waleedlatif1 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/apps/sim/lib/mothership/application/file-owner-context.ts b/apps/sim/lib/mothership/application/file-owner-context.ts
@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
-import { omit } from '@sim/utils/object'
+import { omit, toArray } from '@sim/utils/object'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { executeCopilotProjectDiscovery } from '@/lib/mothership/application/execute-project-use-case'
 import {
@@ -10,18 +10,21 @@ import {
 } from '@/lib/mothership/auth/application-delegation'
 import { getCopilotFileOwnerAdapter } from '@/lib/mothership/file-owners'
 import type { FileOwnerContext } from '@/lib/mothership/generated/file-owner'
+import { WORKSPACE_FILE_COPY_CAPABILITY } from '@/lib/mothership/generated/protocol'
 import { supportsFileOwnerProtocol } from '@/lib/mothership/request/lifecycle/file-owner-protocol'
 import { getCurrentWorkspaceProject } from '@/lib/projects/application'
 import { isProjectsEnabled } from '@/lib/projects/rollout.server'
 
 const logger = createLogger('CopilotFileOwnerContext')
 
 /**
- * Adds current owner hints to admitted authoring turns using the worker's generated contract.
- * Hints are best-effort: a failed Project lookup sends the turn with no Project rather than failing
- * it. Support is probed on the selected worker URL, which may front several worker releases, and a
- * worker that predates the hint keys rejects them; rolling the worker back therefore requires
- * turning the `projects` flag off first.
+ * Adds what admitted authoring turns may do with files, using the worker's generated contract.
+ * Every such turn declares `workspace-file-copy`: copies between workspaces need the turn's
+ * admission but not Projects, and a worker that predates the token ignores it. With Projects on,
+ * it also gets current owner hints. Hints are best-effort: a failed Project lookup sends the turn
+ * with no Project rather than failing it. Support is probed on the selected worker URL, which may
+ * front several worker releases, and a worker that predates the hint keys rejects them; rolling
+ * the worker back therefore requires turning the `projects` flag off first.
  */
 export async function withFileOwnerContext(
   payload: Record<string, unknown>,
@@ -30,14 +33,18 @@ export async function withFileOwnerContext(
   route: string
 ): Promise<Record<string, unknown>> {
   const clean = omit(payload, ['project', 'fileOwnerCapabilities', 'fileOwnerProtocolVersion'])
-  if (
-    !['/api/copilot', '/api/mothership'].includes(route) ||
-    context.requestMode === 'assistant' ||
-    !hasCopilotResourceAdmission(context) ||
-    !(await isProjectsEnabled()) ||
-    !(await supportsFileOwnerProtocol(baseURL))
+  if (!['/api/copilot', '/api/mothership'].includes(route)) return clean
+  const admitted = context.requestMode !== 'assistant' && hasCopilotResourceAdmission(context)
+  const declared = toArray(clean.clientCapabilities).filter(
+    (capability) => capability !== WORKSPACE_FILE_COPY_CAPABILITY
   )
-    return clean
+  const turn = admitted
+    ? { ...clean, clientCapabilities: [...declared, WORKSPACE_FILE_COPY_CAPABILITY] }
+    : clean.clientCapabilities === undefined
+      ? clean
+      : { ...clean, clientCapabilities: declared }
+  if (!admitted || !(await isProjectsEnabled()) || !(await supportsFileOwnerProtocol(baseURL)))
+    return turn
 
   const hints: FileOwnerContext = {
     fileOwnerProtocolVersion: 1,
@@ -70,5 +77,5 @@ export async function withFileOwnerContext(
         })
     }
   }
-  return { ...clean, ...hints }
+  return { ...turn, ...hints }
 }
diff --git a/apps/sim/lib/mothership/chat/post.ts b/apps/sim/lib/mothership/chat/post.ts
@@ -1408,7 +1408,7 @@ export async function handleUnifiedChatPost(req: NextRequest) {
         if (!lease || !sendClaim?.claimToken || sendClaim.storageMethod !== 'database') {
           throw new Error('Chat admission requires its controller and durable send claim')
         }
-        const resourceAuthoringVersion = await durableResourceAuthoringVersion(
+        const resourceAuthoringVersion = durableResourceAuthoringVersion(
           executionContext.copilotResourceAdmission !== undefined
         )
         admittedRun = await admitChatTurn.execute({

diff --git a/apps/sim/lib/mothership/generated/protocol.ts b/apps/sim/lib/mothership/generated/protocol.ts
@@ -303,6 +303,13 @@ export const TOOL_DEADLINE_SETTLE_MARGIN_MS = 90_000;
 /** The `clientCapabilities` token a Sim sends when it honors `StreamToolDeadline`. */
 export const TOOL_DEADLINE_CAPABILITY = "tool-deadline";
 
