evo-cli 0.31.1__tar.gz → 0.31.3__tar.gz

{evo_cli-0.31.1 → evo_cli-0.31.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.31.1
+Version: 0.31.3
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.31.3/evo_cli/VERSION

@@ -0,0 +1 @@
+0.31.3

{evo_cli-0.31.1 → evo_cli-0.31.3}/evo_cli/commands/route/__init__.py

@@ -20,7 +20,9 @@ edit can touch it.
 - `status` - which fixes are currently in place
 
 `check` and `probe` are pure Python sockets and need no privileges. `open` and
-`close` edit hosts or manage a service, so they want administrator rights.
+`close` edit hosts or manage a service, so they want administrator rights. On
+macOS the DPI bypass is SpoofDPI run as your own LaunchAgent behind the system
+proxy, which needs none.
 """
 
 

{evo_cli-0.31.1 → evo_cli-0.31.3}/evo_cli/commands/route/_dpi.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import hashlib
 import os
 import subprocess
+import sys
 import tempfile
 import zipfile
 from pathlib import Path
@@ -27,6 +28,11 @@ def is_windows():
     return os.name == "nt"
 
 
+def is_macos():
+    """macOS gets SpoofDPI instead of GoodbyeDPI; see _spoofdpi."""
+    return sys.platform == "darwin"
+
+
 def is_admin():
     if not is_windows():
         return os.geteuid() == 0 if hasattr(os, "geteuid") else False
@@ -61,7 +67,7 @@ def _sc(*args, check=False):
 
 def service_state():
     if not is_windows():
-        return {"installed": False, "running": False, "args": None, "reason": "windows only"}
+        return {"installed": False, "running": False, "args": None, "reason": "Windows and macOS only"}
     result = _sc("qc", SERVICE_NAME)
     if result.returncode != 0:
         return {"installed": False, "running": False, "args": None, "reason": None}

{evo_cli-0.31.1 → evo_cli-0.31.3}/evo_cli/commands/route/_probe.py

@@ -37,12 +37,38 @@ def tls_probe(ip, sni, timeout=6.0):
     handshake is allowed to finish, not whether the certificate matches the
     name we announced.
     """
+    return _tls_over(lambda sock: sock.connect((ip, PORT)), ip, sni, timeout)
+
+
+def proxy_probe(host, proxy, timeout=6.0):
+    """Like ``tls_probe``, but through the HTTP proxy at ``proxy``: CONNECT first, then the handshake.
+
+    A raw socket never sees a bypass that lives in a proxy, so this is how to tell whether it works.
+    """
+
+    def connect(sock):
+        sock.connect(proxy)
+        sock.sendall(f"CONNECT {host}:{PORT} HTTP/1.1\r\nHost: {host}:{PORT}\r\n\r\n".encode())
+        reply = b""
+        while b"\r\n\r\n" not in reply:
+            chunk = sock.recv(4096)
+            if not chunk:
+                break
+            reply += chunk
+        status = reply.split(b"\r\n", 1)[0].decode(errors="replace")
+        if status.split()[1:2] != ["200"]:
+            raise OSError(f"proxy answered {status or 'nothing'}")
+
+    return _tls_over(connect, f"{proxy[0]}:{proxy[1]}", host, timeout)
+
+
+def _tls_over(connect, ip, sni, timeout):
     result = {"ip": ip, "sni": sni, "tcp": False, "tls": False, "ms": None, "error": None, "reset": False}
     started = time.perf_counter()
     sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     sock.settimeout(timeout)
     try:
-        sock.connect((ip, PORT))
+        connect(sock)
         result["tcp"] = True
         context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         context.check_hostname = False

