diggylab 0.1.36 → 0.1.39

package/README.md

@@ -7,7 +7,7 @@ headless Chromium — the Electron app is not involved.
 ## Requirements
 
 - Node.js 20+
-- Linux packages: `xvfb`, `x11vnc`, `websockify`, `novnc` — run `diggylab install-display` (Debian/Ubuntu) or install them yourself. The Docker image below bundles them.
+- Linux packages: `xvfb` and `x11vnc` — run `diggylab install-display` (Debian/Ubuntu) or install them yourself. The Docker image below bundles them.
 - Chromium for Playwright: downloaded automatically during `npm install`; rerun `diggylab install-browser` if that download failed.
 
 ## Install
@@ -58,37 +58,75 @@ npm publish apps/desktop-agent/dist-npm --access public
 | Command | What it does |
 | --- | --- |
 | `pair --code <code> [--name <device name>] [--api <origin>]` | Pairs the server as a device. Create the code on `/settings/desktop-agent` in the web app. |
-| `login` | Opens the Facebook login page on a virtual screen and prints a noVNC link + QR code. Log in from your phone; the session is stored encrypted on the server. |
+| `login` | Renders the Facebook login page on a virtual screen and prints a DiggyLab link + QR code. Open it on any phone or laptop — no ports, no tunnel — and the session is stored encrypted on the server. |
 | `run` | Connects the WebSocket worker, receives assigned scans, scans headlessly, uploads results. |
 | `status` | Shows the config directory, API origin, paired device, and Facebook session state. |
 | `install-browser` | Downloads the Chromium build Playwright needs (~150 MB). It also runs during `npm install`, so you only need it if that download failed. |
-| `install-display` | On Debian/Ubuntu, installs `xvfb`, `x11vnc`, `websockify`, and `novnc` for the shared login screen. |
+| `install-display` | On Debian/Ubuntu, installs `xvfb` and `x11vnc` for the login screen. |
 | `unpair` | Removes device credentials, the Facebook session, and pending scans. |
 
-Useful options: `--api <origin>` (default `https://api.diggylab.com`), `--port` / `--bind` /
-`--public-host` for the login screen, `--display <number>` to avoid an Xvfb collision.
+Useful options: `--api <origin>` (default `https://api.diggylab.com`), `--web-url <origin>` (only for a
+self-hosted web app, or `DIGGYLAB_WEB_URL`), `--display <number>` to avoid an Xvfb collision.
 
 ## How `login` works on a server
 
-A server has no screen, so the agent starts `Xvfb` (virtual screen), `x11vnc` (shares it) and
-`websockify` + noVNC (turns it into a web page):
+A server has no screen, so the agent starts `Xvfb` (virtual screen) and `x11vnc` (shares it), then
+carries that screen to the customer through the API connection it already uses for scans:
 
 ```
-Xvfb → Chromium opens Facebook's real login page → noVNC link + QR → phone logs in → session saved
+Xvfb → Chromium opens Facebook's real login page → encrypted over the API → link + QR → phone logs in
 ```
 
-The noVNC URL carries a one-time token, the port is only open while `login` runs, and everything is
-torn down when the login finishes or times out (10 minutes). If you prefer not to expose a port,
-pass `--bind 127.0.0.1` and forward it over SSH (`ssh -L 6080:127.0.0.1:6080 <server>`).
+Nothing has to be opened on the server: no port, no tunnel, no firewall change. The link points at
+the web app (`https://diggylab.com/agent-login/<session>#<key>`), and everything is torn down when the
+login finishes or times out (10 minutes).
 
-### Which address the link uses
+### The screen is encrypted end to end
 
-The link points at the machine's default-route address, so a multi-homed server advertises the
-network it actually reaches the internet through. When that address is private, the agent also looks
-up the public IP and prints a second link for phones on another network — forward the port first.
+The part of the link after `#` is the decryption key, and browsers never send a fragment to a server —
+so the relay passes bytes it cannot read. DiggyLab stores nothing: no frames, no keystrokes, no
+session. The Facebook cookies stay on the customer's server, sealed with `~/.diggylab/key`.
 
