feat(gateway): default FeatureSet for unmapped roots + Mapped workspaces filter

Unmapped/rootless/unknown sessions now fall back to the default Space's
Starter FeatureSet (new `ResolutionSource::SpaceDefault`) instead of being
denied, so a freshly-opened folder works out of the box. An explicit
WorkspaceBinding is only needed when a folder should see something other
than the default. Reverses the prior resolver-v3 "deny unmapped" design.

- Scope: Tier 1b (roots reported, no binding) and Tier 3 (rootless / no
  grants / unknown) both fall back to the default Starter FS.
- Grace window (~5s) holds roots-capable sessions at PendingRoots before
  defaulting, so a client about to report a folder resolves straight to its
  mapped FS instead of flashing default-then-mapped. After the grace it goes
  straight to the Space default, never to another client's grants.
- Off-switch: empty the Starter (builtin, can't be deleted); the Deny branch
  is now purely defensive.
- Auto-prompt kept: still emits WorkspaceNeedsBinding on SpaceDefault (gated
  on a folder root, so rootless sessions stay silent). UI copy reframed from
  "no tools until you map" to "already using your default Starter tools".
- Workspaces tab: new "Mapped" filter segment + stable filter test ids.

Tests: resolver fallback, grace-lapse-not-grants, empty-Starter off-switch,
unbound effective features, Mapped/Unmapped filter. Updated all resolver
integration tests for the new 5-arg constructor and SpaceDefault outcomes.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/workspace_binding.rs

@@ -445,11 +445,11 @@ pub struct WorkspaceEffectiveFeaturesDto {
     /// trailing slash, etc.).
     pub workspace_root: String,
     /// `binding` when a `WorkspaceBinding` matched the longest prefix of
-    /// the root; `unbound` when no binding matched. With the new resolver,
-    /// `unbound` means a live roots-capable session for this folder would
-    /// be **denied** — the `feature_sets` field below shows the default
-    /// Space's Default FS purely as a *preview* of what binding the folder
-    /// to that FS would expose, not as the active routing target.
+    /// the root; `unbound` when no binding matched. An `unbound` folder is
+    /// **not** denied — it falls back to the default Space's Starter FS, so
+    /// the `feature_sets` field below is exactly what a live session for this
+    /// folder sees right now (the active routing target), until the user
+    /// attaches an explicit binding to override it.
     pub source: String,
     /// `Some(id)` only when `source == "binding"`.
     pub binding_id: Option<String>,
@@ -588,11 +588,11 @@ pub async fn get_workspace_effective_features(
             b.feature_set_ids,
         ),
         None => {
-            // Source = `unbound` mirrors the new resolver: a live session
-            // here would be denied. We still surface the default Space's
-            // Default FS as a *preview* so the UI can render "if you bound
-            // this folder to <FS>, here's what it would see" — it's
-            // informational, not the active routing target.
+            // Source = `unbound` mirrors the resolver: an unmapped folder
+            // falls back to the default Space's Starter FS. This is the
+            // active routing target a live session here resolves to, not a
+            // hypothetical preview — the user can attach a binding to give
+            // the folder something other than the default.
             let starter_fs = state
                 .feature_set_repository
                 .get_starter_for_space(&default_space.id.to_string())

apps/desktop/src/features/clients/ClientsPage.tsx

@@ -873,9 +873,9 @@ function RootlessGrantsSection({
         <div className="mt-3 flex items-start gap-2 rounded-lg border border-[rgb(var(--border-subtle))] bg-[rgb(var(--surface))] p-2.5">
           <ShieldOff className="mt-0.5 h-4 w-4 flex-shrink-0 text-[rgb(var(--muted))]" />
           <p className="text-[11px] text-[rgb(var(--muted))]">
-            No defaults set — rootless sessions from this client are denied. That&apos;s the safe
-            default. Pick a FeatureSet above only if you trust this client to operate without a
-            workspace folder.
+            No per-client defaults set — rootless sessions from this client fall back to your
+            default Starter set. Pick a FeatureSet above to grant this client a specific set
+            instead.
           </p>
         </div>
       )}

apps/desktop/src/features/workspaces/WorkspaceBindingSheet.tsx

@@ -197,9 +197,9 @@ export function WorkspaceBindingSheet() {
             Which tools should this folder get?
           </h2>
           <p className="mt-2 text-sm text-[rgb(var(--muted))]">
-            You just opened this folder in a connected app. Choose a Space and a
-            feature set, and every app you open here will get exactly those
-            tools.
+            You just opened this folder in a connected app. It&apos;s already
+            using your default Starter tools — pick a Space and feature set to
+            give it a specific set instead, or keep the default.
           </p>
 
