mcpgawk 0.1.74__tar.gz → 0.1.76__tar.gz

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mcpgawk",
   "description": "Measure the MCP servers your agent calls, record the tool surface you approved, and refuse a changed tool until a person has looked. Local-first.",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "author": {
     "name": "Nativerse",
     "email": "hello@nativerse-ventures.com"
@@ -27,7 +27,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mcpgawk==0.1.73",
+        "mcpgawk==0.1.75",
         "mcpgawk",
         "mcp"
       ]

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/.mcp.json

@@ -4,7 +4,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "mcpgawk==0.1.73",
+        "mcpgawk==0.1.75",
         "mcpgawk",
         "mcp"
       ]

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.74
+Version: 0.1.76
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev/docs

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.74"
+version = "0.1.76"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/server.json

@@ -8,12 +8,12 @@
     "url": "https://github.com/gawk-dev/mcpgawk",
     "source": "github"
   },
-  "version": "0.1.74",
+  "version": "0.1.76",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "mcpgawk",
-      "version": "0.1.74",
+      "version": "0.1.76",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/src/mcpgawk/cli.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import argparse
 import asyncio
 import concurrent.futures as _futures
+import contextlib
 import json
 import os
 import re
@@ -1616,19 +1617,25 @@ def _protect() -> int:
             # compares against LAUNCH_ALL: it happens to behave like remote-only today, and would
             # diverge silently the moment anything compared against REMOTE_ONLY instead.
             choice = protect.REMOTE_ONLY
-    if choice == protect.LAUNCH_ALL:
-        scan_args.append("--yes")
-        # We just asked, with more detail than the scan's own gate gives. Tell it not to ask again.
-        from .consent import CONSENT_GIVEN_ENV
-        os.environ[CONSENT_GIVEN_ENV] = "1"
+    # We just asked, with more detail than the scan's own gate gives. Tell it not to ask again —
+    # through a process-local flag around the one dispatch below, NOT --yes and NOT the env.
+    # --yes also means "never prompt" to the scan's batched OAuth offer, so the bare command
+    # silently dropped the sign-in step for every server that needed one and then printed
+    # "re-run in a terminal without --yes" to a user who had typed neither (2026-10-09).
+    # Consent to launch local code and consent to open a browser are two questions; the flag
+    # was answering both. And an env would be inherited by the panel this process may serve.
+    _consented = choice == protect.LAUNCH_ALL
 
     # This run turns checking on and reports it below, agent by agent. The scan's own "not
     # checking yet — run `mcpgawk`" nudge would tell the user to run what they just ran, and on a
     # first run it fires before the hooks exist, contradicting "Protected: N" a few lines down.
     global _IN_PROTECT_RUN
     _IN_PROTECT_RUN = True
+    # The consent the person just gave covers THIS scan and nothing after it.
+    from . import consent as _consent
     try:
-        rc = _dispatch(scan_args)
+        with (_consent.front_door_consent() if _consented else contextlib.nullcontext()):
+            rc = _dispatch(scan_args)
     finally:
         _IN_PROTECT_RUN = False
 