-Pin it explicitly with `--public-host <ip or domain>` or `DIGGYLAB_PUBLIC_HOST`, for example when a
-domain points at the server.
+The link itself is the only way in: it is single use, expires with the login window, and the session
+is created per `login` run.
+
+### When the screen does not appear
+
+`login` checks the virtual screen before printing the link: it reads x11vnc's greeting, so a broken
+screen stops the command with the reason instead of leaving the customer with a blank page.
+
+Each process writes a log to `~/.diggylab/logs/` (`xvfb.log`, `x11vnc.log`). The tail is printed when
+the screen fails or a process dies during the login, and the files stay there for later inspection.
+
+Manual checks while `login` is running:
+
+```bash
+pgrep -a Xvfb; pgrep -a x11vnc                                        # both must be running
+ss -ltnp | grep :5999                                                 # x11vnc listens on loopback
+timeout 2 bash -c 'exec 3<>/dev/tcp/127.0.0.1/5999 && head -c 12 <&3' # expect: RFB 003.008
+```
+
+If the browser says the link expired, run `diggylab login` again — each run mints a new session.
+
+### Logging in with cookies from your own browser
+
+If you would rather not share a screen, log into Facebook in your own browser and import those
+cookies instead — no Xvfb, no link, no port:
+
+1. Install **Cookie-Editor** (Chrome, Edge, Firefox), open `facebook.com`, then *Export → JSON*.
+   (Or copy the `cookie:` request header from your browser's DevTools.)
+2. On the server:
+
+```bash
+diggylab login --cookies cookies.json     # or: diggylab login --cookies -   and paste, then Ctrl-D
+```
+
+The agent keeps only the `facebook.com` cookies, saves them encrypted, and opens Facebook once to
+confirm the session before it accepts it. Cookies exported from a different account, or expired ones,
+are rejected with a message instead of failing during a scan.
+
+Note: Facebook sometimes asks for a security check when a session moves to a server's IP. If that
+happens the command says so — approve the login from your phone and import again.
 
 ## Security notes
 

package/cli.js

@@ -3,7 +3,7 @@
 // src/cli/cli.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "node:fs";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, realpathSync } from "node:fs";
 import { hostname, homedir } from "node:os";
 import { dirname as dirname3, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -513,7 +513,7 @@ function withTimeout(promise, timeoutMs) {
 
 // src/cli/cli.ts
 import { chromium } from "playwright";
-import WebSocket from "ws";
+import WebSocket2 from "ws";
 
 // src/main/activity-log.ts
 import { gzip } from "node:zlib";
@@ -2312,14 +2312,12 @@ function readPrivateKey(privateKey) {
 // src/cli/args.ts
 var FLAGS = {
   "--api": { key: "api", type: "string" },
-  "--bind": { key: "bind", type: "string" },
   "--code": { key: "code", type: "string" },
   "--config": { key: "config", type: "string" },
+  "--cookies": { key: "cookies", type: "string" },
   "--display": { key: "display", type: "number" },
   "--name": { key: "name", type: "string" },
-  "--novnc-web": { key: "novncWeb", type: "string" },
-  "--port": { key: "port", type: "number" },
-  "--public-host": { key: "publicHost", type: "string" }
+  "--web-url": { key: "webUrl", type: "string" }
 };
 function parseCliArgs(argv) {
   const options = {};
@@ -2357,6 +2355,77 @@ function browserInstallCommands(platform) {
   return platform === "linux" ? [["install", "--with-deps", "chromium"], install] : [install];
 }
 
