windscout 0.6.0 → 0.6.1

package/README.md

@@ -140,9 +140,9 @@ The mirrors come from [Mirava](https://github.com/MiravaOrg/Mirava)'s list of mi
 
 **Kernel check:** each container first checks that docker's Linux kernel gives it what Windscribe needs: a tunnel device (tun) and a firewall (nftables). If not, the scan stops and says so, rather than showing every location as blocked. Windscribe's WireGuard also needs nftables' `fib` in its firewall table, which Docker Desktop's own Linux VM lacks (on macOS, and on Windows without WSL 2). There, WireGuard runs on this computer instead (see below).
 
-**Login:** each container's Windscribe app logs in once. WindScout asks for your Windscribe username and password (and a 2FA code or captcha when Windscribe asks for one) and passes them to the containers, one at a time. Each login is kept in that container's docker volume (`windscout-1`, `windscout-2`, …), so later scans don't ask.
+**Login:** the containers' Windscribe apps log in with the session that the Windscribe app on this computer is logged in with, so they never log in with your password. Windscribe locks an account that logs in many times at once, and a login per container would do that. WindScout reads the session from the app's settings (`~/.config/Windscribe/Windscribe2.conf` on Linux, the `com.windscribe.Windscribe2` defaults on macOS, `HKEY_CURRENT_USER\Software\Windscribe\Windscribe2` in the registry on Windows) and hands it to each container on its standard input, not on a command line, where other programs could see it. Each container's docker volume (`windscout-1`, `windscout-2`, …) keeps its app's settings for the next scans, with the WireGuard keys it registered with your account. A volume that another account used starts over. If you log out of the Windscribe app, the containers' session ends too, and the next scan gives them the new one.
 
-**Remember username and password** is ticked to start with (tab to it and press space, or click it). Once the login works, WindScout saves both in `~/.config/windscout/login.json`, as plain text that only you can read. Then containers that are new next time (a scan with more attempts) log in by themselves, with no terminal too; a 2FA code is never saved, so with 2FA they still ask. Untick it and nothing is saved, and a login saved before is forgotten. Deleting that file forgets it too. With `-c` and no terminal, only containers that are logged in already, or can log in with the remembered login, take part.
+WindScout 0.6.0 asked for your username and password instead, and could save them in `~/.config/windscout/login.json`. WindScout now deletes that file.
 
 **Measuring:** the containers share your internet connection, so they take turns measuring latency and speed while the connecting happens in parallel. Numbers stay comparable with a normal scan. Most of the time saved comes from attempts that hang until the timeout, which overlap now.
 
@@ -152,7 +152,7 @@ The mirrors come from [Mirava](https://github.com/MiravaOrg/Mirava)'s list of mi
 - This computer's own Windscribe connection is disconnected at the start and stays off while the containers scan, since it would carry their traffic too.
 - No firewall: "block internet while scanning" isn't used, since it would block the containers' traffic too.
 
-The containers are removed after the scan. To remove the logins too, run `docker volume rm windscout-1 windscout-2 …`. To remove the image, run `docker rmi windscout-worker`.
+The containers are removed after the scan. To remove their settings too (and the session in them), run `docker volume rm windscout-1 windscout-2 …`. To remove the image, run `docker rmi windscout-worker`.
 
 ## Output
 

package/dist/cli.js

@@ -5,7 +5,7 @@
 import { createInterface } from "node:readline";
 import { spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
-import { CONFIG, DEFAULT_TIMEOUT, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard } from "./config.js";
+import { CONFIG, DEFAULT_TIMEOUT, forgetLogin, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard } from "./config.js";
 import { notInContainers, stopWorkers } from "./docker.js";
 import { probe } from "./probe.js";
 import { Scan } from "./scan.js";
@@ -96,8 +96,9 @@ async function main() {
     });
     if (a.worker) {
         await worker();
-        process.exit(); // its stdin may still be open: it has no login to scan with
+        process.exit(); // its stdin may still be open: its app didn't log in
     }
+    forgetLogin();
     if (a.help)
         return console.log(HELP);
     checkUpdate(); // runs while the app starts and the user picks, before the VPN starts switching