@@ -1681,6 +1688,14 @@ def _protect() -> int:
     _unchecked = ([(n, "not launched — this run checked remote servers only")
                    for n in sorted(local_servers)]
                   if choice == protect.REMOTE_ONLY else [])
+    # ON EVERY CONSENT CHOICE, the servers this run could not measure for want of a sign-in: the
+    # scan records them (remote_login.record_auth_needed) and nothing here read that record, so
+    # four credential-blocked servers fell out of the closing report entirely (2026-10-09).
+    from . import remote_login as _rl
+    _aside = _rl.signin_aside()
+    for _n in sorted(_rl.auth_needed()):
+        _unchecked.append((_n, "set aside by you — not measured" if _n in _aside
+                           else "needs your sign-in — not measured this run"))
     print(protect.protection_report(store, guard_line, unchecked=_unchecked))
     # ONBOARDING STAGE 5 ([FOUNDER] 2026-08-15: onboarding ends at protect + PANEL, and the
     # first run offers the bridge): until now the flow finished and the control surface was
@@ -2337,7 +2352,10 @@ def _dispatch(argv: list[str] | None = None) -> int:
     #                         the agent uses server B's trusted tool.
     shadow: dict = {}
     if not args.no_signals:
-        shadow = detect_shadowing(snaps)
+        # Scoped to servers that share a client (discover's `_clients`): the same server in two
+        # agents is not shadowing itself (kite / kite#2, 2026-10-09).
+        shadow = detect_shadowing(snaps, clients={n: (e or {}).get("_clients") or ()
+                                                  for n, e in entries.items()})
         for srv, fs in detect_cross_server_reference(snaps).items():
             shadow.setdefault(srv, []).extend(fs)
     labels = [_label_for(sn, m, entries.get(sn.name) or {}, args, shadow)
@@ -2947,7 +2965,17 @@ def _offer_batched_auth(rows: list, args, entries: dict, *,
     redraw the list in place instead of telling the user to run the command again. Default-deny in
     spirit: a blank or unparseable answer authenticates nothing, and a non-interactive run never
     opens a browser at all."""
-    pending = [r for r in rows if r.needs_auth]
+    # A server the person SET ASIDE ("not available to me") is not asked again. The panel has
+    # honoured that record since the set-aside flow shipped; this offer never read it, so the
+    # front door asked the founder to sign in to robinhood-trading 24 days after they recorded
+    # it was not available in their region (2026-10-09). Named once, not prompted for.
+    from . import remote_login as _rl
+    _aside = _rl.signin_aside()
+    held = [r for r in rows if r.needs_auth and r.name in _aside]
+    pending = [r for r in rows if r.needs_auth and r.name not in _aside]
+    if held:
+        print(f"  Set aside by you, not asked: {', '.join(r.name for r in held)} — put it back "
+              f"from the panel's Today page to be asked again.\n", file=sys.stderr)
     if not pending:
         return {}
     # --yes means non-interactive: proceed without asking. OAuth sign-in cannot be automated, so
@@ -2956,7 +2984,11 @@ def _offer_batched_auth(rows: list, args, entries: dict, *,
     # stdin inherited from the tester's terminal) reached input() and DEADLOCKED behind captured
     # output until the 900s timeout, which the walk then recorded as a false "slow scan".
     if getattr(args, "yes", False) or not sys.stdin.isatty():
-        print(f"  {len(pending)} server(s) need credentials. Re-run in a terminal without --yes, "
+        # Name the step the reader can actually take: "re-run without --yes" to someone who
+        # never typed it (the bare command, 2026-10-09) is a dead end.
+        step = ("Re-run without --yes to sign in" if getattr(args, "yes", False) and sys.stdin.isatty()
+                else "Run this in a terminal to sign in")
+        print(f"  {len(pending)} server(s) need credentials. {step}, "
               f"or: mcpgawk scan --http <url> --login\n", file=sys.stderr)
         return {}
 

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/src/mcpgawk/consent.py

@@ -25,6 +25,28 @@ Target = tuple[str, dict[str, Any]]
 #: an explicit yes, and the front door sets it only after a real answer.
 CONSENT_GIVEN_ENV = "MCPGAWK_CONSENT_GIVEN"
 
+#: The front door (`mcpgawk`) asked, with full disclosure, and is dispatching the scan it asked
+#: about IN THIS PROCESS. Never inherited by a child, never read from the environment.
+_FRONT_DOOR_CONSENT = False
+
+
+class front_door_consent:
+    """`with consent.front_door_consent():` around the one scan the front door asked about."""
+
+    def __enter__(self):
+        global _FRONT_DOOR_CONSENT
+        self._prev, _FRONT_DOOR_CONSENT = _FRONT_DOOR_CONSENT, True
+        return self
+
+    def __exit__(self, *exc):
+        global _FRONT_DOOR_CONSENT
+        _FRONT_DOOR_CONSENT = self._prev
+        return False
+
+
+def front_door_consented() -> bool:
+    return _FRONT_DOOR_CONSENT
+
 
