diggylab 0.1.40 → 0.1.42

package/README.md

@@ -7,7 +7,6 @@ headless Chromium — the Electron app is not involved.
 ## Requirements
 
 - Node.js 20+
-- Linux packages: `xvfb` and `x11vnc` — run `diggylab install-display` (Debian/Ubuntu) or install them yourself. The Docker image below bundles them.
 - Chromium for Playwright: downloaded automatically during `npm install`; rerun `diggylab install-browser` if that download failed.
 
 ## Install
@@ -37,7 +36,7 @@ npm publish apps/desktop-agent/dist-npm --access public
 ```
 
 `cli:pack` bundles the workspace code into a single `cli.js`, so the published package only depends
-on `playwright`, `qrcode-terminal`, and `ws`. The packed manifest copies the version from
+on `playwright` and `ws`. The packed manifest copies the version from
 `apps/desktop-agent/package.json`; use the override below when the app release has not caught up yet.
 
 ### Publishing ahead of an app release
@@ -58,60 +57,30 @@ npm publish apps/desktop-agent/dist-npm --access public
 | Command | What it does |
 | --- | --- |
 | `pair --code <code> [--name <device name>] [--api <origin>]` | Pairs the server as a device. Create the code on `/settings/desktop-agent` in the web app. |
-| `login` | Renders the Facebook login page on a virtual screen and prints a DiggyLab link + QR code. Open it on any phone or laptop — no ports, no tunnel — and the session is stored encrypted on the server. |
+| `login` | Opens Facebook's real login page in a browser window when the machine has a screen. On a server without one it asks for `facebook.com` cookies pasted from your own browser, and the session is stored encrypted. |
 | `run` | Connects the WebSocket worker, receives assigned scans, scans headlessly, uploads results. |
 | `status` | Shows the config directory, API origin, paired device, and Facebook session state. |
 | `install-browser` | Downloads the Chromium build Playwright needs (~150 MB). It also runs during `npm install`, so you only need it if that download failed. |
-| `install-display` | On Debian/Ubuntu, installs `xvfb` and `x11vnc` for the login screen. |
 | `unpair` | Removes device credentials, the Facebook session, and pending scans. |
 
-Useful options: `--api <origin>` (default `https://api.diggylab.com`), `--web-url <origin>` (only for a
-self-hosted web app, or `DIGGYLAB_WEB_URL`), `--display <number>` to avoid an Xvfb collision.
+Useful options: `--api <origin>` (default `https://api.diggylab.com`), `--cookies <file>` to import
+cookies directly.
 
-## How `login` works on a server
+## How `login` works
 
-A server has no screen, so the agent starts `Xvfb` (virtual screen) and `x11vnc` (shares it), then
-carries that screen to the customer through the API connection it already uses for scans:
+Two paths, depending on the machine:
 
-```
-Xvfb → Chromium opens Facebook's real login page → encrypted over the API → link + QR → phone logs in
-```
-
-Nothing has to be opened on the server: no port, no tunnel, no firewall change. The link points at
-the web app (`https://diggylab.com/agent-login/<session>#<key>`), and everything is torn down when the
-login finishes or times out (10 minutes).
-
-### The screen is encrypted end to end
-
-The part of the link after `#` is the decryption key, and browsers never send a fragment to a server —
-so the relay passes bytes it cannot read. DiggyLab stores nothing: no frames, no keystrokes, no
-session. The Facebook cookies stay on the customer's server, sealed with `~/.diggylab/key`.
-
-The link itself is the only way in: it is single use, expires with the login window, and the session
-is created per `login` run.
-
-### When the screen does not appear
-
-`login` checks the virtual screen before printing the link: it reads x11vnc's greeting, so a broken
-screen stops the command with the reason instead of leaving the customer with a blank page.
-
-Each process writes a log to `~/.diggylab/logs/` (`xvfb.log`, `x11vnc.log`). The tail is printed when
-the screen fails or a process dies during the login, and the files stay there for later inspection.
