mcpgawk 0.1.73__tar.gz → 0.1.74__tar.gz

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mcpgawk",
   "description": "Measure the MCP servers your agent calls, record the tool surface you approved, and refuse a changed tool until a person has looked. Local-first.",
-  "version": "0.1.72",
+  "version": "0.1.73",
   "author": {
     "name": "Nativerse",
     "email": "hello@nativerse-ventures.com"
@@ -27,7 +27,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mcpgawk==0.1.72",
+        "mcpgawk==0.1.73",
         "mcpgawk",
         "mcp"
       ]

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/.github/workflows/bare-machine-install.yml

@@ -53,8 +53,11 @@ jobs:
         route:
           - name: uv-tool
             install: uv tool install mcpgawk
+            # Used only when PyPI's index still lags a release that just went out (see below).
+            reinstall: uv tool install --force --refresh mcpgawk
           - name: pipx
             install: pipx install mcpgawk && pipx ensurepath
+            reinstall: pipx install --force --pip-args=--no-cache-dir mcpgawk
     name: ${{ matrix.route.name }}
     steps:
       # The container's default step shell is `sh` (dash), and dash rejects `set -o pipefail` —
@@ -126,9 +129,20 @@ jobs:
           with urllib.request.urlopen('https://pypi.org/pypi/mcpgawk/json', timeout=30) as r:
               print(json.load(r)['info']['version'])")
           echo "installed=$INSTALLED published=$published"
+          # Right after a release the JSON API names the new version minutes before the simple
+          # index installers read serves it (measured ~10-13 min, 0.1.65 and 0.1.71), so this job,
+          # triggered by the publish, failed on every release day with nothing wrong. Wait it out:
+          # reinstall without caches for up to ~20 min. A real failure still fails, just later.
+          for attempt in 1 2 3 4 5 6 7 8; do
+            [ "$INSTALLED" = "$published" ] && break
+            echo "attempt $attempt: installed $INSTALLED, PyPI JSON says $published; index lag? retrying in 150 s"
+            sleep 150
+            su - tester -c 'export PATH="$HOME/.local/bin:$PATH"; ${{ matrix.route.reinstall }}' || true
+            INSTALLED=$(su - tester -c 'mcpgawk --version' 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+          done
           [ "$INSTALLED" = "$published" ] || {
             echo "::error::installed $INSTALLED but PyPI serves $published — the documented command"
-            echo "does not give a tester the current release."
+            echo "does not give a tester the current release (still true after ~20 min of retries)."
             exit 1; }
 
       - name: The shipped --help must list the free commands

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/.mcp.json

@@ -4,7 +4,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mcpgawk==0.1.72",
+        "mcpgawk==0.1.73",
         "mcpgawk",
         "mcp"
       ]

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.73
+Version: 0.1.74
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev/docs

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.73"
+version = "0.1.74"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/server.json

@@ -8,12 +8,12 @@
     "url": "https://github.com/gawk-dev/mcpgawk",
     "source": "github"
   },
-  "version": "0.1.73",
+  "version": "0.1.74",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "mcpgawk",
-      "version": "0.1.73",
+      "version": "0.1.74",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/src/mcpgawk/baseline.py

@@ -277,7 +277,9 @@ def publish(key: str, *, pin: str, tools: dict[str, str], approved_at: str,
             # the old surface; this call is replacing the pin and the tool set. Carrying them over
             # would enforce yesterday's labels on today's tools, which reads as coverage and is not.
             record.pop("annotations", None)
+        history.keep_original(entry, record, "approve")
         entry["approved"] = record
+        history.clear_review(entry)           # the held change is answered by this approval
         entry["approved_via"] = "approve"     # gated by require_human_approval above
         entry["approved_evidence"] = evidence
         if alias:

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/src/mcpgawk/cli.py

@@ -2150,6 +2150,16 @@ def _staleness_advisory() -> None:
         pass
 
 
+def _print_held_change(shown: str, key: str, held: dict, report) -> None:
+    """A server back to its approved form after a change since approval: say so, show the change it
+    made, and how to accept it. The guard holds its changed tools until then (history.held_sighting)."""
+    at = str(held.get("measured_at") or "")[:10] or "an earlier scan"
+    print(f"\n  ⚠ {shown}: matches your baseline now, but it CHANGED on {at} and changed back "
+          f"since. Its changed tools stay blocked until you approve. What it changed to:")
+    print(drift.render(shown, report))
+    _print_accept(key)
+
+
 def _scan_failed(labels: list, drift_reports: dict, reidentified: dict) -> bool:
     """The scan's exit-code decision — one answer for --json, --fleet-json and the terminal view.
 
