evo-cli 0.3.1__tar.gz → 0.4.0__tar.gz

{evo_cli-0.3.1 → evo_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.3.1
+Version: 0.4.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -14,6 +14,7 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: cryptography>=41.0
 Requires-Dist: paramiko>=2.7.0
 Requires-Dist: rich>=13.0
 Requires-Dist: rich-click>=1.8

evo_cli-0.4.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.4.0

{evo_cli-0.3.1 → evo_cli-0.4.0}/evo_cli/cli.py

@@ -4,7 +4,9 @@ from evo_cli import __version__
 from evo_cli.commands.cloudflare import cfssh
 from evo_cli.commands.fix_claude import f_claude
 from evo_cli.commands.gdrive import gdrive
+from evo_cli.commands.localproxy import localproxy
 from evo_cli.commands.miniconda import miniconda
+from evo_cli.commands.netcheck import netcheck
 from evo_cli.commands.site2s import site2s
 from evo_cli.commands.ssh import setupssh
 
@@ -35,6 +37,8 @@ cli.add_command(cfssh)
 cli.add_command(f_claude)
 cli.add_command(gdrive)
 cli.add_command(site2s)
+cli.add_command(localproxy)
+cli.add_command(netcheck)
 
 
 def main():

evo_cli-0.4.0/evo_cli/commands/localproxy.py

@@ -0,0 +1,679 @@
+"""
+evo localproxy — HTTPS reverse proxy mapping https://{domain}.local -> https://{domain}.
+
+Use case: browse / test a real HTTPS site under a local alias. A request to
+``https://edunext.ptudev.net.local`` is TLS-terminated locally with a leaf cert
+issued by a small local CA, the ``.local`` suffix is stripped, and the request is
+forwarded over TLS to the real ``https://edunext.ptudev.net``.
+
+Rewrites that make logins / redirects stay inside the alias:
+  - outbound (request):  Host, Origin, Referer   {domain}.local -> {domain}
+  - inbound  (response): Location, Content-Location, Access-Control-Allow-Origin
+                         {domain} -> {domain}.local ; Set-Cookie Domain= gets a
+                         trailing ``.local`` so cookies bind to the alias host.
+
+Windows-first (no /etc/hosts, lsof, or sudo) but works cross-platform.
+HTTP/1.1 end to end (ALPN pins http/1.1); chunked, keep-alive, Expect:
+100-continue and WebSocket upgrades are handled. Response bodies are streamed
+untouched, so gzip/br pass through transparently.
+"""
+import datetime
+import os
+import re
+import signal
+import socket
+import ssl
+import threading
+from pathlib import Path
+
+import rich_click as click
+from rich.table import Table
+from rich.text import Text
+
+from evo_cli.console import console, error, info, step, success, warning
+
+
+# ── Certificate authority / leaf generation ──────────────────────────────────
+
+def _cert_dir(custom=None):
+    p = Path(custom) if custom else Path.home() / ".evo" / "proxy-certs"
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+
+def _load_or_create_ca(cert_dir):
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from cryptography.x509.oid import NameOID
+
+    key_path = cert_dir / "evo-ca-key.pem"
+    crt_path = cert_dir / "evo-ca-cert.pem"
+    if key_path.exists() and crt_path.exists():
+        key = serialization.load_pem_private_key(key_path.read_bytes(), password=None)
+        crt = x509.load_pem_x509_certificate(crt_path.read_bytes())
+        return key, crt, crt_path
+
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    name = x509.Name([
+        x509.NameAttribute(NameOID.COMMON_NAME, "Evo Local CA"),
+        x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Evo CLI"),
+    ])
+    now = datetime.datetime.now(datetime.timezone.utc)
+    crt = (
+        x509.CertificateBuilder()
+        .subject_name(name).issuer_name(name)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - datetime.timedelta(days=1))
+        .not_valid_after(now + datetime.timedelta(days=3650))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True)
+        .add_extension(
+            x509.KeyUsage(
+                digital_signature=True, key_cert_sign=True, crl_sign=True,
+                content_commitment=False, key_encipherment=False,
+                data_encipherment=False, key_agreement=False,
+                encipher_only=False, decipher_only=False,
+            ),
+            critical=True,
+        )
+        .add_extension(x509.SubjectKeyIdentifier.from_public_key(key.public_key()), critical=False)
+        .sign(key, hashes.SHA256())
+    )
+    key_path.write_bytes(key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.TraditionalOpenSSL,
+        serialization.NoEncryption(),
+    ))
+    crt_path.write_bytes(crt.public_bytes(serialization.Encoding.PEM))
+    return key, crt, crt_path
+
+
+def _make_leaf(cert_dir, ca_key, ca_crt, dns_names):
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID
+
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    now = datetime.datetime.now(datetime.timezone.utc)
+    crt = (
+        x509.CertificateBuilder()
+        .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, dns_names[0])]))
+        .issuer_name(ca_crt.subject)
+        .public_key(key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now - datetime.timedelta(days=1))
+        .not_valid_after(now + datetime.timedelta(days=825))
+        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
+        .add_extension(x509.SubjectAlternativeName([x509.DNSName(d) for d in dns_names]), critical=False)
+        .add_extension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]), critical=False)
+        .sign(ca_key, hashes.SHA256())
+    )
+    key_path = cert_dir / "leaf-key.pem"
+    chain_path = cert_dir / "leaf-chain.pem"
+    key_path.write_bytes(key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.TraditionalOpenSSL,
+        serialization.NoEncryption(),
+    ))
+    chain_path.write_bytes(
+        crt.public_bytes(serialization.Encoding.PEM)
+        + ca_crt.public_bytes(serialization.Encoding.PEM)
+    )
+    return chain_path, key_path
+
+
+def _server_ctx(chain_path, key_path):
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    ctx.load_cert_chain(certfile=str(chain_path), keyfile=str(key_path))
+    try:
+        ctx.set_alpn_protocols(["http/1.1"])
+    except NotImplementedError:
+        pass
+    return ctx
+
+
+# ── Hosts file + trust store helpers ─────────────────────────────────────────
+
+_MARKER = "# evo-cli localproxy"
+
+
+def _hosts_path():
+    if os.name == "nt":
+        root = os.environ.get("SystemRoot", r"C:\Windows")
+        return Path(root) / "System32" / "drivers" / "etc" / "hosts"
+    return Path("/etc/hosts")
+
+
+def _flush_dns():
+    if os.name == "nt":
+        try:
