windscout 0.7.1 → 0.9.0

package/dist/docker.js

@@ -67,10 +67,11 @@ export const INSTALL_DOCS = {
     win32: "https://docs.docker.com/desktop/setup/install/windows-install/",
 }[process.platform] ?? "https://docs.docker.com/engine/install/";
 const lastLine = (s) => s.trim().split("\n").at(-1)?.trim() ?? "";
-/** Runs a command (a shell line when args is null); onLine gets its output as it comes, curl's progress too. code -1: not installed */
-function exec(cmd, args, { input, onLine = () => { }, timeout } = {}) {
+/** Runs a command (a shell line when args is null); onLine gets its output as it comes, curl's progress too. code -1: not
+ * installed (or aborted) */
+function exec(cmd, args, { input, onLine = () => { }, timeout, signal } = {}) {
     return new Promise((resolve) => {
-        const p = args ? spawn(cmd, args, { timeout }) : spawn(cmd, { shell: true, timeout });
+        const p = args ? spawn(cmd, args, { timeout, signal }) : spawn(cmd, { shell: true, timeout, signal });
         let out = "";
         const take = (d) => {
             out = (out + d).slice(-20_000);
@@ -92,18 +93,20 @@ async function docker(args, options) {
     process.env.PATH = dirname(DESKTOP_CLI) + delimiter + process.env.PATH;
     return exec("docker", args, options);
 }
-let info = { cpus: 0, memory: 0, os: "linux" }; // docker's, from the last dockerState() that found it ready
+let info = { cpus: 0, memory: 0, os: "linux", name: "" }; // docker's, from the last dockerState() that found it ready
 /** ready: the daemon answers us. denied: it runs, but this user may not use it (Linux: not in the docker group yet) */
 export async function dockerState() {
-    const r = await docker(["info", "--format", "{{.NCPU}} {{.MemTotal}} {{.OSType}}"], { timeout: 30_000 });
+    const r = await docker(["info", "--format", "{{.NCPU}} {{.MemTotal}} {{.OSType}} {{.OperatingSystem}}"], { timeout: 30_000 });
     if (r.code === -1)
         return DESKTOP && existsSync(DESKTOP) ? "stopped" : "missing";
     if (r.code)
         return /permission denied/i.test(r.out) ? "denied" : "stopped";
-    const [cpus, memory, os] = r.out.trim().split(/\s+/);
-    info = { cpus: Number(cpus), memory: Number(memory), os };
+    const [cpus, memory, os, ...name] = r.out.trim().split(/\s+/);
+    info = { cpus: Number(cpus), memory: Number(memory), os, name: name.join(" ") };
     return "ready";
 }
+/** Docker runs on this computer's own Linux kernel, as docker does on Linux, not in Docker Desktop's VM */
+export const nativeDocker = () => process.platform === "linux" && !/Docker Desktop/i.test(info.name);
 const WORKER_MEMORY = 250e6; // bytes per container: Windscribe's app and helper, a tunnel and node take ~120 MB
 // ponytail: past this, more containers mostly add load on the one uplink, and WireGuard keys on the account; raise if real scans say so
 const MAX_WORKERS = 16;
@@ -207,7 +210,7 @@ function fingerprint() {
 const answers = (registry) => fetch(`https://${registry === "docker.io" ? "registry-1.docker.io" : registry}/v2/`, { signal: AbortSignal.timeout(8000) })
     .then((r) => r.status === 200 || r.status === 401, () => false);
 /** Gets the image's base: from the first registry in REGISTRIES that answers and serves it */
-async function pullBase(onLine) {
+async function pullBase(onLine, signal) {
     if (!(await docker(["image", "inspect", BASE_TAG])).code)
         return;
     const up = await Promise.all(REGISTRIES.map(answers)); // asking them all at once: dead ones would each take the timeout
@@ -217,24 +220,29 @@ async function pullBase(onLine) {
     for (const registry of order) {
         onLine(`the base image, from ${registry}`);
         const ref = `${registry}/${BASE}`;
-        const r = await docker(["pull", ref], { onLine, timeout: 15 * 60_000 });
+        const r = await docker(["pull", ref], { onLine, timeout: 15 * 60_000, signal });
+        if (signal?.aborted)
+            throw new Error("stopped");
         if (!r.code)
             return void (await docker(["tag", ref, BASE_TAG]));
         why = `${registry}: ${lastLine(r.out)}`;
     }
     throw new Error(`couldn't get the containers' base image from Docker Hub or its mirrors (${why}). A VPN may help`);
 }
-/** Builds the containers' image, unless this windscout's is there already; onLine gets the build's output */
-export async function buildImage(onLine) {
+/** Builds the containers' image, unless this windscout's is there already; onLine gets the build's output. Aborting signal
+ * stops the build (it throws) */
+export async function buildImage(onLine, signal) {
     if (info.os === "windows")
         throw new Error("Docker Desktop runs Windows containers: switch it to Linux containers (right-click its icon by the clock), then try again");
     const tag = fingerprint();
     const have = await docker(["image", "inspect", "-f", '{{index .Config.Labels "windscout"}}', IMAGE]);
     if (!have.code && have.out.trim() === tag)