@@ -2363,6 +2373,7 @@ def _dispatch(argv: list[str] | None = None) -> int:
     # name -> the store key, so a drift block can print the exact `approve` command: the name shown
     # for an ad-hoc scan ("cli-stdio") is deliberately not resolvable (new-developer walk, 2026-09-26).
     drift_keys: dict[str, str] = {}
+    seen_keys: dict[str, str] = {}          # every server recorded this run -> its store key
     pin_notes: dict[str, str] = {}          # servers whose pin this build cannot compare
     new_baselines: list[str] = []
     reidentified: dict[str, str] = {}
@@ -2393,6 +2404,7 @@ def _dispatch(argv: list[str] | None = None) -> int:
                                        "changes are measured from that")
             if seen_now.previous is None and not seen_now.appeared:
                 new_baselines.append(sn.name)
+            seen_keys[sn.name] = seen_now.key
             if seen_now.report and seen_now.report.any:
                 drift_reports[sn.name] = seen_now.report
                 drift_keys[sn.name] = seen_now.key
@@ -2403,6 +2415,23 @@ def _dispatch(argv: list[str] | None = None) -> int:
                 # that skipped the exact anchor, which is this product's failure mode.
                 pin_notes[sn.name] = seen_now.report.pin_not_compared
 
+    # THE LATCH, said where a person looks. A server back to its approved form after a change since
+    # approval matches its baseline now, so it has no drift report, but the guard still holds the
+    # tools that changed and `status`/`approve --list` list it. Without this, scan printed
+    # "✓ no change since your baseline" under status's "changed — blocked; Review: mcpgawk scan"
+    # (measured 2026-10-08). Same exit as drift: an unanswered change is not a clean run.
+    held_changes: dict[str, tuple] = {}
+    if seen_keys:
+        _st = history.load()
+        for _nm, _k in seen_keys.items():
+            if _nm in drift_reports:
+                continue
+            _held = history.held_sighting(_st, _k)
+            if _held is None or history.sighting_to_review(_st, _k) is not _held:
+                continue
+            _rep = drift.compare(history.approved(_st, _k), _held)
+            if _rep is not None and _rep.any:
+                held_changes[_nm] = (_k, _held, _rep)
     # Drift must reach the MACHINE-READABLE output and the exit code, not only the pretty print.
     # A rug-pull that a CI job can't see is a rug-pull that ships: `--json` consumers and pipeline
     # gates were previously blind to it.
@@ -2427,11 +2456,19 @@ def _dispatch(argv: list[str] | None = None) -> int:
             # No DriftReport exists for a re-identification, so a JSON consumer would see nothing
             # at all — the same blindness the exit code had.
             lab["x-mcpgawk"]["reidentified_from"] = reidentified[lab["name"]]
+        if lab["name"] in held_changes:
+            # THE LATCH in the document too: --json exited 1 with nothing saying why. The change the
+            # server made and reverted, in the same shape as `drift`, plus when it was seen.
+            _k, _held, _rep = held_changes[lab["name"]]
+            hd = asdict(_rep)
+            hd["changed_back"] = True
+            hd["changed_at"] = _held.get("measured_at")
+            lab["x-mcpgawk"]["held_change"] = hd
 
