test(e2e): cover list==call, debug auto-approve, empty mappings; fix stale helpers

E2E for the workspace-root routing work, plus repairs to e2e helpers that
had drifted out of sync with the Tauri command surface.

New coverage:
- streamable-http TC-SH-016: the reported bug end-to-end through /mcp — seed a
  feature with a dotted server_id + hyphenated name (mirrors
  com.notion-mcp-http_notion-get-users), grant it, then assert the EXACT name
  returned by tools/list is never rejected by tools/call with "not allowed by
  the current grants". Seeding keeps it green even if the backend handshake
  doesn't complete on CI.
- meta-tools TC-MT-003: the DEBUG "Auto-approve writes" switch round-trips
  through get/set_meta_tools_auto_approve and the UI toggle reflects it.
- workspaces TC-WS-010: a binding with zero FeatureSets is savable, persists,
  and still renders a card ("no Space tools").

Helper fixes (these were broken before — wdio runs ts-node transpile-only, so
missing exports only surfaced at runtime):
- Add getActiveSpace (aliases getDefaultSpace) — streamable-http / server-logs
  / deeplink-install / comprehensive all call it; it was never exported, so
  their before() hooks threw at runtime. comprehensive also missing the import.
- Add grantOAuthClientFeatureSet + get/setMetaToolsAutoApprove helpers.
- Drop the stale grantFeatureSetToClient import from the manual screenshot spec.
- WorkspaceBindingInput doc: feature_set_ids MAY be empty (was "non-empty").

Also correct the mcpmux_bind_current_workspace tool description: bindings are
EXACT-match, no subdirectory/ancestor inheritance (the old text still claimed
"the same root (or a subdirectory)").

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

crates/mcpmux-gateway/src/services/meta_tools/tools.rs

@@ -349,10 +349,11 @@ impl MetaTool for BindCurrentWorkspaceTool {
 
     fn description(&self) -> &'static str {
         "Persistently bind the caller's first reported workspace root to the \
-         given FeatureSet inside the caller's resolved Space. Every future \
-         connection that reports the same root (or a subdirectory) will \
-         resolve to this FeatureSet. Requires user approval and the calling \
-         client MUST have declared MCP roots."
+         given FeatureSet inside the caller's resolved Space. Only a future \
+         connection that reports this EXACT root resolves to this FeatureSet — \
+         bindings are exact-match, with no subdirectory/ancestor inheritance. \
+         Requires user approval and the calling client MUST have declared MCP \
+         roots."
     }
 
     fn input_schema(&self) -> Value {

tests/e2e/helpers/tauri-api.ts

@@ -61,6 +61,15 @@ export async function getDefaultSpace(): Promise<Space | null> {
   return spaces.find((s) => s.is_default) ?? null;
 }
 
+/**
+ * The Space tests operate against. In the e2e environment this is the default
+ * Space (the gateway's routing fallback), so it aliases {@link getDefaultSpace}.
+ * Kept as a distinct name because several specs read it as "the active Space".
+ */
+export async function getActiveSpace(): Promise<Space | null> {
+  return getDefaultSpace();
+}
+
 // ============================================================================
 // Client API
 // ============================================================================
@@ -195,6 +204,29 @@ export async function approveOAuthClient(clientId: string): Promise<void> {
   return invoke<void>('approve_oauth_client', { clientId });
 }
 
+/** Grant a feature set to an OAuth client in a space (rootless-client routing). */
+export async function grantOAuthClientFeatureSet(
+  clientId: string,
+  spaceId: string,
+  featureSetId: string
+): Promise<void> {
+  return invoke<void>('grant_oauth_client_feature_set', {
+    clientId,
+    spaceId,
+    featureSetId,
+  });
+}
+
+/** DEBUG: toggle auto-approval of every write meta tool (session-only). */
+export async function setMetaToolsAutoApprove(enabled: boolean): Promise<boolean> {
+  return invoke<boolean>('set_meta_tools_auto_approve', { enabled });
+}
+
+/** Read the current DEBUG auto-approve state. */
+export async function getMetaToolsAutoApprove(): Promise<boolean> {
+  return invoke<boolean>('get_meta_tools_auto_approve');
+}
+
 // ============================================================================
 // Server Feature Seeding API (for E2E / screenshots)
 // ============================================================================
@@ -263,7 +295,7 @@ export interface WorkspaceBinding {
   id: string;
   workspace_root: string;
   space_id: string;
-  /** A binding can map to one or more FeatureSets (order = render order). */
+  /** A binding maps to zero or more FeatureSets (order = render order). */
   feature_set_ids: string[];
   created_at: string;
   updated_at: string;
@@ -272,7 +304,7 @@ export interface WorkspaceBinding {
 export interface WorkspaceBindingInput {
   workspace_root: string;
   space_id: string;
-  /** Non-empty: at least one FeatureSet id. */
+  /** MAY be empty — an empty mapping means "no Space tools" for that root. */
   feature_set_ids: string[];
 }
 

