fix(gateway): keep one-folder pins and redact probe env

Empty ${workspaceFolder} no longer wipes a same-request single-folder set.
Failed config reconnect marks features unavailable, bind active uses the
hook root, and the env-probe allowlists study keys only.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-gateway/src/consumers/server_config_handler.rs

@@ -98,6 +98,7 @@ impl ServerConfigUpdatedHandler {
         }
 
         let started = Instant::now();
+        self.drop_stale_features(space_id, server_id).await;
         match resolve_auto_connection_context(
             self.installed_server_repo.as_ref(),
             self.state_dir.as_deref(),
@@ -136,6 +137,27 @@ impl ServerConfigUpdatedHandler {
         }
         Ok(())
     }
+
+    /// Flip cached features off and drop the resolution cache before reconnect.
+    ///
+    /// A successful discover writes `is_available` back. Without this, a failed
+    /// `reconnect_fresh` evicts the instance while `tools/list` still advertises
+    /// the pre-save rows.
+    async fn drop_stale_features(&self, space_id: Uuid, server_id: &str) {
+        if let Err(error) = self
+            .pool_service
+            .feature_service()
+            .mark_unavailable(&space_id.to_string(), server_id)
+            .await
+        {
+            warn!(
+                server_id = %server_id,
+                space_id = %space_id,
+                error = %error,
+                "[ServerConfigHandler] mark_unavailable failed before reconnect"
+            );
+        }
+    }
 }
 
 #[cfg(test)]

crates/mcpmux-gateway/src/mcp/oauth_middleware.rs

@@ -19,7 +19,7 @@ use tracing::{debug, info, warn};
 use crate::auth::validate_token;
 use crate::logging::TraceContext;
 use crate::server::ServiceContainer;
-use crate::services::{resolve_window_key, PinSource};
+use crate::services::{resolve_window_key, PinSource, SessionRootsRegistry};
 
 /// Synthetic client identity used when system-wide inbound auth is disabled and
 /// a connection arrives without a (valid) Bearer token. Routing still prefers
@@ -362,7 +362,13 @@ pub async fn mcp_oauth_middleware(
     }
 
     if let Some(sid) = session_id_header.as_deref() {
-        resolve_window_pin(&services, sid, empty_workspace_header, &trace_id);
+        resolve_window_pin(
+            &services,
+            sid,
+            empty_workspace_header,
+            workspace_set_header.as_deref(),
+            &trace_id,
+        );
     }
 
     // Captured before `request` is consumed below — needed to recognize the
@@ -433,7 +439,13 @@ pub async fn mcp_oauth_middleware(
                 .session_roots
                 .set_pinned(sid, ws, PinSource::WorkspaceHeader);
         }
-        resolve_window_pin(&services, sid, empty_workspace_header, &trace_id);
+        resolve_window_pin(
+            &services,
+            sid,
+            empty_workspace_header,
+            workspace_set_header.as_deref(),
+            &trace_id,
+        );
     }
 
     // Log errors only — except two rmcp spec-correct shapes that are not
@@ -484,13 +496,18 @@ fn attach_window_identity(services: &ServiceContainer, session_id: &str, peer: O
 /// An empty header is a failed substitution, not "reuse the last pin." Drop
 /// the session claim and skip window inherit so a sibling window on the
 /// shared `mcp-session-id` cannot keep resolving through the previous root.
+/// A one-member set on *this* request is a stronger claim than the empty
+/// active-folder header and must keep the SingleCandidate pin.
 fn resolve_window_pin(
     services: &ServiceContainer,
     session_id: &str,
     empty_workspace_header: bool,
+    workspace_set_header: Option<&str>,
     trace_id: &str,
 ) {
-    if empty_workspace_header {
+    let same_request_single_set = workspace_set_header
+        .is_some_and(SessionRootsRegistry::set_header_is_single_folder);
+    if empty_workspace_header && !same_request_single_set {
         services.session_roots.forget_empty_header_claim(session_id);
         warn!(
             trace_id = %trace_id,
@@ -509,13 +526,7 @@ fn resolve_window_pin(
         services.session_roots.promote_pin_to_window(session_id);
         return;
     }
-    if services
-        .session_roots
-        .inherit_window_pin(session_id)
-        .is_some()
-    {
-        return;
-    }
+    services.session_roots.inherit_window_pin(session_id);
 }
 
