server-studio 1.1.1 → 1.2.1

package/src/server.js

@@ -9,11 +9,16 @@ const os = require('os');
 const net = require('net');
 
 const plat = require('./platform');
+const setport = require('./setport');
+const telemetry = require('./telemetry');
 
 const PORT = process.env.PORT || 4587;
 const RES = __dirname;
 const DATA_DIR = plat.dataDir();
 const DATA_FILE = path.join(DATA_DIR, 'data.json');
+// Folders are stored separately. data.json stays a plain array so the published
+// register-server.js, which reads and writes that array, keeps working untouched.
+const FOLDERS_FILE = path.join(DATA_DIR, 'folders.json');
 
 /* ---------- storage ---------- */
 function ensureStore() {
@@ -27,6 +32,13 @@ function readData() {
 function writeData(d) {
   fs.writeFileSync(DATA_FILE, JSON.stringify(d, null, 2));
 }
+function readFolders() {
+  try { const f = JSON.parse(fs.readFileSync(FOLDERS_FILE, 'utf8')); return Array.isArray(f) ? f : []; }
+  catch (e) { return []; }
+}
+function writeFolders(f) {
+  fs.writeFileSync(FOLDERS_FILE, JSON.stringify(f, null, 2));
+}
 
 /* ---------- helpers ---------- */
 function send(res, code, obj) {
@@ -74,6 +86,41 @@ function portFromUrl(url) {
   return m ? Number(m[1]) : null;
 }
 
+/* ---------- version check ---------- */
+function appVersion() {
+  // Running from a checkout, package.json is one level up. Inside the installed app
+  // bundle there is no package.json, so the installer stamps version.json beside the
+  // code. Try both before giving up.
+  try { return require('./version.json').version || '0.0.0'; } catch (e) {}
+  try { return require('../package.json').version || '0.0.0'; } catch (e) {}
+  return '0.0.0';
+}
+function isNewer(a, b) {
+  const pa = String(a).split('.').map(Number), pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] || 0, y = pb[i] || 0;
+    if (x !== y) return x > y;
+  }
+  return false;
+}
+function latestVersion() {
+  return new Promise((resolve, reject) => {
+    const req = require('https').get({
+      host: 'registry.npmjs.org',
+      path: '/server-studio/latest',
+      headers: { 'User-Agent': 'server-studio' },
+      timeout: 2500,
+    }, r => {
+      if (r.statusCode !== 200) { r.resume(); return resolve(null); }
+      let d = '';
+      r.on('data', c => { d += c; if (d.length > 2e5) r.destroy(); });
+      r.on('end', () => { try { resolve(JSON.parse(d).version || null); } catch (e) { resolve(null); } });
+    });
+    req.on('error', () => resolve(null));
+    req.on('timeout', () => { req.destroy(); resolve(null); });
+  });
+}
+
 /* ---------- routes ---------- */
 const server = http.createServer(async (req, res) => {
   const url = req.url.split('?')[0];
@@ -152,6 +199,62 @@ const server = http.createServer(async (req, res) => {
     });
   }
 
