refactor(meta-tools): remove debug auto-approve; writes always prompt

The DEBUG auto-approve bypass was dev-only (and inert in release after the
earlier security gating) and overlapped confusingly with the planned,
persisted "require approval" production switch. Remove it entirely so the app
surfaces true production behavior — every `mcpmux_*` write goes through the
approval dialog.

- ApprovalBroker: drop the `auto_approve` field, the `MCPMUX_DEBUG_AUTO_APPROVE`
  env read, and `set_auto_approve` / `auto_approve_enabled` (plus the step-0
  bypass in `request_approval`). Always-allow, rate-limit, and fail-closed
  paths are unchanged.
- Remove the `set/get_meta_tools_auto_approve` Tauri commands + their
  registration, the frontend API wrappers, and the "Auto-approve writes
  (debug)" toggle from the meta-tool grants panel.
- Drop the obsolete broker unit test and e2e TC-MT-003.

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/meta_tool_approval.rs

@@ -109,44 +109,3 @@ pub async fn revoke_meta_tool_grant(
     };
     Ok(broker.revoke_always_allow(&client_id, &tool_name))
 }
-
-/// DEBUG/dev only: toggle auto-approval of all write meta tools.
-///
-/// When on, every `mcpmux_*` write tool (manage_feature_set,
-/// bind_current_workspace, …) is approved without a dialog. This exists so a
-/// developer (or the in-app assistant) can self-create feature sets / bindings
-/// and exercise the routing end-to-end without clicking through approvals.
-/// Session-only — it is **not** persisted and resets to the
-/// `MCPMUX_DEBUG_AUTO_APPROVE` env default on gateway restart.
-#[tauri::command]
-pub async fn set_meta_tools_auto_approve(
-    enabled: bool,
-    gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
-) -> Result<bool, String> {
-    let broker = {
-        let state = gateway_state.read().await;
-        state.approval_broker.clone()
-    };
-    let Some(broker) = broker else {
-        warn!("[meta-tool] set_meta_tools_auto_approve called but gateway is not running");
-        return Err("gateway is not running".into());
-    };
-    broker.set_auto_approve(enabled);
-    warn!(enabled, "[meta-tool] auto-approve toggled (DEBUG)");
-    Ok(enabled)
-}
-
-/// Whether write meta tools are currently auto-approved (DEBUG mode state).
-#[tauri::command]
-pub async fn get_meta_tools_auto_approve(
-    gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
-) -> Result<bool, String> {
-    let broker = {
-        let state = gateway_state.read().await;
-        state.approval_broker.clone()
-    };
-    let Some(broker) = broker else {
-        return Ok(false);
-    };
-    Ok(broker.auto_approve_enabled())
-}

apps/desktop/src-tauri/src/lib.rs

@@ -910,8 +910,6 @@ pub fn run() {
             commands::respond_to_meta_tool_approval,
             commands::list_meta_tool_grants,
             commands::revoke_meta_tool_grant,
-            commands::set_meta_tools_auto_approve,
-            commands::get_meta_tools_auto_approve,
             // Built-in servers (per-Space enablement + per-tool toggles)
             commands::list_builtin_servers,
             commands::set_builtin_server_enabled,

apps/desktop/src/features/metaTools/MetaToolGrantsPanel.tsx

@@ -1,11 +1,9 @@
 import { useCallback, useEffect, useState } from 'react';
-import { FlaskConical, KeyRound, Loader2, Trash2 } from 'lucide-react';
-import { Button, Card, CardContent, CardHeader, CardTitle, Switch } from '@mcpmux/ui';
+import { KeyRound, Loader2, Trash2 } from 'lucide-react';
+import { Button, Card, CardContent, CardHeader, CardTitle } from '@mcpmux/ui';
 import {
-  getMetaToolsAutoApprove,
   listMetaToolGrants,
   revokeMetaToolGrant,
-  setMetaToolsAutoApprove,
   type MetaToolGrantEntry,
 } from '@/lib/api/metaTools';
 