-
-Manual checks while `login` is running:
-
-```bash
-pgrep -a Xvfb; pgrep -a x11vnc                                        # both must be running
-ss -ltnp | grep :5999                                                 # x11vnc listens on loopback
-timeout 2 bash -c 'exec 3<>/dev/tcp/127.0.0.1/5999 && head -c 12 <&3' # expect: RFB 003.008
-```
+| Machine | What `login` does |
+| --- | --- |
+| Desktop, or Linux with a display (`$DISPLAY` set) | Opens Chromium on that display with Facebook's real login page; you log in normally. |
+| Server without a screen | Prints a short prompt and asks you to paste `facebook.com` cookies exported from your own browser. |
 
-If the browser says the link expired, run `diggylab login` again — each run mints a new session.
+Both paths save the session encrypted with `~/.diggylab/key`, and `diggylab run` then uses it for scans.
 
 ### Logging in with cookies from your own browser
 
-If you would rather not share a screen, log into Facebook in your own browser and import those
-cookies instead — no Xvfb, no link, no port:
+On a machine without a screen this is the only path, and you can also pick it on a desktop with
+`diggylab login cookies`:
 
 1. Get the `facebook.com` cookies, in whichever way is easiest:
    - **DevTools → Network** (fastest): open facebook.com, click any request, copy the whole
@@ -119,12 +88,15 @@ cookies instead — no Xvfb, no link, no port:
    - **DevTools → Application → Cookies → `https://www.facebook.com`**: select the table and copy the
      rows.
    - **Cookie-Editor** (Chrome, Edge, Firefox): *Export → JSON*.
-2. On the server:
+2. On the server, run the friendly form and paste when asked (Enter finishes the paste):
 
 ```bash
-diggylab login --cookies cookies.json     # or: diggylab login --cookies -   and paste, then Ctrl-D
+diggylab login cookies
 ```
 
+The equivalents: `diggylab login --cookies 'name=value; ...'` for a quoted one-liner, or
+`diggylab login --cookies cookies.json` for a saved file.
+
 Only `name` and `value` are required; the agent fills in the rest (`.facebook.com`, `/`, session
 expiry). Every `facebook.com` cookie is kept, and at least `c_user` plus `xs` must be present — those
 two carry the session, and `datr` is worth keeping too.
@@ -169,8 +141,8 @@ WantedBy=multi-user.target
 
 ```bash
 docker build -f apps/desktop-agent/Dockerfile.cli -t diggylab .
-docker run -it --rm -p 6080:6080 -v diggylab:/data diggylab pair --code ABC123
-docker run -it --rm -p 6080:6080 -v diggylab:/data diggylab login
+docker run -it --rm -v diggylab:/data diggylab pair --code ABC123
+docker run -it --rm -v diggylab:/data diggylab login cookies
 docker run -d --restart unless-stopped -v diggylab:/data diggylab run
 ```
 

package/cli.js

@@ -2,10 +2,10 @@
 
 // src/cli/cli.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
 import { hostname, homedir } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../../packages/facebook-scanner/dist/parser.js
@@ -513,7 +513,7 @@ function withTimeout(promise, timeoutMs) {
 
 // src/cli/cli.ts
 import { chromium } from "playwright";
-import WebSocket2 from "ws";
+import WebSocket from "ws";
 
 // src/main/activity-log.ts
 import { gzip } from "node:zlib";
@@ -2315,9 +2315,7 @@ var FLAGS = {
   "--code": { key: "code", type: "string" },
   "--config": { key: "config", type: "string" },
   "--cookies": { key: "cookies", type: "string" },
-  "--display": { key: "display", type: "number" },
-  "--name": { key: "name", type: "string" },
-  "--web-url": { key: "webUrl", type: "string" }
+  "--name": { key: "name", type: "string" }
 };
 function parseCliArgs(argv) {
   const options = {};
@@ -2329,6 +2327,10 @@ function parseCliArgs(argv) {
       const spec = FLAGS[flag];
