windscout 0.4.6 → 0.5.1

package/README.md

@@ -75,7 +75,7 @@ windscout -t 40 -a                          # longer connect timeout, also list
 |---|---|---|
 | `-c, --countries` | comma-separated ISO country codes, city names or nicknames | open the picker |
 | `-p, --protocols` | comma-separated: `wireguard`, `ikev2` (macOS and Windows), `stealth`, `wstunnel`, `udp`, `tcp`, optionally `:port` | saved, or all |
-| `-t, --timeout` | seconds to wait for each connection | 20 |
+| `-t, --timeout` | seconds to wait for each connection, at least 10 | picker: saved, or 20; with `-c`: 20 |
 | `-a, --all` | include failed attempts in the final table | off |
 | `-n, --no-speed` | connect-only mode: skip the download test, rank by latency | picker: saved, or connect-only on first run; with `-c`: speed test on |
 | `-f, --firewall` | block internet while scanning, except through the VPN | picker: saved, or off; with `-c`: off |
@@ -143,6 +143,17 @@ At the end, the results, a per-protocol summary and the best pick are printed to
 - **No flags in macOS Terminal.** Terminal.app draws flag emoji wider than their space, which pushes table borders out of line, so WindScout leaves them out there (as on Windows). iTerm2 and other terminals show them.
 - **Your connection changes during the scan.** WindScout connects and disconnects the VPN repeatedly, so don't run it while you need a stable connection.
 
+## Development
+
+The source is TypeScript in `src/`. It compiles to `dist/`, which is what gets published.
+
+```sh
+npm install
+npm run build       # compile src/ to dist/ (the windscout command is dist/cli.js)
+node dist/cli.js    # run your build; takes the same options as windscout
+./publish.sh        # build, install the packed tarball to check it runs, publish to npm (bump the version first)
+```
+
 ## License
 