           <div className="mt-5 flex items-start gap-3 rounded-xl border border-[rgb(var(--border))] bg-[rgb(var(--surface))] px-4 py-3">

apps/desktop/src/features/workspaces/WorkspacesPage.tsx

@@ -92,7 +92,7 @@ export function WorkspacesPage() {
 
   const [selected, setSelected] = useState<Selected | null>(null);
   const [searchQuery, setSearchQuery] = useState('');
-  const [filter, setFilter] = useState<'all' | 'live' | 'unmapped'>('all');
+  const [filter, setFilter] = useState<'all' | 'live' | 'mapped' | 'unmapped'>('all');
 
   const loadData = useCallback(async () => {
     setError(null);
@@ -205,6 +205,7 @@ export function WorkspacesPage() {
     const q = searchQuery.trim().toLowerCase();
     return entries.filter((e) => {
       if (filter === 'live' && !e.isLive) return false;
+      if (filter === 'mapped' && !e.binding) return false;
       if (filter === 'unmapped' && e.kind !== 'unmapped-live') return false;
       if (!q) return true;
       const spaceName = e.binding ? spaceById.get(e.binding.space_id)?.name ?? '' : '';
@@ -223,12 +224,14 @@ export function WorkspacesPage() {
 
   const counts = useMemo(() => {
     let live = 0;
+    let mapped = 0;
     let unmapped = 0;
     for (const e of entries) {
       if (e.isLive) live++;
+      if (e.binding) mapped++;
       if (e.kind === 'unmapped-live') unmapped++;
     }
-    return { all: entries.length, live, unmapped };
+    return { all: entries.length, live, mapped, unmapped };
   }, [entries]);
 
   const selectedEntry: Entry | null =
@@ -316,8 +319,9 @@ export function WorkspacesPage() {
                 Map a folder to the tools it should get. When you open that
                 folder in a connected app — Cursor, VS Code, Claude — McpMux
                 serves exactly the tools you chose for it. Folders you
-                haven&apos;t mapped don&apos;t receive your tools until you map
-                them.
+                haven&apos;t mapped fall back to your default Starter set, so
+                they work out of the box — map one only when it should see
+                something different.
               </p>
             </div>
             <div className="flex-shrink-0 flex items-center gap-2">
@@ -362,6 +366,7 @@ export function WorkspacesPage() {
               options={[
                 { value: 'all', label: 'All', count: counts.all },
                 { value: 'live', label: 'Live', count: counts.live },
+                { value: 'mapped', label: 'Mapped', count: counts.mapped },
                 { value: 'unmapped', label: 'Unmapped', count: counts.unmapped },
               ]}
             />
@@ -408,9 +413,8 @@ export function WorkspacesPage() {
                 const isSelected =
                   selected?.mode === 'entry' && selected.id === entry.id;
                 // Mapped entries show their bound Space + FeatureSet names.
-                // Unmapped entries deliberately show no preview — the card
-                // reads "Not mapped" because the folder genuinely gets no
-                // tools until the user maps it.
+                // Unmapped entries read "Not mapped" — they fall back to the
+                // default Starter set rather than to an explicit binding.
                 const resolvedSpaceName = entry.binding
                   ? spaceById.get(entry.binding.space_id)?.name
                   : undefined;
@@ -522,6 +526,8 @@ function SegmentedFilter<T extends string>({
             key={o.value}
             type="button"
             onClick={() => onChange(o.value)}
+            data-testid={`workspace-filter-${o.value}`}
+            aria-pressed={active}
             className={[
               'inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium rounded-lg transition-all',
               active
@@ -692,7 +698,7 @@ function EntryCard({
           ) : (
             <span className="inline-flex items-center gap-1.5 font-medium text-amber-600 dark:text-amber-400">
               <AlertCircle className="h-3.5 w-3.5 flex-shrink-0" />
-              Not mapped — no tools until you map it
+              Not mapped — using your default Starter tools
             </span>
           )}
         </div>
@@ -980,7 +986,7 @@ function InspectorPanel({
             mode === 'create'
               ? 'Choose the folder and the tools it should get.'
               : mode === 'create-from-live'
-                ? 'This folder is open in an app but has no tools yet — map it.'
+                ? 'This folder is open in an app and using your default Starter tools — map it to give it a specific set instead.'
                 : isMapped && entry?.binding
                   ? `Gives ${
                       formatFsList(
@@ -1280,7 +1286,7 @@ function EffectiveFeaturesContent({
             title={
               data.source === 'binding'
                 ? 'A workspace binding matched this folder — live sessions reporting it route here.'
-                : 'No binding matches this folder. A live roots-capable session would be denied; the FeatureSet shown is a preview of what binding here would expose.'
+                : 'No binding matches this folder, so it falls back to the default Starter set shown here. Map it to give this folder a different set.'
             }
             className={[
               'ml-auto text-[10px] px-2 py-0.5 rounded-full font-bold uppercase tracking-wider border',