 /// Generate unauthorized response with RFC 9728 protected-resource discovery.

crates/mcpmux-gateway/src/services/meta_tools/bind_workspace.rs

@@ -52,6 +52,7 @@ struct BindToolResultInput<'a> {
     session_id: Option<&'a str>,
     client_id: &'a str,
     request_machine_id: Option<Uuid>,
+    explicit_workspace_root: Option<&'a str>,
     binding_id: Uuid,
     workspace_root: &'a str,
     feature_set_id: Uuid,
@@ -60,17 +61,25 @@ struct BindToolResultInput<'a> {
     machine_id: Option<Uuid>,
 }
 
+/// Build the bind JSON body, scoring `active` against the hook root when present.
 async fn bind_tool_result(input: BindToolResultInput<'_>) -> Result<CallToolResult, MetaToolError> {
     let fs_id_str = input.feature_set_id.to_string();
-    let resolved = input
-        .resolver
-        .resolve(
-            input.session_id,
-            Some(input.client_id),
-            input.request_machine_id,
-        )
-        .await
-        .map_err(|e| MetaToolError::Internal(e.to_string()))?;
+    let resolved = if let Some(root) = input.explicit_workspace_root {
+        input
+            .resolver
+            .resolve_for_workspace_root(root, Some(input.client_id), input.request_machine_id)
+            .await
+    } else {
+        input
+            .resolver
+            .resolve(
+                input.session_id,
+                Some(input.client_id),
+                input.request_machine_id,
+            )
+            .await
+    }
+    .map_err(|e| MetaToolError::Internal(e.to_string()))?;
     let active = resolved.feature_set_ids.iter().any(|id| id == &fs_id_str);
 
     let mut body = json!({
@@ -230,12 +239,13 @@ impl MetaTool for BindCurrentWorkspaceTool {
                     session_id: call.session_id,
                     client_id: call.client_id,
                     request_machine_id: call.request_machine_id,
+                    explicit_workspace_root: call.explicit_workspace_root.as_deref(),
                     binding_id: existing.id,
                     workspace_root: &normalized,
                     feature_set_id: fs_id,
-                    feature_set_ids: existing.feature_set_ids,
                     already_bound: true,
                     machine_id,
+                    feature_set_ids: existing.feature_set_ids,
                 })
                 .await;
             }
@@ -257,6 +267,7 @@ impl MetaTool for BindCurrentWorkspaceTool {
         let session_id_owned = call.session_id.map(str::to_owned);
         let caller_client_id_for_response = caller_client_id.clone();
         let request_machine_id = call.request_machine_id;
+        let explicit_root = call.explicit_workspace_root.clone();
         info!(
             session_id = ?call.session_id,
             client_id = %call.client_id,
@@ -359,6 +370,7 @@ impl MetaTool for BindCurrentWorkspaceTool {
                     session_id: session_id_owned.as_deref(),
                     client_id: &caller_client_id_for_response,
                     request_machine_id,
+                    explicit_workspace_root: explicit_root.as_deref(),
                     binding_id,
                     workspace_root: &normalized,
                     feature_set_id: fs_id,

crates/mcpmux-gateway/src/services/session_roots.rs

@@ -588,6 +588,15 @@ impl SessionRootsRegistry {
         self.store_candidates(session_id, parse_candidate_set(raw_set));
     }
 
+    /// Whether this request's `X-Mcpmux-Workspace-Set` names exactly one folder.
+    ///
+    /// Unexpanded `${...}` values and blanks are dropped first, same as
+    /// [`Self::set_candidates`]. A one-member set is unambiguous and may keep
+    /// a pin even when the active-folder header arrived empty.
+    pub fn set_header_is_single_folder(raw_set: &str) -> bool {
+        parse_candidate_set(raw_set).len() == 1
+    }
+
     fn store_candidates(&self, session_id: &str, parsed: Vec<String>) {
         if parsed.is_empty() {
             return;
@@ -1238,6 +1247,23 @@ mod tests {
         );
     }
 
