windscout 0.7.0 → 0.9.0

package/dist/docker.js

@@ -29,7 +29,7 @@ const REGISTRIES = [...(process.env.WINDSCOUT_REGISTRY_MIRRORS?.split(",").map((
 // openresolv: the app sets the tunnel's DNS through resolvconf; without it, DNS goes nowhere once connected.
 // The CMD first checks the kernel (WSL's builds tun and parts of nftables as modules): no tun or nftables, no tunnel, so
 // the container stops saying so instead of scanning. The helper's WireGuard routing also puts a fib rule in an inet table,
-// which Docker Desktop's own kernel (macOS, Windows without WSL) can't run: WS_WIREGUARD=0 then, and it runs on this computer.
+// which Docker Desktop's own kernel (macOS, Windows without WSL) can't run: WS_WIREGUARD=0 then, and a parallel scan skips it.
 // No systemd in a container: start the helper (root) like its unit would; the worker starts the app once it has the session
 const DOCKERFILE = `FROM ${BASE_TAG}
 ENV LANG=C.UTF-8
@@ -67,10 +67,11 @@ export const INSTALL_DOCS = {
     win32: "https://docs.docker.com/desktop/setup/install/windows-install/",
 }[process.platform] ?? "https://docs.docker.com/engine/install/";
 const lastLine = (s) => s.trim().split("\n").at(-1)?.trim() ?? "";
-/** Runs a command (a shell line when args is null); onLine gets its output as it comes, curl's progress too. code -1: not installed */
-function exec(cmd, args, { input, onLine = () => { }, timeout } = {}) {
+/** Runs a command (a shell line when args is null); onLine gets its output as it comes, curl's progress too. code -1: not
+ * installed (or aborted) */
+function exec(cmd, args, { input, onLine = () => { }, timeout, signal } = {}) {
     return new Promise((resolve) => {
-        const p = args ? spawn(cmd, args, { timeout }) : spawn(cmd, { shell: true, timeout });
+        const p = args ? spawn(cmd, args, { timeout, signal }) : spawn(cmd, { shell: true, timeout, signal });
         let out = "";
         const take = (d) => {
             out = (out + d).slice(-20_000);
@@ -92,23 +93,25 @@ async function docker(args, options) {
     process.env.PATH = dirname(DESKTOP_CLI) + delimiter + process.env.PATH;
     return exec("docker", args, options);
 }
-let info = { cpus: 0, memory: 0, os: "linux" }; // docker's, from the last dockerState() that found it ready
+let info = { cpus: 0, memory: 0, os: "linux", name: "" }; // docker's, from the last dockerState() that found it ready
 /** ready: the daemon answers us. denied: it runs, but this user may not use it (Linux: not in the docker group yet) */
 export async function dockerState() {
-    const r = await docker(["info", "--format", "{{.NCPU}} {{.MemTotal}} {{.OSType}}"], { timeout: 30_000 });
+    const r = await docker(["info", "--format", "{{.NCPU}} {{.MemTotal}} {{.OSType}} {{.OperatingSystem}}"], { timeout: 30_000 });
     if (r.code === -1)
         return DESKTOP && existsSync(DESKTOP) ? "stopped" : "missing";
     if (r.code)
         return /permission denied/i.test(r.out) ? "denied" : "stopped";
-    const [cpus, memory, os] = r.out.trim().split(/\s+/);
-    info = { cpus: Number(cpus), memory: Number(memory), os };
+    const [cpus, memory, os, ...name] = r.out.trim().split(/\s+/);
+    info = { cpus: Number(cpus), memory: Number(memory), os, name: name.join(" ") };
     return "ready";
 }
+/** Docker runs on this computer's own Linux kernel, as docker does on Linux, not in Docker Desktop's VM */
+export const nativeDocker = () => process.platform === "linux" && !/Docker Desktop/i.test(info.name);
 const WORKER_MEMORY = 250e6; // bytes per container: Windscribe's app and helper, a tunnel and node take ~120 MB
 // ponytail: past this, more containers mostly add load on the one uplink, and WireGuard keys on the account; raise if real scans say so
 const MAX_WORKERS = 16;
-/** Protocols the containers can't do, which a parallel scan runs on this computer after them: IKEv2 (Windscribe's Linux app
- * has none), and WireGuard when their kernel can't run its routing (see DOCKERFILE) */
+/** Protocols the containers can't do, which a parallel scan skips: IKEv2 (Windscribe's Linux app has none), and WireGuard
+ * when their kernel can't run its routing (see DOCKERFILE) */
 export const notInContainers = (protocols, wireguard) => new Set(protocols.filter((p) => /^ikev2(:|$)/.test(p) || (!wireguard && /^wireguard(:|$)/.test(p))));
 /** Containers for this many attempts, when docker can run at most `most`: one per attempt; past that, the fewest that need no