 MIT

package/dist/cli.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// WindScout: find which Windscribe locations and protocols actually work from here.
+// Drives the official windscribe-cli: connects to each country/protocol pair,
+// measures latency and download speed through the tunnel, prints a ranked table.
+import { parseArgs } from "node:util";
+import { CONFIG, DEFAULT_TIMEOUT, loadConfig, MIN_TIMEOUT } from "./config.js";
+import { Scan } from "./scan.js";
+import { pick } from "./tui/picker.js";
+import { logProgress, showProgress } from "./tui/progress.js";
+import { report } from "./tui/report.js";
+import { leaveScreen, out } from "./tui/terminal.js";
+import { yellow } from "./tui/text.js";
+import { checkUpdate, updateNotice, VERSION } from "./update.js";
+import { blockInternet, CLI, isFirewallOn, PROTOCOLS, restoreFirewall, waitForLogin } from "./windscribe.js";
+const HELP = `Usage: windscout [options]
+
+Find which Windscribe locations and protocols work from your network, ranked by speed.
+Without -c it opens an interactive country picker (your selection is remembered).
+
+Options:
+  -c, --countries LIST  comma-separated ISO codes, city names or nicknames (skips the picker)
+  -p, --protocols LIST  comma-separated protocols, optional :port (default: ${PROTOCOLS.join(",")})
+  -t, --timeout SEC     seconds to wait for each connection, at least ${MIN_TIMEOUT} (default: saved, or ${DEFAULT_TIMEOUT})
+  -a, --all             also show failed attempts in the final table
+  -n, --no-speed        connect-only: skip the download test, rank by latency (faster scan)
+  -f, --firewall        block internet while scanning, except through the VPN (turned back off afterwards)
+  -v, --version         show the installed version (and whether a newer one is out)
+  -h, --help            show this help
+
+Selection is stored in ${CONFIG}
+Example: windscout -c DE,NL,TR -p stealth,tcp:443`;
+// "DE, NL,,TR" → ["DE", "NL", "TR"]
+const list = (s) => s.split(",").map((x) => x.trim()).filter(Boolean);
+async function main() {
+    const { values: a } = parseArgs({
+        options: {
+            countries: { type: "string", short: "c" },
+            protocols: { type: "string", short: "p" },
+            timeout: { type: "string", short: "t" },
+            all: { type: "boolean", short: "a", default: false },
+            help: { type: "boolean", short: "h", default: false },
+            version: { type: "boolean", short: "v", default: false },
+            "no-speed": { type: "boolean", short: "n", default: false },
+            firewall: { type: "boolean", short: "f", default: false },
+        },
+    });
+    if (a.help)
+        return console.log(HELP);
+    checkUpdate(); // runs while the app starts and the user picks, before the VPN starts switching
+    if (a.version) {
+        console.log(`windscout ${VERSION}`);
+        await checkUpdate();
+        const notice = updateNotice();
+        if (notice)
+            console.error(yellow(notice));
+        return;
+    }
+    let timeout = a.timeout ? Number(a.timeout) : undefined;
+    if (timeout !== undefined && !(timeout >= MIN_TIMEOUT))
+        throw new Error(`--timeout must be at least ${MIN_TIMEOUT} seconds`);
+    const status = await waitForLogin();
+    const tty = Boolean(process.stdin.isTTY && out.isTTY);
+    let countries = a.countries ? list(a.countries) : undefined;
+    let protocols = a.protocols ? list(a.protocols) : undefined;
+    let speedTest = !a["no-speed"];
+    let firewall = a.firewall;
+    if (!countries) {
+        if (!tty)
+            throw new Error("no terminal for the picker: pass countries with -c");
+        const saved = loadConfig();
+        if (protocols && saved)
+            saved.protocols = protocols.filter((p) => PROTOCOLS.includes(p));
+        const choice = await pick(saved, {
+            timeout: timeout ?? saved?.timeout ?? DEFAULT_TIMEOUT,
+            speedTest: speedTest && (saved?.speed ?? false), // first run: connect-only
+            // already on in the app: show it on, since the scan won't turn it off
+            firewall: firewall || isFirewallOn(status) || (saved?.firewall ?? false),
+        });
+        if (!choice)
+            return;
+        countries = choice.countries;
+        protocols ??= choice.protocols;
+        speedTest = choice.speed;
+        firewall = choice.firewall;
+        timeout = choice.timeout;
+    }
+    protocols ??= PROTOCOLS;
+    timeout ??= DEFAULT_TIMEOUT;
+    const scan = new Scan(countries, protocols, { timeout, speedTest });
+    const blocking = firewall && (await blockInternet());
+    const view = tty ? showProgress(scan, blocking) : logProgress(scan);
+    await scan.run(view);
+    await restoreFirewall();
+    view.close();
+    if (scan.stopping)
+        console.log(yellow("interrupted, showing partial results"));
+    report(scan.results, protocols, { all: a.all, speedTest });
+    await checkUpdate();
+    const notice = updateNotice();
+    if (notice)
+        console.error("\n" + yellow(notice));
+}
+main().catch(async (e) => {
+    leaveScreen();
+    console.error(`windscout: ${e.message}`);
+    await restoreFirewall().catch(() => console.error(`the firewall may still be on: run '${CLI} firewall off'`));
+    process.exit(1);
+});

package/dist/config.js

@@ -0,0 +1,31 @@
+// The picker's selection, remembered between runs.
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { COUNTRIES, PROTOCOLS } from "./windscribe.js";
+export const DEFAULT_TIMEOUT = 20;
+export const MIN_TIMEOUT = 10; // seconds; shorter cuts off connections that would have worked
+export const CONFIG = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "windscout", "config.json");
+/** The saved choice, minus anything this version doesn't offer; null on first run or an unreadable file */
+export function loadConfig() {
+    try {
+        const c = JSON.parse(readFileSync(CONFIG, "utf8"));
+        return {
+            countries: (c.countries ?? []).filter((x) => COUNTRIES.includes(x)),
+            protocols: (c.protocols ?? []).filter((x) => PROTOCOLS.includes(x)),
+            speed: c.speed !== false,
+            firewall: c.firewall === true,
+            timeout: c.timeout >= MIN_TIMEOUT ? c.timeout : DEFAULT_TIMEOUT,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function saveConfig(c) {
+    try {
+        mkdirSync(dirname(CONFIG), { recursive: true });
+        writeFileSync(CONFIG, JSON.stringify(c, null, 2) + "\n");
+    }
+    catch { } // not being able to remember isn't worth failing the scan
+}

