fix(featureset): lock the Starter's name (members-only editable)

Per review: the Starter shouldn't be renamable — only which tools/features it
includes should be editable. It's the default fallback for unmapped folders,
so a stable identity matters.

- storage `update()` now preserves a builtin row's name/description/icon (the
  DB's own `is_builtin` governs, not the caller's struct) while still applying
  MEMBER changes. The member editor routes through `update()`, so editing the
  Starter's tools keeps working, but no caller can rename it. Custom sets are
  unaffected. New test: `test_update_locks_builtin_identity_but_allows_member_edits`.
- Copy updated everywhere from "edit, rename, or delete freely" to "edit which
  tools it includes; its name is fixed and it can't be deleted": domain module
  + FeatureSetType doc + new_starter description, the space_repository seed,
  migration 018's target text (+ its test constant), the FeatureSets card/panel,
  and featureSets.ts.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src/features/featuresets/FeatureSetPanel.tsx

@@ -58,10 +58,11 @@ export function FeatureSetPanel({ featureSet, spaceId, onClose, onDelete, onUpda
 
   // Both FS types are member-driven now.
   const isConfigurable = true;
-  // The auto-seeded "Starter" FS is fully editable like a Custom one (edit /
-  // rename / empty its members). The difference is routing + lifecycle: it's
-  // the default fallback for unmapped folders and can't be deleted — so the
-  // Delete action below is gated to Custom sets only.
+  // The auto-seeded "Starter" FS has editable membership like a Custom one
+  // (change which tools it includes, or empty it). What's locked is its
+  // identity + lifecycle: it's the default fallback for unmapped folders, so
+  // its name is fixed (the backend ignores name changes on builtin rows) and
+  // it can't be deleted — the Delete action below is gated to Custom sets.
   const isStarter = isStarterFeatureSet(featureSet);
   const isCustom = featureSet.feature_set_type === 'custom';
 
@@ -259,7 +260,7 @@ export function FeatureSetPanel({ featureSet, spaceId, onClose, onDelete, onUpda
                 <span
                   title={
                     isStarter
-                      ? "Auto-created with this Space. The default set for folders you haven't mapped — editable and renamable, but can't be deleted."
+                      ? "Auto-created with this Space. The default set for folders you haven't mapped — edit which tools it includes; its name is fixed and it can't be deleted."
                       : undefined
                   }
                   className={`text-[10px] px-1.5 py-0.5 rounded-full font-medium border ${
@@ -341,7 +342,7 @@ export function FeatureSetPanel({ featureSet, spaceId, onClose, onDelete, onUpda
                     <div className="flex gap-2">
                       <Star className="h-4 w-4 text-yellow-500 flex-shrink-0 mt-0.5" />
                       <div className="text-xs text-yellow-800 dark:text-yellow-200">
-                        <strong>Starter FeatureSet:</strong> auto-created with this Space and used as the <em>default</em> for folders you haven&apos;t explicitly mapped (and rootless sessions). Edit, rename, or empty it to change what they get — but it <strong>can&apos;t be deleted</strong>, since the fallback always needs a target.
+                        <strong>Starter FeatureSet:</strong> auto-created with this Space and used as the <em>default</em> for folders you haven&apos;t explicitly mapped (and rootless sessions). Edit which tools it includes (or empty it) to change what they get. Its name is fixed and it <strong>can&apos;t be deleted</strong>, since the fallback always needs a stable target.
                       </div>
                     </div>
                   </div>

apps/desktop/src/features/featuresets/FeatureSetsPage.tsx

@@ -375,7 +375,7 @@ export function FeatureSetsPage() {
                       {isStarter && (
                         <div
                           className="absolute right-3 top-3 flex items-center gap-1.5 rounded-full bg-gradient-to-r from-emerald-500 to-green-500 px-2.5 py-1 text-[10px] font-bold uppercase tracking-wider text-white shadow-[0_4px_12px_-2px_rgb(16_185_129/0.5)]"
-                          title="Auto-seeded with this Space. The default set for folders you haven't mapped — edit or rename it to change what they get. It can't be deleted."
+                          title="Auto-seeded with this Space. The default set for folders you haven't mapped — edit which tools it includes to change what they get. Its name is fixed and it can't be deleted."
                           data-testid={`featureset-starter-badge-${fs.id}`}
                         >
                           <CheckCircle2 className="h-3 w-3" />

apps/desktop/src/lib/api/featureSets.ts

@@ -9,10 +9,11 @@ import { invoke } from '@tauri-apps/api/core';
 /**
  * `starter` is the auto-seeded FS that comes with each Space. It's the
  * default fallback the resolver routes unmapped folders / rootless sessions
- * to, so it's builtin and can't be deleted (it can be edited, renamed, or
- * emptied). The legacy `'default'` value is accepted on read because
- * migration 013 rewrites stored rows lazily and a stale fetch could still
- * surface it; new writes use `'starter'`.
+ * to, so it's builtin: its members are editable (change which tools it
+ * includes, or empty it), but it can't be renamed or deleted. The legacy
+ * `'default'` value is accepted on read because migration 013 rewrites stored
+ * rows lazily and a stale fetch could still surface it; new writes use
+ * `'starter'`.
  */
 export type FeatureSetType = 'starter' | 'default' | 'custom';
 