@@ -23,7 +21,6 @@ export function MetaToolGrantsPanel() {
   const [grants, setGrants] = useState<MetaToolGrantEntry[] | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [revoking, setRevoking] = useState<string | null>(null);
-  const [autoApprove, setAutoApprove] = useState<boolean | null>(null);
 
   const load = useCallback(async () => {
     try {
@@ -41,23 +38,6 @@ export function MetaToolGrantsPanel() {
     return () => clearInterval(i);
   }, [load]);
 
-  useEffect(() => {
-    getMetaToolsAutoApprove()
-      .then(setAutoApprove)
-      .catch(() => setAutoApprove(false));
-  }, []);
-
-  const handleToggleAutoApprove = async (next: boolean) => {
-    const prev = autoApprove;
-    setAutoApprove(next);
-    try {
-      await setMetaToolsAutoApprove(next);
-    } catch (e) {
-      setAutoApprove(prev);
-      setError(e instanceof Error ? e.message : String(e));
-    }
-  };
-
   const handleRevoke = async (g: MetaToolGrantEntry) => {
     const key = `${g.client_id}:${g.tool_name}`;
     setRevoking(key);
@@ -86,33 +66,6 @@ export function MetaToolGrantsPanel() {
       <CardContent>
         {error && <div className="mb-2 text-sm text-red-600 dark:text-red-400">{error}</div>}
 
-        {/* DEBUG: bypass the approval dialog entirely. For developers driving
-            mcpmux_* writes (create feature sets / bindings) from a client to
-            self-test routing. Session-only; resets on gateway restart. */}
-        <div
-          className="mb-4 flex items-start justify-between gap-3 rounded-lg border border-amber-300/60 bg-amber-50 p-3 dark:border-amber-700/50 dark:bg-amber-900/20"
-          data-testid="meta-tool-auto-approve"
-        >
-          <div className="flex min-w-0 gap-2">
-            <FlaskConical className="mt-0.5 h-4 w-4 flex-shrink-0 text-amber-600 dark:text-amber-400" />
-            <div className="min-w-0">
-              <div className="text-sm font-medium text-amber-900 dark:text-amber-200">
-                Auto-approve writes (debug)
-              </div>
-              <p className="mt-0.5 text-xs text-amber-800/80 dark:text-amber-300/80">
-                Skip the approval dialog for every <code className="font-mono">mcpmux_*</code>{' '}
-                write. For self-testing only — resets on gateway restart.
-              </p>
-            </div>
-          </div>
-          <Switch
-            checked={autoApprove ?? false}
-            disabled={autoApprove === null}
-            onCheckedChange={(v) => void handleToggleAutoApprove(v)}
-            data-testid="meta-tool-auto-approve-toggle"
-          />
-        </div>
-
         {grants === null ? (
           <div className="flex items-center gap-2 text-sm text-[rgb(var(--muted))]">
             <Loader2 className="h-4 w-4 animate-spin" /> Loading…

apps/desktop/src/lib/api/metaTools.ts

@@ -33,23 +33,6 @@ export async function revokeMetaToolGrant(clientId: string, toolName: string): P
 // `@/lib/api/builtinServers` (listBuiltinServers / setBuiltinServerEnabled /
 // setBuiltinToolEnabled). The old global get/set_meta_tools_enabled were removed.
 
-/**
- * DEBUG/dev only: toggle auto-approval of every write meta tool.
- *
- * When on, `mcpmux_manage_feature_set` / `mcpmux_bind_current_workspace` and
- * friends are approved without a dialog — so a developer can self-create
- * feature sets and bindings and exercise routing end-to-end. Session-only:
- * resets on gateway restart (to the `MCPMUX_DEBUG_AUTO_APPROVE` env default).
- */
-export async function setMetaToolsAutoApprove(enabled: boolean): Promise<boolean> {
-  return invoke('set_meta_tools_auto_approve', { enabled });
-}
-
-/** Whether write meta tools are currently auto-approved (DEBUG mode state). */
-export async function getMetaToolsAutoApprove(): Promise<boolean> {
-  return invoke('get_meta_tools_auto_approve');
-}
-
 /**
  * Respond to a pending approval request. Normally called by
  * `<MetaToolApprovalDialog>`; exported here for tests and advanced flows.

crates/mcpmux-gateway/src/services/meta_tools/approval.rs

@@ -24,7 +24,6 @@
 //! client_metadata URL for DCR-registered clients like Claude Code). The
 //! broker doesn't parse it; equality + hashing is enough.
 