       if (!spec) return { error: `Unknown option "${flag}".`, options };
       const raw = inline ?? argv[index + 1];
+      if (flag === "--cookies" && (raw === void 0 || raw.startsWith("--"))) {
+        options.cookies = "";
+        continue;
+      }
       if (raw === void 0 || raw.startsWith("--")) return { error: `Option "${flag}" needs a value.`, options };
       if (inline === void 0) index += 1;
       if (spec.type === "number") {
@@ -2340,6 +2342,10 @@ function parseCliArgs(argv) {
       }
       continue;
     }
+    if (command === "login" && token === "cookies" && options.cookies === void 0) {
+      options.cookies = "";
+      continue;
+    }
     if (command === void 0) {
       command = token;
       continue;
@@ -2487,278 +2493,6 @@ function createFileCrypto(keyPath) {
   };
 }
 
-// src/cli/login-screen-relay.ts
-import { createConnection } from "node:net";
-import WebSocket from "ws";
-
-// src/cli/relay-crypto.ts
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, hkdfSync, randomBytes as randomBytes2 } from "node:crypto";
-var FRAME_VERSION = 1;
-var IV_BYTES2 = 12;
-var KEY_BYTES2 = 32;
-var TAG_BYTES2 = 16;
-function createRelayKey() {
-  return randomBytes2(KEY_BYTES2).toString("base64url");
-}
-function deriveRelayKeys(key, sessionId) {
-  const secret = Buffer.from(key, "base64url");
-  const salt = Buffer.from(sessionId, "utf8");
-  const derive = (info) => Buffer.from(hkdfSync("sha256", secret, salt, Buffer.from(info, "utf8"), KEY_BYTES2));
-  return { fromAgent: derive("agent-to-browser"), toAgent: derive("browser-to-agent") };
-}
-function sealFrame(key, payload) {
-  const iv = randomBytes2(IV_BYTES2);
-  const cipher = createCipheriv2("aes-256-gcm", key, iv);
-  const sealed = Buffer.concat([cipher.update(payload), cipher.final()]);
-  return Buffer.concat([Buffer.from([FRAME_VERSION]), iv, sealed, cipher.getAuthTag()]);
-}
-function openFrame(key, frame) {
-  if (frame.length < 1 + IV_BYTES2 + TAG_BYTES2 || frame[0] !== FRAME_VERSION) {
-    throw new Error("Invalid login screen frame.");
-  }
-  const decipher = createDecipheriv2("aes-256-gcm", key, frame.subarray(1, 1 + IV_BYTES2));
-  decipher.setAuthTag(frame.subarray(frame.length - TAG_BYTES2));
-  return Buffer.concat([
-    decipher.update(frame.subarray(1 + IV_BYTES2, frame.length - TAG_BYTES2)),
-    decipher.final()
-  ]);
-}
-
-// src/cli/login-screen-relay.ts
-var RELAY_PATH = "/desktop-agent/login-screen";
-var READY_TIMEOUT_MS = 1e4;
-var DEFAULT_WEB_ORIGIN = "https://diggylab.com";
-async function openLoginScreenRelay(options) {
-  const socket = new WebSocket(`${toWebSocketOrigin(options.apiOrigin)}${RELAY_PATH}`, {
-    headers: { authorization: `Bearer ${options.accessToken}` }
-  });
-  let closed = false;
-  let keys = null;
-  let vnc = null;
-  let resolveScreen = () => void 0;
-  let rejectFailure = () => void 0;
-  const failure = new Promise((_resolve, reject) => {
-    rejectFailure = reject;
-  });
-  const screenConnected = new Promise((resolve) => {
-    resolveScreen = resolve;
-  });
-  failure.catch(() => void 0);
-  const close = () => {
-    closed = true;
-    vnc?.destroy();
-    vnc = null;
-    if (socket.readyState === WebSocket.OPEN || socket.readyState === WebSocket.CONNECTING) socket.close();
-  };
-  const fail = (message) => {
-    close();
-    rejectFailure(new Error(message));
-  };
-  const openScreen = () => {
-    if (closed || vnc) return;
-    const connection = createConnection({ host: "127.0.0.1", port: options.rfbPort });
-    vnc = connection;
-    connection.on("data", (chunk) => {
-      if (closed || !keys || socket.readyState !== WebSocket.OPEN) return;
-      socket.send(sealFrame(keys.fromAgent, chunk), { binary: true });
-    });