tests/e2e/specs/capture-screenshots.manual.ts

@@ -49,7 +49,6 @@ import {
   listServerFeatures,
   listClients,
   addFeatureToSet,
-  grantFeatureSetToClient,
   grantOAuthClientFeatureSet,
 } from '../helpers/tauri-api';
 import { PRESEED } from '../mocks/screenshot-preseed';

tests/e2e/specs/comprehensive.wdio.ts

@@ -8,6 +8,7 @@ import {
   createSpace,
   deleteSpace,
   getDefaultSpace,
+  getActiveSpace,
   listSpaces,
   listFeatureSetsBySpace,
   createFeatureSet,

tests/e2e/specs/meta-tools.wdio.ts

@@ -13,7 +13,13 @@
  */
 
 import { byTestId, TIMEOUT, safeClick } from '../helpers/selectors';
-import { emitEvent, getDefaultSpace, invoke } from '../helpers/tauri-api';
+import {
+  emitEvent,
+  getDefaultSpace,
+  invoke,
+  getMetaToolsAutoApprove,
+  setMetaToolsAutoApprove,
+} from '../helpers/tauri-api';
 
 interface BuiltinServerRow {
   id: string;
@@ -67,6 +73,35 @@ describe('Built-in Servers - Tool Optimization UI', () => {
     await expect(grants).toBeDisplayed();
     await expect(audit).toBeDisplayed();
   });
+
+  it('TC-MT-003: DEBUG auto-approve toggle round-trips and reflects backend state', async () => {
+    const nav = await byTestId('nav-builtin-servers');
+    await safeClick(nav);
+    await browser.pause(1000);
+
+    // The amber debug control lives inside the grants panel.
+    const toggleWrap = await byTestId('meta-tool-auto-approve');
+    await expect(toggleWrap).toBeDisplayed();
+
+    // Start from a known-off baseline (session-only state).
+    await setMetaToolsAutoApprove(false);
+    expect(await getMetaToolsAutoApprove()).toBe(false);
+
+    // Flip it on via the UI switch and confirm the backend agrees.
+    const toggle = await byTestId('meta-tool-auto-approve-toggle');
+    await safeClick(toggle);
+    await browser.waitUntil(async () => (await getMetaToolsAutoApprove()) === true, {
+      timeout: TIMEOUT.medium,
+      timeoutMsg: 'auto-approve did not turn on after clicking the switch',
+    });
+
+    // Flip back off so later tests see the safe default.
+    await safeClick(toggle);
+    await browser.waitUntil(async () => (await getMetaToolsAutoApprove()) === false, {
+      timeout: TIMEOUT.medium,
+      timeoutMsg: 'auto-approve did not turn off after clicking the switch',
+    });
+  });
 });
 