  * more rounds (17 attempts, 16 at most: 9 containers make 2 rounds, as 16 would), since fewer log in sooner and register fewer keys */
@@ -207,7 +210,7 @@ function fingerprint() {
 const answers = (registry) => fetch(`https://${registry === "docker.io" ? "registry-1.docker.io" : registry}/v2/`, { signal: AbortSignal.timeout(8000) })
     .then((r) => r.status === 200 || r.status === 401, () => false);
 /** Gets the image's base: from the first registry in REGISTRIES that answers and serves it */
-async function pullBase(onLine) {
+async function pullBase(onLine, signal) {
     if (!(await docker(["image", "inspect", BASE_TAG])).code)
         return;
     const up = await Promise.all(REGISTRIES.map(answers)); // asking them all at once: dead ones would each take the timeout
@@ -217,24 +220,29 @@ async function pullBase(onLine) {
     for (const registry of order) {
         onLine(`the base image, from ${registry}`);
         const ref = `${registry}/${BASE}`;
-        const r = await docker(["pull", ref], { onLine, timeout: 15 * 60_000 });
+        const r = await docker(["pull", ref], { onLine, timeout: 15 * 60_000, signal });
+        if (signal?.aborted)
+            throw new Error("stopped");
         if (!r.code)
             return void (await docker(["tag", ref, BASE_TAG]));
         why = `${registry}: ${lastLine(r.out)}`;
     }
     throw new Error(`couldn't get the containers' base image from Docker Hub or its mirrors (${why}). A VPN may help`);
 }
-/** Builds the containers' image, unless this windscout's is there already; onLine gets the build's output */
-export async function buildImage(onLine) {
+/** Builds the containers' image, unless this windscout's is there already; onLine gets the build's output. Aborting signal
+ * stops the build (it throws) */
+export async function buildImage(onLine, signal) {
     if (info.os === "windows")
         throw new Error("Docker Desktop runs Windows containers: switch it to Linux containers (right-click its icon by the clock), then try again");
     const tag = fingerprint();
     const have = await docker(["image", "inspect", "-f", '{{index .Config.Labels "windscout"}}', IMAGE]);
     if (!have.code && have.out.trim() === tag)
         return;
-    await pullBase(onLine);
+    await pullBase(onLine, signal);
     // no --progress=plain: when piped, BuildKit prints plain anyway, and a distribution's docker may have only the old builder
-    const r = await docker(["build", "--label", `windscout=${tag}`, "-t", IMAGE, "-f", "-", fileURLToPath(ROOT).replace(/[\\/]$/, "")], { input: DOCKERFILE, onLine });
+    const r = await docker(["build", "--label", `windscout=${tag}`, "-t", IMAGE, "-f", "-", fileURLToPath(ROOT).replace(/[\\/]$/, "")], { input: DOCKERFILE, onLine, signal });
+    if (signal?.aborted)
+        throw new Error("stopped");
     if (r.code)
         throw new Error(`building the containers' image failed: ${lastLine(r.out)}`);
 }
@@ -250,16 +258,27 @@ const running = new Map(); // container name → its `docker run`, until the con
 const removeAll = () => running.size && spawnSync("docker", ["rm", "-f", ...running.keys()], { stdio: "ignore" });
 process.on("exit", removeAll);
 /** Starts n containers, their apps logged in with this computer's session; resolves to a prober for each container that got
- * ready, and whether WireGuard works in them */
-export async function startWorkers(n, session, onStatus) {
+ * ready, and whether WireGuard works in them. network: the docker network they go on (docker's default bridge without);
+ * tag tells their names apart from another group's; aborting signal removes them (none gets ready then) */
+export async function startWorkers(n, session, onStatus, { network, tag = "", signal } = {}) {
     const measuring = mutex();
     let wireguard = true;
     let ready = 0;
+    const names = Array.from({ length: n }, (_, i) => `windscout-${process.pid}-${tag}${i + 1}`);
+    const remove = () => {
+        const left = names.filter((name) => running.has(name));
+        if (left.length)
+            spawn("docker", ["rm", "-f", ...left], { stdio: "ignore" }).on("error", () => { });
+    };
+    signal?.addEventListener("abort", remove, { once: true });
     const start = (i) => new Promise((resolve) => {
-        const name = `windscout-${process.pid}-${i + 1}`;
+        if (signal?.aborted)
+            return resolve(null);
+        const name = names[i];
         // its own volume keeps its app's settings for the next scans: its WireGuard keys, registered with Windscribe once