-    connection.once("error", () => {
-      if (vnc === connection) vnc = null;
-      fail("Could not reach the virtual screen.");
-    });
-    connection.once("close", () => {
-      if (vnc === connection) vnc = null;
-    });
-  };
-  socket.on("message", (data, isBinary) => {
-    if (isBinary) {
-      if (!keys || !vnc || vnc.destroyed) return;
-      try {
-        vnc.write(openFrame(keys.toAgent, Buffer.from(data)));
-      } catch {
-        fail("The login screen received a corrupted frame.");
-      }
-      return;
-    }
-    const message = parseRelayMessage(data.toString());
-    if (message?.type === "screen-connected") {
-      openScreen();
-      resolveScreen();
-    } else if (message?.type === "screen-disconnected") {
-      vnc?.destroy();
-      vnc = null;
-    }
-  });
-  socket.once("error", () => fail("Could not reach the DiggyLab relay."));
-  socket.once("close", () => {
-    if (!closed) fail("The DiggyLab relay closed the login screen.");
-  });
-  const ready = await waitForReady(socket);
-  keys = deriveRelayKeys(options.key, ready.id);
-  const webOrigin = (options.webUrl ?? ready.webUrl ?? DEFAULT_WEB_ORIGIN).replace(/\/+$/, "");
-  return {
-    close,
-    failure,
-    screenConnected,
-    url: `${webOrigin}/agent-login/${encodeURIComponent(ready.id)}#${options.key}`
-  };
-}
-function parseRelayMessage(value) {
-  try {
-    const parsed = JSON.parse(value);
-    if (parsed && typeof parsed === "object" && typeof parsed.type === "string") {
-      return parsed;
-    }
-  } catch {
-  }
-  return null;
-}
-function waitForReady(socket) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error("The DiggyLab relay did not answer in time.")), READY_TIMEOUT_MS);
-    timer.unref();
-    socket.once("message", (data, isBinary) => {
-      clearTimeout(timer);
-      if (isBinary) {
-        reject(new Error("The DiggyLab relay answered with an unexpected frame."));
-        return;
-      }
-      const message = parseRelayMessage(data.toString());
-      if (message?.type !== "ready") {
-        reject(new Error("The DiggyLab relay did not accept the login screen."));
-        return;
-      }
-      resolve(message);
-    });
-    socket.once("error", () => {
-      clearTimeout(timer);
-      reject(new Error("Could not reach the DiggyLab relay."));
-    });
-    socket.once("close", () => {
-      clearTimeout(timer);
-      reject(new Error("The DiggyLab relay refused the login screen."));
-    });
-  });
-}
-function toWebSocketOrigin(origin) {
-  return origin.replace(/^http/i, "ws").replace(/\/+$/, "");
-}
-
-// src/cli/qr.ts
-import qrcode from "qrcode-terminal";
-function terminalQr(value) {
-  let output = "";
-  qrcode.generate(value, { small: true }, (rendered) => {
-    output = rendered;
-  });
-  return output;
-}
-
-// src/cli/virtual-display.ts
-import { spawn } from "node:child_process";
-import { createWriteStream, mkdirSync as mkdirSync2 } from "node:fs";
-import { createConnection as createConnection3 } from "node:net";
-import { join as join3 } from "node:path";
-
-// src/cli/vnc-probe.ts
-import { createConnection as createConnection2 } from "node:net";
-var PROBE_TIMEOUT_MS = 4e3;
-var GREETING_BYTES = 12;
-var GREETING_PATTERN = /^RFB \d{3}\.\d{3}\n$/;
-function probeRfb(host, port, timeoutMs = PROBE_TIMEOUT_MS) {
-  return new Promise((resolve) => {
-    const socket = createConnection2({ host, port });
-    const finish = (result) => {
-      clearTimeout(timer);
-      socket.destroy();
-      resolve(result);
-    };
-    const timer = setTimeout(() => finish(false), timeoutMs);
-    let received = "";
-    socket.on("data", (chunk) => {
-      received += chunk.toString("latin1");
