fix(mothership): a declined call stays unclaimable without its gate marker

Calls gated before permission_requested_at existed carry no marker, so a
recorded decision that does not allow the call now disqualifies it too.

Author: waleedlatif1

apps/sim/lib/mothership/async-runs/lifecycle.ts

@@ -102,13 +102,17 @@ export function isExecutableToolPermissionDecision(
   return decision !== null && decision !== undefined && decision !== 'skip'
 }
 
-/** A call held for the user's decision may run only once they allowed it. */
+/**
+ * A call held for the user's decision may run only once they allowed it. A recorded decision
+ * that does not allow it disqualifies the call even without the gate marker, which calls gated
+ * before the marker existed lack.
+ */
 export function isAwaitingToolPermission(call: {
   permissionRequestedAt: Date | null
   permissionDecision: CopilotToolPermissionDecision | null
 }): boolean {
   return (
-    Boolean(call.permissionRequestedAt) &&
+    Boolean(call.permissionRequestedAt || call.permissionDecision) &&
     !isExecutableToolPermissionDecision(call.permissionDecision)
   )
 }

apps/sim/lib/mothership/async-runs/repository.ts

@@ -728,7 +728,10 @@ export async function claimToolExecution(
                     thisCall,
                     eq(copilotAsyncToolCalls.status, ASYNC_TOOL_STATUS.pending),
                     or(
-                      isNull(copilotAsyncToolCalls.permissionRequestedAt),
+                      and(
+                        isNull(copilotAsyncToolCalls.permissionRequestedAt),
+                        isNull(copilotAsyncToolCalls.permissionDecision)
+                      ),
                       inArray(copilotAsyncToolCalls.permissionDecision, [
                         ...EXECUTABLE_TOOL_PERMISSION_DECISIONS,
                       ])

apps/sim/lib/mothership/tools/client/desktop-tool-authorization.integration.ts

@@ -260,6 +260,22 @@ describe.runIf(Boolean(redisUrl))('desktop tool calls the server no longer admit
     expect(await storedCall(toolCallId)).toMatchObject({ status: 'pending', claimedBy: null })
   })
 
+  it('refuses a call the user declined before its gate was recorded on the row', async () => {
+    const { runId } = await startRun()
+    const toolCallId = generateId()
+    await db.insert(copilotAsyncToolCalls).values({
+      runId,
+      toolCallId,
+      toolName: 'terminal',
+      args: { operation: 'run', args: { command: 'git push --force' } },
+      status: 'pending',
+      permissionDecision: 'skip',
+    })
+
+    expect((await desktopClaims(toolCallId)).status).toBe(403)
+    expect(await storedCall(toolCallId)).toMatchObject({ status: 'pending', claimedBy: null })
+  })
+
   it('refuses a pending desktop call after Stop, and settles it as never started', async () => {
     const { runId, streamId } = await startRun()
     const toolCallId = await agentCalls(runId, 'browser_click', { ref: 'e12' })