+  // Optional email signup. The browser posts here (same-origin), and we forward the
+  // user's chosen email to the remote counter. Inert if no analytics URL is set.
+  if (req.method === 'POST' && url === '/api/subscribe') {
+    const b = await body(req);
+    if (!b) return send(res, 415, { error: 'expected application/json' });
+    const email = String(b.email || '').trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email) || email.length > 254) {
+      return send(res, 400, { error: 'invalid email' });
+    }
+    // The message is optional. It is what turns this from a mailing list into a
+    // place to ask for things, so it is passed through rather than dropped.
+    const message = String(b.message || '').trim().slice(0, 2000);
+    if (!telemetry.subscribeEnabled) return send(res, 200, { ok: false, disabled: true });
+    const r = await telemetry.subscribe(email, message);
+    return send(res, r ? 200 : 502, { ok: r });
+  }
+
+  if (req.method === 'GET' && url === '/api/subscribe') {
+    // Tied to the signup endpoint, not the counter. The box should work even for
+    // someone who has turned telemetry off entirely.
+    return send(res, 200, { enabled: telemetry.subscribeEnabled });
+  }
+
+  // Version check against the public npm registry. No auth, no dependency, and it
+  // fails quietly so a blocked network just means no banner.
+  if (req.method === 'GET' && url === '/api/update') {
+    const current = appVersion();
+    return latestVersion().then(latest => {
+      send(res, 200, { current, latest, newer: !!(latest && isNewer(latest, current)) });
+    }).catch(() => send(res, 200, { current, latest: null, newer: false }));
+  }
+
+  if (req.method === 'GET' && url === '/api/folders') {
+    return send(res, 200, readFolders());
+  }
+
+  if (req.method === 'POST' && url === '/api/folders') {
+    const data = await body(req);
+    if (!Array.isArray(data)) return send(res, 400, { error: 'expected a JSON array' });
+    writeFolders(data);
+    return send(res, 200, { ok: true });
+  }
+
+  // Writes a fixed port into a project's package.json dev script. Pass apply:false to
+  // get the exact before/after first, so the user approves a real diff, not a promise.
+  if (req.method === 'POST' && url === '/api/setport') {
+    const b = await body(req);
+    if (!b) return send(res, 415, { error: 'expected application/json' });
+    const port = Number(b.port);
+    if (!port || port < 1 || port > 65535) return send(res, 400, { error: 'bad port' });
+    const r = b.apply ? setport.apply(String(b.cwd || ''), port) : setport.plan(String(b.cwd || ''), port);
+    return send(res, 200, { ok: !!r.ok, reason: r.reason || null, file: r.file || null,
+      key: r.key || null, before: r.before || null, after: r.after || null,
+      how: r.how || null, backup: r.backup || null });
+  }
+
   if (req.method === 'GET' && url === '/api/platform') {
     return send(res, 200, { platform: process.platform, terminalName: plat.terminalName(), pathExample: plat.pathExample() });
   }
@@ -174,6 +277,7 @@ const server = http.createServer(async (req, res) => {
 ensureStore();
 server.listen(PORT, '127.0.0.1', () => {
   console.log('Server Studio running on http://localhost:' + PORT);
+  telemetry.ping('start'); // one anonymous count per real launch (app or CLI)
   plat.openExternal('http://localhost:' + PORT + '/', () => {});
 });
 server.on('error', (e) => {

package/src/setport.js

@@ -0,0 +1,82 @@
+// Writes a fixed port into a project's package.json dev script, so the card and the
+// project agree instead of drifting.
+//
+// Deliberately narrow. It only ever touches "scripts.dev" (or "scripts.start"), and only
+// when the shape is recognised. It edits the raw text rather than re-serialising the JSON,
+// so nothing else in the file moves. Anything unfamiliar is refused, never guessed at.