 describe('Meta tools - Approval dialog', () => {

tests/e2e/specs/streamable-http.wdio.ts

@@ -23,6 +23,10 @@ import {
   listInstalledServers,
   refreshRegistry,
   approveOAuthClient,
+  grantOAuthClientFeatureSet,
+  createFeatureSet,
+  addFeatureToSet,
+  seedServerFeatures,
 } from '../helpers/tauri-api';
 import {
   registerOAuthClient,
@@ -543,4 +547,123 @@ describe('Streamable HTTP: OAuth MCP Client Flow', function () {
       console.log('[test] First tool:', toolsBody.result.tools[0].name);
     }
   });
+
+  // --------------------------------------------------------------------------
+  // TC-SH-016: "if it lists, it calls" — a listed tool is never grant-blocked
+  //
+  // Regression for the reported bug: a tool (e.g. notion_notion-get-users)
+  // appeared in tools/list yet tools/call rejected it with "not allowed by the
+  // current grants". Root cause was list encoding names via qualified_name()
+  // while call decoded via a stale prefix-cache reverse lookup. Both paths now
+  // match qualified_name() against the SAME resolved feature set.
+  //
+  // Seed a feature with a dotted server_id + hyphenated name (mirrors the real
+  // com.notion-mcp-http_notion-get-users shape) so this holds even when the
+  // backend MCP handshake doesn't complete on CI.
+  // --------------------------------------------------------------------------
+  it('TC-SH-016: every listed tool is callable (no listed-but-blocked)', async () => {
+    // 1. Seed a backend tool feature directly into this space.
+    const seeded = await seedServerFeatures([
+      {
+        space_id: defaultSpaceId,
+        server_id: 'com.e2e-listcall-http',
+        feature_type: 'tool',
+        feature_name: 'list-and-call-me',
+        display_name: 'List And Call Me',
+        description: 'E2E tool proving list==call',
+      },
+    ]);
+    expect(seeded.length).toBe(1);
+    const featureId = seeded[0];
+
+    // 2. Compose a FeatureSet with exactly that tool, grant it to the client.
+    const fs = await createFeatureSet({
+      name: `e2e-listcall-${Date.now()}`,
+      space_id: defaultSpaceId,
+    });
+    await addFeatureToSet(fs.id, featureId, 'include');
+    await grantOAuthClientFeatureSet(clientId, defaultSpaceId, fs.id);
+
+    // 3. Fresh session so the new grant resolves.
+    const token = await obtainAccessToken(clientId, 'http://localhost:0/callback', gatewayPort);
+    const initRes = await fetch(`http://localhost:${gatewayPort}/mcp`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2025-03-26',
+          capabilities: {},
+          clientInfo: { name: 'e2e-listcall', version: '1.0.0' },
+        },
+      }),
+    });
+    expect(initRes.status).toBeLessThan(400);
+    const sessionId = initRes.headers.get('mcp-session-id');
+    expect(sessionId).toBeTruthy();
+    await initRes.text();
+
+    await fetch(`http://localhost:${gatewayPort}/mcp`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        Authorization: `Bearer ${token}`,
+        'Mcp-Session-Id': sessionId!,
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }),
+    });
+
+    // 4. tools/list — the seeded tool MUST be listed under the grant.
+    const listRes = await fetch(`http://localhost:${gatewayPort}/mcp`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        Authorization: `Bearer ${token}`,
+        'Mcp-Session-Id': sessionId!,
+      },
+      body: JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} }),
+    });
+    expect(listRes.ok).toBe(true);
+    const listBody = parseMcpResponse<{
+      result?: { tools: Array<{ name: string }> };
+    }>(listRes.headers.get('content-type'), await listRes.text());
+    const tools = listBody.result?.tools ?? [];
+    console.log('[test] TC-SH-016 listed tools:', tools.map((t) => t.name).join(', '));
+    const target = tools.find((t) => t.name.includes('list-and-call-me'));
+    expect(target).toBeTruthy();
+
+    // 5. tools/call the EXACT listed name. It may fail to execute (no live
+    //    backend behind the seeded feature), but it must NEVER be rejected by
+    //    grants — that is the invariant the fix guarantees.
+    const callRes = await fetch(`http://localhost:${gatewayPort}/mcp`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json, text/event-stream',
+        Authorization: `Bearer ${token}`,
+        'Mcp-Session-Id': sessionId!,
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 3,
+        method: 'tools/call',
+        params: { name: target!.name, arguments: {} },
+      }),
+    });
+    const callBody = parseMcpResponse<{
+      error?: { message?: string };
+      result?: unknown;
+    }>(callRes.headers.get('content-type'), await callRes.text());
+    const errMsg = callBody.error?.message ?? '';
+    console.log('[test] TC-SH-016 call error (if any):', errMsg);
+    expect(errMsg).not.toContain('not allowed by the current grants');
+  });
 });

tests/e2e/specs/workspaces.wdio.ts

@@ -142,6 +142,48 @@ describe('Workspaces - Create, render, delete', () => {
   });
 });
 
+describe('Workspaces - Empty mapping (no Space tools)', () => {
+  let bindingId: string | null = null;
+  const root = uniqueRoot();
+
+  it('TC-WS-010: A mapping with zero FeatureSets is savable and persists', async () => {
+    const space = await getDefaultSpace();
+    if (!space) throw new Error('No default space — cannot set up test');
+
+    // An empty feature_set_ids list is a deliberate "this root gets no Space
+    // tools" mapping — it must persist, not be rejected.
+    const created: WorkspaceBinding = await createWorkspaceBinding({
+      workspace_root: root,
+      space_id: space.id,
+      feature_set_ids: [],
+    });
+    bindingId = created.id;
+    expect(created.feature_set_ids.length).toBe(0);
+
+    const reloaded = (await listWorkspaceBindings()).find((b) => b.id === created.id);
+    expect(reloaded).toBeTruthy();
+    expect(reloaded!.feature_set_ids.length).toBe(0);
+
+    // Card renders for an empty mapping too.
+    const nav = await byTestId('nav-workspaces');
+    await safeClick(nav);
+    await browser.pause(1200);
+    const card = await $(`[data-testid="workspace-entry-${created.id}"]`);
+    await card.waitForDisplayed({ timeout: TIMEOUT.short });
+    expect(await card.isDisplayed()).toBe(true);
+  });
+
+  after(async () => {
+    if (bindingId) {
+      try {
+        await deleteWorkspaceBinding(bindingId);
+      } catch {
+        /* ignore */
+      }
+    }
+  });
+});
+
 describe('Workspaces - Create form flow (UI)', () => {
   let bindingId: string | null = null;