-file-copy";
+
 /** POST /api/mothership — the chat request sim sends. */
 export interface ChatRequest extends StreamResponseReceipt {
   fileOwnerProtocolVersion?: 1 | undefined;
@@ -348,7 +354,8 @@ export interface ChatRequest extends StreamResponseReceipt {
    * grace windows and run tools server-side immediately. ABSENT = older/unknown caller —
    * dispatch keeps its conservative grace (deploy-skew safe: a stale tab that predates
    * this field still gets waited on). Known capability: "workflow-tool-pickup". Sim also
-   * declares its own {@link TOOL_DEADLINE_CAPABILITY} here.
+   * declares its own {@link TOOL_DEADLINE_CAPABILITY} and {@link WORKSPACE_FILE_COPY_CAPABILITY}
+   * here.
    */
   clientCapabilities?: string[] | undefined;
   /**

apps/sim/lib/mothership/request/lifecycle/recovery-config.test.ts

@@ -104,15 +104,22 @@ describe('recovery marker written by an admitted turn', () => {
     }),
   }
 
-  it('stays off a recovery config older builds must still parse while Projects are off', async () => {
-    featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(false)
-    const recovery = await streamRecoveryConfig(options, workspaceRequest)
-    expect(recovery).not.toHaveProperty('resourceAuthoringVersion')
-  })
+  it.each([true, false])(
+    'restores authoring admission on recovery whether Projects are on (%s) or off',
+    async (projects) => {
+      featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(
+        async (flag) => projects && flag === 'projects'
+      )
+      const recovery = await streamRecoveryConfig(options, workspaceRequest)
+      expect(recovery?.resourceAuthoringVersion).toBe(1)
+    }
+  )
 
-  it('restores authoring admission on recovery while Projects are on', async () => {
-    featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(async (flag) => flag === 'projects')
-    const recovery = await streamRecoveryConfig(options, workspaceRequest)
-    expect(recovery?.resourceAuthoringVersion).toBe(1)
+  it('stays off a turn that was never admitted', async () => {
+    const recovery = await streamRecoveryConfig(
+      { ...options, copilotResourceAdmission: undefined },
+      workspaceRequest
+    )
+    expect(recovery).not.toHaveProperty('resourceAuthoringVersion')
   })
 })

apps/sim/lib/mothership/request/lifecycle/recovery-config.ts

@@ -3,7 +3,6 @@ import { hasCopilotResourceAdmission } from '@/lib/mothership/auth/application-d
 import { COPILOT_REQUEST_MODES } from '@/lib/mothership/constants'
 import { ChatPayloadSchema } from '@/lib/mothership/generated/protocol'
 import type { CopilotLifecycleOptions } from '@/lib/mothership/request/lifecycle/run'
-import { isProjectsEnabled } from '@/lib/projects/rollout.server'
 
 export const BillingAdmissionSchema = z
   .object({
@@ -28,14 +27,14 @@ export const DurableChatRequestSchema = ChatPayloadSchema.safeExtend({
 export const RESOURCE_AUTHORING_VERSION = 1
 
 /**
- * The marker an admitted turn stores for recovery. Builds before it parse recovery strictly and
- * would refuse to recover the run, and only Project authoring reads it, so it is written only
- * while Projects are on.
+ * The marker an admitted turn stores for recovery, so a recovered turn keeps its admission. It is
+ * written whether or not Projects are on, since copies between workspaces need the admission
+ * without them; every release since the marker shipped parses it.
  */
-export async function durableResourceAuthoringVersion(
+export function durableResourceAuthoringVersion(
   admitted: boolean
-): Promise<typeof RESOURCE_AUTHORING_VERSION | undefined> {
-  return admitted && (await isProjectsEnabled()) ? RESOURCE_AUTHORING_VERSION : undefined
+): typeof RESOURCE_AUTHORING_VERSION | undefined {
+  return admitted ? RESOURCE_AUTHORING_VERSION : undefined
 }
 
 export const StreamRecoveryConfigSchema = z
@@ -66,7 +65,7 @@ export async function streamRecoveryConfig(
   request: Record<string, unknown>
 ) {
   if (options.interactive !== true) return undefined
-  const resourceAuthoringVersion = await durableResourceAuthoringVersion(
+  const resourceAuthoringVersion = durableResourceAuthoringVersion(
     hasCopilotResourceAdmission({
       ...options,
       ...options.executionContext,

apps/sim/lib/mothership/tools/sandbox-file-copy.ts

@@ -13,6 +13,7 @@ import {
   recordSandboxResourceEffects,
   type SandboxResourceScope,
 } from '@/lib/mothership/tools/sandbox-resources'
+import { copiesWithinWorkspaces } from '@/lib/workspace-files/application/copy-operation'
 
 const logger = createLogger('SandboxFileCopy')
 