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const UNSAFE = /&&|\|\||;|\|/;   // chained scripts: too easy to break, so decline
+
+// Work out what the script should become, or why it cannot be changed.
+function rewriteScript(script, port) {
+  const s = String(script || '').trim();
+  if (!s) return { ok: false, reason: 'there is no dev script to edit' };
+  if (UNSAFE.test(s)) return { ok: false, reason: 'the dev script chains several commands' };
+
+  // Already carries an explicit port: replace the number, do not add another flag.
+  const long = s.match(/(--port[= ])(\d{2,5})/);
+  if (long) return { ok: true, next: s.replace(long[0], long[1] + port), how: 'updated --port' };
+  const short = s.match(/(\s-p[= ])(\d{2,5})/);
+  if (short) return { ok: true, next: s.replace(short[0], short[1] + port), how: 'updated -p' };
+  const envPort = s.match(/(^|\s)PORT=(\d{2,5})/);
+  if (envPort) return { ok: true, next: s.replace(envPort[0], envPort[1] + 'PORT=' + port), how: 'updated PORT=' };
+
+  // No port yet: add one the way that tool expects.
+  if (/(^|\s)vite(\s|$)/.test(s))          return { ok: true, next: s + ' --port ' + port + ' --strictPort', how: 'added --port --strictPort' };
+  if (/(^|\s)next\s+dev(\s|$)/.test(s))    return { ok: true, next: s + ' -p ' + port, how: 'added -p' };
+  if (/(^|\s)astro\s+dev(\s|$)/.test(s))   return { ok: true, next: s + ' --port ' + port, how: 'added --port' };
+  if (/react-scripts\s+start/.test(s))     return { ok: true, next: 'PORT=' + port + ' ' + s, how: 'added PORT=' };
+  if (/(^|\s)nuxt\s+dev(\s|$)/.test(s))    return { ok: true, next: s + ' --port ' + port, how: 'added --port' };
+
+  return { ok: false, reason: 'the dev script is not a framework this can safely edit' };
+}
+
+function plan(cwd, port) {
+  if (!cwd) return { ok: false, reason: 'this server has no project folder set' };
+  const file = path.join(cwd, 'package.json');
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); }
+  catch (e) { return { ok: false, reason: 'no package.json in that folder' }; }
+
+  let pkg;
+  try { pkg = JSON.parse(raw); }
+  catch (e) { return { ok: false, reason: 'package.json is not valid JSON' }; }
+
+  const scripts = pkg.scripts || {};
+  const key = scripts.dev !== undefined ? 'dev' : (scripts.start !== undefined ? 'start' : null);
+  if (!key) return { ok: false, reason: 'no dev or start script in package.json' };
+
+  const before = scripts[key];
+  const r = rewriteScript(before, port);
+  if (!r.ok) return { ok: false, reason: r.reason, script: before };
+  if (r.next === before) return { ok: false, reason: 'that script already uses port ' + port, script: before };
+
+  // Match the key together with its value. Matching the value alone is not enough: a dev
+  // script of "vite" also appears as the dependency name "vite", which is two hits.
+  const esc = t => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp('("' + esc(key) + '"\\s*:\\s*)' + esc(JSON.stringify(before)));
+  const hits = raw.match(new RegExp(re.source, 'g')) || [];
+  if (hits.length === 0) return { ok: false, reason: 'could not locate the script safely in the file' };
+  if (hits.length > 1) return { ok: false, reason: 'that script appears more than once, too risky to edit' };
+
+  return { ok: true, file, key, before, after: r.next, how: r.how, raw, re };
+}
+
+function apply(cwd, port) {
+  const p = plan(cwd, port);
+  if (!p.ok) return p;
+  const backup = p.file + '.backup-' + Date.now();
+  try {
+    fs.writeFileSync(backup, p.raw);
+    fs.writeFileSync(p.file, p.raw.replace(p.re, '$1' + JSON.stringify(p.after).replace(/\$/g, '$$$$')));
+  } catch (e) {
+    return { ok: false, reason: 'could not write package.json: ' + e.message };
+  }
+  return { ok: true, file: p.file, key: p.key, before: p.before, after: p.after, how: p.how, backup };
+}
+
+module.exports = { plan, apply, rewriteScript };