+/**
+ * The `clientCapabilities` token a Sim sends when this turn may copy files within or between
+ * workspaces it can reach (`files copy`) without negotiated file owners, so also where Projects
+ * are off.
+ */
+export const WORKSPACE_FILE_COPY_CAPABILITY = "workspace-file-copy";
+
 /** POST /api/mothership — the chat request sim sends. */
 export interface ChatRequest extends StreamResponseReceipt {
   fileOwnerProtocolVersion?: 1 | undefined;
@@ -348,7 +355,8 @@ export interface ChatRequest extends StreamResponseReceipt {
    * grace windows and run tools server-side immediately. ABSENT = older/unknown caller —
    * dispatch keeps its conservative grace (deploy-skew safe: a stale tab that predates
    * this field still gets waited on). Known capability: "workflow-tool-pickup". Sim also
-   * declares its own {@link TOOL_DEADLINE_CAPABILITY} here.
+   * declares its own {@link TOOL_DEADLINE_CAPABILITY} and {@link WORKSPACE_FILE_COPY_CAPABILITY}
+   * here.
    */
   clientCapabilities?: string[] | undefined;
   /**

diff --git a/apps/sim/lib/mothership/request/lifecycle/recovery-config.test.ts b/apps/sim/lib/mothership/request/lifecycle/recovery-config.test.ts
@@ -104,15 +104,22 @@ describe('recovery marker written by an admitted turn', () => {
     }),
   }
 
-  it('stays off a recovery config older builds must still parse while Projects are off', async () => {
-    featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(false)
-    const recovery = await streamRecoveryConfig(options, workspaceRequest)
-    expect(recovery).not.toHaveProperty('resourceAuthoringVersion')
-  })
+  it.each([true, false])(
+    'restores authoring admission on recovery whether Projects are on (%s) or off',
+    async (projects) => {
+      featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(
+        async (flag) => projects && flag === 'projects'
+      )
+      const recovery = await streamRecoveryConfig(options, workspaceRequest)
+      expect(recovery?.resourceAuthoringVersion).toBe(1)
+    }
+  )
 
-  it('restores authoring admission on recovery while Projects are on', async () => {
-    featureFlagsMockFns.mockIsFeatureEnabled.mockImplementation(async (flag) => flag === 'projects')
-    const recovery = await streamRecoveryConfig(options, workspaceRequest)
-    expect(recovery?.resourceAuthoringVersion).toBe(1)
+  it('stays off a turn that was never admitted', async () => {
+    const recovery = await streamRecoveryConfig(
+      { ...options, copilotResourceAdmission: undefined },
+      workspaceRequest
+    )
+    expect(recovery).not.toHaveProperty('resourceAuthoringVersion')
   })
 })
diff --git a/apps/sim/lib/mothership/request/lifecycle/recovery-config.ts b/apps/sim/lib/mothership/request/lifecycle/recovery-config.ts
@@ -3,7 +3,6 @@ import { hasCopilotResourceAdmission } from '@/lib/mothership/auth/application-d
 import { COPILOT_REQUEST_MODES } from '@/lib/mothership/constants'
 import { ChatPayloadSchema } from '@/lib/mothership/generated/protocol'
 import type { CopilotLifecycleOptions } from '@/lib/mothership/request/lifecycle/run'
-import { isProjectsEnabled } from '@/lib/projects/rollout.server'
 
 export const BillingAdmissionSchema = z
   .object({
@@ -28,14 +27,14 @@ export const DurableChatRequestSchema = ChatPayloadSchema.safeExtend({
 export const RESOURCE_AUTHORING_VERSION = 1
 
 /**
- * The marker an admitted turn stores for recovery. Builds before it parse recovery strictly and
- * would refuse to recover the run, and only Project authoring reads it, so it is written only
- * while Projects are on.
+ * The marker an admitted turn stores for recovery, so a recovered turn keeps its admission. It is
+ * written whether or not Projects are on, since copies between workspaces need the admission
+ * without them; every release since the marker shipped parses it.
  */
-export async function durableResourceAuthoringVersion(
+export function durableResourceAuthoringVersion(
   admitted: boolean
-): Promise<typeof RESOURCE_AUTHORING_VERSION | undefined> {
-  return admitted && (await isProjectsEnabled()) ? RESOURCE_AUTHORING_VERSION : undefined
+): typeof RESOURCE_AUTHORING_VERSION | undefined {
+  return admitted ? RESOURCE_AUTHORING_VERSION : undefined
 }
 