@@ -22,15 +23,17 @@ export async function proxySandboxFileCopyRequest(
   token: string,
   scope: SandboxResourceScope
 ): Promise<Response> {
+  const unavailable = () =>
+    Response.json(
+      { error: 'Paired file owner routing is unavailable or contradictory' },
+      { status: 403 }
+    )
   if (
-    scope.fileOwnerProtocolVersion !== 1 ||
+    (scope.fileOwnerProtocolVersion !== 1 && !scope.workspaceFileCopy) ||
     request.headers.has('x-mothership-file-owner') ||
     request.headers.has('x-mothership-workspace-id')
   )
-    return Response.json(
-      { error: 'Paired file owner routing is unavailable or contradictory' },
-      { status: 403 }
-    )
+    return unavailable()
   if (request.method !== 'POST')
     return Response.json({ error: 'Method not allowed' }, { status: 405 })
   const parsed = await parseRequest(
@@ -43,6 +46,9 @@ export async function proxySandboxFileCopyRequest(
     }
   )
   if (!parsed.success) return parsed.response
+  // Without the negotiated protocol only workspace owners exist for this lease.
+  if (scope.fileOwnerProtocolVersion !== 1 && !copiesWithinWorkspaces(parsed.data.body))
+    return unavailable()
   const endpoint = getInternalApiBaseUrl()
   const transport = createFileCopyCliTransport(
     endpoint,

apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts

@@ -16,6 +16,7 @@ import { assertWorkspaceInvocationScope } from '@/lib/core/application/workspace
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 import { projectFileOperations } from '@/lib/projects/files/application/operations'
+import { fileCopyOperation } from '@/lib/workspace-files/application/copy-operation'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
 const { readScope, recordEffects, fetcher, routeMatcher, recordInput } = vi.hoisted(() => ({
@@ -436,26 +437,72 @@ it.each([
   }
 )
 
-it('refuses a Project copy destination on a lease without the file-owner protocol', async () => {
-  readScope.mockResolvedValue({ ...scope, fileOwnerProtocolVersion: undefined })
-  routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })
+it('binds a workspace pair under the paired copy grant on an admitted lease without the protocol', async () => {
+  readScope.mockResolvedValue({
+    ...scope,
+    fileOwnerProtocolVersion: undefined,
+    workspaceFileCopy: true,
+  })
+  routeMatcher.mockReturnValue({
+    pattern: '/api/v2/files/copy',
+    params: {},
+    load: async () => ({ POST: fetcher }),
+  })
+  fetcher.mockImplementation(async (forwarded: Request) => {
+    expect(
+      copilotRequestPrincipal(forwarded, fileCopyOperation, {
+        operation: fileCopyOperation,
+        delegationAudience: fileCopyOperation.delegationAudience,
+      })
+    ).toMatchObject({
+      kind: 'resource_delegated',
+      subjectUserId: scope.userId,
+      invocation: { kind: 'chat', chatId: scope.chatId },
+      scope: { kind: 'file_copy', destination: { owner: workspaceOwner } },
+    })
+    return Response.json({ data: { copied: [] } })
+  })
   const response = await proxySandboxResourceRequest(
     request('/api/v2/files/copy', {
       method: 'POST',
       body: JSON.stringify({
         source: { owner: workspaceOwner, fileIds: ['file'] },
-        destination: { owner: { entityType: 'project', entityId: 'project' } },
+        destination: { owner: workspaceOwner },
       }),
     }),
     token
   )
-  expect(response.status).toBe(403)
-  expect(await response.json()).toEqual({
-    error: 'Paired file owner routing is unavailable or contradictory',
-  })
-  expect(fetcher).not.toHaveBeenCalled()
+  expect(response.status).toBe(200)
+  expect(fetcher).toHaveBeenCalledTimes(1)
 })
 
+it.each([undefined, true as const])(
+  'refuses a Project copy destination on a lease without the file-owner protocol (workspace copies %s)',
+  async (workspaceFileCopy) => {
+    readScope.mockResolvedValue({
+      ...scope,
+      fileOwnerProtocolVersion: undefined,
+      workspaceFileCopy,
+    })
+    routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })
+    const response = await proxySandboxResourceRequest(
+      request('/api/v2/files/copy', {
+        method: 'POST',
+        body: JSON.stringify({
+          source: { owner: workspaceOwner, fileIds: ['file'] },
+          destination: { owner: { entityType: 'project', entityId: 'project' } },
+        }),
+      }),
+      token
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({
+      error: 'Paired file owner routing is unavailable or contradictory',
+    })
+    expect(fetcher).not.toHaveBeenCalled()
+  }
+)
+
 it('validates a copy body itself once the lease negotiated the file-owner protocol', async () => {
   readScope.mockResolvedValue({ ...scope, fileOwnerProtocolVersion: 1 })
   routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })

apps/sim/lib/mothership/tools/sandbox-resource-transport.ts

@@ -28,6 +28,7 @@ import {
   type SandboxResourceScope,
 } from '@/lib/mothership/tools/sandbox-resources'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { copiesWithinWorkspaces } from '@/lib/workspace-files/application/copy-operation'
 
 const logger = createLogger('MothershipSandboxResourceTransport')
 
