Merge pull request #8 from crimsonsunset/feat/workspace-machine-binding

feat(workspaces): machine-scoped bindings and multi-device gateway routing

Author: crimsonsunset

.env.example

@@ -0,0 +1,15 @@
+# Copy to `.env` in the repo root (gitignored). Used by remote tunnel smoke scripts
+# and Playwright admin tests — never commit real values.
+
+# Cloudflare Access service token (Zero Trust → Access → Service Auth)
+MCPMUX_CF_ACCESS_CLIENT_ID=
+MCPMUX_CF_ACCESS_CLIENT_SECRET=
+
+# Optional tunnel hostnames for `pnpm remote:smoke`
+MCPMUX_REMOTE_GATEWAY_URL=https://mcp.example.com
+MCPMUX_REMOTE_ADMIN_URL=https://mux.example.com
+
+# Playwright admin parity against loopback admin with CF trust enabled
+# MCPMUX_ADMIN_CF_JWT=
+# MCPMUX_ADMIN_CF_TRUST_ENABLED=1
+# MCPMUX_ADMIN_BASE_URL=http://localhost:45819

.gitignore

@@ -60,6 +60,7 @@ coverage/
 # Test reports & assets
 test-results/
 playwright-report/
+.playwright-mcp/
 blob-report/
 html-report/
 tests/e2e/reports/

.vscode/settings.json

@@ -6,6 +6,7 @@
     "rust-analyzer.rustfmt.extraArgs": [
         "+nightly"
     ],
+    "rust-analyzer.cargo.targetDir": true,
     "files.eol": "\n",
     "files.insertFinalNewline": true,
     "files.trimTrailingWhitespace": true,

AGENTS.md

@@ -32,6 +32,10 @@ Run everything from `mcp-mux/`:
 | `pnpm setup` | First-time dev environment setup (PowerShell on Windows). |
 | `pnpm dev` | Tauri desktop dev mode (Rust + React hot-reload). |
 | `pnpm dev:web` | Web UI only via Vite — no Rust, no Tauri shell. |
+| `pnpm dev:admin` | Full stack + web admin: `tauri dev` with admin enabled, opens browser at `:1420` once the gateway is stable. Primary dev driver. |
+| `pnpm dev:web:admin` | Browser-only admin UI; auto-starts the backend detached if it isn't already up. |
+| `pnpm dev:stop` | Quit McpMux.app and free the dev ports (`:1420`, `:45818`, `:45819`). |
+| `pnpm dev:rebuild` | Force `cargo build --workspace` (debug) without launching — recovery for stale binaries. |
 | `pnpm build` | Production Tauri build for the current platform. |
 | `pnpm validate` | Full correctness gate — runs the items below in sequence. |
 | `pnpm lint` | ESLint (recursive) + `cargo clippy --workspace -- -D warnings`. |
@@ -40,6 +44,8 @@ Run everything from `mcp-mux/`:
 | `pnpm format:check` | Formatting check (no writes). |
 | `pnpm typecheck` | Recursive TypeScript typecheck. |
 
+**Hot-reload while developing:** `pnpm dev:admin` keeps the desktop window, the `:1420` browser tab (Vite HMR), and the CF tunnel / `:45819` static UI in sync. TS/CSS changes hot-reload instantly on `:1420`; the same edits trigger `vite build --watch` to rebuild `apps/desktop/dist/` for `:45819` and remote tunnel tabs (hard-refresh those after each rebuild, ~10s). Rust changes in any workspace crate trigger `tauri dev` to recompile and restart the backend automatically. Rust is compiled, so "auto-reload" means recompile + process restart, not live patching. After a stalled restart, orphaned backend, or stale binary, recover with `pnpm dev:stop && pnpm dev:rebuild && pnpm dev:admin`. The repo's `.vscode/settings.json` sets `rust-analyzer.cargo.targetDir` so the editor's `cargo check` doesn't fight `tauri dev` over `target/` (avoids double compiles). When `.env` carries CF Access credentials the admin runs with `cf_access=true`; the dev scripts' health probes send `adminCfProbeHeaders()` so `/api/v1/health` doesn't 401. One-off production bundle: `pnpm build:web:admin`.
+
 **Before claiming a change is done**, run `pnpm validate` (or the relevant subset) — it mirrors what CI enforces.
 
 ## Testing

Cargo.lock

@@ -56,6 +56,7 @@ url = "2.5"
 urlencoding = "2.1"
 dotenvy = "0.15"
 os_pipe = "1"
+hostname = "0.4"
 
 # MCP Protocol
 # NOTE: Never use local path dependency - E:\one-mcp\rust-sdk is for source lookup only

Cargo.toml

@@ -225,6 +225,10 @@ pnpm build    # Production build
 pnpm test     # Run all tests
 ```
 
+**Remote access (optional):** MCP and web admin can be exposed via Cloudflare Tunnel + Access on separate hostnames (`45818` / `45819` stay loopback). User-facing overview: [`docs/guide/remote-access.mdx`](docs/guide/remote-access.mdx).
+
+**Web admin (browser UI over HTTP):** `pnpm dev:admin` or `pnpm dev:web:admin` — see [`AGENTS.md`](AGENTS.md) for dev commands and port layout (`:1420` / `:45818` / `:45819`).
+
 **Prerequisites:** Rust 1.75+, Node.js 18+, pnpm 9+. Linux also needs `gnome-keyring libsecret-1-dev librsvg2-dev pkg-config`.
 
 Built with **Tauri 2** (Rust + React 19), **Axum** for the gateway, **ring** for encryption, **rmcp** for MCP.

README.md

@@ -24,13 +24,15 @@
     "@tauri-apps/plugin-opener": "^2",
     "@tauri-apps/plugin-process": "^2",
     "@tauri-apps/plugin-updater": "^2",
+    "emoji-picker-element": "^1.29.1",
     "i18next": "^26.3.1",
     "immer": "^11.0.1",
     "lucide-react": "^0.561.0",
     "posthog-js": "^1.387.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-i18next": "^17.0.8",
+    "wouter": "^3.10.0",
     "zustand": "^5.0.9"
   },
   "devDependencies": {

apps/desktop/package.json

@@ -46,6 +46,7 @@ notify = { version = "7", default-features = false, features = [
     "macos_fsevent",
 ] }
 notify-debouncer-mini = "0.5"
+hostname.workspace = true
 
 # Internal crates (path-only, no version needed)
 mcpmux-core.workspace = true

apps/desktop/src-tauri/Cargo.toml

@@ -3,9 +3,11 @@
 //! IPC commands for controlling the local MCP gateway server.
 
 use crate::commands::server_manager::ServerManagerState;
+use crate::services::ui_events::OAUTH_CONSENT_REQUEST_CHANNEL;
 use crate::AppState;
 use mcpmux_core::service::{allocate_dynamic_port, is_port_available};
 use mcpmux_core::DomainEvent;
+use mcpmux_gateway::admin::ui_events::AdminUiEventBus;
 use mcpmux_gateway::{
     ConnectionContext, ConnectionResult, FeatureService, InstalledServerInfo, OAuthCompleteEvent,
     PoolService, ResolvedTransport, ServerKey, ServerManager,
@@ -82,6 +84,18 @@ pub struct GatewayAppState {
     /// Surfaced to the desktop Workspaces tab so users can see + act on
     /// every folder connected clients are currently operating in.
     pub session_roots: Option<Arc<mcpmux_gateway::services::SessionRootsRegistry>>,
+    /// FeatureSet resolver for live machine-identity hot-reload.
+    pub feature_set_resolver: Option<Arc<mcpmux_gateway::services::FeatureSetResolverService>>,
+}
+
+/// Hot-reload the resolver's local machine identity after settings persist.
+pub(crate) async fn hot_reload_local_machine_id(
+    gateway_state: &Arc<RwLock<GatewayAppState>>,
+    id: Option<Uuid>,
+) {
+    if let Some(resolver) = gateway_state.read().await.feature_set_resolver.as_ref() {
+        resolver.set_local_machine_id(id).await;
+    }
 }
 
 /// Gracefully shuts down a running gateway and waits for the axum task
@@ -410,7 +424,17 @@ pub fn start_domain_event_bridge(
             // window forward BEFORE emitting so the popup animates into a
             // visible window instead of rendering behind another app.
             if matches!(event, DomainEvent::WorkspaceNeedsBinding { .. }) {
-                focus_main_window(&app_handle_clone);