package/dist/config.js

@@ -1,4 +1,4 @@
-// The picker's selection, and the docker containers' Windscribe login if wanted, remembered between runs.
+// The picker's selection, and what the last parallel scan found its containers can do, remembered between runs.
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -6,8 +6,6 @@ import { COUNTRIES, PROTOCOLS } from "./windscribe.js";
 export const DEFAULT_TIMEOUT = 15;
 export const MIN_TIMEOUT = 10; // seconds; shorter cuts off connections that would have worked
 export const CONFIG = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "windscout", "config.json");
-// ponytail: plain text that only this user can read, like git's credential store; the OS keychain if that's not enough
-export const LOGIN_FILE = join(dirname(CONFIG), "login.json");
 const DOCKER_FILE = join(dirname(CONFIG), "docker.json"); // what the last parallel scan found its containers can do
 /** The saved choice, minus anything this version doesn't offer; null on first run or an unreadable file */
 export function loadConfig() {
@@ -50,24 +48,10 @@ export function saveDockerWireGuard(wireguard) {
     }
     catch { } // not being able to remember isn't worth failing the scan
 }
-/** The Windscribe login remembered for the docker containers; null when there's none */
-export function loadLogin() {
+/** Deletes the Windscribe username and password that 0.6.0 saved for the docker containers: they log in with this computer's session now */
+export function forgetLogin() {
     try {
-        const { username, password } = JSON.parse(readFileSync(LOGIN_FILE, "utf8"));
-        return typeof username === "string" && typeof password === "string" ? { username, password } : null;
+        rmSync(join(dirname(CONFIG), "login.json"), { force: true });
     }
-    catch {
-        return null;
-    }
-}
-/** Remembers the login, or forgets it (null) */
-export function saveLogin(c) {
-    try {
-        rmSync(LOGIN_FILE, { force: true }); // a new file gets the mode below; an old one would keep its own
-        if (!c)
-            return;
-        mkdirSync(dirname(LOGIN_FILE), { recursive: true });
-        writeFileSync(LOGIN_FILE, JSON.stringify(c) + "\n", { mode: 0o600 });
-    }
-    catch { } // not being able to remember isn't worth failing the scan
+    catch { } // not being able to delete it isn't worth failing the scan
 }

