fix(desktop): never fail an awake device's call as offline because a presence write was lost

Presence writes are best effort, so a pull whose write failed left the key
missing and the next read took the device for offline, failing its pending
call early. A call now fails early as offline only when presence is absent and
the device has not pulled for longer than the presence TTL plus the interval
at which a pull writes last_seen_at; otherwise its pickup window decides.

The audit test no longer depends on the insertion order of audit writes,
which are not awaited.

Author: waleedlatif1

apps/sim/lib/desktop/application/executor.integration.ts

@@ -681,7 +681,6 @@ describe.runIf(Boolean(redisUrl))('desktop background executor protocol', () =>
           })
           .from(auditLog)
           .where(eq(auditLog.resourceId, desktop.deviceId))
-          .orderBy(auditLog.createdAt)
       await expect.poll(async () => (await audited()).length).toBe(2)
       const entry = (action: string) => ({
         action,
@@ -695,10 +694,13 @@ describe.runIf(Boolean(redisUrl))('desktop background executor protocol', () =>
           chatId: run.chatId,
         }),
       })
-      expect(await audited()).toEqual([
-        entry('desktop_tool_call.claimed'),
-        entry('desktop_tool_call.completed'),
-      ])
+      /** Audit writes are not awaited, so their insertion order is not the call order. */
+      expect(await audited()).toEqual(
+        expect.arrayContaining([
+          entry('desktop_tool_call.claimed'),
+          entry('desktop_tool_call.completed'),
+        ])
+      )
       expect(JSON.stringify(await audited())).not.toContain('Clicked Save')
     })
 

apps/sim/lib/desktop/executor/bound-turn.integration.ts

@@ -438,6 +438,11 @@ describe.runIf(Boolean(redisUrl))("a turn bound to a desktop's background execut
     async () => {
       const desktop = await signedInDesktop()
       const run = await boundRun(desktop)
+      /** Its last pull was minutes ago, and its presence lapsed long since. */
+      await db
+        .update(desktopDevices)
+        .set({ lastSeenAt: sql`now() - interval '10 minutes'` })
+        .where(eq(desktopDevices.id, desktop.deviceId))
 
       const startedAt = Date.now()
       const { toolCallId, answer, context } = await agentCalls(run, 'terminal', {
@@ -622,6 +627,34 @@ describe.runIf(Boolean(redisUrl))("a turn bound to a desktop's background execut
     TURN_WAIT_MS
   )
 
+  it(
+    'never fails an awake device’s call early because its presence write was lost',
+    async () => {
+      const desktop = await signedInDesktop()
+      const run = await boundRun(desktop)
+      const redis = getRedisClient()
+      if (!redis) throw new Error('Redis is required')
+      const writes = vi.spyOn(redis, 'set').mockRejectedValue(new Error('Redis unavailable'))
+      try {
+        /** The pull succeeds, but its presence write fails: the key reads as absent. */
+        await desktop.pull()
+      } finally {
+        writes.mockRestore()
+      }
+
+      const { toolCallId, answer, context } = await agentCalls(run, 'browser_click', { ref: 'e1' })
+      await offered(toolCallId)
+      await sleep(POLL_SETTLES_MS)
+      expect((await storedCall(toolCallId)).status).toBe('pending')
+      const { executionToken } = await desktop.claim(toolCallId)
+      await desktop.complete(toolCallId, executionToken, { clicked: true })
+      await answer
+
+      expect(resultOf(context, toolCallId)).toMatchObject({ success: true })
+    },
+    TURN_WAIT_MS
+  )
+
   it(
     'enforces the pickup window when presence cannot be read, without failing a call early',
     async () => {

apps/sim/lib/desktop/executor/constants.ts

@@ -18,6 +18,9 @@ export const DESKTOP_INBOX_RECONCILE_MS = 10_000
  */
 export const DESKTOP_PRESENCE_TTL_SECONDS = 45
 
+/** How often an inbox pull writes the device's `last_seen_at`; at most once per interval. */
+export const DESKTOP_LAST_SEEN_WRITE_SECONDS = 60
+
 /**
  * Only runs started this recently are scanned for inbox items. A turn, including a terminal
  * handoff, ends well inside it, and the bound keeps the inbox query on a narrow index range.

apps/sim/lib/desktop/executor/repository.ts

@@ -18,7 +18,11 @@ import {
   type SQL,
   sql,
 } from 'drizzle-orm'
-import { DESKTOP_INBOX_HORIZON_HOURS } from '@/lib/desktop/executor/constants'
+import {
+  DESKTOP_INBOX_HORIZON_HOURS,
+  DESKTOP_LAST_SEEN_WRITE_SECONDS,
+  DESKTOP_PRESENCE_TTL_SECONDS,
+} from '@/lib/desktop/executor/constants'
 import {
   ASYNC_TOOL_STATUS,
   DESKTOP_TOOL_CLAIM_OWNER,
@@ -142,7 +146,7 @@ export async function touchDesktopDevice(deviceId: string): Promise<void> {
     .where(
       and(
         eq(desktopDevices.id, deviceId),
-        sql`${desktopDevices.lastSeenAt} < now() - interval '1 minute'`
+        sql`${desktopDevices.lastSeenAt} < now() - ${DESKTOP_LAST_SEEN_WRITE_SECONDS} * interval '1 second'`
       )
     )
 }
@@ -333,9 +337,16 @@ export async function getDesktopToolCallDeadlines(toolCallId: string) {
       result: copilotAsyncToolCalls.result,
       pickupOverdue: sql<boolean>`coalesce(${pickupOverdueAt(sql`clock_timestamp()`)}, false)`,
       leaseLapsed: sql<boolean>`coalesce(${copilotAsyncToolCalls.executionLeaseExpiresAt} <= clock_timestamp(), false)`,
+      /**
+       * Whether the device's pulls show it awake, independently of Redis presence: a pull writes
+       * `last_seen_at` at most once per write interval, so a device seen within the presence TTL
+       * plus that interval may still be pulling even when its presence key is missing.
+       */
+      recentlySeen: sql<boolean>`coalesce(${desktopDevices.lastSeenAt} > clock_timestamp() - ${DESKTOP_PRESENCE_TTL_SECONDS + DESKTOP_LAST_SEEN_WRITE_SECONDS} * interval '1 second', false)`,
     })
     .from(copilotAsyncToolCalls)
     .innerJoin(copilotRuns, eq(copilotRuns.id, copilotAsyncToolCalls.runId))
+    .leftJoin(desktopDevices, eq(desktopDevices.id, copilotRuns.desktopDeviceId))
     .where(
       and(eq(copilotAsyncToolCalls.toolCallId, toolCallId), isNotNull(copilotRuns.desktopDeviceId))
     )

apps/sim/lib/mothership/request/tools/desktop-wait.ts

@@ -217,8 +217,9 @@ async function settleOverdueDesktopToolCall(toolCallId: string): Promise<boolean
   if (!call) return false
   if (call.status === ASYNC_TOOL_STATUS.pending) {
     const present = await readDesktopPresence(call.deviceId)
-    // Before its pickup window closes, a call fails early only when its device is known to be away.
-    if (!call.pickupOverdue && present !== false) return false
+    // Before its pickup window closes, a call fails early only when its device is known to be away:
+    // no presence, and no pull recent enough that a lost presence write could explain the gap.
+    if (!call.pickupOverdue && (present !== false || call.recentlySeen)) return false
     const reason = present === false ? 'offline' : 'not_responding'
     const outcome = await settleBoundDesktopToolCall(call, desktopToolNotStarted(reason), {
       kind: 'pending',