feat(meta-tools): persisted "require approval" switch

Replaces the removed debug auto-approve with a real, production control: a
global "Require approval for tool changes" switch (default ON). OFF
auto-approves every `mcpmux_*` write without a dialog — the explicit "trust
this local machine" choice the debug toggle only pretended to offer.

- ApprovalBroker gains `require_approval` (default true) + set/get;
  `request_approval` short-circuits to AllowOnce when OFF, ahead of the
  always-allow / rate-limit / dialog path.
- Persisted in app settings (`meta_tools.require_approval`) and restored onto
  the broker on every gateway start via `attach_approval_publisher` — the one
  chokepoint both start paths funnel through — so the broker (recreated per
  start) always reflects the saved choice.
- New Tauri commands `get/set_meta_tools_require_approval` persist the setting
  and apply it to the live broker immediately.
- UI: repurpose the "Meta-tool auto-approvals" card → "Tool-management
  approvals", hosting the master switch (amber warning when off) above the
  session "always allow" grants list.
- Test: broker auto-approves when off (even headless) and re-prompts when on.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/gateway.rs

@@ -144,6 +144,26 @@ pub(crate) async fn attach_approval_publisher<R: tauri::Runtime>(
     approval_broker: &Arc<mcpmux_gateway::services::ApprovalBroker>,
     app_handle: tauri::AppHandle<R>,
 ) {
+    // Restore the persisted "require approval" switch onto the broker (which is
+    // recreated on every gateway start). Default ON when unset. This is the
+    // single chokepoint both start paths (auto-start + start_gateway command)
+    // funnel through, so the setting always survives a restart.
+    {
+        use tauri::Manager;
+        let required = match app_handle.try_state::<AppState>() {
+            Some(app_state) => app_state
+                .settings_repository
+                .get("meta_tools.require_approval")
+                .await
+                .ok()
+                .flatten()
+                .map(|v| v != "false")
+                .unwrap_or(true),
+            None => true,
+        };
+        approval_broker.set_require_approval(required);
+    }
+
     let publisher: mcpmux_gateway::services::meta_tools::ApprovalPublisher = Arc::new(move |req| {
         let app_handle = app_handle.clone();
         Box::pin(async move {

apps/desktop/src-tauri/src/commands/meta_tool_approval.rs

@@ -16,6 +16,12 @@ use tokio::sync::RwLock;
 use tracing::{info, warn};
 
 use crate::commands::gateway::GatewayAppState;
+use crate::AppState;
+
+/// App-settings key for the global "require approval for tool-management
+/// writes" switch. Persisted (survives restart); the gateway restores it onto
+/// the in-memory broker on every start.
+const REQUIRE_APPROVAL_KEY: &str = "meta_tools.require_approval";
 
 #[derive(Debug, Serialize)]
 pub struct MetaToolGrantEntry {
@@ -109,3 +115,48 @@ pub async fn revoke_meta_tool_grant(
     };
     Ok(broker.revoke_always_allow(&client_id, &tool_name))
 }
+
+/// Whether write meta-tools currently require approval (default `true`).
+/// Reads the persisted setting so the UI shows the right state even before
+/// the gateway has started.
+#[tauri::command]
+pub async fn get_meta_tools_require_approval(
+    app_state: State<'_, AppState>,
+) -> Result<bool, String> {
+    let stored = app_state
+        .settings_repository
+        .get(REQUIRE_APPROVAL_KEY)
+        .await
+        .map_err(|e| e.to_string())?;
+    // Default ON: a missing setting means "require approval".
+    Ok(stored.map(|v| v != "false").unwrap_or(true))
+}
+
+/// Set the global "require approval for tool-management writes" switch.
+///
+/// `required = false` makes every `mcpmux_*` write auto-approve without a
+/// dialog — the user's explicit "trust this machine" choice. Persisted to app
+/// settings AND applied to the live broker (if the gateway is running) so it
+/// takes effect immediately and survives restart.
+#[tauri::command]
+pub async fn set_meta_tools_require_approval(
+    required: bool,
+    app_state: State<'_, AppState>,
+    gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
+) -> Result<bool, String> {
+    app_state
+        .settings_repository
+        .set(REQUIRE_APPROVAL_KEY, &required.to_string())
+        .await
+        .map_err(|e| e.to_string())?;
+
+    let broker = {
+        let state = gateway_state.read().await;
+        state.approval_broker.clone()
+    };
+    if let Some(broker) = broker {
+        broker.set_require_approval(required);
+    }
+    warn!(required, "[meta-tool] require-approval switch updated");
+    Ok(required)
+}