         return;
-    await pullBase(onLine);
+    await pullBase(onLine, signal);
     // no --progress=plain: when piped, BuildKit prints plain anyway, and a distribution's docker may have only the old builder
-    const r = await docker(["build", "--label", `windscout=${tag}`, "-t", IMAGE, "-f", "-", fileURLToPath(ROOT).replace(/[\\/]$/, "")], { input: DOCKERFILE, onLine });
+    const r = await docker(["build", "--label", `windscout=${tag}`, "-t", IMAGE, "-f", "-", fileURLToPath(ROOT).replace(/[\\/]$/, "")], { input: DOCKERFILE, onLine, signal });
+    if (signal?.aborted)
+        throw new Error("stopped");
     if (r.code)
         throw new Error(`building the containers' image failed: ${lastLine(r.out)}`);
 }
@@ -250,16 +258,27 @@ const running = new Map(); // container name → its `docker run`, until the con
 const removeAll = () => running.size && spawnSync("docker", ["rm", "-f", ...running.keys()], { stdio: "ignore" });
 process.on("exit", removeAll);
 /** Starts n containers, their apps logged in with this computer's session; resolves to a prober for each container that got
- * ready, and whether WireGuard works in them */
-export async function startWorkers(n, session, onStatus) {
+ * ready, and whether WireGuard works in them. network: the docker network they go on (docker's default bridge without);
+ * tag tells their names apart from another group's; aborting signal removes them (none gets ready then) */
+export async function startWorkers(n, session, onStatus, { network, tag = "", signal } = {}) {
     const measuring = mutex();
     let wireguard = true;
     let ready = 0;
+    const names = Array.from({ length: n }, (_, i) => `windscout-${process.pid}-${tag}${i + 1}`);
+    const remove = () => {
+        const left = names.filter((name) => running.has(name));
+        if (left.length)
+            spawn("docker", ["rm", "-f", ...left], { stdio: "ignore" }).on("error", () => { });
+    };
+    signal?.addEventListener("abort", remove, { once: true });
     const start = (i) => new Promise((resolve) => {
-        const name = `windscout-${process.pid}-${i + 1}`;
+        if (signal?.aborted)
+            return resolve(null);
+        const name = names[i];
         // its own volume keeps its app's settings for the next scans: its WireGuard keys, registered with Windscribe once
         // it makes /dev/net/tun itself: Docker's Linux VM may have none (WSL loads tun as a module), and --device needs one there
-        const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
+        const p = spawn("docker", ["run", "-i", "--rm", "--init", "--name", name, ...(network ? ["--network", network] : []),
+            "--cap-add", "NET_ADMIN", "--device-cgroup-rule", "c 10:200 rwm",
             "--sysctl", "net.ipv4.conf.all.src_valid_mark=1", "-v", `windscout-${i + 1}:/home/ws/.config/Windscribe`, IMAGE], { detached: process.platform !== "win32" }); // its own process group, so ctrl-c reaches only us (Windows would open a window)
         running.set(name, p);
         const send = (m) => p.stdin.write(JSON.stringify(m) + "\n");
@@ -288,7 +307,7 @@ export async function startWorkers(n, session, onStatus) {
         };
         p.on("error", (e) => gone(e.message));
         p.on("close", (code) => gone(lastLine(err) || `exited (${code})`));
-        const prober = (query, protocol, { timeout, speedTest, steady = false, stopped = () => false, onStep = () => { } }) => new Promise((done, reject) => {
+        const prober = (query, protocol, { timeout, speedTest, steady = 0, stopped = () => false, onStep = () => { } }) => new Promise((done, reject) => {
             if (dead)
                 return reject(new Error(`container ${i + 1} stopped: ${dead}`));
             let leave = null, over = false;
@@ -313,18 +332,44 @@ export async function startWorkers(n, session, onStatus) {
             };
             send({ probe: { query, protocol, timeout, speedTest, steady } });
         });
+        const whoami = () => new Promise((done) => {
+            if (dead)
+                return done("");
+            const late = setTimeout(() => done(""), 15_000);
+            fail = () => (clearTimeout(late), done(""));
+            on = (m) => typeof m.ip === "string" && (clearTimeout(late), done(m.ip));
+            send({ whoami: true });
+        });
         fail = (why) => (onStatus(`container ${i + 1}: ${why}`), resolve(null));
         on = (m) => {
-            if (!m.ready)
+            if (!m.ready || signal?.aborted)
                 return;
             wireguard &&= m.wireguard !== false;
             fail = () => { };
             onStatus(`${++ready} of ${n} ready`);
-            resolve(prober);
+            resolve({ name, prober, whoami, alive: () => !dead });
         };
     });
-    const probers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((p) => p !== null);
-    return { probers, wireguard };
+    const workers = (await Promise.all(Array.from({ length: n }, (_, i) => start(i)))).filter((w) => w !== null);
