Kody

Security

• .eval() never runs Twig an untrusted editor wrote with full access: with Craft's Twig sandbox on (enableTwigSandbox) it renders sandboxed, and without it, it only runs content last saved by an admin. Content last saved by anyone else renders nothing and logs why.
• A field's maxHeight must be a CSS length; anything that could add declarations to the style attribute is ignored.

Added

• Initial release.
• PHPStan (level 4) and ECS configuration.
• A Code field built on Monaco, via nystudio107's CodeEditor library: per-field language or an author-chosen one, height that follows the content up to a cap, theme, line numbers, minimap, word wrap, placeholder and default value.
• Entries can be queried by a Code field's language: .snippet({ language: 'twig' }).
• Twig and Craft API autocomplete, scoped to Twig fields — a CSS field is not offered completions it has nothing to do with.
• Optional syntax validation on save, for the two languages where "does not parse" is a fact rather than an opinion: Twig and JSON.
• A Snippets element type and library, with handles, reference tags ({kody:handle:render}), a control-panel index, permissions, and console commands for listing and importing.
• A Snippets relation field for picking from the library.
• Server-side syntax highlighting for 46 languages, cached by content, with no highlighter shipped to the browser.
• Front-end rendering: captions, filenames, line numbers as CSS counters, line highlighting, soft wrap, max height, a copy button, and light/dark/auto themes driven by custom properties.
• craft.kody Twig variable, plus |kody, |kodyHighlight and |kodyInline filters and the kody() and kodySnippet() functions.
• GraphQL types for field values and snippets, including server-highlighted HTML.
• kody/languages/list and kody/languages/check for inspecting the registry and testing a grammar against a real file.