CodeForge

Edit

• Monaco (the editor inside VS Code), bundled: tabs, PHP / JavaScript / CSS / HTML / JSON / Markdown highlighting, CSS / HTML / JSON language services, find in files across themes and plugins, a lazy file tree with create / rename / delete / upload, image preview
• Every PHP save runs php -l first (or the PHP parser when no CLI exists): a file with a syntax error never lands, the error line is marked in the editor
• A snapshot of the file is taken before every save, rename, delete, upload, rollback and push; one-click rollback; unified and side-by-side diffs; retention per file and by age

Deploy

• Git: clone a repository into a theme or plugin folder (public, HTTPS token or SSH deploy key), pull, list and switch branches, status and log; a webhook URL per repository that verifies GitHub / Gitea HMAC signatures or the GitLab token and pulls the bound branch; email on deploy
• Staging: duplicate a theme or plugin to …-staging, edit there, push to live — changed PHP files are syntax-checked, every overwritten or removed live file is snapshotted first
• Preview any theme in your own browser with a signed cookie; the site's active theme does not change

Control

• Only wp-content/themes, plugins and mu-plugins are reachable; wp-config.php, .htaccess, wp-settings.php and anything outside are never readable or writable; symlinks are not followed; CodeForge cannot edit itself
• DISALLOW_FILE_EDIT / DISALLOW_FILE_MODS are honoured: the plugin is read-only until an administrator allows edits in Settings (logged)
• Protected paths of your own that need an unlock per session; an activity log of who changed what, with masked addresses
• Opt-in WP-CLI runner: arguments go straight to wp (no shell), only read-mostly subcommands are allowed, nothing with --path, no database writes, no eval, no installs; every run is logged and time-limited

Snippets

• PHP, CSS and JavaScript snippets with scope (front, admin, both) and order; PHP snippets run from one mu-plugin loader that isolates each one and switches off any snippet that throws or fatals; a one-hour safe mode pauses them all; syntax-checked before enabling

Integrate

• REST codeforge/v1 (tree, file, search, snapshots, lint) for administrators with an application password; wp codeforge snapshots|rollback|lint|snippets|snippet|safe|prune; Site Health check