Yaak Proxy: name the host when decryption isn't configured for it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/yaak-proxy/lib/encryptedCard.test.ts

@@ -91,7 +91,7 @@ describe("the card of an encrypted connection", () => {
 
   test("something else listed: not on the list, with the same choices", () => {
     const c = card({ list: [...user("host:api.stripe.com"), ...BUILT_INS] });
-    expect(c.why).toBe("Not on the decrypt list");
+    expect(c.why).toBe("Decryption not configured for www.google.com");
     expect(c.actions.map((a) => a.label)).toEqual([
       "Decrypt www.google.com",
       "Decrypt Dia",
@@ -106,6 +106,16 @@ describe("the card of an encrypted connection", () => {
     expect(c.actions.map((a) => a.label)).toEqual(["Decrypt www.google.com", "Decrypt Everything"]);
   });
 
+  test("names the host nothing on the list covers, its port only when not 443", () => {
+    const list = [...user("host:api.stripe.com"), ...BUILT_INS];
+    expect(card({ list, flow: { ...tunnel, url: "t.yaak.app:443" } }).why).toBe(
+      "Decryption not configured for t.yaak.app",
+    );
+    expect(card({ list, flow: { ...tunnel, url: "home.ts.net:8317" } }).why).toBe(
+      "Decryption not configured for home.ts.net:8317",
+    );
+  });
+
   test("a port off 443 is part of the host it writes", () => {
     const c = card({ flow: { ...tunnel, url: "home.ts.net:8317" } });
     expect(c.actions[0]?.hint).toBe("host:home.ts.net:8317");

apps/yaak-proxy/lib/encryptedCard.ts

@@ -141,10 +141,11 @@ export function encryptedCard(input: EncryptedCardInput): EncryptedCardModel {
 function tunnelCard({ flow, list, trusted, canTrust }: EncryptedCardInput): EncryptedCardModel {
   const c = connectionOf(flow);
   const q = queryOf(c);
-  const { why, whySub, whyEntry } = whyLine(flow, list);
+  const decryptsNow = decrypts(list, q);
+  const { why, whySub, whyEntry } = whyLine(flow, list, c, decryptsNow);
   const foot = ["New connections only"];
 
-  if (decrypts(list, q)) {
+  if (decryptsNow) {
     // Decrypted from the next connection on: the entries that do it, each to take back.
     const decrypting = list.filter(
       (e) => !e.builtIn && !e.entry.startsWith("!") && entryMatches(e.entry, q),
@@ -236,10 +237,15 @@ function tunnelCard({ flow, list, trusted, canTrust }: EncryptedCardInput): Encr
   };
 }
 
-/** The why line, from the reason the engine recorded as the tunnel opened */
+/**
+ * The why line, from the reason the engine recorded as the tunnel opened. One that nothing on
+ * the list covers names its host; once the list covers it, it opened before that.
+ */
 function whyLine(
   flow: EncryptedCardInput["flow"],
   list: DecryptListEntry[],
+  c: Connection,
+  decryptsNow: boolean,
 ): { why: string; whySub: string | null; whyEntry: string | null } {
   if (flow.tunnelReason === "excluded" && flow.tunnelExcludedBy != null) {
     if (flow.tunnelExcludedBuiltIn) {
@@ -251,7 +257,11 @@ function whyLine(
     return { why: "Excluded by", whySub: null, whyEntry: flow.tunnelExcludedBy };
   }
   return {
-    why: decryptsAnything(list) ? "Not on the decrypt list" : "Nothing is decrypted yet",
+    why: !decryptsAnything(list)
+      ? "Nothing is decrypted yet"
+      : decryptsNow
+        ? "Not on the decrypt list"
+        : `Decryption not configured for ${c.label}`,
     whySub: null,
     whyEntry: null,
   };