Yaak Proxy: the rejected card claims decryption only when the list decrypts

Once an address is no longer passed through, the foot said the next
connection will be decrypted even when the list excludes it or the
certificate is untrusted. It now says so only when the list still
decrypts the connection, and keeps the trust line while untrusted.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

apps/yaak-proxy/lib/encryptedCard.test.ts

@@ -265,6 +265,18 @@ describe("the card of a refused handshake", () => {
     expect(c.foot).toEqual(["The next connection will be decrypted."]);
   });
 
+  test("no longer passed through but excluded since: no claim that it will be decrypted", () => {
+    const excluded = [...user("*", "!app:Acme"), ...BUILT_INS];
+    const c = card({ flow: refused, list: excluded, passthrough: [] });
+    expect(c.actions).toEqual([]);
+    expect(c.foot).toEqual([]);
+  });
+
+  test("an untrusted certificate keeps its line once no longer passed through", () => {
+    const c = card({ flow: refused, list: listed, trusted: false, passthrough: [] });
+    expect(c.foot).toEqual(["This host stays encrypted until the certificate is trusted."]);
+  });
+
   test("a program: its own trust store, Copy Environment first", () => {
     const python = {
       ...refused,

apps/yaak-proxy/lib/encryptedCard.ts

@@ -360,7 +360,14 @@ function rejectedCard(input: EncryptedCardInput): EncryptedCardModel {
     passedThrough === false
       ? null
       : { kind: "try_again", label: "Retry", hint: "next connection", icon: "refresh" };
-  const until = passedThrough === false ? "The next connection will be decrypted." : null;
+  // No longer passed through: the next connection is decrypted while the list still decrypts
+  // it. Excluded since, it stays encrypted, and there is nothing to add.
+  const until: string[] | null =
+    passedThrough === false
+      ? stop == null
+        ? []
+        : ["The next connection will be decrypted."]
+      : null;
 
   if (canTrust && trusted === false && decryptsAnything(list)) {
     return {
@@ -371,7 +378,8 @@ function rejectedCard(input: EncryptedCardInput): EncryptedCardModel {
         { kind: "trust", label: "Trust Certificate", hint: null, primary: true, icon: "shield" },
         ...(stop == null ? [] : [stop]),
       ],
-      foot: [until ?? "This host stays encrypted until the certificate is trusted."],
+      // Whether or not it is still passed through: untrusted, the next one is rejected too.
+      foot: ["This host stays encrypted until the certificate is trusted."],
     };
   }
 
@@ -392,7 +400,7 @@ function rejectedCard(input: EncryptedCardInput): EncryptedCardModel {
         ...(stop == null ? [] : [stop]),
         ...(tryAgain == null ? [] : [tryAgain]),
       ],
-      foot: until == null ? [`Paste it into a terminal, then rerun ${refuser.name}.`] : [until],
+      foot: until ?? [`Paste it into a terminal, then rerun ${refuser.name}.`],
     };
   }
   return {
@@ -410,6 +418,6 @@ function rejectedCard(input: EncryptedCardInput): EncryptedCardModel {
       ...(stop == null ? [] : [{ ...stop, primary: true }]),
       ...(tryAgain == null ? [] : [tryAgain]),
     ],
-    foot: [until ?? "This host stays encrypted until Yaak Proxy is relaunched."],
+    foot: until ?? ["This host stays encrypted until Yaak Proxy is relaunched."],
   };
 }