evo-cli 0.32.1__tar.gz → 0.34.0__tar.gz

{evo_cli-0.32.1 → evo_cli-0.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.32.1
+Version: 0.34.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.34.0/evo_cli/VERSION

@@ -0,0 +1 @@
+0.34.0

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/commands/openvpn.py

@@ -392,9 +392,15 @@ def connect(name, timeout, sudo_password_stdin, watch):
     password = ""
     click.echo(f"Connecting {name}; disconnect any external GUI VPN first. System DNS is not modified.")
     deadline = time.monotonic() + timeout + 20
+    shown = None
     try:
         while time.monotonic() < deadline:
             state = _ask(name)
+            if state.get("auth_url") and state["auth_url"] != shown:
+                shown = state["auth_url"]
+                click.echo(f"Sign in to finish connecting (opened in your browser): {shown}")
+            if state.get("auth_expires"):
+                deadline = max(deadline, time.monotonic() + state["auth_expires"] - time.time() + 20)
             if state["state"] == "CONNECTED":
                 click.echo(f"{name}: connected, tunnel IP {state.get('vpn_ip', 'unknown')}")
                 break

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/commands/route/__init__.py

@@ -15,7 +15,7 @@ edit can touch it.
 
 - `check <host>` - what stands in the way, and which of the two it is
 - `probe <host>` - every address for the name, ranked by what answers
-- `open <host>` - apply the fix the diagnosis calls for
+- `open <host>` - apply the fix the diagnosis calls for, and see to what its page loads
 - `close <host>` - undo it again
 - `status` - which fixes are currently in place
 

evo_cli-0.34.0/evo_cli/commands/route/_page.py

@@ -0,0 +1,96 @@
+"""What a page loads besides itself: a site is not open until its stylesheets and images are."""
+
+from __future__ import annotations
+
+import ipaddress
+import urllib.parse
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+from html.parser import HTMLParser
+
+from evo_cli.commands.route import _probe
+
+# Far past any <head>, and the rest of a long page repeats the same hosts.
+MAX_PAGE = 2 * 1024 * 1024
+WORKERS = 8
+USER_AGENT = (
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 "
+    "(KHTML, like Gecko) Version/17.6 Safari/605.1.15"
+)
+
+# The <link> kinds a browser acts on by itself, unlike canonical or alternate.
+LINK_RELS = {"stylesheet", "preload", "modulepreload", "preconnect", "dns-prefetch", "icon"}
+SOURCE_TAGS = {"script", "img", "source", "video", "audio", "iframe"}
+
+# Under a country code these are a public suffix, not a site: example.com.vn, example.co.uk.
+COUNTRY_SECOND_LEVEL = {"ac", "co", "com", "edu", "gov", "net", "org"}
+
+
+class _AssetParser(HTMLParser):
+    def __init__(self):
+        super().__init__()
+        self.urls = []
+
+    def handle_starttag(self, tag, attrs):
+        fields = dict(attrs)
+        if tag == "link":
+            if LINK_RELS & set((fields.get("rel") or "").lower().split()):
+                self.urls.append(fields.get("href"))
+        elif tag in SOURCE_TAGS:
+            self.urls.append(fields.get("src"))
+            self.urls.extend(part.split()[0] for part in (fields.get("srcset") or "").split(",") if part.strip())
+
+
+def _is_ip(name):
+    try:
+        ipaddress.ip_address(name)
+    except ValueError:
+        return False
+    return True
+
+
+def asset_hosts(html, base_url):
+    """The names a browser would connect to for this page, ignoring what only a click would reach."""
+    parser = _AssetParser()
+    parser.feed(html)
+    hosts = []
+    for url in parser.urls:
+        try:
+            name = urllib.parse.urlsplit(urllib.parse.urljoin(base_url, url or "")).hostname
+        except ValueError:
+            continue
+        if name and "." in name and not _is_ip(name) and name not in hosts:
+            hosts.append(name)
+    return hosts
+
+
+def fetch(host, proxy=None, timeout=6.0):
+    """Read the front page of ``host``, through ``proxy`` when there is one; returns where it ended up and the HTML."""
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({"http": proxy, "https": proxy} if proxy else {}))
+    request = urllib.request.Request(f"https://{host}/", headers={"User-Agent": USER_AGENT, "Accept": "text/html"})
+    with opener.open(request, timeout=timeout) as response:
+        return response.geturl(), response.read(MAX_PAGE).decode("utf-8", "replace")
+
+
+def registrable(host):
+    labels = host.split(".")
+    keep = 3 if len(labels[-1]) == 2 and labels[-2] in COUNTRY_SECOND_LEVEL else 2
+    return ".".join(labels[-keep:])
+
+
+def covers(opened, host):
+    return any(host == name or host.endswith(f".{name}") for name in opened)
+
+
+def blocked_hosts(host, proxy, opened, timeout=6.0):
+    """The hosts the page at ``host`` needs that a browser cannot reach, leaving out what ``opened`` already covers.
+
+    The site's own family is in the running because a page calls its API and sign-in
+    hosts from script, where no tag shows them.
+    """
+    final_url, html = fetch(host, proxy=proxy, timeout=timeout)
+    names = dict.fromkeys([*asset_hosts(html, final_url), registrable(host)])
+    names = [name for name in names if not covers([host, *opened], name)]
+    with ThreadPoolExecutor(max_workers=WORKERS) as pool:
+        alive = list(pool.map(lambda name: _probe.reachable(name, timeout=timeout), names))
+    return [name for name, ok in zip(names, alive) if not ok]