+// src/cli/cookie-import.ts
+var FACEBOOK_DOMAIN = ".facebook.com";
+var FACEBOOK_HOST = /(^|\.)facebook\.com$/i;
+function isFacebookDomain(domain) {
+  return Boolean(domain && FACEBOOK_HOST.test(domain.replace(/^\./, "")));
+}
+function normalizeSameSite(value) {
+  if (typeof value !== "string") return void 0;
+  const lower = value.toLowerCase().replace(/[^a-z]/g, "");
+  if (lower === "lax") return "Lax";
+  if (lower === "strict") return "Strict";
+  if (lower === "none" || lower === "norestriction") return "None";
+  return void 0;
+}
+function toCookie(value) {
+  const name = typeof value.name === "string" ? value.name.trim() : "";
+  const cookieValue = typeof value.value === "string" ? value.value : "";
+  if (!name || !cookieValue) return null;
+  return {
+    domain: typeof value.domain === "string" ? value.domain : void 0,
+    expires: typeof value.expires === "number" ? value.expires : typeof value.expirationDate === "number" ? value.expirationDate : void 0,
+    httpOnly: typeof value.httpOnly === "boolean" ? value.httpOnly : void 0,
+    name,
+    path: typeof value.path === "string" ? value.path : void 0,
+    sameSite: normalizeSameSite(value.sameSite),
+    secure: typeof value.secure === "boolean" ? value.secure : void 0,
+    value: cookieValue
+  };
+}
+function parseCookieHeader(input) {
+  const header = input.replace(/^\s*cookie\s*:/i, "");
+  return header.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const separator = part.indexOf("=");
+    if (separator <= 0) return null;
+    return { name: part.slice(0, separator).trim(), value: part.slice(separator + 1) };
+  }).filter((cookie) => cookie !== null);
+}
+function parseCookieInput(input) {
+  const trimmed = input.trim();
+  if (!trimmed) return [];
+  if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return parseCookieHeader(trimmed);
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (Array.isArray(parsed)) {
+      return parsed.map((entry) => entry && typeof entry === "object" ? toCookie(entry) : null).filter((cookie) => cookie !== null);
+    }
+    if (parsed && typeof parsed === "object") {
+      const cookies = parsed.cookies;
+      if (Array.isArray(cookies)) {
+        return cookies.map((entry) => entry && typeof entry === "object" ? toCookie(entry) : null).filter((cookie) => cookie !== null);
+      }
+    }
+  } catch {
+    return [];
+  }
+  return [];
+}
+function toFacebookStorageState(cookies) {
+  const usable = cookies.filter((cookie) => isFacebookDomain(cookie.domain) || cookie.domain === void 0).map((cookie) => ({
+    domain: isFacebookDomain(cookie.domain) ? cookie.domain : FACEBOOK_DOMAIN,
+    expires: typeof cookie.expires === "number" && cookie.expires > 0 ? cookie.expires : -1,
+    httpOnly: cookie.httpOnly ?? true,
+    name: cookie.name,
+    path: cookie.path?.startsWith("/") ? cookie.path : "/",
+    sameSite: cookie.sameSite ?? "Lax",
+    secure: cookie.secure ?? true,
+    value: cookie.value
+  }));
+  return { cookies: usable, origins: [] };
+}
+
 // src/cli/file-crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -2404,6 +2473,163 @@ function createFileCrypto(keyPath) {
   };
 }
 
