{"id":51573702,"url":"https://github.com/g023/dsphpedit","last_synced_at":"2026-07-10T22:02:05.775Z","repository":{"id":367116150,"uuid":"1278766909","full_name":"g023/dsphpedit","owner":"g023","description":"DS PHP Edit - A DeepSeek V4 Powered PHP Editor with advanced AI capabilities like code completion, analysis, agentic interaction. Throw your project in a working_folder, set your deepseek key, and go. Not meant for a publicly accessible folder.","archived":false,"fork":false,"pushed_at":"2026-06-24T15:25:51.000Z","size":6871,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-24T17:14:28.600Z","etag":null,"topics":["agentic-ai","ai","code","code-completion","code-generation","deepseek","deepseek-v4","developer","developer-tools","ide","llm","php","programming","web-design","web-development"],"latest_commit_sha":null,"homepage":"https://github.com/g023/dsphpedit","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/g023.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-24T04:47:20.000Z","updated_at":"2026-06-24T15:27:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/g023/dsphpedit","commit_stats":null,"previous_names":["g023/dsphpedit"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/g023/dsphpedit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/g023%2Fdsphpedit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/g023%2Fdsphpedit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/g023%2Fdsphpedit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/g023%2Fdsphpedit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/g023","download_url":"https://codeload.github.com/g023/dsphpedit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/g023%2Fdsphpedit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35344523,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-10T02:00:06.465Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agentic-ai","ai","code","code-completion","code-generation","deepseek","deepseek-v4","developer","developer-tools","ide","llm","php","programming","web-design","web-development"],"created_at":"2026-07-10T22:02:03.344Z","updated_at":"2026-07-10T22:02:05.762Z","avatar_url":"https://github.com/g023.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# 🛠️ DS PHP Edit\n\n### A self-hosted, **DeepSeek V4–powered web IDE** for editing and **live-previewing PHP** — right in your browser.\n\nDrop a PHP project into `working_folder/`, edit it with full syntax highlighting,\nask the AI to explain / rewrite / surgically patch your code, then hit **▶ Preview**\nto run the PHP **server-side** and see the real, rendered result.\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-22c55e.svg)](LICENSE)\n[![PHP 8.1+](https://img.shields.io/badge/PHP-8.1%2B-777bb4.svg)](https://www.php.net/)\n[![Editor: Ace](https://img.shields.io/badge/Editor-Ace-0e639c.svg)](https://ace.c9.io/)\n[![AI: DeepSeek V4](https://img.shields.io/badge/AI-DeepSeek%20V4-4f46e5.svg)](https://api.deepseek.com/)\n[![No CDN](https://img.shields.io/badge/Assets-100%25%20Local-ef4444.svg)](#-no-cdn-everything-is-vendored)\n\n**Author:** [g023](https://github.com/g023/) · **Editor:** Ace (BSD-3, vendored) · **No CDN — every asset is local.**\n\n\u003cimg src=\"screenshot_vids/ds-php-edit-demo.gif\" alt=\"DS PHP Edit — edit, ask AI, preview server-side\" width=\"800\"\u003e\n\n\u003c/div\u003e\n\n---\n\n## 🚨 READ THIS FIRST — Do **NOT** put this on a public server\n\n\u003e ## ⛔ This tool runs arbitrary PHP. It is **NOT** for a publicly accessible folder.\n\u003e\n\u003e The entire point of **Preview** is to **execute user-supplied PHP through the web server** — that is **remote code execution by design**, and **no PHP setting makes it safe against a stranger.** Anyone who can reach this app can run any code on your machine.\n\u003e\n\u003e ### The one supported posture:\n\u003e ### 👉 **Single trusted operator, bound to `127.0.0.1` (localhost).