package/src/telemetry.js

@@ -0,0 +1,179 @@
+// Anonymous usage counter + optional email signup. Built-ins only, no dependencies.
+//
+// Two things live here, and they are very different:
+//   ping(event)        anonymous, opt-out, fire-and-forget. A random id + OS/version.
+//   subscribe(email)   an explicit, user-typed signup. Sends the email the user chose
+//                      to give. Never automatic, never affected by the opt-out flag.
+//
+// Both are INERT until SERVER_STUDIO_ANALYTICS_URL points at your Worker origin, e.g.
+//   SERVER_STUDIO_ANALYTICS_URL=https://server-studio-analytics.you.workers.dev
+// The code appends /collect and /subscribe itself.
+'use strict';
+
+const path = require('path');
+const crypto = require('crypto');
+const fs = require('fs');
+
+const BASE = (process.env.SERVER_STUDIO_ANALYTICS_URL || '').replace(/\/+$/, '');
+
+// Signups go to the site's own subscriber list, not to the counter. They are two
+// separate things: one is an anonymous tally, this is a person asking to be emailed.
+// Overridable so a fork points somewhere else instead of at this list.
+const SUBSCRIBE_URL = process.env.SERVER_STUDIO_SUBSCRIBE_URL || 'https://www.mahdicreates.com/api/subscribe';
+
+function optedOut() {
+  if (process.env.SERVER_STUDIO_NO_TELEMETRY) return true;
+  const dnt = String(process.env.DO_NOT_TRACK || '').toLowerCase();
+  return dnt === '1' || dnt === 'true';
+}
+
+function appVersion() {
+  // Running from a checkout, package.json is one level up. Inside the installed app
+  // bundle there is no package.json, so the installer stamps version.json beside the
+  // code. Try both before giving up.
+  try { return require('./version.json').version || '0.0.0'; } catch (e) {}
+  try { return require('../package.json').version || '0.0.0'; } catch (e) {}
+  return '0.0.0';
+}
+
+function dataDir() {
+  try { return require('./platform').dataDir(); }
+  catch (e) {
+    const os = require('os');
+    if (process.env.SERVER_STUDIO_DATA_DIR) return process.env.SERVER_STUDIO_DATA_DIR;
+    if (process.platform === 'darwin') return path.join(os.homedir(), 'Library', 'Application Support', 'Server Studio');
+    if (process.platform === 'win32') return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Server Studio');
+    return path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'server-studio');
+  }
+}
+
+// { id, fresh }. `fresh` is true the first time an id is minted.
+function installId() {
+  const dir = dataDir();
+  const file = path.join(dir, 'analytics-id');
+  try {
+    const existing = fs.readFileSync(file, 'utf8').trim();
+    if (existing) return { id: existing, fresh: false };
+  } catch (e) { /* not created yet */ }
+  const id = crypto.randomUUID();
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(file, id + '\n');
+    return { id, fresh: true };
+  } catch (e) {
+    return { id, fresh: false }; // read-only home: still count, just cannot dedupe
+  }
+}
+
+function notice() {
+  let link = '';
+  try { link = (require('../package.json').homepage || '').split('#')[0]; } catch (e) {}
+  console.error(
+    'Server Studio sends one anonymous ping (a random id + your OS and version, no\n' +
+    'personal data) so installs can be counted. Turn it off any time with\n' +
+    '  SERVER_STUDIO_NO_TELEMETRY=1' + (link ? '   ·  ' + link + '#telemetry' : '')
+  );
+}
+
+// Low-level POST. Resolves { ok } and never rejects.
+function post(pathname, obj, timeout, keepAlive) {
+  return new Promise(resolve => {
+    try {
+      if (!BASE) return resolve({ ok: false });
+      const payload = JSON.stringify(obj);
+      const u = new URL(BASE + pathname);
+      const client = u.protocol === 'http:' ? require('http') : require('https');
+      const req = client.request({
+        hostname: u.hostname,
+        port: u.port || (u.protocol === 'http:' ? 80 : 443),
+        path: u.pathname,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+        timeout: timeout || 1500,
+      }, res => {
+        res.resume(); // drain
+        resolve({ ok: res.statusCode >= 200 && res.statusCode < 300 });
+      });
+      req.on('error', () => resolve({ ok: false }));
+      req.on('timeout', () => { req.destroy(); resolve({ ok: false }); });
+      // Never keep the process alive for a ping. On a network that cannot reach the
+      // endpoint this is the difference between exiting now and waiting out the
+      // timeout. A ping that would not have arrived is not worth a second of anyone's
+      // install. Subscribe passes keepAlive because a person is waiting on the answer.
+      //
+      // The socket has to be unref'd as well as the request. On Node 18 unref'ing the
+      // request before a socket exists does not propagate, and the process sat there
+      // for seconds on a blocked network.
+      if (!keepAlive) {
+        req.on('socket', sock => { if (sock && typeof sock.unref === 'function') sock.unref(); });
+        if (typeof req.unref === 'function') req.unref();
+      }
+      req.end(payload);
+    } catch (e) { resolve({ ok: false }); }
+  });
+}
+
+// POST to an absolute URL and hand back the parsed body. Never rejects.
+function postTo(absUrl, obj, timeout) {
+  return new Promise(resolve => {
+    try {
+      const payload = JSON.stringify(obj);
+      const u = new URL(absUrl);
+      const client = u.protocol === 'http:' ? require('http') : require('https');
+      const req = client.request({
+        hostname: u.hostname,
+        port: u.port || (u.protocol === 'http:' ? 80 : 443),
+        path: u.pathname + (u.search || ''),
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+        timeout: timeout || 6000,
+      }, res => {
+        let d = '';
+        res.on('data', c => { d += c; if (d.length > 1e5) res.destroy(); });
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(d || '{}'); } catch (e) { parsed = null; }
+          resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, json: parsed });
+        });
+      });
+      req.on('error', () => resolve({ ok: false, json: null }));
+      req.on('timeout', () => { req.destroy(); resolve({ ok: false, json: null }); });
+      req.end(payload);
+    } catch (e) { resolve({ ok: false, json: null }); }
+  });
+}
+
+// Anonymous, fire-and-forget.
+function ping(event) {
+  try {
+    if (!BASE || optedOut() || process.env.CI) return;
+    const { id, fresh } = installId();
+    if (fresh) { try { notice(); } catch (e) {} }
+    post('/collect', {
+      event: String(event || 'ping'),
+      id,
+      v: appVersion(),
+      os: process.platform,
+      arch: process.arch,
+      node: process.versions.node.split('.')[0],
+    }, 1500);
+  } catch (e) { /* best-effort, always */ }
+}
+
+// Explicit signup. Returns a Promise<boolean> so the UI can confirm.
+async function subscribe(email, message) {
+  try {
+    const e = String(email || '').trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(e) || e.length > 254) return false;
+    if (!SUBSCRIBE_URL) return false;
+    const body = { email: e };
+    const m = String(message || '').trim().slice(0, 2000);
+    if (m) body.message = m;
+    // Deliberately not gated on the telemetry opt-out: typing an address and pressing
+    // send is an explicit request, not tracking, and refusing it would be wrong.
+    const r = await postTo(SUBSCRIBE_URL, body, 6000);
+    return !!(r && r.ok && r.json && r.json.success);
+  } catch (e) { return false; }
+}
+
+module.exports = { ping, subscribe, enabled: !!BASE, subscribeEnabled: !!SUBSCRIBE_URL };