-      if (received.length >= GREETING_BYTES) finish(GREETING_PATTERN.test(received.slice(0, GREETING_BYTES)));
-    });
-    socket.once("error", () => finish(false));
-    socket.once("close", () => finish(false));
-  });
-}
-
-// src/cli/virtual-display.ts
-var START_TIMEOUT_MS = 15e3;
-function waitForPort(host, port, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  return new Promise((resolve, reject) => {
-    const attempt = () => {
-      const socket = createConnection3({ host, port });
-      socket.once("connect", () => {
-        socket.destroy();
-        resolve();
-      });
-      socket.once("error", () => {
-        socket.destroy();
-        if (Date.now() >= deadline) {
-          reject(new Error(`Timed out waiting for ${host}:${port}.`));
-          return;
-        }
-        setTimeout(attempt, 250).unref();
-      });
-    };
-    attempt();
-  });
-}
-function start(name, command, args, env, deps, logDirectory) {
-  const child = deps.spawnProcess(command, args, env);
-  const log = createWriteStream(join3(logDirectory, `${name}.log`), { mode: 384 });
-  const failure = new Promise((_resolve, reject) => {
-    child.on("error", (error) => reject(error instanceof Error ? error : new Error(String(error))));
-    child.on("exit", (code) => reject(new Error(`${command} exited with code ${String(code)}.`)));
-  });
-  log.on("error", () => void 0);
-  log.write(`# ${command} ${args.join(" ")}
-`);
-  child.stdout?.pipe?.(log, { end: false });
-  child.stderr?.pipe?.(log, { end: false });
-  return { child, failure };
-}
-async function startVirtualDisplay(options, overrides = {}) {
-  const deps = {
-    probeRfb,
-    spawnProcess: spawn,
-    waitForPort,
-    ...overrides
-  };
-  const displayNumber = options.displayNumber ?? 99;
-  const display = `:${displayNumber}`;
-  const height = options.height ?? 900;
-  const rfbPort = 5900 + displayNumber;
-  mkdirSync2(options.logDirectory, { mode: 448, recursive: true });
-  const xvfb = start("xvfb", "Xvfb", [display, "-screen", "0", `${options.width ?? 1280}x${height}x24`, "-nolisten", "tcp"], process.env, deps, options.logDirectory);
-  const vnc = start("x11vnc", "x11vnc", ["-display", display, "-localhost", "-rfbport", String(rfbPort), "-forever", "-shared", "-nopw", "-quiet"], process.env, deps, options.logDirectory);
-  const failure = Promise.race([vnc.failure, xvfb.failure]);
-  failure.catch(() => void 0);
-  const stop = async () => {
-    for (const { child } of [vnc, xvfb]) {
-      child.kill("SIGTERM");
-      await new Promise((resolve) => setTimeout(resolve, 200));
-      child.kill("SIGKILL");
-    }
-  };
-  try {
-    await Promise.race([
-      deps.waitForPort("127.0.0.1", rfbPort, options.timeoutMs ?? START_TIMEOUT_MS),
-      failure
-    ]);
-    if (!await deps.probeRfb("127.0.0.1", rfbPort)) {
-      throw new Error(`The virtual screen did not answer on 127.0.0.1:${rfbPort}.`);
-    }
-  } catch (error) {
-    await stop();
-    throw error;
-  }
-  return { display, failure, logDirectory: options.logDirectory, rfbPort, stop };
-}
-
 // src/cli/cli.ts
 var LOGIN_TIMEOUT_MS = 10 * 60 * 1e3;
 var CONFIG_DIRECTORY = ".diggylab";
@@ -2766,23 +2500,22 @@ var USAGE = `DiggyLab Desktop Agent CLI
 
 Usage:
   diggylab pair --code <code> [--name <device name>] [--api <https://api.diggylab.com>]
-  diggylab login [--display <number>] [--web-url <https://diggylab.com>]
-  diggylab login --cookies <file or ->   (import cookies exported from your own browser)
+  diggylab login                          (opens a browser window when the machine has a screen)
+  diggylab login cookies                  (no screen: paste facebook.com cookies when asked)
+  diggylab login --cookies <file>         (or --cookies 'name=value; ...')