+    signal?.removeEventListener("abort", remove);
+    if (signal?.aborted)
+        remove(); // got ready as it was aborted
+    return {
+        probers: workers.map((w) => w.prober),
+        wireguard,
+        whoami: async () => (await workers.find((w) => w.alive())?.whoami()) ?? "",
+        alive: () => workers.some((w) => w.alive()),
+        async stop() {
+            const names = workers.map((w) => w.name);
+            for (const name of names)
+                running.get(name)?.stdin?.end();
+            for (let i = 0; names.some((name) => running.has(name)) && i < 40; i++)
+                await sleep(250);
+            const stuck = names.filter((name) => running.has(name));
+            if (stuck.length)
+                spawnSync("docker", ["rm", "-f", ...stuck], { stdio: "ignore" });
+        },
+    };
 }
 /** Ends the containers once the scan is over: a worker exits when its stdin closes, and docker removes its container */
 export async function stopWorkers() {
@@ -334,3 +379,56 @@ export async function stopWorkers() {
         await sleep(250);
     removeAll(); // stuck ones: their docker run would keep us from exiting
 }
+// Routing the background checks' containers around this computer's VPN (native docker on Linux). Docker sends its containers'
+// traffic out by this computer's routes, so while the VPN is connected it goes through the VPN, and a container would test
+// from the VPN's server instead of your network. So they go on a docker network of their own, and a routing rule sends what
+// comes from it out the way this computer goes without the VPN: a table with main's default routes (Windscribe's VPN routes
+// are 0.0.0.0/1 and 128.0.0.0/1 in main, or its own table for WireGuard, never main's default). Windscribe's firewall filters
+// this computer's own traffic, not what it forwards, so it doesn't block them. Only traffic from that network is affected.
+// A container on the host's network sets it up: it takes no sudo, since whoever runs docker could do the same
+export const DIRECT_NETWORK = "windscout-direct";
+const TABLE = 2470; // ponytail: a routing table number nothing else is likely to use; the rules go at 89-90, before Windscribe's
+const ROUTE = `net=$1 t=$2
+while ip rule del from "$net" 2>/dev/null; do :; done
+ip route flush table "$t" 2>/dev/null
+[ "$3" = on ] || exit 0
+ip -4 route show table main default | sed -E 's/ (linkdown|dead|offload|trap|rt_offload|rt_trap|pervasive|notify)//g' |
+  while read -r r; do case "$r" in *" via "*) ip route add $r onlink table "$t" ;; *) ip route add $r table "$t" ;; esac; done
+[ -n "$(ip -4 route show table "$t")" ] || { echo "this computer has no default route to send them out by" >&2; exit 1; }
+ip rule add from "$net" to "$net" lookup main priority 89
+ip rule add from "$net" lookup "$t" priority 90`;
+let routed = ""; // the network routed around the VPN, until unroute()
+let routing = Promise.resolve(); // one change at a time: a rule taken away as it's put in could stay
+const oneAtATime = (change) => {
+    const p = routing.then(change);
+    routing = p.catch(() => { });
+    return p;
+};
+const route = (subnet, on) => ["run", "--rm", "--network", "host", "--cap-add", "NET_ADMIN", "--entrypoint", "sh", IMAGE, "-c", ROUTE, "route", subnet, String(TABLE), on ? "on" : "off"];
+/** windscout's own docker network for the background checks, created the first time; resolves to its subnet */
+export async function directNetwork() {
+    const subnet = async () => (await docker(["network", "inspect", "-f", "{{range .IPAM.Config}}{{.Subnet}} {{end}}", DIRECT_NETWORK]))
+        .out.split(/\s+/).find((s) => /^\d+\.\d+\.\d+\.\d+\/\d+$/.test(s)) ?? "";
+    if (!(await subnet()))
+        await docker(["network", "create", DIRECT_NETWORK]);
+    const s = await subnet();
+    if (!s)
+        throw new Error("couldn't create windscout's docker network");
+    return s;
+}
+/** Sends the traffic from the subnet out the way this computer goes without the VPN; again before each check, since the
+ * network may have changed (another Wi-Fi, another gateway) */
+export const routeAround = (subnet) => oneAtATime(async () => {
+    routed = subnet; // before it's in: a crash meanwhile takes it away
+    const r = await docker(route(subnet, true), { timeout: 60_000 });
+    if (r.code)
+        throw new Error(`couldn't route the containers around your VPN: ${lastLine(r.out) || `exit ${r.code}`}`);
+});
+/** Takes routeAround()'s rules and table away */
+export const unroute = () => oneAtATime(async () => {
+    if (routed)
+        await docker(route(routed, false), { timeout: 60_000 });
+    routed = "";
+});
+// a crash or a force quit: take the rule away on the way out (it only touches that network's traffic, so it's harmless if not)
+process.on("exit", () => routed && spawnSync("docker", route(routed, false), { stdio: "ignore", timeout: 30_000 }));