+                let has_web_admin = {
+                    let admin_state: tauri::State<
+                        '_,
+                        Arc<tokio::sync::RwLock<crate::services::AdminServerState>>,
+                    > = app_handle_clone.state();
+                    let guard = admin_state.read().await;
+                    guard.event_hub.has_sse_subscribers()
+                };
+                if !has_web_admin {
+                    focus_main_window(&app_handle_clone);
+                }
             }
 
             // Map domain events to UI channels
@@ -792,7 +816,6 @@ fn map_domain_event_to_ui(event: &DomainEvent) -> (&'static str, serde_json::Val
             session_id,
             space_id,
             workspace_root,
-            collision_client_id,
             space_locked,
         } => (
             "workspace-needs-binding",
@@ -801,7 +824,6 @@ fn map_domain_event_to_ui(event: &DomainEvent) -> (&'static str, serde_json::Val
                 "session_id": session_id,
                 "space_id": space_id,
                 "workspace_root": workspace_root,
-                "collision_client_id": collision_client_id,
                 "space_locked": space_locked,
             }),
         ),
@@ -861,6 +883,30 @@ fn map_domain_event_to_ui(event: &DomainEvent) -> (&'static str, serde_json::Val
     }
 }
 
+/// Wire OAuth consent notifications to the desktop webview and admin SSE bus.
+pub async fn wire_consent_ui_notifications(
+    app_handle: &AppHandle,
+    gateway_state: &Arc<RwLock<mcpmux_gateway::GatewayState>>,
+    ui_bus: Option<Arc<AdminUiEventBus>>,
+) {
+    let app = app_handle.clone();
+    let ui_bus_for_hook = ui_bus.clone();
+    let hook: mcpmux_gateway::ConsentUiNotifier = Arc::new(move |request_id: &str| {
+        crate::services::ui_events::emit_ui_channel(
+            &app,
+            ui_bus_for_hook.as_deref(),
+            OAUTH_CONSENT_REQUEST_CHANNEL,
+            serde_json::json!({ "requestId": request_id }),
+        );
+    });
+
+    gateway_state.write().await.set_consent_ui_hook(hook);
+    info!(
+        "[Gateway] Consent UI wired (Tauri + SSE={})",
+        ui_bus.is_some()
+    );
+}
+
 /// Create Gateway dependencies from app state using DI builder pattern
 ///
 /// Centralizes dependency construction following Dependency Injection principles.
@@ -1057,6 +1103,7 @@ pub async fn start_gateway(
     let server_manager = server.server_manager();
     let grant_service = server.grant_service();
     let session_roots = server.session_roots();
+    let feature_set_resolver = server.feature_set_resolver();
 
     // Seed the system-wide inbound-auth toggle into the running gateway from
     // persisted settings (default: auth required). Live changes go through
@@ -1122,6 +1169,7 @@ pub async fn start_gateway(
     state.grant_service = Some(grant_service);
     state.approval_broker = Some(approval_broker);
     state.session_roots = Some(session_roots);
+    state.feature_set_resolver = Some(feature_set_resolver);
     info!(
         "[Gateway] Started — url={}, event_emitter={}, grant_service={}",
         url,
@@ -1159,6 +1207,12 @@ pub async fn start_gateway(
             drop(guard);
             let guard2 = admin_guard_clone.read().await;
             register_gateway_sse(&guard2, &gw_state_clone).await;
+            wire_consent_ui_notifications(
+                &app_handle,
+                &gw_state_clone,
+                Some(guard2.ui_event_bus.clone()),
+            )
+            .await;
         }
     }