   diggylab run
   diggylab status
   diggylab install-browser
-  diggylab install-display
   diggylab unpair
 
 Global options:
   --config <directory>   Agent state directory (default ~/.diggylab)
   --api <origin>         API origin (default $DIGGYLAB_API_URL or https://api.diggylab.com)`;
 var MISSING_BROWSER_HINT = "Chromium for Playwright is not installed yet. Run `diggylab install-browser` once.";
-var MISSING_DISPLAY_HINT = "The login screen needs Xvfb and x11vnc. Run `diggylab install-display` (Debian/Ubuntu) or use the Docker image.";
 function agentVersion() {
   let directory = fileURLToPath(new URL(".", import.meta.url));
   for (let depth = 0; depth < 4; depth += 1) {
-    const manifest = join4(directory, "package.json");
+    const manifest = join3(directory, "package.json");
     if (existsSync2(manifest)) {
       try {
         const version = JSON.parse(readFileSync2(manifest, "utf8")).version;
@@ -2799,7 +2532,7 @@ function resolvePlatform() {
   return process.platform === "linux" ? "LINUX" : "WINDOWS";
 }
 function resolveConfigDirectory(options) {
-  return options.config?.trim() || process.env.DIGGYLAB_AGENT_DIR?.trim() || join4(homedir(), CONFIG_DIRECTORY);
+  return options.config?.trim() || process.env.DIGGYLAB_AGENT_DIR?.trim() || join3(homedir(), CONFIG_DIRECTORY);
 }
 function resolveEndpoint(options) {
   const configured = (options.api ?? process.env.DIGGYLAB_API_URL)?.trim() || "https://api.diggylab.com";
@@ -2809,29 +2542,16 @@ function resolveEndpoint(options) {
 function createRuntime(options) {
   const directory = resolveConfigDirectory(options);
   const endpoint = resolveEndpoint(options);
-  const crypto2 = createFileCrypto(join4(directory, "key"));
-  const credentials = new CredentialStore(join4(directory, "credentials.json"), crypto2);
+  const crypto2 = createFileCrypto(join3(directory, "key"));
+  const credentials = new CredentialStore(join3(directory, "credentials.json"), crypto2);
   const sessions = new DeviceSessionStore(credentials);
   const facebook = new FacebookSessionStore(credentials);
-  const spool = new EncryptedScanSpool(join4(directory, "scan-spool"), crypto2);
-  const activity = new ActivityLog({ directory: join4(directory, "activity") });
+  const spool = new EncryptedScanSpool(join3(directory, "scan-spool"), crypto2);
+  const activity = new ActivityLog({ directory: join3(directory, "activity") });
   const http = new DesktopAgentHttpClient(endpoint.httpOrigin);
   const manager = new DeviceCredentialManager(sessions, http, createDeviceIdentity);
   return { activity, browserType: createBrowserLauncher(chromium), directory, endpoint, facebook, manager, sessions, spool };
 }
-function printDisplayLogs(directory, io, lines = 12) {
-  io.error(`Login screen logs: ${directory}`);
-  try {
-    for (const name of readdirSync(directory).sort()) {
-      if (!name.endsWith(".log")) continue;
-      const tail = readFileSync2(join4(directory, name), "utf8").split("\n").filter((line) => line.trim() !== "").slice(-lines);
-      if (tail.length === 0) continue;
-      io.error(`--- ${name} ---`);
-      for (const line of tail) io.error(line);
-    }
-  } catch {
-  }
-}
 function waitForFacebookLogin(login, timeoutMs) {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
@@ -2897,7 +2617,11 @@ async function commandPair(runtime, options, io) {
   }
 }
 async function commandLogin(runtime, options, io) {
-  if (options.cookies) return importFacebookCookies(runtime, options.cookies, io);
+  if (options.cookies !== void 0) return importFacebookCookies(runtime, options.cookies || "-", io);
+  if (process.platform === "linux" && !process.env.DISPLAY) {
+    io.log("This server has no screen, so the login uses cookies from your browser.");
+    return importFacebookCookies(runtime, "-", io);
+  }
   const login = new FacebookLoginService({
     browserType: runtime.browserType,
     clearTimer: (timer) => clearTimeout(timer),
@@ -2915,79 +2639,34 @@ async function commandLogin(runtime, options, io) {
     io.log("Facebook is already connected.");
     return 0;
   }
-  let display = null;
-  let relay = null;
   try {
-    const needsVirtualDisplay = process.platform === "linux" && !process.env.DISPLAY;
-    if (!needsVirtualDisplay) {
