fix(desktop): refuse a claim past its pickup window and leave executor leases to their own settlement

A device could claim an offered call after its pickup deadline and before the wait's next check settled it, running an action the turn was about to report as not started. The claim and the inbox now treat a closed window as no longer offered. The generic Sim lease sweep no longer settles a desktop executor's lapsed lease with the Sim interrupted result: the bound wait and the stale-execution cron settle it as outcome unknown, so the model is told the action may already have taken effect.

Author: waleedlatif1

apps/sim/lib/desktop/executor/bound-turn.integration.ts

@@ -55,7 +55,10 @@ import {
 } from '@/lib/desktop/executor/doorbell'
 import { DesktopCallRevokedError } from '@/lib/desktop/executor/errors'
 import { SIM_TOOL_EXECUTION_VERSION } from '@/lib/mothership/async-runs/lifecycle'
-import { requestRunStop } from '@/lib/mothership/async-runs/repository'
+import {
+  requestRunStop,
+  revokeExpiredSimToolExecutions,
+} from '@/lib/mothership/async-runs/repository'
 import { prePersistClientExecutableToolCall, sseHandlers } from '@/lib/mothership/request/handlers'
 import { waitForClientToolCompletion } from '@/lib/mothership/request/tools/client'
 import { TraceCollector } from '@/lib/mothership/request/trace'
@@ -438,13 +441,15 @@ describe.runIf(Boolean(redisUrl))("a turn bound to a desktop's background execut
       await offered(toolCallId)
       expect((await storedCall(toolCallId)).status).toBe('pending')
       await lapse(toolCallId, 'pickup')
+      /** Before the wait's next check settles it, the closed window already refuses the device. */
+      expect((await desktop.pull()).items).toEqual([])
+      await expect(desktop.claim(toolCallId)).rejects.toThrow('no longer waiting')
       await answer
 
       expect(resultOf(context, toolCallId)).toMatchObject({
         success: false,
         output: { notStarted: true, reason: 'not_responding' },
       })
-      await expect(desktop.claim(toolCallId)).rejects.toThrow('no longer waiting')
     },
     TURN_WAIT_MS
   )
@@ -468,6 +473,9 @@ describe.runIf(Boolean(redisUrl))("a turn bound to a desktop's background execut
       expect((await storedCall(toolCallId)).status).toBe('running')
 
       await lapse(toolCallId, 'lease')
+      /** A Sim tool waiting on the same run sweeps its expired executions; this one is not its. */
+      await revokeExpiredSimToolExecutions({ runId: run.runId, userId })
+      expect((await storedCall(toolCallId)).status).toBe('running')
       await answer
       const late = await desktop.complete(toolCallId, executionToken, { output: 'built' })
 

apps/sim/lib/desktop/executor/repository.ts

@@ -132,6 +132,10 @@ export async function listDesktopInboxRows(identity: Omit<DesktopDeviceIdentity,
           and(
             eq(copilotAsyncToolCalls.status, ASYNC_TOOL_STATUS.pending),
             isNull(copilotAsyncToolCalls.executionOwnerToken),
+            or(
+              isNull(copilotAsyncToolCalls.pickupDeadlineAt),
+              sql`${copilotAsyncToolCalls.pickupDeadlineAt} > clock_timestamp()`
+            ),
             inArray(copilotRuns.status, LIVE_RUN_STATUSES),
             isNull(copilotRuns.toolAdmissionClosedAt)
           ),

apps/sim/lib/mothership/async-runs/repository.ts

@@ -815,6 +815,11 @@ export async function claimDesktopToolCall(
             and(
               thisCall,
               eq(copilotAsyncToolCalls.status, ASYNC_TOOL_STATUS.pending),
+              // An offered call whose pickup window closed belongs to its not-started settlement.
+              or(
+                isNull(copilotAsyncToolCalls.pickupDeadlineAt),
+                sql`${copilotAsyncToolCalls.pickupDeadlineAt} > clock_timestamp()`
+              ),
               or(
                 and(
                   isNull(copilotAsyncToolCalls.permissionRequestedAt),
@@ -903,6 +908,12 @@ async function revokeExpiredExecutions(tx: RunAdmissionTransaction, scope: SQL)
         isNull(copilotAsyncToolCalls.executionSettledAt),
         isNull(copilotAsyncToolCalls.executionRevokedAt),
         isNull(copilotAsyncToolCalls.clientWorkflowExecutionId),
+        // A desktop executor's lapsed lease is settled by its own wait and the stale-execution cron,
+        // with a result that warns the action may already have taken effect.
+        or(
+          isNull(copilotAsyncToolCalls.claimedBy),
+          notInArray(copilotAsyncToolCalls.claimedBy, Object.values(DESKTOP_TOOL_CLAIM_OWNER))
+        ),
         sql`${copilotAsyncToolCalls.executionLeaseExpiresAt} <= clock_timestamp()`
       )
     )