feat(gateway): hard-scope meta-tools + lock mapping popup to base-dir Space

When a session's reported root is under a Space's base directory, the
self-optimize meta-tools see ONLY that Space, and the mapping popup locks its
Space field to it.

- Resolver: new pub scoped_space_for_session(session_id).
- meta-tools: mcpmux_list_spaces returns only the scoped Space; target_space_id
  resolves to it and rejects an explicit space_id that names a different Space.
- WorkspaceNeedsBinding gains space_locked; handler sets it; the sheet disables
  the Space picker (user only picks the FeatureSet).
- Tests: resolver scoped_space_for_session; TS sheet picker lock/unlock.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/gateway.rs

@@ -696,13 +696,15 @@ fn map_domain_event_to_ui(event: &DomainEvent) -> (&'static str, serde_json::Val
             session_id,
             space_id,
             workspace_root,
+            space_locked,
         } => (
             "workspace-needs-binding",
             serde_json::json!({
                 "client_id": client_id,
                 "session_id": session_id,
                 "space_id": space_id,
                 "workspace_root": workspace_root,
+                "space_locked": space_locked,
             }),
         ),
 

apps/desktop/src/features/workspaces/WorkspaceBindingSheet.tsx

@@ -36,6 +36,9 @@ interface WorkspaceNeedsBindingPayload {
   session_id: string;
   space_id: string;
   workspace_root: string;
+  /** The folder is scoped to `space_id` by a Space base directory — lock the
+   * Space field to it (the user only picks the feature set). */
+  space_locked?: boolean;
 }
 
 /**
@@ -250,14 +253,16 @@ export function WorkspaceBindingSheet() {
               Space
             </div>
             <p className="mb-3 text-xs text-[rgb(var(--muted))]">
-              A profile that groups MCP servers — pick the one this folder draws
-              its tools from.
+              {payload.space_locked
+                ? 'This folder is under a base directory of this space, so it stays in this space — just pick the feature set below.'
+                : 'A profile that groups MCP servers — pick the one this folder draws its tools from.'}
             </p>
             <div className="relative">
               <select
                 value={selectedSpaceId}
                 onChange={(e) => setSelectedSpaceId(e.target.value)}
-                className="w-full appearance-none rounded-xl border border-[rgb(var(--border))] bg-[rgb(var(--background))] px-4 py-3 pr-10 text-sm font-medium text-[rgb(var(--foreground))] hover:border-[rgb(var(--border-hover,var(--accent)))] focus:border-[rgb(var(--accent))] focus:outline-none transition-colors"
+                disabled={payload.space_locked}
+                className="w-full appearance-none rounded-xl border border-[rgb(var(--border))] bg-[rgb(var(--background))] px-4 py-3 pr-10 text-sm font-medium text-[rgb(var(--foreground))] transition-colors hover:border-[rgb(var(--border-hover,var(--accent)))] focus:border-[rgb(var(--accent))] focus:outline-none disabled:cursor-not-allowed disabled:opacity-60"
                 data-testid="workspace-binding-space-picker"
               >
                 {spaces.map((s) => (

crates/mcpmux-core/src/domain/event.rs

@@ -365,6 +365,11 @@ pub enum DomainEvent {
         session_id: String,
         space_id: Uuid,
         workspace_root: String,
+        /// The folder is scoped to `space_id` by a Space base directory, so the
+        /// mapping popup locks its Space field to it (the user only picks the
+        /// FeatureSet). `false` for an ordinary unmapped folder, where the user
+        /// may bind it to any Space.
+        space_locked: bool,
     },
 
     /// The live set of reported session roots changed (a client connected
@@ -719,6 +724,7 @@ mod tests {
             session_id: "sess-1".to_string(),
             space_id: Uuid::new_v4(),
             workspace_root: "/proj/foo".to_string(),
+            space_locked: false,
         };
         assert!(!e.affects_mcp_capabilities());
         assert!(e.is_ui_only());
@@ -744,6 +750,7 @@ mod tests {
             session_id: "s".into(),
             space_id: Uuid::nil(),
             workspace_root: "/r".into(),
+            space_locked: true,
         };
         let json = serde_json::to_string(&needs).unwrap();
         assert!(json.contains("\"type\":\"workspace_needs_binding\""));