+            import subprocess
+            subprocess.run(["ipconfig", "/flushdns"], capture_output=True)
+        except Exception:
+            pass
+
+
+def _setup_hosts(local_hosts):
+    path = _hosts_path()
+    entries = [f"127.0.0.1 {h} {_MARKER}" for h in local_hosts]
+    try:
+        content = path.read_text(encoding="utf-8", errors="ignore") if path.exists() else ""
+        kept = [
+            ln for ln in content.splitlines()
+            if _MARKER not in ln and not any(h in ln.split() for h in local_hosts)
+        ]
+        path.write_text("\n".join(kept + entries) + "\n", encoding="utf-8")
+        success(f"Updated hosts file ({len(local_hosts)} entries)")
+        _flush_dns()
+        return True
+    except PermissionError:
+        warning("Cannot edit the hosts file (need Administrator).")
+        warning("Run the terminal as Administrator, or add these lines manually:")
+        for e in entries:
+            console.print(f"  [cmd]{e}[/cmd]")
+        return False
+
+
+def _cleanup_hosts():
+    path = _hosts_path()
+    try:
+        if not path.exists():
+            return
+        kept = [ln for ln in path.read_text(encoding="utf-8", errors="ignore").splitlines()
+                if _MARKER not in ln]
+        path.write_text("\n".join(kept) + "\n", encoding="utf-8")
+        _flush_dns()
+        warning("Removed hosts entries.")
+    except PermissionError:
+        pass
+
+
+def _install_ca(ca_crt_path):
+    if os.name == "nt":
+        import subprocess
+        info("Installing CA into the Windows user Root store...")
+        r = subprocess.run(["certutil", "-addstore", "-user", "-f", "Root", str(ca_crt_path)],
+                           capture_output=True, text=True)
+        if r.returncode == 0:
+            success("CA trusted (Chrome / Edge will accept .local certs)")
+            console.print("[cmd]Firefox: set security.enterprise_roots.enabled=true, "
+                          "or import the CA in its own store.[/cmd]")
+        else:
+            error(f"certutil failed: {r.stdout.strip()} {r.stderr.strip()}")
+            console.print(f'[cmd]Install manually: certutil -addstore -user -f Root "{ca_crt_path}"[/cmd]')
+    else:
+        warning(f"Import this CA into your OS / browser trust store: {ca_crt_path}")
+
+
+# ── HTTP/1.1 message helpers ─────────────────────────────────────────────────
+
+def _parse_headers(raw_lines):
+    """raw_lines: list of header line bytes (CRLF-terminated). -> [[name, value], ...]"""
+    parsed = []
+    for ln in raw_lines:
+        s = ln.rstrip(b"\r\n")
+        if not s:
+            continue
+        if s[:1] in (b" ", b"\t"):  # obsolete line folding
+            if parsed:
+                parsed[-1][1] += b" " + s.strip()
+            continue
+        name, _, val = s.partition(b":")
+        parsed.append([name.strip(), val.strip()])
+    return parsed
+
+
+def _read_head(reader):
+    """Read a request/response head. -> (start_line_bytes, parsed_headers) or None on EOF."""
+    while True:
+        line = reader.readline()
+        if not line:
+            return None
+        start_line = line.rstrip(b"\r\n")
+        if start_line:  # tolerate stray blank lines between messages
+            break
+    raw = []
+    while True:
+        h = reader.readline()
+        if not h or h in (b"\r\n", b"\n"):
+            break
+        raw.append(h)
+    return start_line, _parse_headers(raw)
+
+
+def _serialize(start_line, parsed):
+    out = [start_line.rstrip(b"\r\n"), b"\r\n"]
+    for name, val in parsed:
+        out += [name, b": ", val, b"\r\n"]
+    out.append(b"\r\n")
+    return b"".join(out)
+
+
+def _hget(parsed, name):
+    nl = name.lower()
+    for n, v in parsed:
+        if n.lower() == nl:
+            return v
+    return None
+
+
+def _hset(parsed, name, value):
+    nl = name.lower()
+    for pair in parsed:
+        if pair[0].lower() == nl:
+            pair[1] = value
+            return
+    parsed.append([name, value])
+
+
+def _hdel(parsed, name):
+    nl = name.lower()
+    parsed[:] = [p for p in parsed if p[0].lower() != nl]
+
+
+def _status_code(start_line):
+    parts = start_line.split(b" ", 2)
+    if len(parts) >= 2 and parts[1].isdigit():
+        return int(parts[1])
+    return None
+
+
+def _conn_close(parsed):
+    v = _hget(parsed, b"Connection")
+    return v is not None and b"close" in v.lower()
+
+
+_COOKIE_DOMAIN_RE = re.compile(rb"(?i)(;\s*domain=)([^;]+)")
+
+
+def _rewrite_cookie_domain(value):
+    def repl(m):
+        dom = m.group(2).strip()
+        if dom.lower().endswith(b".local"):
+            return m.group(0)
+        return m.group(1) + dom + b".local"
+    return _COOKIE_DOMAIN_RE.sub(repl, value)
+
+
+def _safe_close(sock):
+    try:
+        sock.close()
+    except OSError:
+        pass
+
+
+def _send_simple(sock, code, msg):
+    reason = {403: b"Forbidden", 421: b"Misdirected Request",
+              502: b"Bad Gateway", 404: b"Not Found"}.get(code, b"Error")
+    body = msg + b"\n"
+    resp = (b"HTTP/1.1 %d %s\r\n" % (code, reason)
+            + b"Content-Type: text/plain; charset=utf-8\r\n"
+            + b"Content-Length: %d\r\n" % len(body)
+            + b"Connection: close\r\n\r\n" + body)
+    try:
+        sock.sendall(resp)
+    except OSError:
+        pass
+
+
+# ── Body relaying ────────────────────────────────────────────────────────────
+
+def _relay_n(reader, out_sock, n):
+    remaining = n
+    while remaining > 0:
+        chunk = reader.read(min(65536, remaining))
+        if not chunk:
+            break
+        out_sock.sendall(chunk)
+        remaining -= len(chunk)
+
+
+def _relay_chunked(reader, out_sock):
+    while True:
+        size_line = reader.readline()
+        if not size_line:
+            break
+        out_sock.sendall(size_line)
+        try:
+            size = int(size_line.strip().split(b";", 1)[0], 16)
+        except ValueError:
+            break
+        if size == 0:  # last chunk -> relay trailers up to blank line
+            while True:
+                t = reader.readline()
+                out_sock.sendall(t)
+                if not t or t in (b"\r\n", b"\n"):
+                    break
+            break
+        _relay_n(reader, out_sock, size)
+        out_sock.sendall(reader.read(2))  # trailing CRLF
+
+
+def _relay_until_eof(reader, out_sock):
+    while True:
+        chunk = reader.read1(65536)
+        if not chunk:
+            break
+        out_sock.sendall(chunk)
+
+
+def _transfer_body(reader, out_sock, parsed, is_request, method=b"GET", status=None):