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/commands/route/_probe.py

@@ -105,6 +105,12 @@ def rank(host, candidates, timeout=6.0):
     return rows
 
 
+def reachable(host, timeout=6.0):
+    """Whether a browser going straight to what the system resolves gets a handshake."""
+    ips = [ip for ip in _dns.system_resolve(host) or [] if not _dns.is_bogus(ip)]
+    return any(tls_probe(ip, host, timeout=timeout)["tls"] for ip in ips)
+
+
 def candidates(answers):
     """The system's own addresses first, since those are what a browser connects to, then every trusted one."""
     system = [ip for ip in answers["system"] or [] if not _dns.is_bogus(ip)]

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/commands/route/_spoofdpi.py

@@ -84,12 +84,13 @@ def opened():
         lines = hosts_path().read_text(encoding="utf-8").splitlines()
     except FileNotFoundError:
         return []
-    return [line for line in lines if line and not line.startswith(("#", "*."))]
+    return [line for line in lines if line and not line.startswith(("#", "*"))]
 
 
 def _write_hosts(hosts):
     home().mkdir(parents=True, exist_ok=True)
-    lines = [pattern for host in sorted(set(hosts)) for pattern in (host, f"*.{host}")]
+    # `*` stands for one label and `**` for any number: a CDN name like store.fastly.example.com needs the second.
+    lines = [pattern for host in sorted(set(hosts)) for pattern in (host, f"**.{host}")]
     hosts_path().write_text("".join(f"{line}\n" for line in lines), encoding="utf-8")
 
 
@@ -310,15 +311,15 @@ def service_state():
     }
 
 
-def ensure(host):
-    """Put ``host`` through the bypass: install SpoofDPI, (re)start its agent, point the system proxy at it."""
+def ensure(*hosts):
+    """Put ``hosts`` through the bypass: install SpoofDPI, (re)start its agent, point the system proxy at it."""
     conflicts = _proxy_conflicts()
     if conflicts:
         raise RuntimeError(f"A proxy is already set on {', '.join(conflicts)}; evo will not replace it.")
     exe = executable() or install()
     home().mkdir(parents=True, exist_ok=True)
     config_path().write_text(CONFIG, encoding="utf-8")
-    _write_hosts([*opened(), host])
+    _write_hosts([*opened(), *hosts])
     if not _start(reload=_write_agent(exe)):
         return service_state()
     set_system_proxy()

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/commands/route/fix.py

@@ -1,11 +1,12 @@
 from __future__ import annotations
 
+import http.client
 import sys
 
 import rich_click as click
 from rich.text import Text
 
-from evo_cli.commands.route import _dpi, _hosts, _probe, _spoofdpi
+from evo_cli.commands.route import _dpi, _hosts, _page, _probe, _spoofdpi
 from evo_cli.console import console, error, info, step, success, warning
 