evo_cli-0.31.3/evo_cli/commands/route/_spoofdpi.py

@@ -0,0 +1,344 @@
+"""The DPI bypass on macOS: SpoofDPI behind the system proxy, run as a LaunchAgent.
+
+GoodbyeDPI has no macOS build. SpoofDPI is a local HTTP proxy that splits the
+TLS ClientHello, so the filter never reads the server name in one piece. It only
+does that for the hosts `evo route open` named: every other name passes through
+untouched and resolves with the system resolver, so names only a VPN knows keep
+working. The named hosts resolve over DoH instead, because a name the filter
+blocks usually has its DNS answer poisoned too.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import plistlib
+import shutil
+import socket
+import subprocess
+import time
+from pathlib import Path
+
+from evo_cli.console import info, run_command
+
+LABEL = "com.evo.route.spoofdpi"
+LISTEN_HOST = "127.0.0.1"
+# Off 8080, where development servers live.
+LISTEN_PORT = 18080
+
+# `first-byte` cuts the TLS record header off the rest of the ClientHello, and the
+# filter does not put the two back together. SpoofDPI's default `sni` split, which
+# cuts inside the server name, still gets the handshake reset (medium.com, 2026-10).
+SPLIT_MODE = "first-byte"
+
+CONFIG = f"""# Written by `evo route open`; the hosts it opened are listed in hosts.txt.
+[dns]
+mode = "system"
+
+[https]
+skip = true
+
+[[rules]]
+name = "evo route open"
+priority = 50
+match = {{ domains = ["file:hosts.txt"] }}
+dns = {{ mode = "https", cache = true }}
+https = {{ skip = false, split-mode = "{SPLIT_MODE}" }}
+"""
+
+# networksetup names both proxies by these words: -getwebproxy, -setsecurewebproxystate, ...
+PROXY_KINDS = ("webproxy", "securewebproxy")
+
+# Chromium browsers, under ~/Library/Application Support; each profile keeps extension-held settings
+# in its Secure Preferences.
+BROWSERS = ("Google/Chrome", "BraveSoftware/Brave-Browser", "Microsoft Edge", "Chromium")
+
+
+def home():
+    return Path(os.environ.get("EVO_ROUTE_HOME", str(Path.home() / ".evo" / "route")))
+
+
+def config_path():
+    return home() / "spoofdpi.toml"
+
+
+def hosts_path():
+    return home() / "hosts.txt"
+
+
+def agent_path():
+    return Path.home() / "Library" / "LaunchAgents" / f"{LABEL}.plist"
+
+
+def log_path():
+    return Path.home() / "Library" / "Logs" / "evo-route-spoofdpi.log"
+
+
+def listen():
+    return f"{LISTEN_HOST}:{LISTEN_PORT}"
+
+
+def opened():
+    """The hosts the bypass covers, as `evo route open` named them."""
+    try:
+        lines = hosts_path().read_text(encoding="utf-8").splitlines()
+    except FileNotFoundError:
+        return []
+    return [line for line in lines if line and not line.startswith(("#", "*."))]
+
+
+def _write_hosts(hosts):
+    home().mkdir(parents=True, exist_ok=True)
+    lines = [pattern for host in sorted(set(hosts)) for pattern in (host, f"*.{host}")]
+    hosts_path().write_text("".join(f"{line}\n" for line in lines), encoding="utf-8")
+
+
+def executable():
+    found = shutil.which("spoofdpi")
+    if found:
+        return found
+    # launchd and some shells start without Homebrew on PATH.
+    for candidate in ("/opt/homebrew/bin/spoofdpi", "/usr/local/bin/spoofdpi"):
+        if Path(candidate).exists():
+            return candidate
+    return None
+
+
+def install():
+    brew = shutil.which("brew") or next(
+        (path for path in ("/opt/homebrew/bin/brew", "/usr/local/bin/brew") if Path(path).exists()), None
+    )
+    if not brew:
+        raise RuntimeError("SpoofDPI is not installed and neither is Homebrew - install one of them first.")
+    info("SpoofDPI is not installed yet, installing it with Homebrew")
+    run_command([brew, "install", "spoofdpi"])
+    found = executable()
+    if not found:
+        raise RuntimeError("brew installed spoofdpi, but it is not on PATH.")
+    return found
+
+
+def _program(exe):
+    return [exe, "--config", str(config_path()), "--no-tui", "--listen-addr", listen()]
+
+
+def _write_agent(exe):