-use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -118,12 +117,6 @@ pub struct ApprovalBroker {
     /// Published to the desktop layer; `None` means headless.
     publisher: Mutex<Option<ApprovalPublisher>>,
     timeout: Duration,
-    /// DEBUG/dev only: when set, every write meta-tool is auto-approved without
-    /// a dialog. Lets self-tests drive `mcpmux_manage_feature_set` /
-    /// `mcpmux_bind_current_workspace` headlessly. Off by default; enabled via
-    /// `MCPMUX_DEBUG_AUTO_APPROVE=1` at startup or the
-    /// `set_meta_tools_auto_approve` command at runtime.
-    auto_approve: AtomicBool,
 }
 
 impl Default for ApprovalBroker {
@@ -134,31 +127,12 @@ impl Default for ApprovalBroker {
 
 impl ApprovalBroker {
     pub fn new() -> Self {
-        // Auto-approve is a DEBUG-ONLY bypass of the sole human-in-the-loop
-        // control for write meta-tools. Compile the env-var read out of
-        // release builds entirely (`debug_assertions` is off in `--release`)
-        // so a stray `MCPMUX_DEBUG_AUTO_APPROVE` inherited from the parent
-        // shell / CI / launcher can never silently disable the approval
-        // dialog in a shipped binary.
-        #[cfg(debug_assertions)]
-        let auto = std::env::var("MCPMUX_DEBUG_AUTO_APPROVE")
-            .map(|v| matches!(v.as_str(), "1" | "true"))
-            .unwrap_or(false);
-        #[cfg(not(debug_assertions))]
-        let auto = false;
-
-        if auto {
-            warn!(
-                "[ApprovalBroker] MCPMUX_DEBUG_AUTO_APPROVE set — meta-tool writes auto-approved"
-            );
-        }
         Self {
             pending: DashMap::new(),
             always_allow: DashMap::new(),
             rate_limit: DashMap::new(),
             publisher: Mutex::new(None),
             timeout: DEFAULT_TIMEOUT,
-            auto_approve: AtomicBool::new(auto),
         }
     }
 
@@ -167,34 +141,6 @@ impl ApprovalBroker {
         self
     }
 
-    /// DEBUG/dev only: toggle auto-approval of all write meta tools.
-    ///
-    /// In release builds this is inert — a request to enable auto-approve is
-    /// ignored and logged, so production binaries cannot turn off the
-    /// approval dialog at runtime (the Tauri command stays registered for a
-    /// uniform IPC surface, but has no effect).
-    pub fn set_auto_approve(&self, on: bool) {
-        #[cfg(debug_assertions)]
-        {
-            self.auto_approve.store(on, Ordering::Relaxed);
-            warn!(on, "[ApprovalBroker] auto-approve toggled (DEBUG)");
-        }
-        #[cfg(not(debug_assertions))]
-        {
-            if on {
-                warn!(
-                    "[ApprovalBroker] set_auto_approve(true) ignored in release build — \
-                     meta-tool approval cannot be disabled in production"
-                );
-            }
-        }
-    }
-
-    /// Whether write meta tools are currently auto-approved.
-    pub fn auto_approve_enabled(&self) -> bool {
-        self.auto_approve.load(Ordering::Relaxed)
-    }
-
     /// Attach the desktop subscriber. Call once at app startup.
     pub async fn set_publisher(&self, publisher: ApprovalPublisher) {
         *self.publisher.lock().await = Some(publisher);
@@ -266,16 +212,6 @@ impl ApprovalBroker {
         tool_name: &str,
         payload: ApprovalPayload,
     ) -> Result<ApprovalDecision, MetaToolError> {
-        // 0. DEBUG auto-approve — bypass the dialog entirely (dev/self-test).
-        if self.auto_approve.load(Ordering::Relaxed) {
-            warn!(
-                %client_id,
-                tool = tool_name,
-                "[ApprovalBroker] DEBUG auto-approve — bypassing dialog",
-            );
-            return Ok(ApprovalDecision::AllowOnce);
-        }
-
         // 1. Always-allow short-circuit.
         if self
             .always_allow
@@ -396,37 +332,6 @@ mod tests {
         assert!(matches!(err, MetaToolError::ApprovalRequiredNoDesktop));
     }
 