         // it makes /dev/net/tun itself: Docker's Linux VM may have none (WSL loads tun as a module), and --device needs one there
-        const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
+        const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, ...(network ? ["--network", network] : []),
+            "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
             "--sysctl", "net.ipv4.conf.all.src_valid_mark=1", "-v", `windscout-${i + 1}:/home/ws/.config/Windscribe`, IMAGE], { detached: process.platform !== "win32" }); // its own process group, so ctrl-c reaches only us (Windows would open a window)
         running.set(name, p);
         const send = (m) => p.stdin.write(JSON.stringify(m) + "\n");
@@ -288,7 +307,7 @@ export async function startWorkers(n, session, onStatus) {
         };
         p.on("error", (e) => gone(e.message));
         p.on("close", (code) => gone(lastLine(err) || `exited (${code})`));
-        const prober = (query, protocol, { timeout, speedTest, steady = false, stopped = () => false, onStep = () => { } }) => new Promise((done, reject) => {
+        const prober = (query, protocol, { timeout, speedTest, steady = 0, stopped = () => false, onStep = () => { } }) => new Promise((done, reject) => {
             if (dead)
                 return reject(new Error(`container ${i + 1} stopped: ${dead}`));
             let leave = null, over = false;
@@ -313,18 +332,44 @@ export async function startWorkers(n, session, onStatus) {
             };
             send({ probe: { query, protocol, timeout, speedTest, steady } });
         });
+        const whoami = () => new Promise((done) => {
+            if (dead)
+                return done("");
+            const late = setTimeout(() => done(""), 15_000);
+            fail = () => (clearTimeout(late), done(""));
+            on = (m) => typeof m.ip === "string" && (clearTimeout(late), done(m.ip));
+            send({ whoami: true });
+        });
         fail = (why) => (onStatus(`container ${i + 1}: ${why}`), resolve(null));
         on = (m) => {
-            if (!m.ready)
+            if (!m.ready || signal?.aborted)
                 return;
             wireguard &&= m.wireguard !== false;
             fail = () => { };
             onStatus(`${++ready} of ${n} ready`);
-            resolve(prober);
+            resolve({ name, prober, whoami, alive: () => !dead });
         };
     });
-    const probers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((p) => p !== null);
-    return { probers, wireguard };
+    const workers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((w) => w !== null);
+    signal?.removeEventListener("abort", remove);
+    if (signal?.aborted)
+        remove(); // got ready as it was aborted
+    return {
+        probers: workers.map((w) => w.prober),
+        wireguard,
+        whoami: async () => (await workers.find((w) => w.alive())?.whoami()) ?? "",
+        alive: () => workers.some((w) => w.alive()),
+        async stop() {
+            const names = workers.map((w) => w.name);
+            for (const name of names)
+                running.get(name)?.stdin?.end();
+            for (let i = 0; names.some((name) => running.has(name)) && i < 40; i++)
+                await sleep(250);
+            const stuck = names.filter((name) => running.has(name));
+            if (stuck.length)
+                spawnSync("docker", ["rm", "-f", ...stuck], { stdio: "ignore" });
+        },
+    };
 }
 /** Ends the containers once the scan is over: a worker exits when its stdin closes, and docker removes its container */
 export async function stopWorkers() {
@@ -334,3 +379,56 @@ export async function stopWorkers() {
         await sleep(250);
     removeAll(); // stuck ones: their docker run would keep us from exiting
 }
+// Routing the background checks' containers around this computer's VPN (native docker on Linux). Docker sends its containers'
+// traffic out by this computer's routes, so while the VPN is connected it goes through the VPN, and a container would test
+// from the VPN's server instead of your network. So they go on a docker network of their own, and a routing rule sends what
+// comes from it out the way this computer goes without the VPN: a table with main's default routes (Windscribe's VPN routes
+// are 0.0.0.0/1 and 128.0.0.0/1 in main, or its own table for WireGuard, never main's default). Windscribe's firewall filters
+// this computer's own traffic, not what it forwards, so it doesn't block them. Only traffic from that network is affected.
