windscout 0.6.1 → 0.6.4

package/README.md

@@ -1,8 +1,8 @@
 # WindScout
 
-Find which Windscribe locations and protocols actually work from your network, ranked by speed. Runs on Linux, macOS and Windows.
+Find which Windscribe locations and protocols actually work from your network, ranked by latency. Runs on Linux, macOS and Windows.
 
-WindScout drives the official `windscribe-cli`: it connects to each country × protocol pair, measures latency and download speed through the tunnel, disconnects, and prints a ranked table.
+WindScout drives the official `windscribe-cli`: it connects to each country × protocol pair, measures latency through the tunnel, disconnects, and prints a ranked table.
 
 ![WindScout picking countries, scanning, and printing the availability grid and ranked results](demo.gif)
 
@@ -30,7 +30,7 @@ Run `windscout` with no arguments to open the interactive picker:
 ```
 ╭─ WindScout ──────────────────────────────────── 2/68 selected ─╮
 │ 1 ● wireguard   2 ● stealth   3 ○ wstunnel   4 ● udp   5 ● tcp │
-│ s ○ speed test  off: connect-only, ranks by latency            │
+│ p ○ all ports  off: each protocol on its default port          │
 ╰────────────────────────────────────────────────────────────────╯
 ╭────────────────────────────────────────────────────────────────╮
 │ 🔍 an▏                                              1–16 of 18 │
@@ -51,7 +51,7 @@ Run `windscout` with no arguments to open the interactive picker:
 | `/` | search by country name or code (enter/esc to finish, esc again to clear) |
 | `a` / `n` | select all / unselect all (only the matching countries while a search is active) |
 | `1`–`6` | toggle a protocol (`1`–`5` on Linux, which has no IKEv2) |
-| `s` | toggle the speed test (off = connect-only mode) |
+| `p` | toggle [all ports](#all-ports): each protocol on every port it has, not just its default |
 | `f` | toggle "block internet while scanning" (firewall) |
 | `r` | toggle random order: scan the selected countries shuffled, a new order each run |
 | `d` | toggle the [parallel scan in docker containers](#parallel-scan-with-docker) (installs or starts docker first, after asking) |
@@ -59,11 +59,11 @@ Run `windscout` with no arguments to open the interactive picker:
 | `enter` | start scanning |
 | `q` | quit (during a scan: stop and show partial results; press again to force quit) |
 
-**Mouse:** click a country to select or unselect it, click a protocol or the speed-test line to toggle it, click the search box to start typing (click anywhere else to leave it), and scroll the list with the wheel. The `[ ▶ Start ]  [ All ]  [ None ]  [ Quit ]` buttons under the table do the same as their keys; the shortcut key is underlined on screen (on the buttons, the protocol numbers and `s`). This needs a terminal with mouse support, which most have. On Windows, use Windows Terminal; if clicks do nothing there, the keyboard does everything.
+**Mouse:** click a country to select or unselect it, click a protocol or a setting's line to toggle it, click the search box to start typing (click anywhere else to leave it), and scroll the list with the wheel. The `[ ▶ Start ]  [ All ]  [ None ]  [ Quit ]` buttons under the table do the same as their keys; the shortcut key is underlined on screen (on the buttons, the protocol numbers and the settings' letters). This needs a terminal with mouse support, which most have. On Windows, use Windows Terminal; if clicks do nothing there, the keyboard does everything.
 
 Your selection is saved to `~/.config/windscout/config.json` (`%USERPROFILE%\.config\windscout\config.json` on Windows) and preselected next time.
 
-While scanning, WindScout shows a progress bar, elapsed time and remaining time. It also shows what it's doing right now (connecting, measuring latency or measuring speed). The table of working locations refreshes after each country. When the scan finishes, the final report is printed to your normal terminal. It ends with the best connection and the other working ones, each with its `windscribe-cli connect` command. At the prompt, press enter to connect to the best one, type another one's number to connect to that, or `q` to quit.
+While scanning, WindScout shows a progress bar, elapsed time and remaining time. It also shows what it's doing right now (connecting or measuring latency). The table of working locations refreshes after each country. When the scan finishes, the final report is printed to your normal terminal. It ends with the best connection and the other working ones, each with its `windscribe-cli connect` command. At the prompt, press enter to connect to the best one, type another one's number to connect to that, or `q` to quit.
 
 ### Non-interactive
 
@@ -72,6 +72,7 @@ Pass `-c` to skip the picker, for scripts or when there is no terminal:
 ```sh
 windscout -c DE,NL,TR -p stealth,tcp:443    # chosen countries and protocols (port optional)
 windscout -c Frankfurt,Wurstchen            # cities or datacenter nicknames work too
+windscout -c DE -p stealth,tcp -P           # every port of stealth and tcp
 windscout -t 40 -a                          # longer connect timeout, also list failed attempts
 ```
 
@@ -79,19 +80,17 @@ windscout -t 40 -a                          # longer connect timeout, also list
 |---|---|---|
 | `-c, --countries` | comma-separated ISO country codes, city names or nicknames | open the picker |
 | `-p, --protocols` | comma-separated: `wireguard`, `ikev2` (macOS and Windows), `stealth`, `wstunnel`, `udp`, `tcp`, optionally `:port` | saved, or all |
+| `-P, --all-ports` | try each protocol on [every port](#all-ports) Windscribe offers for it, not just its default | picker: saved, or off; with `-c`: off |
 | `-t, --timeout` | seconds to wait for each connection, at least 10 | picker: saved, or 15; with `-c`: 15 |
 | `-a, --all` | include failed attempts in the final table | off |
-| `-n, --no-speed` | connect-only mode: skip the download test, rank by latency | picker: saved, or connect-only on first run; with `-c`: speed test on |
 | `-f, --firewall` | block internet while scanning, except through the VPN | picker: saved, or off; with `-c`: off |
 | `-r, --random` | scan the countries in a random order | picker: saved, or off; with `-c`: off |
 | `-d, --docker` | [scan in parallel, in docker containers](#parallel-scan-with-docker) | picker: saved, or off; with `-c`: off |
 | `-v, --version` | print the installed version; if a newer one is on npm, show the update command (with `sudo` when needed) and ask (y/n) to run it | |
 
-## Connect-only mode
+## Availability grid
 
-Often you only need to know **what connects**, not how fast it is. Turn the speed test off with `s` in the picker or with `--no-speed`. Each working connection is then checked with a quick latency test only. That saves about 15 s per working connection, and results are ranked by latency. Connect-only is the default on the first run, and the choice is remembered.
-
-Both modes show an **availability grid**: one row per country, and ✓ / ✗ for each protocol (`·` = not tried yet). Location(s) lists each datacenter that connected, one per line, since protocols can land on different ones:
+Each working connection gets a quick latency test, and the working ones are ranked by latency. The scan screen and the final report show an **availability grid**: one row per country, and ✓ / ✗ for each protocol (`·` = not tried yet; `key limit`, in a [parallel scan](#parallel-scan-with-docker): WireGuard couldn't be tried). With [all ports](#all-ports), it counts how many of a protocol's ports worked: `✓ 3/11`. Location(s) lists each datacenter that connected, one per line, since protocols can land on different ones:
 