apps/desktop/src-tauri/src/lib.rs

@@ -910,6 +910,8 @@ pub fn run() {
             commands::respond_to_meta_tool_approval,
             commands::list_meta_tool_grants,
             commands::revoke_meta_tool_grant,
+            commands::get_meta_tools_require_approval,
+            commands::set_meta_tools_require_approval,
             // Built-in servers (per-Space enablement + per-tool toggles)
             commands::list_builtin_servers,
             commands::set_builtin_server_enabled,

apps/desktop/src/features/metaTools/MetaToolGrantsPanel.tsx

@@ -1,26 +1,30 @@
 import { useCallback, useEffect, useState } from 'react';
-import { KeyRound, Loader2, Trash2 } from 'lucide-react';
-import { Button, Card, CardContent, CardHeader, CardTitle } from '@mcpmux/ui';
+import { AlertTriangle, KeyRound, Loader2, ShieldCheck, Trash2 } from 'lucide-react';
+import { Button, Card, CardContent, CardHeader, CardTitle, Switch } from '@mcpmux/ui';
 import {
+  getMetaToolsRequireApproval,
   listMetaToolGrants,
   revokeMetaToolGrant,
+  setMetaToolsRequireApproval,
   type MetaToolGrantEntry,
 } from '@/lib/api/metaTools';
 
 /**
- * Session-scoped "always allow (client, tool)" grants. These live in the
- * gateway's in-memory `ApprovalBroker` and are wiped on gateway restart —
- * so showing the list is both for awareness AND for a panic-revoke button
- * when a user regrets ticking "Always for this session".
+ * Approvals for the `mcpmux_*` self-management writes:
+ *   1. The master "Require approval" switch — persisted; OFF auto-approves
+ *      every write on this (trusted, local) machine.
+ *   2. The session-scoped "always allow (client, tool)" grants, which live in
+ *      the gateway's in-memory broker and wipe on restart — shown for
+ *      awareness with a panic-revoke button.
  *
- * Drop this anywhere. It refetches on mount and polls every 10s because the
- * underlying broker state can change from either side (dialog clicks or
- * calls to `revokeMetaToolGrant`).
+ * Refetches on mount and polls every 10s because the broker state can change
+ * from either side (dialog clicks or calls to `revokeMetaToolGrant`).
  */
 export function MetaToolGrantsPanel() {
   const [grants, setGrants] = useState<MetaToolGrantEntry[] | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [revoking, setRevoking] = useState<string | null>(null);
+  const [requireApproval, setRequireApproval] = useState<boolean | null>(null);
 
   const load = useCallback(async () => {
     try {
@@ -38,6 +42,23 @@ export function MetaToolGrantsPanel() {
     return () => clearInterval(i);
   }, [load]);
 
+  useEffect(() => {
+    getMetaToolsRequireApproval()
+      .then(setRequireApproval)
+      .catch(() => setRequireApproval(true));
+  }, []);
+
+  const handleToggleRequireApproval = async (required: boolean) => {
+    const prev = requireApproval;
+    setRequireApproval(required);
+    try {
+      await setMetaToolsRequireApproval(required);
+    } catch (e) {
+      setRequireApproval(prev);
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  };
+
   const handleRevoke = async (g: MetaToolGrantEntry) => {
     const key = `${g.client_id}:${g.tool_name}`;
     setRevoking(key);
@@ -55,17 +76,63 @@ export function MetaToolGrantsPanel() {
     <Card data-testid="meta-tool-grants-panel">
       <CardHeader>
         <CardTitle className="flex items-center gap-2 text-base">
-          <KeyRound className="h-4 w-4" />
-          Meta-tool auto-approvals
+          <ShieldCheck className="h-4 w-4" />
+          Tool-management approvals
         </CardTitle>
         <p className="mt-1 text-xs text-[rgb(var(--muted))]">
-          &quot;Always for this session&quot; approvals granted to clients for specific{' '}
-          <code className="font-mono">mcpmux_*</code> tools. Wipes on gateway restart.
+          Control approval for the <code className="font-mono">mcpmux_*</code> writes a connected
+          AI can make (create/update/delete feature sets, bind a workspace).
         </p>
       </CardHeader>
       <CardContent>
         {error && <div className="mb-2 text-sm text-red-600 dark:text-red-400">{error}</div>}
 