+    """Relay a message body. Returns True only for a close-delimited response."""
+    if not is_request:
+        if method == b"HEAD" or status in (204, 304) or (status is not None and 100 <= status < 200):
+            return False
+    te = (_hget(parsed, b"Transfer-Encoding") or b"").lower()
+    if b"chunked" in te:
+        _relay_chunked(reader, out_sock)
+        return False
+    cl = _hget(parsed, b"Content-Length")
+    if cl is not None:
+        try:
+            n = int(cl.strip())
+        except ValueError:
+            n = 0
+        _relay_n(reader, out_sock, n)
+        return False
+    if is_request:
+        return False  # no framing => no request body
+    _relay_until_eof(reader, out_sock)  # response body delimited by connection close
+    return True
+
+
+# ── Reverse proxy ────────────────────────────────────────────────────────────
+
+class LocalReverseProxy:
+    def __init__(self, domains, listen_port=443, upstream_port=443,
+                 bind="127.0.0.1", insecure_upstream=False, timeout=30):
+        self.domains = domains
+        self.listen_port = listen_port
+        self.upstream_port = upstream_port
+        self.bind = bind
+        self.timeout = timeout
+        self.running = True
+        self.local_to_real = {f"{d}.local": d for d in domains}
+        self._ssl_ctx = None
+        self._server = None
+
+        self.up_ctx = ssl.create_default_context()
+        if insecure_upstream:
+            self.up_ctx.check_hostname = False
+            self.up_ctx.verify_mode = ssl.CERT_NONE
+        try:
+            self.up_ctx.set_alpn_protocols(["http/1.1"])
+        except NotImplementedError:
+            pass
+
+    def _route(self, host_header):
+        if not host_header:
+            return None
+        h = host_header.decode("latin-1").strip().lower().split(":")[0]
+        return self.local_to_real.get(h)
+
+    def _rewrite_request(self, parsed, real_host):
+        _hset(parsed, b"Host", real_host.encode())
+        for hdr in (b"Origin", b"Referer"):
+            v = _hget(parsed, hdr)
+            if v is None:
+                continue
+            nv = v
+            for local, real in self.local_to_real.items():
+                nv = nv.replace(local.encode(), real.encode())
+            if nv != v:
+                _hset(parsed, hdr, nv)
+
+    def _rewrite_response(self, parsed):
+        for hdr in (b"Location", b"Content-Location", b"Access-Control-Allow-Origin"):
+            v = _hget(parsed, hdr)
+            if v is None:
+                continue
+            nv = v
+            for local, real in self.local_to_real.items():
+                # real -> local, but skip values already ending in .local
+                nv = re.sub(re.escape(real).encode() + rb"(?!\.local)",
+                            lambda m, _l=local: _l.encode(), nv)
+            if nv != v:
+                _hset(parsed, hdr, nv)
+        for pair in parsed:
+            if pair[0].lower() == b"set-cookie":
+                pair[1] = _rewrite_cookie_domain(pair[1])
+
+    def _connect_upstream(self, real_host):
+        try:
+            s = socket.create_connection((real_host, self.upstream_port), timeout=self.timeout)
+            ss = self.up_ctx.wrap_socket(s, server_hostname=real_host)
+            ss.settimeout(self.timeout)
+            return ss, ss.makefile("rb")
+        except (OSError, ssl.SSLError) as e:
+            error(f"upstream {real_host}:{self.upstream_port} failed: {e}")
+            return None, None
+
+    def _relay_upgrade(self, tls, creader, usock, ureader):
+        def pipe(reader, dst):
+            try:
+                while True:
+                    data = reader.read1(65536)
+                    if not data:
+                        break
+                    dst.sendall(data)
+            except (OSError, ssl.SSLError):
+                pass
+            finally:
+                try:
+                    dst.shutdown(socket.SHUT_WR)
+                except OSError:
+                    pass
+        t1 = threading.Thread(target=pipe, args=(creader, usock), daemon=True)
+        t2 = threading.Thread(target=pipe, args=(ureader, tls), daemon=True)
+        t1.start(); t2.start()
+        t1.join(); t2.join()
+
+    def _handle(self, raw_conn, addr):
+        try:
+            tls = self._ssl_ctx.wrap_socket(raw_conn, server_side=True)
+        except (ssl.SSLError, OSError):
+            _safe_close(raw_conn)
+            return
+        tls.settimeout(self.timeout)
+        creader = tls.makefile("rb")
+        upstream = None  # [sock, reader, real_host, reusable]
+        try:
+            while self.running:
+                head = _read_head(creader)
+                if head is None:
+                    break
+                start_line, parsed = head
+                method = start_line.split(b" ", 1)[0].upper()
+                real_host = self._route(_hget(parsed, b"Host"))
+                if real_host is None:
+                    _send_simple(tls, 421, b"Unknown .local host for this proxy")
+                    break
+
+                if upstream is None or upstream[2] != real_host or not upstream[3]:
+                    if upstream is not None:
+                        _safe_close(upstream[0])
+                    s, r = self._connect_upstream(real_host)
+                    if s is None:
+                        _send_simple(tls, 502, b"Upstream connection failed")
+                        break
+                    upstream = [s, r, real_host, True]
+                usock, ureader = upstream[0], upstream[1]
+
+                expect_continue = False
+                ev = _hget(parsed, b"Expect")
+                if ev is not None and b"100-continue" in ev.lower():
+                    expect_continue = True
+                    _hdel(parsed, b"Expect")
+
+                self._rewrite_request(parsed, real_host)
+                try:
+                    usock.sendall(_serialize(start_line, parsed))
+                    if expect_continue:
+                        tls.sendall(b"HTTP/1.1 100 Continue\r\n\r\n")
+                    _transfer_body(creader, usock, parsed, is_request=True, method=method)
+                except (OSError, ssl.SSLError):
+                    upstream[3] = False
+                    _send_simple(tls, 502, b"Upstream write failed")
+                    break
+
+                # Read the response, transparently passing through 1xx interim heads.
+                resp = None
+                while True:
