chore: import upstream snapshot with attribution

apps/sim/app/api/copilot/confirm/route.test.ts

@@ -0,0 +1,224 @@
+/**
+ * @vitest-environment node
+ */
+import { copilotHttpMock, copilotHttpMockFns } from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  getAsyncToolCall,
+  getRunSegment,
+  upsertAsyncToolCall,
+  completeAsyncToolCall,
+  publishToolConfirmation,
+} = vi.hoisted(() => ({
+  getAsyncToolCall: vi.fn(),
+  getRunSegment: vi.fn(),
+  upsertAsyncToolCall: vi.fn(),
+  completeAsyncToolCall: vi.fn(),
+  publishToolConfirmation: vi.fn(),
+}))
+
+vi.mock('@/lib/copilot/request/http', () => copilotHttpMock)
+
+vi.mock('@/lib/copilot/async-runs/repository', () => ({
+  getAsyncToolCall,
+  getRunSegment,
+  upsertAsyncToolCall,
+  completeAsyncToolCall,
+}))
+
+vi.mock('@/lib/copilot/persistence/tool-confirm', () => ({
+  publishToolConfirmation,
+}))
+
+import { POST } from './route'
+
+describe('Copilot Confirm API Route', () => {
+  const existingRow = {
+    toolCallId: 'tool-call-123',
+    runId: 'run-1',
+    checkpointId: 'checkpoint-1',
+    toolName: 'client_tool',
+    args: { foo: 'bar' },
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValue({
+      userId: 'user-1',
+      isAuthenticated: true,
+    })
+    getAsyncToolCall.mockResolvedValue(existingRow)
+    getRunSegment.mockResolvedValue({ id: 'run-1', userId: 'user-1' })
+    upsertAsyncToolCall.mockResolvedValue(existingRow)
+    completeAsyncToolCall.mockResolvedValue(existingRow)
+  })
+
+  function createMockPostRequest(body: Record<string, unknown>): NextRequest {
+    return new NextRequest('http://localhost:3000/api/copilot/confirm', {
+      method: 'POST',
+      body: JSON.stringify(body),
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  it('returns 401 when the session is unauthenticated', async () => {
+    copilotHttpMockFns.mockAuthenticateCopilotRequestSessionOnly.mockResolvedValue({
+      userId: null,
+      isAuthenticated: false,
+    })
+
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+      })
+    )
+
+    expect(response.status).toBe(401)
+    expect(await response.json()).toEqual({ error: 'Unauthorized' })
+  })
+
+  it('returns 404 when the tool call row does not exist', async () => {
+    getAsyncToolCall.mockResolvedValue(null)
+
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'missing-tool',
+        status: 'success',
+      })
+    )
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toEqual({ error: 'Tool call not found' })
+  })
+
+  it('returns 403 when the tool call belongs to a different user', async () => {
+    getRunSegment.mockResolvedValue({ id: 'run-1', userId: 'user-2' })
+
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+      })
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({ error: 'Forbidden' })
+  })
+
+  it('persists terminal confirmations through completeAsyncToolCall', async () => {
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+        message: 'Tool executed successfully',
+        data: { ok: true },
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(completeAsyncToolCall).toHaveBeenCalledWith({
+      toolCallId: 'tool-call-123',
+      status: 'completed',
+      result: { ok: true },
+      error: null,
+    })
+    expect(upsertAsyncToolCall).not.toHaveBeenCalled()
+    expect(publishToolConfirmation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+        data: { ok: true },
+      })
+    )
+  })
+
+  it('accepts primitive terminal confirmation data', async () => {
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+        message: 'Tool executed successfully',
+        data: 'done',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(completeAsyncToolCall).toHaveBeenCalledWith({
+      toolCallId: 'tool-call-123',
+      status: 'completed',
+      result: 'done',
+      error: null,
+    })
+    expect(publishToolConfirmation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+        data: 'done',
+      })
+    )
+  })
+
+  it('keeps background as a live pending detach confirmation', async () => {
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'background',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(upsertAsyncToolCall).not.toHaveBeenCalled()
+    expect(completeAsyncToolCall).not.toHaveBeenCalled()
+    expect(publishToolConfirmation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        toolCallId: 'tool-call-123',
+        status: 'background',
+      })
+    )
+  })
+
+  it('rejects unsupported accepted and rejected confirmation statuses', async () => {
