fix(copilot): refuse an in-band tool call whose egress catalog is unavailable

Production shows 88 of these in fourteen days, every one from this route
and every one caused by a workspace id that no longer exists reaching the
in-band lane. The handler ran anyway, which is the worst pair of outcomes
available: the side effect happened, and because the projection can vouch
for nothing without a catalog, the caller got a bare success or an opaque
sentinel naming neither the cause nor whether anything had changed. It is
also where the reported "cannot tell whether the mutation occurred" came
from — of the tools affected, read and grep dominate, and the runs were
bursts inside single sessions.

Refuse before dispatch instead. Nothing runs, so there is nothing to be
uncertain about, and the caller is told which workspace and why.

A missing workspace also reported itself as an access denial, which sent
every deleted-workspace call down a permissions path nobody could
reproduce. `checkWorkspaceAccess` already distinguishes the two, so say
which one it was. The refusal log now carries the user and workspace it
refused; without them the only way to find the cause was to join by
timestamp.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/copilot/tools/execute/route.test.ts

@@ -95,12 +95,22 @@ describe('POST /api/copilot/tools/execute (in-band)', () => {
     expect(body.error).toBe('File not found: files/a.md')
   })
 
-  it('withholds results when no egress registry can be built', async () => {
-    mockPrepareEnvironmentContext.mockRejectedValue(new Error('env unavailable'))
+  /**
+   * Running the tool without a catalog used to produce the worst pair of outcomes available:
+   * the side effect happened and the caller got a bare `{success: true}` naming neither the
+   * cause nor whether anything had changed.
+   */
+  it('refuses the call, without running the tool, when no egress registry can be built', async () => {
+    mockPrepareEnvironmentContext.mockRejectedValue(new Error('Workspace ws-gone does not exist'))
     mockHandler.mockResolvedValue({ success: true, output: { content: 'sensitive' } })
+
     const res = await POST(makeRequest({ ...BASE_BODY, messageId: 'msg-no-registry' }) as never)
     const body = await res.json()
-    expect(body).toEqual({ success: true })
+
+    expect(mockHandler).not.toHaveBeenCalled()
+    expect(body.success).toBe(false)
+    expect(body.error).toContain('Workspace ws-gone does not exist')
+    expect(body.output).toEqual({ resultWithheld: true, effect: 'not_attempted' })
   })
 
   it('reuses one turn registry across calls that share a messageId', async () => {

apps/sim/app/api/copilot/tools/execute/route.ts

@@ -4,6 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { copilotToolExecuteInternalBodySchema } from '@/lib/api/contracts/copilot'
 import { validationErrorResponse } from '@/lib/api/server'
 import { prepareCopilotEnvironmentContext } from '@/lib/copilot/environment-context'
+import { MothershipStreamV1ToolOutcome } from '@/lib/copilot/generated/mothership-stream-v1'
 import { TraceAttr } from '@/lib/copilot/generated/trace-attributes-v1'
 import { TraceSpan } from '@/lib/copilot/generated/trace-spans-v1'
 import { checkInternalApiKey } from '@/lib/copilot/request/http'
@@ -17,6 +18,7 @@ import { handleResourceSideEffects } from '@/lib/copilot/request/tools/resources
 import type { ToolCallResult } from '@/lib/copilot/request/types'
 import { ensureHandlersRegistered } from '@/lib/copilot/tool-executor'
 import { executeTool } from '@/lib/copilot/tool-executor/executor'
+import { TOOL_EFFECT_PHASE } from '@/lib/copilot/tool-executor/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -116,16 +118,35 @@ export const POST = withRouteHandler((request: NextRequest) =>
         [TraceAttr.UserId]: userId,
       })
 
-      let toolRegistry: ResolvedSecretTraceRegistry | undefined
-      let turnRegistry: ResolvedSecretTraceRegistry | undefined
+      let toolRegistry: ResolvedSecretTraceRegistry
+      let turnRegistry: ResolvedSecretTraceRegistry
       try {
         turnRegistry = await getTurnEgressRegistry(userId, workspaceId, messageId)
         toolRegistry = turnRegistry.forkForInputPaths([])
       } catch (err) {
-        logger.error('In-band egress registry unavailable; results will be withheld', {
+        /**
+         * Without a catalog the projection can vouch for nothing, so every result this call
+         * could produce would be withheld. Running the tool anyway was the worst of both
+         * outcomes: the side effect happened and the caller got an opaque sentinel that named
+         * neither the cause nor whether anything had changed. Refusing before dispatch is
+         * both truthful and the only answer that leaves nothing behind.
+         *
+         * The cause is almost always the workspace itself — a deleted or inaccessible id
+         * reaching this lane — which is actionable, so it is reported rather than swallowed.
+         */
+        const reason = getErrorMessage(err)
+        logger.error('In-band egress registry unavailable; refusing the call', {
           toolName,
           toolCallId,
-          error: getErrorMessage(err),
+          userId,
+          workspaceId,
+          error: reason,
+        })
+        rootSpan.setAttributes({ [TraceAttr.ToolOutcome]: MothershipStreamV1ToolOutcome.error })
+        return NextResponse.json({
+          success: false,
+          error: `${toolName} was not run: ${reason}`,
+          output: { resultWithheld: true, effect: TOOL_EFFECT_PHASE.notAttempted },
         })
       }
 
@@ -149,7 +170,7 @@ export const POST = withRouteHandler((request: NextRequest) =>
         })
         const projection = inspectToolResultForCopilot(result, toolRegistry, toolName)
         const projected = projection.result
-        if (projection.safe && toolRegistry?.isComplete() && turnRegistry) {
+        if (projection.safe && toolRegistry.isComplete()) {
           turnRegistry.mergeToolCallRegistry(toolRegistry)
         }
         if (!projected.success) {

apps/sim/lib/environment/utils.ts

@@ -151,6 +151,15 @@ export async function getPersonalAndWorkspaceEnv(
   let workspaceCanAdmin = false
   if (workspaceId) {
     const access = options?.workspaceAccess ?? (await checkWorkspaceAccess(workspaceId, userId))
+    /**
+     * A workspace that no longer exists and one the caller may not read are different facts
+     * and take different corrections — stop using the id versus ask for access. Collapsing
+     * them sent every deleted-workspace call down the access-denied path, where it read as a
+     * permissions problem nobody could reproduce.
+     */
+    if (!access.exists) {
+      throw new Error(`Workspace ${workspaceId} does not exist`)
+    }
     if (!access.hasAccess) {
       throw new Error(`Access denied to workspace ${workspaceId}`)
     }