 ```
 ╭──────────────────────────────────────────────────────────────────────────────╮
@@ -106,7 +105,25 @@ Both modes show an **availability grid**: one row per country, and ✓ / ✗ for
 ╰─────────────────────────┴────────────────────────┴─────────┴───────────┴─────╯
 ```
 
-While scanning, press `tab` to switch between the availability grid and the speed or latency ranking. Press `p` (or `space`) to pause: the current attempt finishes, the VPN disconnects, and the scan waits until you press `p` again. Paused time doesn't count toward elapsed or remaining. In connect-only mode the scan starts on the availability grid.
+While scanning, press `tab` to switch between the availability grid and the latency ranking. Press `p` (or `space`) to pause: the current attempt finishes, the VPN disconnects, and the scan waits until you press `p` again. Paused time doesn't count toward elapsed or remaining. The scan starts on the availability grid.
+
+## All ports
+
+Each protocol is normally tried on its default port, the first one Windscribe lists for it. A network can block a protocol on one port and let it through on another, so turn on **all ports** with `p` in the picker or `-P` (`--all-ports`): each selected protocol is then tried on every port Windscribe offers for it. WindScout asks your Windscribe app for the ports (`windscribe-cli ports tcp`), so the list follows Windscribe's. In October 2026 it was:
+
+| Protocol | Ports | Attempts per country |
+|---|---|---|
+| wireguard | 443, 80, 53, 123, 1194, 65142 | 6 |
+| stealth | 443, 587, 21, 22, 80, 123, 143, 3306, 8080, 54783, 8443 | 11 |
+| wstunnel | 443 | 1 |
+| udp | 443, 80, 53, 123, 1194, 54783 | 6 |
+| tcp | 443, 587, 21, 22, 80, 123, 143, 3306, 8080, 54783, 1194 | 11 |
+
+With every protocol selected, that's 35 attempts per country instead of 5, 7 times as many (on macOS and Windows, IKEv2 adds its own ports). The picker shows the count (`35 attempts per country, not 5`) and the estimate: one country takes about 11m 40s instead of 1m 40s in a normal scan, and about 2 minutes in a [parallel scan](#parallel-scan-with-docker), which helps most here. To try fewer, select only the protocols you need, or give a port yourself: a protocol with a port (`-p tcp:443`) stays on that one.
+
+The availability grid keeps one column per protocol and counts how many of its ports worked (`✓ 3/11`, or `✗ 0/11` when none did). The results list each working protocol with its port, and the per-protocol table has a line per port.
+
+When the app making an attempt doesn't offer a port, Windscribe quietly connects on the protocol's default port instead. That can happen in a parallel scan, where each container runs its own copy of the app, which can be older or newer than yours. WindScout checks the port it actually connected on and shows those attempts as `no port` (in yellow), rather than as results for a port that wasn't tried. Listing ports needs Windscribe 2.22 or newer. With an older app, all ports changes nothing, and the picker says so.
 
 ## Block internet while scanning (firewall)
 
@@ -116,7 +133,7 @@ Between attempts the VPN is disconnected for a moment, and apps on your computer
 
 A normal scan tries one location at a time, because your computer has one VPN connection. Turn on **parallel scan** with `d` in the picker or `--docker`, and each attempt runs in its own docker container instead. Each container has its own Windscribe app (Windscribe's Linux CLI app) and so its own VPN connection, and several locations are tried at once. The results come back to the scan screen, which shows a line per container.
 
-**How many containers:** one per attempt, as many as docker's CPUs allow and three quarters of its memory (at 250 MB each), at most 8. The picker shows the number (`8 at a time`) and the estimate that goes with it.
+**How many containers:** one per attempt, so 1 country with 5 protocols starts 5. Docker's CPUs, three quarters of its memory (at 250 MB each) and a maximum of 16 limit that. With more attempts than that, WindScout starts the fewest containers that need no more rounds: 17 attempts get 9 containers with 2 attempts each, the same 2 rounds that 16 containers would take. Fewer containers log in sooner (in a test, 1 took 37 s, and 16 together up to 75 s) and register fewer WireGuard keys. The picker shows the number (`9 at a time`) and the estimate that goes with it, which includes the time the containers take to log in before the scan starts (`+ ~58s login`: about 35 s, plus 2.5 s per container).
 
 **First time:** if docker isn't installed or isn't running, `d` (or a scan with `--docker`) opens a dialog that says what WindScout will do, and does it once you agree:
 
@@ -142,9 +159,11 @@ The mirrors come from [Mirava](https://github.com/MiravaOrg/Mirava)'s list of mi
 
 **Login:** the containers' Windscribe apps log in with the session that the Windscribe app on this computer is logged in with, so they never log in with your password. Windscribe locks an account that logs in many times at once, and a login per container would do that. WindScout reads the session from the app's settings (`~/.config/Windscribe/Windscribe2.conf` on Linux, the `com.windscribe.Windscribe2` defaults on macOS, `HKEY_CURRENT_USER\Software\Windscribe\Windscribe2` in the registry on Windows) and hands it to each container on its standard input, not on a command line, where other programs could see it. Each container's docker volume (`windscout-1`, `windscout-2`, …) keeps its app's settings for the next scans, with the WireGuard keys it registered with your account. A volume that another account used starts over. If you log out of the Windscribe app, the containers' session ends too, and the next scan gives them the new one.
 
+**WireGuard keys:** each container's app registers a WireGuard key of its own with your account the first time it uses WireGuard, and keeps it in its volume for later scans. Windscribe allows each account only so many keys. A container past that limit can't try WireGuard, which says nothing about your network, so the grid shows `key limit` (in yellow) instead of ✗, and those attempts don't count in the report's per-protocol numbers. Under the grid, the report says how many there were and gives the command that tries them on this computer, which has a key of its own: `windscout -c "DE,NL" -p wireguard`.
+
 WindScout 0.6.0 asked for your username and password instead, and could save them in `~/.config/windscout/login.json`. WindScout now deletes that file.
 
-**Measuring:** the containers share your internet connection, so they take turns measuring latency and speed while the connecting happens in parallel. Numbers stay comparable with a normal scan. Most of the time saved comes from attempts that hang until the timeout, which overlap now.
+**Measuring:** the containers share your internet connection, so they take turns measuring latency while the connecting happens in parallel. Numbers stay comparable with a normal scan. Most of the time saved comes from attempts that hang until the timeout, which overlap now.
 
 **Differences from a normal scan:**
 
@@ -164,23 +183,23 @@ While scanning:
 │  ██████████████████████████████████████████▌░░░░░░░░░░░░░░░░   72%   │
 │                                                                      │
 │  ⠏ 🇳🇱 Netherlands · stealth                                          │
-│    measuring speed · Amsterdam - Tulip · 3s                          │
+│    measuring latency · Amsterdam - Tulip · 1s                        │
 ├──────────────────────────────────────────────────────────────────────┤
 │  elapsed 25s   │   remaining ≈ 13s   │   ✓ 2 working   │   ✗ 1 blocked │
 ╰──────────────────────────────────────────────────────────────────────╯
 ╭──────────────────────────────────────────────────────────────────────╮
 │ Working so far                                               2 found │
 ├───┬────────────┬───────────────────────┬───────────┬───────────┬─────┤
-│ # │ Country    │ Location              │ Protocol  │     Speed │ ... │
+│ # │ Country    │ Location              │ Protocol  │   Latency │ ... │
 ```
 
