fix(plan): enforce benchmark and native action admission

Author: icecrasher321

apps/sim/app/api/desktop/tool/authorize/route.test.ts

@@ -106,6 +106,20 @@ describe('desktop tool authorization', () => {
     expect(response.status).toBe(403)
   })
 
+  it.each([false, true])(
+    'refuses native computer actions through generic desktop authorization with claim %s',
+    async (claim) => {
+      getAsyncToolCall.mockResolvedValueOnce({
+        toolCallId: 'computer-tool',
+        runId: 'run-1',
+        status: 'pending',
+        toolName: 'computer',
+        args: { action: 'list_apps' },
+      })
+      expect((await POST(request('computer-tool', claim))).status).toBe(403)
+    }
+  )
+
   it('rejects a replayed browser action after its pending row was claimed', async () => {
     getAsyncToolCall.mockResolvedValueOnce({
       toolCallId: 'browser-tool',

apps/sim/app/api/desktop/tool/authorize/route.ts

@@ -20,7 +20,7 @@ import {
 import {
   chatViewDesktopLeaseOwnerToken,
   getDesktopToolClaimOwner,
-  isDesktopToolCall,
+  isBackgroundDesktopToolCall,
   isLocalReadToolCall,
 } from '@/lib/mothership/tools/desktop-tools'
 
@@ -83,7 +83,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
 
   const args = isRecordLike(toolCall.args) ? (toolCall.args as Record<string, unknown>) : {}
-  if (!isDesktopToolCall(toolCall.toolName, args)) {
+  if (!isBackgroundDesktopToolCall(toolCall.toolName, args)) {
     return NextResponse.json(
       { error: 'Tool call is not authorized for desktop execution' },
       { status: 403 }

apps/sim/lib/benchmarks/application/stage-lease.test.ts

@@ -25,6 +25,25 @@ describe('benchmark stage lifetime', () => {
   })
   afterEach(() => vi.useRealTimers())
 
+  it.each([0, -1])(
+    'does not start work when its initial lease expired %s milliseconds ago',
+    async (offset) => {
+      let started = false
+      await expect(
+        withBenchmarkStageLease(
+          { ...attempt, leaseExpiresAt: new Date(Date.now() + offset) },
+          undefined,
+          async () => {
+            started = true
+            return 'stale result'
+          }
+        )
+      ).rejects.toMatchObject({ code: 'conflict' })
+      expect(started).toBe(false)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+
   it('keeps a healthy inspection alive beyond ten minutes and stops its heartbeat on completion', async () => {
     const result = withBenchmarkStageLease(attempt, undefined, async (signal) => {
       await vi.advanceTimersByTimeAsync(60 * 60_000)

apps/sim/lib/benchmarks/application/stage-lease.ts

@@ -18,7 +18,12 @@ export async function withBenchmarkStageLease<T>(
     ownership.abort(
       new OrchestrationError('conflict', 'This step lost its run ownership. Refresh and retry it.')
     )
-  let expiry = setTimeout(loseOwnership, Math.max(0, attempt.leaseExpiresAt.getTime() - Date.now()))
+  const remaining = attempt.leaseExpiresAt.getTime() - Date.now()
+  if (remaining <= 0) {
+    loseOwnership()
+    signal.throwIfAborted()
+  }
+  let expiry = setTimeout(loseOwnership, remaining)
   expiry.unref?.()
   let onAbort: (() => void) | undefined
   const aborted = new Promise<never>((_resolve, reject) => {

apps/sim/lib/computer-use/repository.integration.ts

@@ -54,7 +54,7 @@ describe.skipIf(!connection)('computer use one-shot admission in PostgreSQL', ()
       `CREATE TABLE copilot_runs (id uuid PRIMARY KEY, chat_id uuid NOT NULL, user_id text NOT NULL, status text NOT NULL, tool_admission_closed_at timestamp)`
     )
     await connection.unsafe(
-      `CREATE TABLE copilot_async_tool_calls (tool_call_id text PRIMARY KEY, run_id uuid NOT NULL, tool_name text NOT NULL, args jsonb NOT NULL, status text NOT NULL, claimed_by text, claimed_at timestamp, created_at timestamp DEFAULT now(), updated_at timestamp DEFAULT now())`
+      `CREATE TABLE copilot_async_tool_calls (tool_call_id text PRIMARY KEY, run_id uuid NOT NULL, tool_name text NOT NULL, args jsonb NOT NULL, status text NOT NULL, claimed_by text, claimed_at timestamp, permission_requested_at timestamp, permission_decision text, created_at timestamp DEFAULT now(), updated_at timestamp DEFAULT now())`
     )
     database.current = drizzle(connection)
   })
@@ -80,6 +80,27 @@ describe.skipIf(!connection)('computer use one-shot admission in PostgreSQL', ()
     await requireConnection()`UPDATE copilot_runs SET tool_admission_closed_at = now()`
     expect(await claimComputerUseTool(input)).toBeNull()
   })
+  it.each([
+    { requested: true, decision: null },
+    { requested: true, decision: 'skip' },
+    { requested: false, decision: 'skip' },
+  ])(
+    'refuses an unapproved action with gate $requested and decision $decision',
+    async ({ requested, decision }) => {
+      await requireConnection()`UPDATE copilot_async_tool_calls SET permission_requested_at = CASE WHEN ${requested} THEN now() ELSE NULL END, permission_decision = ${decision}`
+      expect(await claimComputerUseTool(input)).toBeNull()
+      const [row] =
+        await requireConnection()`SELECT status, claimed_by FROM copilot_async_tool_calls`
+      expect(row).toEqual({ status: 'pending', claimed_by: null })
+    }
+  )
+  it.each(['allow', 'allow_chat', 'always_allow'])(
+    'claims an action approved with %s',
+    async (decision) => {
+      await requireConnection()`UPDATE copilot_async_tool_calls SET permission_requested_at = now(), permission_decision = ${decision}`
+      expect(await claimComputerUseTool(input)).toEqual({ args: { action: 'list_apps' } })
+    }
+  )
   it('refuses old calls and leaves them unclaimed', async () => {
     await requireConnection()`UPDATE copilot_async_tool_calls SET created_at = now() - interval '3 minutes'`
     expect(await claimComputerUseTool(input)).toBeNull()