+// A container on the host's network sets it up: it takes no sudo, since whoever runs docker could do the same
+export const DIRECT_NETWORK = "windscout-direct";
+const TABLE = 2470; // ponytail: a routing table number nothing else is likely to use; the rules go at 89-90, before Windscribe's
+const ROUTE = `net=$1 t=$2
+while ip rule del from "$net" 2>/dev/null; do :; done
+ip route flush table "$t" 2>/dev/null
+[ "$3" = on ] || exit 0
+ip -4 route show table main default | sed -E 's/ (linkdown|dead|offload|trap|rt_offload|rt_trap|pervasive|notify)//g' |
+  while read -r r; do case "$r" in *" via "*) ip route add $r onlink table "$t" ;; *) ip route add $r table "$t" ;; esac; done
+[ -n "$(ip -4 route show table "$t")" ] || { echo "this computer has no default route to send them out by" >&2; exit 1; }
+ip rule add from "$net" to "$net" lookup main priority 89
+ip rule add from "$net" lookup "$t" priority 90`;
+let routed = ""; // the network routed around the VPN, until unroute()
+let routing = Promise.resolve(); // one change at a time: a rule taken away as it's put in could stay
+const oneAtATime = (change) => {
+    const p = routing.then(change);
+    routing = p.catch(() => { });
+    return p;
+};
+const route = (subnet, on) => ["run", "--rm", "--network", "host", "--cap-add", "NET_ADMIN", "--entrypoint", "sh", IMAGE, "-c", ROUTE, "route", subnet, String(TABLE), on ? "on" : "off"];
+/** windscout's own docker network for the background checks, created the first time; resolves to its subnet */
+export async function directNetwork() {
+    const subnet = async () => (await docker(["network", "inspect", "-f", "{{range .IPAM.Config}}{{.Subnet}} {{end}}", DIRECT_NETWORK]))
+        .out.split(/\s+/).find((s) => /^\d+\.\d+\.\d+\.\d+\/\d+$/.test(s)) ?? "";
+    if (!(await subnet()))
+        await docker(["network", "create", DIRECT_NETWORK]);
+    const s = await subnet();
+    if (!s)
+        throw new Error("couldn't create windscout's docker network");
+    return s;
+}
+/** Sends the traffic from the subnet out the way this computer goes without the VPN; again before each check, since the
+ * network may have changed (another Wi-Fi, another gateway) */
+export const routeAround = (subnet) => oneAtATime(async () => {
+    routed = subnet; // before it's in: a crash meanwhile takes it away
+    const r = await docker(route(subnet, true), { timeout: 60_000 });
+    if (r.code)
+        throw new Error(`couldn't route the containers around your VPN: ${lastLine(r.out) || `exit ${r.code}`}`);
+});
+/** Takes routeAround()'s rules and table away */
+export const unroute = () => oneAtATime(async () => {
+    if (routed)
+        await docker(route(routed, false), { timeout: 60_000 });
+    routed = "";
+});
+// a crash or a force quit: take the rule away on the way out (it only touches that network's traffic, so it's harmless if not)
+process.on("exit", () => routed && spawnSync("docker", route(routed, false), { stdio: "ignore", timeout: 30_000 }));

package/dist/measure.js

@@ -10,6 +10,18 @@ setDefaultResultOrder("ipv4first");
 const LATENCY_URL = "https://www.gstatic.com/generate_204";
 const SPEED_URL = "https://speed.cloudflare.com/__down?bytes=10000000";
 export const SPEED_SECONDS = 15;
+export const SPEED_MB = 10; // the most a speed test downloads
+const TRACE_URL = "https://www.cloudflare.com/cdn-cgi/trace"; // the speed test's Cloudflare: it says which IP asked
+/** The IP this connection goes out from, as Cloudflare sees it; "" when it didn't answer */
+export async function outsideIp() {
+    try {
+        const text = await (await fetch(TRACE_URL, { signal: AbortSignal.timeout(5000) })).text();
+        return text.match(/^ip=(\S+)/m)?.[1] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
 /** Best round trip of a few tries, in ms; null if none got through */
 export async function latencyMs(tries = 3) {
     let best = null;

package/dist/probe.js

@@ -1,18 +1,22 @@
 // One attempt: connect to a location over a protocol, measure through the tunnel, disconnect.