+// src/cli/login-screen-relay.ts
+import { createConnection } from "node:net";
+import WebSocket from "ws";
+
+// src/cli/relay-crypto.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, hkdfSync, randomBytes as randomBytes2 } from "node:crypto";
+var FRAME_VERSION = 1;
+var IV_BYTES2 = 12;
+var KEY_BYTES2 = 32;
+var TAG_BYTES2 = 16;
+function createRelayKey() {
+  return randomBytes2(KEY_BYTES2).toString("base64url");
+}
+function deriveRelayKeys(key, sessionId) {
+  const secret = Buffer.from(key, "base64url");
+  const salt = Buffer.from(sessionId, "utf8");
+  const derive = (info) => Buffer.from(hkdfSync("sha256", secret, salt, Buffer.from(info, "utf8"), KEY_BYTES2));
+  return { fromAgent: derive("agent-to-browser"), toAgent: derive("browser-to-agent") };
+}
+function sealFrame(key, payload) {
+  const iv = randomBytes2(IV_BYTES2);
+  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const sealed = Buffer.concat([cipher.update(payload), cipher.final()]);
+  return Buffer.concat([Buffer.from([FRAME_VERSION]), iv, sealed, cipher.getAuthTag()]);
+}
+function openFrame(key, frame) {
+  if (frame.length < 1 + IV_BYTES2 + TAG_BYTES2 || frame[0] !== FRAME_VERSION) {
+    throw new Error("Invalid login screen frame.");
+  }
+  const decipher = createDecipheriv2("aes-256-gcm", key, frame.subarray(1, 1 + IV_BYTES2));
+  decipher.setAuthTag(frame.subarray(frame.length - TAG_BYTES2));
+  return Buffer.concat([
+    decipher.update(frame.subarray(1 + IV_BYTES2, frame.length - TAG_BYTES2)),
+    decipher.final()
+  ]);
+}
+
+// src/cli/login-screen-relay.ts
+var RELAY_PATH = "/desktop-agent/login-screen";
+var READY_TIMEOUT_MS = 1e4;
+var DEFAULT_WEB_ORIGIN = "https://diggylab.com";
+async function openLoginScreenRelay(options) {
+  const socket = new WebSocket(`${toWebSocketOrigin(options.apiOrigin)}${RELAY_PATH}`, {
+    headers: { authorization: `Bearer ${options.accessToken}` }
+  });
+  let closed = false;
+  let keys = null;
+  let vnc = null;
+  let resolveScreen = () => void 0;
+  let rejectFailure = () => void 0;
+  const failure = new Promise((_resolve, reject) => {
+    rejectFailure = reject;
+  });
+  const screenConnected = new Promise((resolve) => {
+    resolveScreen = resolve;
+  });
+  failure.catch(() => void 0);
+  const close = () => {
+    closed = true;
+    vnc?.destroy();
+    vnc = null;
+    if (socket.readyState === WebSocket.OPEN || socket.readyState === WebSocket.CONNECTING) socket.close();
+  };
+  const fail = (message) => {
+    close();
+    rejectFailure(new Error(message));
+  };
+  const openScreen = () => {
+    if (closed || vnc) return;
+    const connection = createConnection({ host: "127.0.0.1", port: options.rfbPort });
+    vnc = connection;
+    connection.on("data", (chunk) => {
+      if (closed || !keys || socket.readyState !== WebSocket.OPEN) return;
+      socket.send(sealFrame(keys.fromAgent, chunk), { binary: true });
+    });
+    connection.once("error", () => {
+      if (vnc === connection) vnc = null;
+      fail("Could not reach the virtual screen.");
+    });
+    connection.once("close", () => {
+      if (vnc === connection) vnc = null;
+    });
+  };
+  socket.on("message", (data, isBinary) => {
+    if (isBinary) {
+      if (!keys || !vnc || vnc.destroyed) return;
+      try {
+        vnc.write(openFrame(keys.toAgent, Buffer.from(data)));
+      } catch {
+        fail("The login screen received a corrupted frame.");
+      }
+      return;
+    }
+    const message = parseRelayMessage(data.toString());
+    if (message?.type === "screen-connected") {
+      openScreen();
+      resolveScreen();
+    } else if (message?.type === "screen-disconnected") {
+      vnc?.destroy();
+      vnc = null;
+    }
+  });
+  socket.once("error", () => fail("Could not reach the DiggyLab relay."));
+  socket.once("close", () => {
+    if (!closed) fail("The DiggyLab relay closed the login screen.");
+  });
+  const ready = await waitForReady(socket);
+  keys = deriveRelayKeys(options.key, ready.id);
+  const webOrigin = (options.webUrl ?? ready.webUrl ?? DEFAULT_WEB_ORIGIN).replace(/\/+$/, "");
+  return {
+    close,
+    failure,
+    screenConnected,
+    url: `${webOrigin}/agent-login/${encodeURIComponent(ready.id)}#${options.key}`
+  };
+}
+function parseRelayMessage(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object" && typeof parsed.type === "string") {
+      return parsed;
+    }
+  } catch {
+  }
+  return null;
+}
+function waitForReady(socket) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("The DiggyLab relay did not answer in time.")), READY_TIMEOUT_MS);
+    timer.unref();
+    socket.once("message", (data, isBinary) => {
+      clearTimeout(timer);
+      if (isBinary) {
+        reject(new Error("The DiggyLab relay answered with an unexpected frame."));
+        return;
+      }
+      const message = parseRelayMessage(data.toString());
+      if (message?.type !== "ready") {
+        reject(new Error("The DiggyLab relay did not accept the login screen."));
+        return;
+      }
+      resolve(message);
+    });
+    socket.once("error", () => {
+      clearTimeout(timer);
+      reject(new Error("Could not reach the DiggyLab relay."));
+    });
+    socket.once("close", () => {
+      clearTimeout(timer);
+      reject(new Error("The DiggyLab relay refused the login screen."));
+    });
+  });
+}
+function toWebSocketOrigin(origin) {
+  return origin.replace(/^http/i, "ws").replace(/\/+$/, "");
+}
+
 // src/cli/qr.ts
 import qrcode from "qrcode-terminal";
 function terminalQr(value) {
@@ -2416,19 +2642,41 @@ function terminalQr(value) {
 