package/dist/docker.js

@@ -1,4 +1,5 @@
 // Parallel scans: a docker container per slot, each with its own Windscribe app, so each has its own tunnel.
+// The apps log in with the session this computer's app is logged in with.
 // A container runs `windscout --worker` (worker.ts) and takes attempts from here one at a time:
 // a JSON object per line on its stdin, answered the same way on its stdout.
 import { spawn, spawnSync } from "node:child_process";
@@ -29,7 +30,7 @@ const REGISTRIES = [...(process.env.WINDSCOUT_REGISTRY_MIRRORS?.split(",").map((
 // The CMD first checks the kernel (WSL's builds tun and parts of nftables as modules): no tun or nftables, no tunnel, so
 // the container stops saying so instead of scanning. The helper's WireGuard routing also puts a fib rule in an inet table,
 // which Docker Desktop's own kernel (macOS, Windows without WSL) can't run: WS_WIREGUARD=0 then, and it runs on this computer.
-// No systemd in a container: start the helper (root) and the app (as a user: its CLI refuses root) like their units would
+// No systemd in a container: start the helper (root) like its unit would; the worker starts the app once it has the session
 const DOCKERFILE = `FROM ${BASE_TAG}
 ENV LANG=C.UTF-8
 RUN for m in deb.debian.org mirror.shatel.ir mirror.iranserver.com mirror.mobinhost.com mirror2.chabokan.net; do \\
@@ -51,7 +52,6 @@ CMD mkdir -p /dev/net && { [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200; }
   nft 'add table inet wscheck; add chain inet wscheck p { type filter hook prerouting priority 0; }; add rule inet wscheck p fib saddr type != local drop; delete table inet wscheck' 2>/dev/null \\
   && wg=1 || wg=0; \\
   /opt/windscribe/helper >/dev/null 2>&1 & \\
-  runuser -u ws -- env HOME=/home/ws /opt/windscribe/Windscribe >/dev/null 2>&1 & \\
   exec runuser -u ws -- env HOME=/home/ws WS_WIREGUARD=$wg node /app/dist/cli.js --worker
 `;
 const user = userInfo().username;
@@ -105,7 +105,7 @@ export async function dockerState() {
     return "ready";
 }
 const WORKER_MEMORY = 250e6; // bytes per container: Windscribe's app and helper, a tunnel and node take ~120 MB
-const MAX_WORKERS = 8; // ponytail: past this, more containers mostly add logins and load on the one uplink; raise if real scans say so
+const MAX_WORKERS = 8; // ponytail: past this, more containers mostly add load on the one uplink; raise if real scans say so
 /** Protocols the containers can't do, which a parallel scan runs on this computer after them: IKEv2 (Windscribe's Linux app
  * has none), and WireGuard when their kernel can't run its routing (see DOCKERFILE) */
 export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => p === "ikev2" || (p === "wireguard" && !wireguard)));
@@ -243,27 +243,22 @@ const running = new Map(); // container name → its `docker run`, until the con
 // a crash or a force quit leaves them running: remove them
 const removeAll = () => running.size && spawnSync("docker", ["rm", "-f", ...running.keys()], { stdio: "ignore" });
 process.on("exit", removeAll);
-/** Starts n containers and logs them in to Windscribe, one at a time; resolves to a prober for each container that got ready,
- * and whether WireGuard works in them */
-export async function startWorkers(n, prompt, onStatus) {
-    const measuring = mutex(), loggingIn = mutex();
+/** Starts n containers, their apps logged in with this computer's session; resolves to a prober for each container that got
+ * ready, and whether WireGuard works in them */
+export async function startWorkers(n, session, onStatus) {
+    const measuring = mutex();
     let wireguard = true;
-    let creds; // undefined: not asked yet; null: the user cancelled
     let ready = 0;
-    const credentials = async (error) => {
-        if (creds !== null && (error || !creds))
-            creds = await prompt.credentials(error);
-        return creds;
-    };
     const start = (i) => new Promise((resolve) => {
         const name = `windscout-${process.pid}-${i + 1}`;
-        // its own volume keeps its Windscribe login for the next scans
+        // its own volume keeps its app's settings for the next scans: its WireGuard keys, registered with Windscribe once
         // it makes /dev/net/tun itself: Docker's Linux VM may have none (WSL loads tun as a module), and --device needs one there
         const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
             "--sysctl", "net.ipv4.conf.all.src_valid_mark=1", "-v", `windscout-${i + 1}:/home/ws/.config/Windscribe`, IMAGE], { detached: process.platform !== "win32" }); // its own process group, so ctrl-c reaches only us (Windows would open a window)
         running.set(name, p);
         const send = (m) => p.stdin.write(JSON.stringify(m) + "\n");
         p.stdin.on("error", () => { }); // it stopped: "close" deals with that
+        send({ session }); // on stdin, not in the command line or the environment, where ps and docker inspect show it
         let on = (_) => { }; // the current phase's message handler
         let fail = (_) => { }; // and what it does when the container stops
         let dead = "", err = "";
@@ -312,28 +307,14 @@ export async function startWorkers(n, prompt, onStatus) {
             };
             send({ probe: { query, protocol, timeout, speedTest } });
         });
-        let leave = null, used = null, unused = false; // the login lock while logging in; with what; or no login for it
-        fail = (why) => (leave?.(), unused || onStatus(`container ${i + 1}: ${why}`), resolve(null));
-        on = async (m) => {
-            if (m.need === "login") {
-                leave ??= await loggingIn();
-                const c = await credentials(m.text ?? "");
-                if (c)
-                    (used = c), send({ login: c });
-                else
-                    (unused = true), p.stdin.end(); // none: the worker gives up, its container stops
-            }
-            else if (m.need === "input")
-                send({ input: (await prompt.answer(m.text ?? "")) ?? "" });
-            else if (m.ready) {
-                leave?.();
-                if (used)
-                    prompt.loggedIn(used);
-                wireguard &&= m.wireguard !== false;
-                fail = () => { };
-                onStatus(`${++ready} of ${n} ready`);
-                resolve(prober);
-            }
+        fail = (why) => (onStatus(`container ${i + 1}: ${why}`), resolve(null));
+        on = (m) => {
+            if (!m.ready)
+                return;
+            wireguard &&= m.wireguard !== false;
+            fail = () => { };
+            onStatus(`${++ready} of ${n} ready`);
+            resolve(prober);
         };
     });
     const probers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((p) => p !== null);

