server-studio 1.2.3 → 1.2.5

package/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 Notable changes to Server Studio. Dates are release dates.
 
+## 1.2.5 — 2026-08-30
+
+### The install counter is gone
+- **Removed:** the anonymous install counter added in 1.2.0. It was never switched on. The
+  endpoint came from `SERVER_STUDIO_ANALYTICS_URL`, which had no default, so no published build
+  ever sent a ping and the collector was never deployed. Removed outright rather than left
+  dormant, along with the bundled Cloudflare Worker, both opt-out variables and the README
+  section describing it.
+- Server Studio now makes exactly two outbound requests: a public read of
+  `registry.npmjs.org` to check for updates, which sends nothing about you, and the sidebar
+  email box, which is silent until you type an address and press send. The README says so
+  precisely.
+- The sidebar email box is untouched. It never depended on any of this.
+
+### Fixed
+- **Fixed:** `telemetry.js` carried a `req.unref()` call that had never run once. `ClientRequest`
+  has no such method, so the `typeof` guard silently skipped it on every Node version. The socket
+  unref beside it was doing all the work. The comments claiming it was a Node 18 workaround were
+  wrong on both counts.
+- **Fixed:** the install-timing check in CI failed at random on macOS. It pointed at a black-hole
+  IP and hoped the connection would hang, which depends entirely on the network, and it inherited
+  `CI=true`, under which the ping did not fire at all, so it was timing two identical runs. It now
+  uses a local listener that accepts and never answers. That check retired with the counter it
+  tested.
+
+## 1.2.4 — 2026-08-30
+
+- **Fixed:** on Windows, stopping a server could kill an unrelated process. The port was matched
+  with `findstr :5173`, which also matches `0.0.0.0:51730`, so a longer port sharing the prefix was
+  caught too. Reported and patched by @anupamme in #1.
+- `killPort` no longer builds a shell command at all, on any platform. The port was already
+  sanitised by `Number()`, so this is hardening rather than a fix.
+
 ## 1.2.3 — 2026-08-30
 
 - The badge shown after an update now says **quit & reopen** rather than "restart to finish".
@@ -73,6 +106,7 @@ Notable changes to Server Studio. Dates are release dates.
 - Documented in the README, with `SERVER_STUDIO_NO_TELEMETRY=1` and `DO_NOT_TRACK` both honoured.
 - Signups go to the author's own list, so the bundled Cloudflare Worker keeps only anonymous counts
   and its open write route is gone.
+- **Superseded by 1.2.5:** none of this counting was ever active, and it was removed entirely.
 
 ## 1.1.1 — 2026-08-25
 

package/README.md

@@ -246,37 +246,26 @@ The one step no machine can do is click a folder and confirm, so the path that r
 directory is exercised by hand rather than by CI. If Browse ever misbehaves on your system, type the
 path into the field instead. Nothing else depends on it.
 
-## Telemetry
+## What it sends
 
-Server Studio sends one anonymous ping when it is installed and one when it launches, so
-installs can be counted. That is the whole of it.
+No usage tracking, no analytics, no account, no profile. Server Studio makes exactly two
+outbound requests, and neither carries anything about you that you did not type yourself.
 
-What is sent:
+**The update check.** On launch it fetches `registry.npmjs.org/server-studio/latest` to see
+whether a newer version exists. That is a plain read of a public URL, the same one `npm view`
+hits. No id, no version of yours, nothing identifying is sent.
 
-| Field | Example | Why |
-|---|---|---|
-| A random id | `9f3c...` | Generated on your machine, stored in your data folder. Lets two launches from one machine count as one user |
-| Version | `1.2.0` | Which versions are still in use |
-| OS, arch | `darwin`, `arm64` | Which platforms to test on |
-| Node major | `22` | Which Node versions to keep supporting |
-
-What is never sent: your projects, folder paths, run commands, ports, notes, IP-derived
-location, or anything you typed into the app. There is no account and no profile.
-
-Turn it off completely, before or after installing:
-
-```bash
-export SERVER_STUDIO_NO_TELEMETRY=1
-```
+**The email box in the sidebar.** Entirely opt-in and completely silent unless you type an
+address and press send. When you do, that address and your message go to `mahdicreates.com`,
+the author's own site, so he can reply and let you know when something ships. Nothing else is
+attached.
 
