merge: resolve upstream main conflicts against client-mapping reconciliation

Merges upstream mcpmux/mcp-mux main (through #215) into dev-rebased.
Resolves conflicts between upstream's original #201/#202/#203/#205/#206
implementations and this fork's own reconciled port (Phases 1-4 of
upstream-client-mapping-reconciliation.md) by keeping the fork's version
wherever the two implement the same feature:

- Migrations: kept 036-038 (fork numbering/shape); removed upstream's
  020_inbound_client_api_keys.sql / 021_binding_type.sql /
  022_inbound_client_locked_space.sql as superseded (Decision 6 — one
  reconciled migration set, not a straight append)
- Resolver, repositories, domain, Tauri commands, Clients/Workspaces UI:
  kept the fork's Unbound-preserving, Tier 0/2 implementation over
  upstream's SpaceDefault-based one (Decisions 1/2)
- navigation.ts / HomePage.tsx: kept the fork's nav (Decision 5 — no
  Apps->Clients / Workspaces->Mapping rename); HomePage.tsx stays deleted
  (already removed by the fork's earlier Dashboard-unification commit,
  unrelated to this merge)
- Took upstream's unrelated CI hardening (apt cache pinning, Claude
  Code Actions workflow) and its new API-key e2e test as-is

Autonomous decisions:
- Fixed tests/rust/tests/database/migrations.rs upgrade-path regression
  test to reference migration 036/037/038 (not upstream's 020/021/022)
  and drop the partial indexes migration 037 creates before dropping
  the binding_type column, or the rollback step fails
- Fixed 3 e2e specs asserting upstream's rejected nav rename ('Mapping')
  to assert the fork's real label ('Projects') instead

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

.github/actions/install-linux-deps/action.yml

@@ -13,18 +13,30 @@ runs:
   using: composite
   steps:
     # Cache apt packages to avoid re-downloading on every run
+    # The runner image ships an apt index from its build date, and
+    # cache-apt-pkgs-action's own refresh (update_apt_lists_if_stale) is a
+    # no-op outside nektos/act -- it guards on ACT=true. A stale index names
+    # .debs that Ubuntu has since superseded and dropped from the pool, so the
+    # install 404s; the action then caches the empty result instead of failing,
+    # and every later run restores that as a hit and skips installing at all.
+    - name: Refresh apt lists
+      shell: bash
+      run: sudo apt-get update
+
+    # Pinned to a SHA: `@latest` is a moving tag, so a broken upstream release
+    # (e.g. v1.6.2) would otherwise roll straight into CI unreviewed.
     - name: Cache apt packages (base)
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
       with:
         packages: build-essential pkg-config libglib2.0-dev libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libsecret-1-dev libfuse2
-        version: 1.1
+        version: 1.2
 
     - name: Cache apt packages (E2E)
       if: ${{ inputs.e2e == 'true' }}
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
       with:
         packages: webkit2gtk-driver xvfb gnome-keyring gsettings-desktop-schemas dbus-x11 at-spi2-core libglib2.0-bin libwayland-server0 libwayland-client0
-        version: 1.3
+        version: 1.4
 
     # Compile gsettings schemas (required after restore from cache)
     - name: Compile gsettings schemas

.github/workflows/ci.yml

@@ -17,6 +17,7 @@ permissions:
   actions: read
   checks: write
   pull-requests: write
+  id-token: write
 
 env:
   CARGO_TERM_COLOR: always

.github/workflows/claude.yml

@@ -0,0 +1,50 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr *)'
+

tests/e2e/specs/app.wdio.ts

@@ -56,7 +56,7 @@ describe('McpMux Application', () => {
     await safeClick(clientsButton);
     await browser.pause(1500);
     const pageSource = await browser.getPageSource();
-    expect(pageSource.includes('Apps') || pageSource.includes('clients-page')).toBe(true);
+    expect(pageSource.includes('Clients') || pageSource.includes('clients-page')).toBe(true);
   });
 
   it('should navigate to FeatureSets page', async () => {

tests/e2e/specs/clients.wdio.ts

@@ -22,10 +22,10 @@ describe('Connections - Page shell', () => {
     const pageSource = await browser.getPageSource();
 