 // src/cli/virtual-display.ts
 import { spawn } from "node:child_process";
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { createConnection } from "node:net";
-import { networkInterfaces } from "node:os";
+import { createWriteStream, mkdirSync as mkdirSync2 } from "node:fs";
+import { createConnection as createConnection3 } from "node:net";
 import { join as join3 } from "node:path";
+
+// src/cli/vnc-probe.ts
+import { createConnection as createConnection2 } from "node:net";
+var PROBE_TIMEOUT_MS = 4e3;
+var GREETING_BYTES = 12;
+var GREETING_PATTERN = /^RFB \d{3}\.\d{3}\n$/;
+function probeRfb(host, port, timeoutMs = PROBE_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    const socket = createConnection2({ host, port });
+    const finish = (result) => {
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(result);
+    };
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    let received = "";
+    socket.on("data", (chunk) => {
+      received += chunk.toString("latin1");
+      if (received.length >= GREETING_BYTES) finish(GREETING_PATTERN.test(received.slice(0, GREETING_BYTES)));
+    });
+    socket.once("error", () => finish(false));
+    socket.once("close", () => finish(false));
+  });
+}
+
+// src/cli/virtual-display.ts
 var START_TIMEOUT_MS = 15e3;
-var PUBLIC_IP_TIMEOUT_MS = 3e3;
-var PUBLIC_IP_ENDPOINT = "https://api.ipify.org";
 function waitForPort(host, port, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   return new Promise((resolve, reject) => {
     const attempt = () => {
-      const socket = createConnection({ host, port });
+      const socket = createConnection3({ host, port });
       socket.once("connect", () => {
         socket.destroy();
         resolve();
@@ -2445,94 +2693,56 @@ function waitForPort(host, port, timeoutMs) {
     attempt();
   });
 }
-function isPrivateAddress(address) {
-  const [first, second] = address.split(".").map(Number);
-  return first === 10 || first === 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 100 && second >= 64 && second <= 127;
-}
-function defaultRouteInterface() {
-  if (process.platform !== "linux") return null;
-  try {
-    for (const line of readFileSync2("/proc/net/route", "utf8").split("\n").slice(1)) {
-      const [iface, destination, , , , , flags] = line.trim().split(/\s+/);
-      if (destination === "00000000" && Number.parseInt(flags ?? "0", 16) & 2) return iface;
-    }
-  } catch {
-  }
-  return null;
-}
-function localAddress() {
-  const interfaces = networkInterfaces();
-  const addressOf = (addresses) => addresses?.find((entry) => entry.family === "IPv4" && !entry.internal)?.address ?? null;
-  const preferred = defaultRouteInterface();
-  return (preferred ? addressOf(interfaces[preferred]) : null) ?? Object.values(interfaces).map(addressOf).find((address) => address !== null) ?? "127.0.0.1";
-}
-async function detectPublicIp(fetcher = fetch) {
-  try {
-    const response = await fetcher(PUBLIC_IP_ENDPOINT, { signal: AbortSignal.timeout(PUBLIC_IP_TIMEOUT_MS) });
-    if (!response.ok) return null;
-    const value = (await response.text()).trim();
-    return /^\d{1,3}(?:\.\d{1,3}){3}$/.test(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function start(command, args, env, deps) {
+function start(name, command, args, env, deps, logDirectory) {
   const child = deps.spawnProcess(command, args, env);
+  const log = createWriteStream(join3(logDirectory, `${name}.log`), { mode: 384 });
   const failure = new Promise((_resolve, reject) => {