-The standard `DO_NOT_TRACK=1` is honoured too, and nothing is sent under CI. The ping never
-blocks anything: it is fired without holding the process open, so a blocked or offline
-network costs you no time at all.
+That is the whole list. Your projects, folder paths, run commands, ports and notes never leave
+your machine, and there is no install counter of any kind.
 
-The email box in the sidebar is separate and entirely opt-in. Nothing is sent from it unless
-you type an address and press send. When you do, your address and your message go to
-`mahdicreates.com`, which is the author's site, so he can reply and let you know when
-something new ships. Nothing else about you is attached.
+> Versions 1.2.0 to 1.2.4 shipped an anonymous install counter that was never switched on.
+> The endpoint came from an environment variable with no default, so no published build ever
+> sent a ping and no collector was ever deployed. It was removed outright in 1.2.5.
 
 ## Your data
 
@@ -311,7 +300,6 @@ signups arrive in someone else's inbox:
 | What | Where | Why |
 |---|---|---|
 | `SERVER_STUDIO_SUBSCRIBE_URL` | `src/telemetry.js` | Defaults to `mahdicreates.com`. Point it at your own endpoint, or set it empty to remove the sidebar box entirely |
-| `SERVER_STUDIO_ANALYTICS_URL` | unset by default | Install counting is inert unless you set this to your own collector |
 
 The creator credit in the sidebar is ordinary MIT-licensed source. You are free to change it,
 same as any other part.

package/bin/cli.js

@@ -6,7 +6,6 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const telemetry = require('../src/telemetry');
 
 const ROOT = path.join(__dirname, '..');
 const APP_NAME = 'Server Studio.app';
@@ -118,8 +117,6 @@ function install() {
     console.log('\nUsing Claude Cowork? Install the plugin by opening this file:');
     console.log('  ' + pluginFile);
   }
-
-  telemetry.ping('install'); // counts a real install (never fires on --dry-run: it returns above)
 }
 
 /* ---------- uninstall ---------- */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-studio",
-  "version": "1.2.3",
+  "version": "1.2.5",
   "description": "A tiny dashboard for your local dev servers. One click to run, stop and open them, with one permanent port per project.",
   "author": "Md Mahdi Hasan",
   "license": "MIT",

package/src/platform.js

@@ -4,7 +4,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { execFile, exec } = require('child_process');
+const { execFile } = require('child_process');
 
 const WIN = process.platform === 'win32';
 const MAC = process.platform === 'darwin';
@@ -86,15 +86,21 @@ function killPort(port, cb) {
   if (!p) return cb(new Error('bad port'));
   if (WIN) {
     // netstat lists the owning PID in the last column of LISTENING rows.
-    return exec('netstat -ano -p tcp | findstr LISTENING | findstr :' + p, (err, stdout) => {
+    // execFile (no shell) avoids ever building a shell command string from `port`.
+    return execFile('netstat', ['-ano', '-p', 'tcp'], (err, stdout) => {
       const pids = new Set(String(stdout || '').trim().split(/\r?\n/)
+        .filter(l => /LISTENING/.test(l) && l.includes(':' + p + ' '))
         .map(l => l.trim().split(/\s+/).pop())
         .filter(x => /^\d+$/.test(x) && x !== '0'));
       if (!pids.size) return cb(null);
-      exec([...pids].map(id => 'taskkill /PID ' + id + ' /T /F').join(' & '), () => cb(null));
+      execFile('taskkill', ['/T', '/F', ...[...pids].flatMap(id => ['/PID', id])], () => cb(null));
     });
   }
-  return exec('lsof -nti tcp:' + p + ' | xargs kill 2>/dev/null', () => cb(null));
+  return execFile('lsof', ['-nti', 'tcp:' + p], (err, stdout) => {
+    const pids = String(stdout || '').trim().split(/\r?\n/).filter(Boolean);
+    if (!pids.length) return cb(null);
+    execFile('kill', pids, () => cb(null));
+  });
 }
 
 /* ---------- native "choose a folder" dialog ---------- */

package/src/server.js

@@ -199,8 +199,8 @@ const server = http.createServer(async (req, res) => {
     });
   }
 