+    """Write the LaunchAgent; True when its content changed."""
+    plist = plistlib.dumps(
+        {
+            "Label": LABEL,
+            "ProgramArguments": _program(exe),
+            "RunAtLoad": True,
+            "KeepAlive": True,
+            "StandardOutPath": str(log_path()),
+            "StandardErrorPath": str(log_path()),
+        }
+    )
+    path = agent_path()
+    if path.exists() and path.read_bytes() == plist:
+        return False
+    path.parent.mkdir(parents=True, exist_ok=True)
+    log_path().parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(plist)
+    return True
+
+
+def _launchctl(*args):
+    return subprocess.run(["launchctl", *args], capture_output=True, text=True, stdin=subprocess.DEVNULL, check=False)
+
+
+def _domain():
+    return f"gui/{os.getuid()}"
+
+
+def _loaded():
+    return _launchctl("print", f"{_domain()}/{LABEL}").returncode == 0
+
+
+def _listening(timeout=0.5):
+    try:
+        with socket.create_connection((LISTEN_HOST, LISTEN_PORT), timeout=timeout):
+            return True
+    except OSError:
+        return False
+
+
+def _wait(condition, seconds):
+    deadline = time.monotonic() + seconds
+    while time.monotonic() < deadline:
+        if condition():
+            return True
+        time.sleep(0.2)
+    return condition()
+
+
+def _start(reload):
+    """Start or restart the agent and wait for the proxy port. SpoofDPI reads hosts.txt only when it starts."""
+    if _loaded() and not reload:
+        _launchctl("kickstart", "-k", f"{_domain()}/{LABEL}")
+    else:
+        if _loaded():
+            _launchctl("bootout", f"{_domain()}/{LABEL}")
+            _wait(lambda: not _listening(), 5)
+        if _listening():
+            raise RuntimeError(f"Something else already listens on {listen()}.")
+        result = _launchctl("bootstrap", _domain(), str(agent_path()))
+        if result.returncode != 0:
+            raise RuntimeError(f"launchctl bootstrap failed: {(result.stderr or result.stdout).strip()}")
+    return _wait(_listening, 10)
+
+
+def _networksetup(*args):
+    return subprocess.run(
+        ["networksetup", *args], capture_output=True, text=True, stdin=subprocess.DEVNULL, check=False
+    )
+
+
+def network_services():
+    """Enabled network services. The first line of the listing explains that `*` marks a disabled one."""
+    lines = _networksetup("-listallnetworkservices").stdout.splitlines()[1:]
+    return [line for line in lines if line.strip() and not line.startswith("*")]
+
+
+def _proxy(service, kind):
+    fields = {}
+    for line in _networksetup(f"-get{kind}", service).stdout.splitlines():
+        key, _, value = line.partition(":")
+        fields[key.strip()] = value.strip()
+    return fields.get("Enabled") == "Yes", fields.get("Server", ""), fields.get("Port", "")
+
+
+def _ours(server, port):
+    return server == LISTEN_HOST and port == str(LISTEN_PORT)
+
+
+def proxied_services():
+    """The services whose system proxy points at the bypass."""
+    services = []
+    for service in network_services():
+        proxies = [_proxy(service, kind) for kind in PROXY_KINDS]
+        if any(enabled and _ours(server, port) for enabled, server, port in proxies):
+            services.append(service)
+    return services
+
+
+def _proxy_conflicts():
+    conflicts = []
+    for service in network_services():
+        for kind in PROXY_KINDS:
+            enabled, server, port = _proxy(service, kind)
+            if enabled and not _ours(server, port):
+                conflicts.append(f"{service} ({server}:{port})")
+    return conflicts
+
+
+def set_system_proxy():
+    services = network_services()
+    for service in services:
+        for kind in PROXY_KINDS:
+            result = _networksetup(f"-set{kind}", service, LISTEN_HOST, str(LISTEN_PORT))
+            if result.returncode != 0:
+                raise RuntimeError(
+                    f"networksetup -set{kind} {service} failed: {(result.stderr or result.stdout).strip()}"
+                )