crates/mcpmux-core/src/domain/feature_set.rs

@@ -3,11 +3,13 @@
 //! Each FeatureSet is scoped to a space and is one of two types:
 //! - **Starter**: auto-created with the Space. It's the **default fallback**
 //!   for folders that aren't explicitly mapped (and for rootless/unknown
-//!   sessions) — the resolver routes them here instead of denying. Editable
-//!   and renamable (empty it to grant nothing by default), but **builtin and
-//!   not deletable** since the fallback always needs a target. (Pre-resolver-v3
-//!   it was the "Default" type and also acted as the implicit fallback; that
-//!   role is back after a stint where it was a no-op seed.)
+//!   sessions) — the resolver routes them here instead of denying. Its
+//!   membership is editable (change which tools it includes, or empty it to
+//!   grant nothing by default), but its **identity is locked**: builtin, so
+//!   not renamable and not deletable since the fallback always needs a stable
+//!   target. (Pre-resolver-v3 it was the "Default" type and also acted as the
+//!   implicit fallback; that role is back after a stint where it was a no-op
+//!   seed.)
 //! - **Custom**: any other operator-defined FeatureSet.
 
 use chrono::{DateTime, Utc};
@@ -25,9 +27,10 @@ use uuid::Uuid;
 #[derive(Default)]
 pub enum FeatureSetType {
     /// Auto-created with the Space and used as the **default fallback** for
-    /// unmapped folders / rootless sessions. Editable and renamable, but
-    /// builtin — not deletable. Was historically called `Default` (DB column
-    /// value carried over via migration 013).
+    /// unmapped folders / rootless sessions. Its members are editable, but its
+    /// identity is locked: builtin — not renamable and not deletable. Was
+    /// historically called `Default` (DB column value carried over via
+    /// migration 013).
     Starter,
     /// Any operator-defined FeatureSet.
     #[default]
@@ -240,10 +243,10 @@ impl FeatureSet {
             id: format!("fs_default_{}", space_id),
             name: "Starter".to_string(),
             description: Some(
-                "Auto-created with this Space. Unmapped folders fall back to \
-                 this set — it's the default toolset for anything you haven't \
-                 explicitly mapped. Edit or rename it to change what they get; \
-                 it can't be deleted."
+                "Auto-created with this Space — the default set for folders \
+                 you haven't explicitly mapped. Edit which tools it includes \
+                 to change what they get. Its name is fixed and it can't be \
+                 deleted."
                     .to_string(),
             ),
             icon: Some("⭐".to_string()),

crates/mcpmux-storage/src/migrations/018_starter_is_default_fallback_copy.sql

@@ -12,7 +12,7 @@
 -- an operator who customized the copy keeps their change.
 
 UPDATE feature_sets
-   SET description = 'Auto-created with this Space. Unmapped folders fall back to this set — it''s the default toolset for anything you haven''t explicitly mapped. Edit or rename it to change what they get; it can''t be deleted.'
+   SET description = 'Auto-created with this Space — the default set for folders you haven''t explicitly mapped. Edit which tools it includes to change what they get. Its name is fixed and it can''t be deleted.'
  WHERE is_builtin = 1
    AND feature_set_type IN ('starter', 'default')
    AND description = 'Auto-created with this Space. Edit, rename, or delete freely — bindings and per-client grants pick FeatureSets explicitly, so this one has no special routing role.';

crates/mcpmux-storage/src/repositories/feature_set_repository.rs

@@ -230,9 +230,20 @@ impl FeatureSetRepository for SqliteFeatureSetRepository {
         let db = self.db.lock().await;
         let conn = db.connection();
 
+        // Builtin FeatureSets (the auto-seeded Starter) are the default
+        // fallback for unmapped folders, so their identity is fixed: name,
+        // description, and icon are preserved here regardless of the incoming
+        // values — only the MEMBERS (replaced below) and `updated_at` are
+        // editable. The DB's own `is_builtin` flag governs (not the caller's
+        // struct), so the lock holds for every caller, including the
+        // member-set command that routes through update(). Custom sets update
+        // normally.
         let rows_affected = conn.execute(
-            "UPDATE feature_sets 
-             SET name = ?2, description = ?3, icon = ?4, updated_at = ?5
+            "UPDATE feature_sets
+             SET name = CASE WHEN is_builtin = 1 THEN name ELSE ?2 END,
+                 description = CASE WHEN is_builtin = 1 THEN description ELSE ?3 END,
+                 icon = CASE WHEN is_builtin = 1 THEN icon ELSE ?4 END,
+                 updated_at = ?5
              WHERE id = ?1 AND is_deleted = 0",
             params![
                 feature_set.id,