 // windscout connect makes the same attempt and, when it works, stays connected.
 import { latencyMs, SPEED_SECONDS, speedMbps } from "./measure.js";
-import { now, sleep } from "./time.js";
-import { connectState, windscribe } from "./windscribe.js";
+import { duration, now, sleep } from "./time.js";
+import { connectState, place, windscribe } from "./windscribe.js";
 // Stop at the first ends the scan at one connection, so that one has to last: a tunnel can connect and then be cut or throttled
-// once traffic flows. It counts once it downloads at MIN_MBPS or more, then stays up with internet for STEADY_CHECKS round trips
+// once traffic flows, or refuse the next connection, which is the one the user makes. So it counts once it downloads at
+// MIN_MBPS or more, holds up (holdsUp), downloads at MIN_MBPS or more again, and connects again as the user will
 export const MIN_MBPS = 1;
-const STEADY_CHECKS = 5, STEADY_GAP = 2; // seconds between the round trips
-// shortcut: guesses ~5 s to connect and the whole speed test; refine from real runs
-export const STEADY_SECONDS = 5 + SPEED_SECONDS + STEADY_CHECKS * (STEADY_GAP + 0.5);
+const STEADY_GAP = 2; // seconds between the hold's round trips
+// shortcut: guesses ~5 s to connect, the whole speed tests and ~10 s to reconnect; refine from real runs
+export const steadySeconds = (hold) => 5 + SPEED_SECONDS + hold + SPEED_SECONDS + 10;
 /** Whether stop at the first can stop at this result: it worked, held up, and is fast enough for real use */
 export const reliable = (r) => r.status === "ok" && (r.speedMbps ?? 0) >= MIN_MBPS;
-// "Connected: Miami - Vice" → "Miami - Vice"
-const place = (state) => state.split(":").slice(1).join(":").trim();
+/** Whether a hold's round trips so far (true: got through) still hold up: never 2 lost in a row (an outage), and no more
+ * than 1 in 10 lost (too lossy to use); fewer than 10 may lose 1 */
+export const holding = (trips) => !trips.some((ok, i) => !ok && trips[i - 1] === false) && trips.filter((ok) => !ok).length * 10 <= Math.max(10, trips.length);
+// nickname pins the exact datacenter: what the user connects with, and what the reconnect checks
+export const target = (r) => r.location.split(" - ").at(-1) || r.query;
 export async function probe(query, protocol, options) {
     try {
         return await attempt(query, protocol, options);
@@ -31,7 +35,7 @@ export async function disconnect() {
         await sleep(1000);
 }
 /** Connects and measures through the tunnel, as probe does, but leaves the connection as it is: up when it worked */
-export async function attempt(query, protocol, { timeout, speedTest, steady = false, stopped = () => false, onStep = () => { }, measure = (fn) => fn() }) {
+export async function attempt(query, protocol, { timeout, speedTest, steady = 0, stopped = () => false, onStep = () => { }, measure = (fn) => fn() }) {
     const r = { query, protocol, location: "", connectS: null, latencyMs: null, speedMbps: null };
     const end = (status) => ({ ...r, status });
     onStep("connecting");
@@ -56,42 +60,64 @@ export async function attempt(query, protocol, { timeout, speedTest, steady = fa
         // Windscribe refused this app another WireGuard key for the account: says nothing about this network
         else if (s.includes("WireGuard key limit") && now() - t > 3)
             return end("key limit");
-        else if (s === "Disconnected" && now() - t > 3)
+        // an error the app gave up with ("Error: WireGuard adapter setup failed", out of data, …): no need to wait out the timeout
+        else if ((s === "Disconnected" || s.startsWith("Error")) && now() - t > 3)
             return end("failed");
         onStep(`connecting ${r.location}`.trim());
         await sleep(1000);
     }
     // a port the app doesn't offer for the protocol: it connects on the protocol's default instead, so this port wasn't tried
-    const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol: .*:(\d+)\s*$/m)?.[1];
+    const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol:[ \t]*\S*:(\d+)\s*$/m)?.[1];
     if (port && shown && shown !== port)
         return end("no such port");
-    let measured = false, holds = true;
+    let status = "interrupted", reconnect = false; // reconnect: it passed the other checks, so the reconnect is next