 def _format(name: str, entry: dict[str, Any]) -> str:
     cmd = str(entry.get("command", ""))
@@ -60,7 +82,14 @@ def gate_stdio_consent(
     # disclosure, and remembers the answer. Re-announcing here made a first run ask, get an answer,
     # and then immediately restate the warning — which reads as though the answer was ignored and
     # quietly undermines the "asked once" promise the prompt makes.
-    if os.environ.get(CONSENT_GIVEN_ENV) == "1" and assume_yes:
+    # Two carriers, deliberately different in reach. The PROCESS-LOCAL flag is the front door's
+    # own answer, set around the one scan it dispatches in this process and nothing after it;
+    # the front door no longer passes --yes, because --yes also silenced the batched OAuth
+    # offer and told a user in a terminal to "re-run without --yes" (2026-10-09). The env var
+    # keeps its narrower meaning (with --yes only): a child process inherits an env, and the
+    # panel's scan button must never launch local code because its parent once consented
+    # (test_scan_button_respects_the_consent_boundary).
+    if _FRONT_DOOR_CONSENT or (os.environ.get(CONSENT_GIVEN_ENV) == "1" and assume_yes):
         return list(targets)
     isatty = sys.stdin.isatty() if stdin_isatty is None else stdin_isatty
     n = len(stdio)

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/src/mcpgawk/decide.py

@@ -70,6 +70,16 @@ def pending_decisions(store: dict[str, Any]) -> list[dict[str, Any]]:
             "since_original": history.since_original(entry, latest),
             "hostile": list(report.hostile),
             "seen_at": latest.get("seen") or "",
+            # THE one sentence (history.changed_head) — "Changed after you approved it" was a
+            # literal here for every origin (2026-10-09).
+            "head": history.changed_head(
+                history.baseline_origin(store, key),
+                ("on " + str(entry.get("approved_at") or approved.get("measured_at") or "")[:10])
+                if (entry.get("approved_at") or approved.get("measured_at")) else None
+            )[:1].upper() + history.changed_head(
+                history.baseline_origin(store, key),
+                ("on " + str(entry.get("approved_at") or approved.get("measured_at") or "")[:10])
+                if (entry.get("approved_at") or approved.get("measured_at")) else None)[1:],
         })
     return out
 
@@ -136,7 +146,11 @@ def _diff_block(report: drift.DriftReport) -> str:
                 f'<div class="was">{_esc(report.unreadable)}</div>'
                 '<div class="now">Nothing was compared, so there is no diff to judge. Approving '
                 'here would trust a surface no one has seen.</div></div>')
-    for tool in report.hostile:
+    # ONLY AN INJECTED KEY IS "the rug-pull signature". `hostile` is injected ∪ escalated, and a
+    # tool that merely gained openWorldHint has no inserted text to accuse (supademo, 2026-10-09:
+    # three tools were shown as rug-pulls for an annotation flip). The escalated keys get their
+    # own row below, saying what grew; the scan's per-line writer follows the same split.
+    for tool in report.injected:
         before, after = report.texts.get(tool, ("", ""))
         rows.append(
             f'<div class="ev danger"><div class="lbl">⚠ {_esc(tool)} — '
@@ -145,20 +159,23 @@ def _diff_block(report: drift.DriftReport) -> str:
                if before or after else "")
             + "</div>")
     for tool in report.added:
-        rows.append(f'<div class="ev"><div class="lbl">+ {_esc(tool)} — a tool that did not exist '
-                    f'when you approved this server</div></div>')
+        rows.append(f'<div class="ev"><div class="lbl">+ {_esc(tool)} — not in the baseline; '
+                    f'added since</div></div>')
     for tool in report.removed:
         rows.append(f'<div class="ev"><div class="lbl">− {_esc(tool)} — removed</div></div>')
     for tool in report.changed:
-        if tool in report.hostile:
+        if tool in report.injected:
             continue
         before, after = report.texts.get(tool, ("", ""))
         rows.append(f'<div class="ev"><div class="lbl">~ {_esc(tool)} — description changed</div>'
                     + (f'<div class="was">{_esc(before)}</div><div class="now">{_esc(after)}</div>'
                        if before or after else "") + "</div>")
     for tool in report.annotation_changed:
-        rows.append(f'<div class="ev danger"><div class="lbl">⚠ {_esc(tool)} — safety annotations '
-                    f'changed (a tool relabelled itself)</div></div>')
+        grew = report.escalations(tool)
+        what = (f"now declares more power ({', '.join(grew)})" if grew
+                else "safety annotations changed (a tool relabelled itself)")
+        rows.append(f'<div class="ev danger"><div class="lbl">⚠ {_esc(tool)} — {_esc(what)}'
+                    f'</div></div>')
     for tool in report.schema_changed:
         rows.append(f'<div class="ev"><div class="lbl">~ {_esc(tool)} — inputs changed</div></div>')
     return "\n".join(rows) or '<div class="ev"><div class="lbl">No detail recorded.</div></div>'
@@ -211,7 +228,7 @@ def render_page(items: list[dict[str, Any]], token: str, note: str = "",
     <h2>{_esc(it['name'])}</h2>
     <span class="pill">blocked · waiting on you</span>
   </div>
-  <p class="sub">Changed after you approved it{(' · last seen ' + _esc(it['seen_at'])) if it['seen_at'] else ''}.
+  <p class="sub">{_esc(it.get('head') or 'Changed since its baseline')}{(' · last seen ' + _esc(it['seen_at'])) if it['seen_at'] else ''}.
      Your agents cannot call it until you decide.</p>
   {_diff_block(r)}
   {_total_line(it.get('since_original'))}
@@ -406,7 +423,7 @@ def serve(port: int = DEFAULT_PORT, open_browser: bool = True, log=print) -> int
         # The SAME scoping the page uses. This line is what a user reads before the browser even
         # opens, so an all-clear here is read exactly as hard as one on the page.
         gaps = uncovered(store)
-        log("\n  No server with an approved baseline has changed since you approved it.")
+        log("\n  No server has changed since its baseline.")
         if gaps.get("alerts"):
             who = ", ".join(gaps.get("alert_servers", [])[:6])
             log(f"  ⚠ monitoring is separately holding {gaps['alerts']} unaccepted alert(s) on "