 OPEN_EPILOG = Text.from_markup(
@@ -13,9 +14,12 @@ OPEN_EPILOG = Text.from_markup(
     "  [cyan]evo route open store.steampowered.com[/cyan]     pick the fix that fits\n"
     "  [cyan]evo route open medium.com --dry-run[/cyan]       say what it would do\n"
     "  [cyan]evo route open x.com --method hosts[/cyan]       force the address pin\n"
-    "  [cyan]evo route open x.com --method dpi[/cyan]         force the DPI bypass\n\n"
+    "  [cyan]evo route open x.com --method dpi[/cyan]         force the DPI bypass\n"
+    "  [cyan]evo route open x.com --host-only[/cyan]          leave what its page loads alone\n\n"
     "[dim]Diagnoses first, then applies only the fix that matches: pinning an address\n"
     "for a poisoned name, or the packet-level bypass for a name-keyed block.\n"
+    "Then reads the page: the bypass takes in the blocked hosts it loads from,\n"
+    "whole domains at a time because CDNs rotate; a pin only names them.\n"
     "Needs administrator rights because it edits hosts / installs a service;\n"
     "on macOS the bypass is SpoofDPI as your own LaunchAgent and needs no sudo.[/dim]"
 )
@@ -98,6 +102,51 @@ def _apply_dpi(report, dry_run):
     return state
 
 
+def _page_hosts(host, proxy, timeout):
+    """The blocked hosts ``host``'s page needs, or None when the page cannot be read."""
+    with console.status(f"[info]reading the page at {host}...[/info]", spinner="dots"):
+        try:
+            return _page.blocked_hosts(host, proxy, _spoofdpi.opened(), timeout=timeout)
+        except (OSError, http.client.HTTPException, ValueError) as exc:
+            warning(f"Could not read the page at {host}, so what it loads is unchecked: {exc}")
+            return None
+
+
+def _open_page_hosts(host, timeout):
+    """The macOS bypass lists hosts by name, so everything the page loads has to go on the list too."""
+    proxy = (_spoofdpi.LISTEN_HOST, _spoofdpi.LISTEN_PORT)
+    blocked = _page_hosts(host, f"http://{_spoofdpi.listen()}", timeout)
+    if blocked is None:
+        return
+    if not blocked:
+        success(f"Nothing the page at {host} loads is blocked")
+        return
+
+    info(f"The page at {host} also needs {', '.join(blocked)}")
+    domains = sorted({_page.registrable(name) for name in blocked})
+    try:
+        state = _spoofdpi.ensure(*domains)
+    except RuntimeError as exc:
+        error(str(exc))
+        sys.exit(1)
+    if not state["running"]:
+        error(f"SpoofDPI would not restart - see {_spoofdpi.log_path()}")
+        sys.exit(1)
+
+    with console.status("[info]re-checking through the proxy...[/info]", spinner="dots"):
+        failed = [name for name in blocked if not _probe.proxy_probe(name, proxy, timeout=timeout)["tls"]]
+    if failed:
+        warning(f"Still failing through the bypass: {', '.join(failed)}. See {_spoofdpi.log_path()}")
+    success(f"Added {', '.join(domains)} to the bypass - `evo route close <host>` takes one back out")
+
+
+def _warn_page_hosts(host, timeout):
+    """A pin cannot reach past the name it pins, and the bypass will not start under sudo, so this only reports."""
+    blocked = _page_hosts(host, None, timeout)
+    if blocked:
+        warning(f"The page at {host} also needs {', '.join(blocked)} - run `evo route open <host>` on each")
+
+
 @click.command("open", epilog=OPEN_EPILOG)
 @click.argument("host")
 @click.option(
@@ -109,14 +158,16 @@ def _apply_dpi(report, dry_run):
 )
 @click.option("-n", "--dry-run", is_flag=True, help="Say what would change, change nothing.")
 @click.option("-t", "--timeout", default=6.0, show_default=True, help="Per-connection timeout (seconds).")
-def open_route(host, method, dry_run, timeout):
+@click.option("--host-only", is_flag=True, help="Open HOST alone, not what its page loads from.")
+def open_route(host, method, dry_run, timeout, host_only):
     """Open a route to `HOST` by applying the fix its diagnosis calls for.
 
     A poisoned name gets its working address pinned in hosts. A name-keyed DPI
     block gets the packet-level bypass, because no amount of hosts or DNS
     editing survives a filter that reads the server name out of the handshake.
 
