PHP Lint Local + SSH for Nova

PHP Lint Local + SSH validates the active PHP document in Nova with either a PHP interpreter installed on the Mac or one on a server reached through SSH. It checks the exact text currently held by the editor, including unsaved changes, and displays syntax errors on the corresponding lines in Nova's editor and Issues sidebar.

Features

• Manual validation with Command-Shift-V, the Editor menu, or Command Palette.
• Optional automatic validation when a PHP document is saved.
• A choice between local PHP and remote PHP over SSH.
• Discovery of installed local or remote PHP interpreters with Get PHP Versions.
• Manual selection of any absolute local or remote PHP executable path.
• Support for Nova's PHP, PHTML, and Advanced PHP syntaxes.
• SSH key authentication by default, with optional password authentication through macOS Keychain.
• Actionable authentication errors for rejected passwords, unavailable password login, and Keychain access problems.
• Full or anonymized copyable diagnostics for support requests without passwords, key data, PHP source, or document paths.
• Native Nova diagnostics with PHP's reported line numbers.
• Independent controls for errors, warnings and notices, and deprecations.
• Optional error and success notifications without mandatory popup noise.

Security Model

Local validation starts the selected PHP executable directly without a shell and sends the unsaved document through standard input. It does not create a temporary source file.

For remote validation, SSH key authentication is the recommended default. An identity file can be selected explicitly in the extension settings, or OpenSSH can obtain the key through SSH Agent and ~/.ssh/config.

Password authentication is available for servers that permit it. Nova collects the password in a masked input panel and stores it with the macOS Keychain Credentials API under the configured user, server, and port. It is not stored in extension settings, command arguments, environment variables, logs, or temporary files. A bundled local Expect helper receives it through a private process pipe and supplies it only to OpenSSH's interactive password prompt.

During remote validation:

1. The document's UTF-8 text is sent through SSH standard input.
2. The server creates a unique temporary PHP file with umask 077.
3. The selected interpreter runs php -l against that file. Diagnostic output is enabled only for the lint command, so the server's php.ini is not changed.
4. A shell trap removes the temporary file even if validation fails.
5. SSH uses a connection timeout and host-key verification. Key mode also uses BatchMode=yes; password mode permits exactly one interactive authentication attempt.

Settings

Open Extensions > Extension Library, select PHP Lint Local + SSH, and open the Settings tab.

• Server: for example, 192.168.10.1 or an alias from ~/.ssh/config.
• SSH port: normally 22.
• SSH user: for example, developer.
• Authentication: SSH key (recommended) or Password (macOS Keychain).
• Private key file: an optional absolute path used in key mode, such as /Users/example/.ssh/id_ed25519.
• Host key policy: Require trusted host key is recommended.
• PHP location: Local PHP on this Mac or Remote PHP over SSH.
• Remote PHP executable: for example, /usr/bin/php8.3.
• Local PHP executable: for example, /opt/homebrew/bin/php.
• Validate on save: enables automatic validation whenever a PHP document is saved.
• Show Errors: reports syntax and compile-time fatal errors. Enabled by default.
• Show Warnings: reports compile-time warnings and notices. Enabled by default.
• Show Deprecations: reports compile-time deprecations with warning severity. Enabled by default.
• Error Notifications: also shows a popup for syntax errors when errors are visible. Disabled by default.
• Success Notifications: confirms successful manual and automatic checks and notes visible warnings. Disabled by default.

Usage

Open a PHP document and press Command-Shift-V, choose Editor > Validate PHP, or run PHP Lint Local + SSH: Validate Current Document from the Command Palette. Nova applies the default shortcut when it does not conflict with another active command; it can be reassigned in Nova's key bindings settings when necessary.

Choose Extensions > PHP Lint Local + SSH > Get PHP Versions to scan either this Mac or the configured server, depending on the selected PHP location, and select a discovered interpreter. Local discovery checks the active PATH and common installations from Homebrew, MacPorts, MAMP, XAMPP, and Laravel Herd. Choose Extensions > PHP Lint Local + SSH > Test Selected PHP to verify the selected interpreter. These commands are kept in Nova's Extensions menu because that menu provides the active workspace required for result palettes and notifications.

To use password authentication, select Password (macOS Keychain) in the extension settings and choose Extensions > PHP Lint Local + SSH > Save or Change Password. The first manual connection can also open the secure password panel automatically. Choose Forget Saved Password to remove the credential for the configured user, server, and port. Automatic validation never opens a password dialog; it reports a configuration issue when no password has been saved.

After a validation, discovery, connection test, or credential operation, choose Extensions > PHP Lint Local + SSH > Copy Diagnostic Details to copy a support report. Choose Copy Anonymized Diagnostic Details for public issues; it also masks the SSH user, server, target, and matching values inside the PHP path or error text. Reports include the extension version, time, operation, authentication mode, PHP executable, host-key policy, process status, and a sanitized result. They are kept only in memory and are cleared when the extension reloads. Review a report before sharing it.

Enabled diagnostics appear in Nova's Issues sidebar and are marked on the line reported by PHP. Popups are shown only when the corresponding notification setting is enabled.

Limitations

• The remote server must be Unix-like and provide sh, mktemp, cat, and rm.
• Local discovery checks common installation locations. An interpreter installed elsewhere can be selected manually with its absolute path.
• Password mode requires /usr/bin/expect on the Mac and password or keyboard-interactive authentication on the SSH server. Multi-step authentication is not supported.
• Copying diagnostic details requires Nova's clipboard permission. The report intentionally excludes passwords, private-key paths and contents, PHP source, and document paths.
• Remote interpreter discovery checks common locations under /usr/bin, /usr/local/bin, /opt, and /snap/bin. Any other absolute path can be entered manually.
• Linting checks PHP syntax only. It does not replace static analysis with tools such as PHPStan or Psalm.

Support and Feedback

Support is limited and provided only as time permits. Feedback of any kind is greatly appreciated and can be sent to teknik@staircase.se.

License and Responsibility

PHP Lint Local + SSH is distributed under the MIT License. It is provided as is, without warranty of any kind. Use it entirely at your own risk. You are solely responsible for reviewing its source, testing it in your environment, protecting SSH credentials, selecting the correct server and interpreter, and assessing any consequences of its use.

The complete license and liability disclaimer is available in the License tab in Nova's Extension Library.

Version 1.0.0

• Initial release.
• Secure remote validation of the active PHP document over SSH.
• Manual PHP validation with Command-Shift-V.
• Automatic discovery and selection of PHP interpreters on the server.
• Optional local PHP validation with discovery for common macOS PHP installations.
• Independent reporting controls for errors, warnings and notices, and deprecations.
• Optional error and success notifications for manual and automatic validation.
• Native Nova diagnostics with line numbers for PHP syntax errors.
• Optional validation when a document is saved.
• Optional password authentication with secure storage in macOS Keychain.
• Clear guidance for rejected passwords, disabled server-side password authentication, and locked or inaccessible Keychain credentials.
• Copyable, sanitized diagnostic reports for support requests.
• An anonymized diagnostic variant for public support reports.

MIT License

Copyright (c) 2026 Staircase AB

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Use at Your Own Risk

Use of the Software is entirely at the user's own risk. Each user is solely responsible for reviewing and testing the Software, protecting SSH credentials, configuring remote connections and PHP interpreters correctly, and evaluating whether the Software is suitable for the user's environment. This notice reiterates the warranty and liability disclaimer above and does not add restrictions to the permissions granted by the MIT License.