fix(desktop): resume supervising a desktop call from its row after a restart

Supervision now resumes from the stored pickup deadline or lease when the
call is waited on again (the worker's handoff re-dispatches it), instead of
giving up because the call was already offered. The existing-claim waiter
uses the same bound-run budget as the resume gate, the desktop composer's
behaviour without a background executor is pinned by a test, and the
supervisor tests wait for presence before supervising.

Author: waleedlatif1

apps/sim/lib/desktop/executor/supervisor.integration.ts

@@ -39,6 +39,7 @@ import {
   renewDesktopToolLease,
   resolveTurnDesktopDevice,
 } from '@/lib/desktop/application/executor'
+import { isDesktopPresent } from '@/lib/desktop/executor/presence'
 import { failLapsedDesktopCall } from '@/lib/desktop/executor/repository'
 import {
   DESKTOP_LEASE_LOST_MESSAGE,
@@ -185,6 +186,7 @@ describe.runIf(Boolean(redisUrl))('desktop call supervision and turn binding', (
     const heard: string[] = []
     const close = stream.subscribe((_event, data) => heard.push(String(data.reason)))
     try {
+      await expect.poll(() => isDesktopPresent(desktop.deviceId)).toBe(true)
       return await run(heard)
     } finally {
       close()
@@ -445,6 +447,80 @@ describe.runIf(Boolean(redisUrl))('desktop call supervision and turn binding', (
       expect((await row(toolCallId)).status).toBe('running')
     })
 
+    it('resumes supervising an offered call after the process that offered it restarts', async () => {
+      const desktop = await signedInDesktop()
+      const run = await boundRun(desktop.userId, desktop.deviceId)
+      const toolCallId = await pendingCall(run.runId)
+      const supervise = (signal?: AbortSignal) =>
+        superviseDesktopCall({
+          toolCallId,
+          runId: run.runId,
+          userId: desktop.userId,
+          deviceId: desktop.deviceId,
+          pickupGraceMs: 800,
+          signal,
+        })
+
+      await online(desktop, async () => {
+        /** The first supervisor offers the call, then its process dies. */
+        const died = new AbortController()
+        const first = supervise(died.signal)
+        await expect
+          .poll(async () => (await row(toolCallId)).executionLeaseExpiresAt)
+          .not.toBeNull()
+        died.abort()
+        await expect(first).resolves.toBe('aborted')
+
+        /** The worker's handoff waits on the call again; supervision resumes from the row. */
+        const started = Date.now()
+        await expect(supervise()).resolves.toBe('not_responding')
+        expect(Date.now() - started).toBeLessThan(1_500)
+      })
+      await expect(unsealed(toolCallId, run.runId, desktop.userId)).resolves.toMatchObject({
+        data: { notStarted: true, reason: 'not_responding' },
+      })
+    })
+
+    it('resumes supervising a claimed call after a restart and settles its lapsed lease', async () => {
+      const desktop = await signedInDesktop()
+      const run = await boundRun(desktop.userId, desktop.deviceId)
+      const toolCallId = await pendingCall(run.runId)
+
+      await online(desktop, async () => {
+        const died = new AbortController()
+        const first = superviseDesktopCall({
+          toolCallId,
+          runId: run.runId,
+          userId: desktop.userId,
+          deviceId: desktop.deviceId,
+          pickupGraceMs: 2_000,
+          signal: died.signal,
+        })
+        await expect
+          .poll(async () => (await row(toolCallId)).executionLeaseExpiresAt)
+          .not.toBeNull()
+        await claimDesktopTool.execute({
+          principal: desktop.principal,
+          input: { deviceId: desktop.deviceId, toolCallId },
+        })
+        died.abort()
+        await expect(first).resolves.toBe('aborted')
+        await db
+          .update(copilotAsyncToolCalls)
+          .set({ executionLeaseExpiresAt: sql`clock_timestamp() + interval '300 milliseconds'` })
+          .where(eq(copilotAsyncToolCalls.toolCallId, toolCallId))
+
+        await expect(
+          superviseDesktopCall({
+            toolCallId,
+            runId: run.runId,
+            userId: desktop.userId,
+            deviceId: desktop.deviceId,
+          })
+        ).resolves.toBe('lease_lost')
+      })
+    })
+
     it('never offers a call on a run the chat view serves', async () => {
       const desktop = await signedInDesktop()
       const run = await boundRun(desktop.userId, null)

apps/sim/lib/desktop/executor/supervisor.ts

@@ -81,13 +81,67 @@ function wake(input: SuperviseDesktopCallInput, message: string, data: unknown)
   })
 }
 