     child.on("error", (error) => reject(error instanceof Error ? error : new Error(String(error))));
     child.on("exit", (code) => reject(new Error(`${command} exited with code ${String(code)}.`)));
   });
+  log.on("error", () => void 0);
+  log.write(`# ${command} ${args.join(" ")}
+`);
+  child.stdout?.pipe?.(log, { end: false });
+  child.stderr?.pipe?.(log, { end: false });
   return { child, failure };
 }
 async function startVirtualDisplay(options, overrides = {}) {
   const deps = {
-    detectPublicIp: () => detectPublicIp(),
-    localAddress,
+    probeRfb,
     spawnProcess: spawn,
     waitForPort,
     ...overrides
   };
-  const bind = options.bind ?? "0.0.0.0";
   const displayNumber = options.displayNumber ?? 99;
+  const display = `:${displayNumber}`;
   const height = options.height ?? 900;
-  const novncWeb = options.novncWeb ?? "/usr/share/novnc";
-  const port = options.port ?? 6080;
   const rfbPort = 5900 + displayNumber;
-  const token = randomBytes2(18).toString("base64url");
-  const tokenFile = join3(options.tokenDirectory, "websockify-token");
-  mkdirSync2(options.tokenDirectory, { mode: 448, recursive: true });
-  writeFileSync2(tokenFile, `${token}: 127.0.0.1:${rfbPort}
-`, { mode: 384 });
-  const xvfb = start("Xvfb", [`:${displayNumber}`, "-screen", `0`, `${options.width ?? 1280}x${height}x24`, "-nolisten", "tcp"], process.env, deps);
-  const vnc = start("x11vnc", ["-display", `:${displayNumber}`, "-localhost", "-rfbport", String(rfbPort), "-forever", "-shared", "-nopw", "-quiet"], process.env, deps);
-  const proxy = start("websockify", ["--web", novncWeb, "--token-plugin", "TokenFile", "--token-source", tokenFile, `${bind}:${port}`], process.env, deps);
+  mkdirSync2(options.logDirectory, { mode: 448, recursive: true });
+  const xvfb = start("xvfb", "Xvfb", [display, "-screen", "0", `${options.width ?? 1280}x${height}x24`, "-nolisten", "tcp"], process.env, deps, options.logDirectory);
+  const vnc = start("x11vnc", "x11vnc", ["-display", display, "-localhost", "-rfbport", String(rfbPort), "-forever", "-shared", "-nopw", "-quiet"], process.env, deps, options.logDirectory);
+  const failure = Promise.race([vnc.failure, xvfb.failure]);
+  failure.catch(() => void 0);
   const stop = async () => {
-    for (const { child } of [proxy, vnc, xvfb]) {
+    for (const { child } of [vnc, xvfb]) {
       child.kill("SIGTERM");
       await new Promise((resolve) => setTimeout(resolve, 200));
       child.kill("SIGKILL");
     }
-    rmSync(tokenFile, { force: true });
   };
   try {
     await Promise.race([
-      deps.waitForPort(bind === "0.0.0.0" ? "127.0.0.1" : bind, port, options.timeoutMs ?? START_TIMEOUT_MS),
-      proxy.failure,
-      vnc.failure,
-      xvfb.failure
+      deps.waitForPort("127.0.0.1", rfbPort, options.timeoutMs ?? START_TIMEOUT_MS),
+      failure
     ]);
+    if (!await deps.probeRfb("127.0.0.1", rfbPort)) {
+      throw new Error(`The virtual screen did not answer on 127.0.0.1:${rfbPort}.`);
+    }
   } catch (error) {
     await stop();
     throw error;
   }
-  const publicHost = options.publicHost ?? deps.localAddress();
-  const link = (host) => `http://${host}:${port}/vnc.html?autoconnect=1&token=${encodeURIComponent(token)}`;
-  const publicIp = options.publicHost || !isPrivateAddress(publicHost) ? null : await deps.detectPublicIp();
-  return {
-    alternateUrl: publicIp && publicIp !== publicHost ? link(publicIp) : null,
-    stop,
-    url: link(publicHost)
-  };
+  return { display, failure, logDirectory: options.logDirectory, rfbPort, stop };
 }
 