**\n\u003e\n\u003e **Never** expose DS PHP Edit on a shared host, a VPS with a public port, a `0.0.0.0` bind, or any internet-reachable directory. Every other security control in this app (CSP, CSRF, path sandboxing, upload hardening) is **defense-in-depth on top of network isolation — never a substitute for it.**\n\nSee [`SECURITY.md`](SECURITY.md) for the full threat model. **If in doubt, keep it on your laptop.**\n\n---\n\n## ✨ The whole loop in one sentence\n\n\u003e **Drop a PHP project in → open a file → edit it → ask the AI → ▶ Preview → repeat.**\n\n| | |\n|---|---|\n| ✏️ **Edit** real PHP with highlighting, line numbers \u0026 AI autocomplete | 🤖 **Ask** DeepSeek to explain, rewrite, or patch your code |\n| ▶️ **Preview** runs your PHP *server-side* — real output, not a static playground | 📦 **One-click ZIP** backups \u0026 safe restore |\n| 🖼️ **Media library** with auto-thumbnails \u0026 snippet insertion | 🔒 **100% local** — no CDN, no telemetry, no build step |\n\n---\n\n## 📸 Screenshots\n\n\u003ctable\u003e\n  \u003ctr\u003e\n    \u003ctd width=\"50%\"\u003e\u003cimg src=\"screenshots/01-editor-overview.png\" alt=\"Editor overview\"\u003e\u003cbr\u003e\u003cb\u003eEditor\u003c/b\u003e — Ace highlighting, line numbers, file tree, tabs\u003c/td\u003e\n    \u003ctd width=\"50%\"\u003e\u003cimg src=\"screenshots/02-live-preview.png\" alt=\"Live server-side preview\"\u003e\u003cbr\u003e\u003cb\u003eLive preview\u003c/b\u003e — your PHP executed for real, server-side\u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n    \u003ctd\u003e\u003cimg src=\"screenshots/03-ai-assistant.png\" alt=\"AI assistant\"\u003e\u003cbr\u003e\u003cb\u003eAI assistant\u003c/b\u003e — Explain / Full rewrite / Edit (search-replace)\u003c/td\u003e\n    \u003ctd\u003e\u003cimg src=\"screenshots/04-analysis-tools.png\" alt=\"Analysis tools\"\u003e\u003cbr\u003e\u003cb\u003eAnalysis\u003c/b\u003e — in-process syntax-check lint (no \u003ccode\u003ephp -l\u003c/code\u003e subprocess), structure outline, metrics\u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n    \u003ctd\u003e\u003cimg src=\"screenshots/05-backups.png\" alt=\"Backups and restore\"\u003e\u003cbr\u003e\u003cb\u003eBackups\u003c/b\u003e — one-click ZIP, Zip-Slip-safe restore\u003c/td\u003e\n    \u003ctd\u003e\u003cimg src=\"screenshots/06-media-library.png\" alt=\"Media library\"\u003e\u003cbr\u003e\u003cb\u003eMedia library\u003c/b\u003e — upload, thumbnail, insert at cursor\u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\u003e 🎥 A full walkthrough video is in [`screenshot_vids/`](screenshot_vids/) (`ds-php-edit-demo.mp4` / `.gif`).\n\n---\n\n## 🚀 Quick start (zero-install, drop-in)\n\nThere is **no build step, no installer, no package manager, no setup wizard.** Getting the folder onto a PHP host and opening it is the *entire* deployment.\n\n### 1. Get the code\n\n```bash\ngit clone https://github.com/g023/dsphpedit.git\ncd dsphpedit\n```\n\n### 2. Add your DeepSeek API key\n\nCopy the example key file and paste your `sk-...` key into it (one line):\n\n```bash\ncp K.dat.example K.dat\n# then edit K.dat and replace the placeholder with your real DeepSeek key\n```\n\n\u003e 🔑 Get a key at \u003chttps://platform.deepseek.com/\u003e. The key stays **server-side only** — it never reaches the browser. Editing and preview work **without** a key; only the AI features need it.\n\n### 3. Run it (localhost only)\n\n**Option A — built-in PHP server (recommended, easiest localhost binding):**\n\n```bash\nphp -S 127.0.0.1:8000 router.php\n# open http://127.0.0.1:8000/\n```\n\nThe `router.php` front controller blocks direct HTTP access to secrets/state (`K.dat`, history JSON, backups, dotfiles) and serves vendored assets directly.