package/dist/tui/docker.js

@@ -1,33 +1,17 @@
-// Docker on screen, for parallel scans: dialogs to install or start it (taking the sudo password),
-// progress while the image builds and the containers start, and the Windscribe login the containers need.
-import { homedir } from "node:os";
-import { LOGIN_FILE, loadLogin, saveLogin } from "../config.js";
 import { buildImage, dockerState, INSTALL_DOCS, runSteps, startWorkers, steps, sudoLogin, sudoReady, waitReady, workerCount } from "../docker.js";
 import { duration, now } from "../time.js";
+import { session } from "../windscribe.js";
 import { draw, enterScreen, input, leaveScreen, out } from "./terminal.js";
-import { bold, cyan, dim, green, vw, yellow } from "./text.js";
+import { bold, cyan, dim, vw, yellow } from "./text.js";
 import { box, centerIn } from "./widgets.js";
 const tty = () => Boolean(process.stdin.isTTY && out.isTTY);
 const clip = (s, n = 76) => (s.length > n ? s.slice(0, n - 1) + "…" : s);
 // lines of at most n columns, broken at spaces: an error can be longer than the screen is wide
 const wrap = (s, n = 76) => s.match(new RegExp(`.{1,${n}}(\\s+|$)|\\S+`, "g"))?.map((l) => l.trim()) ?? [s];
-let asking = false; // a dialog waits for the user: progress doesn't draw over it
-function paint({ lines, fields = [], check, buttons, error }, a = { values: [], checked: false, focus: 0 }) {
-    const many = fields.length + (check ? 1 : 0) > 1; // then a ❯ marks where the keys go
-    const mark = (i) => (!many ? "" : i === a.focus ? cyan("❯ ") : "  ");
-    const body = [...lines], items = [];
-    if (fields.length || check)
-        body.push("");
-    fields.forEach((f, i) => {
-        items.push(body.length);
-        body.push(`${mark(i)}${f.label} ${bold(f.secret ? "•".repeat(a.values[i].length) : a.values[i])}${i === a.focus ? cyan("▏") : ""}`);
-    });
-    if (check) {
-        items.push(body.length);
-        body.push(`${mark(fields.length)}${a.checked ? green("[✓]") : dim("[ ]")} ${check.label}`);
-        if (check.note)
-            body.push(dim(`${many ? "  " : ""}    ${check.note}`));
-    }
+function paint({ lines, password, buttons, error }, typed = "") {
+    const body = [...lines];
+    if (password !== undefined)
+        body.push("", `${password} ${bold("•".repeat(typed.length))}${cyan("▏")}`);
     if (error)
         body.push("", yellow(error));
     const width = Math.max(56, ...body.map(vw));
@@ -36,86 +20,53 @@ function paint({ lines, fields = [], check, buttons, error }, a = { values: [],
         const [ok, cancel] = buttons;
         line = `${bold(cyan(`[ ${ok} ]`))}${cancel ? dim(`  [ ${cancel} ]`) : ""}`;
         row = body.length + 1;
-        body.push("", centerIn(line, width), centerIn(dim([many && "tab/↑↓ move", check && "space ticks the box", `enter ${ok.toLowerCase()}`,
-            cancel && `esc ${cancel.toLowerCase()}`].filter(Boolean).join(" · ")), width));
+        body.push("", centerIn(line, width), centerIn(dim([`enter ${ok.toLowerCase()}`, cancel && `esc ${cancel.toLowerCase()}`].filter(Boolean).join(" · ")), width));
     }
     enterScreen();
     const at = draw(box(body, { title: bold(cyan("WindScout · docker")), width }));
-    // a body line sits a row under the box's top border, two columns right of its left one
-    const rows = items.map((i) => at.top + 1 + i);
     if (!buttons)
-        return { rows, buttons: -1, ok: [0, 0], cancel: [0, 0] };
+        return { row: -1, ok: [0, 0], cancel: [0, 0] };
+    // a body line sits a row under the box's top border, two columns right of its left one
     const x = at.left + 2 + Math.floor((width - vw(line)) / 2), okEnd = x + vw(`[ ${buttons[0]} ]`);
-    return { rows, buttons: at.top + 1 + row, ok: [x, okEnd], cancel: buttons[1] ? [okEnd + 2, okEnd + 2 + vw(`[ ${buttons[1]} ]`)] : [0, 0] };
+    return { row: at.top + 1 + row, ok: [x, okEnd], cancel: buttons[1] ? [okEnd + 2, okEnd + 2 + vw(`[ ${buttons[1]} ]`)] : [0, 0] };
 }
-/** Shows the dialog until the user answers: what was typed and ticked on enter (or a click on ok), null on esc.
- * tab, ↑↓ and enter move between the fields; space or a click ticks the checkbox */
