feat(meta-tools): debug auto-approve to self-test mcpmux_* writes

Self-testing the workspace-root routing means driving write meta tools
(mcpmux_create_feature_set, mcpmux_bind_current_workspace) from a real
client — but every write blocks on a native approval dialog, which a
headless/scripted client can't satisfy.

Add a session-only DEBUG bypass on ApprovalBroker:
- `auto_approve: AtomicBool`, seeded from MCPMUX_DEBUG_AUTO_APPROVE=1|true
  at startup; `set_auto_approve` / `auto_approve_enabled` toggle it live.
- request_approval() step 0: if on, return AllowOnce before any dialog,
  rate-limit, or publisher check — so even a headless gateway approves.
- Tauri commands set_meta_tools_auto_approve / get_meta_tools_auto_approve
  (registered in invoke_handler) + metaTools.ts bindings.
- A clearly-marked amber "Auto-approve writes (debug)" switch in
  MetaToolGrantsPanel so it's discoverable and obviously dev-only.

Not persisted: resets to the env default on gateway restart, so the safe
"every write needs a fresh nod" default always returns.

Test: approval::tests::auto_approve_bypasses_dialog — on => AllowOnce with
no publisher; off => restores ApprovalRequiredNoDesktop.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/meta_tool_approval.rs

@@ -109,3 +109,44 @@ pub async fn revoke_meta_tool_grant(
     };
     Ok(broker.revoke_always_allow(&client_id, &tool_name))
 }
+
+/// DEBUG/dev only: toggle auto-approval of all write meta tools.
+///
+/// When on, every `mcpmux_*` write tool (create_feature_set,
+/// bind_current_workspace, …) is approved without a dialog. This exists so a
+/// developer (or the in-app assistant) can self-create feature sets / bindings
+/// and exercise the routing end-to-end without clicking through approvals.
+/// Session-only — it is **not** persisted and resets to the
+/// `MCPMUX_DEBUG_AUTO_APPROVE` env default on gateway restart.
+#[tauri::command]
+pub async fn set_meta_tools_auto_approve(
+    enabled: bool,
+    gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
+) -> Result<bool, String> {
+    let broker = {
+        let state = gateway_state.read().await;
+        state.approval_broker.clone()
+    };
+    let Some(broker) = broker else {
+        warn!("[meta-tool] set_meta_tools_auto_approve called but gateway is not running");
+        return Err("gateway is not running".into());
+    };
+    broker.set_auto_approve(enabled);
+    warn!(enabled, "[meta-tool] auto-approve toggled (DEBUG)");
+    Ok(enabled)
+}
+
+/// Whether write meta tools are currently auto-approved (DEBUG mode state).
+#[tauri::command]
+pub async fn get_meta_tools_auto_approve(
+    gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
+) -> Result<bool, String> {
+    let broker = {
+        let state = gateway_state.read().await;
+        state.approval_broker.clone()
+    };
+    let Some(broker) = broker else {
+        return Ok(false);
+    };
+    Ok(broker.auto_approve_enabled())
+}

apps/desktop/src-tauri/src/lib.rs

@@ -910,6 +910,8 @@ pub fn run() {
             commands::respond_to_meta_tool_approval,
             commands::list_meta_tool_grants,
             commands::revoke_meta_tool_grant,
+            commands::set_meta_tools_auto_approve,
+            commands::get_meta_tools_auto_approve,
             // Built-in servers (per-Space enablement + per-tool toggles)
             commands::list_builtin_servers,
             commands::set_builtin_server_enabled,

apps/desktop/src/features/metaTools/MetaToolGrantsPanel.tsx

@@ -1,9 +1,11 @@
 import { useCallback, useEffect, useState } from 'react';
-import { KeyRound, Loader2, Trash2 } from 'lucide-react';
-import { Button, Card, CardContent, CardHeader, CardTitle } from '@mcpmux/ui';
+import { FlaskConical, KeyRound, Loader2, Trash2 } from 'lucide-react';
+import { Button, Card, CardContent, CardHeader, CardTitle, Switch } from '@mcpmux/ui';
 import {
+  getMetaToolsAutoApprove,
   listMetaToolGrants,
   revokeMetaToolGrant,
+  setMetaToolsAutoApprove,
   type MetaToolGrantEntry,
 } from '@/lib/api/metaTools';
 