     # ONE exit code for both output modes (see _scan_failed). `--json` used to `return 0`
     # unconditionally — so a failed probe or a detected rug-pull reported success to CI, the same
     # class of lie as a false CLEAN.
-    failed = _scan_failed(labels, drift_reports, reidentified)
+    failed = _scan_failed(labels, drift_reports, reidentified) or bool(held_changes)
 
     if args.json:
         print(json.dumps(labels, indent=2))
@@ -2489,6 +2526,8 @@ def _dispatch(argv: list[str] | None = None) -> int:
                 origins={n: r.baseline_origin for n, r in drift_reports.items()}))
             for name in sorted(drift_reports):
                 print(drift.render(name, drift_reports[name]))
+        for name in sorted(held_changes):
+            _print_held_change(name, *held_changes[name])
         print()
         print(fleet.render_fleet(rows))
         # The per-server narrative is a deliberate --detail away here, so a multi-server overview
@@ -2583,6 +2622,8 @@ def _dispatch(argv: list[str] | None = None) -> int:
             if rep:
                 print(drift.render(shown, rep))
                 _print_accept(drift_keys.get(name))
+            elif name in held_changes:
+                _print_held_change(shown, *held_changes[name])
             continue
         if name in reidentified:
             print(f"\n  ⛔ {shown} now identifies itself as a DIFFERENT server "
@@ -2594,6 +2635,8 @@ def _dispatch(argv: list[str] | None = None) -> int:
             # rest of the surface — unchanged since approval — stays behind --full.
             print("\n" + drift.render(shown, rep))
             _print_accept(drift_keys.get(name))
+        elif name in held_changes:
+            _print_held_change(shown, *held_changes[name])
         elif name in appeared:
             # Never "no change since your baseline": it has none. Named in the block below.
             print("\n" + render_cli(lab, verbose=False, shown=shown))

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/src/mcpgawk/decide.py

@@ -51,16 +51,23 @@ def pending_decisions(store: dict[str, Any]) -> list[dict[str, Any]]:
     and the page cannot disagree with `mcpgawk status` about what is outstanding."""
     out: list[dict[str, Any]] = []
     for key in history.pending(store):
-        approved, latest = history.approved(store, key), history.last(store, key)
+        # The sighting to REVIEW, not merely the last: a change that reverted is still shown as the
+        # change it was (history.sighting_to_review, the one rule pending() uses too).
+        approved, latest = history.approved(store, key), history.sighting_to_review(store, key)
         if not approved or not latest:
             continue
         report = drift.compare(approved, latest)
         if report is None:
             continue
+        entry = (store.get("servers") or {}).get(key) or {}
         out.append({
             "key": key,
             "name": history.display_name(store, key),
             "report": report,
+            # The step (since the current approval) and the TOTAL (since the original baseline):
+            # a widening in small steps is invisible in the step alone. None when they coincide.
+            "since_last": history.approval_change(approved, latest),
+            "since_original": history.since_original(entry, latest),
             "hostile": list(report.hostile),
             "seen_at": latest.get("seen") or "",
         })
@@ -157,6 +164,13 @@ def _diff_block(report: drift.DriftReport) -> str:
     return "\n".join(rows) or '<div class="ev"><div class="lbl">No detail recorded.</div></div>'
 
 
+def _total_line(total: Any) -> str:
+    """The change since the ORIGINAL baseline, under the step: what trusting this makes the server,
+    measured from where it started. Empty when the step is the whole story."""
+    words = history.original_words(total)
+    return f'<p class="sub"><b>In total</b>, {_esc(words)}.</p>' if words else ""
+
+
 def render_page(items: list[dict[str, Any]], token: str, note: str = "",
                 gaps: dict[str, Any] | None = None) -> str:
     """The whole UI. One file, no assets, no network — it must work on a machine with no internet
@@ -200,6 +214,7 @@ def render_page(items: list[dict[str, Any]], token: str, note: str = "",
   <p class="sub">Changed after you approved it{(' · last seen ' + _esc(it['seen_at'])) if it['seen_at'] else ''}.
      Your agents cannot call it until you decide.</p>
   {_diff_block(r)}
+  {_total_line(it.get('since_original'))}
   {(f'''<form method="POST" action="/decide">
     <input type="hidden" name="token" value="{_esc(token)}">
     <input type="hidden" name="key" value="{_esc(it['key'])}">

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/src/mcpgawk/decision.py

@@ -76,7 +76,8 @@ def declared_verdict(server: str, tool: str,
                      args: dict | None = None,
                      approved_props: list[str] | None = None,
                      seen_at: str | None = None,
-                     permission_changes: list[str] | None = None) -> tuple[str, str, str | None]:
+                     permission_changes: list[str] | None = None,
+                     reverted: dict | None = None) -> tuple[str, str, str | None]:
     """The declared-tier decision: `(decision, basis, reason)`.
 