 At the end, the results, a per-protocol summary and the best pick are printed to your normal terminal:
 
 ```
-╭─ ★ Best ─────────────────────────────────────────────────╮
-│ 🇳🇱 Amsterdam - Tulip over wireguard · 27.0 Mbps · 109 ms │
-│ windscribe-cli connect "Tulip" wireguard                 │
-╰──────────────────────────────────────────────────────────╯
+╭─ ★ Best (lowest latency) ────────────────────╮
+│ 🇳🇱 Amsterdam - Tulip over wireguard · 109 ms │
+│ windscribe-cli connect "Tulip" wireguard     │
+╰──────────────────────────────────────────────╯
 ```
 
 ## Notes

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 // WindScout: find which Windscribe locations and protocols actually work from here.
 // Drives the official windscribe-cli: connects to each country/protocol pair,
-// measures latency and download speed through the tunnel, prints a ranked table.
+// measures latency through the tunnel, prints a ranked table.
 import { createInterface } from "node:readline";
 import { spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
-import { CONFIG, DEFAULT_TIMEOUT, forgetLogin, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard } from "./config.js";
+import { CONFIG, DEFAULT_TIMEOUT, forgetLogin, loadConfig, loadDockerWireGuard, MIN_TIMEOUT, saveDockerWireGuard, SPEED_TEST } from "./config.js";
 import { notInContainers, stopWorkers } from "./docker.js";
 import { probe } from "./probe.js";
 import { Scan } from "./scan.js";
@@ -17,27 +17,28 @@ import { leaveScreen, out } from "./tui/terminal.js";
 import { cyan, green, yellow } from "./tui/text.js";
 import { now, sleep } from "./time.js";
 import { canUpdate, checkUpdate, runUpdate, updateNotice, versionLines } from "./update.js";
-import { blockInternet, CLI, connectState, isFirewallOn, PROTOCOLS, restoreFirewall, waitForLogin, windscribe } from "./windscribe.js";
+import { blockInternet, CLI, connectState, isFirewallOn, protocolPorts, PROTOCOLS, restoreFirewall, waitForLogin, windscribe, withPorts } from "./windscribe.js";
 import { worker } from "./worker.js";
 const HELP = `Usage: windscout [options]
 
-Find which Windscribe locations and protocols work from your network, ranked by speed.
+Find which Windscribe locations and protocols work from your network, ranked by ${SPEED_TEST ? "speed" : "latency"}.
 Without -c it opens an interactive country picker (your selection is remembered).
 
 Options:
   -c, --countries LIST  comma-separated ISO codes, city names or nicknames (skips the picker)
   -p, --protocols LIST  comma-separated protocols, optional :port (default: ${PROTOCOLS.join(",")})
+  -P, --all-ports       try each protocol on every port Windscribe offers for it, not just its default
   -t, --timeout SEC     seconds to wait for each connection, at least ${MIN_TIMEOUT} (default: saved, or ${DEFAULT_TIMEOUT})
   -a, --all             also show failed attempts in the final table
-  -n, --no-speed        connect-only: skip the download test, rank by latency (faster scan)
-  -f, --firewall        block internet while scanning, except through the VPN (turned back off afterwards)
+${SPEED_TEST ? "  -n, --no-speed        connect-only: skip the download test, rank by latency (faster scan)\n" : ""}  -f, --firewall        block internet while scanning, except through the VPN (turned back off afterwards)
   -r, --random          scan the countries in a random order
-  -d, --docker          scan in parallel, in docker containers (as many as docker's CPUs and memory allow, up to 8)
+  -d, --docker          scan in parallel, in docker containers (one per attempt, up to 16, as docker's CPUs and memory allow)
   -v, --version         show the installed version (and offer to update if a newer one is out)
   -h, --help            show this help
 
 Selection is stored in ${CONFIG}
-Example: windscout -c DE,NL,TR -p stealth,tcp:443`;
+Examples: windscout -c DE,NL,TR -p stealth,tcp:443
+          windscout -c DE -p stealth,tcp -P`;
 // "DE, NL,,TR" → ["DE", "NL", "TR"]
 const list = (s) => s.split(",").map((x) => x.trim()).filter(Boolean);
 const ask = (question) => new Promise((resolve) => {
@@ -83,11 +84,12 @@ async function main() {
         options: {
             countries: { type: "string", short: "c" },
             protocols: { type: "string", short: "p" },
+            "all-ports": { type: "boolean", short: "P", default: false },
             timeout: { type: "string", short: "t" },
             all: { type: "boolean", short: "a", default: false },
             help: { type: "boolean", short: "h", default: false },
             version: { type: "boolean", short: "v", default: false },
-            "no-speed": { type: "boolean", short: "n", default: false },
+            "no-speed": { type: "boolean", short: "n", default: false }, // still accepted while the speed test is hidden
             firewall: { type: "boolean", short: "f", default: false },
             random: { type: "boolean", short: "r", default: false },
             docker: { type: "boolean", short: "d", default: false },
@@ -116,9 +118,10 @@ async function main() {
     const tty = Boolean(process.stdin.isTTY && out.isTTY);
     let countries = a.countries ? list(a.countries) : undefined;
     let protocols = a.protocols ? list(a.protocols) : undefined;
-    let speedTest = !a["no-speed"];
+    let speedTest = SPEED_TEST && !a["no-speed"];
     let firewall = a.firewall;
     let random = a.random;
+    let allPorts = a["all-ports"];
     let docker = a.docker;
     if (!countries) {
         if (!tty)
@@ -132,6 +135,7 @@ async function main() {
             // already on in the app: show it on, since the scan won't turn it off
             firewall: firewall || isFirewallOn(status) || (saved?.firewall ?? false),
             random: random || (saved?.random ?? false),
+            allPorts: allPorts || (saved?.allPorts ?? false),
             docker: docker || (saved?.docker ?? false),
         });
         if (!choice)
@@ -143,11 +147,18 @@ async function main() {
         speedTest = choice.speed;
         firewall = choice.firewall;
         random = choice.random;
+        allPorts = choice.allPorts;
         timeout = choice.timeout;
         docker = choice.docker;
     }
     protocols ??= PROTOCOLS;
     timeout ??= DEFAULT_TIMEOUT;
+    // the picker asked for the ports already: waiting for that keeps windscribe-cli free for the scan
+    if (allPorts || !a.countries) {
+        const lists = await protocolPorts();
+        if (allPorts)
+            protocols = withPorts(protocols, lists);
+    }
     if (random)
         countries = countries.map((c) => [Math.random(), c]).sort(([x], [y]) => x - y).map(([, c]) => c);
     let probers = [probe], after; // after: what runs here once the containers are done

package/dist/config.js

@@ -3,6 +3,8 @@ import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { COUNTRIES, PROTOCOLS } from "./windscribe.js";
+// The speed test is hidden: every scan is connect-only, and a saved "on" reads as off. Its code stays; true brings it back
+export const SPEED_TEST = false;
 export const DEFAULT_TIMEOUT = 15;
 export const MIN_TIMEOUT = 10; // seconds; shorter cuts off connections that would have worked
 export const CONFIG = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "windscout", "config.json");
@@ -14,9 +16,10 @@ export function loadConfig() {
         return {
             countries: (c.countries ?? []).filter((x) => COUNTRIES.includes(x)),
             protocols: (c.protocols ?? []).filter((x) => PROTOCOLS.includes(x)),
-            speed: c.speed !== false,
+            speed: SPEED_TEST && c.speed !== false,
             firewall: c.firewall === true,
             random: c.random === true,
+            allPorts: c.allPorts === true,
             timeout: c.timeout >= MIN_TIMEOUT ? c.timeout : DEFAULT_TIMEOUT,
             docker: c.docker === true,
         };

package/dist/docker.js

@@ -105,12 +105,18 @@ export async function dockerState() {
     return "ready";
 }
 const WORKER_MEMORY = 250e6; // bytes per container: Windscribe's app and helper, a tunnel and node take ~120 MB
-const MAX_WORKERS = 8; // ponytail: past this, more containers mostly add load on the one uplink; raise if real scans say so
+// ponytail: past this, more containers mostly add load on the one uplink, and WireGuard keys on the account; raise if real scans say so
+const MAX_WORKERS = 16;
 /** Protocols the containers can't do, which a parallel scan runs on this computer after them: IKEv2 (Windscribe's Linux app
  * has none), and WireGuard when their kernel can't run its routing (see DOCKERFILE) */
-export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => p === "ikev2" || (p === "wireguard" && !wireguard)));
-/** Containers for a scan of this many attempts: one per attempt, within docker's CPUs and 3/4 of its memory */
-export const workerCount = (attempts) => Math.max(1, Math.min(attempts, MAX_WORKERS, info.cpus, Math.floor((info.memory * 0.75) / WORKER_MEMORY)));
+export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => /^ikev2(:|$)/.test(p) || (!wireguard && /^wireguard(:|$)/.test(p))));
+/** Containers for this many attempts, when docker can run at most `most`: one per attempt; past that, the fewest that need no
+ * more rounds (17 attempts, 16 at most: 9 containers make 2 rounds, as 16 would), since fewer log in sooner and register fewer keys */
+export const containersFor = (attempts, most) => attempts <= most ? Math.max(1, attempts) : Math.ceil(attempts / Math.ceil(attempts / most));
+// ponytail: rough seconds until n containers are logged in: in a test, 1 took 37 s, 16 at once 38-75 s; refine from real runs
+export const loginSeconds = (containers) => 35 + 2.5 * containers;
+/** Containers for a scan of this many attempts, within docker's CPUs and 3/4 of its memory */
+export const workerCount = (attempts) => containersFor(attempts, Math.max(1, Math.min(MAX_WORKERS, info.cpus, Math.floor((info.memory * 0.75) / WORKER_MEMORY))));
 const DMG = `https://desktop.docker.com/mac/main/${process.arch === "arm64" ? "arm64" : "amd64"}/Docker.dmg`;
 const START_DESKTOP = process.platform === "win32"
     ? { label: "start Docker Desktop", cmd: () => `start "" "${DESKTOP}"` }

package/dist/probe.js

@@ -27,11 +27,18 @@ export async function probe(query, protocol, { timeout, speedTest, stopped = ()
             }
             else if (s.includes("does not exist"))
                 return end("no such location");
+            // Windscribe refused this app another WireGuard key for the account: says nothing about this network
+            else if (s.includes("WireGuard key limit") && now() - t > 3)
+                return end("key limit");
             else if (s === "Disconnected" && now() - t > 3)
                 return end("failed");
             onStep(`connecting ${r.location}`.trim());
             await sleep(1000);
         }
+        // a port the app doesn't offer for the protocol: it connects on the protocol's default instead, so this port wasn't tried
+        const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol: .*:(\d+)\s*$/m)?.[1];
+        if (port && shown && shown !== port)
+            return end("no such port");
         await measure(async () => {
             onStep(`measuring latency · ${r.location}`);
             r.latencyMs = await latencyMs();

package/dist/tui/picker.js

@@ -1,9 +1,9 @@
-import { loadDockerWireGuard, MIN_TIMEOUT, saveConfig } from "../config.js";
-import { dockerState, notInContainers, workerCount } from "../docker.js";
+import { loadDockerWireGuard, MIN_TIMEOUT, saveConfig, SPEED_TEST } from "../config.js";
+import { dockerState, loginSeconds, notInContainers, workerCount } from "../docker.js";
 import { attemptSeconds, estimate } from "../scan.js";
 import { duration } from "../time.js";
 import { canUpdate, checkUpdate, versionLines } from "../update.js";
-import { COUNTRIES, PROTOCOLS } from "../windscribe.js";
+import { COUNTRIES, protocolPorts, PROTOCOLS } from "../windscribe.js";
 import { countryName, flag } from "./country.js";
 import { setupDocker } from "./docker.js";
 import { draw, enterScreen, input, leaveScreen, out, repoLink } from "./terminal.js";
@@ -11,18 +11,21 @@ import { bold, cyan, dim, green, under, vw, yellow } from "./text.js";
 import { box, centerIn, grid } from "./widgets.js";
 const flip = (set, value) => (set.has(value) ? set.delete(value) : set.add(value));
 /** Resolves to the choice (also saved for next time), null when the user quits, or "update" for u */
-export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
+export function pick(saved, { timeout, speedTest, firewall, random, allPorts, docker }) {
     const selected = new Set(saved?.countries ?? []);
     const protos = new Set(saved?.protocols.length ? saved.protocols : PROTOCOLS);
     let cursor = 0, top = 0, message = "", query = "", searching = false;
     let seconds = String(timeout), editing = false; // the timeout, as typed
     let dockerAt = null, inDialog = false; // docker's state once checked; a docker dialog has the screen
+    let portLists = null; // each protocol's ports, once the app said
     let hit;
     const visible = () => {
         const q = query.toLowerCase();
         return q ? COUNTRIES.filter((c) => c.toLowerCase().includes(q) || countryName(c).toLowerCase().includes(q)) : COUNTRIES;
     };
-    const attempts = () => selected.size * protos.size;
+    const ports = (p) => (allPorts && portLists?.get(p)?.length) || 1; // attempts per country for the protocol
+    const perCountry = (ps) => [...ps].reduce((n, p) => n + ports(p), 0);
+    const attempts = () => selected.size * perCountry(protos);
     const wireguard = loadDockerWireGuard(); // in docker containers, as the last parallel scan found
     enterScreen();
     return new Promise((resolve) => {
@@ -40,6 +43,12 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 top = cursor - height + 1;
             top = Math.max(0, Math.min(top, matches.length - height));
             const protoLine = PROTOCOLS.map((p, i) => `${dim(under(String(i + 1)))} ${protos.has(p) ? green("● " + p) : dim("○ " + p)}`).join("   ");
+            const listed = portLists && [...portLists.values()].some((l) => l.length), each = perCountry(protos);
+            const portsLine = `${dim(under("p"))} ${allPorts ? green("● all ports") : dim("○ all ports")}  ${dim(!allPorts
+                ? "off: each protocol on its default port"
+                : !portLists ? "checking the ports…"
+                    : !listed ? "this Windscribe app can't list its ports: 2.22 and newer can"
+                        : `every port of each protocol: ${each} attempt${each === 1 ? "" : "s"} per country${each > protos.size ? `, not ${protos.size}` : ""}`)}`;
             const speedLine = `${dim(under("s"))} ${speedTest ? green("● speed test") : dim("○ speed test")}  ${dim(speedTest
                 ? "ranks by download speed · adds ~15s per working connection"
                 : "off: connect-only, ranks by latency")}`;
@@ -55,8 +64,10 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
             const timeoutLine = `${dim(under("t"))} timeout ${editing ? bold(seconds) + cyan("▏") : (short ? yellow : bold)(seconds || "?")} s  ${dim(`per connection · at least ${MIN_TIMEOUT}`)}`;
             const n = attempts();
             const here = PROTOCOLS.filter((p) => docker && protos.has(p) && notInContainers(PROTOCOLS, wireguard).has(p)); // after the containers
-            const inContainers = selected.size * (protos.size - here.length);
-            const slots = docker && dockerAt === "ready" && inContainers ? workerCount(inContainers) : 1;
+            const inContainers = selected.size * perCountry([...protos].filter((p) => !here.includes(p)));
+            const parallel = docker && dockerAt === "ready" && inContainers > 0;
+            const slots = parallel ? workerCount(inContainers) : 1;
+            const login = parallel ? loginSeconds(slots) : 0; // the containers log in before the scan starts
             const dockerLabel = "parallel scan in docker containers";
             const dockerLine = `${dim(under("d"))} ${docker ? green("● " + dockerLabel) : dim("○ " + dockerLabel)}  ${dim(!docker
                 ? "off: one attempt at a time"
@@ -82,9 +93,10 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 ["quit", under("Q") + "uit"],
             ];
             const buttonLine = buttons.map(([id, label]) => (id === "start" ? bold(cyan(`[ ${label} ]`)) : dim(`[ ${label} ]`))).join("  ");
-            const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(...[protoLine, speedLine, fwLine, randomLine, timeoutLine, dockerLine].map(vw)) + 4 });
+            const settings = [protoLine, portsLine, ...(SPEED_TEST ? [speedLine] : []), fwLine, randomLine, timeoutLine, dockerLine];
+            const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(...settings.map(vw)) + 4 });
             const width = vw(table[0]);
-            const head = box([protoLine, speedLine, fwLine, randomLine, timeoutLine, dockerLine], {
+            const head = box(settings, {
                 title: bold(cyan("WindScout")),
                 right: `${bold(String(selected.size))}${dim(`/${COUNTRIES.length} selected`)}`,
                 width: width - 4,
@@ -96,7 +108,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 centerIn(buttonLine, width),
                 "",
                 centerIn(n
-                    ? `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(estimate(inContainers, timeout, slots) + estimate(n - inContainers, timeout)))} ${dim(`(~${attemptSeconds(timeout)}s each${slots > 1 ? `, ${slots} at a time` : ""})`)}`
+                    ? `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(login + estimate(inContainers, timeout, slots) + estimate(n - inContainers, timeout)))} ${dim(`(~${attemptSeconds(timeout)}s each${slots > 1 ? `, ${slots} at a time` : ""}${login ? `, + ~${duration(login)} login` : ""})`)}`
                     : yellow("select at least one country and one protocol"), width),
                 centerIn(dim(editing
                     ? "type the seconds to wait for each connection · enter/esc done"
@@ -104,13 +116,14 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                         ? "type to filter · ↑↓ move · enter/esc done"
                         // both lines fit 80 columns
                         : `↑↓ move · space select · a/n ${query ? "all/none shown · esc clear" : "all/none · / search"} · enter start · q quit`), width),
-                centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · s speed test · f firewall · r random · t timeout · d docker`), width),
+                centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · p ports${SPEED_TEST ? " · s speed" : ""} · f firewall · r random · t timeout · d docker`), width),
             ];
             if (message)
                 lines.push(centerIn(yellow(message), width));
             lines.push("", ...version.map((l) => centerIn(l, width)), centerIn(dim(repoLink), width));
             const at = draw(lines);
             // click map, in screen coordinates
+            const row = (line) => at.top + 1 + settings.indexOf(line); // a settings line, under the box's top border
             let px = at.left + 2; // "│ " before the protocol line
             const protoHits = PROTOCOLS.map((p, i) => {
                 const len = vw(`${i + 1} ● ${p}`);
@@ -126,7 +139,8 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 return range;
             });
             hit = {
-                protoRow: at.top + 1, protoHits, speedRow: at.top + 2, firewallRow: at.top + 3, randomRow: at.top + 4, timeoutRow: at.top + 5, dockerRow: at.top + 6,
+                protoRow: row(protoLine), protoHits, portsRow: row(portsLine), speedRow: SPEED_TEST ? row(speedLine) : -1,
+                firewallRow: row(fwLine), randomRow: row(randomLine), timeoutRow: row(timeoutLine), dockerRow: row(dockerLine),
                 searchRow: at.top + head.length + 1,
                 firstRow: at.top + head.length + 5, shown: shown.length,
                 buttonRow: at.top + head.length + table.length + 1, buttonHits,
@@ -136,6 +150,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
         checkUpdate().then(() => !closed && render()); // the check usually lands after the first draw
         if (docker)
             dockerState().then((s) => ((dockerAt = s), !closed && render()));
+        protocolPorts().then((l) => ((portLists = l), !closed && render()));
         const finish = (value) => {
             closed = true;
             out.off("resize", render);
@@ -161,6 +176,7 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 speed: speedTest,
                 firewall,
                 random,
+                allPorts,
                 timeout,
                 docker,
             };
@@ -214,6 +230,8 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                     if (i >= 0)
                         flip(protos, PROTOCOLS[i]);
                 }
+                else if (y === hit.portsRow)
+                    allPorts = !allPorts;
                 else if (y === hit.speedRow)
                     speedTest = !speedTest;
                 else if (y === hit.firewallRow)
@@ -294,7 +312,9 @@ export function pick(saved, { timeout, speedTest, firewall, random, docker }) {
                 matches.forEach((c) => selected.add(c));
             else if (k === "n")
                 matches.forEach((c) => selected.delete(c));
-            else if (k === "s")
+            else if (k === "p")
+                allPorts = !allPorts;
+            else if (k === "s" && SPEED_TEST)
                 speedTest = !speedTest;
             else if (k === "f")
                 firewall = !firewall;

package/dist/tui/progress.js

@@ -24,7 +24,9 @@ export function showProgress(scan, blocking) {
         const eta = (total - done) * (done ? elapsed / done : attemptSeconds(timeout) / slots.length);
         const spinner = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"[frame++ % 10];
         const ok = sortOk(results);
-        const failed = finished.filter((c) => !results.some((r) => r.query === c && r.status === "ok"));
+        // blocked: nothing worked, and something was really tried (a key limit or a port the app doesn't offer tries nothing)
+        const failed = finished.filter((c) => !results.some((r) => r.query === c && r.status === "ok")
+            && results.some((r) => r.query === c && r.status !== "key limit" && r.status !== "no such port"));
         const attempt = ({ current: c }) => (c ? `${flag(c.country)} ${countryName(c.country)} ${dim("·")} ${c.protocol}` : "");
         const many = slots.length > 1; // a parallel scan: a line per container
         const pct = bold(`${String(Math.floor(fraction * 100)).padStart(3)}%`);

package/dist/tui/report.js

@@ -30,6 +30,15 @@ export function report(results, protocols, { all, speedTest }) {
     console.log();
     if (avail.length)
         console.log(avail.join("\n"));
+    const limited = results.filter((r) => r.status === "key limit");
+    if (limited.length) {
+        const many = limited.length > 1, list = (xs) => [...new Set(xs)].join(",");
+        console.log([
+            yellow(`⚠ ${limited.length} WireGuard attempt${many ? "s" : ""} hit your Windscribe account's limit of WireGuard keys`),
+            dim(`  (each docker container registers a key of its own), so ${many ? "these don't" : "it doesn't"} show whether WireGuard works from here.`),
+            `  To find out, scan ${many ? "them" : "it"} on this computer: ${cyan(`windscout -c "${list(limited.map((r) => r.query))}" -p ${list(limited.map((r) => r.protocol))}`)}`,
+        ].join("\n"));
+    }
     if (!ok.length) {
         console.log(box([yellow("Nothing connected."),
             dim("Try other countries, ports (e.g. -p stealth:443,tcp:443) or a longer --timeout.")], { title: bold(cyan("WindScout")), width: width - 4 }).join("\n"));
@@ -37,7 +46,7 @@ export function report(results, protocols, { all, speedTest }) {
     }
     console.log(main.join("\n"));
     const stats = protocols.map((p) => {
-        const tried = results.filter((r) => r.protocol === p && r.status !== "no such location");
+        const tried = results.filter((r) => r.protocol === p && !["no such location", "key limit", "no such port"].includes(r.status));
         const good = tried.filter((r) => r.status === "ok");
         return { p, good: good.length, tried: tried.length, best: sortOk(good).at(0) };
     }).sort((x, y) => y.good - x.good || (y.best?.speedMbps ?? 0) - (x.best?.speedMbps ?? 0) || (x.best?.latencyMs ?? 1e9) - (y.best?.latencyMs ?? 1e9));