crates/mcpmux-gateway/src/mcp/handler.rs

@@ -150,12 +150,21 @@ impl McpMuxGatewayHandler {
                     resolved.space_id,
                     root_for_prompt,
                 ) {
+                    // Lock the popup's Space field when the folder is scoped to
+                    // a Space by base directory — the user shouldn't be able to
+                    // bind it elsewhere.
+                    let space_locked = resolver
+                        .scoped_space_for_session(Some(sid))
+                        .await
+                        .unwrap_or(None)
+                        .is_some();
                     services.gateway_state.read().await.emit_domain_event(
                         mcpmux_core::DomainEvent::WorkspaceNeedsBinding {
                             client_id: client_id.to_string(),
                             session_id: sid.to_string(),
                             space_id,
                             workspace_root: root.to_string(),
+                            space_locked,
                         },
                     );
                 }

crates/mcpmux-gateway/src/services/feature_set_resolver.rs

@@ -210,6 +210,20 @@ impl FeatureSetResolverService {
         Ok(None)
     }
 
+    /// The Space a session is scoped to by base directory — its reported root
+    /// sits under that Space's base dir — or `None` when it isn't base-dir
+    /// scoped (no session, no roots, or no matching base dir). The meta-tools
+    /// use this to hard-restrict self-optimization to the matched Space.
+    pub async fn scoped_space_for_session(&self, session_id: Option<&str>) -> Result<Option<Uuid>> {
+        let Some(sid) = session_id else {
+            return Ok(None);
+        };
+        let Some(roots) = self.session_roots.get(sid) else {
+            return Ok(None);
+        };
+        self.space_for_roots(&roots).await
+    }
+
     /// Override the pending-roots grace window. `Duration::ZERO` makes the
     /// resolver skip the wait entirely and fall back to the Space default on
     /// the first pending resolution — used by tests to exercise the

crates/mcpmux-gateway/src/services/meta_tools/tools.rs

@@ -70,6 +70,30 @@ async fn caller_space_id(call: &MetaToolCall<'_>) -> Result<Uuid, MetaToolError>
 /// `mcpmux_list_spaces` — writes stay gated by the approval dialog, which names
 /// the target Space so cross-Space changes are a conscious user choice.
 async fn target_space_id(call: &MetaToolCall<'_>) -> Result<Uuid, MetaToolError> {
+    // When the caller's workspace is scoped to a Space by base directory, that
+    // Space is authoritative: the meta-tools see ONLY it (no cross-Space
+    // targeting). An explicit `space_id` that names a different Space is
+    // rejected; omitting it (or naming the scoped Space) resolves to it.
+    if let Some(scoped) = call
+        .ctx
+        .resolver
+        .scoped_space_for_session(call.session_id)
+        .await?
+    {
+        if let Some(s) = opt_str_arg(&call.args, "space_id") {
+            let id = Uuid::parse_str(&s).map_err(|_| {
+                MetaToolError::InvalidArgument(format!("`space_id` is not a UUID: {s}"))
+            })?;
+            if id != scoped {
+                return Err(MetaToolError::InvalidArgument(format!(
+                    "This workspace is scoped to space '{scoped}' by its base directory; \
+                     it can't target another space ('{id}')."
+                )));
+            }
+        }
+        return Ok(scoped);
+    }
+
     match opt_str_arg(&call.args, "space_id") {
         Some(s) => {
             let id = Uuid::parse_str(&s).map_err(|_| {
@@ -290,7 +314,18 @@ impl MetaTool for ListSpacesTool {
     }
 
     async fn call(&self, call: MetaToolCall<'_>) -> Result<CallToolResult, MetaToolError> {
-        let spaces = call.ctx.space_repo.list().await?;
+        let mut spaces = call.ctx.space_repo.list().await?;
+        // When the caller's workspace is scoped to a Space by base directory,
+        // expose ONLY that Space — self-optimization must not reach across into
+        // other Spaces' tools.
+        if let Some(scoped) = call
+            .ctx
+            .resolver
+            .scoped_space_for_session(call.session_id)
+            .await?
+        {
+            spaces.retain(|s| s.id == scoped);
+        }
         let spaces: Vec<_> = spaces
             .iter()
             .map(|s| {

tests/rust/tests/integration/feature_set_resolver.rs

@@ -417,6 +417,44 @@ async fn exact_binding_overrides_base_dir_scope() {
     assert_eq!(r.feature_set_ids, vec![f.fs_a_id.clone()]);
 }
 
