windscout 0.6.0 → 0.6.4

package/README.md

@@ -1,8 +1,8 @@
 # WindScout
 
-Find which Windscribe locations and protocols actually work from your network, ranked by speed. Runs on Linux, macOS and Windows.
+Find which Windscribe locations and protocols actually work from your network, ranked by latency. Runs on Linux, macOS and Windows.
 
-WindScout drives the official `windscribe-cli`: it connects to each country × protocol pair, measures latency and download speed through the tunnel, disconnects, and prints a ranked table.
+WindScout drives the official `windscribe-cli`: it connects to each country × protocol pair, measures latency through the tunnel, disconnects, and prints a ranked table.
 
 ![WindScout picking countries, scanning, and printing the availability grid and ranked results](demo.gif)
 
@@ -30,7 +30,7 @@ Run `windscout` with no arguments to open the interactive picker:
 ```
 ╭─ WindScout ──────────────────────────────────── 2/68 selected ─╮
 │ 1 ● wireguard   2 ● stealth   3 ○ wstunnel   4 ● udp   5 ● tcp │
-│ s ○ speed test  off: connect-only, ranks by latency            │
+│ p ○ all ports  off: each protocol on its default port          │
 ╰────────────────────────────────────────────────────────────────╯
 ╭────────────────────────────────────────────────────────────────╮
 │ 🔍 an▏                                              1–16 of 18 │
@@ -51,7 +51,7 @@ Run `windscout` with no arguments to open the interactive picker:
 | `/` | search by country name or code (enter/esc to finish, esc again to clear) |
 | `a` / `n` | select all / unselect all (only the matching countries while a search is active) |
 | `1`–`6` | toggle a protocol (`1`–`5` on Linux, which has no IKEv2) |
-| `s` | toggle the speed test (off = connect-only mode) |
+| `p` | toggle [all ports](#all-ports): each protocol on every port it has, not just its default |
 | `f` | toggle "block internet while scanning" (firewall) |
 | `r` | toggle random order: scan the selected countries shuffled, a new order each run |
 | `d` | toggle the [parallel scan in docker containers](#parallel-scan-with-docker) (installs or starts docker first, after asking) |
@@ -59,11 +59,11 @@ Run `windscout` with no arguments to open the interactive picker:
 | `enter` | start scanning |
 | `q` | quit (during a scan: stop and show partial results; press again to force quit) |
 
-**Mouse:** click a country to select or unselect it, click a protocol or the speed-test line to toggle it, click the search box to start typing (click anywhere else to leave it), and scroll the list with the wheel. The `[ ▶ Start ]  [ All ]  [ None ]  [ Quit ]` buttons under the table do the same as their keys; the shortcut key is underlined on screen (on the buttons, the protocol numbers and `s`). This needs a terminal with mouse support, which most have. On Windows, use Windows Terminal; if clicks do nothing there, the keyboard does everything.
+**Mouse:** click a country to select or unselect it, click a protocol or a setting's line to toggle it, click the search box to start typing (click anywhere else to leave it), and scroll the list with the wheel. The `[ ▶ Start ]  [ All ]  [ None ]  [ Quit ]` buttons under the table do the same as their keys; the shortcut key is underlined on screen (on the buttons, the protocol numbers and the settings' letters). This needs a terminal with mouse support, which most have. On Windows, use Windows Terminal; if clicks do nothing there, the keyboard does everything.
 
 Your selection is saved to `~/.config/windscout/config.json` (`%USERPROFILE%\.config\windscout\config.json` on Windows) and preselected next time.
 
-While scanning, WindScout shows a progress bar, elapsed time and remaining time. It also shows what it's doing right now (connecting, measuring latency or measuring speed). The table of working locations refreshes after each country. When the scan finishes, the final report is printed to your normal terminal. It ends with the best connection and the other working ones, each with its `windscribe-cli connect` command. At the prompt, press enter to connect to the best one, type another one's number to connect to that, or `q` to quit.
+While scanning, WindScout shows a progress bar, elapsed time and remaining time. It also shows what it's doing right now (connecting or measuring latency). The table of working locations refreshes after each country. When the scan finishes, the final report is printed to your normal terminal. It ends with the best connection and the other working ones, each with its `windscribe-cli connect` command. At the prompt, press enter to connect to the best one, type another one's number to connect to that, or `q` to quit.
 
 ### Non-interactive
 
@@ -72,6 +72,7 @@ Pass `-c` to skip the picker, for scripts or when there is no terminal:
 ```sh
 windscout -c DE,NL,TR -p stealth,tcp:443    # chosen countries and protocols (port optional)
 windscout -c Frankfurt,Wurstchen            # cities or datacenter nicknames work too
+windscout -c DE -p stealth,tcp -P           # every port of stealth and tcp
 windscout -t 40 -a                          # longer connect timeout, also list failed attempts
 ```
 
@@ -79,19 +80,17 @@ windscout -t 40 -a                          # longer connect timeout, also list
 |---|---|---|
 | `-c, --countries` | comma-separated ISO country codes, city names or nicknames | open the picker |
 | `-p, --protocols` | comma-separated: `wireguard`, `ikev2` (macOS and Windows), `stealth`, `wstunnel`, `udp`, `tcp`, optionally `:port` | saved, or all |
+| `-P, --all-ports` | try each protocol on [every port](#all-ports) Windscribe offers for it, not just its default | picker: saved, or off; with `-c`: off |
 | `-t, --timeout` | seconds to wait for each connection, at least 10 | picker: saved, or 15; with `-c`: 15 |
 | `-a, --all` | include failed attempts in the final table | off |
-| `-n, --no-speed` | connect-only mode: skip the download test, rank by latency | picker: saved, or connect-only on first run; with `-c`: speed test on |
 | `-f, --firewall` | block internet while scanning, except through the VPN | picker: saved, or off; with `-c`: off |
 | `-r, --random` | scan the countries in a random order | picker: saved, or off; with `-c`: off |
 | `-d, --docker` | [scan in parallel, in docker containers](#parallel-scan-with-docker) | picker: saved, or off; with `-c`: off |
 | `-v, --version` | print the installed version; if a newer one is on npm, show the update command (with `sudo` when needed) and ask (y/n) to run it | |
 
-## Connect-only mode
+## Availability grid
 
-Often you only need to know **what connects**, not how fast it is. Turn the speed test off with `s` in the picker or with `--no-speed`. Each working connection is then checked with a quick latency test only. That saves about 15 s per working connection, and results are ranked by latency. Connect-only is the default on the first run, and the choice is remembered.
-
-Both modes show an **availability grid**: one row per country, and ✓ / ✗ for each protocol (`·` = not tried yet). Location(s) lists each datacenter that connected, one per line, since protocols can land on different ones:
+Each working connection gets a quick latency test, and the working ones are ranked by latency. The scan screen and the final report show an **availability grid**: one row per country, and ✓ / ✗ for each protocol (`·` = not tried yet; `key limit`, in a [parallel scan](#parallel-scan-with-docker): WireGuard couldn't be tried). With [all ports](#all-ports), it counts how many of a protocol's ports worked: `✓ 3/11`. Location(s) lists each datacenter that connected, one per line, since protocols can land on different ones:
 