     // Heading has been renamed.
-    expect(pageSource.includes('Apps')).toBe(true);
+    expect(pageSource.includes('Clients')).toBe(true);
 
-    // The page routes users to Workspaces for any routing questions.
-    expect(pageSource.includes('Workspaces')).toBe(true);
+    // The page routes users to the Projects tab for any routing questions.
+    expect(pageSource.includes('Projects')).toBe(true);
   });
 
   it('TC-CL-002: Open side panel and verify legacy routing controls are gone', async () => {
@@ -57,4 +57,32 @@ describe('Connections - Page shell', () => {
       expect(pageSource.includes("Let's hook up your first IDE")).toBe(true);
     }
   });
+
+  it('TC-CL-003: Register an API-key client and reveal the key once', async () => {
+    // The desktop app auto-starts the gateway, so register_api_key_client can
+    // mint a key. Open the Apps tab, register a client, and confirm the
+    // generated mcpk_ key is shown exactly once.
+    const connectionsBtn = await byTestId('nav-clients');
+    await connectionsBtn.click();
+    await browser.pause(1000);
+
+    const registerBtn = await byTestId('register-api-key-client-btn');
+    await registerBtn.click();
+    await browser.pause(800);
+
+    const nameInput = await byTestId('register-api-key-name');
+    await nameInput.setValue('e2e-headless-bot');
+
+    const generateBtn = await byTestId('register-api-key-generate');
+    await generateBtn.click();
+    await browser.pause(1500);
+
+    await browser.saveScreenshot('./tests/e2e/screenshots/cl-03-api-key-created.png');
+
+    const keyEl = await byTestId('register-api-key-value');
+    await expect(keyEl).toBeDisplayed();
+    const keyText = await keyEl.getText();
+    // Shown once, prefixed mcpk_ (never the stored hash).
+    expect(keyText.startsWith('mcpk_')).toBe(true);
+  });
 });

tests/e2e/specs/navigation.spec.ts

@@ -30,9 +30,9 @@ test.describe('Navigation', () => {
     await page.locator('nav button:has-text("Search")').click({ force: true });
     await expect(page.locator('h1:has-text("Discover Servers")')).toBeVisible();
 
-    // Spaces (use last() to avoid space switcher)
-    await page.locator('nav button:has-text("Spaces")').last().click({ force: true });
-    await expect(page.locator('h1:has-text("Workspaces")')).toBeVisible();
+    // Projects (the folder → bundle mapping tab)
+    await page.locator('nav button:has-text("Projects")').last().click({ force: true });
+    await expect(page.locator('h1:has-text("Projects")')).toBeVisible();
 
     // FeatureSets
     await page.locator('nav button:has-text("Bundles")').click({ force: true });

tests/e2e/specs/user-flows.spec.ts

@@ -44,9 +44,9 @@ test.describe('Complete User Flows', () => {
     await page.locator('nav button:has-text("Search")').click();
     await expect(page.locator('h1:has-text("Discover Servers")')).toBeVisible();
 
-    // Spaces (use last() to avoid space switcher)
-    await page.locator('nav button:has-text("Spaces")').last().click();
-    await expect(page.locator('h1:has-text("Workspaces")')).toBeVisible();
+    // Projects (the folder → bundle mapping tab)
+    await page.locator('nav button:has-text("Projects")').last().click();
+    await expect(page.locator('h1:has-text("Projects")')).toBeVisible();
 