package/dist/measure.js

@@ -10,6 +10,18 @@ setDefaultResultOrder("ipv4first");
 const LATENCY_URL = "https://www.gstatic.com/generate_204";
 const SPEED_URL = "https://speed.cloudflare.com/__down?bytes=10000000";
 export const SPEED_SECONDS = 15;
+export const SPEED_MB = 10; // the most a speed test downloads
+const TRACE_URL = "https://www.cloudflare.com/cdn-cgi/trace"; // the speed test's Cloudflare: it says which IP asked
+/** The IP this connection goes out from, as Cloudflare sees it; "" when it didn't answer */
+export async function outsideIp() {
+    try {
+        const text = await (await fetch(TRACE_URL, { signal: AbortSignal.timeout(5000) })).text();
+        return text.match(/^ip=(\S+)/m)?.[1] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
 /** Best round trip of a few tries, in ms; null if none got through */
 export async function latencyMs(tries = 3) {
     let best = null;

package/dist/probe.js

@@ -1,18 +1,22 @@
 // One attempt: connect to a location over a protocol, measure through the tunnel, disconnect.
 // windscout connect makes the same attempt and, when it works, stays connected.
 import { latencyMs, SPEED_SECONDS, speedMbps } from "./measure.js";
-import { now, sleep } from "./time.js";
-import { connectState, windscribe } from "./windscribe.js";
+import { duration, now, sleep } from "./time.js";
+import { connectState, place, windscribe } from "./windscribe.js";
 // Stop at the first ends the scan at one connection, so that one has to last: a tunnel can connect and then be cut or throttled
-// once traffic flows. It counts once it downloads at MIN_MBPS or more, then stays up with internet for STEADY_CHECKS round trips
+// once traffic flows, or refuse the next connection, which is the one the user makes. So it counts once it downloads at
+// MIN_MBPS or more, holds up (holdsUp), downloads at MIN_MBPS or more again, and connects again as the user will
 export const MIN_MBPS = 1;
-const STEADY_CHECKS = 5, STEADY_GAP = 2; // seconds between the round trips
-// shortcut: guesses ~5 s to connect and the whole speed test; refine from real runs
-export const STEADY_SECONDS = 5 + SPEED_SECONDS + STEADY_CHECKS * (STEADY_GAP + 0.5);
+const STEADY_GAP = 2; // seconds between the hold's round trips
+// shortcut: guesses ~5 s to connect, the whole speed tests and ~10 s to reconnect; refine from real runs
+export const steadySeconds = (hold) => 5 + SPEED_SECONDS + hold + SPEED_SECONDS + 10;
 /** Whether stop at the first can stop at this result: it worked, held up, and is fast enough for real use */
 export const reliable = (r) => r.status === "ok" && (r.speedMbps ?? 0) >= MIN_MBPS;
-// "Connected: Miami - Vice" → "Miami - Vice"
-const place = (state) => state.split(":").slice(1).join(":").trim();
+/** Whether a hold's round trips so far (true: got through) still hold up: never 2 lost in a row (an outage), and no more
+ * than 1 in 10 lost (too lossy to use); fewer than 10 may lose 1 */
+export const holding = (trips) => !trips.some((ok, i) => !ok && trips[i - 1] === false) && trips.filter((ok) => !ok).length * 10 <= Math.max(10, trips.length);
+// nickname pins the exact datacenter: what the user connects with, and what the reconnect checks
+export const target = (r) => r.location.split(" - ").at(-1) || r.query;
 export async function probe(query, protocol, options) {
     try {
         return await attempt(query, protocol, options);
@@ -31,7 +35,7 @@ export async function disconnect() {
         await sleep(1000);
 }
 /** Connects and measures through the tunnel, as probe does, but leaves the connection as it is: up when it worked */
-export async function attempt(query, protocol, { timeout, speedTest, steady = false, stopped = () => false, onStep = () => { }, measure = (fn) => fn() }) {
+export async function attempt(query, protocol, { timeout, speedTest, steady = 0, stopped = () => false, onStep = () => { }, measure = (fn) => fn() }) {
     const r = { query, protocol, location: "", connectS: null, latencyMs: null, speedMbps: null };
     const end = (status) => ({ ...r, status });
     onStep("connecting");
@@ -56,42 +60,64 @@ export async function attempt(query, protocol, { timeout, speedTest, steady = fa
         // Windscribe refused this app another WireGuard key for the account: says nothing about this network
         else if (s.includes("WireGuard key limit") && now() - t > 3)
             return end("key limit");
-        else if (s === "Disconnected" && now() - t > 3)
+        // an error the app gave up with ("Error: WireGuard adapter setup failed", out of data, …): no need to wait out the timeout
+        else if ((s === "Disconnected" || s.startsWith("Error")) && now() - t > 3)
             return end("failed");
         onStep(`connecting ${r.location}`.trim());
         await sleep(1000);
     }
     // a port the app doesn't offer for the protocol: it connects on the protocol's default instead, so this port wasn't tried
-    const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol: .*:(\d+)\s*$/m)?.[1];
+    const port = protocol.split(":")[1], shown = (await windscribe("status")).match(/^Protocol:[ \t]*\S*:(\d+)\s*$/m)?.[1];
     if (port && shown && shown !== port)
         return end("no such port");
-    let measured = false, holds = true;
+    let status = "interrupted", reconnect = false; // reconnect: it passed the other checks, so the reconnect is next
     await measure(async () => {
         // a stopping scan waits for no more measurements: a parallel scan's containers measure one at a time, so they'd queue up
         if (stopped())
             return;
-        measured = true;
         onStep(`measuring latency · ${r.location}`);
         r.latencyMs = await latencyMs();
         if (r.latencyMs === null)
-            return;
+            return void (status = "no internet");
         if (speedTest || steady) {
             onStep(`measuring speed · ${r.location}`);
             r.speedMbps = await speedMbps();
         }
-        if (steady)
-            holds = await holdsUp(r.location, onStep);
+        status = "ok";
+        const first = r.speedMbps ?? 0;
+        if (!steady || first < MIN_MBPS)
+            return; // the scan never stops at a slower one, so it goes without the checks
+        const held = await holdsUp(steady, r.location, stopped, onStep);
+        if (held !== true)
+            return void (status = held === "interrupted" ? held : "unreliable");
+        onStep(`measuring speed again · ${r.location}`);
+        r.speedMbps = Math.min(first, (await speedMbps()) ?? 0); // throttled once traffic flowed: the slower one counts
+        if (r.speedMbps < MIN_MBPS)
+            return void (status = "unreliable");
+        reconnect = true;
     });
-    if (!measured)
-        return end("interrupted");
-    return end(r.latencyMs === null ? "no internet" : holds ? "ok" : "unreliable");
+    if (!reconnect)
+        return end(status);
+    // after its turn to measure: the next container can start while this one connects again, as the user will
+    onStep(`reconnecting · ${r.location}`);
+    await disconnect();
+    const { status: again } = await attempt(target(r), protocol, { timeout, speedTest: false, stopped });
+    return end(again === "ok" || again === "interrupted" ? again : "unreliable");
 }
-/** Whether the connection stays up with internet through it: STEADY_CHECKS round trips, STEADY_GAP seconds apart, each with a retry */
-async function holdsUp(location, onStep) {
-    for (let i = 1; i <= STEADY_CHECKS; i++) {
-        onStep(`checking it holds up ${i}/${STEADY_CHECKS} · ${location}`);
+/** Whether the connection holds up for seconds: connected to the same server the whole time, with a round trip through it
+ * every STEADY_GAP seconds, as long as they're holding(); "interrupted" when the scan stops first */
+async function holdsUp(seconds, location, stopped, onStep) {
+    const trips = [];
+    for (const t = now(); now() - t < seconds;) {
+        if (stopped())
+            return "interrupted";
+        onStep(`checking it holds up ${duration(now() - t)}/${duration(seconds)} · ${location}`);
         await sleep(STEADY_GAP * 1000);
-        if (!(await connectState()).startsWith("Connected") || (await latencyMs(2)) === null)
+        const s = await connectState(); // dropped, or the app moved it to another server
+        if (!s.startsWith("Connected") || (location && s.includes(":") && place(s) !== location))
+            return false;
+        trips.push((await latencyMs(1)) !== null);
+        if (!holding(trips))
             return false;
     }
     return true;

package/dist/scan.js

@@ -89,7 +89,7 @@ export class Scan {
     }
     /** One slot: takes the attempts from the queue, one at a time, until there are none */
     async work(prober, slot, queue, left, hooks) {
-        const { timeout, speedTest, stopAtFirst = false } = this.options;
+        const { timeout, speedTest, stopAtFirst = 0 } = this.options;
         for (;;) {
             while (this.paused && !this.stopping) {
                 if (!this.waiting && this.slots.every((s) => !s.current)) { // the last running attempt is over

package/dist/time.js

@@ -2,6 +2,11 @@
 export const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** Seconds on a monotonic clock */
 export const now = () => performance.now() / 1000;
+/** "just now", "5m ago", "3h ago", "2 days ago", for a time in ms since the epoch */
+export function ago(ms) {
+    const m = Math.max(0, Math.round((Date.now() - ms) / 60000)), h = Math.round(m / 60), d = Math.round(h / 24);
+    return m < 1 ? "just now" : m < 60 ? `${m}m ago` : h < 48 ? `${h}h ago` : `${d} days ago`;
+}
 /** "9s", "1m 05s", "1h 01m" */
 export function duration(sec) {
     sec = Math.max(0, Math.round(sec));

package/dist/tui/connect.js

@@ -0,0 +1,29 @@
+// Connecting to the working connections a scan found, without a terminal (windscout connect in a script): one line each.
+// In a terminal, the results screen (results.ts) connects and keeps you connected instead.
+import { attempt, disconnect, target } from "../probe.js";
+import { duration, now } from "../time.js";
+import { label } from "../watch.js";
+import { command } from "./report.js";
+import { cyan, green, yellow } from "./text.js";
+/** Runs a result's connect command and checks it as the scan does: connected, on its port, with internet through it.
+ * True once it is; otherwise disconnects (and waits until the app has), so the next connect isn't swallowed */
+async function connectTo(r, timeout, stopped) {
+    console.log(cyan(command(r)));
+    const t = now(), { status, location } = await attempt(target(r), r.protocol, { timeout, speedTest: false, stopped });
+    if (status === "ok")
+        return console.log(green(`Connected: ${location}`)), true;
+    console.log(yellow(`${status} after ${duration(now() - t)}`));
+    await disconnect();
+    return false;
+}
+/** Connects to list[from], or when it doesn't connect, to the next ones in turn, around to the one before it.
+ * The index of the one that connected; -1 when none did */
+export async function connectFrom(list, from, timeout, stopped = () => false) {
+    for (let k = 0; k < list.length && !stopped(); k++) {
+        const i = (from + k) % list.length;
+        console.log(`\n${k + 1}/${list.length} ${label(list[i])}`);
+        if (await connectTo(list[i], timeout, stopped))
+            return i;
+    }
+    return -1;
+}

package/dist/tui/picker.js

@@ -1,8 +1,8 @@
-import { loadDockerWireGuard, MIN_TIMEOUT, saveConfig, SPEED_TEST } from "../config.js";
+import { loadDockerWireGuard, MIN_HOLD, MIN_TIMEOUT, saveConfig, SPEED_TEST } from "../config.js";
 import { dockerState, loginSeconds, notInContainers, workerCount } from "../docker.js";
-import { STEADY_SECONDS } from "../probe.js";
+import { steadySeconds } from "../probe.js";
 import { attemptSeconds, estimate, ORDERS, plan } from "../scan.js";
-import { duration } from "../time.js";
+import { ago, duration } from "../time.js";
 import { canUpdate, checkUpdate, versionLines } from "../update.js";
 import { COUNTRIES, protocolPorts, PROTOCOLS, withPorts } from "../windscribe.js";
 import { countryName, flag } from "./country.js";
@@ -20,17 +20,13 @@ const needsLast = (o) => o === "last-first" || o === "last-only";
 // only the last results: the countries, protocols and ports are greyed out, and their keys and clicks say why
 const SKIPPED = "skipped with only the last results: o changes the scanning type";
 const flip = (set, value) => (set.has(value) ? set.delete(value) : set.add(value));
-// "5m ago", "3h ago", "2 days ago"
-const ago = (ms) => {
-    const m = Math.max(0, Math.round((Date.now() - ms) / 60000)), h = Math.round(m / 60), d = Math.round(h / 24);
-    return m < 1 ? "just now" : m < 60 ? `${m}m ago` : h < 48 ? `${h}h ago` : `${d} days ago`;
-};
 /** Resolves to the choice (also saved for next time), null when the user quits, or "update" for u */
-export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst, allPorts, docker, last }) {
+export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst, hold, allPorts, docker, last }) {
     const selected = new Set(saved?.countries ?? []);
     const protos = new Set(saved?.protocols.length ? saved.protocols : PROTOCOLS);
     let cursor = 0, top = 0, message = "", query = "", searching = false;
-    let seconds = String(timeout), editing = false; // the timeout, as typed
+    const typed = { timeout: String(timeout), hold: String(hold) }; // the settings in seconds, as typed
+    let editing = null; // the one being typed
     let dockerAt = null, inDialog = false; // docker's state once checked; a docker dialog has the screen
     let portLists = null; // each protocol's ports, once the app said
     let starting = -1; // once start is pressed: the start button's spinner frame, until the next screen shows
@@ -59,11 +55,12 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             const version = versionLines(true);
             const off = order === "last-only"; // only the saved connections: the countries, protocols and ports are skipped
             const missing = needsLast(order) && !last; // a type by the last result, and no saved scan: start is off
-            timeout = Number(seconds);
+            timeout = Number(typed.timeout);
+            hold = Number(typed.hold);
             const { list, skipped } = todo(), n = list.length;
             // only the last results lists the countries it scans, all selected; the user's own selection is back with the other types
             const matches = off ? [...new Set(list.map((a) => a.country))] : visible();
-            const height = Math.max(3, rows - 24 - version.length);
+            const height = Math.max(3, rows - 25 - version.length);