@@ -21,6 +23,7 @@ export function MetaToolGrantsPanel() {
   const [grants, setGrants] = useState<MetaToolGrantEntry[] | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [revoking, setRevoking] = useState<string | null>(null);
+  const [autoApprove, setAutoApprove] = useState<boolean | null>(null);
 
   const load = useCallback(async () => {
     try {
@@ -38,6 +41,23 @@ export function MetaToolGrantsPanel() {
     return () => clearInterval(i);
   }, [load]);
 
+  useEffect(() => {
+    getMetaToolsAutoApprove()
+      .then(setAutoApprove)
+      .catch(() => setAutoApprove(false));
+  }, []);
+
+  const handleToggleAutoApprove = async (next: boolean) => {
+    const prev = autoApprove;
+    setAutoApprove(next);
+    try {
+      await setMetaToolsAutoApprove(next);
+    } catch (e) {
+      setAutoApprove(prev);
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  };
+
   const handleRevoke = async (g: MetaToolGrantEntry) => {
     const key = `${g.client_id}:${g.tool_name}`;
     setRevoking(key);
@@ -54,28 +74,51 @@ export function MetaToolGrantsPanel() {
   return (
     <Card data-testid="meta-tool-grants-panel">
       <CardHeader>
-        <CardTitle className="text-base flex items-center gap-2">
+        <CardTitle className="flex items-center gap-2 text-base">
           <KeyRound className="h-4 w-4" />
           Meta-tool auto-approvals
         </CardTitle>
-        <p className="text-xs text-[rgb(var(--muted))] mt-1">
-          &quot;Always for this session&quot; approvals granted to clients for
-          specific <code className="font-mono">mcpmux_*</code> tools. Wipes on
-          gateway restart.
+        <p className="mt-1 text-xs text-[rgb(var(--muted))]">
+          &quot;Always for this session&quot; approvals granted to clients for specific{' '}
+          <code className="font-mono">mcpmux_*</code> tools. Wipes on gateway restart.
         </p>
       </CardHeader>
       <CardContent>
-        {error && (
-          <div className="text-sm text-red-600 dark:text-red-400 mb-2">
-            {error}
+        {error && <div className="mb-2 text-sm text-red-600 dark:text-red-400">{error}</div>}
+
+        {/* DEBUG: bypass the approval dialog entirely. For developers driving
+            mcpmux_* writes (create feature sets / bindings) from a client to
+            self-test routing. Session-only; resets on gateway restart. */}
+        <div
+          className="mb-4 flex items-start justify-between gap-3 rounded-lg border border-amber-300/60 bg-amber-50 p-3 dark:border-amber-700/50 dark:bg-amber-900/20"
+          data-testid="meta-tool-auto-approve"
+        >
+          <div className="flex min-w-0 gap-2">
+            <FlaskConical className="mt-0.5 h-4 w-4 flex-shrink-0 text-amber-600 dark:text-amber-400" />
+            <div className="min-w-0">
+              <div className="text-sm font-medium text-amber-900 dark:text-amber-200">
+                Auto-approve writes (debug)
+              </div>
+              <p className="mt-0.5 text-xs text-amber-800/80 dark:text-amber-300/80">
+                Skip the approval dialog for every <code className="font-mono">mcpmux_*</code>{' '}
+                write. For self-testing only — resets on gateway restart.
+              </p>
+            </div>
           </div>
-        )}
+          <Switch
+            checked={autoApprove ?? false}
+            disabled={autoApprove === null}
+            onCheckedChange={(v) => void handleToggleAutoApprove(v)}
+            data-testid="meta-tool-auto-approve-toggle"
+          />
+        </div>
+
         {grants === null ? (
           <div className="flex items-center gap-2 text-sm text-[rgb(var(--muted))]">
             <Loader2 className="h-4 w-4 animate-spin" /> Loading…
           </div>
         ) : grants.length === 0 ? (
-          <p className="text-sm text-[rgb(var(--muted))] italic">
+          <p className="text-sm italic text-[rgb(var(--muted))]">
             No auto-approvals yet. Each dialog defaults to &quot;Allow once&quot;.
           </p>
         ) : (
@@ -88,11 +131,9 @@ export function MetaToolGrantsPanel() {
                   className="flex items-center justify-between py-2 text-sm"
                   data-testid={`meta-tool-grant-${g.tool_name}`}
                 >
-                  <div className="flex flex-col min-w-0 mr-3">
-                    <span className="font-mono text-xs truncate">
-                      {g.tool_name}
-                    </span>
-                    <span className="text-[11px] text-[rgb(var(--muted))] truncate">
+                  <div className="mr-3 flex min-w-0 flex-col">
+                    <span className="truncate font-mono text-xs">{g.tool_name}</span>
+                    <span className="truncate text-[11px] text-[rgb(var(--muted))]">
                       client {g.client_id.slice(0, 8)}…
                     </span>
                   </div>
@@ -107,7 +148,7 @@ export function MetaToolGrantsPanel() {
                       <Loader2 className="h-3 w-3 animate-spin" />
                     ) : (
                       <>
-                        <Trash2 className="h-3 w-3 mr-1" /> Revoke
+                        <Trash2 className="mr-1 h-3 w-3" /> Revoke
                       </>
                     )}
                   </Button>