 ```
 ╭──────────────────────────────────────────────────────────────────────────────╮
@@ -106,7 +105,25 @@ Both modes show an **availability grid**: one row per country, and ✓ / ✗ for
 ╰─────────────────────────┴────────────────────────┴─────────┴───────────┴─────╯
 ```
 
-While scanning, press `tab` to switch between the availability grid and the speed or latency ranking. Press `p` (or `space`) to pause: the current attempt finishes, the VPN disconnects, and the scan waits until you press `p` again. Paused time doesn't count toward elapsed or remaining. In connect-only mode the scan starts on the availability grid.
+While scanning, press `tab` to switch between the availability grid and the latency ranking. Press `p` (or `space`) to pause: the current attempt finishes, the VPN disconnects, and the scan waits until you press `p` again. Paused time doesn't count toward elapsed or remaining. The scan starts on the availability grid.
+
+## All ports
+
+Each protocol is normally tried on its default port, the first one Windscribe lists for it. A network can block a protocol on one port and let it through on another, so turn on **all ports** with `p` in the picker or `-P` (`--all-ports`): each selected protocol is then tried on every port Windscribe offers for it. WindScout asks your Windscribe app for the ports (`windscribe-cli ports tcp`), so the list follows Windscribe's. In October 2026 it was:
+
+| Protocol | Ports | Attempts per country |
+|---|---|---|
+| wireguard | 443, 80, 53, 123, 1194, 65142 | 6 |
+| stealth | 443, 587, 21, 22, 80, 123, 143, 3306, 8080, 54783, 8443 | 11 |
+| wstunnel | 443 | 1 |
+| udp | 443, 80, 53, 123, 1194, 54783 | 6 |
+| tcp | 443, 587, 21, 22, 80, 123, 143, 3306, 8080, 54783, 1194 | 11 |
+
+With every protocol selected, that's 35 attempts per country instead of 5, 7 times as many (on macOS and Windows, IKEv2 adds its own ports). The picker shows the count (`35 attempts per country, not 5`) and the estimate: one country takes about 11m 40s instead of 1m 40s in a normal scan, and about 2 minutes in a [parallel scan](#parallel-scan-with-docker), which helps most here. To try fewer, select only the protocols you need, or give a port yourself: a protocol with a port (`-p tcp:443`) stays on that one.
+
+The availability grid keeps one column per protocol and counts how many of its ports worked (`✓ 3/11`, or `✗ 0/11` when none did). The results list each working protocol with its port, and the per-protocol table has a line per port.
+
+When the app making an attempt doesn't offer a port, Windscribe quietly connects on the protocol's default port instead. That can happen in a parallel scan, where each container runs its own copy of the app, which can be older or newer than yours. WindScout checks the port it actually connected on and shows those attempts as `no port` (in yellow), rather than as results for a port that wasn't tried. Listing ports needs Windscribe 2.22 or newer. With an older app, all ports changes nothing, and the picker says so.
 
 ## Block internet while scanning (firewall)
 
@@ -116,7 +133,7 @@ Between attempts the VPN is disconnected for a moment, and apps on your computer
 
 A normal scan tries one location at a time, because your computer has one VPN connection. Turn on **parallel scan** with `d` in the picker or `--docker`, and each attempt runs in its own docker container instead. Each container has its own Windscribe app (Windscribe's Linux CLI app) and so its own VPN connection, and several locations are tried at once. The results come back to the scan screen, which shows a line per container.
 
-**How many containers:** one per attempt, as many as docker's CPUs allow and three quarters of its memory (at 250 MB each), at most 8. The picker shows the number (`8 at a time`) and the estimate that goes with it.
+**How many containers:** one per attempt, so 1 country with 5 protocols starts 5. Docker's CPUs, three quarters of its memory (at 250 MB each) and a maximum of 16 limit that. With more attempts than that, WindScout starts the fewest containers that need no more rounds: 17 attempts get 9 containers with 2 attempts each, the same 2 rounds that 16 containers would take. Fewer containers log in sooner (in a test, 1 took 37 s, and 16 together up to 75 s) and register fewer WireGuard keys. The picker shows the number (`9 at a time`) and the estimate that goes with it, which includes the time the containers take to log in before the scan starts (`+ ~58s login`: about 35 s, plus 2.5 s per container).
 
 **First time:** if docker isn't installed or isn't running, `d` (or a scan with `--docker`) opens a dialog that says what WindScout will do, and does it once you agree:
 
@@ -140,11 +157,13 @@ The mirrors come from [Mirava](https://github.com/MiravaOrg/Mirava)'s list of mi
 
 **Kernel check:** each container first checks that docker's Linux kernel gives it what Windscribe needs: a tunnel device (tun) and a firewall (nftables). If not, the scan stops and says so, rather than showing every location as blocked. Windscribe's WireGuard also needs nftables' `fib` in its firewall table, which Docker Desktop's own Linux VM lacks (on macOS, and on Windows without WSL 2). There, WireGuard runs on this computer instead (see below).
 
-**Login:** each container's Windscribe app logs in once. WindScout asks for your Windscribe username and password (and a 2FA code or captcha when Windscribe asks for one) and passes them to the containers, one at a time. Each login is kept in that container's docker volume (`windscout-1`, `windscout-2`, …), so later scans don't ask.
+**Login:** the containers' Windscribe apps log in with the session that the Windscribe app on this computer is logged in with, so they never log in with your password. Windscribe locks an account that logs in many times at once, and a login per container would do that. WindScout reads the session from the app's settings (`~/.config/Windscribe/Windscribe2.conf` on Linux, the `com.windscribe.Windscribe2` defaults on macOS, `HKEY_CURRENT_USER\Software\Windscribe\Windscribe2` in the registry on Windows) and hands it to each container on its standard input, not on a command line, where other programs could see it. Each container's docker volume (`windscout-1`, `windscout-2`, …) keeps its app's settings for the next scans, with the WireGuard keys it registered with your account. A volume that another account used starts over. If you log out of the Windscribe app, the containers' session ends too, and the next scan gives them the new one.
+
+**WireGuard keys:** each container's app registers a WireGuard key of its own with your account the first time it uses WireGuard, and keeps it in its volume for later scans. Windscribe allows each account only so many keys. A container past that limit can't try WireGuard, which says nothing about your network, so the grid shows `key limit` (in yellow) instead of ✗, and those attempts don't count in the report's per-protocol numbers. Under the grid, the report says how many there were and gives the command that tries them on this computer, which has a key of its own: `windscout -c "DE,NL" -p wireguard`.
 
-**Remember username and password** is ticked to start with (tab to it and press space, or click it). Once the login works, WindScout saves both in `~/.config/windscout/login.json`, as plain text that only you can read. Then containers that are new next time (a scan with more attempts) log in by themselves, with no terminal too; a 2FA code is never saved, so with 2FA they still ask. Untick it and nothing is saved, and a login saved before is forgotten. Deleting that file forgets it too. With `-c` and no terminal, only containers that are logged in already, or can log in with the remembered login, take part.
+WindScout 0.6.0 asked for your username and password instead, and could save them in `~/.config/windscout/login.json`. WindScout now deletes that file.
 
-**Measuring:** the containers share your internet connection, so they take turns measuring latency and speed while the connecting happens in parallel. Numbers stay comparable with a normal scan. Most of the time saved comes from attempts that hang until the timeout, which overlap now.
+**Measuring:** the containers share your internet connection, so they take turns measuring latency while the connecting happens in parallel. Numbers stay comparable with a normal scan. Most of the time saved comes from attempts that hang until the timeout, which overlap now.
 
 **Differences from a normal scan:**
 
@@ -152,7 +171,7 @@ The mirrors come from [Mirava](https://github.com/MiravaOrg/Mirava)'s list of mi
 - This computer's own Windscribe connection is disconnected at the start and stays off while the containers scan, since it would carry their traffic too.
 - No firewall: "block internet while scanning" isn't used, since it would block the containers' traffic too.
 
-The containers are removed after the scan. To remove the logins too, run `docker volume rm windscout-1 windscout-2 …`. To remove the image, run `docker rmi windscout-worker`.
+The containers are removed after the scan. To remove their settings too (and the session in them), run `docker volume rm windscout-1 windscout-2 …`. To remove the image, run `docker rmi windscout-worker`.
 
 ## Output
 
@@ -164,23 +183,23 @@ While scanning:
 │  ██████████████████████████████████████████▌░░░░░░░░░░░░░░░░   72%   │
 │                                                                      │
 │  ⠏ 🇳🇱 Netherlands · stealth                                          │
-│    measuring speed · Amsterdam - Tulip · 3s                          │
+│    measuring latency · Amsterdam - Tulip · 1s                        │
 ├──────────────────────────────────────────────────────────────────────┤
 │  elapsed 25s   │   remaining ≈ 13s   │   ✓ 2 working   │   ✗ 1 blocked │
 ╰──────────────────────────────────────────────────────────────────────╯
 ╭──────────────────────────────────────────────────────────────────────╮
 │ Working so far                                               2 found │
 ├───┬────────────┬───────────────────────┬───────────┬───────────┬─────┤
-│ # │ Country    │ Location              │ Protocol  │     Speed │ ... │
+│ # │ Country    │ Location              │ Protocol  │   Latency │ ... │
 ```
 
 At the end, the results, a per-protocol summary and the best pick are printed to your normal terminal:
 
 ```
-╭─ ★ Best ─────────────────────────────────────────────────╮
-│ 🇳🇱 Amsterdam - Tulip over wireguard · 27.0 Mbps · 109 ms │
-│ windscribe-cli connect "Tulip" wireguard                 │
-╰──────────────────────────────────────────────────────────╯
+╭─ ★ Best (lowest latency) ────────────────────╮
+│ 🇳🇱 Amsterdam - Tulip over wireguard · 109 ms │
+│ windscribe-cli connect "Tulip" wireguard     │
+╰──────────────────────────────────────────────╯
 ```
 
 ## Notes

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 // WindScout: find which Windscribe locations and protocols actually work from here.
 // Drives the official windscribe-cli: connects to each country/protocol pair,
-// measures latency and download speed through the tunnel, prints a ranked table.
+// measures latency through the tunnel, prints a ranked table.
 import { createInterface } from "node:readline";
 import { spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
-import { CONFIG, DEFAULT_TIMEOUT, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard } from "./config.js";
+import { CONFIG, DEFAULT_TIMEOUT, forgetLogin, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard, SPEED_TEST } from "./config.js";
 import { notInContainers, stopWorkers } from "./docker.js";
 import { probe } from "./probe.js";
 import { Scan } from "./scan.js";
@@ -17,27 +17,28 @@ import { leaveScreen, out } from "./tui/terminal.js";
 import { cyan, green, yellow } from "./tui/text.js";
 import { now, sleep } from "./time.js";
 import { canUpdate, checkUpdate, runUpdate, updateNotice, versionLines } from "./update.js";
-import { blockInternet, CLI, connectState, isFirewallOn, PROTOCOLS, restoreFirewall, waitForLogin, windscribe } from "./windscribe.js";
+import { blockInternet, CLI, connectState, isFirewallOn, protocolPorts, PROTOCOLS, restoreFirewall, waitForLogin, windscribe, withPorts } from "./windscribe.js";
 import { worker } from "./worker.js";
 const HELP = `Usage: windscout [options]
 
-Find which Windscribe locations and protocols work from your network, ranked by speed.
+Find which Windscribe locations and protocols work from your network, ranked by ${SPEED_TEST ? "speed" : "latency"}.
 Without -c it opens an interactive country picker (your selection is remembered).
 
 Options:
   -c, --countries LIST  comma-separated ISO codes, city names or nicknames (skips the picker)
   -p, --protocols LIST  comma-separated protocols, optional :port (default: ${PROTOCOLS.join(",")})
+  -P, --all-ports       try each protocol on every port Windscribe offers for it, not just its default
   -t, --timeout SEC     seconds to wait for each connection, at least ${MIN_TIMEOUT} (default: saved, or ${DEFAULT_TIMEOUT})
   -a, --all             also show failed attempts in the final table
-  -n, --no-speed        connect-only: skip the download test, rank by latency (faster scan)
-  -f, --firewall        block internet while scanning, except through the VPN (turned back off afterwards)
+${SPEED_TEST ? "  -n, --no-speed        connect-only: skip the download test, rank by latency (faster scan)\n" : ""}  -f, --firewall        block internet while scanning, except through the VPN (turned back off afterwards)
   -r, --random          scan the countries in a random order
-  -d, --docker          scan in parallel, in docker containers (as many as docker's CPUs and memory allow, up to 8)
+  -d, --docker          scan in parallel, in docker containers (one per attempt, up to 16, as docker's CPUs and memory allow)
   -v, --version         show the installed version (and offer to update if a newer one is out)
   -h, --help            show this help
 
 Selection is stored in ${CONFIG}
-Example: windscout -c DE,NL,TR -p stealth,tcp:443`;
+Examples: windscout -c DE,NL,TR -p stealth,tcp:443
+          windscout -c DE -p stealth,tcp -P`;
 // "DE, NL,,TR" → ["DE", "NL", "TR"]
 const list = (s) => s.split(",").map((x) => x.trim()).filter(Boolean);
 const ask = (question) => new Promise((resolve) => {
@@ -83,11 +84,12 @@ async function main() {
         options: {
             countries: { type: "string", short: "c" },
             protocols: { type: "string", short: "p" },
+            "all-ports": { type: "boolean", short: "P", default: false },
             timeout: { type: "string", short: "t" },
             all: { type: "boolean", short: "a", default: false },
             help: { type: "boolean", short: "h", default: false },
             version: { type: "boolean", short: "v", default: false },
-            "no-speed": { type: "boolean", short: "n", default: false },
+            "no-speed": { type: "boolean", short: "n", default: false }, // still accepted while the speed test is hidden
             firewall: { type: "boolean", short: "f", default: false },
             random: { type: "boolean", short: "r", default: false },
             docker: { type: "boolean", short: "d", default: false },
@@ -96,8 +98,9 @@ async function main() {
     });
     if (a.worker) {
         await worker();
-        process.exit(); // its stdin may still be open: it has no login to scan with
+        process.exit(); // its stdin may still be open: its app didn't log in
     }
+    forgetLogin();
     if (a.help)
         return console.log(HELP);
     checkUpdate(); // runs while the app starts and the user picks, before the VPN starts switching
@@ -115,9 +118,10 @@ async function main() {
     const tty = Boolean(process.stdin.isTTY && out.isTTY);
     let countries = a.countries ? list(a.countries) : undefined;
     let protocols = a.protocols ? list(a.protocols) : undefined;
-    let speedTest = !a["no-speed"];
+    let speedTest = SPEED_TEST && !a["no-speed"];
     let firewall = a.firewall;
     let random = a.random;
+    let allPorts = a["all-ports"];
     let docker = a.docker;
     if (!countries) {
         if (!tty)
@@ -131,6 +135,7 @@ async function main() {
             // already on in the app: show it on, since the scan won't turn it off
             firewall: firewall || isFirewallOn(status) || (saved?.firewall ?? false),
             random: random || (saved?.random ?? false),
+            allPorts: allPorts || (saved?.allPorts ?? false),
             docker: docker || (saved?.docker ?? false),
         });
         if (!choice)
@@ -142,11 +147,18 @@ async function main() {
         speedTest = choice.speed;
         firewall = choice.firewall;
         random = choice.random;
+        allPorts = choice.allPorts;
         timeout = choice.timeout;
         docker = choice.docker;
     }
     protocols ??= PROTOCOLS;
     timeout ??= DEFAULT_TIMEOUT;
+    // the picker asked for the ports already: waiting for that keeps windscribe-cli free for the scan
+    if (allPorts || !a.countries) {
+        const lists = await protocolPorts();
+        if (allPorts)
+            protocols = withPorts(protocols, lists);
+    }
     if (random)
         countries = countries.map((c) => [Math.random(), c]).sort(([x], [y]) => x - y).map(([, c]) => c);
     let probers = [probe], after; // after: what runs here once the containers are done

package/dist/config.js

@@ -1,13 +1,13 @@
-// The picker's selection, and the docker containers' Windscribe login if wanted, remembered between runs.
+// The picker's selection, and what the last parallel scan found its containers can do, remembered between runs.
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { COUNTRIES, PROTOCOLS } from "./windscribe.js";
+// The speed test is hidden: every scan is connect-only, and a saved "on" reads as off. Its code stays; true brings it back
+export const SPEED_TEST = false;
 export const DEFAULT_TIMEOUT = 15;
 export const MIN_TIMEOUT = 10; // seconds; shorter cuts off connections that would have worked
 export const CONFIG = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "windscout", "config.json");
-// ponytail: plain text that only this user can read, like git's credential store; the OS keychain if that's not enough
-export const LOGIN_FILE = join(dirname(CONFIG), "login.json");
 const DOCKER_FILE = join(dirname(CONFIG), "docker.json"); // what the last parallel scan found its containers can do
 /** The saved choice, minus anything this version doesn't offer; null on first run or an unreadable file */
 export function loadConfig() {
@@ -16,9 +16,10 @@ export function loadConfig() {
         return {
             countries: (c.countries ?? []).filter((x) => COUNTRIES.includes(x)),
             protocols: (c.protocols ?? []).filter((x) => PROTOCOLS.includes(x)),
-            speed: c.speed !== false,
+            speed: SPEED_TEST && c.speed !== false,
             firewall: c.firewall === true,
             random: c.random === true,
+            allPorts: c.allPorts === true,
             timeout: c.timeout >= MIN_TIMEOUT ? c.timeout : DEFAULT_TIMEOUT,
             docker: c.docker === true,
         };
@@ -50,24 +51,10 @@ export function saveDockerWireGuard(wireguard) {
     }
     catch { } // not being able to remember isn't worth failing the scan
 }
-/** The Windscribe login remembered for the docker containers; null when there's none */
-export function loadLogin() {
+/** Deletes the Windscribe username and password that 0.6.0 saved for the docker containers: they log in with this computer's session now */
+export function forgetLogin() {
     try {
-        const { username, password } = JSON.parse(readFileSync(LOGIN_FILE, "utf8"));
-        return typeof username === "string" && typeof password === "string" ? { username, password } : null;
+        rmSync(join(dirname(CONFIG), "login.json"), { force: true });
     }
-    catch {
-        return null;
-    }
-}
-/** Remembers the login, or forgets it (null) */
-export function saveLogin(c) {
-    try {
-        rmSync(LOGIN_FILE, { force: true }); // a new file gets the mode below; an old one would keep its own
-        if (!c)
-            return;
-        mkdirSync(dirname(LOGIN_FILE), { recursive: true });
-        writeFileSync(LOGIN_FILE, JSON.stringify(c) + "\n", { mode: 0o600 });
-    }
-    catch { } // not being able to remember isn't worth failing the scan
+    catch { } // not being able to delete it isn't worth failing the scan
 }

package/dist/docker.js

@@ -1,4 +1,5 @@
 // Parallel scans: a docker container per slot, each with its own Windscribe app, so each has its own tunnel.
+// The apps log in with the session this computer's app is logged in with.
 // A container runs `windscout --worker` (worker.ts) and takes attempts from here one at a time:
 // a JSON object per line on its stdin, answered the same way on its stdout.
 import { spawn, spawnSync } from "node:child_process";
@@ -29,7 +30,7 @@ const REGISTRIES = [...(process.env.WINDSCOUT_REGISTRY_MIRRORS?.split(",").map((
 // The CMD first checks the kernel (WSL's builds tun and parts of nftables as modules): no tun or nftables, no tunnel, so
 // the container stops saying so instead of scanning. The helper's WireGuard routing also puts a fib rule in an inet table,
 // which Docker Desktop's own kernel (macOS, Windows without WSL) can't run: WS_WIREGUARD=0 then, and it runs on this computer.
-// No systemd in a container: start the helper (root) and the app (as a user: its CLI refuses root) like their units would
+// No systemd in a container: start the helper (root) like its unit would; the worker starts the app once it has the session
 const DOCKERFILE = `FROM ${BASE_TAG}
 ENV LANG=C.UTF-8
 RUN for m in deb.debian.org mirror.shatel.ir mirror.iranserver.com mirror.mobinhost.com mirror2.chabokan.net; do \\
@@ -51,7 +52,6 @@ CMD mkdir -p /dev/net && { [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200; }
   nft 'add table inet wscheck; add chain inet wscheck p { type filter hook prerouting priority 0; }; add rule inet wscheck p fib saddr type != local drop; delete table inet wscheck' 2>/dev/null \\
   && wg=1 || wg=0; \\
   /opt/windscribe/helper >/dev/null 2>&1 & \\
-  runuser -u ws -- env HOME=/home/ws /opt/windscribe/Windscribe >/dev/null 2>&1 & \\
   exec runuser -u ws -- env HOME=/home/ws WS_WIREGUARD=$wg node /app/dist/cli.js --worker
 `;
 const user = userInfo().username;
@@ -105,12 +105,18 @@ export async function dockerState() {
     return "ready";
 }
 const WORKER_MEMORY = 250e6; // bytes per container: Windscribe's app and helper, a tunnel and node take ~120 MB
-const MAX_WORKERS = 8; // ponytail: past this, more containers mostly add logins and load on the one uplink; raise if real scans say so
+// ponytail: past this, more containers mostly add load on the one uplink, and WireGuard keys on the account; raise if real scans say so
+const MAX_WORKERS = 16;
 /** Protocols the containers can't do, which a parallel scan runs on this computer after them: IKEv2 (Windscribe's Linux app
  * has none), and WireGuard when their kernel can't run its routing (see DOCKERFILE) */
-export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => p === "ikev2" || (p === "wireguard" && !wireguard)));
-/** Containers for a scan of this many attempts: one per attempt, within docker's CPUs and 3/4 of its memory */
-export const workerCount = (attempts) => Math.max(1, Math.min(attempts, MAX_WORKERS, info.cpus, Math.floor((info.memory * 0.75) / WORKER_MEMORY)));
+export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => /^ikev2(:|$)/.test(p) || (!wireguard && /^wireguard(:|$)/.test(p))));
+/** Containers for this many attempts, when docker can run at most `most`: one per attempt; past that, the fewest that need no
+ * more rounds (17 attempts, 16 at most: 9 containers make 2 rounds, as 16 would), since fewer log in sooner and register fewer keys */
+export const containersFor = (attempts, most) => attempts <= most ? Math.max(1, attempts) : Math.ceil(attempts / Math.ceil(attempts / most));
+// ponytail: rough seconds until n containers are logged in: in a test, 1 took 37 s, 16 at once 38-75 s; refine from real runs
+export const loginSeconds = (containers) => 35 + 2.5 * containers;
+/** Containers for a scan of this many attempts, within docker's CPUs and 3/4 of its memory */
+export const workerCount = (attempts) => containersFor(attempts, Math.max(1, Math.min(MAX_WORKERS, info.cpus, Math.floor((info.memory * 0.75) / WORKER_MEMORY))));
 const DMG = `https://desktop.docker.com/mac/main/${process.arch === "arm64" ? "arm64" : "amd64"}/Docker.dmg`;
 const START_DESKTOP = process.platform === "win32"
     ? { label: "start Docker Desktop", cmd: () => `start "" "${DESKTOP}"` }
@@ -243,27 +249,22 @@ const running = new Map(); // container name → its `docker run`, until the con
 // a crash or a force quit leaves them running: remove them
 const removeAll = () => running.size && spawnSync("docker", ["rm", "-f", ...running.keys()], { stdio: "ignore" });
 process.on("exit", removeAll);
-/** Starts n containers and logs them in to Windscribe, one at a time; resolves to a prober for each container that got ready,
- * and whether WireGuard works in them */
-export async function startWorkers(n, prompt, onStatus) {
-    const measuring = mutex(), loggingIn = mutex();
+/** Starts n containers, their apps logged in with this computer's session; resolves to a prober for each container that got
+ * ready, and whether WireGuard works in them */
+export async function startWorkers(n, session, onStatus) {
+    const measuring = mutex();
     let wireguard = true;
-    let creds; // undefined: not asked yet; null: the user cancelled
     let ready = 0;
-    const credentials = async (error) => {
-        if (creds !== null && (error || !creds))
-            creds = await prompt.credentials(error);
-        return creds;
-    };
     const start = (i) => new Promise((resolve) => {
         const name = `windscout-${process.pid}-${i + 1}`;
-        // its own volume keeps its Windscribe login for the next scans
+        // its own volume keeps its app's settings for the next scans: its WireGuard keys, registered with Windscribe once
         // it makes /dev/net/tun itself: Docker's Linux VM may have none (WSL loads tun as a module), and --device needs one there
         const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
             "--sysctl", "net.ipv4.conf.all.src_valid_mark=1", "-v", `windscout-${i + 1}:/home/ws/.config/Windscribe`, IMAGE], { detached: process.platform !== "win32" }); // its own process group, so ctrl-c reaches only us (Windows would open a window)
         running.set(name, p);
         const send = (m) => p.stdin.write(JSON.stringify(m) + "\n");
         p.stdin.on("error", () => { }); // it stopped: "close" deals with that
+        send({ session }); // on stdin, not in the command line or the environment, where ps and docker inspect show it
         let on = (_) => { }; // the current phase's message handler
         let fail = (_) => { }; // and what it does when the container stops
         let dead = "", err = "";
@@ -312,28 +313,14 @@ export async function startWorkers(n, prompt, onStatus) {
             };
             send({ probe: { query, protocol, timeout, speedTest } });
         });
-        let leave = null, used = null, unused = false; // the login lock while logging in; with what; or no login for it
-        fail = (why) => (leave?.(), unused || onStatus(`container ${i + 1}: ${why}`), resolve(null));
-        on = async (m) => {
-            if (m.need === "login") {
-                leave ??= await loggingIn();
-                const c = await credentials(m.text ?? "");
-                if (c)
-                    (used = c), send({ login: c });
-                else
-                    (unused = true), p.stdin.end(); // none: the worker gives up, its container stops
-            }
-            else if (m.need === "input")
-                send({ input: (await prompt.answer(m.text ?? "")) ?? "" });
-            else if (m.ready) {
-                leave?.();
-                if (used)
-                    prompt.loggedIn(used);
-                wireguard &&= m.wireguard !== false;
-                fail = () => { };
-                onStatus(`${++ready} of ${n} ready`);
-                resolve(prober);
-            }
+        fail = (why) => (onStatus(`container ${i + 1}: ${why}`), resolve(null));
+        on = (m) => {
+            if (!m.ready)
+                return;
+            wireguard &&= m.wireguard !== false;
+            fail = () => { };
+            onStatus(`${++ready} of ${n} ready`);
+            resolve(prober);
         };
     });
     const probers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((p) => p !== null);

package/dist/probe.js

@@ -27,11 +27,18 @@ export async function probe(query, protocol, { timeout, speedTest, stopped = ()
             }
             else if (s.includes("does not exist"))
                 return end("no such location");
+            // Windscribe refused this app another WireGuard key for the account: says nothing about this network
+            else if (s.includes("WireGuard key limit") && now() - t > 3)
+                return end("key limit");
             else if (s === "Disconnected" && now() - t > 3)
                 return end("failed");
             onStep(`connecting ${r.location}`.trim());
             await sleep(1000);
         }
+        // a port the app doesn't offer for the protocol: it connects on the protocol's default instead, so this port wasn't tried
+        const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol: .*:(\d+)\s*$/m)?.[1];
+        if (port && shown && shown !== port)
+            return end("no such port");
         await measure(async () => {
             onStep(`measuring latency · ${r.location}`);
             r.latencyMs = await latencyMs();

package/dist/tui/docker.js

@@ -1,33 +1,17 @@
-// Docker on screen, for parallel scans: dialogs to install or start it (taking the sudo password),
-// progress while the image builds and the containers start, and the Windscribe login the containers need.
-import { homedir } from "node:os";
-import { LOGIN_FILE, loadLogin, saveLogin } from "../config.js";
 import { buildImage, dockerState, INSTALL_DOCS, runSteps, startWorkers, steps, sudoLogin, sudoReady, waitReady, workerCount } from "../docker.js";
 import { duration, now } from "../time.js";
+import { session } from "../windscribe.js";
 import { draw, enterScreen, input, leaveScreen, out } from "./terminal.js";
-import { bold, cyan, dim, green, vw, yellow } from "./text.js";
+import { bold, cyan, dim, vw, yellow } from "./text.js";
 import { box, centerIn } from "./widgets.js";
 const tty = () => Boolean(process.stdin.isTTY && out.isTTY);
 const clip = (s, n = 76) => (s.length > n ? s.slice(0, n - 1) + "…" : s);
 // lines of at most n columns, broken at spaces: an error can be longer than the screen is wide
 const wrap = (s, n = 76) => s.match(new RegExp(`.{1,${n}}(\\s+|$)|\\S+`, "g"))?.map((l) => l.trim()) ?? [s];
-let asking = false; // a dialog waits for the user: progress doesn't draw over it
-function paint({ lines, fields = [], check, buttons, error }, a = { values: [], checked: false, focus: 0 }) {
-    const many = fields.length + (check ? 1 : 0) > 1; // then a ❯ marks where the keys go
-    const mark = (i) => (!many ? "" : i === a.focus ? cyan("❯ ") : "  ");
-    const body = [...lines], items = [];
-    if (fields.length || check)
-        body.push("");
-    fields.forEach((f, i) => {
-        items.push(body.length);
-        body.push(`${mark(i)}${f.label} ${bold(f.secret ? "•".repeat(a.values[i].length) : a.values[i])}${i === a.focus ? cyan("▏") : ""}`);
-    });
-    if (check) {
-        items.push(body.length);
-        body.push(`${mark(fields.length)}${a.checked ? green("[✓]") : dim("[ ]")} ${check.label}`);
-        if (check.note)
-            body.push(dim(`${many ? "  " : ""}    ${check.note}`));
-    }
+function paint({ lines, password, buttons, error }, typed = "") {
+    const body = [...lines];
+    if (password !== undefined)
+        body.push("", `${password} ${bold("•".repeat(typed.length))}${cyan("▏")}`);
     if (error)
         body.push("", yellow(error));
     const width = Math.max(56, ...body.map(vw));
@@ -36,86 +20,53 @@ function paint({ lines, fields = [], check, buttons, error }, a = { values: [],
         const [ok, cancel] = buttons;
         line = `${bold(cyan(`[ ${ok} ]`))}${cancel ? dim(`  [ ${cancel} ]`) : ""}`;
         row = body.length + 1;
-        body.push("", centerIn(line, width), centerIn(dim([many && "tab/↑↓ move", check && "space ticks the box", `enter ${ok.toLowerCase()}`,
-            cancel && `esc ${cancel.toLowerCase()}`].filter(Boolean).join(" · ")), width));
+        body.push("", centerIn(line, width), centerIn(dim([`enter ${ok.toLowerCase()}`, cancel && `esc ${cancel.toLowerCase()}`].filter(Boolean).join(" · ")), width));
     }
     enterScreen();
     const at = draw(box(body, { title: bold(cyan("WindScout · docker")), width }));
-    // a body line sits a row under the box's top border, two columns right of its left one
-    const rows = items.map((i) => at.top + 1 + i);
     if (!buttons)
-        return { rows, buttons: -1, ok: [0, 0], cancel: [0, 0] };
+        return { row: -1, ok: [0, 0], cancel: [0, 0] };
+    // a body line sits a row under the box's top border, two columns right of its left one
     const x = at.left + 2 + Math.floor((width - vw(line)) / 2), okEnd = x + vw(`[ ${buttons[0]} ]`);
-    return { rows, buttons: at.top + 1 + row, ok: [x, okEnd], cancel: buttons[1] ? [okEnd + 2, okEnd + 2 + vw(`[ ${buttons[1]} ]`)] : [0, 0] };
+    return { row: at.top + 1 + row, ok: [x, okEnd], cancel: buttons[1] ? [okEnd + 2, okEnd + 2 + vw(`[ ${buttons[1]} ]`)] : [0, 0] };
 }
-/** Shows the dialog until the user answers: what was typed and ticked on enter (or a click on ok), null on esc.
- * tab, ↑↓ and enter move between the fields; space or a click ticks the checkbox */
-function form(d) {
+/** Shows the dialog until the user answers: what was typed in its field ("" without one) on enter or a click on ok, null on esc */
+function ask(d) {
     if (!tty())
         return Promise.resolve(null);
-    asking = true;
-    const fields = d.fields ?? [];
-    const n = fields.length + (d.check ? 1 : 0);
-    const a = { values: fields.map((f) => f.value ?? ""), checked: d.check?.on ?? false, focus: 0 };
-    let hits = paint(d, a);
-    const redraw = () => (hits = paint(d, a));
+    let typed = "";
+    let hits = paint(d, typed);
+    const redraw = () => (hits = paint(d, typed));
     return new Promise((resolve) => {
         const done = (v) => {
-            asking = false;
             input.off("keypress", onKey);
             input.off("mouse", onMouse);
             out.off("resize", redraw);
             resolve(v);
         };
         const onKey = (str, key = {}) => {
-            const field = a.focus < fields.length;
             if (key.name === "escape" || (key.ctrl && key.name === "c"))
                 return done(null);
-            if (key.name === "return") {
-                if (a.focus >= fields.length - 1)
-                    return done(a);
-                a.focus++; // like a form: on to the next field
-            }
-            else if (n > 1 && (key.name === "tab" || key.name === "down"))
-                a.focus = (a.focus + (key.shift ? n - 1 : 1)) % n;
-            else if (n > 1 && key.name === "up")
-                a.focus = (a.focus + n - 1) % n;
-            else if (!field) {
-                if (key.name === "space")
-                    a.checked = !a.checked;
-            }
-            else if (key.name === "backspace")
-                a.values[a.focus] = a.values[a.focus].slice(0, -1);
-            else if (str && !key.ctrl && !key.meta && str >= " ")
-                a.values[a.focus] += str;
+            if (key.name === "return")
+                return done(typed);
+            if (key.name === "backspace")
+                typed = typed.slice(0, -1);
+            else if (d.password !== undefined && str && !key.ctrl && !key.meta && str >= " ")
+                typed += str;
             redraw();
         };
         const onMouse = (m) => {
-            if (!m.press || m.button !== 0)
-                return;
-            const i = hits.rows.indexOf(m.y);
-            const on = ([from, to]) => m.y === hits.buttons && m.x >= from && m.x < to;
-            if (i >= 0) {
-                a.focus = i;
-                if (i === fields.length)
-                    a.checked = !a.checked; // the checkbox
-            }
-            else if (on(hits.ok))
-                return done(a);
+            const on = ([from, to]) => m.press && m.button === 0 && m.y === hits.row && m.x >= from && m.x < to;
+            if (on(hits.ok))
+                done(typed);
             else if (on(hits.cancel))
-                return done(null);
-            redraw();
+                done(null);
         };
         input.on("keypress", onKey);
         input.on("mouse", onMouse);
         out.on("resize", redraw);
     });
 }
-/** A dialog with one field or none: the field's text ("" without one) on enter, null on esc */
-const ask = async (d) => {
-    const a = await form(d);
-    return a && (a.values[0] ?? "");
-};
 /** Waits for work while the screen shows a spinner, status.label, the time so far and status.line (its latest output). esc quits */
 async function busy(status, work) {
     if (!tty()) {
@@ -124,10 +75,10 @@ async function busy(status, work) {
     }
     const t = now();
     let frame = 0;
-    const tick = () => asking || paint({ lines: [`${cyan("⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10])} ${status.label} ${dim("· " + duration(now() - t))}`,
+    const tick = () => paint({ lines: [`${cyan("⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10])} ${status.label} ${dim("· " + duration(now() - t))}`,
             dim(clip(status.line)), "", dim("esc quits")] });
-    // a dialog on top (the login) takes its own keys; the exit handlers remove containers already started
-    const quit = (_, key = {}) => !asking && (key.name === "escape" || key.name === "q" || (key.ctrl && key.name === "c"))
+    // the exit handlers remove containers already started
+    const quit = (_, key = {}) => (key.name === "escape" || key.name === "q" || (key.ctrl && key.name === "c"))
         && (leaveScreen(), process.exit(130));
     const timer = setInterval(tick, 120);
     input.on("keypress", quit);
@@ -160,7 +111,7 @@ export async function setupDocker() {
             : [])];
     let password, error = "";
     for (;;) {
-        const a = await ask({ lines, fields: root ? [{ label: "password for sudo:", secret: true }] : [], buttons: [state === "missing" ? "Install" : "Start", "Cancel"], error });
+        const a = await ask({ lines, password: root ? "password for sudo:" : undefined, buttons: [state === "missing" ? "Install" : "Start", "Cancel"], error });
         if (a === null)
             return false;
         if (!root)
@@ -193,49 +144,23 @@ export async function setupDocker() {
         return a !== null && setupDocker();
     }
 }
-const LOGIN = [
-    "Each container runs its own Windscribe app, which logs in once:",
-    "the login stays in the container's docker volume for the next scans.",
-];
-let lastUser = "", remember = true; // the box as last ticked: ticked to start with
-/** A remembered login unless that just failed, else the login form */
-async function credentials(error) {
-    const saved = loadLogin();
-    if (saved && !error)
-        return saved;
-    const a = await form({
-        lines: LOGIN,
-        fields: [{ label: "Windscribe username:", value: lastUser || saved?.username }, { label: "Windscribe password:", secret: true }],
-        check: { label: "remember username and password", on: remember,
-            note: `saved in ${LOGIN_FILE.replace(homedir(), "~")}, only you can read it` },
-        buttons: ["Log in", "Cancel"],
-        error,
-    });
-    if (!a)
-        return null;
-    remember = a.checked;
-    if (!remember)
-        saveLogin(null); // unticked: forget the one saved before, if any
-    const [username, password] = a.values;
-    return { username: (lastUser = username), password };
-}
-/** Starts the containers for a parallel scan of this many attempts: docker, the image, the logins.
- * Resolves to their probers and whether WireGuard works in them; null if the user backed out */
+/** Starts the containers for a parallel scan of this many attempts: docker, the image, the containers' apps logged in with
+ * this computer's session. Resolves to their probers and whether WireGuard works in them; null if the user backed out */
 export async function startParallel(attempts) {
+    const s = session();
+    if (!s)
+        throw new Error("can't find the session this computer's Windscribe app is logged in with, which the containers' apps log in with:"
+            + " update the Windscribe app, or scan without --docker (d in the picker)");
     if (!(await setupDocker()))
         return null;
     const status = { label: "building the containers' image (the first time takes a few minutes)", line: "" };
     await busy(status, buildImage((line) => (status.line = line)));
     const n = workerCount(attempts);
     Object.assign(status, { label: `starting ${n} container${n > 1 ? "s" : ""}`, line: "" });
-    const started = await busy(status, startWorkers(n, {
-        credentials,
-        answer: (question) => ask({ lines: ["Windscribe asks:", "", ...question.split("\n")], fields: [{ label: "answer:" }], buttons: ["Send", "Cancel"] }),
-        loggedIn: (c) => remember && saveLogin(c), // saved only once it worked
-    }, (line) => (status.line = line)));
+    const started = await busy(status, startWorkers(n, s, (line) => (status.line = line)));
     if (!started.probers.length) {
         const why = status.line.startsWith("container") ? ` (${status.line})` : ""; // the last container's trouble
-        throw new Error(why || tty() ? `no container got ready${why}` : "the containers aren't logged in to Windscribe yet: run windscout --docker in a terminal once");
+        throw new Error(`no container got ready${why}`);
     }
     return started;
 }

package/dist/tui/picker.js

@@ -1,9 +1,9 @@
-import { loadDockerWireGuard, MIN_TIMEOUT, saveConfig } from "../config.js";
-import { dockerState, notInContainers, workerCount } from "../docker.js";
+import { loadDockerWireGuard, MIN_TIMEOUT, saveConfig, SPEED_TEST } from "../config.js";
+import { dockerState, loginSeconds, notInContainers, workerCount } from "../docker.js";
 import { attemptSeconds, estimate } from "../scan.js";
 import { duration } from "../time.js";
 import { canUpdate, checkUpdate, versionLines } from "../update.js";
-import { COUNTRIES, PROTOCOLS } from "../windscribe.js";
+import { COUNTRIES, protocolPorts, PROTOCOLS } from "../windscribe.js";
 import { countryName, flag } from "./country.js";
 import { setupDocker } from "./docker.js";
 import { draw, enterScreen, input, leaveScreen, out, repoLink } from "./terminal.js";
@@ -11,18 +11,21 @@ import { bold, cyan, dim, green, under, vw, yellow } from "./text.js";
 import { box, centerIn, grid } from "./widgets.js";
 const flip = (set, value) => (set.has(value) ? set.delete(value) : set.add(value));
 /** Resolves to the choice (also saved for next time), null when the user quits, or "update" for u */
-export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
+export function pick(saved, { timeout, speedTest, firewall, random, allPorts, docker }) {
     const selected = new Set(saved?.countries ?? []);
     const protos = new Set(saved?.protocols.length ? saved.protocols : PROTOCOLS);
     let cursor = 0, top = 0, message = "", query = "", searching = false;
     let seconds = String(timeout), editing = false; // the timeout, as typed
     let dockerAt = null, inDialog = false; // docker's state once checked; a docker dialog has the screen
+    let portLists = null; // each protocol's ports, once the app said
     let hit;
     const visible = () => {
         const q = query.toLowerCase();
         return q ? COUNTRIES.filter((c) => c.toLowerCase().includes(q) || countryName(c).toLowerCase().includes(q)) : COUNTRIES;
     };
-    const attempts = () => selected.size * protos.size;
+    const ports = (p) => (allPorts && portLists?.get(p)?.length) || 1; // attempts per country for the protocol
+    const perCountry = (ps) => [...ps].reduce((n, p) => n + ports(p), 0);
+    const attempts = () => selected.size * perCountry(protos);
     const wireguard = loadDockerWireGuard(); // in docker containers, as the last parallel scan found
     enterScreen();
     return new Promise((resolve) => {
@@ -40,6 +43,12 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 top = cursor - height + 1;
             top = Math.max(0, Math.min(top, matches.length - height));
             const protoLine = PROTOCOLS.map((p, i) => `${dim(under(String(i + 1)))} ${protos.has(p) ? green("● " + p) : dim("○ " + p)}`).join("   ");
+            const listed = portLists && [...portLists.values()].some((l) => l.length), each = perCountry(protos);
+            const portsLine = `${dim(under("p"))} ${allPorts ? green("● all ports") : dim("○ all ports")}  ${dim(!allPorts
+                ? "off: each protocol on its default port"
+                : !portLists ? "checking the ports…"
+                    : !listed ? "this Windscribe app can't list its ports: 2.22 and newer can"
+                        : `every port of each protocol: ${each} attempt${each === 1 ? "" : "s"} per country${each > protos.size ? `, not ${protos.size}` : ""}`)}`;
             const speedLine = `${dim(under("s"))} ${speedTest ? green("● speed test") : dim("○ speed test")}  ${dim(speedTest
                 ? "ranks by download speed · adds ~15s per working connection"
                 : "off: connect-only, ranks by latency")}`;
@@ -55,8 +64,10 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
             const timeoutLine = `${dim(under("t"))} timeout ${editing ? bold(seconds) + cyan("▏") : (short ? yellow : bold)(seconds || "?")} s  ${dim(`per connection · at least ${MIN_TIMEOUT}`)}`;
             const n = attempts();
             const here = PROTOCOLS.filter((p) => docker && protos.has(p) && notInContainers(PROTOCOLS, wireguard).has(p)); // after the containers
-            const inContainers = selected.size * (protos.size - here.length);
-            const slots = docker && dockerAt === "ready" && inContainers ? workerCount(inContainers) : 1;
+            const inContainers = selected.size * perCountry([...protos].filter((p) => !here.includes(p)));
+            const parallel = docker && dockerAt === "ready" && inContainers > 0;
+            const slots = parallel ? workerCount(inContainers) : 1;
+            const login = parallel ? loginSeconds(slots) : 0; // the containers log in before the scan starts
             const dockerLabel = "parallel scan in docker containers";
             const dockerLine = `${dim(under("d"))} ${docker ? green("● " + dockerLabel) : dim("○ " + dockerLabel)}  ${dim(!docker
                 ? "off: one attempt at a time"
@@ -82,9 +93,10 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 ["quit", under("Q") + "uit"],
             ];
             const buttonLine = buttons.map(([id, label]) => (id === "start" ? bold(cyan(`[ ${label} ]`)) : dim(`[ ${label} ]`))).join("  ");
-            const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(...[protoLine, speedLine, fwLine, randomLine, timeoutLine, dockerLine].map(vw)) + 4 });
+            const settings = [protoLine, portsLine, ...(SPEED_TEST ? [speedLine] : []), fwLine, randomLine, timeoutLine, dockerLine];
+            const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(...settings.map(vw)) + 4 });
             const width = vw(table[0]);
-            const head = box([protoLine, speedLine, fwLine, randomLine, timeoutLine, dockerLine], {
+            const head = box(settings, {
                 title: bold(cyan("WindScout")),
                 right: `${bold(String(selected.size))}${dim(`/${COUNTRIES.length} selected`)}`,
                 width: width - 4,
@@ -96,7 +108,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 centerIn(buttonLine, width),
                 "",
                 centerIn(n
-                    ? `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(estimate(inContainers, timeout, slots) + estimate(n - inContainers, timeout)))} ${dim(`(~${attemptSeconds(timeout)}s each${slots > 1 ? `, ${slots} at a time` : ""})`)}`
+                    ? `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(login + estimate(inContainers, timeout, slots) + estimate(n - inContainers, timeout)))} ${dim(`(~${attemptSeconds(timeout)}s each${slots > 1 ? `, ${slots} at a time` : ""}${login ? `, + ~${duration(login)} login` : ""})`)}`
                     : yellow("select at least one country and one protocol"), width),
                 centerIn(dim(editing
                     ? "type the seconds to wait for each connection · enter/esc done"
@@ -104,13 +116,14 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                         ? "type to filter · ↑↓ move · enter/esc done"
                         // both lines fit 80 columns
                         : `↑↓ move · space select · a/n ${query ? "all/none shown · esc clear" : "all/none · / search"} · enter start · q quit`), width),
-                centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · s speed test · f firewall · r random · t timeout · d docker`), width),
+                centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · p ports${SPEED_TEST ? " · s speed" : ""} · f firewall · r random · t timeout · d docker`), width),
             ];
             if (message)
                 lines.push(centerIn(yellow(message), width));
             lines.push("", ...version.map((l) => centerIn(l, width)), centerIn(dim(repoLink), width));
             const at = draw(lines);
             // click map, in screen coordinates
+            const row = (line) => at.top + 1 + settings.indexOf(line); // a settings line, under the box's top border
             let px = at.left + 2; // "│ " before the protocol line
             const protoHits = PROTOCOLS.map((p, i) => {
                 const len = vw(`${i + 1} ● ${p}`);
@@ -126,7 +139,8 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 return range;
             });
             hit = {
-                protoRow: at.top + 1, protoHits, speedRow: at.top + 2, firewallRow: at.top + 3, randomRow: at.top + 4, timeoutRow: at.top + 5, dockerRow: at.top + 6,
+                protoRow: row(protoLine), protoHits, portsRow: row(portsLine), speedRow: SPEED_TEST ? row(speedLine) : -1,
+                firewallRow: row(fwLine), randomRow: row(randomLine), timeoutRow: row(timeoutLine), dockerRow: row(dockerLine),
                 searchRow: at.top + head.length + 1,
                 firstRow: at.top + head.length + 5, shown: shown.length,
                 buttonRow: at.top + head.length + table.length + 1, buttonHits,
@@ -136,6 +150,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
         checkUpdate().then(() => !closed && render()); // the check usually lands after the first draw
         if (docker)
             dockerState().then((s) => ((dockerAt = s), !closed && render()));
+        protocolPorts().then((l) => ((portLists = l), !closed && render()));
         const finish = (value) => {
             closed = true;
             out.off("resize", render);
@@ -161,6 +176,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 speed: speedTest,
                 firewall,
                 random,
+                allPorts,
                 timeout,
                 docker,
             };
@@ -214,6 +230,8 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                     if (i >= 0)
                         flip(protos, PROTOCOLS[i]);
                 }
+                else if (y === hit.portsRow)
+                    allPorts = !allPorts;
                 else if (y === hit.speedRow)
                     speedTest = !speedTest;
                 else if (y === hit.firewallRow)
@@ -294,7 +312,9 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 matches.forEach((c) => selected.add(c));
             else if (k === "n")
                 matches.forEach((c) => selected.delete(c));
-            else if (k === "s")
+            else if (k === "p")
+                allPorts = !allPorts;
+            else if (k === "s" && SPEED_TEST)
                 speedTest = !speedTest;
             else if (k === "f")
                 firewall = !firewall;

package/dist/tui/progress.js

@@ -24,7 +24,9 @@ export function showProgress(scan, blocking) {
         const eta = (total - done) * (done ? elapsed / done : attemptSeconds(timeout) / slots.length);
         const spinner = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10];
         const ok = sortOk(results);
-        const failed = finished.filter((c) => !results.some((r) => r.query === c && r.status === "ok"));
+        // blocked: nothing worked, and something was really tried (a key limit or a port the app doesn't offer tries nothing)
+        const failed = finished.filter((c) => !results.some((r) => r.query === c && r.status === "ok")
+            && results.some((r) => r.query === c && r.status !== "key limit" && r.status !== "no such port"));
         const attempt = ({ current: c }) => (c ? `${flag(c.country)} ${countryName(c.country)} ${dim("·")} ${c.protocol}` : "");
         const many = slots.length > 1; // a parallel scan: a line per container
         const pct = bold(`${String(Math.floor(fraction * 100)).padStart(3)}%`);

package/dist/tui/report.js

@@ -30,6 +30,15 @@ export function report(results, protocols, { all, speedTest }) {
     console.log();
     if (avail.length)
         console.log(avail.join("\n"));
+    const limited = results.filter((r) => r.status === "key limit");
+    if (limited.length) {
+        const many = limited.length > 1, list = (xs) => [...new Set(xs)].join(",");
+        console.log([
+            yellow(`⚠ ${limited.length} WireGuard attempt${many ? "s" : ""} hit your Windscribe account's limit of WireGuard keys`),
+            dim(`  (each docker container registers a key of its own), so ${many ? "these don't" : "it doesn't"} show whether WireGuard works from here.`),
+            `  To find out, scan ${many ? "them" : "it"} on this computer: ${cyan(`windscout -c "${list(limited.map((r) => r.query))}" -p ${list(limited.map((r) => r.protocol))}`)}`,
+        ].join("\n"));
+    }
     if (!ok.length) {
         console.log(box([yellow("Nothing connected."),
             dim("Try other countries, ports (e.g. -p stealth:443,tcp:443) or a longer --timeout.")], { title: bold(cyan("WindScout")), width: width - 4 }).join("\n"));
@@ -37,7 +46,7 @@ export function report(results, protocols, { all, speedTest }) {
     }
     console.log(main.join("\n"));
     const stats = protocols.map((p) => {
-        const tried = results.filter((r) => r.protocol === p && r.status !== "no such location");
+        const tried = results.filter((r) => r.protocol === p && !["no such location", "key limit", "no such port"].includes(r.status));
         const good = tried.filter((r) => r.status === "ok");
         return { p, good: good.length, tried: tried.length, best: sortOk(good).at(0) };
     }).sort((x, y) => y.good - x.good || (y.best?.speedMbps ?? 0) - (x.best?.speedMbps ?? 0) || (x.best?.latencyMs ?? 1e9) - (y.best?.latencyMs ?? 1e9));

package/dist/tui/tables.js

@@ -1,5 +1,5 @@
 import { countryName, flag } from "./country.js";
-import { bold, dim, fmt, green, red } from "./text.js";
+import { bold, dim, fmt, green, red, yellow } from "./text.js";
 import { grid } from "./widgets.js";
 const RESULT_COLS = [
     { title: "#", align: "right" }, { title: "Country" }, { title: "Location" }, { title: "Protocol" },
@@ -14,15 +14,27 @@ const resultRow = (r, i) => [
     r.connectS === null ? "-" : `${fmt(r.connectS, 1)} s`,
     r.latencyMs === null ? "-" : `${fmt(r.latencyMs, 0)} ms`,
     r.speedMbps === null ? "-" : bold(`${fmt(r.speedMbps, 1)} Mbps`),
-    r.status === "ok" ? green("✓ ok") : red(r.status),
+    r.status === "ok" ? green("✓ ok") : r.status === "key limit" || r.status === "no such port" ? yellow(r.status) : red(r.status),
 ];
 /** Numbered attempts, in the given order; the Speed column only when the speed test ran */
 export function resultTable(results, speedTest, options) {
     const keep = (_, i) => speedTest || i !== SPEED_COL;
     return grid(RESULT_COLS.filter(keep), results.map((r, i) => resultRow(r, i).filter(keep)), options);
 }
-/** One row per country, ✓/✗ per protocol (· = not tried yet); no lines until something was tried */
+const base = (protocol) => protocol.split(":")[0];
+/** A protocol's cell: ✓/✗, with how many of its ports worked when it has several (✓ 3/11); · = not tried yet,
+ * key limit = couldn't try WireGuard, no port = the app doesn't offer it. Those last two don't count */
+function cell(rs, ports) {
+    const tried = rs.filter((r) => ports.includes(r.protocol));
+    const real = tried.filter((r) => r.status !== "key limit" && r.status !== "no such port");
+    const good = real.filter((r) => r.status === "ok").length, count = ports.length > 1 ? ` ${good}/${real.length}` : "";
+    if (real.length)
+        return good ? green(`✓${count}`) : red(`✗${count}`);
+    return tried.some((r) => r.status === "key limit") ? yellow("key limit") : tried.length ? yellow("no port") : dim("·");
+}
+/** One row per country, a cell per protocol (its ports share it); no lines until something was tried */
 export function matrix(results, protocols, { minWidth = 0, limit = Infinity } = {}) {
+    const columns = [...new Set(protocols.map(base))].map((b) => protocols.filter((p) => base(p) === b));
     const byCountry = new Map();
     for (const r of results) {
         if (r.status === "no such location" || r.status === "interrupted")
@@ -45,15 +57,13 @@ export function matrix(results, protocols, { minWidth = 0, limit = Infinity } =
             [
                 `${flag(q)} ${countryName(q)}`,
                 first,
-                ...protocols.map((p) => {
-                    const r = rs.find((x) => x.protocol === p);
-                    return !r ? dim("·") : r.status === "ok" ? green("✓") : red("✗");
-                }),
+                ...columns.map((ports) => cell(rs, ports)),
             ],
-            ...more.map((place) => ["", place, ...protocols.map(() => "")]),
+            ...more.map((place) => ["", place, ...columns.map(() => "")]),
         ];
     }).slice(0, limit);
-    return grid([{ title: "Country" }, { title: "Location(s)" }, ...protocols.map((p) => ({ title: p, align: "center" }))], rows, {
+    return grid([{ title: "Country" }, { title: "Location(s)" },
+        ...columns.map((ports) => ({ title: ports.length > 1 ? base(ports[0]) : ports[0], align: "center" }))], rows, {
         caption: bold("Availability"),
         captionRight: dim(`${reachable}/${ranked.length} countries reachable${ranked.length > limit ? ` · top ${limit}` : ""}`),
         minWidth,

package/dist/windscribe.js

@@ -1,6 +1,7 @@
 // The Windscribe desktop app, driven through the windscribe-cli it ships with.
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { sleep } from "./time.js";
 export const CLI = "windscribe-cli";
@@ -14,6 +15,19 @@ const DESKTOP_CLI = {
 let cliBin = CLI;
 // IKEv2 is offered by the macOS/Windows apps only
 export const PROTOCOLS = ["wireguard", ...(process.platform === "linux" ? [] : ["ikev2"]), "stealth", "wstunnel", "udp", "tcp"];
+let portLists;
+/** The ports the app offers for each protocol, its default first; [] where it lists none (IKEv2 on Linux, or apps before 2.22,
+ * which have no `ports`). Asked once, one protocol at a time: windscribe-cli runs one at a time */
+export const protocolPorts = () => (portLists ??= (async () => {
+    const lists = new Map();
+    for (const p of PROTOCOLS) {
+        const out = await windscribe("ports", p).catch(() => ""); // can't ask: no list, so the default port
+        lists.set(p, out.match(/^\d+(, \d+)*$/m)?.[0].split(", ").map(Number) ?? []);
+    }
+    return lists;
+})());
+/** Each protocol given without a port, on every port in lists: "tcp" → "tcp:443", "tcp:587", …; the rest as given */
+export const withPorts = (protocols, lists) => protocols.flatMap((p) => (!p.includes(":") && lists.get(p)?.length ? lists.get(p).map((port) => `${p}:${port}`) : [p]));
 // ponytail: hardcoded because `windscribe-cli locations` returns nothing on 2.24; refresh when Windscribe adds countries
 export const COUNTRIES = `US CA MX BR AR CL CO PE GB IE FR DE NL BE LU CH AT IT ES PT DK NO SE FI IS
 PL CZ SK HU RO BG GR CY TR RS HR SI BA MK AL MD UA EE LV LT IL AE AZ GE AM KZ IN JP KR
@@ -69,6 +83,51 @@ export async function waitForLogin() {
             + `\nDon't have it? ${DOWNLOAD_URL}`);
     return status;
 }
+// The app's settings (Qt's, as Windscribe/Windscribe2): this INI file on Linux, the user's defaults on macOS, the registry on Windows
+export const SETTINGS = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "Windscribe", "Windscribe2.conf");
+/** A top-level value in the text of the INI file: Qt puts those under [General] */
+export function iniValue(ini, key) {
+    let general = false;
+    for (const line of ini.split(/\r?\n/)) {
+        if (line.startsWith("["))
+            general = line.trim() === "[General]";
+        else if (general && line.startsWith(`${key}=`))
+            return line.slice(key.length + 1);
+    }
+}
+/** The INI file's text with the app logging in with this session when it starts. Settings another account left start over:
+ * the WireGuard keys in them are registered with that account */
+export function withSession(ini, { userId, authHash }) {
+    if (userId && iniValue(ini, "userId") !== userId)
+        ini = "";
+    let general = false;
+    const lines = ini.split("\n").filter((line) => {
+        if (line.startsWith("["))
+            general = line.trim() === "[General]";
+        return !(general && line.startsWith("authHash="));
+    });
+    const at = lines.findIndex((line) => line.trim() === "[General]");
+    lines.splice(at + 1, 0, ...(at < 0 ? ["[General]"] : []), `authHash=${authHash}`);
+    return lines.join("\n");
+}
+/** One of the app's top-level settings on this computer; "" when it isn't there, or doesn't look like an ID or a token */
+function setting(key) {
+    const run = (cmd, args) => execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 10_000 });
+    try {
+        const value = process.platform === "darwin" ? run("defaults", ["read", "com.windscribe.Windscribe2", key])
+            : process.platform === "win32" ? run("reg", ["query", "HKCU\\Software\\Windscribe\\Windscribe2", "/v", key]).match(/REG_SZ\s+(.*)/)?.[1]
+                : iniValue(readFileSync(SETTINGS, "utf8"), key);
+        return value?.trim().match(/^[\w:.+/=-]+$/)?.[0] ?? "";
+    }
+    catch {
+        return ""; // no such setting, or no settings
+    }
+}
+/** The session this computer's app is logged in with; null when its settings don't have one */
+export function session() {
+    const authHash = setting("authHash");
+    return authHash ? { userId: setting("userId"), authHash } : null;
+}
 export const isFirewallOn = (status) => /^Firewall state: On/m.test(status);
 let firewallChanged = false; // blockInternet() turned the firewall on, so restoreFirewall() turns it back off
 /** Turns on the app's firewall, so nothing goes online outside the VPN. False if it was on already (it then stays on) */

package/dist/worker.js

@@ -1,13 +1,14 @@
 // windscout --worker: runs in a parallel scan's docker container (docker.ts), beside the container's own Windscribe app.
 // Takes the host's messages from stdin and answers on stdout, a JSON object per line.
 import { spawn } from "node:child_process";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { createInterface } from "node:readline";
 import { probe } from "./probe.js";
-import { sleep } from "./time.js";
-import { CLI, windscribe } from "./windscribe.js";
+import { now, sleep } from "./time.js";
+import { SETTINGS, windscribe, withSession } from "./windscribe.js";
+const APP = "/opt/windscribe/Windscribe"; // as the image installs it
 const send = (m) => process.stdout.write(JSON.stringify(m) + "\n");
-// the CLI mixes JSON log lines into its output
-const text = (s) => s.split("\n").filter((l) => !l.startsWith('{"tm"')).join("\n").trim();
 export async function worker() {
     const inbox = [];
     let wake = () => { }, closed = false, stop = false;
@@ -26,21 +27,28 @@ export async function worker() {
             await new Promise((resolve) => (wake = resolve));
         return inbox.shift() ?? null;
     };
-    // the app starts beside us (the image's CMD); its CLI answers once it's up
+    // The app logs in with this computer's session, which goes in its settings before it starts: no login of its own, since
+    // Windscribe locks an account that logs in many times at once. Never log out here: that would end this computer's session too
+    const session = (await next())?.session;
+    if (!session)
+        return;
+    let ini = "";
+    try {
+        ini = readFileSync(SETTINGS, "utf8");
+    }
+    catch { } // a new volume: no settings yet
+    mkdirSync(dirname(SETTINGS), { recursive: true });
+    writeFileSync(SETTINGS, withSession(ini, session));
+    // no systemd in a container: start the app like its unit would, as this user (its CLI refuses root)
+    spawn(APP, { stdio: "ignore" }).on("error", () => { }); // not there: its CLI never answers below
+    // its CLI answers once it's up, and says logged in once Windscribe accepts the session, or the error it got instead.
+    // One container took 37 s in a test, 16 at once 38-75 s
     let status = "";
-    for (let i = 0; i < 60 && !(status = await windscribe("status")).includes("Login state"); i++)
+    for (const t = now(); now() - t < 180 && !/Login state: (Logged in|Error)/.test(status = await windscribe("status"));)
         await sleep(1000);
-    if (!status.includes("Login state"))
-        return void console.error("Windscribe's app didn't start in the container");
     if (!status.includes("Logged in")) {
-        for (let error = "";;) {
-            send({ need: "login", text: error });
-            const m = await next();
-            if (!m?.login)
-                return; // no credentials for us: this container sits out the scan
-            if (!(error = await login(m.login.username, m.login.password, next)))
-                break;
-        }
+        const state = status.match(/^Login state: (.*)$/m)?.[1].trim();
+        return void console.error(state ? `Windscribe's app didn't log in with this computer's session (${state})` : "Windscribe's app didn't start in the container");
     }
     send({ ready: true, wireguard: process.env.WS_WIREGUARD !== "0" }); // the image's CMD checked the kernel
     for (let m; (m = await next());) {
@@ -66,27 +74,3 @@ export async function worker() {
         send({ result });
     }
 }
-/** windscribe-cli login, with the password on its stdin; what it asks next (a 2FA code, a captcha) goes to the host.
- * "" once logged in, else why not */
-function login(username, password, next) {
-    return new Promise((resolve) => {
-        const p = spawn(CLI, ["login", username], { stdio: ["pipe", "pipe", "ignore"] });
-        p.stdin.on("error", () => { });
-        p.stdin.write(password + "\n");
-        let out = "";
-        p.stdout.on("data", async (d) => {
-            out += d;
-            const asked = text(out);
-            // a question ends the output, with no newline after it: "2FA code:", or under a captcha "…to continue:"
-            if (!asked.endsWith(":"))
-                return;
-            out = "";
-            if (asked.endsWith("Password:"))
-                return; // answered already
-            send({ need: "input", text: asked });
-            p.stdin.write(((await next())?.input ?? "") + "\n");
-        });
-        // it exits 0 whether that worked or not: ask the app
-        p.on("close", async () => resolve((await windscribe("status")).includes("Logged in") ? "" : text(out).split("\n").at(-1) || "login failed"));
-    });
-}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windscout",
-  "version": "0.6.0",
-  "description": "Find which Windscribe locations and protocols work from your network, ranked by speed (unofficial)",
+  "version": "0.6.4",
+  "description": "Find which Windscribe locations and protocols work from your network, ranked by latency (unofficial)",
   "type": "module",
   "bin": {
     "windscout": "dist/cli.js"
@@ -25,14 +25,12 @@
   "keywords": [
     "windscribe",
     "vpn",
-    "speedtest",
     "wireguard",
     "stealth",
     "cli",
     "censorship",
     "firewall",
     "unblock",
-    "vpn-speed-test",
     "server-finder",
     "docker"
   ],