apps/sim/lib/computer-use/repository.ts

@@ -3,6 +3,7 @@ import { copilotAsyncToolCalls, copilotChats, copilotRuns } from '@sim/db/schema
 import { ComputerUseSchema } from '@sim/desktop-bridge/computer-use'
 import { omit, toRecord } from '@sim/utils/object'
 import { and, eq, isNull, notInArray, sql } from 'drizzle-orm'
+import { executableToolPermission } from '@/lib/mothership/async-runs/executable-tool-permission'
 import { DESKTOP_TOOL_CLAIM_OWNER } from '@/lib/mothership/async-runs/lifecycle'
 
 interface ComputerUseClaim {
@@ -55,7 +56,8 @@ export async function claimComputerUseTool(input: ComputerUseClaim) {
       .where(
         and(
           eq(copilotAsyncToolCalls.toolCallId, input.toolCallId),
-          eq(copilotAsyncToolCalls.status, 'pending')
+          eq(copilotAsyncToolCalls.status, 'pending'),
+          executableToolPermission()
         )
       )
       .returning({ args: copilotAsyncToolCalls.args })

apps/sim/lib/mothership/agent-cli/read-only.test.ts

@@ -49,6 +49,19 @@ describe('benchmark reference workspace inspection', () => {
     }
   )
 
+  it.each(['/api/v2/secrets', '/api/v2/secrets?cursor=next', '/api/v2/secrets/name'])(
+    'refuses credential values from %s before contacting the source',
+    async (path) => {
+      let dispatched = false
+      const transport = readOnlyCliTransport(async () => {
+        dispatched = true
+        return Response.json({ data: 'sensitive fixture' })
+      })
+      expect((await transport(`https://sim.test${path}`)).status).toBe(403)
+      expect(dispatched).toBe(false)
+    }
+  )
+
   it('retains paginated reads and table queries without allowing lookalike mutation paths', async () => {
     const transport = readOnlyCliTransport(async () => Response.json({ data: 'authorized result' }))
     for (const path of ['/api/v2/workflows?cursor=next', '/api/v2/tables/table']) {

apps/sim/lib/mothership/agent-cli/read-only.ts

@@ -33,8 +33,9 @@ export function readOnlyCliTransport(transport: typeof fetch): typeof fetch {
     const request = new Request(input, init)
     const path = new URL(request.url).pathname
     if (
-      request.method !== 'GET' &&
-      !(request.method === 'POST' && /^\/api\/v2\/tables\/[^/]+\/query(?:\/count)?$/.test(path))
+      /^\/api\/v2\/secrets(?:\/|$)/.test(path) ||
+      (request.method !== 'GET' &&
+        !(request.method === 'POST' && /^\/api\/v2\/tables\/[^/]+\/query(?:\/count)?$/.test(path)))
     ) {
       return Response.json(
         {

apps/sim/lib/mothership/async-runs/executable-tool-permission.ts

@@ -0,0 +1,14 @@
+import { copilotAsyncToolCalls } from '@sim/db/schema'
+import { and, inArray, isNull, or } from 'drizzle-orm'
+import { EXECUTABLE_TOOL_PERMISSION_DECISIONS } from '@/lib/mothership/async-runs/lifecycle'
+
+/** Check permission in the claim update so a concurrent decision cannot be bypassed. */
+export function executableToolPermission() {
+  return or(
+    and(
+      isNull(copilotAsyncToolCalls.permissionRequestedAt),
+      isNull(copilotAsyncToolCalls.permissionDecision)
+    ),
+    inArray(copilotAsyncToolCalls.permissionDecision, [...EXECUTABLE_TOOL_PERMISSION_DECISIONS])
+  )
+}

apps/sim/lib/mothership/async-runs/repository.ts

@@ -30,6 +30,7 @@ import { type ResourceOwner, resourceScopeFromOwner } from '@/lib/core/resource-
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
 import type { SessionProcessIdentity } from '@/lib/execution/remote-sandbox/session-process'
 import { AsyncToolCallOwnershipError } from '@/lib/mothership/async-runs/errors'
+import { executableToolPermission } from '@/lib/mothership/async-runs/executable-tool-permission'
 import {
   INTERRUPTED_SIM_TOOL_MESSAGE,
   SIM_TOOL_EXECUTION_LEASE_SECONDS,
@@ -836,15 +837,7 @@ export async function claimDesktopToolCall(
                     isNull(copilotAsyncToolCalls.pickupDeadlineAt),
                     sql`${copilotAsyncToolCalls.pickupDeadlineAt} > clock_timestamp()`
                   ),
-              or(
-                and(
-                  isNull(copilotAsyncToolCalls.permissionRequestedAt),
-                  isNull(copilotAsyncToolCalls.permissionDecision)
-                ),
-                inArray(copilotAsyncToolCalls.permissionDecision, [
-                  ...EXECUTABLE_TOOL_PERMISSION_DECISIONS,
-                ])
-              )
+              executableToolPermission()
             )
           )
           .returning({ id: copilotAsyncToolCalls.id })