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/src/mcpgawk/drift.py

@@ -930,8 +930,16 @@ def render_headline(names: list[str], hostile: list[str] | None = None,
                          f"like an ATTACK.")
             lines.append("     Do NOT approve until you have read the inserted text below.")
         if esc:
+            # "than you approved" only when a person approved THESE servers' baselines — the
+            # escalated ones, not the fleet-wide mix `since` was built from. supademo 2026-10-09:
+            # "DECLARES MORE POWER than you approved" one line above "you have not approved this
+            # server yet".
+            from .history import vouched
+            esc_v = origins is None or vouched([origins.get(x) for x in esc])
+            than = ("you approved" if esc_v
+                    else ("its baseline" if len(esc) == 1 else "their baselines"))
             lines.append((f"  ⛔ {n} {what} CHANGED, and " if not inj else "     Also: ")
-                         + f"{', '.join(esc)} now DECLARES MORE POWER than you approved "
+                         + f"{', '.join(esc)} now DECLARES MORE POWER than {than} "
                          f"(a tool stopped declaring read-only or idempotent, or started "
                          f"declaring destructive or open-world).")
             lines.append("     Do NOT approve until you have read what it gained below.")
@@ -973,43 +981,28 @@ def render(name: str, r: DriftReport, head: str | None = None) -> str:
                 f"        Until then this server is NOT being compared against anything.")
     when = ago(r.prev_at)
     approval = head is None      # the default caller compares "your approval" with "now"
-    if head is not None:
-        pass
-    elif r.baseline_origin == "first-sighting":
-        # Trust on first use is not a decision. "changed since you approved it" told a user who
-        # never ran `approve` that they had (new-developer walk, 2026-09-26).
-        head = (f"    ⟳ DRIFT on {name} — changed since first seen"
-                f"{' ' + when if when else ''}; you have not approved this server yet:")
-    elif r.baseline_origin == "unattended":
-        # Approved, but with no person present (an agent session, an agent process, no terminal or
-        # the panel unconfirmed): "since you approved it" would claim a decision nobody made.
-        head = (f"    ⟳ DRIFT on {name} — changed since its baseline, approved"
-                f"{' ' + when if when else ''} without a person present:")
-    elif r.baseline_origin == "fleet":
-        # First seen, then accepted by `approve --fleet`: an approval, but of the fleet, given
-        # after this baseline was recorded — so the date is the sighting's, said as such.
-        head = (f"    ⟳ DRIFT on {name} — changed since first seen"
-                f"{' ' + when if when else ''}, the baseline your fleet approval accepted:")
-    elif when:
-        # `prev_at` is the APPROVED sighting's time — the age of the baseline, not of the change.
-        # "changed 19 days ago" read as if the change were dated (2026-09-03); it is not. Say
-        # what the timestamp is.
-        head = f"    ⟳ DRIFT on {name} — changed since you approved it {when}:"
-    elif r.prev_at:
-        head = f"    ⟳ DRIFT on {name} — changed since {r.prev_at}, after you approved it:"
-    else:
-        head = f"    ⟳ DRIFT on {name} — changed after you approved it:"
+    if head is None:
+        # ONE sentence, from `history.changed_head`, shared with the panel's /next headline: who
+        # approved this baseline is decided by `baseline_origin`, not by which renderer is
+        # printing. `prev_at` is the APPROVED sighting's time — the age of the baseline, not of
+        # the change ("changed 19 days ago" read as if the change were dated, 2026-09-03).
+        from .history import changed_head
+        head = f"    ⟳ DRIFT on {name} — {changed_head(r.baseline_origin, when or r.prev_at)}:"
     lines = [head]
     for kind in ITEM_KINDS:
         split = r.of_kind(kind)
         if split["changed"]:
             # "(rug-pull signature)" is an ACCUSATION, so it is made only where there is evidence
-            # for it — `r.hostile`, the same set that earns the per-line INJECTION SIGNATURE mark
+            # for it — `r.injected`, the same set that earns the per-line INJECTION SIGNATURE mark
             # below. Printing it on every rewrite meant a typo fix and a poisoning attempt arrived
             # in identical words, which is how a team learns to run `approve --all` without reading.
             # That is the failure this whole module exists to prevent (see `_with_severity`).
+            # NOT `r.hostile`: that is injected ∪ escalated, and an annotation flip is not text.
+            # supademo 2026-10-09: move_demos gained openWorldHint and nothing else, and this line
+            # called it a rug-pull while the headline (3f219d76) had already learned to tell the
+            # two apart. The escalation has its own words on the annotations line below.
             tag = (" (rug-pull signature)"
-                   if any(f"{kind}.{s}" in r.hostile for s in split["changed"]) else "")
+                   if any(f"{kind}.{s}" in r.injected for s in split["changed"]) else "")
             lines.append(f"        ! {kind} description CHANGED{tag}: "
                          f"{', '.join(split['changed'])}")
             # Show WHAT it gained. "helper's description changed" tells a user to go and look;
@@ -1019,7 +1012,7 @@ def render(name: str, r: DriftReport, head: str | None = None) -> str:
                 key = f"{kind}.{short}"
                 gained, lost = r.insertion(key), r.deletion(key)
                 if gained:
-                    mark = "  ← INJECTION SIGNATURE" if key in r.hostile else ""
+                    mark = "  ← INJECTION SIGNATURE" if key in r.injected else ""
                     lines.append(f"            {short} gained: {_excerpt(gained)}{mark}")
                 if lost:
                     # A deleted safety caveat steers the model as effectively as an added