             if (!off) { // so the selection's list keeps its cursor and scroll for then
                 cursor = Math.max(0, Math.min(cursor, matches.length - 1));
                 if (cursor < top)
@@ -93,8 +90,9 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             const fwLine = `${dim(under("f"))} ${firewall ? green("● " + fwLabel) : dim("○ " + fwLabel)}  ${dim(docker
                 ? "not used with docker"
                 : firewall ? "only VPN traffic gets through" : "off: apps may leak in between")}`;
-            const short = timeout < MIN_TIMEOUT;
-            const timeoutLine = `${dim(under("t"))} timeout ${editing ? bold(seconds) + cyan("▏") : (short ? yellow : bold)(seconds || "?")} s  ${dim(`per connection · at least ${MIN_TIMEOUT}`)}`;
+            // a setting in seconds: as typed, with the cursor while typing, yellow when it's under its least
+            const field = (k, least) => editing === k ? bold(typed[k]) + cyan("▏") : (Number(typed[k]) < least ? yellow : bold)(typed[k] || "?");
+            const timeoutLine = `${dim(under("t"))} timeout ${field("timeout", MIN_TIMEOUT)} s  ${dim(`per connection · at least ${MIN_TIMEOUT}`)}`;
             const dockerLabel = "parallel scan in docker containers";
             const dockerLine = `${dim(under("d"))} ${docker ? green("● " + dockerLabel) : dim("○ " + dockerLabel)}  ${dim(!docker
                 ? "off: one attempt at a time"
@@ -113,8 +111,11 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             const lead = list[0]?.saved ? list[0] : null;
             const stopLine = `${dim(under("w"))} ${stopAtFirst ? green("● " + stopLabel) : dim("○ " + stopLabel)}  ${dim(!stopAtFirst
                 ? "off: tries every attempt"
-                : lead ? `≈ ${duration(login + STEADY_SECONDS)} if ${lead.country} ${lead.protocol} still holds up`
-                    : "after a speed and stability check")}`;
+                : lead ? `≈ ${duration(login + steadySeconds(hold))} if ${lead.country} ${lead.protocol} still holds up`
+                    : `≈ ${duration(steadySeconds(hold))} of checks per working one`)}`;
+            const holdLine = `${dim(under("h"))} hold ${field("hold", MIN_HOLD)} s  ${dim(stopAtFirst
+                ? `each working one stays connected this long · at least ${MIN_HOLD}`
+                : "not used: stop at the first is off")}`;
             const search = off
                 ? yellow("the last results' countries: only these are scanned")
                 : searching ? `${cyan("🔍")} ${bold(query)}${cyan("▏")}`
@@ -136,7 +137,7 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
                 ["quit", under("Q") + "uit"],
             ];
             const buttonLine = buttons.map(([id, label]) => (id === "start" && n && !missing ? bold(cyan(`[ ${label} ]`)) : dim(`[ ${label} ]`))).join("  ");
-            const settings = [protoLine, portsLine, ...(SPEED_TEST ? [speedLine] : []), fwLine, timeoutLine, dockerLine, orderLine, stopLine];
+            const settings = [protoLine, portsLine, ...(SPEED_TEST ? [speedLine] : []), fwLine, timeoutLine, dockerLine, orderLine, stopLine, holdLine];
             const table = grid([{ title: "" }, { title: "Code" }, { title: "Country" }], body, { caption: search, captionRight: dim(range), minWidth: Math.max(...settings.map(vw)) + 4 });
             const width = vw(table[0]);
             const head = box(settings, {
@@ -156,14 +157,16 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
                     ? yellow("no saved scan yet, so start is off: press o for another scanning type")
                     : !n ? yellow(skipped.length ? `the docker containers can't run ${skipped.join(" or ")}: d turns docker off`
                         : `select at least one country and one protocol${last ? ", or o for only the last results" : ""}`)
-                        : stopAtFirst // it can end at any attempt: this is when none holds up
-                            ? `up to ${bold(String(n))} attempts · at most ${bold("≈ " + duration(total))} ${costs}`
+                        : stopAtFirst // it can end at any attempt, and each working one adds its checks (the w line)
+                            ? `up to ${bold(String(n))} attempts · ${bold("≈ " + duration(total))} if none connects ${costs}`
                             : `${bold(String(n))} attempts · estimated ${bold("≈ " + duration(total))} ${costs}`, width),
-                centerIn(dim(editing
-                    ? "type the seconds to wait for each connection · enter/esc done"
-                    : searching
-                        ? "type to filter · ↑↓ move · enter/esc done"
-                        : `↑↓ move · space select · a/n ${query ? "all/none shown · esc clear" : "all/none · / search"} · enter start · q quit`), width),