 // src/cli/cli.ts
@@ -2542,7 +2752,8 @@ var USAGE = `DiggyLab Desktop Agent CLI
 
 Usage:
   diggylab pair --code <code> [--name <device name>] [--api <https://api.diggylab.com>]
-  diggylab login [--port 6080] [--bind 0.0.0.0] [--public-host <ip or host>]
+  diggylab login [--display <number>] [--web-url <https://diggylab.com>]
+  diggylab login --cookies <file or ->   (import cookies exported from your own browser)
   diggylab run
   diggylab status
   diggylab install-browser
@@ -2553,14 +2764,14 @@ Global options:
   --config <directory>   Agent state directory (default ~/.diggylab)
   --api <origin>         API origin (default $DIGGYLAB_API_URL or https://api.diggylab.com)`;
 var MISSING_BROWSER_HINT = "Chromium for Playwright is not installed yet. Run `diggylab install-browser` once.";
-var MISSING_DISPLAY_HINT = "The shared login screen needs Xvfb, x11vnc, websockify, and noVNC. Run `diggylab install-display` (Debian/Ubuntu) or use the Docker image.";
+var MISSING_DISPLAY_HINT = "The login screen needs Xvfb and x11vnc. Run `diggylab install-display` (Debian/Ubuntu) or use the Docker image.";
 function agentVersion() {
   let directory = fileURLToPath(new URL(".", import.meta.url));
   for (let depth = 0; depth < 4; depth += 1) {
     const manifest = join4(directory, "package.json");
     if (existsSync2(manifest)) {
       try {
-        const version = JSON.parse(readFileSync3(manifest, "utf8")).version;
+        const version = JSON.parse(readFileSync2(manifest, "utf8")).version;
         if (typeof version === "string" && version) return version;
       } catch {
       }
@@ -2594,6 +2805,19 @@ function createRuntime(options) {
   const manager = new DeviceCredentialManager(sessions, http, createDeviceIdentity);
   return { activity, browserType: createBrowserLauncher(chromium), directory, endpoint, facebook, manager, sessions, spool };
 }
+function printDisplayLogs(directory, io, lines = 12) {
+  io.error(`Login screen logs: ${directory}`);
+  try {
+    for (const name of readdirSync(directory).sort()) {
+      if (!name.endsWith(".log")) continue;
+      const tail = readFileSync2(join4(directory, name), "utf8").split("\n").filter((line) => line.trim() !== "").slice(-lines);
+      if (tail.length === 0) continue;
+      io.error(`--- ${name} ---`);
+      for (const line of tail) io.error(line);
+    }
+  } catch {
+  }
+}
 function waitForFacebookLogin(login, timeoutMs) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
@@ -2659,6 +2883,7 @@ async function commandPair(runtime, options, io) {
   }
 }
 async function commandLogin(runtime, options, io) {
+  if (options.cookies) return importFacebookCookies(runtime, options.cookies, io);
   const login = new FacebookLoginService({
     browserType: runtime.browserType,
     clearTimer: (timer) => clearTimeout(timer),
@@ -2677,49 +2902,128 @@ async function commandLogin(runtime, options, io) {
     return 0;
   }
   let display = null;
+  let relay = null;
   try {
     const needsVirtualDisplay = process.platform === "linux" && !process.env.DISPLAY;
     if (!needsVirtualDisplay) {
       io.log(process.env.DISPLAY ? `Opening the Facebook login page on display ${process.env.DISPLAY}.` : "Opening the Facebook login page in a browser window.");
     } else {
-      const configuredHost = options.publicHost ?? process.env.DIGGYLAB_PUBLIC_HOST?.trim();
+      const access = runtime.manager.getAccessCredential();
+      if (!access) {
+        io.error("This server is not paired yet. Run `diggylab pair --code <code>` first.");
+        return 1;
+      }
+      const webUrl = options.webUrl ?? process.env.DIGGYLAB_WEB_URL?.trim();
       display = await startVirtualDisplay({
-        bind: options.bind,
         displayNumber: options.display,
-        novncWeb: options.novncWeb,
-        port: options.port,
-        publicHost: configuredHost || void 0,
-        tokenDirectory: join4(runtime.directory, "novnc")
+        logDirectory: join4(runtime.directory, "logs")
       });
-      process.env.DISPLAY = `:${options.display ?? 99}`;
-      io.log(terminalQr(display.url));
+      relay = await openLoginScreenRelay({
+        accessToken: access.accessToken,
+        apiOrigin: runtime.endpoint.httpOrigin,
+        key: createRelayKey(),
+        rfbPort: display.rfbPort,
+        webUrl: webUrl || void 0
+      });
+      process.env.DISPLAY = display.display;
+      io.log(terminalQr(relay.url));
       io.log(`Open this link on your phone, or scan the QR above:
-${display.url}`);
-      if (display.alternateUrl) {
-        io.log(`Phone on another network? Forward port ${options.port ?? 6080} and use:
-${display.alternateUrl}`);
-      }
+${relay.url}`);
       io.log("Log into Facebook on that screen; the agent saves the session automatically.");
+      void relay.screenConnected.then(() => io.log("Login screen opened in the browser."));
     }
-    await waitForFacebookLogin(login, LOGIN_TIMEOUT_MS + 6e4);
+    const waiting = waitForFacebookLogin(login, LOGIN_TIMEOUT_MS + 6e4);
+    const failures = [display?.failure, relay?.failure].filter((value) => Boolean(value));
+    await (failures.length > 0 ? Promise.race([waiting, ...failures]) : waiting);
     io.log("Facebook session saved.");
     return 0;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    if (/spawn (?:Xvfb|x11vnc|websockify) ENOENT/.test(message)) {