+                    resp = _read_head(ureader)
+                    if resp is None:
+                        break
+                    rstart, rparsed = resp
+                    status = _status_code(rstart)
+                    self._rewrite_response(rparsed)
+                    tls.sendall(_serialize(rstart, rparsed))
+                    if status is not None and 100 <= status < 200 and status != 101:
+                        continue
+                    break
+                if resp is None:
+                    upstream[3] = False
+                    _send_simple(tls, 502, b"Upstream closed connection")
+                    break
+
+                if status == 101:  # WebSocket / protocol switch
+                    self._relay_upgrade(tls, creader, usock, ureader)
+                    break
+
+                close_delimited = _transfer_body(
+                    ureader, tls, rparsed, is_request=False, method=method, status=status)
+
+                if _conn_close(rparsed) or close_delimited:
+                    upstream[3] = False
+                if _conn_close(parsed) or close_delimited:
+                    break
+        except (ssl.SSLError, OSError, ConnectionError, ValueError):
+            pass
+        finally:
+            if upstream is not None:
+                _safe_close(upstream[0])
+            _safe_close(tls)
+
+    def serve(self, ssl_ctx):
+        self._ssl_ctx = ssl_ctx
+        srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        srv.bind((self.bind, self.listen_port))
+        srv.listen(128)
+        srv.settimeout(1)
+        self._server = srv
+        while self.running:
+            try:
+                conn, addr = srv.accept()
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            conn.settimeout(self.timeout)
+            threading.Thread(target=self._handle, args=(conn, addr), daemon=True).start()
+        _safe_close(srv)
+
+
+# ── CLI command ──────────────────────────────────────────────────────────────
+
+EPILOG = Text.from_markup(
+    "[bold]Examples[/bold]\n\n"
+    "  [cyan]evo localproxy edunext.ptudev.net --install-ca[/cyan]\n"
+    "  [cyan]evo localproxy edunext.ptudev.net api.ptudev.net[/cyan]\n"
+    "  [cyan]evo localproxy edunext.ptudev.net -p 8443[/cyan]   (if 443 is busy)\n"
+    "  [cyan]evo localproxy edunext.ptudev.net --no-hosts[/cyan]"
+)
+
+
+def run_localproxy(domains, port, bind, no_hosts, cert_dir,
+                   install_ca, insecure_upstream, upstream_port):
+    norm = []
+    for d in domains:
+        d = re.sub(r"^https?://", "", d.strip().lower()).split("/")[0].split(":")[0]
+        if d.endswith(".local"):
+            d = d[: -len(".local")]
+        if d and d not in norm:
+            norm.append(d)
+    if not norm:
+        error("No valid domains given.")
+        return
+    local_hosts = [f"{d}.local" for d in norm]
+
+    cdir = _cert_dir(cert_dir)
+    ca_key, ca_crt, ca_crt_path = _load_or_create_ca(cdir)
+    chain_path, key_path = _make_leaf(cdir, ca_key, ca_crt, local_hosts)
+    ssl_ctx = _server_ctx(chain_path, key_path)
+
+    if install_ca:
+        _install_ca(ca_crt_path)
+    if not no_hosts:
+        _setup_hosts(local_hosts)
+
+    def _url(host, p):
+        return f"https://{host}" if p == 443 else f"https://{host}:{p}"
+
+    table = Table(title="Local HTTPS Reverse Proxy", title_style="accent")
+    table.add_column("Browse (local)", style="cyan")
+    table.add_column("", style="white")
+    table.add_column("Forwards to", style="green")
+    for d in norm:
+        table.add_row(_url(f"{d}.local", port), "->", _url(d, upstream_port))
+    console.print(table)
+    console.print(f"[cmd]CA cert: {ca_crt_path}[/cmd]")
+    if not install_ca:
+        console.print("[cmd]Trust the CA once so browsers don't warn:[/cmd]")
+        if os.name == "nt":
+            console.print(f'[cmd]  certutil -addstore -user -f Root "{ca_crt_path}"   '
+                          "(or re-run with --install-ca)[/cmd]")
+        else:
+            console.print(f"[cmd]  import {ca_crt_path} into your trust store[/cmd]")
+    info(f"Listening on {bind}:{port} — Ctrl+C to stop.")
+
+    proxy = LocalReverseProxy(norm, listen_port=port, upstream_port=upstream_port,
+                              bind=bind, insecure_upstream=insecure_upstream)
+
+    def _shutdown(_sig, _frame):
+        proxy.running = False
+    try:
+        signal.signal(signal.SIGINT, _shutdown)
+        signal.signal(signal.SIGTERM, _shutdown)
+    except (ValueError, AttributeError):
+        pass
+
+    try:
+        proxy.serve(ssl_ctx)
+    except OSError as exc:
+        error(f"Cannot bind {bind}:{port} — {exc}")
+        if port == 443:
+            warning("Port 443 is likely in use. Try `-p 8443` and browse "
+                    "https://{domain}.local:8443")
+    except KeyboardInterrupt:
+        pass
+    finally:
+        proxy.running = False
+        if not no_hosts:
+            _cleanup_hosts()
+        success("Proxy stopped.")
+
+
+@click.command("localproxy", epilog=EPILOG)
+@click.argument("domains", nargs=-1, required=True)
+@click.option("-p", "--port", type=int, default=443, show_default=True, help="Local HTTPS listen port.")
+@click.option("-u", "--upstream-port", type=int, default=443, show_default=True,
+              help="Upstream HTTPS port to forward to.")
+@click.option("-b", "--bind", default="127.0.0.1", show_default=True, help="Bind address.")
+@click.option("--no-hosts", is_flag=True, help="Don't modify the hosts file.")
+@click.option("--cert-dir", type=click.Path(), default=None, help="Where to store the local CA / leaf certs.")
+@click.option("--install-ca", is_flag=True, help="Install the local CA into the OS trust store.")
+@click.option("--insecure-upstream", is_flag=True, help="Skip upstream TLS certificate verification.")
+def localproxy(domains, port, upstream_port, bind, no_hosts, cert_dir, install_ca, insecure_upstream):
+    """HTTPS reverse proxy: `https://{domain}.local` -> `https://{domain}`.
+
+    Maps a `.local` alias of a real site to the real site over TLS so you can
+    browse / test it under a local name. Host/Origin/Referer are rewritten
+    outbound; Location/Set-Cookie/CORS rewritten inbound so logins and redirects
+    stay inside the alias. A local CA issues the `.local` cert (trust it once
+    with `--install-ca`). Editing the hosts file needs an elevated shell.
+    """
+    step("evo localproxy")
+    run_localproxy(domains, port, bind, no_hosts, cert_dir, install_ca, insecure_upstream, upstream_port)