package/dist/measure.js

@@ -0,0 +1,41 @@
+// Latency and download speed over whatever connection is up (the VPN tunnel, during a scan).
+import { now } from "./time.js";
+const LATENCY_URL = "https://www.gstatic.com/generate_204";
+const SPEED_URL = "https://speed.cloudflare.com/__down?bytes=10000000";
+const SPEED_SECONDS = 15;
+/** Best round trip of a few tries, in ms; null if none got through */
+export async function latencyMs(tries = 3) {
+    let best = null;
+    for (let i = 0; i < tries; i++) {
+        const t = now();
+        try {
+            await (await fetch(LATENCY_URL, { signal: AbortSignal.timeout(5000) })).arrayBuffer();
+        }
+        catch {
+            continue;
+        }
+        const ms = (now() - t) * 1000;
+        best = best === null ? ms : Math.min(best, ms);
+    }
+    return best;
+}
+/** Download speed in Mbps over at most SPEED_SECONDS; null if nothing arrived */
+export async function speedMbps() {
+    const t = now();
+    let n = 0;
+    try {
+        const res = await fetch(SPEED_URL, {
+            headers: { "User-Agent": "curl/8" }, // Cloudflare 403s unknown clients
+            signal: AbortSignal.timeout(SPEED_SECONDS * 1000),
+        });
+        if (!res.ok || !res.body)
+            return null;
+        for await (const chunk of res.body)
+            n += chunk.length;
+    }
+    catch {
+        if (!n)
+            return null; // timeout mid-download is fine: we measured what arrived
+    }
+    return (n * 8) / (now() - t) / 1e6;
+}

package/dist/probe.js

@@ -0,0 +1,56 @@
+// One attempt: connect to a location over a protocol, measure through the tunnel, disconnect.
+import { latencyMs, speedMbps } from "./measure.js";
+import { now, sleep } from "./time.js";
+import { connectState, windscribe } from "./windscribe.js";
+// "Connected: Miami - Vice" → "Miami - Vice"
+const place = (state) => state.split(":").slice(1).join(":").trim();
+export async function probe(query, protocol, { timeout, speedTest, stopped = () => false, onStep = () => { } }) {
+    const r = { query, protocol, location: "", connectS: null, latencyMs: null, speedMbps: null };
+    const end = (status) => ({ ...r, status });
+    onStep("connecting");
+    await windscribe("connect", "-n", query, protocol);
+    const t = now();
+    try {
+        for (;;) {
+            if (stopped())
+                return end("interrupted");
+            if (now() - t >= timeout)
+                return end("timeout");
+            const s = await connectState();
+            if (s.startsWith("Connecting:"))
+                r.location = place(s);
+            else if (s.startsWith("Connected")) {
+                if (s.includes(":"))
+                    r.location = place(s);
+                r.connectS = now() - t;
+                break;
+            }
+            else if (s.includes("does not exist"))
+                return end("no such location");
+            else if (s === "Disconnected" && now() - t > 3)
+                return end("failed");
+            onStep(`connecting ${r.location}`.trim());
+            await sleep(1000);
+        }
+        onStep(`measuring latency · ${r.location}`);
+        r.latencyMs = await latencyMs();
+        if (r.latencyMs === null)
+            return end("no internet");
+        if (speedTest) {
+            onStep(`measuring speed · ${r.location}`);
+            r.speedMbps = await speedMbps();
+        }
+        return end("ok");
+    }
+    finally {
+        onStep("disconnecting");
+        await windscribe("disconnect");
+        // the CLI's disconnect can return while the app is still tearing down (it does after a timed-out connect);
+        // a connect sent then is swallowed and the next attempt reads as an instant "failed", so wait it out
+        for (let i = 0; i < 30 && (await connectState()) === "Disconnecting"; i++)
+            await sleep(1000);
+    }
+}
+/** The attempts that worked, best first: fastest, then lowest latency */
+export const sortOk = (results) => results.filter((r) => r.status === "ok")
+    .sort((x, y) => (y.speedMbps ?? 0) - (x.speedMbps ?? 0) || (x.latencyMs ?? 0) - (y.latencyMs ?? 0));