+        {/* Master switch — persisted across restarts. OFF auto-approves every
+            write on this machine. */}
+        <div
+          className={`mb-4 flex items-start justify-between gap-3 rounded-lg border p-3 ${
+            requireApproval === false
+              ? 'border-amber-300/60 bg-amber-50 dark:border-amber-700/50 dark:bg-amber-900/20'
+              : 'border-[rgb(var(--border-subtle))] bg-[rgb(var(--surface))]'
+          }`}
+          data-testid="meta-tool-require-approval"
+        >
+          <div className="flex min-w-0 gap-2">
+            {requireApproval === false ? (
+              <AlertTriangle className="mt-0.5 h-4 w-4 flex-shrink-0 text-amber-600 dark:text-amber-400" />
+            ) : (
+              <ShieldCheck className="mt-0.5 h-4 w-4 flex-shrink-0 text-emerald-600 dark:text-emerald-400" />
+            )}
+            <div className="min-w-0">
+              <div className="text-sm font-medium">Require approval for tool changes</div>
+              <p className="mt-0.5 text-xs text-[rgb(var(--muted))]">
+                {requireApproval === false ? (
+                  <span className="text-amber-800 dark:text-amber-300">
+                    Off — every <code className="font-mono">mcpmux_*</code> write is applied without
+                    asking. Only leave this off on a machine where you trust every connected client.
+                  </span>
+                ) : (
+                  <>
+                    On — each <code className="font-mono">mcpmux_*</code> write prompts you to Allow
+                    or Deny. Turn off to auto-approve on a trusted machine.
+                  </>
+                )}
+              </p>
+            </div>
+          </div>
+          <Switch
+            checked={requireApproval ?? true}
+            disabled={requireApproval === null}
+            onCheckedChange={(v) => void handleToggleRequireApproval(v)}
+            data-testid="meta-tool-require-approval-toggle"
+          />
+        </div>
+
+        <div className="mb-2 flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wide text-[rgb(var(--muted))]">
+          <KeyRound className="h-3 w-3" />
+          Session &quot;always allow&quot; grants
+        </div>
+
         {grants === null ? (
           <div className="flex items-center gap-2 text-sm text-[rgb(var(--muted))]">
             <Loader2 className="h-4 w-4 animate-spin" /> Loading…

apps/desktop/src/lib/api/metaTools.ts

@@ -29,6 +29,22 @@ export async function revokeMetaToolGrant(clientId: string, toolName: string): P
   return invoke('revoke_meta_tool_grant', { clientId, toolName });
 }
 
+/** Whether write meta tools require approval (default true). Persisted. */
+export async function getMetaToolsRequireApproval(): Promise<boolean> {
+  return invoke('get_meta_tools_require_approval');
+}
+
+/**
+ * Set the global "require approval for tool-management writes" switch.
+ *
+ * `required = false` makes every `mcpmux_*` write auto-approve without a
+ * dialog — an explicit "trust this machine" choice. Persisted (survives
+ * restart) and applied to the running gateway immediately.
+ */
+export async function setMetaToolsRequireApproval(required: boolean): Promise<boolean> {
+  return invoke('set_meta_tools_require_approval', { required });
+}
+
 // The mcpmux_* enablement switch is now per-Space — see
 // `@/lib/api/builtinServers` (listBuiltinServers / setBuiltinServerEnabled /
 // setBuiltinToolEnabled). The old global get/set_meta_tools_enabled were removed.

crates/mcpmux-gateway/src/services/meta_tools/approval.rs

@@ -24,6 +24,7 @@
 //! client_metadata URL for DCR-registered clients like Claude Code). The
 //! broker doesn't parse it; equality + hashing is enough.
 