evo_cli-0.4.0/evo_cli/commands/netcheck.py

@@ -0,0 +1,396 @@
+import json as jsonlib
+import socket
+import ssl
+import struct
+import sys
+import time
+import urllib.error
+import urllib.request
+
+import rich_click as click
+from rich.table import Table
+from rich.text import Text
+
+from evo_cli.console import console, error, info, step, success, warning
+
+DEFAULT_HOSTS = ["google.com", "facebook.com", "github.com"]
+PORT = 443
+SPEED_BYTES = 25_000_000
+SPEED_URL = "https://speed.cloudflare.com/__down?bytes={n}"
+
+# Thresholds used to turn raw numbers into a plain-language verdict.
+DNS_SLOW_MS = 100
+LATENCY_HIGH_MS = 150
+JITTER_HIGH_MS = 80
+
+EPILOG = Text.from_markup(
+    "[bold]Examples[/bold]\n\n"
+    "  [cyan]evo netcheck[/cyan]                         check google, facebook, github\n"
+    "  [cyan]evo netcheck example.com 1.1.1.1[/cyan]     check your own hosts\n"
+    "  [cyan]evo netcheck --speed[/cyan]                 also run a download throughput test\n"
+    "  [cyan]evo netcheck -c 10[/cyan]                    take 10 latency samples per host\n"
+    "  [cyan]evo netcheck --json[/cyan]                  machine-readable output\n\n"
+    "[dim]Splits every connection into DNS / TCP / TLS / TTFB so you can see which\n"
+    "phase is slow, measures latency + jitter + packet loss, and flags the classic\n"
+    "'broken IPv6' case where DNS hands out AAAA records the host cannot reach.[/dim]"
+)
+
+
+def _ms(start):
+    return (time.perf_counter() - start) * 1000
+
+
+def resolve(host, family):
+    """Return resolved addresses for ``family`` (raises socket.gaierror on failure)."""
+    return socket.getaddrinfo(host, PORT, family, socket.SOCK_STREAM)
+
+
+# --- Raw AAAA lookup ---------------------------------------------------------
+# socket.getaddrinfo(AF_INET6) is filtered by the OS when the host has no IPv6
+# source address (Windows returns "getaddrinfo failed"), which would hide the
+# very "broken IPv6" case we want to catch. So query DNS for AAAA records
+# directly over UDP - independent of local IPv6 connectivity, no dependencies.
+PUBLIC_RESOLVERS = ["1.1.1.1", "8.8.8.8"]
+
+
+def dns_resolvers():
+    """Local nameservers first (Linux/mac resolv.conf), then public fallbacks."""
+    found = []
+    try:
+        with open("/etc/resolv.conf") as handle:
+            for line in handle:
+                line = line.strip()
+                if line.startswith("nameserver"):
+                    parts = line.split()
+                    if len(parts) > 1:
+                        found.append(parts[1])
+    except OSError:
+        pass
+    for r in PUBLIC_RESOLVERS:
+        if r not in found:
+            found.append(r)
+    return found
+
+
+def _encode_qname(host):
+    out = bytearray()
+    for label in host.rstrip(".").split("."):
+        raw = label.encode("idna") if any(ord(c) > 127 for c in label) else label.encode()
+        out.append(len(raw))
+        out.extend(raw)
+    out.append(0)
+    return bytes(out)
+
+
+def _skip_name(data, off):
+    """Advance past a (possibly compressed) DNS name and return the new offset."""
+    while off < len(data):
+        length = data[off]
+        if length == 0:
+            return off + 1
+        if length & 0xC0 == 0xC0:  # compression pointer (2 bytes)
+            return off + 2
+        off += 1 + length
+    return off
+
+
+def dns_query_aaaa(host, resolvers, timeout=2.0):
+    """Return AAAA addresses from DNS, [] if none published, or None if DNS unreachable."""
+    header = struct.pack(">HHHHHH", 0xABCD, 0x0100, 1, 0, 0, 0)
+    packet = header + _encode_qname(host) + struct.pack(">HH", 28, 1)  # QTYPE=AAAA, QCLASS=IN
+    for resolver in resolvers:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(timeout)
+        try:
+            sock.sendto(packet, (resolver, 53))
+            data, _ = sock.recvfrom(4096)
+        except OSError:
+            continue
+        finally:
+            sock.close()
+        ancount = struct.unpack(">H", data[6:8])[0]
+        off = _skip_name(data, 12) + 4  # skip question name + qtype/qclass
+        addrs = []
+        for _ in range(ancount):
+            off = _skip_name(data, off)
+            if off + 10 > len(data):
+                break
+            rtype, _rclass, _ttl, rdlength = struct.unpack(">HHIH", data[off : off + 10])
+            off += 10
+            rdata = data[off : off + rdlength]
+            off += rdlength
+            if rtype == 28 and rdlength == 16:
+                addrs.append(socket.inet_ntop(socket.AF_INET6, rdata))
+        return addrs
+    return None
+
+
+def probe(host, timeout):
+    """Time the DNS / TCP / TLS / TTFB phases of one HTTPS connection."""
+    res = {
+        "host": host,
+        "ip": None,
+        "dns_ms": None,
+        "tcp_ms": None,
+        "tls_ms": None,
+        "ttfb_ms": None,
+        "total_ms": None,
+        "aaaa": [],