package/dist/scan.js

@@ -0,0 +1,75 @@
+// A scan: every country × protocol pair, tried in order, with pause and stop.
+import { probe } from "./probe.js";
+import { now } from "./time.js";
+// ponytail: rough per-attempt cost: a failure burns the timeout, a success ~connect+speed test; refine from real runs
+export const attemptSeconds = (timeout) => timeout + 5;
+export const estimate = (countries, protocols, timeout) => countries * protocols * attemptSeconds(timeout);
+/** Progress views read the fields; their keys call togglePause() and stop() */
+export class Scan {
+    countries;
+    protocols;
+    options;
+    results = [];
+    finished = []; // countries with every attempt done: the views refresh their tables per country
+    total;
+    started = now();
+    done = 0;
+    attemptStart = now();
+    current = null;
+    step = ""; // what the running attempt is doing
+    stopping = false; // stop after the current attempt
+    // a pause lands between attempts, so the VPN is disconnected while waiting
+    paused = false;
+    waiting = false;
+    waitStart = 0;
+    idle = 0; // seconds spent paused
+    resume = () => { };
+    constructor(countries, protocols, options) {
+        this.countries = countries;
+        this.protocols = protocols;
+        this.options = options;
+        this.total = countries.length * protocols.length;
+    }
+    /** Seconds spent scanning, pauses not counted */
+    elapsed() {
+        return now() - this.started - this.idle - (this.waiting ? now() - this.waitStart : 0);
+    }
+    togglePause() {
+        this.paused = !this.paused;
+        if (!this.paused)
+            this.resume();
+    }
+    stop() {
+        this.stopping = true;
+        this.resume(); // a paused scan stops right away
+    }
+    async run(hooks = {}) {
+        const { timeout, speedTest } = this.options;
+        outer: for (const country of this.countries) {
+            for (const protocol of this.protocols) {
+                if (this.paused && !this.stopping) {
+                    this.waiting = true;
+                    this.waitStart = now();
+                    await new Promise((resolve) => (this.resume = resolve));
+                    this.waiting = false;
+                    this.idle += now() - this.waitStart;
+                }
+                if (this.stopping)
+                    break outer;
+                this.current = { country, protocol };
+                this.attemptStart = now();
+                hooks.attempt?.(country, protocol);
+                const r = await probe(country, protocol, { timeout, speedTest, stopped: () => this.stopping, onStep: (s) => (this.step = s) });
+                this.results.push(r);
+                this.done++;
+                hooks.result?.(r);
+                if (r.status === "no such location") { // its other protocols won't connect either
+                    this.done += this.protocols.length - this.protocols.indexOf(protocol) - 1;
+                    break;
+                }
+            }
+            this.finished.push(country);
+        }
+        return this.results;
+    }
+}

package/dist/time.js

@@ -0,0 +1,10 @@
+// Clock helpers shared by the scan and the screens.
+export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Seconds on a monotonic clock */
+export const now = () => performance.now() / 1000;
+/** "9s", "1m 05s", "1h 01m" */
+export function duration(sec) {
+    sec = Math.max(0, Math.round(sec));
+    const h = Math.floor(sec / 3600), m = Math.floor((sec % 3600) / 60), s = sec % 60;
+    return h ? `${h}h ${String(m).padStart(2, "0")}m` : m ? `${m}m ${String(s).padStart(2, "0")}s` : `${s}s`;
+}

package/dist/tui/country.js

@@ -0,0 +1,15 @@
+// Country codes for display: "DE" → "🇩🇪 Germany".
+const regionName = new Intl.DisplayNames(["en"], { type: "region" });
+export function countryName(code) {
+    try {
+        return regionName.of(code) ?? code;
+    }
+    catch {
+        return code; // city names / nicknames aren't region codes
+    }
+}
+// two regional-indicator letters render as the country's flag emoji (Windows has no flag glyphs: it would show
+// two boxed letters of unpredictable width and break the table borders, so leave the slot blank there).
+// macOS Terminal draws flags ~half a column wider than the 2 it advances, nudging table borders right: blank there too
+const noFlags = process.platform === "win32" || process.env.TERM_PROGRAM === "Apple_Terminal";
+export const flag = (code) => !noFlags && /^[A-Z]{2}$/.test(code) ? String.fromCodePoint(...[...code].map((c) => 0x1f1a5 + c.charCodeAt(0))) : "  ";