-    #[tokio::test]
-    async fn auto_approve_bypasses_dialog() {
-        // DEBUG mode: even with NO publisher attached (which normally yields
-        // ApprovalRequiredNoDesktop), auto-approve returns AllowOnce so
-        // self-tests can drive write meta tools headlessly. Toggling off
-        // restores the safe headless deny.
-        let broker = ApprovalBroker::new();
-        broker.set_auto_approve(true);
-        assert!(broker.auto_approve_enabled());
-        let d = broker
-            .request_approval(
-                &Uuid::new_v4().to_string(),
-                "mcpmux_bind_current_workspace",
-                make_payload(),
-            )
-            .await
-            .unwrap();
-        assert_eq!(d, ApprovalDecision::AllowOnce);
-
-        broker.set_auto_approve(false);
-        let err = broker
-            .request_approval(
-                &Uuid::new_v4().to_string(),
-                "mcpmux_bind_current_workspace",
-                make_payload(),
-            )
-            .await
-            .unwrap_err();
-        assert!(matches!(err, MetaToolError::ApprovalRequiredNoDesktop));
-    }
-
     #[tokio::test]
     async fn always_allow_short_circuits() {
         let broker = ApprovalBroker::new();

tests/e2e/helpers/tauri-api.ts

@@ -217,16 +217,6 @@ export async function grantOAuthClientFeatureSet(
   });
 }
 
-/** DEBUG: toggle auto-approval of every write meta tool (session-only). */
-export async function setMetaToolsAutoApprove(enabled: boolean): Promise<boolean> {
-  return invoke<boolean>('set_meta_tools_auto_approve', { enabled });
-}
-
-/** Read the current DEBUG auto-approve state. */
-export async function getMetaToolsAutoApprove(): Promise<boolean> {
-  return invoke<boolean>('get_meta_tools_auto_approve');
-}
-
 // ============================================================================
 // Server Feature Seeding API (for E2E / screenshots)
 // ============================================================================

tests/e2e/specs/meta-tools.wdio.ts

@@ -13,13 +13,7 @@
  */
 
 import { byTestId, TIMEOUT, safeClick } from '../helpers/selectors';
-import {
-  emitEvent,
-  getDefaultSpace,
-  invoke,
-  getMetaToolsAutoApprove,
-  setMetaToolsAutoApprove,
-} from '../helpers/tauri-api';
+import { emitEvent, getDefaultSpace, invoke } from '../helpers/tauri-api';
 
 interface BuiltinServerRow {
   id: string;
@@ -74,34 +68,6 @@ describe('Built-in Servers - Tool Optimization UI', () => {
     await expect(audit).toBeDisplayed();
   });
 
-  it('TC-MT-003: DEBUG auto-approve toggle round-trips and reflects backend state', async () => {
-    const nav = await byTestId('nav-builtin-servers');
-    await safeClick(nav);
-    await browser.pause(1000);
-
-    // The amber debug control lives inside the grants panel.
-    const toggleWrap = await byTestId('meta-tool-auto-approve');
-    await expect(toggleWrap).toBeDisplayed();
-
-    // Start from a known-off baseline (session-only state).
-    await setMetaToolsAutoApprove(false);
-    expect(await getMetaToolsAutoApprove()).toBe(false);
-
-    // Flip it on via the UI switch and confirm the backend agrees.
-    const toggle = await byTestId('meta-tool-auto-approve-toggle');
-    await safeClick(toggle);
-    await browser.waitUntil(async () => (await getMetaToolsAutoApprove()) === true, {
-      timeout: TIMEOUT.medium,
-      timeoutMsg: 'auto-approve did not turn on after clicking the switch',
-    });
-
-    // Flip back off so later tests see the safe default.
-    await safeClick(toggle);
-    await browser.waitUntil(async () => (await getMetaToolsAutoApprove()) === false, {
-      timeout: TIMEOUT.medium,
-      timeoutMsg: 'auto-approve did not turn off after clicking the switch',
-    });
-  });
 });
 
 describe('Meta tools - Approval dialog', () => {