fix(gateway): skip pending workspace pins from another window

Every Cursor window shares one access key, so a parked X-Mcpmux-Workspace
could pin a brand-new session onto a folder that window never had open.
Refuse the pending header unless it is in the claiming request's candidate set.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-gateway/src/mcp/oauth_middleware.rs

@@ -313,9 +313,11 @@ pub async fn mcp_oauth_middleware(
                 .remember_pending_workspace(&client_id, ws);
         }
         (Some(sid), None) => {
-            services
-                .session_roots
-                .apply_pending_workspace(&client_id, sid);
+            services.session_roots.apply_pending_workspace(
+                &client_id,
+                sid,
+                workspace_set_header.as_deref(),
+            );
         }
         _ => {}
     }

crates/mcpmux-gateway/src/services/session_roots.rs

@@ -380,14 +380,40 @@ impl SessionRootsRegistry {
     ///
     /// Returns `true` when a pending path was applied. The pending entry is
     /// kept so a later session from the same client can reuse it.
-    pub fn apply_pending_workspace(&self, client_id: &str, session_id: &str) -> bool {
+    ///
+    /// The pending slot is keyed by `client_id`, and every Cursor window shares
+    /// one access key — so the parked path may belong to a *different* window
+    /// than the session now claiming it. `reported_set` is the claiming
+    /// request's own `X-Mcpmux-Workspace-Set`; together with any set already
+    /// stored for the session it decides membership, and a non-member is
+    /// refused rather than pinned onto the wrong workspace.
+    pub fn apply_pending_workspace(
+        &self,
+        client_id: &str,
+        session_id: &str,
+        reported_set: Option<&str>,
+    ) -> bool {
         let Some(path) = self
             .pending_by_client
             .get(client_id)
             .map(|value| value.clone())
         else {
             return false;
         };
+        let reported = reported_set.map(parse_candidate_set).unwrap_or_default();
+        let outside_reported = !reported.is_empty() && !reported.contains(&path);
+        if outside_reported || !self.is_candidate(session_id, &path) {
+            warn!(
+                %session_id,
+                pending_root = %path,
+                reported_candidates = ?reported,
+                session_candidates = ?self.get_candidates(session_id),
+                "[SessionRoots] held X-Mcpmux-Workspace names a folder this window does \
+                 not have open — pin skipped (the value was parked by another window \
+                 sharing this access key)",
+            );
+            return false;
+        }
         self.set_pinned(session_id, &path, PinSource::WorkspaceHeader);
         true
     }
@@ -862,7 +888,7 @@ mod tests {
 
         reg.remember_pending_workspace("client-1", pin_in);
         assert!(reg.get_pinned("sess-new").is_none());
-        assert!(reg.apply_pending_workspace("client-1", "sess-new"));
+        assert!(reg.apply_pending_workspace("client-1", "sess-new", None));
         assert_eq!(reg.get("sess-new"), Some(vec![pin_norm.to_string()]));
 
         reg.set(
@@ -882,10 +908,39 @@ mod tests {
     fn empty_pending_header_does_not_pin() {
         let reg = SessionRootsRegistry::default();
         reg.remember_pending_workspace("client-1", "   ");
-        assert!(!reg.apply_pending_workspace("client-1", "sess-1"));
+        assert!(!reg.apply_pending_workspace("client-1", "sess-1", None));
         assert!(reg.get_pinned("sess-1").is_none());
     }
 
+    #[test]
+    fn pending_header_from_another_window_does_not_pin() {
+        // Observed live: every Cursor window shares one access key, so window A
+        // parked its own folder in the client-keyed pending slot and window B's
+        // brand-new session claimed it — pinning B onto A's workspace even
+        // though B never had that folder open.
+        let reg = SessionRootsRegistry::default();
+        #[cfg(windows)]
+        let other_window = "d:\\delta";
+        #[cfg(not(windows))]
+        let other_window = "/repos/delta";
+        reg.remember_pending_workspace("client-1", other_window);
+
+        // Refused against the claiming request's own reported set.
+        let reported = CANDIDATES.join(",");
+        assert!(!reg.apply_pending_workspace("client-1", "sess-b", Some(&reported)));
+        assert!(reg.get_pinned("sess-b").is_none());
+
+        // Refused against a set already stored for the session.
+        reg.set_candidates("sess-c", &reported);
+        assert!(!reg.apply_pending_workspace("client-1", "sess-c", None));
+        assert!(reg.get_pinned("sess-c").is_none());
+
+        // A member of the set still pins — the gate is membership, not a block.
+        reg.remember_pending_workspace("client-1", CANDIDATES[0]);
+        assert!(reg.apply_pending_workspace("client-1", "sess-c", Some(&reported)));
+        assert_eq!(reg.get_pinned("sess-c").as_deref(), Some(CANDIDATES[0]));
+    }
+
     #[test]
     fn set_pinned_clears_last_resolution() {
         let reg = SessionRootsRegistry::default();