-  // Optional email signup. The browser posts here (same-origin), and we forward the
-  // user's chosen email to the remote counter. Inert if no analytics URL is set.
+  // Optional email signup. The browser posts here (same-origin) and we forward the
+  // address the user typed to the signup endpoint. Nothing is sent until they press send.
   if (req.method === 'POST' && url === '/api/subscribe') {
     const b = await body(req);
     if (!b) return send(res, 415, { error: 'expected application/json' });
@@ -277,7 +277,6 @@ const server = http.createServer(async (req, res) => {
 ensureStore();
 server.listen(PORT, '127.0.0.1', () => {
   console.log('Server Studio running on http://localhost:' + PORT);
-  telemetry.ping('start'); // one anonymous count per real launch (app or CLI)
   plat.openExternal('http://localhost:' + PORT + '/', () => {});
 });
 server.on('error', (e) => {

package/src/telemetry.js

@@ -1,118 +1,17 @@
-// Anonymous usage counter + optional email signup. Built-ins only, no dependencies.
+// The email signup / "ask" box. Built-ins only, no dependencies.
 //
-// Two things live here, and they are very different:
-//   ping(event)        anonymous, opt-out, fire-and-forget. A random id + OS/version.
-//   subscribe(email)   an explicit, user-typed signup. Sends the email the user chose
-//                      to give. Never automatic, never affected by the opt-out flag.
+// This file used to also hold an anonymous install counter. It was never switched on:
+// the endpoint came from an env var with no default, so no build ever sent a ping, and
+// the Cloudflare Worker meant to receive them was never deployed. It is gone rather
+// than left dormant. Server Studio now makes exactly one outbound request, and only
+// when someone types a message and presses send.
 //
-// Both are INERT until SERVER_STUDIO_ANALYTICS_URL points at your Worker origin, e.g.
-//   SERVER_STUDIO_ANALYTICS_URL=https://server-studio-analytics.you.workers.dev
-// The code appends /collect and /subscribe itself.
+//   subscribe(email, message)   explicit, user-typed. Never automatic.
 'use strict';
 
-const path = require('path');
-const crypto = require('crypto');
-const fs = require('fs');
-
-const BASE = (process.env.SERVER_STUDIO_ANALYTICS_URL || '').replace(/\/+$/, '');
-
-// Signups go to the site's own subscriber list, not to the counter. They are two
-// separate things: one is an anonymous tally, this is a person asking to be emailed.
-// Overridable so a fork points somewhere else instead of at this list.
+// Overridable so a fork points at its own list instead of this one.
 const SUBSCRIBE_URL = process.env.SERVER_STUDIO_SUBSCRIBE_URL || 'https://www.mahdicreates.com/api/subscribe';
 