     // FeatureSets
     await page.locator('nav button:has-text("Bundles")').click();

tests/rust/tests/database/migrations.rs

@@ -151,3 +151,89 @@ fn test_018_rewrites_stale_starter_description_only() {
         "operator-customized copy must be preserved"
     );
 }
+
+// ---------------------------------------------------------------------------
+// Upgrade path — applying NEW migrations to an EXISTING (older) on-disk DB.
+//
+// Every other test here uses a FRESH in-memory DB, where all migrations run at
+// once — so they never catch a migration that fails to apply when a real user
+// opens a database created by a previous release. These two do.
+// ---------------------------------------------------------------------------
+
+fn table_exists(db: &Database, name: &str) -> bool {
+    db.connection()
+        .query_row(
+            "SELECT COUNT(*) > 0 FROM sqlite_master WHERE type='table' AND name=?1",
+            [name],
+            |r| r.get::<_, bool>(0),
+        )
+        .unwrap_or(false)
+}
+
+fn column_exists(db: &Database, table: &str, column: &str) -> bool {
+    let sql = format!("SELECT COUNT(*) > 0 FROM pragma_table_info('{table}') WHERE name=?1");
+    db.connection()
+        .query_row(&sql, [column], |r| r.get::<_, bool>(0))
+        .unwrap_or(false)
+}
+
+#[test]
+fn test_new_schema_objects_exist_after_migration() {
+    // A fresh migrate must produce every object the API-key + mapping features
+    // depend on — a regression guard against a migration being dropped or broken.
+    let db = Database::open_in_memory().expect("open");
+    assert!(
+        table_exists(&db, "inbound_client_api_keys"),
+        "migration 036 must create inbound_client_api_keys"
+    );
+    assert!(
+        column_exists(&db, "workspace_bindings", "binding_type"),
+        "migration 037 must add workspace_bindings.binding_type"
+    );
+    assert!(
+        column_exists(&db, "inbound_clients", "locked_space_id"),
+        "migration 038 must add inbound_clients.locked_space_id"
+    );
+}
+
+#[test]
+fn test_pending_migrations_apply_to_an_existing_older_database() {
+    // Reproduce the real upgrade that surfaced "no such table:
+    // inbound_client_api_keys" in the field: a DB created before 036/037/038
+    // existed, reopened by a newer build. The pending migrations MUST apply.
+    let dir = tempfile::tempdir().expect("tempdir");
+    let path = dir.path().join("mcpmux.db");
+
+    // 1. Fully migrate, then roll the schema back to a pre-036 state.
+    {
+        let db = Database::open(&path).expect("open");
+        db.connection()
+            .execute_batch(
+                "DELETE FROM schema_migrations WHERE version >= 36;
+                 DROP TABLE IF EXISTS inbound_client_api_keys;
+                 DROP INDEX IF EXISTS idx_wb_root_global;
+                 DROP INDEX IF EXISTS idx_wb_root_machine;
+                 DROP INDEX IF EXISTS idx_wb_root_scoped;
+                 DROP INDEX IF EXISTS idx_wb_id_global;
+                 DROP INDEX IF EXISTS idx_wb_id_machine;
+                 DROP INDEX IF EXISTS idx_workspace_bindings_binding_type;
+                 DROP INDEX IF EXISTS idx_inbound_clients_locked_space_id;
+                 ALTER TABLE workspace_bindings DROP COLUMN binding_type;
+                 ALTER TABLE inbound_clients DROP COLUMN locked_space_id;",
+            )
+            .expect("roll schema back to pre-036");
+        assert!(
+            !table_exists(&db, "inbound_client_api_keys"),
+            "precondition: the rolled-back DB is missing the table"
+        );
+    }
+
+    // 2. Reopen — run_migrations() must re-apply 036/037/038.
+    let db = Database::open(&path).expect("reopen older DB");
+    assert!(
+        table_exists(&db, "inbound_client_api_keys"),
+        "reopening an older DB must re-create inbound_client_api_keys"
+    );
+    assert!(column_exists(&db, "workspace_bindings", "binding_type"));
+    assert!(column_exists(&db, "inbound_clients", "locked_space_id"));
+}

tests/ts/components/WorkspaceSetupWizard.test.tsx

@@ -81,6 +81,7 @@ describe('WorkspaceSetupWizard', () => {
       workspace_root: '/proj/app',
       space_id: 's1',
       feature_set_ids: ['fs_starter'],
+      binding_type: 'path',
     });
     // The parent navigates to the new mapping's inspector (effective features);
     // the wizard itself does not close.