+    const acceptedResponse = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'accepted',
+      })
+    )
+
+    expect(acceptedResponse.status).toBe(400)
+    expect(await acceptedResponse.json()).toMatchObject({
+      error: 'Invalid request data: Invalid notification status',
+      details: expect.any(Array),
+    })
+
+    const rejectedResponse = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'rejected',
+      })
+    )
+
+    expect(rejectedResponse.status).toBe(400)
+    expect(await rejectedResponse.json()).toMatchObject({
+      error: 'Invalid request data: Invalid notification status',
+      details: expect.any(Array),
+    })
+  })
+
+  it('returns 500 when the durable write fails before publish', async () => {
+    completeAsyncToolCall.mockRejectedValueOnce(new Error('db down'))
+
+    const response = await POST(
+      createMockPostRequest({
+        toolCallId: 'tool-call-123',
+        status: 'success',
+      })
+    )
+
+    expect(response.status).toBe(500)
+    expect(publishToolConfirmation).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/copilot/confirm/route.ts

@@ -0,0 +1,217 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage, toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { copilotConfirmContract } from '@/lib/api/contracts/copilot'
+import { parseRequest, validationErrorResponse } from '@/lib/api/server'
+import {
+  ASYNC_TOOL_CONFIRMATION_STATUS,
+  ASYNC_TOOL_STATUS,
+  type AsyncCompletionData,
+  type AsyncConfirmationStatus,
+} from '@/lib/copilot/async-runs/lifecycle'
+import {
+  completeAsyncToolCall,
+  getAsyncToolCall,
+  getRunSegment,
+  upsertAsyncToolCall,
+} from '@/lib/copilot/async-runs/repository'
+import { CopilotConfirmOutcome } from '@/lib/copilot/generated/trace-attribute-values-v1'
+import { TraceAttr } from '@/lib/copilot/generated/trace-attributes-v1'
+import { TraceSpan } from '@/lib/copilot/generated/trace-spans-v1'
+import { publishToolConfirmation } from '@/lib/copilot/persistence/tool-confirm'
+import {
+  authenticateCopilotRequestSessionOnly,
+  createInternalServerErrorResponse,
+  createNotFoundResponse,
+  createRequestTracker,
+  createUnauthorizedResponse,
+} from '@/lib/copilot/request/http'
+import { withIncomingGoSpan } from '@/lib/copilot/request/otel'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('CopilotConfirmAPI')
+
+/**
+ * Persist terminal durable tool status, then publish a wakeup event.
+ *
+ * `background` remains a live detach signal in the current browser workflow
+ * runtime, so it should not rewrite the durable async row.
+ */
+async function updateToolCallStatus(
+  existing: NonNullable<Awaited<ReturnType<typeof getAsyncToolCall>>>,
+  status: AsyncConfirmationStatus,
+  message?: string,
+  data?: AsyncCompletionData
+): Promise<boolean> {
+  const toolCallId = existing.toolCallId
+  if (status === ASYNC_TOOL_CONFIRMATION_STATUS.background) {
+    publishToolConfirmation({
+      toolCallId,
+      status,
+      message: message || undefined,
+      timestamp: new Date().toISOString(),
+      data,
+    })
+    return true
+  }
+  const durableStatus =
+    status === 'success'
+      ? ASYNC_TOOL_STATUS.completed
+      : status === 'cancelled'
+        ? ASYNC_TOOL_STATUS.cancelled
+        : status === 'error'
+          ? ASYNC_TOOL_STATUS.failed
+          : ASYNC_TOOL_STATUS.pending
+  try {
+    if (
+      durableStatus === ASYNC_TOOL_STATUS.completed ||
+      durableStatus === ASYNC_TOOL_STATUS.failed ||
+      durableStatus === ASYNC_TOOL_STATUS.cancelled
+    ) {
+      await completeAsyncToolCall({
+        toolCallId,
+        status: durableStatus,
+        result: data ?? null,
+        error: status === 'success' ? null : message || status,
+      })
+    } else if (existing.runId) {
+      await upsertAsyncToolCall({
+        runId: existing.runId,
+        checkpointId: existing.checkpointId ?? null,
+        toolCallId,
+        toolName: existing.toolName || 'client_tool',
+        args: (existing.args as Record<string, unknown> | null) ?? {},
+        status: durableStatus,
+      })
+    }
+    publishToolConfirmation({
+      toolCallId,
+      status,
+      message: message || undefined,
+      timestamp: new Date().toISOString(),
+      data,
+    })
+    return true
+  } catch (error) {
+    logger.error('Failed to update tool call status', {
+      toolCallId,
+      status,
+      error: toError(error).message,
+    })
+    return false
+  }
+}
+
+// POST /api/copilot/confirm — delivery path for client-executed tool
+// results. Correlate via `toolCallId` when the awaiting chat stream
+// stalls.