+    return services
+
+
+def clear_system_proxy():
+    """Turn off only the proxies that point at the bypass; one the user set stays as it was."""
+    cleared = []
+    for service in network_services():
+        for kind in PROXY_KINDS:
+            enabled, server, port = _proxy(service, kind)
+            if enabled and _ours(server, port):
+                _networksetup(f"-set{kind}state", service, "off")
+                if service not in cleared:
+                    cleared.append(service)
+    return cleared
+
+
+def _extension_name(profile, ext_id):
+    for path in sorted((profile / "Extensions" / ext_id).glob("*/manifest.json")):
+        try:
+            manifest = json.loads(path.read_text(encoding="utf-8-sig"))
+            name = manifest.get("name", "")
+            if name.startswith("__MSG_"):
+                # A localised name: "__MSG_key__" looked up, ignoring case, in the default locale's messages.
+                locale = manifest.get("default_locale", "en")
+                messages = json.loads(
+                    (path.parent / "_locales" / locale / "messages.json").read_text(encoding="utf-8-sig")
+                )
+                key = name[len("__MSG_") : -len("__")].lower()
+                name = next((value["message"] for k, value in messages.items() if k.lower() == key), "")
+        except (OSError, ValueError, KeyError, TypeError):
+            continue
+        if name:
+            return name
+    return ext_id
+
+
+def browser_overrides(support=None):
+    """Enabled browser extensions that hold the proxy setting, so their browser never sees the system proxy.
+
+    A VPN extension keeps holding it while switched off, set to `direct`.
+    """
+    support = Path(support or Path.home() / "Library" / "Application Support")
+    found = []
+    for browser in BROWSERS:
+        for prefs in sorted((support / browser).glob("*/Secure Preferences")):
+            try:
+                settings = json.loads(prefs.read_text(encoding="utf-8"))["extensions"]["settings"]
+            except (OSError, ValueError, KeyError, TypeError):
+                continue
+            for ext_id, ext in settings.items():
+                enabled = not ext.get("disable_reasons") and ext.get("state", 1) != 0
+                if enabled and "proxy" in ext.get("preferences", {}):
+                    name = _extension_name(prefs.parent, ext_id)
+                    found.append(f"{browser.split('/')[-1]} ({prefs.parent.name}): {name}")
+    return found
+
+
+def service_state():
+    exe = executable()
+    return {
+        "installed": agent_path().exists(),
+        "running": _loaded() and _listening(),
+        "args": " ".join(_program(exe or "spoofdpi")),
+        "reason": None,
+        "hosts": opened(),
+        "proxy": proxied_services(),
+    }
+
+
+def ensure(host):
+    """Put ``host`` through the bypass: install SpoofDPI, (re)start its agent, point the system proxy at it."""
+    conflicts = _proxy_conflicts()
+    if conflicts:
+        raise RuntimeError(f"A proxy is already set on {', '.join(conflicts)}; evo will not replace it.")
+    exe = executable() or install()
+    home().mkdir(parents=True, exist_ok=True)
+    config_path().write_text(CONFIG, encoding="utf-8")
+    _write_hosts([*opened(), host])
+    if not _start(reload=_write_agent(exe)):
+        return service_state()
+    set_system_proxy()
+    return service_state()
+
+
+def forget(host):
+    """Take ``host`` out of the bypass; the last one out stops it altogether."""
+    hosts = [name for name in opened() if name != host]
+    if not hosts:
+        return remove()
+    _write_hosts(hosts)
+    _start(reload=False)
+    return True
+
+
+def remove():
+    """Clear the system proxy first, so nothing points at a proxy that is gone, then stop and drop the agent."""
+    clear_system_proxy()
+    _launchctl("bootout", f"{_domain()}/{LABEL}")
+    agent_path().unlink(missing_ok=True)
+    hosts_path().unlink(missing_ok=True)
+    return True