+/** Fails a call nobody claimed as not started; returns whether this settlement won. */
+async function failUnclaimed(
+  input: SuperviseDesktopCallInput,
+  reason: 'offline' | 'not_responding',
+  message: string,
+  deadlinePassed: boolean
+): Promise<boolean> {
+  const state = await getDesktopCallState(input.toolCallId)
+  const result = await sealFailure(input, state?.result, { reason, message, notStarted: true })
+  const failed = await failUnclaimedDesktopCall({
+    toolCallId: input.toolCallId,
+    runId: input.runId,
+    result,
+    error: message,
+    deadlinePassed,
+  })
+  if (failed) wake(input, message, result)
+  return failed
+}
+
+/** Fails a claimed call whose lease lapsed as outcome unknown; returns whether this settlement won. */
+async function failLapsed(
+  input: SuperviseDesktopCallInput,
+  ownerToken: string,
+  existing: unknown
+): Promise<boolean> {
+  const result = await sealFailure(input, existing, {
+    reason: 'lease_lost',
+    message: DESKTOP_LEASE_LOST_MESSAGE,
+    outcomeUnknown: true,
+    doNotRetry: true,
+  })
+  const failed = await failLapsedDesktopCall({
+    toolCallId: input.toolCallId,
+    runId: input.runId,
+    ownerToken,
+    result,
+    error: DESKTOP_LEASE_LOST_MESSAGE,
+  })
+  if (failed) wake(input, DESKTOP_LEASE_LOST_MESSAGE, result)
+  return failed
+}
+
+/** A call some supervisor offered (pickup window open or closed) or the device claimed. */
+function isOfferedOrClaimed(state: Awaited<ReturnType<typeof getDesktopCallState>>): boolean {
+  if (!state) return false
+  if (state.status === ASYNC_TOOL_STATUS.pending)
+    return !state.ownerToken && state.msUntilLeaseEnd !== null
+  return state.status === ASYNC_TOOL_STATUS.running && Boolean(state.ownerToken)
+}
+
 /**
  * Owns a desktop call on a device-bound run from the moment it may run until it settles: offers
  * it to the device and rings the doorbell, fails it at once as not started when the device is
  * offline or after the pickup window when nobody claimed it, and fails it as outcome unknown when
  * a claimed call's lease lapses. A running call stays alive for as long as the device renews it.
  * Every settlement is a CAS against the device's own transitions, so exactly one wins, and every
  * failure is published so the run's waiter reads it at once.
+ *
+ * All of its state is on the row: when the process supervising a call restarts, the next wait on
+ * the call (the worker's handoff re-dispatches it) resumes supervision from the stored deadline.
  */
 export async function superviseDesktopCall(
   input: SuperviseDesktopCallInput
@@ -97,65 +151,27 @@ export async function superviseDesktopCall(
     runId: input.runId,
     pickupGraceMs: input.pickupGraceMs ?? DESKTOP_CALL_PICKUP_GRACE_MS,
   })
-  if (!offered) return 'not_offered'
-  ringDesktopInbox(input.deviceId, 'call')
-
-  const failUnclaimed = async (
-    reason: 'offline' | 'not_responding',
-    message: string,
-    deadlinePassed: boolean
-  ) => {
-    const state = await getDesktopCallState(input.toolCallId)
-    const result = await sealFailure(input, state?.result, { reason, message, notStarted: true })
-    const failed = await failUnclaimedDesktopCall({
-      toolCallId: input.toolCallId,
-      runId: input.runId,
-      result,
-      error: message,
-      deadlinePassed,
-    })
-    if (failed) wake(input, message, result)
-    return failed
-  }
-
-  if (!(await isDesktopPresent(input.deviceId).catch(() => false))) {
-    if (await failUnclaimed('offline', DESKTOP_OFFLINE_MESSAGE, false)) return 'offline'
+  if (offered) {
+    ringDesktopInbox(input.deviceId, 'call')
+    if (!(await isDesktopPresent(input.deviceId).catch(() => false))) {
+      if (await failUnclaimed(input, 'offline', DESKTOP_OFFLINE_MESSAGE, false)) return 'offline'
+    }
+  } else if (!isOfferedOrClaimed(await getDesktopCallState(input.toolCallId))) {
+    return 'not_offered'
   }
 
   for (;;) {
     if (input.signal?.aborted) return 'aborted'
     const state = await getDesktopCallState(input.toolCallId)
     if (!state || isTerminalAsyncStatus(state.status)) return 'settled'
+    if (!isOfferedOrClaimed(state)) return 'settled'
     const remainingMs = state.msUntilLeaseEnd ?? 0
-    if (state.status === ASYNC_TOOL_STATUS.pending && !state.ownerToken) {
-      if (remainingMs <= 0) {
-        if (await failUnclaimed('not_responding', DESKTOP_NOT_RESPONDING_MESSAGE, true))
-          return 'not_responding'
-        continue
-      }
-    } else if (state.status === ASYNC_TOOL_STATUS.running && state.ownerToken) {
-      if (remainingMs <= 0) {
-        const result = await sealFailure(input, state.result, {
-          reason: 'lease_lost',
-          message: DESKTOP_LEASE_LOST_MESSAGE,
-          outcomeUnknown: true,
-          doNotRetry: true,
-        })
-        const failed = await failLapsedDesktopCall({
-          toolCallId: input.toolCallId,
-          runId: input.runId,
-          ownerToken: state.ownerToken,
-          result,
-          error: DESKTOP_LEASE_LOST_MESSAGE,
-        })
-        if (failed) {
-          wake(input, DESKTOP_LEASE_LOST_MESSAGE, result)
-          return 'lease_lost'
-        }
-        continue
-      }
-    } else {
-      return 'settled'
+    if (remainingMs <= 0) {
+      const won = state.ownerToken
+        ? await failLapsed(input, state.ownerToken, state.result)
+        : await failUnclaimed(input, 'not_responding', DESKTOP_NOT_RESPONDING_MESSAGE, true)
+      if (won) return state.ownerToken ? 'lease_lost' : 'not_responding'
+      continue
     }
     await interruptibleSleep(Math.min(remainingMs + DEADLINE_SLACK_MS, MAX_WAIT_MS), input.signal)
   }