{mcpgawk-0.1.74 → mcpgawk-0.1.76}/src/mcpgawk/history.py

@@ -1139,7 +1139,20 @@ def baseline_origin(store: dict[str, Any], key: str) -> str | None:
     e = (store.get("servers") or {}).get(key) or {}
     if e.get("approved_at") or e.get("approved_via") == "approve":
         return "unattended" if evidence_words(e.get("approved_evidence")) else "approve"
-    if e.get("approved_via") != "first-sighting":
+    via = e.get("approved_via")
+    if via is None:
+        # NO MARKER AT ALL. `approve` has stamped approved_at / approved_by / approved_via on every
+        # path since APPROVAL_MARKERS_SINCE; the first-sighting fallback only began labelling
+        # itself on 2026-09-26. A record from the window between, with no marker, can only be a
+        # first sighting — a real approval would have left its stamp. Older than the window it
+        # is unknown, and unknown is said as unknown, never as "you approved" (notion and
+        # brandfetch, 2026-10-09: the scan told the founder they had approved two servers that
+        # were first-sighting fallbacks from 15 Sep).
+        at = str((e.get("approved") or {}).get("measured_at") or "")
+        if at < APPROVAL_MARKERS_SINCE:
+            return None
+        via = "first-sighting"
+    if via != "first-sighting":
         return None
     if not fleet_covers(store, key):
         return "first-sighting"
@@ -1178,9 +1191,16 @@ def fleet_covers(store: dict[str, Any], key: str) -> bool:
     return any(str(fk).partition("/")[2] in aliases for fk in (fleet.get("entries") or {}))
 