-function form(d) {
+/** Shows the dialog until the user answers: what was typed in its field ("" without one) on enter or a click on ok, null on esc */
+function ask(d) {
     if (!tty())
         return Promise.resolve(null);
-    asking = true;
-    const fields = d.fields ?? [];
-    const n = fields.length + (d.check ? 1 : 0);
-    const a = { values: fields.map((f) => f.value ?? ""), checked: d.check?.on ?? false, focus: 0 };
-    let hits = paint(d, a);
-    const redraw = () => (hits = paint(d, a));
+    let typed = "";
+    let hits = paint(d, typed);
+    const redraw = () => (hits = paint(d, typed));
     return new Promise((resolve) => {
         const done = (v) => {
-            asking = false;
             input.off("keypress", onKey);
             input.off("mouse", onMouse);
             out.off("resize", redraw);
             resolve(v);
         };
         const onKey = (str, key = {}) => {
-            const field = a.focus < fields.length;
             if (key.name === "escape" || (key.ctrl && key.name === "c"))
                 return done(null);
-            if (key.name === "return") {
-                if (a.focus >= fields.length - 1)
-                    return done(a);
-                a.focus++; // like a form: on to the next field
-            }
-            else if (n > 1 && (key.name === "tab" || key.name === "down"))
-                a.focus = (a.focus + (key.shift ? n - 1 : 1)) % n;
-            else if (n > 1 && key.name === "up")
-                a.focus = (a.focus + n - 1) % n;
-            else if (!field) {
-                if (key.name === "space")
-                    a.checked = !a.checked;
-            }
-            else if (key.name === "backspace")
-                a.values[a.focus] = a.values[a.focus].slice(0, -1);
-            else if (str && !key.ctrl && !key.meta && str >= " ")
-                a.values[a.focus] += str;
+            if (key.name === "return")
+                return done(typed);
+            if (key.name === "backspace")
+                typed = typed.slice(0, -1);
+            else if (d.password !== undefined && str && !key.ctrl && !key.meta && str >= " ")
+                typed += str;
             redraw();
         };
         const onMouse = (m) => {
-            if (!m.press || m.button !== 0)
-                return;
-            const i = hits.rows.indexOf(m.y);
-            const on = ([from, to]) => m.y === hits.buttons && m.x >= from && m.x < to;
-            if (i >= 0) {
-                a.focus = i;
-                if (i === fields.length)
-                    a.checked = !a.checked; // the checkbox
-            }
-            else if (on(hits.ok))
-                return done(a);
+            const on = ([from, to]) => m.press && m.button === 0 && m.y === hits.row && m.x >= from && m.x < to;
+            if (on(hits.ok))
+                done(typed);
             else if (on(hits.cancel))
-                return done(null);
-            redraw();
+                done(null);
         };
         input.on("keypress", onKey);
         input.on("mouse", onMouse);
         out.on("resize", redraw);
     });
 }
-/** A dialog with one field or none: the field's text ("" without one) on enter, null on esc */
-const ask = async (d) => {
-    const a = await form(d);
-    return a && (a.values[0] ?? "");
-};
 /** Waits for work while the screen shows a spinner, status.label, the time so far and status.line (its latest output). esc quits */
 async function busy(status, work) {
     if (!tty()) {
@@ -124,10 +75,10 @@ async function busy(status, work) {
     }
     const t = now();
     let frame = 0;
-    const tick = () => asking || paint({ lines: [`${cyan("⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10])} ${status.label} ${dim("· " + duration(now() - t))}`,
+    const tick = () => paint({ lines: [`${cyan("⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10])} ${status.label} ${dim("· " + duration(now() - t))}`,
             dim(clip(status.line)), "", dim("esc quits")] });
-    // a dialog on top (the login) takes its own keys; the exit handlers remove containers already started