-    Re-checks afterwards and reports whether the route actually opened.
+    Re-checks afterwards and reports whether the route actually opened, then
+    reads the page, because a site with its CDN still blocked is not open.
     """
     step(f"evo route open {host}")
 
@@ -144,15 +195,22 @@ def open_route(host, method, dry_run, timeout):
         _apply_dpi(report, dry_run)
 
     if dry_run:
+        if method == "dpi" and _dpi.is_macos() and not host_only:
+            info("Would then read its page and add the blocked hosts it loads from")
         return report
 
     step("Verify")
     if method == "dpi" and _dpi.is_macos():
-        return _verify_through_proxy(host, timeout)
+        row = _verify_through_proxy(host, timeout)
+        if row["tls"] and not host_only:
+            _open_page_hosts(host, timeout)
+        return row
     with console.status(f"[info]re-checking {host}...[/info]", spinner="dots"):
         after = _probe.diagnose(host, timeout=timeout)
     if after["verdict"] in (_probe.OPEN, _probe.DNS_POISONED) and after["working"]:
         success(f"{host} is reachable now ({after['best']})")
+        if method == "hosts" and not host_only:
+            _warn_page_hosts(host, timeout)
     else:
         warning(f"{host} still reports [bold]{after['verdict']}[/bold]. Run `evo route check {host}` for detail.")
     return after

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli/openvpn.py

@@ -45,6 +45,7 @@ OPTIONS = {
     "connect-retry",
     "connect-retry-max",
     "connect-timeout",
+    "server-poll-timeout",
     "float",
     "tun-mtu",
     "mssfix",
@@ -522,6 +523,30 @@ def auth_commands(line, profile):
     return f'username "Auth" {quote(username)}\npassword "Auth" {quote(password)}\n'
 
 
+def web_auth_url(message):
+    """The sign-in URL of a pending-auth INFOMSG (WEB_AUTH:flags:url or the older OPEN_URL:url), else None."""
+    if message.startswith("WEB_AUTH:"):
+        # No proxy is announced, so flags hold no colon.
+        url = message[9:].partition(":")[2]
+    elif message.startswith("OPEN_URL:"):
+        url = message[9:]
+    else:
+        return None
+    if urlparse(url).scheme != "https" or any(c.isspace() or not c.isprintable() for c in url):
+        raise CredentialError("VPN server sent an unusable sign-in URL.")
+    return url
+
+
+def open_url(url):
+    """Open the sign-in page in the user's browser; the worker runs as the user, never as root."""
+    opener = shutil.which("open" if sys.platform == "darwin" else "xdg-open")
+    if opener:
+        try:
+            subprocess.Popen([opener, url], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        except OSError:
+            pass
+
+
 def worker(name, timeout):
     """Keep the management channel alive for reauthentication; never persist raw VPN logs."""
     import fcntl
@@ -592,6 +617,10 @@ def worker(name, timeout):
             "--verb",
             "3",
         ]
+        if not uses_credentials(profile["config"]):
+            # With no password to ask for, a server can add a sign-in step only through the browser (Access
+            # Server SAML); announce it, or such a server refuses the client.
+            command += ["--setenv", "IV_SSO", "openurl,webauth"]
         pinned = [] if takes_default_route(profile["config"]) else remotes
         if profile.get("otp_url"):
             pinned = [*pinned, urlparse(profile["otp_url"]).hostname]
@@ -662,6 +691,12 @@ def worker(name, timeout):
                             if stamp.isdigit():
                                 clock = time.strftime("%H:%M:%S", time.localtime(int(stamp)))
                                 log.append(f"{clock}  {rest.partition(',')[2]}")
+                        elif line.startswith(">INFOMSG:"):
+                            url = web_auth_url(line[9:])
+                            if url:
+                                state["auth_url"] = url
+                                publish()
+                                open_url(url)
                         elif line.startswith(">FATAL:"):
                             raise CredentialError("OpenVPN reported a fatal error; check config, TLS and permissions.")
                         elif line.startswith(">STATE:"):
@@ -671,11 +706,18 @@ def worker(name, timeout):
                                 if fields[1] == "CONNECTED" and fields[2] == "SUCCESS":
                                     state["vpn_ip"] = fields[3]
                                     state["since"] = time.time()
+                                    state.pop("auth_url", None)
+                                    state.pop("auth_expires", None)
                                     # Once up, let OpenVPN retry for as long as the network is gone.
                                     deadline = float("inf")
                                 elif fields[1] != "CONNECTED":
                                     state.pop("vpn_ip", None)
                                     state.pop("since", None)
+                                if fields[1] == "AUTH_PENDING":
+                                    # Signing in happens in the browser: allow the time the server gives it.
+                                    wait = int(fields[2]) if fields[2].isdigit() else 300
+                                    deadline = max(deadline, time.monotonic() + wait)
+                                    state["auth_expires"] = time.time() + wait
                                 if fields[1] == "RECONNECTING":
                                     state["reconnects"] = state.get("reconnects", 0) + 1
                                 if fields[1] in ("RECONNECTING", "EXITING"):

