Merge origin/dev into root-resolution.

Keep the generation-guarded resolution cache and public invalidate_space so PR 10 and the workspace-routing work coexist.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

apps/desktop/src-tauri/src/lib.rs

@@ -900,7 +900,9 @@ pub fn run() {
                 tauri::async_runtime::spawn(async move {
                     #[cfg(unix)]
                     {
-                        crate::unix_signal::wait_for_term().await;
+                        if !crate::unix_signal::wait_for_term().await {
+                            return;
+                        }
                     }
                     #[cfg(windows)]
                     {

apps/desktop/src-tauri/src/unix_signal.rs

@@ -17,21 +17,22 @@ static PIPE_WRITE_FD: AtomicI32 = AtomicI32::new(-1);
 
 /// Install the recorder and wait until SIGTERM or SIGINT arrives.
 ///
-/// Returns after the first termination signal. Caller should then exit.
-pub async fn wait_for_term() {
+/// Returns `true` after the first termination signal. Returns `false` if the
+/// handler could not be installed — the caller must not treat that as exit.
+pub async fn wait_for_term() -> bool {
     let read_end = match install() {
         Ok(fd) => fd,
         Err(e) => {
             tracing::warn!("[Signal] Failed to install SA_SIGINFO handler: {e}");
-            return;
+            return false;
         }
     };
 
     let mut reader = match tokio::net::UnixStream::from_std(read_end) {
         Ok(s) => s,
         Err(e) => {
             tracing::warn!("[Signal] Failed to wrap self-pipe: {e}");
-            return;
+            return false;
         }
     };
     let mut buf = [0u8; 1];
@@ -58,6 +59,7 @@ pub async fn wait_for_term() {
         si_code = code,
         "[Signal] {name} — requesting exit"
     );
+    true
 }
 
 fn install() -> std::io::Result<UnixStream> {

crates/mcpmux-gateway/src/oauth/flow.rs

@@ -187,7 +187,7 @@ impl OAuthFlow {
 fn generate_state() -> String {
     use rand::Rng;
     let mut rng = rand::thread_rng();
-    let bytes: Vec<u8> = (0..16).map(|_| rng.gen()).collect();
+    let bytes: Vec<u8> = (0..16).map(|_| rng.gen::<u8>()).collect();
     use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
     URL_SAFE_NO_PAD.encode(&bytes)
 }

crates/mcpmux-gateway/src/oauth/pkce.rs

@@ -22,7 +22,7 @@ impl PkceChallenge {
     pub fn generate() -> Self {
         // Generate 32 random bytes for the verifier
         let mut rng = rand::thread_rng();
-        let random_bytes: Vec<u8> = (0..32).map(|_| rng.gen()).collect();
+        let random_bytes: Vec<u8> = (0..32).map(|_| rng.gen::<u8>()).collect();
 
         // Base64-URL encode to create verifier (43-128 characters)
         let verifier = URL_SAFE_NO_PAD.encode(&random_bytes);

crates/mcpmux-gateway/src/pool/features/resolution.rs

@@ -37,14 +37,21 @@ fn apply_mode_to_set(
 /// the hit so tools/prompts/resources share one entry.
 type ResolutionCacheKey = (String, Vec<String>);
 
+/// Resolved features plus an invalidation generation so a miss cannot
+/// republish a pre-event snapshot after the listener has already cleared.
+struct ResolutionCache {
+    generation: u64,
+    entries: HashMap<ResolutionCacheKey, Vec<ServerFeature>>,
+}
+
 /// Handles feature set resolution and permission evaluation
 pub struct FeatureResolutionService {
     feature_repo: Arc<dyn ServerFeatureRepository>,
     feature_set_repo: Arc<dyn FeatureSetRepository>,
     prefix_cache: Arc<PrefixCacheService>,
     /// Resolved (allow/exclude + prefix) features, invalidated when
     /// [`DomainEvent::affects_mcp_capabilities`] is true.
-    cache: Arc<RwLock<HashMap<ResolutionCacheKey, Vec<ServerFeature>>>>,
+    cache: Arc<RwLock<ResolutionCache>>,
 }
 
 impl FeatureResolutionService {
@@ -57,7 +64,10 @@ impl FeatureResolutionService {
             feature_repo,
             feature_set_repo,
             prefix_cache,
-            cache: Arc::new(RwLock::new(HashMap::new())),
+            cache: Arc::new(RwLock::new(ResolutionCache {
+                generation: 0,
+                entries: HashMap::new(),
+            })),
         }
     }
 
@@ -105,14 +115,17 @@ impl FeatureResolutionService {
     /// and from `FeatureService::mark_unavailable` so a disconnect does not
     /// keep serving a pre-disconnect tool list.
     pub async fn invalidate_space(&self, space_id: &str) {
-        self.cache
-            .write()
-            .await
+        let mut cache = self.cache.write().await;
+        cache.generation = cache.generation.wrapping_add(1);
+        cache
+            .entries
             .retain(|(cached_space, _), _| cached_space != space_id);
     }
 
     async fn invalidate_all(&self) {
-        self.cache.write().await.clear();
+        let mut cache = self.cache.write().await;
+        cache.generation = cache.generation.wrapping_add(1);
+        cache.entries.clear();
     }
 
     /// Get all available features for a space (optionally filtered by type)
@@ -155,16 +168,25 @@ impl FeatureResolutionService {
         sorted_ids.sort();
         let key = (space_id.to_string(), sorted_ids);
 
-        if let Some(cached) = self.cache.read().await.get(&key).cloned() {
-            return Ok(Self::apply_type_filter(cached, filter_type));
-        }
+        let generation = {
+            let cache = self.cache.read().await;
+            if let Some(cached) = cache.entries.get(&key).cloned() {
+                return Ok(Self::apply_type_filter(cached, filter_type));
+            }
+            cache.generation
+        };
 
         // ponytail: concurrent misses recompute; single-flight if cold-start
         // stampede shows up.
         let resolved = self
             .resolve_feature_sets_uncached(space_id, feature_set_ids)
             .await?;
-        self.cache.write().await.insert(key, resolved.clone());
+        {
+            let mut cache = self.cache.write().await;
+            if cache.generation == generation {
+                cache.entries.insert(key, resolved.clone());
+            }
+        }
         Ok(Self::apply_type_filter(resolved, filter_type))
     }
 

crates/mcpmux-storage/src/repositories/embedding_repository.rs

@@ -48,8 +48,10 @@ fn decode_vector(blob: &[u8]) -> Result<Vec<f32>> {
     }
 
     Ok(blob
-        .chunks_exact(std::mem::size_of::<f32>())
-        .map(|chunk| f32::from_le_bytes([chunk[0], chunk[1], chunk[2], chunk[3]]))
+        .as_chunks::<{ std::mem::size_of::<f32>() }>()
+        .0
+        .iter()
+        .map(|chunk| f32::from_le_bytes(*chunk))
         .collect())
 }