-    const quit = (_, key = {}) => !asking && (key.name === "escape" || key.name === "q" || (key.ctrl && key.name === "c"))
+    // the exit handlers remove containers already started
+    const quit = (_, key = {}) => (key.name === "escape" || key.name === "q" || (key.ctrl && key.name === "c"))
         && (leaveScreen(), process.exit(130));
     const timer = setInterval(tick, 120);
     input.on("keypress", quit);
@@ -160,7 +111,7 @@ export async function setupDocker() {
             : [])];
     let password, error = "";
     for (;;) {
-        const a = await ask({ lines, fields: root ? [{ label: "password for sudo:", secret: true }] : [], buttons: [state === "missing" ? "Install" : "Start", "Cancel"], error });
+        const a = await ask({ lines, password: root ? "password for sudo:" : undefined, buttons: [state === "missing" ? "Install" : "Start", "Cancel"], error });
         if (a === null)
             return false;
         if (!root)
@@ -193,49 +144,23 @@ export async function setupDocker() {
         return a !== null && setupDocker();
     }
 }
-const LOGIN = [
-    "Each container runs its own Windscribe app, which logs in once:",
-    "the login stays in the container's docker volume for the next scans.",
-];
-let lastUser = "", remember = true; // the box as last ticked: ticked to start with
-/** A remembered login unless that just failed, else the login form */
-async function credentials(error) {
-    const saved = loadLogin();
-    if (saved && !error)
-        return saved;
-    const a = await form({
-        lines: LOGIN,
-        fields: [{ label: "Windscribe username:", value: lastUser || saved?.username }, { label: "Windscribe password:", secret: true }],
-        check: { label: "remember username and password", on: remember,
-            note: `saved in ${LOGIN_FILE.replace(homedir(), "~")}, only you can read it` },
-        buttons: ["Log in", "Cancel"],
-        error,
-    });
-    if (!a)
-        return null;
-    remember = a.checked;
-    if (!remember)
-        saveLogin(null); // unticked: forget the one saved before, if any
-    const [username, password] = a.values;
-    return { username: (lastUser = username), password };
-}
-/** Starts the containers for a parallel scan of this many attempts: docker, the image, the logins.
- * Resolves to their probers and whether WireGuard works in them; null if the user backed out */
+/** Starts the containers for a parallel scan of this many attempts: docker, the image, the containers' apps logged in with
+ * this computer's session. Resolves to their probers and whether WireGuard works in them; null if the user backed out */
 export async function startParallel(attempts) {
+    const s = session();
+    if (!s)
+        throw new Error("can't find the session this computer's Windscribe app is logged in with, which the containers' apps log in with:"
+            + " update the Windscribe app, or scan without --docker (d in the picker)");
     if (!(await setupDocker()))
         return null;
     const status = { label: "building the containers' image (the first time takes a few minutes)", line: "" };
     await busy(status, buildImage((line) => (status.line = line)));
     const n = workerCount(attempts);
     Object.assign(status, { label: `starting ${n} container${n > 1 ? "s" : ""}`, line: "" });
-    const started = await busy(status, startWorkers(n, {
-        credentials,
-        answer: (question) => ask({ lines: ["Windscribe asks:", "", ...question.split("\n")], fields: [{ label: "answer:" }], buttons: ["Send", "Cancel"] }),
-        loggedIn: (c) => remember && saveLogin(c), // saved only once it worked
-    }, (line) => (status.line = line)));
+    const started = await busy(status, startWorkers(n, s, (line) => (status.line = line)));
     if (!started.probers.length) {
         const why = status.line.startsWith("container") ? ` (${status.line})` : ""; // the last container's trouble
-        throw new Error(why || tty() ? `no container got ready${why}` : "the containers aren't logged in to Windscribe yet: run windscout --docker in a terminal once");
+        throw new Error(`no container got ready${why}`);
     }
     return started;
 }