     `approved` is the `{tool: hash}` mapping the human approved for this server, or None when
@@ -98,8 +99,11 @@ def declared_verdict(server: str, tool: str,
     (`gateway.set_live_tools`). The free hook cannot list the server per call; since 2026-09-05 it
     passes the hash from the LAST SIGHTING the projection carries (`seen`, written by every scan
     and by the monitor daemon) with `seen_at`, and the reason says so — a deny on the last
-    sighting is not a deny on this call: a drift not yet seen passes until the next scan, and a
-    server that reverted stays denied until it is seen again.
+    sighting is not a deny on this call: a drift not yet seen passes until the next scan.
+
+    `reverted` is THE LATCH (2026-10-08): this tool changed at an earlier sighting since approval
+    (`{"at": when}`) and is back to its approved form now. It stays denied until a person approves
+    again — a change that reverted before the next scan is still a change the person never saw.
     """
     if approved is None:
         return DEFER, BASIS_DECLARED, None
@@ -117,6 +121,10 @@ def declared_verdict(server: str, tool: str,
     if permission_changes:
         return DENY, BASIS_DECLARED, permission_changed_reason(server, tool, permission_changes,
                                                                seen_at)
+    if reverted:
+        return DENY, BASIS_DECLARED, reverted_reason(server, tool,
+                                                     reverted.get("at") if isinstance(reverted, dict)
+                                                     else None)
     # THE SMUGGLED FIELD. A schema widened after approval breaks nothing by itself and is left
     # to the Decisions queue; the deny fires only at the moment the attack becomes real — this
     # call is FILLING a parameter the human never approved, and it is credential-shaped
@@ -151,7 +159,8 @@ def verdict(server: str, tool: str, approved: dict[str, str] | None,
             args: dict | None = None,
             approved_props: list[str] | None = None,
             seen_at: str | None = None,
-            permission_changes: list[str] | None = None) -> tuple[str, str, str | None]:
+            permission_changes: list[str] | None = None,
+            reverted: dict | None = None) -> tuple[str, str, str | None]:
     """The WHOLE decision: declared tier first, then the behavioural tier — composed
     positive-only, exactly like the paid gateway's profile handling (CONSTRAINTS §2 row 1).
 
@@ -170,7 +179,8 @@ def verdict(server: str, tool: str, approved: dict[str, str] | None,
     decision, basis, reason = declared_verdict(server, tool, approved, live_hash,
                                                args=args, approved_props=approved_props,
                                                seen_at=seen_at,
-                                               permission_changes=permission_changes)
+                                               permission_changes=permission_changes,
+                                               reverted=reverted)
     if decision == DENY:
         return decision, basis, reason
 
@@ -247,6 +257,24 @@ def permission_changed_reason(server: str, tool: str, changes: list[str],
     )
 
 
+def reverted_reason(server: str, tool: str, at: str | None = None) -> str:
+    """The denial for THE LATCH: the tool changed after approval and changed back. Same properties
+    and the same classifying phrase as `changed_reason` (REASON_TOOL_CHANGED)."""
+    when = f"on {at[:10]}" if isinstance(at, str) and at else "at an earlier sighting"
+    return (
+        f"SECURITY BLOCK (mcpgawk). '{tool}' on MCP server '{server}' has CHANGED since you "
+        f"approved it — it was seen changed {when} and changed back since. A tool that changes "
+        f"and then reverts before anyone looks is still a change you never reviewed.\n"
+        f"This decision is final for this session. Do not retry it, do not call a different "
+        f"tool to achieve the same thing, and do not run any mcpgawk command to change the "
+        f"baseline — approval requires the person at the keyboard, and attempting it from "
+        f"inside an agent session is itself treated as a red flag.\n"
+        f"Tell the user exactly this: the MCP server '{server}' changed the tool '{tool}' after "
+        f"they approved it and changed it back, mcpgawk blocked the call, and they should run "
+        f"`mcpgawk decide` themselves to read what changed before deciding whether to trust it."
+    )
+
+
 #: Machine-readable codes for the denials this module emits — classified HERE, by the module that
 #: owns the wording, so no renderer ever pattern-matches prose it does not control.
 REASON_TOOL_ADDED = "tool-added"