+                centerIn(dim(editing === "hold"
+                    ? "type the seconds each working connection has to stay connected · enter/esc done"
+                    : editing
+                        ? "type the seconds to wait for each connection · enter/esc done"
+                        : searching
+                            ? "type to filter · ↑↓ move · enter/esc done"
+                            : `↑↓ move · space select · a/n ${query ? "all/none shown · esc clear" : "all/none · / search"} · enter start · q quit`), width),
                 centerIn(dim(searching || editing ? "" : `1-${PROTOCOLS.length} protocols · p ports${SPEED_TEST ? " · s speed" : ""} · f firewall · t timeout · d docker · o type · w first`), width),
             ];
             if (message)
@@ -188,7 +191,7 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             });
             hit = {
                 protoRow: row(protoLine), protoHits, portsRow: row(portsLine), speedRow: SPEED_TEST ? row(speedLine) : -1,
-                firewallRow: row(fwLine), timeoutRow: row(timeoutLine), dockerRow: row(dockerLine), orderRow: row(orderLine), stopRow: row(stopLine),
+                firewallRow: row(fwLine), timeoutRow: row(timeoutLine), dockerRow: row(dockerLine), orderRow: row(orderLine), stopRow: row(stopLine), holdRow: row(holdLine),
                 searchRow: at.top + head.length + 1,
                 firstRow: at.top + head.length + 5, shown: shown.length,
                 buttonRow: at.top + head.length + table.length + 1, buttonHits,
@@ -219,6 +222,10 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
                 message = `the timeout must be at least ${MIN_TIMEOUT} seconds`;
                 return false;
             }
+            if (stopAtFirst && !(hold >= MIN_HOLD)) {
+                message = `the hold must be at least ${MIN_HOLD} seconds`;
+                return false;
+            }
             // keep the user's order of preference stable: list order
             const choice = {
                 countries: COUNTRIES.filter((c) => selected.has(c)),
@@ -227,6 +234,7 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
                 firewall,
                 order,
                 stopAtFirst,
+                hold,
                 allPorts,
                 timeout,
                 docker,
@@ -275,11 +283,13 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             else if (off && (onCountries || y === hit.protoRow || y === hit.portsRow))
                 message = SKIPPED;
             else if (y === hit.searchRow)
-                searching = true, editing = false;
+                searching = true, editing = null;
             else if (y === hit.timeoutRow)
-                editing = true, searching = false;
+                editing = "timeout", searching = false;
+            else if (y === hit.holdRow)
+                editing = "hold", searching = false;
             else {
-                searching = editing = false; // clicking anywhere else ends typing, like leaving a text field
+                searching = false, editing = null; // clicking anywhere else ends typing, like leaving a text field
                 if (y >= hit.firstRow && y < hit.firstRow + hit.shown) {
                     cursor = top + (y - hit.firstRow);
                     const c = matches[cursor];
@@ -345,12 +355,13 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             else if (k === "pagedown")
                 cursor = Math.min(matches.length - 1, cursor + 10);
             else if (editing) {
+                const text = typed[editing];
                 if (k === "return" || k === "escape")
-                    editing = false;
+                    editing = null;
                 else if (k === "backspace")
-                    seconds = seconds.slice(0, -1);
-                else if (/^[0-9]$/.test(str ?? "") && seconds.length < 4)
-                    seconds = seconds === "0" ? str : seconds + str;
+                    typed[editing] = text.slice(0, -1);
+                else if (/^[0-9]$/.test(str ?? "") && text.length < 4)
+                    typed[editing] = text === "0" ? str : text + str;
             }
             else if (searching) {
                 // typing goes into the search box; letters are not shortcuts here
@@ -386,7 +397,9 @@ export function pick(saved, { timeout, speedTest, firewall, order, stopAtFirst,
             else if (k === "f")
                 firewall = !firewall;
             else if (k === "t")
-                editing = true, seconds = "";
+                editing = "timeout", typed.timeout = "";
+            else if (k === "h")
+                editing = "hold", typed.hold = "";
             else if (k === "d")
                 return void toggleDocker();
             else if (k === "o")