\n\n**Option B — Apache (userdir / vhost / subfolder):**\n\nPlace the folder under a served path, e.g. `~/public_html/dsphpedit/`, and open\n`http://localhost/~youruser/dsphpedit/`. The bundled `.htaccess` denies `K.dat`\nand dotfiles; `working_folder/uploads/.htaccess` makes the upload dir\nnon-executable. The app is **path-independent** — every server path derives from\n`__DIR__` and every front-end URL is relative, so it works at any path or location.\n\n\u003e 🔒 **To hard-enforce localhost at the Apache layer:** uncomment the\n\u003e `Require ip 127.0.0.1` block in `.htaccess`, or bind Apache's `Listen` to `127.0.0.1`.\n\n### 4. That's it\n\nRequired runtime directories (`working_folder/uploads/`, `working_folder/g023_backups/`, `working_folder/g023_history.json`, thumbnails) are **auto-created on first use** — delete them and they come back. A small sample project (`welcome.php`) is already in `working_folder/` so you have something to preview immediately.\n\n---\n\n## ✅ Requirements\n\n- **PHP 8.1+** (developed against 8.4). A CLI `php` binary must be available (used for preview + lint).\n- PHP extensions — **all stock, no PECL/compile:**\n  **`curl`** (DeepSeek), **`gd`** (thumbnails), **`zip`** (backups),\n  **`fileinfo`** (upload MIME), **`mbstring`**, plus `json` / `session`.\n\nVerify your host before you start:\n\n```bash\nphp tools/selfcheck.php       # checks extensions, writable dirs, key, preview capability\nphp tools/test_paths.php      # path-traversal test suite — must be ALL GREEN\nphp tools/test_features.php   # settings / PEEK / agentic-reading suite (in-process assertions)\n```\n\nBoth also render in a browser (they are localhost-only tools).\n\n\u003e ⚠️ The `working_folder/` must be **writable by the web-server user** (e.g. `www-data`\n\u003e under Apache). If saves, uploads, or backups fail with \"Write failed,\" fix the\n\u003e directory permissions.\n\n---\n\n## 🧩 Features\n\n| Area | What you get |\n|---|---|\n| **Editor** | Ace with syntax highlighting + line numbers for PHP / HTML / JS / CSS / JSON / Markdown, language auto-selected by extension, `Ctrl+S` to save, dirty-state tracking, multi-file tabs with persisted UI state. |\n| **AI code completion** | Copilot-style inline **ghost-text** suggestions from DeepSeek (flash, fill-in-the-middle using code before *and* after the cursor). Suggestions are **overlap-deduped** so they splice in cleanly — any head that re-types the code before the cursor (e.g. a doubled `//`) or tail that re-types the code after it (doubled `)`, `;`, `}`, or whole lines) is trimmed server-side. Toggle on/off (`Alt+Shift+A` or the **✨ Complete** control); choose **Manual** (suggest on `Alt+\\`) or **Auto** (suggest as you pause). Accept all with **✓ Accept**, one word with **✓ word** / `Alt+]`, dismiss with `Esc`. `Tab` keeps normal indent. Persists per browser. |\n| **File explorer** | Tree scoped to `working_folder/`; create / rename / delete files \u0026 folders; nested dirs; right-click actions. App-managed state is hidden from the picker. |\n| **Server-side preview** | Runs the saved PHP **natively through the web server** — exactly as it will in production (real `$_SERVER`, `header()`, sessions) — and renders output in a same-origin iframe. PHP errors / warnings / fatals are shown. Path-confined to `working_folder/`; works under Apache/mod_php, PHP-FPM, and `php -S`. |\n| **AI assistant** | DeepSeek V4. Three modes: **Explain** (Q\u0026A), **Full** (whole updated file → *Apply full code*), **Edit** (JSON search/replace → *Apply edits*). Optional **Thinking** mode surfaces reasoning. Token usage shown. |\n| **Models** | `deepseek-v4-flash` is the default everywhere (~3× cheaper). `deepseek-v4-pro` is an opt-in selector, never the default. |\n| **Media** | Upload images / PDF / audio / video. Server-side MIME allowlist (finfo), GD re-encode (strips payloads/EXIF), auto thumbnails, randomized filenames, **non-executable** upload dir. The media browser inserts the right snippet at the cursor. |\n| **History** | Conversations persisted to `working_folder/g023_history.json` — browsable, reloadable, clearable, rotated. |\n| **Backup / restore** | One-click ZIP of `working_folder/` (atomic). **Zip-Slip-safe** restore (per-entry validation, stream extraction, temp-dir-then-swap). Retention prunes oldest (default 20). |\n| **Analysis tools** | Non-AI: in-process syntax-check lint (`token_get_all` full-parse — no `php -l`/CLI subprocess), structure outline, metrics. AI: explain / refactor / docblocks / find-bugs (routed through DeepSeek on flash). |\n| **Settings** ⚙ | A settings panel for an **alternate working folder** and **alternate API-key path** (relative *or* absolute), plus default model, thinking on/off + reasoning effort, DeepSeek timeout, editor font/tab-size/word-wrap, auto-backup-on-save, and the agentic-reading/PEEK knobs. Stored in `dspe_settings.json` (never web-served, kept outside `working_folder/` so a folder switch never loses it); path changes prompt a reload. |\n| **Agentic reading** 🔍 | When you ask the AI about (or to edit) a file, it automatically reads the files that file *depends on* — following `include`/`require` **and** resolving symbols (functions/classes/constants used here but defined elsewhere) via the project map. Bounded by file/byte/depth budgets (configurable); over-budget files degrade to a summary. Each answer shows a **\"read N related files\"** badge listing exactly what was pulled in. Deterministic — no extra LLM round-trips. |\n| **PEEK project map** 🗺 | A compact structural map of `working_folder/` (symbols, signatures, namespaces, dependency edges) the AI is given so it understands your codebase without reading every file. Extracted with `token_get_all()`, cached at `working_folder/.g023_peek.json` and rebuilt incrementally (only changed files re-scan); browse it in the 🗺 panel. |\n| **Security** | Strict `'self'` CSP, CSRF on every state-changing POST, hardened sessions, security headers, single `safe_resolve()` path gate, key never reaches the browser. `dspe_settings.json` is denied to the web alongside `K.dat`. |\n\n---\n\n## 🗂️ Architecture\n\n```\ndsphpedit/\n├── index.php          Front-end shell (CSP, CSRF meta, vendored asset includes)\n├── config.php         Paths, model policy, limits, settings resolution, self-creating state\n├── router.php         Front controller for `php -S` (denies secrets/state)\n├── .htaccess          Apache hardening (denies K.dat, dspe_settings.json, dotfiles; security headers)\n├── K.dat              YOUR DeepSeek API key (git-ignored; never web-served)\n├── K.dat.example      Placeholder you copy to K.dat\n├── dspe_settings.json operator settings (never web-served; outside working_folder/; auto-created on first save)\n├── lib/\n│   ├── ds4.php        Canonical DeepSeek connector (ds4_chat / llm_get)\n│   ├── paths.php      safe_resolve() — the ONE gate for all file I/O\n│   ├── security.php   session bootstrap, CSRF, security headers, api_guard()\n│   ├── settings.php   settings schema, validation, save, path checks\n│   ├── codemap.php    PEEK map builder (symbols + dependency edges, cached)\n│   ├── context.php    agentic reading (follows includes + symbol refs)\n│   └── response.php   JSON envelope helpers\n├── api/\n│   ├── files.php      list / read / write / create / rename / delete / mkdir\n│   ├── preview.php    server-side PHP execution (the headline feature)\n│   ├── ai_chat.php    explain / full / edit modes (+ agentic context)\n│   ├── complete.php   AI inline code completion (fill-in-the-middle)\n│   ├── settings.php   get / save / reset operator settings\n│   ├── peek.php       project map: render / structured / symbols / deps\n│   ├── upload.php     finfo + GD re-encode + thumbnail\n│   ├── media.php      media browse + thumbnail/raw serving\n│   ├── history.php    conversation history\n│   └── backup.php     create / list / restore / delete (Zip-Slip-safe)\n├── ai_tools/assist.php   programmatic AI tools (explain/refactor/docblocks/bugs)\n├── tools/\n│   ├── analyze.php       