{mcpgawk-0.1.73 → mcpgawk-0.1.74}/src/mcpgawk/guard_hook.py

@@ -273,6 +273,24 @@ def _approved_from_projection(server: str,
     return (dict(tools) if isinstance(tools, dict) else None), note
 
 
+def projected_evidence(server: str, store_path: Path) -> dict[str, tuple]:
+    """`{tool: (permission_changes, reverted)}` for one server, from the SAME projection row the hook
+    judges by — for the paid gateway, so it refuses what the hook refuses (permission growth since
+    approval, and the latch). Empty when there is no row; never raises."""
+    try:
+        record, _note = _record_from_projection(server, store_path)
+    except Exception:                               # noqa: BLE001 — evidence is optional, never a crash
+        return {}
+    if not isinstance(record, dict) or not isinstance(record.get("tools"), dict):
+        return {}
+    out: dict[str, tuple] = {}
+    for tool in record["tools"]:
+        _a, _p, _s, _at, grown, reverted = _row_evidence(record, tool)
+        if grown or reverted:
+            out[tool] = (grown, reverted)
+    return out
+
+
 def tools_comparable(server: str, store_path: Path) -> bool:
     """Whether this server's approved per-tool hashes may be compared with hashes WE compute.
 
@@ -552,9 +570,9 @@ def _resolve_over_approved_only(server: str,
 
 def _row_evidence(record: dict | None, tool: str):
     """`(approved {tool: hash}, approved props for this tool, last-seen hash, seen_at, permission
-    changes since approval)` from one projection row. All None for no row."""
+    changes since approval, reverted hold)` from one projection row. All None for no row."""
     if record is None:
-        return None, None, None, None, None
+        return None, None, None, None, None, None
     _tools = record.get("tools")
     approved = dict(_tools) if isinstance(_tools, dict) else None
     seen_hash = seen_at = approved_props = None
@@ -575,13 +593,25 @@ def _row_evidence(record: dict | None, tool: str):
     _pc = record.get("permission_changes")
     if isinstance(_pc, dict) and isinstance(_pc.get(tool), list):
         grown = [str(x) for x in _pc[tool] if x] or None
-    return approved, approved_props, seen_hash, seen_at, grown
+    # THE LATCH: changed at an earlier sighting since approval, back to approved now (history.py).
+    reverted = None
+    _rv = record.get("reverted")
+    if isinstance(_rv, dict) and isinstance(_rv.get(tool), dict):
+        reverted = {"at": _rv[tool].get("at") if isinstance(_rv[tool].get("at"), str) else None}
+    return approved, approved_props, seen_hash, seen_at, grown, reverted
 
 
 def _judge(core, server: str, tool: str, record: dict | None, observations, sources, args):
     """`core.verdict` against ONE projection row, tolerant of an older decision core."""
-    approved, approved_props, seen_hash, seen_at, grown = _row_evidence(record, tool)
+    approved, approved_props, seen_hash, seen_at, grown, reverted = _row_evidence(record, tool)
     args = args if isinstance(args, dict) else None
+    if reverted:
+        try:
+            return core.verdict(server, tool, approved, observations, sources,
+                                live_hash=seen_hash, args=args, approved_props=approved_props,
+                                seen_at=seen_at, permission_changes=grown, reverted=reverted)
+        except TypeError:
+            pass   # an older decision core: fall through, the hold is not enforced by it
     try:
         return core.verdict(server, tool, approved, observations, sources, live_hash=seen_hash,
                             args=args, approved_props=approved_props, seen_at=seen_at,
@@ -657,7 +687,7 @@ def _decide(event: dict, store_path: Path | None,
     store = store_path or history_path()
     record, note, strict_refuse, others = _lookup(
         server, store, rewritten=fmt not in RAW_SERVER_NAME_FORMATS)
-    approved, _props, _seen, seen_at, _grown = _row_evidence(record, tool)
+    approved, _props, _seen, seen_at, _grown, _reverted = _row_evidence(record, tool)
 
     # The verdict itself comes from the shared decision core — the paid gateway evaluates the SAME
     # functions, so the paths cannot drift apart. If the core cannot be loaded we cannot compute a