 
-#: Origins whose baseline a person stands behind. None — a baseline recorded before origins were —
-#: keeps the approval wording every surface has always given it: unknown is not re-guessed.
-VOUCHED_ORIGINS = frozenset({"approve", "fleet", None})
+#: `approve` has written approved_at / approved_by / approved_via on every path since this
+#: release date (e133152c, shipped in 0.1.35 on 2026-09-05). A record approved on or after it
+#: with no marker was therefore never through `approve` — see `baseline_origin`.
+APPROVAL_MARKERS_SINCE = "2026-09-05"
+
+#: Origins whose baseline a person stands behind. None — a baseline older than
+#: APPROVAL_MARKERS_SINCE with no marker — is UNKNOWN, and an unknown origin is not a person's
+#: approval: until 2026-10-09 it kept the "you approved" words, which asserted a decision the
+#: record cannot show. Unknown is worded as "its baseline" on every surface.
+VOUCHED_ORIGINS = frozenset({"approve", "fleet"})
 
 
 def vouched(origins: "list[str | None]") -> bool:
@@ -1205,6 +1225,30 @@ def changed_since(store: dict[str, Any], keys: "list[str]", *, plural: bool | No
     return since_words([baseline_origin(store, k) for k in keys], plural=plural)
 
 
+def changed_head(origin: "str | None", when: "str | None") -> str:
+    """THE sentence for one server that moved off its baseline: "changed since …", worded from
+    `baseline_origin`. The scan's drift head, the panel's /next headline and `baseline` all print
+    this one string, so they cannot disagree about who approved what (2026-10-09: the scan said
+    "since you approved it 23 days ago" and /next said "nobody has approved this server yet" of
+    the same record). `when` is already a phrase — "23 days ago" or "on 2026-09-15" — or None."""
+    w = f" {when}" if when else ""
+    if origin == "first-sighting":
+        # Trust on first use is not a decision (new-developer walk, 2026-09-26).
+        return f"changed since first seen{w}; you have not approved this server yet"
+    if origin == "unattended":
+        # Approved with no person present: "you approved it" claims a decision nobody made.
+        return f"changed since its baseline, approved{w} without a person present"
+    if origin == "fleet":
+        # First seen, then accepted by `approve --fleet`: the date is the sighting's, said so.
+        return f"changed since first seen{w}, the baseline your fleet approval accepted"
+    if origin == "approve":
+        return f"changed since you approved it{w}" if when else "changed after you approved it"
+    # Unknown: a record older than APPROVAL_MARKERS_SINCE with no marker. Neither a person nor
+    # nobody can be asserted; say what the anchor is and that the record does not say who set it.
+    return (f"changed since its baseline, recorded{w}; who approved it is not on record"
+            if when else "changed since its baseline; who approved it is not on record")
+
+
 def changed_within(store: dict[str, Any], days: int = 7,
                    now: "float | None" = None) -> list[tuple[str, str]]:
     """Servers whose surface first MOVED from its approved pin within the last `days`, as
@@ -1486,7 +1530,12 @@ def display_name(store: dict[str, Any], key: str) -> str:
         return asserted
     if not aliases:
         return key
-    primary = aliases[0]
+    # A CONFIG NAME BEATS A TARGET. Aliases are stored sorted, so a URL alias from `scan --http`
+    # sorted ahead of the config name and the fleet read "https://<host>/mcp (also
+    # configured as notion)" above "approve <name>" (2026-10-09). The ad-hoc targets are how the
+    # server was reached, not what it is called: they are neither the name nor the aside.
+    named = [a for a in aliases if not _is_adhoc_target(a)] or aliases
+    primary = named[0]
 
     # AMBIGUITY IS WORSE THAN THE RAW KEY. Two different servers can carry the same alias, and a
     # fleet then shows two rows reading identically: a user cannot tell which one changed, and
@@ -1497,9 +1546,9 @@ def display_name(store: dict[str, Any], key: str) -> str:
                if k != key and primary in ((v or {}).get("aliases") or [])]
     if sharing:
         return f"{primary} [{key}]"
-    if len(aliases) == 1:
+    if len(named) == 1:
         return primary
-    return f"{primary} (also configured as {', '.join(aliases[1:])})"
+    return f"{primary} (also configured as {', '.join(named[1:])})"
 
 
 def pending(store: dict[str, Any]) -> list[str]: