PHPackages                             kabachello/codiware - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [DevOps & Deployment](/categories/devops)
4. /
5. kabachello/codiware

ActiveLibrary[DevOps & Deployment](/categories/devops)

kabachello/codiware
===================

Codiware Editor - PHP cloud IDE delivered as a single PSR-15 middleware.

0.4.5(1w ago)1125[1 issues](https://github.com/kabachello/codiware/issues)MITJavaScriptPHP >=8.2

Since Jun 2Pushed 1w agoCompare

[ Source](https://github.com/kabachello/codiware)[ Packagist](https://packagist.org/packages/kabachello/codiware)[ RSS](/packages/kabachello-codiware/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (10)Dependencies (37)Versions (17)Used By (0)

Codiware
========

[](#codiware)

A self-contained, embeddable web IDE delivered as a single PSR-15 middleware plus a dependency-free SPA. Codiware is designed to be mounted under an arbitrary base path inside any PHP host application (e.g. the ExFace workbench) and operate on a configurable set of workspace folders.

Features
--------

[](#features)

- File tree, multi-tab editor, save / rename / delete / upload / download
- Pluggable editor registry (textarea fallback included; Monaco, CodeMirror, Toast UI, etc. can be plugged in via npm-asset packages or custom JS)
- Git source-control panel (status, stage / unstage / discard, commit, amend, push, branches, history) over the local `git` CLI
- Workspace-wide search and search-and-replace with regex / case options
- In-IDE console with a deny-by-default allowlist + operator-curated presets
- Light/dark themes via CSS custom properties; per-locale translations
- All paths protected by a single `PathGuard` that rejects traversal, symlink escape, and matches configurable deny patterns (`.env`, `*.key`, …)

Requirements
------------

[](#requirements)

- PHP **8.2+**
- Composer
- Server Content-Security-Policies must include these:
    - `font-src data: ; worker-src blob: ;`
- Optional: a local `git` binary for the source-control panel

Install
-------

[](#install)

```
composer require axenox/codiware
```

The package depends on `npm-asset/*` packages for optional front-end editors. The `composer.json` already enables [Asset Packagist](https://asset-packagist.org)so `npm-asset/monaco-editor` and friends can be installed alongside PHP packages.

Mount in a host
---------------

[](#mount-in-a-host)

```
use kabachello\Codiware\Middleware\CodiwareMiddleware;
use kabachello\Codiware\Middleware\CodiwareConfig;
use kabachello\Codiware\Middleware\UserContext;

$middleware = new CodiwareMiddleware(
    config: CodiwareConfig::fromFile(__DIR__ . '/codiware.json'),
    responseFactory: $psr17,
    streamFactory: $psr17,
    logger: $psrLogger,
    userContext: new UserContext($user->getName(), $user->getEmail(), $user->getId())
);
```

`CodiwareMiddleware` implements `Psr\Http\Server\MiddlewareInterface`. Any request whose URI path is **not** under the configured base path is delegated unchanged to the next handler.

### Workspace URL

[](#workspace-url)

`GET {basePath}/repo/{workspacePath...}` returns the SPA shell with a boot payload describing the requested workspace, user, theme, locale, and enabled extensions. All subsequent API calls go to other `{basePath}/...` routes.

Configuration
-------------

[](#configuration)

Defaults are shipped in `config/defaults.config.json`.

At runtime, `CodiwareConfig` behaves like ExFace config maps:

- keys are normalized to uppercase
- nested objects are flattened to dot keys (`CONSOLE.ENABLED`)
- arrays and arrays of objects stay as values (`CONSOLE.PRESETS`)

See `dev-server.config.json.example` for a documented sample.

Typical host override patterns:

```
$config = CodiwareConfig::fromFile(__DIR__ . '/codiware.json')
  ->set('URL_TO_API', '/api/ide/codiware')
  ->merge([
    'THEME.DEFAULT' => 'dark',
    'CONSOLE.TIMEOUT_SECONDS' => 120,
  ]);
```

Key options:

KeyPurpose`URL_TO_API`URL prefix the middleware listens on (default `/codiware`).`BASE_FOLDER`Folder whose direct children are valid workspace aliases.`ALLOWED_ROOTS`Explicit `[{alias, path, label}]` list overriding `BASE_FOLDER`.`DENY_PATTERNS``fnmatch` patterns rejected by `PathGuard`.`MAX_UPLOAD_BYTES`Per-file upload limit.`GIT.BINARY`Path to the `git` executable.`CONSOLE.ALLOW_PATTERNS`Regex allowlist for raw console commands.`CONSOLE.PRESETS``[{label, command}]` shortcuts always allowed.`THEME.DEFAULT``light` or `dark`.`TRANSLATIONS.DEFAULT_LOCALE`Initial UI locale.`EXTENSIONS.ENABLED`Identifiers of front-end extensions to load.Development server
------------------

[](#development-server)

```
composer install
cp dev-server.config.json.example dev-server.config.json
php -S localhost:8080 -t public public/dev-server.php
```

Open [http://localhost:8080/codiware/repo/{workspace-alias}](http://localhost:8080/codiware/repo/%7Bworkspace-alias%7D).

Extending the editor
--------------------

[](#extending-the-editor)

The SPA exposes a small global API on `window.Codiware`:

```
window.Codiware.registerEditor({
    id: 'my.editor',
    label: 'My editor',
    priority: 50,
    accepts: (entry) => /\.json$/i.test(entry.path),
    create: (host, ctx) => new MyEditor(host, ctx),
});
```

Each editor implements `load(content, meta)`, `getContent()`, `isDirty()`, `markClean()`, `destroy()`, and an optional `on('change'|'save-request', fn)`.

Adding a richer editor library (Monaco, CodeMirror 6, Toast UI):

1. `composer require npm-asset/monaco-editor` (or similar)
2. Drop a small JS module under `public/js/extensions/` that imports the library from `/{basePath}/assets/monaco-editor/...` and calls `window.Codiware.registerEditor(...)`.
3. Add the extension id to `EXTENSIONS.ENABLED` in the config — the SPA boot payload exposes the list so your extension knows it is enabled.

Security model
--------------

[](#security-model)

- All filesystem paths flow through `kabachello\Codiware\Workspace\PathGuard`, which resolves them via `realpath`, rejects `..` traversal and any path that ends up outside the workspace root, and matches the configured deny patterns against both the relative path and the basename.
- Uploaded ZIP archives are fully validated entry-by-entry (rejects absolute paths, `../`, and runs every resolved destination through `PathGuard`) to prevent zip-slip.
- Console commands are deny-by-default. A command runs only if it matches a preset label or a configured regex in `CONSOLE.ALLOW_PATTERNS`.
- The middleware never trusts the host with raw paths: workspace selection always goes through `WorkspaceResolver` which validates against `ALLOWED_ROOTS` / `BASE_FOLDER` first.

License
-------

[](#license)

MIT. See [LICENSE](LICENSE).

###  Health Score

39

—

LowBetter than 84% of packages

Maintenance78

Regular maintenance activity

Popularity16

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity44

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 88.2% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~3 days

Total

14

Last Release

13d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/ce17ef40c16ca9c117b01615c538a0f9ec310966110fd4816d2684a43c298cef?d=identicon)[Kabachnik](/maintainers/Kabachnik)

---

Top Contributors

[![kabachello](https://avatars.githubusercontent.com/u/4246282?v=4)](https://github.com/kabachello "kabachello (15 commits)")[![MiriamSeitz](https://avatars.githubusercontent.com/u/150794245?v=4)](https://github.com/MiriamSeitz "MiriamSeitz (2 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/kabachello-codiware/health.svg)

```
[![Health](https://phpackages.com/badges/kabachello-codiware/health.svg)](https://phpackages.com/packages/kabachello-codiware)
```

###  Alternatives

[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k16](/packages/tempest-framework)[typo3/cms-core

TYPO3 CMS Core

3713.2M5.2k](/packages/typo3-cms-core)[cakephp/cakephp

The CakePHP framework

8.8k19.5M1.8k](/packages/cakephp-cakephp)[shopware/core

Shopware platform is the core for all Shopware ecommerce products.

585.6M600](/packages/shopware-core)[shopware/platform

The Shopware e-commerce core

3.4k1.5M3](/packages/shopware-platform)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)