crates/mcpmux-storage/src/repositories/space_repository.rs

@@ -111,10 +111,11 @@ impl SpaceRepository for SqliteSpaceRepository {
         // is preserved for FK-stability across the rename (migration 013).
         // The Starter is the default fallback for folders that aren't
         // explicitly mapped (and rootless/unknown sessions), so it's
-        // load-bearing and builtin (can't be deleted).
+        // load-bearing and builtin: members are editable, but it can't be
+        // renamed or deleted.
         conn.execute(
             "INSERT OR IGNORE INTO feature_sets (id, name, description, icon, space_id, feature_set_type, is_builtin, created_at, updated_at)
-             VALUES (?1, 'Starter', 'Auto-created with this Space. Unmapped folders fall back to this set — it''s the default toolset for anything you haven''t explicitly mapped. Edit or rename it to change what they get; it can''t be deleted.', '⭐', ?2, 'starter', 1, ?3, ?3)",
+             VALUES (?1, 'Starter', 'Auto-created with this Space — the default set for folders you haven''t explicitly mapped. Edit which tools it includes to change what they get. Its name is fixed and it can''t be deleted.', '⭐', ?2, 'starter', 1, ?3, ?3)",
             params![
                 format!("fs_default_{}", space_id),
                 space_id,

tests/rust/tests/database/feature_set.rs

@@ -3,7 +3,7 @@
 //! Tests for feature set CRUD, builtin types (All, Default, ServerAll),
 //! and feature member composition.
 
-use mcpmux_core::domain::{FeatureSetType, MemberMode};
+use mcpmux_core::domain::{FeatureSetMember, FeatureSetType, MemberMode};
 use mcpmux_core::repository::{FeatureSetRepository, SpaceRepository};
 use mcpmux_storage::{SqliteFeatureSetRepository, SqliteSpaceRepository};
 use std::sync::Arc;
@@ -112,6 +112,55 @@ async fn test_update_feature_set() {
     assert_eq!(loaded.description, Some("New description".to_string()));
 }
 
+/// The builtin Starter's identity is locked: `update()` must ignore name /
+/// description / icon changes on a builtin row (it's the default fallback, not
+/// renamable) while still applying MEMBER changes — that's how the member
+/// editor (which routes through `update()`) keeps working for the Starter.
+#[tokio::test]
+async fn test_update_locks_builtin_identity_but_allows_member_edits() {
+    let test_db = TestDatabase::new();
+    let db = Arc::new(Mutex::new(test_db.db));
+    let feature_repo = SqliteFeatureSetRepository::new(Arc::clone(&db));
+    let space_repo = SqliteSpaceRepository::new(db);
+
+    let space = fixtures::test_space("Test Space");
+    SpaceRepository::create(&space_repo, &space).await.unwrap();
+
+    // Auto-seed the builtin Starter for this Space.
+    FeatureSetRepository::ensure_builtin_for_space(&feature_repo, &space.id.to_string())
+        .await
+        .unwrap();
+    let mut starter =
+        FeatureSetRepository::get_starter_for_space(&feature_repo, &space.id.to_string())
+            .await
+            .unwrap()
+            .expect("starter seeded");
+    let original_name = starter.name.clone();
+    let original_desc = starter.description.clone();
+
+    // Attempt to rename + re-describe the builtin AND add a member at once.
+    starter.name = "Hacked Name".to_string();
+    starter.description = Some("hacked description".to_string());
+    starter.members = vec![FeatureSetMember::include_feature(&starter.id, "feat-x")];
+    FeatureSetRepository::update(&feature_repo, &starter)
+        .await
+        .expect("update should succeed");
+
+    let loaded = FeatureSetRepository::get_with_members(&feature_repo, &starter.id)
+        .await
+        .unwrap()
+        .unwrap();
+    // Identity preserved...
+    assert_eq!(loaded.name, original_name, "builtin name must not change");
+    assert_eq!(
+        loaded.description, original_desc,
+        "builtin description must not change"
+    );
+    // ...but the member edit went through.
+    assert_eq!(loaded.members.len(), 1, "members must stay editable");
+    assert_eq!(loaded.members[0].member_id, "feat-x");
+}
+
 #[tokio::test]
 async fn test_delete_feature_set() {
     let test_db = TestDatabase::new();

tests/rust/tests/database/migrations.rs

@@ -103,7 +103,7 @@ fn test_017_purges_orphaned_feature_set_members() {
 #[test]
 fn test_018_rewrites_stale_starter_description_only() {
     const STALE: &str = "Auto-created with this Space. Edit, rename, or delete freely — bindings and per-client grants pick FeatureSets explicitly, so this one has no special routing role.";
-    const FRESH: &str = "Auto-created with this Space. Unmapped folders fall back to this set — it's the default toolset for anything you haven't explicitly mapped. Edit or rename it to change what they get; it can't be deleted.";
+    const FRESH: &str = "Auto-created with this Space — the default set for folders you haven't explicitly mapped. Edit which tools it includes to change what they get. Its name is fixed and it can't be deleted.";
 
     let test_db = TestDatabase::new();
     let conn = test_db.db.connection();