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.32.1
+Version: 0.34.0
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.32.1 → evo_cli-0.34.0}/evo_cli.egg-info/SOURCES.txt

@@ -82,6 +82,7 @@ evo_cli/commands/route/__init__.py
 evo_cli/commands/route/_dns.py
 evo_cli/commands/route/_dpi.py
 evo_cli/commands/route/_hosts.py
+evo_cli/commands/route/_page.py
 evo_cli/commands/route/_probe.py
 evo_cli/commands/route/_spoofdpi.py
 evo_cli/commands/route/check.py

{evo_cli-0.32.1 → evo_cli-0.34.0}/tests/test_openvpn.py

@@ -104,6 +104,11 @@ def test_rejects_unsafe_or_external_config(directive):
         vpn.validate_config(CONFIG + directive + "\n")
 
 
+def test_config_accepts_access_server_timing():
+    # OpenVPN Access Server profiles carry server-poll-timeout, an alias of connect-timeout.
+    assert vpn.validate_config(CONFIG + "server-poll-timeout 4\n") == ["vpn.example 1194 udp"]
+
+
 def test_config_accepts_inline_key_without_parsing_it():
     assert vpn.validate_config(CONFIG + "lport 0\n<key>\nPRIVATE SECRET\n</key>\n") == ["vpn.example 1194 udp"]
 
@@ -349,6 +354,26 @@ def test_worker_pins_the_otp_host_even_for_a_full_tunnel(store, monkeypatch):
     assert pinned == [["otp.example"]]
 
 
+@pytest.mark.parametrize(
+    "message,expected",
+    [
+        ("WEB_AUTH::https://vpn.example/a?b=1", "https://vpn.example/a?b=1"),
+        ("WEB_AUTH:external:https://vpn.example/a", "https://vpn.example/a"),
+        ("OPEN_URL:https://vpn.example/a", "https://vpn.example/a"),
+        ("CR_TEXT:E,R:Enter code", None),
+        ("some other notice", None),
+    ],
+)
+def test_web_auth_url(message, expected):
+    assert vpn.web_auth_url(message) == expected
+
+
+@pytest.mark.parametrize("url", ["http://vpn.example/a", "file:///etc/passwd", "https://vpn.example/a b", "-a"])
+def test_web_auth_url_rejects_anything_but_plain_https(url):
+    with pytest.raises(CredentialError):
+        vpn.web_auth_url("WEB_AUTH::" + url)
+
+
 def test_plain_password_escaping_and_no_unrequested_otp():
     text = vpn.auth_commands("Need 'Auth' username/password", {"username": "u", "password": 'p"\\'})
     assert text == 'username "Auth" "u"\npassword "Auth" "p\\"\\\\"\n'
@@ -462,7 +487,12 @@ with socket.socket(socket.AF_UNIX) as s:
     seen = hold()
     assert {b'state on\\n', b'log on\\n', b'bytecount 2\\n'} <= seen
     held = b'hold off\\n' not in seen
-    auth()
+    if sys.argv[2] == 'webauth':
+        # Access Server SAML: no password prompt, a browser sign-in instead.
+        s.sendall(b'>STATE:1,AUTH_PENDING,120,,,,,\\n')
+        s.sendall(b'>INFOMSG:WEB_AUTH::https://vpn.example/auth/1\\n')
+    else:
+        auth()
     if sys.argv[2] == 'fail':
         s.sendall(b\">PASSWORD:Verification Failed: 'Auth'\\n\")
     else:
@@ -480,12 +510,15 @@ with socket.socket(socket.AF_UNIX) as s:
 """
 
