cmdzero 0.8.1 → 0.8.3

package/README.md

@@ -65,9 +65,15 @@ Opt out permanently:
 export CMDZERO_TELEMETRY=0   # or DO_NOT_TRACK=1 — both respected
 ```
 
+Telemetry never blocks or breaks the daemon: it's fire-and-forget with a 3s
+timeout and no retries. It's also silent about its own failures by default — set
+`CMDZERO_TELEMETRY_DEBUG=1` to log delivery errors, or read
+`curl -s localhost:4100/api/health | jq` for the last send and last error.
+
 ## Options
 
 - `npx cmdzero --port 4101` (+ `<CmdZeroOverlay origin="http://localhost:4101" />`)
 - `CMDZERO_FAST_MODEL` / `CMDZERO_SMART_MODEL` — model aliases for the router (default `haiku` / `sonnet`)
 - `CMDZERO_BASELINE_COST` / `CMDZERO_BASELINE_MS` — baseline for the savings counter
+- `CMDZERO_TELEMETRY=0` / `DO_NOT_TRACK=1` — opt out of telemetry; `CMDZERO_TELEMETRY_DEBUG=1` logs delivery failures
 - Natural-language tweaks require the [Claude Code CLI](https://claude.com/claude-code) (`claude`) on your PATH; copy/style lanes work without it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cmdzero",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Tweak your UI live in the browser and write the changes straight to source. Copy and Tailwind edits cost zero tokens; everything else routes to a right-sized model via headless claude.",
   "license": "MIT",
   "type": "module",
@@ -8,7 +8,8 @@
     "cmdzero": "bin/cmdzero.js"
   },
   "scripts": {
-    "start": "node bin/cmdzero.js"
+    "start": "node bin/cmdzero.js",
+    "test": "node --test test/*.test.js"
   },
   "files": [
     "bin",

package/src/resolver.js

@@ -28,13 +28,18 @@ export function parseLoc(loc) {
 export function loadTarget(root, loc) {
   const parsed = parseLoc(loc);
   const { line, col } = parsed;
-  // Stamps come from two sources: the babel plugin (root-relative path,
-  // 0-based column) and the @cmdzero/react dev runtime (absolute path,
-  // 1-based column). Normalize the path and match either column convention.
-  const file = path.isAbsolute(parsed.file)
-    ? path.relative(root, parsed.file)
-    : parsed.file;
-  if (file.startsWith('..')) throw new Error('file outside root');
+  // Stamps come from three sources: the babel plugin (root-relative path,
+  // 0-based column) and the @cmdzero/react dev runtime (1-based column), which
+  // reports whatever the bundler handed jsxDEV — an absolute path under
+  // webpack, but "[project]/..." under Turbopack. Normalize the path and match
+  // either column convention.
+  const raw = parsed.file.replace(/^\[project\]\//, '');
+  // Resolve before the escape check: the guard has to see a normalized path,
+  // or a "foo/../../.." stamp walks straight past a leading-".." test.
+  const file = path.relative(root, path.resolve(root, raw));
+  if (file.startsWith('..') || path.isAbsolute(file)) {
+    throw new Error('file outside root');
+  }
   const abs = path.resolve(root, file);
   const content = fs.readFileSync(abs, 'utf8');
   const ast = parseSource(content, file);

package/src/server.js

@@ -77,7 +77,17 @@ export function startServer({ root, port = 4100 }) {
       }
 
       if (req.method === 'GET' && url.pathname === '/api/health') {
-        return json(res, { ok: true, version: VERSION, root, totals, tailwind, telemetry: !telemetry.disabled });
+        const { lastSentAt, lastError } = telemetry.status();
+        return json(res, {
+          ok: true,
+          version: VERSION,
+          root,
+          totals,
+          tailwind,
+          telemetry: !telemetry.disabled,
+          telemetryLastSentAt: lastSentAt,
+          telemetryLastError: lastError,
+        });
       }
 
       if (req.method === 'GET' && url.pathname === '/api/events') {
@@ -317,8 +327,10 @@ export function startServer({ root, port = 4100 }) {
   });
   server.listen(port, () => {
     console.log(`[cmdzero] daemon on http://localhost:${port} (root: ${root})`);
-    console.log('[cmdzero] docs & updates → https://cmdzero.dev');
+    console.log('[cmdzero] docs & updates → https://cmdzero.xyz');
     if (telemetry.firstRun && !telemetry.disabled) console.log(DISCLOSURE);
+    // After the disclosure, never before it.
+    telemetry.start();
   });
   return server;
 }

package/src/telemetry.js

@@ -9,9 +9,13 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 
 const ENDPOINT =
-  process.env.CMDZERO_TELEMETRY_URL || 'https://telemetry.cmdzero.dev/v1/events';
+  process.env.CMDZERO_TELEMETRY_URL || 'https://telemetry.cmdzero.xyz/v1/events';
 const CONFIG_PATH = path.join(os.homedir(), '.cmdzero', 'telemetry.json');
 const FLUSH_MS = 60_000;
+// Off by default: this runs in other people's dev terminals, and telemetry that
+// complains about itself is worse than telemetry that fails. Delivery status is
+// always readable via /api/health regardless of this flag.
+const DEBUG = process.env.CMDZERO_TELEMETRY_DEBUG === '1';
 
 export function telemetryDisabled() {
   const v = String(process.env.CMDZERO_TELEMETRY ?? '').toLowerCase();
@@ -55,6 +59,19 @@ export function initTelemetry({ version, tailwind }) {
   const disabled = telemetryDisabled();
   const counts = { copy: 0, style: 0, delete: 0, nl: 0, move: 0, deploy: 0 };
   let flushTimer = null;
+  let lastSentAt = null;
+  let lastError = null;
+
+  // Must never throw: it runs inside the promise handlers below.
+  function note(what, err) {
+    if (!err) {
+      lastSentAt = new Date().toISOString();
+      lastError = null;
+      return;
+    }
+    lastError = { at: new Date().toISOString(), message: `${what}: ${err}` };
+    if (DEBUG) console.error(`[cmdzero] telemetry ${what} failed: ${err}`);
+  }
 
   function send(event, extra = {}) {
     if (disabled) return;
@@ -73,9 +90,15 @@ export function initTelemetry({ version, tailwind }) {
           ...extra,
         }),
         signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
-    } catch {
-      /* fire and forget */
+      })
+        .then((res) => note(event, res.ok ? null : `HTTP ${res.status}`))
+        // Terminal, and it has to stay that way. If .then() were the tail of this
+        // chain a network failure would surface as an unhandled rejection, which
+        // Node turns into a dead daemon in someone else's terminal — the
+        // .catch(() => {}) this replaces was the only thing preventing that.
+        .catch((err) => note(event, err?.message || err));
+    } catch (err) {
+      note(event, err?.message || err);
     }
   }
 
@@ -92,6 +115,12 @@ export function initTelemetry({ version, tailwind }) {
     }
   }
 
-  send('boot');
-  return { firstRun, disabled, record };
+  // Not fired here. server.js calls start() once the first-run disclosure has
+  // actually printed, so a first-time user's first event never precedes the
+  // notice that tells them it's coming.
+  function start() {
+    send('boot');
+  }
+
+  return { firstRun, disabled, record, start, status: () => ({ lastSentAt, lastError }) };
 }