package/dist/tui/tables.js

@@ -1,5 +1,5 @@
 import { countryName, flag } from "./country.js";
-import { bold, dim, fmt, green, red } from "./text.js";
+import { bold, dim, fmt, green, red, yellow } from "./text.js";
 import { grid } from "./widgets.js";
 const RESULT_COLS = [
     { title: "#", align: "right" }, { title: "Country" }, { title: "Location" }, { title: "Protocol" },
@@ -14,15 +14,27 @@ const resultRow = (r, i) => [
     r.connectS === null ? "-" : `${fmt(r.connectS, 1)} s`,
     r.latencyMs === null ? "-" : `${fmt(r.latencyMs, 0)} ms`,
     r.speedMbps === null ? "-" : bold(`${fmt(r.speedMbps, 1)} Mbps`),
-    r.status === "ok" ? green("✓ ok") : red(r.status),
+    r.status === "ok" ? green("✓ ok") : r.status === "key limit" || r.status === "no such port" ? yellow(r.status) : red(r.status),
 ];
 /** Numbered attempts, in the given order; the Speed column only when the speed test ran */
 export function resultTable(results, speedTest, options) {
     const keep = (_, i) => speedTest || i !== SPEED_COL;
     return grid(RESULT_COLS.filter(keep), results.map((r, i) => resultRow(r, i).filter(keep)), options);
 }
-/** One row per country, ✓/✗ per protocol (· = not tried yet); no lines until something was tried */
+const base = (protocol) => protocol.split(":")[0];
+/** A protocol's cell: ✓/✗, with how many of its ports worked when it has several (✓ 3/11); · = not tried yet,
+ * key limit = couldn't try WireGuard, no port = the app doesn't offer it. Those last two don't count */
+function cell(rs, ports) {
+    const tried = rs.filter((r) => ports.includes(r.protocol));
+    const real = tried.filter((r) => r.status !== "key limit" && r.status !== "no such port");
+    const good = real.filter((r) => r.status === "ok").length, count = ports.length > 1 ? ` ${good}/${real.length}` : "";
+    if (real.length)
+        return good ? green(`✓${count}`) : red(`✗${count}`);
+    return tried.some((r) => r.status === "key limit") ? yellow("key limit") : tried.length ? yellow("no port") : dim("·");
+}
+/** One row per country, a cell per protocol (its ports share it); no lines until something was tried */
 export function matrix(results, protocols, { minWidth = 0, limit = Infinity } = {}) {
+    const columns = [...new Set(protocols.map(base))].map((b) => protocols.filter((p) => base(p) === b));
     const byCountry = new Map();
     for (const r of results) {
         if (r.status === "no such location" || r.status === "interrupted")
@@ -45,15 +57,13 @@ export function matrix(results, protocols, { minWidth = 0, limit = Infinity } =
             [
                 `${flag(q)} ${countryName(q)}`,
                 first,
-                ...protocols.map((p) => {
-                    const r = rs.find((x) => x.protocol === p);
-                    return !r ? dim("·") : r.status === "ok" ? green("✓") : red("✗");
-                }),
+                ...columns.map((ports) => cell(rs, ports)),
             ],
-            ...more.map((place) => ["", place, ...protocols.map(() => "")]),
+            ...more.map((place) => ["", place, ...columns.map(() => "")]),
         ];
     }).slice(0, limit);
-    return grid([{ title: "Country" }, { title: "Location(s)" }, ...protocols.map((p) => ({ title: p, align: "center" }))], rows, {
+    return grid([{ title: "Country" }, { title: "Location(s)" },
+        ...columns.map((ports) => ({ title: ports.length > 1 ? base(ports[0]) : ports[0], align: "center" }))], rows, {
         caption: bold("Availability"),
         captionRight: dim(`${reachable}/${ranked.length} countries reachable${ranked.length > limit ? ` · top ${limit}` : ""}`),
         minWidth,

package/dist/windscribe.js

@@ -15,6 +15,19 @@ const DESKTOP_CLI = {
 let cliBin = CLI;
 // IKEv2 is offered by the macOS/Windows apps only
 export const PROTOCOLS = ["wireguard", ...(process.platform === "linux" ? [] : ["ikev2"]), "stealth", "wstunnel", "udp", "tcp"];
+let portLists;
+/** The ports the app offers for each protocol, its default first; [] where it lists none (IKEv2 on Linux, or apps before 2.22,
+ * which have no `ports`). Asked once, one protocol at a time: windscribe-cli runs one at a time */
+export const protocolPorts = () => (portLists ??= (async () => {
+    const lists = new Map();
+    for (const p of PROTOCOLS) {
+        const out = await windscribe("ports", p).catch(() => ""); // can't ask: no list, so the default port
+        lists.set(p, out.match(/^\d+(, \d+)*$/m)?.[0].split(", ").map(Number) ?? []);
+    }
+    return lists;
+})());
+/** Each protocol given without a port, on every port in lists: "tcp" → "tcp:443", "tcp:587", …; the rest as given */
+export const withPorts = (protocols, lists) => protocols.flatMap((p) => (!p.includes(":") && lists.get(p)?.length ? lists.get(p).map((port) => `${p}:${port}`) : [p]));
 // ponytail: hardcoded because `windscribe-cli locations` returns nothing on 2.24; refresh when Windscribe adds countries
 export const COUNTRIES = `US CA MX BR AR CL CO PE GB IE FR DE NL BE LU CH AT IT ES PT DK NO SE FI IS
 PL CZ SK HU RO BG GR CY TR RS HR SI BA MK AL MD UA EE LV LT IL AE AZ GE AM KZ IN JP KR

package/dist/worker.js

@@ -41,9 +41,10 @@ export async function worker() {
     writeFileSync(SETTINGS, withSession(ini, session));
     // no systemd in a container: start the app like its unit would, as this user (its CLI refuses root)
     spawn(APP, { stdio: "ignore" }).on("error", () => { }); // not there: its CLI never answers below
-    // its CLI answers once it's up, and says logged in once Windscribe accepts the session, or the error it got instead
+    // its CLI answers once it's up, and says logged in once Windscribe accepts the session, or the error it got instead.
+    // One container took 37 s in a test, 16 at once 38-75 s
     let status = "";
-    for (const t = now(); now() - t < 120 && !/Login state: (Logged in|Error)/.test(status = await windscribe("status"));)
+    for (const t = now(); now() - t < 180 && !/Login state: (Logged in|Error)/.test(status = await windscribe("status"));)
         await sleep(1000);
     if (!status.includes("Logged in")) {
         const state = status.match(/^Login state: (.*)$/m)?.[1].trim();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windscout",
-  "version": "0.6.1",
-  "description": "Find which Windscribe locations and protocols work from your network, ranked by speed (unofficial)",
+  "version": "0.6.4",
+  "description": "Find which Windscribe locations and protocols work from your network, ranked by latency (unofficial)",
   "type": "module",
   "bin": {
     "windscout": "dist/cli.js"
@@ -25,14 +25,12 @@
   "keywords": [
     "windscribe",
     "vpn",
-    "speedtest",
     "wireguard",
     "stealth",
     "cli",
     "censorship",
     "firewall",
     "unblock",
-    "vpn-speed-test",
     "server-finder",
     "docker"
   ],