 
-@pytest.mark.parametrize("mode", ["ok", "fail", "reconnect"])
+@pytest.mark.parametrize("mode", ["ok", "fail", "reconnect", "webauth"])
 def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatch, mode):
-    fail = mode == "fail"
+    fail, webauth = mode == "fail", mode == "webauth"
+    config = CERT_ONLY if webauth else CONFIG
     vpn.save_profile(
-        "m1", {"config": CONFIG, "username": "test", "password": "password-secret", "totp": vpn.parse_totp(SECRET)}
+        "m1", {"config": config, "username": "test", "password": "password-secret", "totp": vpn.parse_totp(SECRET)}
     )
+    opened = []
+    monkeypatch.setattr(vpn, "open_url", opened.append)
     monkeypatch.setattr(sys, "stdin", io.StringIO("not-a-real-sudo-password\n"))
     monkeypatch.setattr(vpn.os, "geteuid", lambda: 0)
     monkeypatch.setattr(vpn.shutil, "which", lambda _: "/fake/openvpn")
@@ -497,6 +530,8 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
         # A soft restart (ping-restart, connection-reset) must reconnect, not exit.
         assert "--remap-usr1" not in command and "--connect-retry-max" not in command
         assert command[command.index("--ping") + 1] == "10"
+        # Only a profile without a password announces browser sign-in.
+        assert ("IV_SSO" in command) == webauth
         endpoint = command[command.index("--management") + 1]
         return popen([sys.executable, "-c", FAKE_OPENVPN, endpoint, mode], **kwargs)
 
@@ -511,7 +546,7 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
             if state["state"] == "CONNECTED" and (mode != "reconnect" or state.get("reconnects")):
                 assert state["vpn_ip"] == "10.8.0.2"
                 assert state["since"] and (state["bytes_in"], state["bytes_out"]) == (1024, 2048)
-                assert not fail
+                assert not fail and "auth_url" not in state and "auth_expires" not in state
                 if mode == "reconnect":
                     assert state["reconnects"] == 1 and state["last_reason"] == "connection-reset"
                 # Only the newest lines are kept, and a reply larger than one read arrives whole.
@@ -522,6 +557,7 @@ def test_worker_real_sockets_auth_status_shutdown_without_root(store, monkeypatc
             time.sleep(0.05)
         thread.join(5)
         assert not thread.is_alive()
+        assert opened == (["https://vpn.example/auth/1"] if webauth else [])
         assert vpn.request("m1")["state"] == "STOPPED"
         base = vpn.session_path("m1")
         state = json.loads(Path(str(base) + ".json").read_text())
@@ -609,6 +645,27 @@ def test_cert_only_profile_connects_and_lists_without_credentials(store, monkeyp
     assert rows == {"cert": "cert", "login": "no"}
 
 
+def test_connect_shows_the_sign_in_url_once_and_waits_for_it(store, monkeypatch):
+    vpn.save_profile("sso", {"config": CERT_ONLY})
+    pending = {"state": "AUTH_PENDING", "auth_url": "https://vpn.example/auth/1", "auth_expires": time.time() + 120}
+    states = iter([{"state": "STOPPED"}, pending, pending])
+    monkeypatch.setattr(vpn, "request", lambda name, command="status": next(states, {"state": "CONNECTED"}))
+    monkeypatch.setattr("evo_cli.commands.openvpn.shutil.which", lambda _: "/fake/openvpn")
+    monkeypatch.setattr("evo_cli.commands.openvpn.os.geteuid", lambda: 0)
+
+    class Running:
+        def __init__(self):
+            self.stdin = io.BytesIO()
+
+        def poll(self):
+            return None
+
+    monkeypatch.setattr("evo_cli.commands.openvpn.subprocess.Popen", lambda command, **_: Running())
+    result = CliRunner().invoke(cli, ["openvpn", "connect", "sso", "--no-watch", "--timeout", "10"])
+    assert result.exit_code == 0, result.output
+    assert result.output.count("https://vpn.example/auth/1") == 1 and "connected" in result.output
+
+
 def test_pick_profile_by_number_single_or_prompt(store, monkeypatch):
     runner = CliRunner()
     totp = vpn.parse_totp(SECRET)