+        "has_aaaa": False,
+        "error": None,
+    }
+    started = time.perf_counter()
+    try:
+        t = time.perf_counter()
+        infos = resolve(host, socket.AF_INET)
+        res["dns_ms"] = _ms(t)
+        res["ip"] = infos[0][4][0]
+
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(timeout)
+        t = time.perf_counter()
+        sock.connect((res["ip"], PORT))
+        res["tcp_ms"] = _ms(t)
+
+        ctx = ssl.create_default_context()
+        t = time.perf_counter()
+        ssock = ctx.wrap_socket(sock, server_hostname=host)
+        res["tls_ms"] = _ms(t)
+
+        request = (
+            f"HEAD / HTTP/1.1\r\nHost: {host}\r\n"
+            "User-Agent: evo-cli/netcheck\r\nAccept: */*\r\nConnection: close\r\n\r\n"
+        )
+        t = time.perf_counter()
+        ssock.sendall(request.encode())
+        ssock.recv(1)
+        res["ttfb_ms"] = _ms(t)
+        ssock.close()
+        res["total_ms"] = _ms(started)
+    except (socket.gaierror, socket.timeout, OSError, ssl.SSLError) as exc:
+        res["error"] = str(exc)
+    return res
+
+
+def latency_samples(ip, count, timeout):
+    """Measure TCP-connect RTT to ``ip`` ``count`` times; return (rtts_ms, failures)."""
+    rtts = []
+    fails = 0
+    for _ in range(count):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(timeout)
+        try:
+            t = time.perf_counter()
+            sock.connect((ip, PORT))
+            rtts.append(_ms(t))
+        except OSError:
+            fails += 1
+        finally:
+            sock.close()
+    return rtts, fails
+
+
+def measure_host(host, count, timeout, resolvers):
+    row = probe(host, timeout)
+    aaaa = dns_query_aaaa(host, resolvers)
+    row["aaaa"] = aaaa or []
+    row["has_aaaa"] = bool(aaaa)
+    row.update({"avg_ms": None, "min_ms": None, "max_ms": None, "jitter_ms": None, "loss": None})
+    if row["ip"] and count > 0:
+        rtts, fails = latency_samples(row["ip"], count, timeout)
+        total = count
+        row["loss"] = (fails / total) * 100 if total else 0.0
+        if rtts:
+            row["avg_ms"] = sum(rtts) / len(rtts)
+            row["min_ms"] = min(rtts)
+            row["max_ms"] = max(rtts)
+            row["jitter_ms"] = row["max_ms"] - row["min_ms"]
+    return row
+
+
+def check_ipv6(rows, timeout):
+    """Detect broken IPv6: AAAA records exist in DNS but the host cannot reach them."""
+    for row in rows:
+        addrs = row.get("aaaa") or []
+        if not addrs:
+            continue
+        ip = addrs[0]
+        sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+        sock.settimeout(timeout)
+        try:
+            t = time.perf_counter()
+            sock.connect((ip, PORT))
+            return {"status": "healthy", "host": row["host"], "ip": ip, "rtt_ms": _ms(t)}
+        except OSError as exc:
+            return {"status": "broken", "host": row["host"], "ip": ip, "error": str(exc)}
+        finally:
+            sock.close()
+    return {"status": "none"}
+
+
+def speed_test(timeout):
+    url = SPEED_URL.format(n=SPEED_BYTES)
+    req = urllib.request.Request(url, headers={"User-Agent": "evo-cli/netcheck"})
+    total = 0
+    started = time.perf_counter()
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            while True:
+                chunk = resp.read(65536)
+                if not chunk:
+                    break
+                total += len(chunk)
+    except (urllib.error.URLError, socket.timeout, OSError) as exc:
+        return {"error": str(exc)}
+    elapsed = time.perf_counter() - started
+    mbps = (total * 8) / elapsed / 1e6 if elapsed else 0.0
+    return {"bytes": total, "seconds": elapsed, "mbps": mbps}
+
+
+def fmt(value, suffix="", missing="-"):
+    if value is None:
+        return missing
+    return f"{value:.0f}{suffix}"
+
+
+def render_table(rows):
+    table = Table(show_header=True, header_style="accent", expand=False)
+    table.add_column("Host", style="info", no_wrap=True)
+    table.add_column("IP", style="dim", no_wrap=True, min_width=15)
+    table.add_column("DNS", justify="right")
+    table.add_column("TCP", justify="right")
+    table.add_column("TLS", justify="right")
+    table.add_column("TTFB", justify="right")
+    table.add_column("Latency avg/jit", justify="right")
+    table.add_column("Loss", justify="right")
+    table.add_column("v6", justify="center")
+
+    for r in rows:
+        if r["error"]:
+            table.add_row(r["host"], "[error]unreachable[/error]", "-", "-", "-", "-", "-", "-", "-")
+            continue
+        latency = f"{fmt(r['avg_ms'])}/{fmt(r['jitter_ms'])}ms" if r["avg_ms"] is not None else "-"
+        loss = r["loss"]
+        loss_text = "-" if loss is None else (f"[error]{loss:.0f}%[/error]" if loss > 0 else "0%")
+        v6 = "[success]yes[/success]" if r["has_aaaa"] else "[dim]no[/dim]"
+        table.add_row(