 export const StreamRecoveryConfigSchema = z
@@ -66,7 +65,7 @@ export async function streamRecoveryConfig(
   request: Record<string, unknown>
 ) {
   if (options.interactive !== true) return undefined
-  const resourceAuthoringVersion = await durableResourceAuthoringVersion(
+  const resourceAuthoringVersion = durableResourceAuthoringVersion(
     hasCopilotResourceAdmission({
       ...options,
       ...options.executionContext,

diff --git a/apps/sim/lib/mothership/tools/sandbox-file-copy.ts b/apps/sim/lib/mothership/tools/sandbox-file-copy.ts
@@ -13,6 +13,7 @@ import {
   recordSandboxResourceEffects,
   type SandboxResourceScope,
 } from '@/lib/mothership/tools/sandbox-resources'
+import { copiesWithinWorkspaces } from '@/lib/workspace-files/application/copy-operation'
 
 const logger = createLogger('SandboxFileCopy')
 
@@ -22,15 +23,17 @@ export async function proxySandboxFileCopyRequest(
   token: string,
   scope: SandboxResourceScope
 ): Promise<Response> {
+  const unavailable = () =>
+    Response.json(
+      { error: 'Paired file owner routing is unavailable or contradictory' },
+      { status: 403 }
+    )
   if (
-    scope.fileOwnerProtocolVersion !== 1 ||
+    (scope.fileOwnerProtocolVersion !== 1 && !scope.workspaceFileCopy) ||
     request.headers.has('x-mothership-file-owner') ||
     request.headers.has('x-mothership-workspace-id')
   )
-    return Response.json(
-      { error: 'Paired file owner routing is unavailable or contradictory' },
-      { status: 403 }
-    )
+    return unavailable()
   if (request.method !== 'POST')
     return Response.json({ error: 'Method not allowed' }, { status: 405 })
   const parsed = await parseRequest(
@@ -43,6 +46,9 @@ export async function proxySandboxFileCopyRequest(
     }
   )
   if (!parsed.success) return parsed.response
+  // Without the negotiated protocol only workspace owners exist for this lease.
+  if (scope.fileOwnerProtocolVersion !== 1 && !copiesWithinWorkspaces(parsed.data.body))
+    return unavailable()
   const endpoint = getInternalApiBaseUrl()
   const transport = createFileCopyCliTransport(
     endpoint,

diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.test.ts
@@ -16,6 +16,7 @@ import { assertWorkspaceInvocationScope } from '@/lib/core/application/workspace
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 import { projectFileOperations } from '@/lib/projects/files/application/operations'
+import { fileCopyOperation } from '@/lib/workspace-files/application/copy-operation'
 import { fileOperations } from '@/lib/workspace-files/application/operations'
 
 const { readScope, recordEffects, fetcher, routeMatcher, recordInput } = vi.hoisted(() => ({
@@ -436,26 +437,72 @@ it.each([
   }
 )
 
-it('refuses a Project copy destination on a lease without the file-owner protocol', async () => {
-  readScope.mockResolvedValue({ ...scope, fileOwnerProtocolVersion: undefined })
-  routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })
+it('binds a workspace pair under the paired copy grant on an admitted lease without the protocol', async () => {
+  readScope.mockResolvedValue({
+    ...scope,
+    fileOwnerProtocolVersion: undefined,
+    workspaceFileCopy: true,
+  })
+  routeMatcher.mockReturnValue({
+    pattern: '/api/v2/files/copy',
+    params: {},
+    load: async () => ({ POST: fetcher }),
+  })
+  fetcher.mockImplementation(async (forwarded: Request) => {
+    expect(
+      copilotRequestPrincipal(forwarded, fileCopyOperation, {
+        operation: fileCopyOperation,
+        delegationAudience: fileCopyOperation.delegationAudience,
+      })
+    ).toMatchObject({
+      kind: 'resource_delegated',
+      subjectUserId: scope.userId,
+      invocation: { kind: 'chat', chatId: scope.chatId },
+      scope: { kind: 'file_copy', destination: { owner: workspaceOwner } },
+    })
+    return Response.json({ data: { copied: [] } })
+  })
   const response = await proxySandboxResourceRequest(
     request('/api/v2/files/copy', {
       method: 'POST',
       body: JSON.stringify({
         source: { owner: workspaceOwner, fileIds: ['file'] },
-        destination: { owner: { entityType: 'project', entityId: 'project' } },
+        destination: { owner: workspaceOwner },
       }),
     }),
     token
   )
-  expect(response.status).toBe(403)
-  expect(await response.json()).toEqual({
-    error: 'Paired file owner routing is unavailable or contradictory',
-  })
-  expect(fetcher).not.toHaveBeenCalled()
+  expect(response.status).toBe(200)
+  expect(fetcher).toHaveBeenCalledTimes(1)
 })
 