package/dist/tui/picker.js

@@ -0,0 +1,274 @@
+import { MIN_TIMEOUT, saveConfig } from "../config.js";
+import { attemptSeconds, estimate } from "../scan.js";
+import { duration } from "../time.js";
+import { checkUpdate, updateNotice } from "../update.js";
+import { COUNTRIES, PROTOCOLS } from "../windscribe.js";
+import { countryName, flag } from "./country.js";
+import { draw, enterScreen, input, leaveScreen, out, repoLink } from "./terminal.js";
+import { bold, cyan, dim, green, under, vw, yellow } from "./text.js";
+import { box, centerIn, grid } from "./widgets.js";
+const flip = (set, value) => (set.has(value) ? set.delete(value) : set.add(value));
+/** Resolves to the choice (also saved for next time), or null when the user quits */
+export function pick(saved, { timeout, speedTest, firewall }) {
+    const selected = new Set(saved?.countries ?? []);
+    const protos = new Set(saved?.protocols.length ? saved.protocols : PROTOCOLS);
+    let cursor = 0, top = 0, message = "", query = "", searching = false;
+    let seconds = String(timeout), editing = false; // the timeout, as typed
+    let hit;
+    const visible = () => {
+        const q = query.toLowerCase();
+        return q ? COUNTRIES.filter((c) => c.toLowerCase().includes(q) || countryName(c).toLowerCase().includes(q)) : COUNTRIES;
+    };
+    enterScreen();
+    return new Promise((resolve) => {
+        const render = () => {
+            const rows = out.rows || 24;
+            const notice = updateNotice();
+            const matches = visible();
+            const height = Math.max(3, rows - 21 - (notice ? 1 : 0));
+            cursor = Math.max(0, Math.min(cursor, matches.length - 1));
+            if (cursor < top)
+                top = cursor;
+            if (cursor >= top + height)
+                top = cursor - height + 1;
+            top = Math.max(0, Math.min(top, matches.length - height));
+            const protoLine = PROTOCOLS.map((p, i) => `${dim(under(String(i + 1)))} ${protos.has(p) ? green("● " + p) : dim("○ " + p)}`).join("   ");
+            const speedLine = `${dim(under("s"))} ${speedTest ? green("● speed test") : dim("○ speed test")}  ${dim(speedTest
+                ? "ranks by download speed · adds ~15s per working connection"
+                : "off: connect-only, ranks by latency")}`;
+            const fwLabel = "block internet while scanning (firewall)";
+            const fwLine = `${dim(under("f"))} ${firewall ? green("● " + fwLabel) : dim("○ " + fwLabel)}  ${dim(firewall
+                ? "only VPN traffic gets through"
+                : "off: apps may leak in between")}`;
+            timeout = Number(seconds);
+            const short = timeout < MIN_TIMEOUT;
+            const timeoutLine = `${dim(under("t"))} timeout ${editing ? bold(seconds) + cyan("▏") : (short ? yellow : bold)(seconds || "?")} s  ${dim(`per connection · at least ${MIN_TIMEOUT}`)}`;
+            const search = searching
+                ? `${cyan("🔍")} ${bold(query)}${cyan("▏")}`
+                : query ? `🔍 ${query}` : dim("🔍 press / to search");
+            const shown = matches.slice(top, top + height);
+            const range = matches.length > height ? `${top + 1}–${top + shown.length} of ${matches.length}` : `${matches.length} countries`;
+            const body = shown.map((code, j) => {
+                const here = top + j === cursor;
+                const mark = selected.has(code) ? green("●") : dim("○");
+                const name = `${flag(code)} ${countryName(code)}`;
+                return [`${here ? cyan("❯") : " "} ${mark}`, here ? bold(code) : dim(code), here ? bold(cyan(name)) : name];
+            });
+            if (!body.length)
+                body.push(["   ", "", dim("no country matches")]);
+            const buttons = [
+                ["start", "▶ Start"],
+                ["all", under("A") + (query ? "ll shown" : "ll")],
+                ["none", under("N") + (query ? "one shown" : "one")],
+                ["quit", under("Q") + "uit"],
+            ];
+            const buttonLine = buttons.map(([id, label]) => (id === "start" ? bold(cyan(`[ ${label} ]`)) : dim(`[ ${label} ]`))).join("  ");
+            const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(vw(protoLine), vw(speedLine), vw(fwLine), vw(timeoutLine)) + 4 });
+            const width = vw(table[0]);
+            const head = box([protoLine, speedLine, fwLine, timeoutLine], {
+                title: bold(cyan("WindScout")),