+export const POST = withRouteHandler((req: NextRequest) => {
+  const tracker = createRequestTracker()
+
+  return withIncomingGoSpan(
+    req.headers,
+    TraceSpan.CopilotConfirmToolResult,
+    { [TraceAttr.RequestId]: tracker.requestId },
+    async (span) => {
+      try {
+        const { userId: authenticatedUserId, isAuthenticated } =
+          await authenticateCopilotRequestSessionOnly()
+
+        if (!isAuthenticated || !authenticatedUserId) {
+          span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.Unauthorized)
+          return createUnauthorizedResponse()
+        }
+
+        const parsed = await parseRequest(
+          copilotConfirmContract,
+          req,
+          {},
+          {
+            validationErrorResponse: (error) => {
+              span.setAttribute(
+                TraceAttr.CopilotConfirmOutcome,
+                CopilotConfirmOutcome.ValidationError
+              )
+              return validationErrorResponse(
+                error,
+                `Invalid request data: ${error.issues.map((e) => e.message).join(', ')}`
+              )
+            },
+          }
+        )
+        if (!parsed.success) return parsed.response
+        const { toolCallId, status, message, data } = parsed.data.body
+        span.setAttributes({
+          [TraceAttr.ToolCallId]: toolCallId,
+          [TraceAttr.ToolConfirmationStatus]: status,
+          [TraceAttr.UserId]: authenticatedUserId,
+        })
+
+        const existing = await getAsyncToolCall(toolCallId).catch((err) => {
+          logger.warn('Failed to fetch async tool call', {
+            toolCallId,
+            error: getErrorMessage(err),
+          })
+          return null
+        })
+
+        if (!existing) {
+          span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.ToolCallNotFound)
+          return createNotFoundResponse('Tool call not found')
+        }
+        if (existing.toolName) span.setAttribute(TraceAttr.ToolName, existing.toolName)
+        if (existing.runId) span.setAttribute(TraceAttr.RunId, existing.runId)
+
+        const run = await getRunSegment(existing.runId).catch((err) => {
+          logger.warn('Failed to fetch run segment', {
+            runId: existing.runId,
+            error: getErrorMessage(err),
+          })
+          return null
+        })
+        if (!run) {
+          span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.RunNotFound)
+          return createNotFoundResponse('Tool call run not found')
+        }
+        if (run.userId !== authenticatedUserId) {
+          span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.Forbidden)
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+        }
+
+        const updated = await updateToolCallStatus(existing, status, message, data)
+
+        if (!updated) {
+          logger.error(`[${tracker.requestId}] Failed to update tool call status`, {
+            userId: authenticatedUserId,
+            toolCallId,
+            status,
+            internalStatus: status,
+            message,
+          })
+          span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.UpdateFailed)
+          // DB write failed — 500, not 400. 400 is a client-shape error.
+          return createInternalServerErrorResponse('Failed to update tool call status')
+        }
+
+        span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.Delivered)
+        return NextResponse.json({
+          success: true,
+          message: message || `Tool call ${toolCallId} has been ${status.toLowerCase()}`,
+          toolCallId,
+          status,
+        })
+      } catch (error) {
+        const duration = tracker.getDuration()
+
+        logger.error(`[${tracker.requestId}] Unexpected error:`, {
+          duration,
+          error: getErrorMessage(error, 'Unknown error'),
+          stack: error instanceof Error ? error.stack : undefined,
+        })
+
+        span.setAttribute(TraceAttr.CopilotConfirmOutcome, CopilotConfirmOutcome.InternalError)
+        return createInternalServerErrorResponse(getErrorMessage(error, 'Internal server error'))
+      }
+    }
+  )
+})