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -117,6 +118,13 @@ pub struct ApprovalBroker {
     /// Published to the desktop layer; `None` means headless.
     publisher: Mutex<Option<ApprovalPublisher>>,
     timeout: Duration,
+    /// Whether write meta-tools require human approval at all. Default `true`
+    /// (every write prompts). A user can turn this OFF in Settings to trust a
+    /// local machine — then writes are auto-approved without a dialog. The
+    /// authoritative value is **persisted** in app settings
+    /// (`meta_tools.require_approval`); this in-memory flag is restored from
+    /// there on every gateway start (the broker is recreated per start).
+    require_approval: AtomicBool,
 }
 
 impl Default for ApprovalBroker {
@@ -133,6 +141,7 @@ impl ApprovalBroker {
             rate_limit: DashMap::new(),
             publisher: Mutex::new(None),
             timeout: DEFAULT_TIMEOUT,
+            require_approval: AtomicBool::new(true),
         }
     }
 
@@ -141,6 +150,23 @@ impl ApprovalBroker {
         self
     }
 
+    /// Set whether write meta-tools require approval. `false` = auto-approve
+    /// every write (no dialog) — the user's explicit "trust this machine"
+    /// choice. Persisted by the caller; applied to the broker here.
+    pub fn set_require_approval(&self, required: bool) {
+        self.require_approval.store(required, Ordering::Relaxed);
+        if !required {
+            warn!(
+                "[ApprovalBroker] approval requirement DISABLED — meta-tool writes auto-approved"
+            );
+        }
+    }
+
+    /// Whether write meta-tools currently require approval (default `true`).
+    pub fn require_approval_enabled(&self) -> bool {
+        self.require_approval.load(Ordering::Relaxed)
+    }
+
     /// Attach the desktop subscriber. Call once at app startup.
     pub async fn set_publisher(&self, publisher: ApprovalPublisher) {
         *self.publisher.lock().await = Some(publisher);
@@ -202,6 +228,7 @@ impl ApprovalBroker {
     /// Core entry point for write meta tools.
     ///
     /// Order of checks:
+    ///   0. Approval requirement disabled (user opt-out) → `AllowOnce`.
     ///   1. Always-allow hit → immediate `AllowOnce` (no dialog).
     ///   2. Rate limit overflow → `RateLimited`.
     ///   3. No publisher attached → `ApprovalRequiredNoDesktop`.
@@ -212,6 +239,17 @@ impl ApprovalBroker {
         tool_name: &str,
         payload: ApprovalPayload,
     ) -> Result<ApprovalDecision, MetaToolError> {
+        // 0. Global "require approval" switch OFF — the user has opted to
+        //    auto-approve every write on this (trusted, local) machine.
+        if !self.require_approval.load(Ordering::Relaxed) {
+            debug!(
+                %client_id,
+                tool = tool_name,
+                "[ApprovalBroker] approval requirement disabled; approving without dialog",
+            );
+            return Ok(ApprovalDecision::AllowOnce);
+        }
+
         // 1. Always-allow short-circuit.
         if self
             .always_allow
@@ -344,6 +382,39 @@ mod tests {
         assert_eq!(d, ApprovalDecision::AllowOnce);
     }
 
+    #[tokio::test]
+    async fn require_approval_off_auto_approves_without_publisher() {
+        // Default is ON (require approval).
+        let broker = ApprovalBroker::new();
+        assert!(broker.require_approval_enabled());
+
+        // OFF → writes auto-approve even with no desktop attached (which would
+        // otherwise be ApprovalRequiredNoDesktop).
+        broker.set_require_approval(false);
+        assert!(!broker.require_approval_enabled());
+        let d = broker
+            .request_approval(
+                &Uuid::new_v4().to_string(),
+                "mcpmux_manage_feature_set",
+                make_payload(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(d, ApprovalDecision::AllowOnce);
+
+        // Back ON → no publisher → safe headless deny again.
+        broker.set_require_approval(true);
+        let err = broker
+            .request_approval(
+                &Uuid::new_v4().to_string(),
+                "mcpmux_manage_feature_set",
+                make_payload(),
+            )
+            .await
+            .unwrap_err();
+        assert!(matches!(err, MetaToolError::ApprovalRequiredNoDesktop));
+    }
+
     #[tokio::test]
     async fn url_client_id_works() {
         // Regression for the bug where DCR-registered clients (which use