+                right: `${bold(String(selected.size))}${dim(`/${COUNTRIES.length} selected`)}`,
+                width: width - 4,
+            });
+            const n = selected.size * protos.size;
+            const lines = [
+                ...head,
+                ...table,
+                "",
+                centerIn(buttonLine, width),
+                "",
+                centerIn(n
+                    ? `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(estimate(selected.size, protos.size, timeout)))} ${dim(`(~${attemptSeconds(timeout)}s each)`)}`
+                    : yellow("select at least one country and one protocol"), width),
+                centerIn(dim(editing
+                    ? "type the seconds to wait for each connection · enter/esc done"
+                    : searching
+                        ? "type to filter · ↑↓ move · enter/esc done"
+                        : `↑↓ move · space select · a/n ${query ? "all/none shown" : "all/none"} · / search`), width),
+                centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · s speed test · f firewall · t timeout · enter start · ${query ? "esc clear · " : ""}q quit`), width),
+            ];
+            if (message)
+                lines.push(centerIn(yellow(message), width));
+            lines.push("", centerIn(dim(repoLink), width));
+            if (notice)
+                lines.push(centerIn(yellow(notice), width));
+            const at = draw(lines);
+            // click map, in screen coordinates
+            let px = at.left + 2; // "│ " before the protocol line
+            const protoHits = PROTOCOLS.map((p, i) => {
+                const len = vw(`${i + 1} ● ${p}`);
+                const range = [px, px + len];
+                px += len + 3;
+                return range;
+            });
+            let bx = at.left + Math.floor((width - vw(buttonLine)) / 2);
+            const buttonHits = buttons.map(([id, label]) => {
+                const len = vw(`[ ${label} ]`);
+                const range = [id, bx, bx + len];
+                bx += len + 2;
+                return range;
+            });
+            hit = {
+                protoRow: at.top + 1, protoHits, speedRow: at.top + 2, firewallRow: at.top + 3, timeoutRow: at.top + 4,
+                searchRow: at.top + head.length + 1,
+                firstRow: at.top + head.length + 5, shown: shown.length,
+                buttonRow: at.top + head.length + table.length + 1, buttonHits,
+            };
+        };
+        let closed = false;
+        checkUpdate().then(() => updateNotice() && !closed && render()); // the check usually lands after the first draw
+        const finish = (value) => {
+            closed = true;
+            out.off("resize", render);
+            input.removeAllListeners("keypress");
+            input.removeAllListeners("mouse");
+            if (!value)
+                leaveScreen();
+            resolve(value);
+        };
+        const start = () => {
+            if (!selected.size || !protos.size) {
+                message = "nothing to scan yet";
+                return false;
+            }
+            if (!(timeout >= MIN_TIMEOUT)) {
+                message = `the timeout must be at least ${MIN_TIMEOUT} seconds`;
+                return false;
+            }
+            // keep the user's order of preference stable: list order
+            const choice = {
+                countries: COUNTRIES.filter((c) => selected.has(c)),
+                protocols: PROTOCOLS.filter((p) => protos.has(p)),
+                speed: speedTest,
+                firewall,
+                timeout,
+            };
+            saveConfig(choice);
+            finish(choice);
+            return true;
+        };
+        input.on("mouse", (m) => {
+            if (!m.press)
+                return;
+            message = "";
+            const matches = visible();
+            const { x, y } = m;
+            if (m.button === 64)
+                cursor = Math.max(0, cursor - 3); // wheel up
+            else if (m.button === 65)
+                cursor = Math.min(matches.length - 1, cursor + 3); // wheel down
+            else if (m.button !== 0)
+                return; // left button only
+            else if (y === hit.searchRow)
+                searching = true, editing = false;
+            else if (y === hit.timeoutRow)
+                editing = true, searching = false;
+            else {
+                searching = editing = false; // clicking anywhere else ends typing, like leaving a text field