+    #[test]
+    fn empty_header_plus_one_folder_set_keeps_pin_across_repeat_requests() {
+        let reg = SessionRootsRegistry::default();
+        for _ in 0..3 {
+            reg.set_candidates("sess", CANDIDATES[0]);
+            if !SessionRootsRegistry::set_header_is_single_folder(CANDIDATES[0]) {
+                reg.forget_empty_header_claim("sess");
+            }
+        }
+        assert_eq!(
+            reg.session_pin("sess").as_deref(),
+            Some(CANDIDATES[0]),
+            "empty ${{workspaceFolder}} must not wipe a same-request one-folder set"
+        );
+        assert_eq!(reg.get("sess"), Some(vec![CANDIDATES[0].to_string()]));
+    }
+
     /// Regression test for the field-confirmed cross-window leak (see
     /// `docs/planning/window-scoped-workspace-pin.md`, "second incident"):
     /// Cursor's global bridge shares one `mcp-remote` process, and therefore

scripts/cursor-env-probe.mjs

@@ -82,14 +82,22 @@ export function redactArg(arg) {
 }
 
 /**
- * Whether an environment variable name looks like a secret.
+ * Whether this env key is part of the substitution study (log the value).
+ * Everything else is treated as a secret.
+ * @param {string} key
+ * @returns {boolean}
+ */
+export function isLoggedEnvKey(key) {
+  return /^(WORKSPACE_FOLDER_PATHS|PWD|VSCODE_PID|CURSOR_.*)$/i.test(key);
+}
+
+/**
+ * Whether an environment variable should be redacted in the probe log.
  * @param {string} key
  * @returns {boolean}
  */
 export function isSecretEnvKey(key) {
-  return /token|secret|password|passwd|api[_-]?key|authorization|credential|bearer|mcpk/i.test(
-    key
-  );
+  return !isLoggedEnvKey(key);
 }
 
 /**

tests/ts/scripts/cursor-env-probe.test.ts

@@ -29,18 +29,35 @@ describe('cursor-env-probe', () => {
       'Authorization:Bearer <redacted>'
     );
     expect(isSecretEnvKey('GITHUB_TOKEN')).toBe(true);
+    expect(isSecretEnvKey('OPENAI_KEY')).toBe(true);
+    expect(isSecretEnvKey('AWS_ACCESS_KEY_ID')).toBe(true);
+    expect(isSecretEnvKey('GITHUB_PAT')).toBe(true);
+    expect(isSecretEnvKey('DATABASE_URL')).toBe(true);
+    expect(isSecretEnvKey('PATH')).toBe(true);
     expect(isSecretEnvKey('CURSOR_TRACE_ID')).toBe(false);
+    expect(isSecretEnvKey('WORKSPACE_FOLDER_PATHS')).toBe(false);
+    expect(isSecretEnvKey('VSCODE_PID')).toBe(false);
 
     const record = formatProbeRecord(
       ['npx', '-y', 'mcp-remote', '--header', 'Authorization:Bearer mcpk_abc'],
-      { PATH: '/usr/bin', OPENAI_API_KEY: 'sk-test', CURSOR_TRACE_ID: 't1' },
+      {
+        PATH: '/usr/bin',
+        OPENAI_KEY: 'sk-test',
+        AWS_ACCESS_KEY_ID: 'AKIATEST',
+        CURSOR_TRACE_ID: 't1',
+        WORKSPACE_FOLDER_PATHS: '/repos/alpha',
+      },
       '/tmp',
       new Date('2026-08-21T00:00:00.000Z')
     );
     expect(record).toContain('Authorization:Bearer <redacted>');
     expect(record).not.toContain('mcpk_abc');
-    expect(record).toContain('OPENAI_API_KEY=<redacted>');
+    expect(record).toContain('OPENAI_KEY=<redacted>');
+    expect(record).toContain('AWS_ACCESS_KEY_ID=<redacted>');
+    expect(record).toContain('PATH=<redacted>');
     expect(record).not.toContain('sk-test');
+    expect(record).not.toContain('AKIATEST');
     expect(record).toContain('CURSOR_TRACE_ID=t1');
+    expect(record).toContain('WORKSPACE_FOLDER_PATHS=/repos/alpha');
   });
 });