+#[tokio::test]
+async fn scoped_space_for_session_reports_base_dir_match() {
+    let f = Fixture::new().await;
+    let (base, root, outside) = if cfg!(windows) {
+        ("d:\\work", "d:\\work\\proj", "d:\\elsewhere")
+    } else {
+        ("/work", "/work/proj", "/elsewhere")
+    };
+    let (work_space, _) = f.make_space_with_base_dir("Work", base).await;
+
+    // A session whose root is under a base dir IS scoped (the meta-tools use
+    // this to restrict to that one Space).
+    f.session_roots.set("s", [root]);
+    assert_eq!(
+        f.resolver
+            .scoped_space_for_session(Some("s"))
+            .await
+            .unwrap(),
+        Some(work_space)
+    );
+
+    // A root outside every base dir is NOT scoped.
+    f.session_roots.set("s2", [outside]);
+    assert_eq!(
+        f.resolver
+            .scoped_space_for_session(Some("s2"))
+            .await
+            .unwrap(),
+        None
+    );
+
+    // No session / no roots → not scoped.
+    assert_eq!(
+        f.resolver.scoped_space_for_session(None).await.unwrap(),
+        None
+    );
+}
+
 // ---------------------------------------------------------------------------
 // ClientGrant tier — rootless fallback
 // ---------------------------------------------------------------------------

tests/rust/tests/integration/workspace_binding_events.rs

@@ -209,6 +209,7 @@ fn event_json_payloads_are_stable() {
         session_id: "s-9".to_string(),
         space_id: Uuid::parse_str("00000000-0000-0000-0000-000000000001").unwrap(),
         workspace_root: "/abs/path".to_string(),
+        space_locked: false,
     };
     let v: serde_json::Value = serde_json::to_value(&needs).unwrap();
     assert_eq!(v["type"], "workspace_needs_binding");

tests/ts/components/WorkspaceBindingPrompt.test.tsx

@@ -35,12 +35,18 @@ import { WorkspaceBindingSheet } from '@/features/workspaces/WorkspaceBindingShe
 const TITLE = /This folder is using your Starter set/i;
 
 /** Invoke the captured `workspace-needs-binding` listener with a payload. */
-function fireNeedsBinding() {
+function fireNeedsBinding(overrides: Record<string, unknown> = {}) {
   const call = vi.mocked(listen).mock.calls.find((c) => c[0] === 'workspace-needs-binding');
   if (!call) throw new Error('workspace-needs-binding listener was not registered');
   const cb = call[1] as (e: { payload: unknown }) => unknown | Promise<unknown>;
   return cb({
-    payload: { client_id: 'c', session_id: 's', space_id: 's1', workspace_root: '/home/u/proj' },
+    payload: {
+      client_id: 'c',
+      session_id: 's',
+      space_id: 's1',
+      workspace_root: '/home/u/proj',
+      ...overrides,
+    },
   });
 }
 
@@ -86,4 +92,24 @@ describe('WorkspaceBindingSheet – mapping prompt toggle', () => {
     );
     await waitFor(() => expect(screen.queryByText(TITLE)).toBeNull());
   });
+
+  it('locks the Space picker when the folder is base-dir scoped', async () => {
+    mockPromptEnabled(true);
+    render(<WorkspaceBindingSheet />);
+    await fireNeedsBinding({ space_locked: true });
+    await screen.findByText(TITLE);
+
+    const picker = screen.getByTestId('workspace-binding-space-picker') as HTMLSelectElement;
+    expect(picker.disabled).toBe(true);
+  });
+
+  it('leaves the Space picker editable for an ordinary unmapped folder', async () => {
+    mockPromptEnabled(true);
+    render(<WorkspaceBindingSheet />);
+    await fireNeedsBinding({ space_locked: false });
+    await screen.findByText(TITLE);
+
+    const picker = screen.getByTestId('workspace-binding-space-picker') as HTMLSelectElement;
+    expect(picker.disabled).toBe(false);
+  });
 });