docs/planning/window-scoped-workspace-pin.md

@@ -1,6 +1,6 @@
 # Window-Scoped Workspace Pin
 
-**Last Updated:** Aug 20, 2026
+**Last Updated:** Aug 21, 2026
 **Status:** Phases 1–4 shipped, then patched same night after a field-confirmed cross-window leak on the shared global bridge process (decision 4b). Chosen from a six-option brainstorm as the highest value-per-line fix for the empty-`${workspaceFolder}` residual. Phase 1 load-bearing check passed in-process: unprivileged `netstat2` socket→PID lookup resolves a loopback peer to this process — see "second incident" below for why that check didn't catch the leak.
 **Branch:** `root-resolution`
 **Depends on:** [`cursor-workspace-routing-bridge.md`](./cursor-workspace-routing-bridge.md) Phases 1–3 (shipped) — this reuses the bridge's `X-Mcpmux-Workspace` / `X-Mcpmux-Workspace-Set` headers and the `set_workspace_root` escape hatch rather than replacing any of them
@@ -23,6 +23,8 @@ Tonight's gateway log, one machine, roughly six Cursor windows:
 
 759 manual pins for six windows is not 759 ambiguities. It is the same handful of answers re-supplied every time a session churns, because [`SessionRootsRegistry`](../../crates/mcpmux-gateway/src/services/session_roots.rs) keys `pinned` by `session_id` and nothing else. The only coarser key available today is `pending_by_client`, keyed by `client_id` — and `client_id` is per-API-key, not per-window, which is why it collapses six windows into two values. So a pin has exactly one lifetime available to it: the session. Every reconnect, every auth bounce, every `mcp-remote` respawn throws the answer away and asks again.
 
+`apply_pending_workspace` now refuses to apply a parked header that is not a member of the claiming request's `X-Mcpmux-Workspace-Set` (or the session's already-stored candidate set). That stops window A's initialize from pinning window B onto A's folder when they share one access key. An absent set still does not block (same doctrine as `is_candidate`). Re-keying the pending slot by `WindowKey` would close the remaining no-set case; not done here.
+
 ### The dead end that isn't
 
 [`cursor-workspace-routing-bridge.md`](./cursor-workspace-routing-bridge.md) Scope/Out records gateway-side process introspection as: *"Dead end — the gateway sees a TCP connection over streamable HTTP, not a spawned child process; there's no PID to walk."*
@@ -233,7 +235,7 @@ Closes the ways a remembered pin could outlive its truth.
 
 | File | Note |
 | ---- | ---- |
-| [`crates/mcpmux-gateway/src/services/session_roots.rs`](../../crates/mcpmux-gateway/src/services/session_roots.rs) | `pinned` is session-keyed; `pending_by_client` is client-keyed (2 values for 6 windows). The gap this doc fills sits between them |
+| [`crates/mcpmux-gateway/src/services/session_roots.rs`](../../crates/mcpmux-gateway/src/services/session_roots.rs) | `pinned` is session-keyed; `pending_by_client` is client-keyed (2 values for 6 windows). `apply_pending_workspace` now refuses a parked path that is not in the claiming window's candidate set. |
 | [`crates/mcpmux-gateway/src/mcp/oauth_middleware.rs`](../../crates/mcpmux-gateway/src/mcp/oauth_middleware.rs) | Header hold-then-pin, the empty-header warn, and the set-header constraint all live here — as will the window-key memoization |
 | [`crates/mcpmux-gateway/src/server/mod.rs`](../../crates/mcpmux-gateway/src/server/mod.rs) | `into_make_service_with_connect_info::<SocketAddr>()` is already wired; `restrict_management_to_loopback` is prior art for trusting the peer socket over a spoofable header |
 | [`crates/mcpmux-core/src/domain/workspace_binding.rs`](../../crates/mcpmux-core/src/domain/workspace_binding.rs) | `normalize_workspace_root()` / `expand_home_tilde()` — the shared-filesystem assumption that the HA OS `~/helm` case violates |