-      io.log(process.env.DISPLAY ? `Opening the Facebook login page on display ${process.env.DISPLAY}.` : "Opening the Facebook login page in a browser window.");
-    } else {
-      const stored = await runtime.manager.load();
-      if (!stored) {
-        io.error("This server is not paired yet. Run `diggylab pair --code <code>` first.");
-        return 1;
-      }
-      const access = await runtime.manager.refresh();
-      const webUrl = options.webUrl ?? process.env.DIGGYLAB_WEB_URL?.trim();
-      display = await startVirtualDisplay({
-        displayNumber: options.display,
-        logDirectory: join4(runtime.directory, "logs")
-      });
-      relay = await openLoginScreenRelay({
-        accessToken: access.accessToken,
-        apiOrigin: runtime.endpoint.httpOrigin,
-        key: createRelayKey(),
-        rfbPort: display.rfbPort,
-        webUrl: webUrl || void 0
-      });
-      process.env.DISPLAY = display.display;
-      io.log(terminalQr(relay.url));
-      io.log(`Open this link on your phone, or scan the QR above:
-${relay.url}`);
-      io.log("Log into Facebook on that screen; the agent saves the session automatically.");
-      void relay.screenConnected.then(() => io.log("Login screen opened in the browser."));
-    }
-    const waiting = waitForFacebookLogin(login, LOGIN_TIMEOUT_MS + 6e4);
-    const failures = [display?.failure, relay?.failure].filter((value) => Boolean(value));
-    await (failures.length > 0 ? Promise.race([waiting, ...failures]) : waiting);
+    io.log(process.env.DISPLAY ? `Opening the Facebook login page on display ${process.env.DISPLAY}.` : "Opening the Facebook login page in a browser window.");
+    await waitForFacebookLogin(login, LOGIN_TIMEOUT_MS + 6e4);
     io.log("Facebook session saved.");
     return 0;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    if (/spawn (?:Xvfb|x11vnc) ENOENT/.test(message)) {
-      io.error(MISSING_DISPLAY_HINT);
-      return 1;
-    }
-    if (/CREDENTIAL_REVOKED|not paired/i.test(message)) {
-      io.error("This server is not paired (or was unpaired). Run `diggylab pair --code <code>` again.");
-      return 1;
-    }
-    if (/NETWORK_ERROR|SERVER_UNAVAILABLE|fetch failed/i.test(message)) {
-      io.error(`Could not reach the API: ${message}`);
-      return 1;
-    }
-    if (/virtual screen|login screen|DiggyLab relay|Xvfb exited|x11vnc exited/i.test(message)) {
-      io.error(`The login screen failed: ${message}`);
-      printDisplayLogs(join4(runtime.directory, "logs"), io);
-      return 1;
-    }
     if (/Executable doesn't exist|playwright install/i.test(message)) {
       io.error(MISSING_BROWSER_HINT);
       return 1;
     }
     throw error;
   } finally {
-    relay?.close();
     await login.close();
-    await display?.stop();
   }
 }
 async function importFacebookCookies(runtime, source, io) {
   let input;
-  try {
-    input = source === "-" ? await readStdin() : readFileSync2(source, "utf8");
-  } catch {
-    io.error(`Could not read "${source}". Pass a file path, or "-" to paste the cookies instead.`);
+  if (source === "-") {
+    input = await readPastedCookies(io);
+  } else if (existsSync2(source)) {
+    input = readFileSync2(source, "utf8");
+  } else if (source.includes("=")) {
+    input = source;
+  } else {
+    io.error(`Could not read "${source}".`);
+    io.error("Paste the cookies in quotes: diggylab login --cookies 'datr=...; c_user=...; xs=...'");
+    io.error("Or save them to a file (diggylab login --cookies cookies.txt), or use --cookies - and press Ctrl-D after pasting.");
     return 1;
   }
   const cookies = parseCookieInput(input);
@@ -2997,9 +2676,11 @@ async function importFacebookCookies(runtime, source, io) {
     return 1;
   }
   const state = toFacebookStorageState(cookies);
+  io.log(`Read ${cookies.length} cookie${cookies.length === 1 ? "" : "s"}.`);
   if (!state.cookies.some((cookie) => cookie.name === "c_user")) {
     io.error("Those cookies have no `c_user` value, so they are not a Facebook login.");
-    io.error("Open facebook.com in your browser, make sure you are logged in, then export the facebook.com cookies.");
+    io.error("If you pasted them on the command line, wrap the whole string in quotes so the shell keeps it together.");
+    io.error("Open facebook.com in your browser, make sure you are logged in, then copy the `cookie:` request header again.");