apps/desktop/src/lib/api/metaTools.ts

@@ -25,17 +25,31 @@ export async function listMetaToolGrants(): Promise<MetaToolGrantEntry[]> {
 }
 
 /** Revoke a single "always allow" entry. */
-export async function revokeMetaToolGrant(
-  clientId: string,
-  toolName: string
-): Promise<boolean> {
+export async function revokeMetaToolGrant(clientId: string, toolName: string): Promise<boolean> {
   return invoke('revoke_meta_tool_grant', { clientId, toolName });
 }
 
 // The mcpmux_* enablement switch is now per-Space — see
 // `@/lib/api/builtinServers` (listBuiltinServers / setBuiltinServerEnabled /
 // setBuiltinToolEnabled). The old global get/set_meta_tools_enabled were removed.
 
+/**
+ * DEBUG/dev only: toggle auto-approval of every write meta tool.
+ *
+ * When on, `mcpmux_create_feature_set` / `mcpmux_bind_current_workspace` and
+ * friends are approved without a dialog — so a developer can self-create
+ * feature sets and bindings and exercise routing end-to-end. Session-only:
+ * resets on gateway restart (to the `MCPMUX_DEBUG_AUTO_APPROVE` env default).
+ */
+export async function setMetaToolsAutoApprove(enabled: boolean): Promise<boolean> {
+  return invoke('set_meta_tools_auto_approve', { enabled });
+}
+
+/** Whether write meta tools are currently auto-approved (DEBUG mode state). */
+export async function getMetaToolsAutoApprove(): Promise<boolean> {
+  return invoke('get_meta_tools_auto_approve');
+}
+
 /**
  * Respond to a pending approval request. Normally called by
  * `<MetaToolApprovalDialog>`; exported here for tests and advanced flows.
@@ -44,10 +58,7 @@ export async function respondToMetaToolApproval(
   requestId: string,
   clientId: string,
   toolName: string,
-  decision:
-    | 'allow_once'
-    | 'always_for_this_session_and_client'
-    | 'deny'
+  decision: 'allow_once' | 'always_for_this_session_and_client' | 'deny'
 ): Promise<boolean> {
   return invoke('respond_to_meta_tool_approval', {
     requestId,

crates/mcpmux-gateway/src/services/meta_tools/approval.rs

@@ -24,6 +24,7 @@
 //! client_metadata URL for DCR-registered clients like Claude Code). The
 //! broker doesn't parse it; equality + hashing is enough.
 