non-AI lint / outline / metrics\n│   ├── selfcheck.php     environment self-check\n│   ├── test_features.php settings / PEEK / agentic-reading suite (36 assertions)\n│   └── test_paths.php    traversal test suite\n├── assets/vendor/     Ace (BSD-3) + jQuery — all local, no CDN\n├── docs/PRD.md        product requirements / spec of record\n└── working_folder/    YOUR project under edit (the sandbox boundary)\n    ├── welcome.php     sample file (preview this first)\n    ├── uploads/        media (non-executable, .htaccess)\n    ├── g023_backups/   ZIP snapshots (auto-created)\n    ├── .g023_peek.json cached PEEK map (hidden, per-working-folder)\n    └── g023_history.json  conversation history (auto-created)\n```\n\n**Boundary rule:** every file read / write / upload / preview passes through\n`safe_resolve()`, confining it to `working_folder/`.\n\n---\n\n## 🔌 DeepSeek integration notes\n\n- Endpoint: `https://api.deepseek.com/chat/completions` (OpenAI-compatible). Bearer auth; key trimmed.\n- The connector returns `['reasoning', 'response', 'meta' =\u003e [id, model, finish_reason, usage, tool_calls?]]`.\n- `reasoning` comes from `message.reasoning_content` (populated only when **Thinking** is enabled via `thinking: {type: enabled}`).\n- Default model **`deepseek-v4-flash`**; `deepseek-v4-pro` is opt-in. Legacy `deepseek-chat` / `deepseek-reasoner` are **not** targeted.\n- **Code completion sends `thinking: {type: disabled}`.** flash reasons by default even when the param is omitted, and that reasoning adds latency *and* is counted against `max_tokens` — often consuming the whole budget and returning an empty completion (`finish_reason=length`). Disabling thinking makes completions fast (~1s) and non-truncated. (The chat assistant leaves Thinking user-controllable.)\n- **Code completion is FIM-with-dedup.** The prompt sends up to 6000 chars of prefix and 4000 chars of suffix, instructing the model that the code after the cursor *already exists* and must not be rewritten. Because chat models still re-emit closers and restate just-typed tokens, the server trims the completion against the real prefix (`dspe_trim_prefix_overlap`) and the **full** untruncated suffix (`dspe_trim_suffix_overlap`) before returning it — single-char overlaps are only trimmed when structural (punctuation / closers / whitespace) to avoid eating a coincidental identifier letter.\n\n---\n\n## 🧱 No CDN — everything is vendored\n\nEvery third-party asset (the Ace editor and jQuery) is **downloaded into\n`assets/vendor/`** and served locally. There are **no external script tags, no\nCDN calls, and no telemetry.** Combined with the strict `'self'` CSP, the browser\ntalks only to your own server. Third-party licenses are reproduced in\n[`LICENSE`](LICENSE) and alongside the vendored code.\n\n---\n\n## 🩺 Troubleshooting\n\n- **AI says \"no K.dat key\":** copy `K.dat.example` → `K.dat` and paste your `sk-...` key. Editing/preview work without it.\n- **Preview is blank / errors:** PHP fatals are shown in the preview pane; check the diagnostics banner. Preview runs with a 15s timeout and a memory cap.\n- **\"Write failed\" on save/upload/backup:** make `working_folder/` writable by the web-server user.\n- **Backups fail:** ensure the `zip` extension is loaded (`php tools/selfcheck.php`).\n\n---\n\n## 📄 License\n\nMIT © [g023](https://github.com/g023/). See [`LICENSE`](LICENSE).\nBundles **Ace** (BSD-3-Clause) and **jQuery** (MIT), vendored under `assets/vendor/`.\n\n---\n\n\u003cdiv align=\"center\"\u003e\n\n**Built for builders.** Drop a project in, edit, ask, preview. That's the whole loop.\n\n⭐ If this is useful, star it on [GitHub](https://github.com/g023/dsphpedit).\n\n\u003c/div\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fg023%2Fdsphpedit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fg023%2Fdsphpedit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fg023%2Fdsphpedit/lists"}