     return 1;
   }
   try {
@@ -3047,6 +2728,33 @@ function readStdin() {
     process.stdin.on("error", reject);
   });
 }
+function readPastedCookies(io) {
+  if (!process.stdin.isTTY) return readStdin();
+  io.log("Paste the facebook.com cookies here, then press Enter.");
+  io.log("In your browser: F12 \u2192 Network \u2192 click any facebook.com request \u2192 copy the whole `cookie:` value.");
+  return new Promise((resolve) => {
+    let value = "";
+    let idle;
+    const finish = () => {
+      if (idle) clearTimeout(idle);
+      process.stdin.off("data", handleData);
+      process.stdin.pause();
+      resolve(value);
+    };
+    const handleData = (chunk) => {
+      value += chunk;
+      if (idle) clearTimeout(idle);
+      if (value.includes("\n") && value.includes("c_user")) {
+        finish();
+        return;
+      }
+      idle = setTimeout(finish, 350);
+    };
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", handleData);
+    process.stdin.resume();
+  });
+}
 function playwrightCliPath() {
   try {
     return fileURLToPath(new URL("cli.js", import.meta.resolve("playwright")));
@@ -3063,7 +2771,7 @@ async function commandInstallBrowser(io) {
   }
   io.log("Downloading Chromium for Playwright...");
   const run = (args) => new Promise((resolve, reject) => {
-    const child = spawn2(process.execPath, [cli, ...args], { stdio: "inherit" });
+    const child = spawn(process.execPath, [cli, ...args], { stdio: "inherit" });
     child.once("error", reject);
     child.once("exit", (value) => resolve(value ?? 1));
   });
@@ -3080,31 +2788,6 @@ async function commandInstallBrowser(io) {
   io.log("Chromium installed.");
   return 0;
 }
-async function commandInstallDisplay(io) {
-  if (process.platform !== "linux") {
-    io.log("The shared login screen is only needed on a Linux server; desktops open a browser window.");
-    return 0;
-  }
-  if (!existsSync2("/usr/bin/apt-get")) {
-    io.error("Automatic installation supports Debian/Ubuntu. Install xvfb and x11vnc with your package manager.");
-    return 1;
-  }
-  const sudo = typeof process.getuid === "function" && process.getuid() !== 0 ? ["sudo"] : [];
-  const run = (args) => new Promise((resolve, reject) => {
-    const child = spawn2(args[0], args.slice(1), { stdio: "inherit" });
-    child.once("error", reject);
-    child.once("exit", (value) => resolve(value ?? 1));
-  });
-  io.log("Installing xvfb and x11vnc...");
-  await run([...sudo, "apt-get", "update"]).catch(() => 1);
-  const code = await run([...sudo, "apt-get", "install", "-y", "xvfb", "x11vnc"]);
-  if (code !== 0) {
-    io.error("Installation failed. Run the same command with apt manually.");
-    return code;
-  }
-  io.log("Login screen packages installed.");
-  return 0;
-}
 async function commandRun(runtime, io) {
   const stored = await runtime.manager.load();
   if (!stored) {
@@ -3119,7 +2802,7 @@ async function commandRun(runtime, io) {
     agentVersion: agentVersion(),
     clearTimer: (timer) => clearTimeout(timer),
     createSocket: (url, accessToken) => {
-      const socket = new WebSocket2(url, {
+      const socket = new WebSocket(url, {
         headers: { authorization: `Bearer ${accessToken}` },
         maxPayload: 16 * 1024
       });
@@ -3227,13 +2910,12 @@ async function main(argv, io = console) {
     io.log(USAGE);
     return 0;
   }
-  if (!["install-browser", "install-display", "login", "pair", "run", "status", "unpair"].includes(command)) {
+  if (!["install-browser", "login", "pair", "run", "status", "unpair"].includes(command)) {
     io.error(`Unknown command "${command}".`);
     io.error(USAGE);
     return 2;
   }
   if (command === "install-browser") return commandInstallBrowser(io);
-  if (command === "install-display") return commandInstallDisplay(io);
   const runtime = createRuntime(parsed.options);
   switch (command) {
     case "pair":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "diggylab",
-  "version": "0.1.40",
+  "version": "0.1.42",
   "description": "DiggyLab Desktop Agent collects posts and information from Facebook Groups on a paired computer. (headless CLI)",
   "type": "module",
   "bin": {
@@ -15,7 +15,6 @@
   },
   "dependencies": {
     "playwright": "^1.62.0",
-    "qrcode-terminal": "^0.12.0",
     "ws": "^8.21.3"
   },
   "scripts": {