{evo_cli-0.31.1 → evo_cli-0.31.3}/evo_cli/commands/route/fix.py

@@ -5,7 +5,7 @@ import sys
 import rich_click as click
 from rich.text import Text
 
-from evo_cli.commands.route import _dpi, _hosts, _probe
+from evo_cli.commands.route import _dpi, _hosts, _probe, _spoofdpi
 from evo_cli.console import console, error, info, step, success, warning
 
 OPEN_EPILOG = Text.from_markup(
@@ -16,12 +16,13 @@ OPEN_EPILOG = Text.from_markup(
     "  [cyan]evo route open x.com --method dpi[/cyan]         force the DPI bypass\n\n"
     "[dim]Diagnoses first, then applies only the fix that matches: pinning an address\n"
     "for a poisoned name, or the packet-level bypass for a name-keyed block.\n"
-    "Needs administrator rights because it edits hosts / installs a service.[/dim]"
+    "Needs administrator rights because it edits hosts / installs a service;\n"
+    "on macOS the bypass is SpoofDPI as your own LaunchAgent and needs no sudo.[/dim]"
 )
 
 CLOSE_EPILOG = Text.from_markup(
     "[bold]Examples[/bold]\n\n"
-    "  [cyan]evo route close medium.com[/cyan]      drop that one pinned address\n"
+    "  [cyan]evo route close medium.com[/cyan]      drop its pin, or take it out of the bypass\n"
     "  [cyan]evo route close --all[/cyan]           drop every pin evo added\n"
     "  [cyan]evo route close --dpi[/cyan]           stop and remove the DPI bypass\n\n"
     "[dim]Only touches the block evo owns, marked in hosts by `# >>> evo route >>>`.\n"
@@ -51,9 +52,34 @@ def _apply_hosts(report, dry_run):
     return best
 
 
+def _apply_spoofdpi(host, dry_run):
+    if dry_run:
+        state = _spoofdpi.service_state()
+        if state["running"] and host in state["hosts"]:
+            info(f"{host} already goes through the DPI bypass - nothing to do.")
+        else:
+            info(f"Would run SpoofDPI on {_spoofdpi.listen()} as the system proxy, splitting the handshake for {host}")
+        return None
+    if _dpi.is_admin():
+        error("Run this without sudo: SpoofDPI runs as your own LaunchAgent and sets your proxy.")
+        sys.exit(1)
+    try:
+        state = _spoofdpi.ensure(host)
+    except RuntimeError as exc:
+        error(str(exc))
+        sys.exit(1)
+    if not state["running"]:
+        error(f"SpoofDPI would not start - see {_spoofdpi.log_path()}")
+        sys.exit(1)
+    success(f"DPI bypass is running on {_spoofdpi.listen()}, system proxy set on {', '.join(state['proxy'])}")
+    return state
+
+
 def _apply_dpi(report, dry_run):
+    if _dpi.is_macos():
+        return _apply_spoofdpi(report["host"], dry_run)
     if not _dpi.is_windows():
-        error("The DPI bypass is Windows-only. On Linux use a tunnel, or a tool like zapret.")
+        error("The DPI bypass runs on Windows and macOS. On Linux use a tunnel, or a tool like zapret.")
         sys.exit(1)
     if dry_run:
         state = _dpi.service_state()
@@ -121,6 +147,8 @@ def open_route(host, method, dry_run, timeout):
         return report
 
     step("Verify")
+    if method == "dpi" and _dpi.is_macos():
+        return _verify_through_proxy(host, timeout)
     with console.status(f"[info]re-checking {host}...[/info]", spinner="dots"):
         after = _probe.diagnose(host, timeout=timeout)
     if after["verdict"] in (_probe.OPEN, _probe.DNS_POISONED) and after["working"]:
@@ -130,6 +158,21 @@ def open_route(host, method, dry_run, timeout):
     return after
 