apps/sim/lib/desktop/index.test.ts

@@ -57,6 +57,37 @@ describe('desktop surface availability', () => {
     ).toBeUndefined()
   })
 
+  it('offers a turn to the background executor only when the shell has a registered one', async () => {
+    setDesktopPreferencesSnapshot({
+      ...ENABLED_PREFERENCES,
+      browserEnabled: false,
+      terminalEnabled: false,
+    })
+    const offerFrom = async (bridge: Record<string, unknown>) => {
+      installBridge({ localFiles: vi.fn(), ...bridge })
+      const { desktopCapabilities } = await getDesktopChatCapabilities('chat-1')
+      return { deviceId: desktopCapabilities?.deviceId, executor: desktopCapabilities?.executor }
+    }
+    const unset = { deviceId: undefined, executor: undefined }
+
+    expect(await offerFrom({})).toEqual(unset)
+    expect(await offerFrom({ desktopExecutor: { getDevice: vi.fn(async () => null) } })).toEqual(
+      unset
+    )
+    expect(
+      await offerFrom({
+        desktopExecutor: { getDevice: vi.fn(async () => Promise.reject(new Error('IPC closed'))) },
+      })
+    ).toEqual(unset)
+    expect(
+      await offerFrom({
+        desktopExecutor: {
+          getDevice: vi.fn(async () => ({ deviceId: 'device-1', protocolVersion: 1 })),
+        },
+      })
+    ).toEqual({ deviceId: 'device-1', executor: 1 })
+  })
+
   it('bounds terminal hints before adding them to a chat request', async () => {
     const oversizedValue = 'x'.repeat(1100)
     installBridge({

apps/sim/lib/desktop/index.ts

@@ -215,6 +215,7 @@ export async function getDesktopChatCapabilities(
           .then((state) => state.sessions)
           .catch(() => [])
       : []
+  // Shells without a background executor (every build before it ships) leave the turn unbound.
   const executorDevice = bridge?.desktopExecutor
     ? await bridge.desktopExecutor.getDevice().catch(() => null)
     : null

apps/sim/lib/mothership/chat/post.ts

@@ -377,6 +377,7 @@ const ChatMessageSchema = z
   )
 
 type UnifiedChatRequest = z.infer<typeof ChatMessageSchema>
+
 /**
  * The desktop a turn asks its background executor to run on. Only a desktop composer that speaks
  * the executor protocol and switched on at least one desktop surface asks; Assistant turns have

apps/sim/lib/mothership/request/handlers/tool.ts

@@ -194,6 +194,13 @@ function rebindResolvedIntegrationCall(
   return true
 }
 
+/** Reads the run's device binding once per streaming context. */
+async function resolveRunDesktopDevice(context: StreamingContext): Promise<string | null> {
+  if (context.desktopDeviceId === undefined)
+    context.desktopDeviceId = context.runId ? await getRunDesktopDeviceId(context.runId) : null
+  return context.desktopDeviceId
+}
+
 /**
  * Upsert the durable `async_tool_calls` row before the authoritative tool-call
  * SSE frame is forwarded to the client, so `/api/copilot/confirm` and
@@ -208,13 +215,6 @@ function rebindResolvedIntegrationCall(
  * Also stamps `awaiting_approval` onto the outgoing frame so the browser and
  * the persisted content block both record that the call is gated.
  */
-/** Reads the run's device binding once per streaming context. */
-async function resolveRunDesktopDevice(context: StreamingContext): Promise<string | null> {
-  if (context.desktopDeviceId === undefined)
-    context.desktopDeviceId = context.runId ? await getRunDesktopDeviceId(context.runId) : null
-  return context.desktopDeviceId
-}
-
 export async function prePersistClientExecutableToolCall(
   event: StreamEvent,
   context: StreamingContext,

apps/sim/lib/mothership/request/tools/executor.ts

@@ -668,7 +668,7 @@ async function executeToolAndReportInner(
       /** The winning controller owns execution; this promise observes its durable result. */
       const completion = await waitForToolConfirmation(
         toolCall.id,
-        pendingToolWaitBudgetMs(toolCall),
+        pendingToolWaitBudgetMs(toolCall, context.desktopDeviceId),
         options?.abortSignal ?? execContext.abortSignal,
         {
           executionScope: { runId: context.runId, userId: execContext.userId },