     await measure(async () => {
         // a stopping scan waits for no more measurements: a parallel scan's containers measure one at a time, so they'd queue up
         if (stopped())
             return;
-        measured = true;
         onStep(`measuring latency · ${r.location}`);
         r.latencyMs = await latencyMs();
         if (r.latencyMs === null)
-            return;
+            return void (status = "no internet");
         if (speedTest || steady) {
             onStep(`measuring speed · ${r.location}`);
             r.speedMbps = await speedMbps();
         }
-        if (steady)
-            holds = await holdsUp(r.location, onStep);
+        status = "ok";
+        const first = r.speedMbps ?? 0;
+        if (!steady || first < MIN_MBPS)
+            return; // the scan never stops at a slower one, so it goes without the checks
+        const held = await holdsUp(steady, r.location, stopped, onStep);
+        if (held !== true)
+            return void (status = held === "interrupted" ? held : "unreliable");
+        onStep(`measuring speed again · ${r.location}`);
+        r.speedMbps = Math.min(first, (await speedMbps()) ?? 0); // throttled once traffic flowed: the slower one counts
+        if (r.speedMbps < MIN_MBPS)
+            return void (status = "unreliable");
+        reconnect = true;
     });
-    if (!measured)
-        return end("interrupted");
-    return end(r.latencyMs === null ? "no internet" : holds ? "ok" : "unreliable");
+    if (!reconnect)
+        return end(status);
+    // after its turn to measure: the next container can start while this one connects again, as the user will
+    onStep(`reconnecting · ${r.location}`);
+    await disconnect();
+    const { status: again } = await attempt(target(r), protocol, { timeout, speedTest: false, stopped });
+    return end(again === "ok" || again === "interrupted" ? again : "unreliable");
 }
-/** Whether the connection stays up with internet through it: STEADY_CHECKS round trips, STEADY_GAP seconds apart, each with a retry */
-async function holdsUp(location, onStep) {
-    for (let i = 1; i <= STEADY_CHECKS; i++) {
-        onStep(`checking it holds up ${i}/${STEADY_CHECKS} · ${location}`);
+/** Whether the connection holds up for seconds: connected to the same server the whole time, with a round trip through it
+ * every STEADY_GAP seconds, as long as they're holding(); "interrupted" when the scan stops first */
+async function holdsUp(seconds, location, stopped, onStep) {
+    const trips = [];
+    for (const t = now(); now() - t < seconds;) {
+        if (stopped())
+            return "interrupted";
+        onStep(`checking it holds up ${duration(now() - t)}/${duration(seconds)} · ${location}`);
         await sleep(STEADY_GAP * 1000);
-        if (!(await connectState()).startsWith("Connected") || (await latencyMs(2)) === null)
+        const s = await connectState(); // dropped, or the app moved it to another server
+        if (!s.startsWith("Connected") || (location && s.includes(":") && place(s) !== location))
+            return false;
+        trips.push((await latencyMs(1)) !== null);
+        if (!holding(trips))
             return false;
     }
     return true;

package/dist/scan.js

@@ -29,7 +29,6 @@ export class Scan {
     protocols;
     options;
     probers;
-    after;
     results = [];
     finished = []; // countries with every attempt done: the views refresh their tables per country
     errors = []; // why slots stopped early
@@ -46,16 +45,13 @@ export class Scan {
     idle = 0; // seconds spent paused
     resume = () => { };
     unpaused = Promise.resolve();
-    constructor(countries, protocols, options, probers = [probe], after) {
+    constructor(countries, protocols, options, probers = [probe]) {
         this.countries = countries;
         this.protocols = protocols;
         this.options = options;
         this.probers = probers;
-        this.after = after;
         this.total = this.attempts().length;
         this.slots = probers.map(() => ({ current: null, step: "", attemptStart: now() }));
-        if (after)
-            this.slots.push({ current: null, step: "", attemptStart: now(), name: after.name });
     }
     /** Seconds spent scanning, pauses not counted */
     elapsed() {
@@ -87,16 +83,13 @@ export class Scan {
