feat(gateway): Phase 2 — invocation gate + self-bind escape hatch

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-gateway/src/admin/command_bridge/read.rs

@@ -412,23 +412,12 @@ pub async fn get_workspace_effective_features(
             binding.space_id,
             binding.feature_set_ids,
         ),
-        None => {
-            let sets = ctx
-                .services
-                .permission()
-                .list_feature_sets_for_space(&default_space.id.to_string())
-                .await?;
-            let fallback = sets
-                .into_iter()
-                .find(|set| set.feature_set_type.as_str() == "starter")
-                .ok_or_else(|| anyhow!("Default Space has no Starter FeatureSet"))?;
-            (
-                "unbound".to_string(),
-                None,
-                default_space.id,
-                vec![fallback.id],
-            )
-        }
+        None => (
+            "unbound".to_string(),
+            None,
+            default_space.id,
+            vec![],
+        ),
     };
 
     let space = ctx

crates/mcpmux-gateway/src/mcp/handler.rs

@@ -143,6 +143,7 @@ impl McpMuxGatewayHandler {
                     resolved.source,
                     crate::services::ResolutionSource::Deny
                         | crate::services::ResolutionSource::SpaceDefault
+                        | crate::services::ResolutionSource::Unbound
                 );
                 if let (true, Some(sid), Some(space_id), Some(root)) = (
                     should_prompt,
@@ -605,7 +606,7 @@ impl ServerHandler for McpMuxGatewayHandler {
                     // normalized them on insert. Passing `Some(root)`
                     // lets log_and_notify_resolution emit
                     // `WorkspaceNeedsBinding` if the resolver ended
-                    // up at `source = Deny` (i.e. no binding yet).
+                    // up at `source = Deny | Unbound` (i.e. no binding yet).
                     let root_for_prompt =
                         session_roots.get(&session_id_for_task).and_then(|roots| {
                             roots

crates/mcpmux-gateway/src/services/meta_tools/mod.rs

@@ -85,6 +85,7 @@ pub const CORE_META_TOOLS: &[&str] = &[
     "mcpmux_get_tool_schema",
     "mcpmux_list_servers",
     "mcpmux_set_workspace_root",
+    "mcpmux_bind_current_workspace",
 ];
 
 /// Convenience: is this tool name one of ours?

crates/mcpmux-gateway/src/services/meta_tools/token_budget.rs

@@ -159,7 +159,7 @@ mod tests {
         );
         println!("{line}");
 
-        assert_eq!(CORE_META_TOOLS.len(), 5);
+        assert_eq!(CORE_META_TOOLS.len(), 6);
         assert_eq!(ALL_REGISTERED_META_TOOL_NAMES.len(), 12);
         assert!(
             budget.core_claude_est < budget.full_claude_est,

tests/rust/tests/integration/meta_tools.rs

@@ -1923,7 +1923,6 @@ async fn registry_advertises_core_tools_read_only_in_list() {
     }
     for hidden in [
         "mcpmux_list_feature_sets",
-        "mcpmux_bind_current_workspace",
         "mcpmux_search_resources",
         "mcpmux_read_resource",
         "mcpmux_search_prompts",
@@ -1941,6 +1940,14 @@ async fn registry_advertises_core_tools_read_only_in_list() {
             .as_ref()
             .and_then(|a| a.destructive_hint)
             .unwrap_or(false);
+        if tool.name.as_ref() == "mcpmux_bind_current_workspace" {
+            assert!(
+                destructive,
+                "bind must be annotated as a write tool: {:?}",
+                tool.name
+            );
+            continue;
+        }
         assert!(
             !destructive,
             "advertised core tools must be read-only hints: {:?}",
@@ -1950,18 +1957,74 @@ async fn registry_advertises_core_tools_read_only_in_list() {
 }
 
 #[tokio::test(flavor = "multi_thread")]
-async fn hidden_bind_tool_callable_but_not_advertised() {
+async fn unbound_session_lists_bind_current_workspace() {
     let f = Fixture::new().await;
+    let root = "/tmp/mcpmux-unbound-list-tools";
+    f.session_roots.set_roots_capable(&f.session_id, true);
+    f.session_roots.set(&f.session_id, [root]);
+
     let advertised: Vec<_> = f
         .registry
         .list_as_tools()
         .iter()
         .map(|t| t.name.to_string())
         .collect();
-    assert!(!advertised
+    assert!(
+        advertised.iter().any(|n| n == "mcpmux_bind_current_workspace"),
+        "Unbound sessions must advertise bind in tools/list: {advertised:?}"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn unbound_session_invoke_tool_returns_bind_denial_hint() {
+    let f = Fixture::new().await;
+    let root = "/tmp/mcpmux-unbound-invoke-denial";
+    f.session_roots.set_roots_capable(&f.session_id, true);
+    f.session_roots.set(&f.session_id, [root]);
+
+    let result = f
+        .registry
+        .call(
+            "mcpmux_invoke_tool",
+            &f.client_id,
+            Some(&f.session_id),
+            json!({ "server_id": "github", "tool": "create_issue" }),
+        )
+        .await
+        .unwrap();
+    assert!(
+        Fixture::is_error(&result),
+        "backend invoke must be denied for Unbound sessions"
+    );
+    let body = Fixture::result_json(&result);
+    assert_eq!(
+        body.get("error").and_then(|v| v.as_str()),
+        Some("not_ready")
+    );
+    assert_eq!(
+        body.get("reason").and_then(|v| v.as_str()),
+        Some("inactive")
+    );
+    assert_eq!(
+        body.get("tool").and_then(|v| v.as_str()),
+        Some("mcpmux_bind_current_workspace")
+    );
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn hidden_list_feature_sets_callable_but_not_advertised() {
+    let f = Fixture::new().await;
+    let advertised: Vec<_> = f
+        .registry
+        .list_as_tools()
         .iter()
-        .any(|n| n == "mcpmux_bind_current_workspace"));
-    assert!(f.registry.contains("mcpmux_bind_current_workspace"));
+        .map(|t| t.name.to_string())
+        .collect();
+    assert!(
+        !advertised.iter().any(|n| n == "mcpmux_list_feature_sets"),
+        "list_feature_sets stays off tools/list"
+    );
+    assert!(f.registry.contains("mcpmux_list_feature_sets"));
 
     let result = f
         .registry