 
+def _verify_through_proxy(host, timeout):
+    """The macOS bypass lives in a proxy, which a fresh diagnosis over raw sockets would never use."""
+    proxy = (_spoofdpi.LISTEN_HOST, _spoofdpi.LISTEN_PORT)
+    with console.status(f"[info]re-checking {host} through the proxy...[/info]", spinner="dots"):
+        row = _probe.proxy_probe(host, proxy, timeout=timeout)
+    if row["tls"]:
+        success(f"{host} is reachable through the DPI bypass")
+        info(f"Browsers pick it up from the system proxy; curl and other CLIs need -x http://{_spoofdpi.listen()}")
+        for override in _spoofdpi.browser_overrides():
+            warning(f"{override} holds the browser's proxy setting, so that browser skips the bypass - disable it")
+    else:
+        warning(f"{host} still fails through the bypass: {row['error']}. See {_spoofdpi.log_path()}")
+    return row
+
+
 @click.command("close", epilog=CLOSE_EPILOG)
 @click.argument("host", required=False)
 @click.option("--all", "drop_all", is_flag=True, help="Remove every address evo pinned.")
@@ -152,16 +195,26 @@ def close_route(host, drop_all, drop_dpi):
         _hosts.clear()
         success(f"Removed {len(entries)} pinned address(es)")
     elif host:
-        _require_admin("Editing hosts")
-        _, removed = _hosts.unpin(host)
-        if removed:
+        closed = False
+        if _dpi.is_macos() and host in _spoofdpi.opened():
+            _spoofdpi.forget(host)
+            success(f"Took {host} out of the DPI bypass")
+            closed = True
+        if host in _hosts.read_block():
+            _require_admin("Editing hosts")
+            _hosts.unpin(host)
             success(f"Unpinned {host}")
-        else:
-            info(f"{host} was not pinned by evo - nothing changed.")
+            closed = True
+        if not closed:
+            info(f"{host} was not opened by evo - nothing changed.")
 
     if drop_dpi:
+        if _dpi.is_macos():
+            _spoofdpi.remove()
+            success("DPI bypass stopped and the system proxy cleared")
+            return
         if not _dpi.is_windows():
-            error("The DPI bypass is Windows-only.")
+            error("The DPI bypass runs on Windows and macOS.")
             sys.exit(1)
         _require_admin("Removing the DPI bypass")
         if _dpi.remove():

{evo_cli-0.31.1 → evo_cli-0.31.3}/evo_cli/commands/route/status.py

@@ -6,7 +6,7 @@ import rich_click as click
 from rich.table import Table
 from rich.text import Text
 
-from evo_cli.commands.route import _dpi, _hosts
+from evo_cli.commands.route import _dpi, _hosts, _spoofdpi
 from evo_cli.console import console, info, step, success
 
 EPILOG = Text.from_markup(
@@ -22,7 +22,7 @@ def collect():
     return {
         "hosts_file": str(_hosts.hosts_path()),
         "pinned": _hosts.read_block(),
-        "dpi": _dpi.service_state(),
+        "dpi": _spoofdpi.service_state() if _dpi.is_macos() else _dpi.service_state(),
         "admin": _dpi.is_admin(),
     }
 
@@ -68,5 +68,9 @@ def status(as_json):
     else:
         info("Installed but stopped.")
         console.print(f"  [dim]{dpi['args']}[/dim]")
+    if dpi.get("hosts"):
+        info(f"Hosts: {', '.join(dpi['hosts'])} - remove with `evo route close <host>`")
+    if dpi.get("proxy"):
+        info(f"System proxy set on {', '.join(dpi['proxy'])}")
 
     return state