-function optedOut() {
-  if (process.env.SERVER_STUDIO_NO_TELEMETRY) return true;
-  const dnt = String(process.env.DO_NOT_TRACK || '').toLowerCase();
-  return dnt === '1' || dnt === 'true';
-}
-
-function appVersion() {
-  // Running from a checkout, package.json is one level up. Inside the installed app
-  // bundle there is no package.json, so the installer stamps version.json beside the
-  // code. Try both before giving up.
-  try { return require('./version.json').version || '0.0.0'; } catch (e) {}
-  try { return require('../package.json').version || '0.0.0'; } catch (e) {}
-  return '0.0.0';
-}
-
-function dataDir() {
-  try { return require('./platform').dataDir(); }
-  catch (e) {
-    const os = require('os');
-    if (process.env.SERVER_STUDIO_DATA_DIR) return process.env.SERVER_STUDIO_DATA_DIR;
-    if (process.platform === 'darwin') return path.join(os.homedir(), 'Library', 'Application Support', 'Server Studio');
-    if (process.platform === 'win32') return path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'Server Studio');
-    return path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'server-studio');
-  }
-}
-
-// { id, fresh }. `fresh` is true the first time an id is minted.
-function installId() {
-  const dir = dataDir();
-  const file = path.join(dir, 'analytics-id');
-  try {
-    const existing = fs.readFileSync(file, 'utf8').trim();
-    if (existing) return { id: existing, fresh: false };
-  } catch (e) { /* not created yet */ }
-  const id = crypto.randomUUID();
-  try {
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(file, id + '\n');
-    return { id, fresh: true };
-  } catch (e) {
-    return { id, fresh: false }; // read-only home: still count, just cannot dedupe
-  }
-}
-
-function notice() {
-  let link = '';
-  try { link = (require('../package.json').homepage || '').split('#')[0]; } catch (e) {}
-  console.error(
-    'Server Studio sends one anonymous ping (a random id + your OS and version, no\n' +
-    'personal data) so installs can be counted. Turn it off any time with\n' +
-    '  SERVER_STUDIO_NO_TELEMETRY=1' + (link ? '   ·  ' + link + '#telemetry' : '')
-  );
-}
-
-// Low-level POST. Resolves { ok } and never rejects.
-function post(pathname, obj, timeout, keepAlive) {
-  return new Promise(resolve => {
-    try {
-      if (!BASE) return resolve({ ok: false });
-      const payload = JSON.stringify(obj);
-      const u = new URL(BASE + pathname);
-      const client = u.protocol === 'http:' ? require('http') : require('https');
-      const req = client.request({
-        hostname: u.hostname,
-        port: u.port || (u.protocol === 'http:' ? 80 : 443),
-        path: u.pathname,
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
-        timeout: timeout || 1500,
-      }, res => {
-        res.resume(); // drain
-        resolve({ ok: res.statusCode >= 200 && res.statusCode < 300 });
-      });
-      req.on('error', () => resolve({ ok: false }));
-      req.on('timeout', () => { req.destroy(); resolve({ ok: false }); });
-      // Never keep the process alive for a ping. On a network that cannot reach the
-      // endpoint this is the difference between exiting now and waiting out the
-      // timeout. A ping that would not have arrived is not worth a second of anyone's
-      // install. Subscribe passes keepAlive because a person is waiting on the answer.
-      //
-      // The socket has to be unref'd as well as the request. On Node 18 unref'ing the
-      // request before a socket exists does not propagate, and the process sat there
-      // for seconds on a blocked network.
-      if (!keepAlive) {
-        req.on('socket', sock => { if (sock && typeof sock.unref === 'function') sock.unref(); });
-        if (typeof req.unref === 'function') req.unref();
-      }
-      req.end(payload);
-    } catch (e) { resolve({ ok: false }); }
-  });
-}
-
 // POST to an absolute URL and hand back the parsed body. Never rejects.
 function postTo(absUrl, obj, timeout) {
   return new Promise(resolve => {
@@ -138,28 +37,12 @@ function postTo(absUrl, obj, timeout) {
       });
       req.on('error', () => resolve({ ok: false, json: null }));
       req.on('timeout', () => { req.destroy(); resolve({ ok: false, json: null }); });
+      // Deliberately not unref'd: a person pressed send and is waiting on the answer.
       req.end(payload);
     } catch (e) { resolve({ ok: false, json: null }); }
   });
 }
 
-// Anonymous, fire-and-forget.
-function ping(event) {
-  try {
-    if (!BASE || optedOut() || process.env.CI) return;
-    const { id, fresh } = installId();
-    if (fresh) { try { notice(); } catch (e) {} }
-    post('/collect', {
-      event: String(event || 'ping'),
-      id,
-      v: appVersion(),
-      os: process.platform,
-      arch: process.arch,
-      node: process.versions.node.split('.')[0],
-    }, 1500);
-  } catch (e) { /* best-effort, always */ }
-}
-
 // Explicit signup. Returns a Promise<boolean> so the UI can confirm.
 async function subscribe(email, message) {
   try {
@@ -169,11 +52,13 @@ async function subscribe(email, message) {
     const body = { email: e };
     const m = String(message || '').trim().slice(0, 2000);
     if (m) body.message = m;
-    // Deliberately not gated on the telemetry opt-out: typing an address and pressing
-    // send is an explicit request, not tracking, and refusing it would be wrong.
-    const r = await postTo(SUBSCRIBE_URL, body, 6000);
+    // 6s was not enough. The endpoint fans out to WordPress, FluentCRM and an SMTP
+    // relay, and a cold function walked past it, so a first-time sender saw a silent
+    // failure on the one attempt they were ever going to make. Warm it answers in
+    // about 2s. A person is watching a spinner, so waiting is better than lying.
+    const r = await postTo(SUBSCRIBE_URL, body, 15000);
     return !!(r && r.ok && r.json && r.json.success);
   } catch (e) { return false; }
 }
 
-module.exports = { ping, subscribe, enabled: !!BASE, subscribeEnabled: !!SUBSCRIBE_URL };
+module.exports = { subscribe, subscribeEnabled: !!SUBSCRIBE_URL };