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -117,6 +118,12 @@ pub struct ApprovalBroker {
     /// Published to the desktop layer; `None` means headless.
     publisher: Mutex<Option<ApprovalPublisher>>,
     timeout: Duration,
+    /// DEBUG/dev only: when set, every write meta-tool is auto-approved without
+    /// a dialog. Lets self-tests drive `mcpmux_create_feature_set` /
+    /// `mcpmux_bind_current_workspace` headlessly. Off by default; enabled via
+    /// `MCPMUX_DEBUG_AUTO_APPROVE=1` at startup or the
+    /// `set_meta_tools_auto_approve` command at runtime.
+    auto_approve: AtomicBool,
 }
 
 impl Default for ApprovalBroker {
@@ -127,12 +134,21 @@ impl Default for ApprovalBroker {
 
 impl ApprovalBroker {
     pub fn new() -> Self {
+        let auto = std::env::var("MCPMUX_DEBUG_AUTO_APPROVE")
+            .map(|v| matches!(v.as_str(), "1" | "true"))
+            .unwrap_or(false);
+        if auto {
+            warn!(
+                "[ApprovalBroker] MCPMUX_DEBUG_AUTO_APPROVE set — meta-tool writes auto-approved"
+            );
+        }
         Self {
             pending: DashMap::new(),
             always_allow: DashMap::new(),
             rate_limit: DashMap::new(),
             publisher: Mutex::new(None),
             timeout: DEFAULT_TIMEOUT,
+            auto_approve: AtomicBool::new(auto),
         }
     }
 
@@ -141,6 +157,17 @@ impl ApprovalBroker {
         self
     }
 
+    /// DEBUG/dev only: toggle auto-approval of all write meta tools.
+    pub fn set_auto_approve(&self, on: bool) {
+        self.auto_approve.store(on, Ordering::Relaxed);
+        warn!(on, "[ApprovalBroker] auto-approve toggled (DEBUG)");
+    }
+
+    /// Whether write meta tools are currently auto-approved.
+    pub fn auto_approve_enabled(&self) -> bool {
+        self.auto_approve.load(Ordering::Relaxed)
+    }
+
     /// Attach the desktop subscriber. Call once at app startup.
     pub async fn set_publisher(&self, publisher: ApprovalPublisher) {
         *self.publisher.lock().await = Some(publisher);
@@ -212,6 +239,16 @@ impl ApprovalBroker {
         tool_name: &str,
         payload: ApprovalPayload,
     ) -> Result<ApprovalDecision, MetaToolError> {
+        // 0. DEBUG auto-approve — bypass the dialog entirely (dev/self-test).
+        if self.auto_approve.load(Ordering::Relaxed) {
+            warn!(
+                %client_id,
+                tool = tool_name,
+                "[ApprovalBroker] DEBUG auto-approve — bypassing dialog",
+            );
+            return Ok(ApprovalDecision::AllowOnce);
+        }
+
         // 1. Always-allow short-circuit.
         if self
             .always_allow
@@ -332,6 +369,37 @@ mod tests {
         assert!(matches!(err, MetaToolError::ApprovalRequiredNoDesktop));
     }
 
+    #[tokio::test]
+    async fn auto_approve_bypasses_dialog() {
+        // DEBUG mode: even with NO publisher attached (which normally yields
+        // ApprovalRequiredNoDesktop), auto-approve returns AllowOnce so
+        // self-tests can drive write meta tools headlessly. Toggling off
+        // restores the safe headless deny.
+        let broker = ApprovalBroker::new();
+        broker.set_auto_approve(true);
+        assert!(broker.auto_approve_enabled());
+        let d = broker
+            .request_approval(
+                &Uuid::new_v4().to_string(),
+                "mcpmux_bind_current_workspace",
+                make_payload(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(d, ApprovalDecision::AllowOnce);
+
+        broker.set_auto_approve(false);
+        let err = broker
+            .request_approval(
+                &Uuid::new_v4().to_string(),
+                "mcpmux_bind_current_workspace",
+                make_payload(),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(err, MetaToolError::ApprovalRequiredNoDesktop));
+    }
+
     #[tokio::test]
     async fn always_allow_short_circuits() {
         let broker = ApprovalBroker::new();