         const left = new Map(); // attempts to go, per country
         for (const { country } of queue)
             left.set(country, (left.get(country) ?? 0) + 1);
-        const later = this.after?.protocols ?? new Set();
-        await Promise.all(this.probers.map((prober, i) => this.work(prober, this.slots[i], (p) => !later.has(p), queue, left, hooks)));
-        // then the rest, also what slots whose container stopped left over
-        if (this.after)
-            await this.work(this.after.prober, this.slots[this.probers.length], () => true, queue, left, hooks);
+        // when every slot's container stops, what they left isn't tried: scan.errors says why
+        await Promise.all(this.probers.map((prober, i) => this.work(prober, this.slots[i], queue, left, hooks)));
         return this.results;
     }
-    /** One slot: takes the attempts it can make from the queue, one at a time, until there are none */
-    async work(prober, slot, can, queue, left, hooks) {
-        const { timeout, speedTest, stopAtFirst = false } = this.options;
+    /** One slot: takes the attempts from the queue, one at a time, until there are none */
+    async work(prober, slot, queue, left, hooks) {
+        const { timeout, speedTest, stopAtFirst = 0 } = this.options;
         for (;;) {
             while (this.paused && !this.stopping) {
                 if (!this.waiting && this.slots.every((s) => !s.current)) { // the last running attempt is over
@@ -105,10 +98,9 @@ export class Scan {
                 }
                 await this.unpaused;
             }
-            const i = this.stopping ? -1 : queue.findIndex((a) => can(a.protocol));
-            if (i < 0)
+            const next = this.stopping ? undefined : queue.shift();
+            if (!next)
                 return;
-            const [next] = queue.splice(i, 1);
             const { country, protocol } = next;
             Object.assign(slot, { current: next, step: "", attemptStart: now() });
             hooks.attempt?.(country, protocol);

package/dist/time.js

@@ -2,6 +2,11 @@
 export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** Seconds on a monotonic clock */
 export const now = () => performance.now() / 1000;
+/** "just now", "5m ago", "3h ago", "2 days ago", for a time in ms since the epoch */
+export function ago(ms) {
+    const m = Math.max(0, Math.round((Date.now() - ms) / 60000)), h = Math.round(m / 60), d = Math.round(h / 24);
+    return m < 1 ? "just now" : m < 60 ? `${m}m ago` : h < 48 ? `${h}h ago` : `${d} days ago`;
+}
 /** "9s", "1m 05s", "1h 01m" */
 export function duration(sec) {
     sec = Math.max(0, Math.round(sec));

package/dist/tui/connect.js

@@ -0,0 +1,29 @@
+// Connecting to the working connections a scan found, without a terminal (windscout connect in a script): one line each.
+// In a terminal, the results screen (results.ts) connects and keeps you connected instead.
+import { attempt, disconnect, target } from "../probe.js";
+import { duration, now } from "../time.js";
+import { label } from "../watch.js";
+import { command } from "./report.js";
+import { cyan, green, yellow } from "./text.js";
+/** Runs a result's connect command and checks it as the scan does: connected, on its port, with internet through it.
+ * True once it is; otherwise disconnects (and waits until the app has), so the next connect isn't swallowed */
+async function connectTo(r, timeout, stopped) {
+    console.log(cyan(command(r)));
+    const t = now(), { status, location } = await attempt(target(r), r.protocol, { timeout, speedTest: false, stopped });
+    if (status === "ok")
+        return console.log(green(`Connected: ${location}`)), true;
+    console.log(yellow(`${status} after ${duration(now() - t)}`));
+    await disconnect();
+    return false;
+}
+/** Connects to list[from], or when it doesn't connect, to the next ones in turn, around to the one before it.
+ * The index of the one that connected; -1 when none did */
+export async function connectFrom(list, from, timeout, stopped = () => false) {
+    for (let k = 0; k < list.length && !stopped(); k++) {
+        const i = (from + k) % list.length;
+        console.log(`\n${k + 1}/${list.length} ${label(list[i])}`);
+        if (await connectTo(list[i], timeout, stopped))
+            return i;
+    }
+    return -1;
+}