+            r["host"],
+            r["ip"] or "-",
+            fmt(r["dns_ms"], "ms"),
+            fmt(r["tcp_ms"], "ms"),
+            fmt(r["tls_ms"], "ms"),
+            fmt(r["ttfb_ms"], "ms"),
+            latency,
+            loss_text,
+            v6,
+        )
+    console.print(table)
+
+
+def build_notes(rows, ipv6):
+    notes = []
+    for r in rows:
+        if r["error"]:
+            notes.append(("error", f"{r['host']}: cannot connect - {r['error']}"))
+            continue
+        if r["dns_ms"] and r["dns_ms"] > DNS_SLOW_MS:
+            notes.append(("warning", f"{r['host']}: slow DNS ({r['dns_ms']:.0f}ms)"))
+        if r["avg_ms"] and r["avg_ms"] > LATENCY_HIGH_MS:
+            notes.append(("warning", f"{r['host']}: high latency ({r['avg_ms']:.0f}ms avg)"))
+        if r["loss"]:
+            notes.append(("warning", f"{r['host']}: {r['loss']:.0f}% packet loss"))
+        if r["jitter_ms"] and r["jitter_ms"] > JITTER_HIGH_MS:
+            notes.append(("warning", f"{r['host']}: high jitter ({r['jitter_ms']:.0f}ms)"))
+    if ipv6["status"] == "broken":
+        notes.append(
+            (
+                "warning",
+                "broken IPv6: DNS returns AAAA records but the host can't reach IPv6 "
+                f"({ipv6['host']} {ipv6['ip']}). This can cause lag on dual-stack sites; "
+                "prefer IPv4 (Windows: set Tcpip6 DisabledComponents = 0x20, then reboot).",
+            )
+        )
+    return notes
+
+
+def run(hosts, count, timeout, want_speed, as_json):
+    resolvers = dns_resolvers()
+    rows = []
+    for host in hosts:
+        with console.status(f"[info]probing {host}...[/info]", spinner="dots"):
+            rows.append(measure_host(host, count, timeout, resolvers))
+
+    with console.status("[info]checking IPv6 reachability...[/info]", spinner="dots"):
+        ipv6 = check_ipv6(rows, timeout)
+
+    speed = None
+    if want_speed:
+        with console.status("[info]running throughput test (25MB)...[/info]", spinner="dots"):
+            speed = speed_test(max(timeout, 60))
+
+    if as_json:
+        payload = {"hosts": rows, "ipv6": ipv6, "speed": speed}
+        console.print_json(jsonlib.dumps(payload, ensure_ascii=False))
+        return payload
+
+    render_table(rows)
+
+    if ipv6["status"] == "healthy":
+        info(f"IPv6: reachable via [accent]{ipv6['host']}[/accent] ({fmt(ipv6['rtt_ms'], 'ms')})")
+    elif ipv6["status"] == "broken":
+        warning("IPv6: AAAA records resolve but cannot connect (broken / half-configured)")
+    else:
+        info("IPv6: no AAAA records served - IPv4-only, nothing to worry about")
+
+    if speed is not None:
+        if speed.get("error"):
+            warning(f"Speed test failed: {speed['error']}")
+        else:
+            mb = speed["bytes"] / 1e6
+            success(
+                f"Throughput: [accent]{speed['mbps']:.0f} Mbps[/accent] "
+                f"({mb:.0f}MB in {speed['seconds']:.1f}s)"
+            )
+
+    notes = build_notes(rows, ipv6)
+    step("Verdict")
+    if not notes:
+        success("Everything looks healthy - DNS, latency, loss and routing are all fine.")
+    else:
+        for level, message in notes:
+            {"warning": warning, "error": error}.get(level, info)(message)
+
+    return {"hosts": rows, "ipv6": ipv6, "speed": speed}
+
+
+@click.command("netcheck", epilog=EPILOG)
+@click.argument("hosts", nargs=-1)
+@click.option("-c", "--count", default=4, show_default=True, help="Latency samples (TCP RTT) per host.")
+@click.option("-t", "--timeout", default=5.0, show_default=True, help="Per-connection timeout (seconds).")
+@click.option("-s", "--speed", "want_speed", is_flag=True, help="Also run a 25MB download throughput test.")
+@click.option("--json", "as_json", is_flag=True, help="Print result as JSON.")
+def netcheck(hosts, count, timeout, want_speed, as_json):
+    """Diagnose why network access feels slow.
+
+    For each `HOST` (default: google.com, facebook.com, github.com) this splits a
+    real HTTPS connection into its **DNS**, **TCP**, **TLS** and **TTFB** phases so
+    you can see exactly where the time goes, then takes several TCP round-trips to
+    report **latency**, **jitter** and **packet loss**.
+
+    It also flags the classic *broken IPv6* trap - where DNS hands out AAAA
+    records the machine cannot actually reach, making dual-stack sites (Google,
+    Facebook) lag while a plain `curl` looks fine - and, with `--speed`, measures
+    real download throughput.
+
+    Pure Python (sockets), so it needs no admin rights and works the same on
+    Windows and Linux.
+    """
+    step("evo netcheck")
+    targets = list(hosts) if hosts else DEFAULT_HOSTS
+    try:
+        run(targets, count, timeout, want_speed, as_json)
+    except click.ClickException:
+        raise
+    except Exception as exc:
+        error(str(exc))
+        sys.exit(1)