+it.each([undefined, true as const])(
+  'refuses a Project copy destination on a lease without the file-owner protocol (workspace copies %s)',
+  async (workspaceFileCopy) => {
+    readScope.mockResolvedValue({
+      ...scope,
+      fileOwnerProtocolVersion: undefined,
+      workspaceFileCopy,
+    })
+    routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })
+    const response = await proxySandboxResourceRequest(
+      request('/api/v2/files/copy', {
+        method: 'POST',
+        body: JSON.stringify({
+          source: { owner: workspaceOwner, fileIds: ['file'] },
+          destination: { owner: { entityType: 'project', entityId: 'project' } },
+        }),
+      }),
+      token
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({
+      error: 'Paired file owner routing is unavailable or contradictory',
+    })
+    expect(fetcher).not.toHaveBeenCalled()
+  }
+)
+
 it('validates a copy body itself once the lease negotiated the file-owner protocol', async () => {
   readScope.mockResolvedValue({ ...scope, fileOwnerProtocolVersion: 1 })
   routeMatcher.mockReturnValue({ params: {}, load: async () => ({ POST: fetcher }) })

diff --git a/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts b/apps/sim/lib/mothership/tools/sandbox-resource-transport.ts
@@ -28,6 +28,7 @@ import {
   type SandboxResourceScope,
 } from '@/lib/mothership/tools/sandbox-resources'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
+import { copiesWithinWorkspaces } from '@/lib/workspace-files/application/copy-operation'
 
 const logger = createLogger('MothershipSandboxResourceTransport')
 
@@ -54,15 +55,20 @@ export async function proxySandboxResourceRequest(
   if (!scope)
     return Response.json({ error: 'Sandbox tool execution is no longer active' }, { status: 403 })
   /**
-   * Paired owners need the negotiated protocol. Without it, only a copy that names a non-workspace
-   * owner is refused there; workspace copies and invalid bodies keep the workspace route and its
+   * Copies bind both owners under the paired grant. Project owners need the negotiated protocol,
+   * and an admitted lease copies between workspaces without it; a copy naming a Project owner is
+   * refused there. Otherwise workspace copies and invalid bodies keep the workspace route and its
    * v2 validation response.
    */
   if (path === v2CopyFileItemsContract.path) {
     const buffered = await bufferCopyRequest(request)
     if (buffered instanceof Response) return buffered
     request = buffered
-    if (scope.fileOwnerProtocolVersion === 1 || (await copiesBeyondWorkspaces(request)))
+    if (
+      scope.fileOwnerProtocolVersion === 1 ||
+      scope.workspaceFileCopy ||
+      (await copiesBeyondWorkspaces(request))
+    )
       return proxySandboxFileCopyRequest(request, token, scope)
   }
   const ownerHeader = request.headers.get('x-mothership-file-owner')
@@ -245,9 +251,5 @@ async function copiesBeyondWorkspaces(request: Request): Promise<boolean> {
     {},
     V2_PARSE_DEFAULTS
   )
-  return (
-    parsed.success &&
-    (parsed.data.body.source.owner.entityType !== 'workspace' ||
-      parsed.data.body.destination.owner.entityType !== 'workspace')
-  )
+  return parsed.success && !copiesWithinWorkspaces(parsed.data.body)
 }
diff --git a/apps/sim/lib/mothership/tools/sandbox-resources.test.ts b/apps/sim/lib/mothership/tools/sandbox-resources.test.ts
@@ -308,7 +308,7 @@ it.each([
   [true, false, true, undefined],
   [true, true, false, undefined],
 ] as const)(
-  'negotiates the callback protocol only with admission=%s projects=%s peer=%s',
+  'negotiates the callback protocol only with admission=%s projects=%s peer=%s; copies follow admission alone',
   async (admitted, enabled, supported, expected) => {
     featureFlagsMockFns.mockIsFeatureEnabled.mockResolvedValue(enabled)
     vi.stubGlobal(
@@ -334,6 +334,7 @@ it.each([
         if (!token) throw new Error('Callback token missing')
         const scope = await readSandboxResourceScope(token, 'secret')
         expect(scope?.fileOwnerProtocolVersion).toBe(expected)
+        expect(scope?.workspaceFileCopy).toBe(admitted ? true : undefined)
       }
     )
   }