+    if (/spawn (?:Xvfb|x11vnc) ENOENT/.test(message)) {
       io.error(MISSING_DISPLAY_HINT);
       return 1;
     }
+    if (/virtual screen|login screen|DiggyLab relay|Xvfb exited|x11vnc exited/i.test(message)) {
+      io.error(`The login screen failed: ${message}`);
+      printDisplayLogs(join4(runtime.directory, "logs"), io);
+      return 1;
+    }
     if (/Executable doesn't exist|playwright install/i.test(message)) {
       io.error(MISSING_BROWSER_HINT);
       return 1;
     }
     throw error;
   } finally {
+    relay?.close();
     await login.close();
     await display?.stop();
   }
 }
+async function importFacebookCookies(runtime, source, io) {
+  let input;
+  try {
+    input = source === "-" ? await readStdin() : readFileSync2(source, "utf8");
+  } catch {
+    io.error(`Could not read "${source}". Pass a file path, or "-" to paste the cookies instead.`);
+    return 1;
+  }
+  const cookies = parseCookieInput(input);
+  if (cookies.length === 0) {
+    io.error("No cookies found there. Export the facebook.com cookies as JSON, or copy the browser's `cookie:` request header.");
+    io.error("Cookie-Editor (Chrome, Edge, Firefox) \u2192 Export \u2192 JSON is the easiest way.");
+    return 1;
+  }
+  const state = toFacebookStorageState(cookies);
+  if (!state.cookies.some((cookie) => cookie.name === "c_user")) {
+    io.error("Those cookies have no `c_user` value, so they are not a Facebook login.");
+    io.error("Open facebook.com in your browser, make sure you are logged in, then export the facebook.com cookies.");
+    return 1;
+  }
+  try {
+    const accountId = await runtime.facebook.save(state);
+    io.log(`Facebook session saved for account ${accountId}. Asking Facebook to confirm it...`);
+    const condition = await validateImportedSession(runtime, state);
+    if (condition !== "READY") {
+      await runtime.facebook.clear();
+      io.error(condition === "CHECKPOINT_REQUIRED" ? "Facebook asked for a security check on this server. Open facebook.com on your phone and approve the login, then import again." : "Facebook did not accept those cookies \u2014 they are usually expired. Log in again in your browser and export fresh ones.");
+      return 1;
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/Executable doesn't exist|playwright install/i.test(message)) {
+      io.error(MISSING_BROWSER_HINT);
+    } else if (message === "FACEBOOK_SESSION_INVALID") {
+      io.error("Those cookies are incomplete: the export must include `c_user` and `xs`.");
+    } else {
+      io.error(`Could not use those cookies: ${message}`);
+    }
+    return 1;
+  }
+  io.log("Facebook session saved.");
+  return 0;
+}
+async function validateImportedSession(runtime, state) {
+  const browser = await runtime.browserType.launch({ headless: true });
+  try {
+    const context = await browser.newContext({ storageState: state });
+    const page = await context.newPage();
+    await page.goto("https://www.facebook.com/", { timeout: 45e3, waitUntil: "domcontentloaded" });
+    return await detectFacebookSession(page, context);
+  } finally {
+    await browser.close();
+  }
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let value = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      value += chunk;
+    });
+    process.stdin.on("end", () => resolve(value));
+    process.stdin.on("error", reject);
+  });
+}
 function playwrightCliPath() {
   try {
     return fileURLToPath(new URL("cli.js", import.meta.resolve("playwright")));
@@ -2759,7 +3063,7 @@ async function commandInstallDisplay(io) {
     return 0;
   }
   if (!existsSync2("/usr/bin/apt-get")) {
-    io.error("Automatic installation supports Debian/Ubuntu. Install xvfb, x11vnc, websockify, and noVNC with your package manager.");
+    io.error("Automatic installation supports Debian/Ubuntu. Install xvfb and x11vnc with your package manager.");
     return 1;
   }
   const sudo = typeof process.getuid === "function" && process.getuid() !== 0 ? ["sudo"] : [];
@@ -2768,9 +3072,9 @@ async function commandInstallDisplay(io) {
     child.once("error", reject);
     child.once("exit", (value) => resolve(value ?? 1));
   });
-  io.log("Installing xvfb, x11vnc, websockify, and noVNC...");
+  io.log("Installing xvfb and x11vnc...");
   await run([...sudo, "apt-get", "update"]).catch(() => 1);
-  const code = await run([...sudo, "apt-get", "install", "-y", "xvfb", "x11vnc", "websockify", "novnc"]);
+  const code = await run([...sudo, "apt-get", "install", "-y", "xvfb", "x11vnc"]);
   if (code !== 0) {
     io.error("Installation failed. Run the same command with apt manually.");
     return code;
@@ -2792,7 +3096,7 @@ async function commandRun(runtime, io) {
     agentVersion: agentVersion(),
     clearTimer: (timer) => clearTimeout(timer),
     createSocket: (url, accessToken) => {
-      const socket = new WebSocket(url, {
+      const socket = new WebSocket2(url, {
         headers: { authorization: `Bearer ${accessToken}` },
         maxPayload: 16 * 1024
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "diggylab",
-  "version": "0.1.36",
+  "version": "0.1.39",
   "description": "DiggyLab Desktop Agent collects posts and information from Facebook Groups on a paired computer. (headless CLI)",
   "type": "module",
   "bin": {