@@ -54,15 +55,20 @@ export async function proxySandboxResourceRequest(
   if (!scope)
     return Response.json({ error: 'Sandbox tool execution is no longer active' }, { status: 403 })
   /**
-   * Paired owners need the negotiated protocol. Without it, only a copy that names a non-workspace
-   * owner is refused there; workspace copies and invalid bodies keep the workspace route and its
+   * Copies bind both owners under the paired grant. Project owners need the negotiated protocol,
+   * and an admitted lease copies between workspaces without it; a copy naming a Project owner is
+   * refused there. Otherwise workspace copies and invalid bodies keep the workspace route and its
    * v2 validation response.
    */
   if (path === v2CopyFileItemsContract.path) {
     const buffered = await bufferCopyRequest(request)
     if (buffered instanceof Response) return buffered
     request = buffered
-    if (scope.fileOwnerProtocolVersion === 1 || (await copiesBeyondWorkspaces(request)))
+    if (
+      scope.fileOwnerProtocolVersion === 1 ||
+      scope.workspaceFileCopy ||
+      (await copiesBeyondWorkspaces(request))
+    )
       return proxySandboxFileCopyRequest(request, token, scope)
   }
   const ownerHeader = request.headers.get('x-mothership-file-owner')
@@ -245,9 +251,5 @@ async function copiesBeyondWorkspaces(request: Request): Promise<boolean> {
     {},
     V2_PARSE_DEFAULTS
   )
-  return (
-    parsed.success &&
-    (parsed.data.body.source.owner.entityType !== 'workspace' ||
-      parsed.data.body.destination.owner.entityType !== 'workspace')
-  )
+  return parsed.success && !copiesWithinWorkspaces(parsed.data.body)
 }

apps/sim/lib/mothership/tools/sandbox-resources.test.ts

@@ -308,7 +308,7 @@ it.each([
   [true, false, true, undefined],
   [true, true, false, undefined],
 ] as const)(
-  'negotiates the callback protocol only with admission=%s projects=%s peer=%s',
+  'negotiates the callback protocol only with admission=%s projects=%s peer=%s; copies follow admission alone',
   async (admitted, enabled, supported, expected) => {
     featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(enabled)
     vi.stubGlobal(
@@ -334,6 +334,7 @@ it.each([
         if (!token) throw new Error('Callback token missing')
         const scope = await readSandboxResourceScope(token, 'secret')
         expect(scope?.fileOwnerProtocolVersion).toBe(expected)
+        expect(scope?.workspaceFileCopy).toBe(admitted ? true : undefined)
       }
     )
   }

apps/sim/lib/mothership/tools/sandbox-resources.ts

@@ -28,6 +28,7 @@ const scopeSchema = z
     organizationId: z.string().optional(),
     apiKeyHash: z.string(),
     fileOwnerProtocolVersion: z.literal(1).optional(),
+    workspaceFileCopy: z.literal(true).optional(),
   })
   .refine(
     (scope) => Boolean(scope.workspaceId) !== Boolean(scope.organizationId),
@@ -46,6 +47,7 @@ interface ActiveSandboxResourceScope {
   signal: AbortSignal
   token?: string
   fileOwnerProtocolVersion?: 1
+  workspaceFileCopy?: true
 }
 
 const resourceScope = new AsyncLocalStorage<ActiveSandboxResourceScope>()
@@ -60,6 +62,11 @@ export function activeSandboxFileOwnerProtocol() {
   return resourceScope.getStore()?.fileOwnerProtocolVersion
 }
 
+/** An admitted tool's lease copies between workspaces whether or not Projects are on. */
+export function activeSandboxWorkspaceFileCopy() {
+  return resourceScope.getStore()?.workspaceFileCopy
+}
+
 const contextKey = (token: string) => `mothership:sandbox-resources:${token}:context`
 const inboxKey = (token: string) => `mothership:sandbox-resources:${token}:inbox`
 const seenKey = (token: string) => `mothership:sandbox-resources:${token}:seen`
@@ -96,6 +103,7 @@ export async function sandboxResourceEndpoint(
     (await supportsFileOwnerProtocol(identity.mothershipBaseURL))
       ? 1
       : undefined
+  const workspaceFileCopy = identity.resourceAdmitted ? (true as const) : undefined
   const scope: SandboxResourceScope = {
     toolCallId: identity.toolCallId,
     runId: identity.runId,
@@ -106,8 +114,10 @@ export async function sandboxResourceEndpoint(
     organizationId: identity.organizationId,
     apiKeyHash: sha256Hex(apiKey),
     fileOwnerProtocolVersion,
+    workspaceFileCopy,
   }
   active.fileOwnerProtocolVersion = fileOwnerProtocolVersion
+  active.workspaceFileCopy = workspaceFileCopy
   await redisClient().set(contextKey(token), JSON.stringify(scope), 'EX', CONTEXT_TTL_SECONDS)
   active.token = token
   if (active.signal.aborted) {