package/dist/windscribe.js

@@ -1,6 +1,7 @@
 // The Windscribe desktop app, driven through the windscribe-cli it ships with.
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { sleep } from "./time.js";
 export const CLI = "windscribe-cli";
@@ -69,6 +70,51 @@ export async function waitForLogin() {
             + `\nDon't have it? ${DOWNLOAD_URL}`);
     return status;
 }
+// The app's settings (Qt's, as Windscribe/Windscribe2): this INI file on Linux, the user's defaults on macOS, the registry on Windows
+export const SETTINGS = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "Windscribe", "Windscribe2.conf");
+/** A top-level value in the text of the INI file: Qt puts those under [General] */
+export function iniValue(ini, key) {
+    let general = false;
+    for (const line of ini.split(/\r?\n/)) {
+        if (line.startsWith("["))
+            general = line.trim() === "[General]";
+        else if (general && line.startsWith(`${key}=`))
+            return line.slice(key.length + 1);
+    }
+}
+/** The INI file's text with the app logging in with this session when it starts. Settings another account left start over:
+ * the WireGuard keys in them are registered with that account */
+export function withSession(ini, { userId, authHash }) {
+    if (userId && iniValue(ini, "userId") !== userId)
+        ini = "";
+    let general = false;
+    const lines = ini.split("\n").filter((line) => {
+        if (line.startsWith("["))
+            general = line.trim() === "[General]";
+        return !(general && line.startsWith("authHash="));
+    });
+    const at = lines.findIndex((line) => line.trim() === "[General]");
+    lines.splice(at + 1, 0, ...(at < 0 ? ["[General]"] : []), `authHash=${authHash}`);
+    return lines.join("\n");
+}
+/** One of the app's top-level settings on this computer; "" when it isn't there, or doesn't look like an ID or a token */
+function setting(key) {
+    const run = (cmd, args) => execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 });
+    try {
+        const value = process.platform === "darwin" ? run("defaults", ["read", "com.windscribe.Windscribe2", key])
+            : process.platform === "win32" ? run("reg", ["query", "HKCU\\Software\\Windscribe\\Windscribe2", "/v", key]).match(/REG_SZ\s+(.*)/)?.[1]
+                : iniValue(readFileSync(SETTINGS, "utf8"), key);
+        return value?.trim().match(/^[\w:.+/=-]+$/)?.[0] ?? "";
+    }
+    catch {
+        return ""; // no such setting, or no settings
+    }
+}
+/** The session this computer's app is logged in with; null when its settings don't have one */
+export function session() {
+    const authHash = setting("authHash");
+    return authHash ? { userId: setting("userId"), authHash } : null;
+}
 export const isFirewallOn = (status) => /^Firewall state: On/m.test(status);
 let firewallChanged = false; // blockInternet() turned the firewall on, so restoreFirewall() turns it back off
 /** Turns on the app's firewall, so nothing goes online outside the VPN. False if it was on already (it then stays on) */