{evo_cli-0.3.1 → evo_cli-0.4.0}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.3.1
+Version: 0.4.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -14,6 +14,7 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: cryptography>=41.0
 Requires-Dist: paramiko>=2.7.0
 Requires-Dist: rich>=13.0
 Requires-Dist: rich-click>=1.8

{evo_cli-0.3.1 → evo_cli-0.4.0}/evo_cli.egg-info/SOURCES.txt

@@ -20,7 +20,9 @@ evo_cli/commands/__init__.py
 evo_cli/commands/cloudflare.py
 evo_cli/commands/fix_claude.py
 evo_cli/commands/gdrive.py
+evo_cli/commands/localproxy.py
 evo_cli/commands/miniconda.py
+evo_cli/commands/netcheck.py
 evo_cli/commands/site2s.py
 evo_cli/commands/ssh.py
 tests/__init__.py

{evo_cli-0.3.1 → evo_cli-0.4.0}/evo_cli.egg-info/requires.txt

@@ -1,3 +1,4 @@
+cryptography>=41.0
 paramiko>=2.7.0
 rich>=13.0
 rich-click>=1.8

{evo_cli-0.3.1 → evo_cli-0.4.0}/pyproject.toml

@@ -18,6 +18,7 @@ classifiers = [
     "Programming Language :: Python :: 3",
 ]
 dependencies = [
+    "cryptography>=41.0",
     "paramiko>=2.7.0",
     "rich>=13.0",
     "rich-click>=1.8",

evo_cli-0.3.1/evo_cli/VERSION

@@ -1 +0,0 @@
-0.3.1