apps/desktop/src/lib/api/workspaceBindings.ts

@@ -158,7 +158,7 @@ export interface EffectiveFeatureSetSummary {
 
 export interface WorkspaceEffectiveFeatures {
   workspace_root: string;
-  /** `binding` when a saved WorkspaceBinding matched; `unbound` when no binding matched — the `feature_sets` field previews the default Space's Default FS but a live session here would be denied. */
+  /** `binding` when a saved WorkspaceBinding matched; `unbound` when no binding matched — an unbound folder falls back to the default Space's Starter FS, so `feature_sets` is what a live session here actually sees until the user attaches a binding. */
   source: 'binding' | 'unbound';
   binding_id: string | null;
   space_id: string;

crates/mcpmux-gateway/src/mcp/handler.rs

@@ -82,9 +82,13 @@ impl McpMuxGatewayHandler {
     }
 
     /// Log resolver decision, emit `WorkspaceNeedsBinding` when a session
-    /// reports roots but no binding matched (`source=Default`), and — when
-    /// the session's resolved FS *flipped* from a prior value — fire a
-    /// per-peer `list_changed` so the client re-pulls its tools.
+    /// reports roots but no binding matched (`source=SpaceDefault` or `Deny`),
+    /// and — when the session's resolved FS *flipped* from a prior value —
+    /// fire a per-peer `list_changed` so the client re-pulls its tools. That
+    /// flip is also what broadcasts the freshly-resolved tools the moment a
+    /// root is reported: the resolution moves from `PendingRoots` (empty) to
+    /// either the folder's binding or the Space default, the fingerprint
+    /// changes, and the peer re-lists.
     ///
     /// `notifier` is optional: callers from contexts where peer notification
     /// doesn't apply (e.g. rootless init paths) can pass `None`.
@@ -126,12 +130,20 @@ impl McpMuxGatewayHandler {
                     }
                 }
 
-                // Prompt only when the session reported a root but no
-                // binding matched (`Deny` with a non-empty root_for_prompt).
-                // PendingRoots / ClientGrant / WorkspaceBinding never
-                // trigger the prompt.
-                let should_prompt =
-                    matches!(resolved.source, crate::services::ResolutionSource::Deny);
+                // Prompt only when the session reported a root that has no
+                // explicit binding — i.e. it fell back to the Space default
+                // (`SpaceDefault`), or there was no default FS to fall back to
+                // (`Deny`). Either way `root_for_prompt` is `Some(..)` for a
+                // folder-reporting session and `None` for a rootless one, so
+                // rootless defaults never prompt. PendingRoots / ClientGrant /
+                // WorkspaceBinding never trigger the prompt. The folder still
+                // works via the default FS meanwhile; the prompt just offers
+                // an explicit mapping.
+                let should_prompt = matches!(
+                    resolved.source,
+                    crate::services::ResolutionSource::Deny
+                        | crate::services::ResolutionSource::SpaceDefault
+                );
                 if let (true, Some(sid), Some(space_id), Some(root)) = (
                     should_prompt,
                     session_id,

crates/mcpmux-gateway/src/server/service_container.rs

@@ -108,6 +108,7 @@ impl ServiceContainer {
             deps.workspace_binding_repo.clone(),
             session_roots.clone(),
             deps.inbound_client_repo.clone(),
+            deps.feature_set_repo.clone(),
         ));
 
         // Authorization service is now a thin adapter over the resolver.