package/dist/worker.js

@@ -1,13 +1,14 @@
 // windscout --worker: runs in a parallel scan's docker container (docker.ts), beside the container's own Windscribe app.
 // Takes the host's messages from stdin and answers on stdout, a JSON object per line.
 import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 import { probe } from "./probe.js";
-import { sleep } from "./time.js";
-import { CLI, windscribe } from "./windscribe.js";
+import { now, sleep } from "./time.js";
+import { SETTINGS, windscribe, withSession } from "./windscribe.js";
+const APP = "/opt/windscribe/Windscribe"; // as the image installs it
 const send = (m) => process.stdout.write(JSON.stringify(m) + "\n");
-// the CLI mixes JSON log lines into its output
-const text = (s) => s.split("\n").filter((l) => !l.startsWith('{"tm"')).join("\n").trim();
 export async function worker() {
     const inbox = [];
     let wake = () => { }, closed = false, stop = false;
@@ -26,21 +27,27 @@ export async function worker() {
             await new Promise((resolve) => (wake = resolve));
         return inbox.shift() ?? null;
     };
-    // the app starts beside us (the image's CMD); its CLI answers once it's up
+    // The app logs in with this computer's session, which goes in its settings before it starts: no login of its own, since
+    // Windscribe locks an account that logs in many times at once. Never log out here: that would end this computer's session too
+    const session = (await next())?.session;
+    if (!session)
+        return;
+    let ini = "";
+    try {
+        ini = readFileSync(SETTINGS, "utf8");
+    }
+    catch { } // a new volume: no settings yet
+    mkdirSync(dirname(SETTINGS), { recursive: true });
+    writeFileSync(SETTINGS, withSession(ini, session));
+    // no systemd in a container: start the app like its unit would, as this user (its CLI refuses root)
+    spawn(APP, { stdio: "ignore" }).on("error", () => { }); // not there: its CLI never answers below
+    // its CLI answers once it's up, and says logged in once Windscribe accepts the session, or the error it got instead
     let status = "";
-    for (let i = 0; i < 60 && !(status = await windscribe("status")).includes("Login state"); i++)
+    for (const t = now(); now() - t < 120 && !/Login state: (Logged in|Error)/.test(status = await windscribe("status"));)
         await sleep(1000);
-    if (!status.includes("Login state"))
-        return void console.error("Windscribe's app didn't start in the container");
     if (!status.includes("Logged in")) {
-        for (let error = "";;) {
-            send({ need: "login", text: error });
-            const m = await next();
-            if (!m?.login)
-                return; // no credentials for us: this container sits out the scan
-            if (!(error = await login(m.login.username, m.login.password, next)))
-                break;
-        }
+        const state = status.match(/^Login state: (.*)$/m)?.[1].trim();
+        return void console.error(state ? `Windscribe's app didn't log in with this computer's session (${state})` : "Windscribe's app didn't start in the container");
     }
     send({ ready: true, wireguard: process.env.WS_WIREGUARD !== "0" }); // the image's CMD checked the kernel
     for (let m; (m = await next());) {
@@ -66,27 +73,3 @@ export async function worker() {
         send({ result });
     }
 }
-/** windscribe-cli login, with the password on its stdin; what it asks next (a 2FA code, a captcha) goes to the host.
- * "" once logged in, else why not */
-function login(username, password, next) {
-    return new Promise((resolve) => {
-        const p = spawn(CLI, ["login", username], { stdio: ["pipe", "pipe", "ignore"] });
-        p.stdin.on("error", () => { });
-        p.stdin.write(password + "\n");
-        let out = "";
-        p.stdout.on("data", async (d) => {
-            out += d;
-            const asked = text(out);
-            // a question ends the output, with no newline after it: "2FA code:", or under a captcha "…to continue:"
-            if (!asked.endsWith(":"))
-                return;
-            out = "";
-            if (asked.endsWith("Password:"))
-                return; // answered already
-            send({ need: "input", text: asked });
-            p.stdin.write(((await next())?.input ?? "") + "\n");
-        });
-        // it exits 0 whether that worked or not: ask the app
-        p.on("close", async () => resolve((await windscribe("status")).includes("Logged in") ? "" : text(out).split("\n").at(-1) || "login failed"));
-    });
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windscout",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Find which Windscribe locations and protocols work from your network, ranked by speed (unofficial)",
   "type": "module",
   "bin": {