+                if (y >= hit.firstRow && y < hit.firstRow + hit.shown) {
+                    cursor = top + (y - hit.firstRow);
+                    const c = matches[cursor];
+                    if (c)
+                        flip(selected, c);
+                }
+                else if (y === hit.protoRow) {
+                    const i = hit.protoHits.findIndex(([a, b]) => x >= a && x < b);
+                    if (i >= 0)
+                        flip(protos, PROTOCOLS[i]);
+                }
+                else if (y === hit.speedRow)
+                    speedTest = !speedTest;
+                else if (y === hit.firewallRow)
+                    firewall = !firewall;
+                else if (y === hit.buttonRow) {
+                    const id = hit.buttonHits.find(([, a, b]) => x >= a && x < b)?.[0];
+                    if (id === "start" && start())
+                        return;
+                    if (id === "quit")
+                        return finish(null);
+                    if (id === "all")
+                        matches.forEach((c) => selected.add(c));
+                    if (id === "none")
+                        matches.forEach((c) => selected.delete(c));
+                }
+            }
+            render();
+        });
+        out.on("resize", render);
+        input.on("keypress", (str, key = {}) => {
+            message = "";
+            const k = key.name;
+            const matches = visible();
+            const toggle = () => {
+                const c = matches[cursor];
+                if (!c)
+                    return;
+                flip(selected, c);
+                cursor = Math.min(matches.length - 1, cursor + 1);
+            };
+            if (key.ctrl && k === "c")
+                return finish(null);
+            if (k === "up")
+                cursor = Math.max(0, cursor - 1);
+            else if (k === "down")
+                cursor = Math.min(matches.length - 1, cursor + 1);
+            else if (k === "pageup")
+                cursor = Math.max(0, cursor - 10);
+            else if (k === "pagedown")
+                cursor = Math.min(matches.length - 1, cursor + 10);
+            else if (editing) {
+                if (k === "return" || k === "escape")
+                    editing = false;
+                else if (k === "backspace")
+                    seconds = seconds.slice(0, -1);
+                else if (/^[0-9]$/.test(str ?? "") && seconds.length < 4)
+                    seconds = seconds === "0" ? str : seconds + str;
+            }
+            else if (searching) {
+                // typing goes into the search box; letters are not shortcuts here
+                if (k === "return" || k === "escape")
+                    searching = false;
+                else if (k === "backspace")
+                    query = query.slice(0, -1), cursor = 0;
+                else if (k === "space" && !query)
+                    toggle();
+                else if (str && !key.ctrl && !key.meta && str >= " ")
+                    query += str, cursor = 0;
+            }
+            else if (k === "home")
+                cursor = 0;
+            else if (k === "end")
+                cursor = matches.length - 1;
+            else if (k === "k")
+                cursor = Math.max(0, cursor - 1);
+            else if (k === "j")
+                cursor = Math.min(matches.length - 1, cursor + 1);
+            else if (str === "/")
+                searching = true;
+            else if (k === "space")
+                toggle();
+            else if (k === "a")
+                matches.forEach((c) => selected.add(c));
+            else if (k === "n")
+                matches.forEach((c) => selected.delete(c));
+            else if (k === "s")
+                speedTest = !speedTest;
+            else if (k === "f")
+                firewall = !firewall;
+            else if (k === "t")
+                editing = true, seconds = "";
+            else if (/^[1-9]$/.test(str ?? "") && PROTOCOLS[Number(str) - 1])
+                flip(protos, PROTOCOLS[Number(str) - 1]);
+            else if (k === "escape" && query)
+                query = "", cursor = 0;
+            else if (k === "return") {
+                if (start())
+                    return;
+            }
+            else if (k === "q" || k === "escape")
+                return finish(null);
+            render();
+        });
+        render();
+    });
+}