Expression Lab

An interactive diagnostics console and declarative DSL for WordPress.

Expression Lab is an experimental in-browser console for exploring WordPress data. Powered by a declarative Domain-Specific Language (DSL), it enables inspecting posts, options, database tables, and files without writing raw PHP snippets.

In WordPress development, troubleshooting often relies on ad-hoc PHP code execution, temporary var_dump() calls, or console plugins based on eval(). In production sites, unconstrained execution carries inherent risks: accidental database writes, memory exhaustion, or security exposure.

Expression Lab explores an alternative approach:

• Evaluating DSL expressions via an Abstract Syntax Tree (AST) powered by an extended Symfony Expression Language engine, rather than executing arbitrary PHP.
• Employing client-side cryptographic key derivation and server-side signature verification so credentials and private keys are never stored in the database.
• Providing operational boundaries, including in-memory SQLite mirroring (Database.mirror()), read-only database defaults, filesystem path canonicalization, and CPU execution time limits.

Architecture & Execution Model

The diagram below illustrates the authentication and execution lifecycle:

Authentication operates through client-side key derivation and cryptographic request signing. The browser generates ephemeral keys in memory to sign each request, and the backend verifies the signature without storing master passphrases, private keys, or credentials in the WordPress database.

The runtime enforces strict operational boundaries. Expressions evaluate declaratively inside an isolated AST engine rather than arbitrary PHP execution, database operations default to read-only access, the console UI runs in a sandboxed iframe, and an execution timer acts as a CPU watchdog to terminate runaway requests.

For an in-depth breakdown of the cryptographic model, boundary limits, and threat assumptions, see the Security Model documentation.

The DSL at a Glance

Expression Lab provides fluent query interfaces for core WordPress entities and functional pipeline helpers:

Fluent Entity Queries

In-Memory SQLite Analytics

Mirroring tables allows running SQL queries:

Functional Pipeline Operations

Data transformations are composed using declarative special forms (prog, set, map, filter, var):

System Requirements

Installation & Setup

[!WARNING] Expression Lab is currently experimental alpha software intended for staging, local development, and sandboxed diagnostic environments. It has not undergone third-party security audits. Do not use in production or business-critical environments. Provided under the GPL-2.0 license without warranty.

1. Installation

Pre-built ZIP Archive (Recommended)

Pre-built release packages are distributed as .zip archives via GitHub Releases. These include bundled frontend assets and scoped dependencies, installable through Plugins → Add New Plugin → Upload Plugin in the WordPress administration dashboard.

From Source (Development)

For local development, source builds, or code contributions:

1. Clone the repository into the WordPress plugins directory:

2. Install PHP dependencies:

   (For a lightweight test build without development tooling, use composer install --no-dev --optimize-autoloader).

3. Install JavaScript dependencies and compile frontend assets:

2. Configuration

1. Navigate to Tools → Expression Lab in the WordPress administration dashboard as an administrator.
2. Complete the initial security onboarding wizard by defining a master passphrase.

3. The wizard outputs the required configuration constants. Append them to wp-config.php:

4. Once defined in wp-config.php, reload the administration interface.

Development & Tooling

The repository provides automated validation, asset compilation, and a local documentation environment:

Code Quality & Automated Tests

Frontend Assets & Live Reload

[!TIP] Frontend Development with Hot Reload: In production, the console UI executes inside an isolated iframe with a unique origin (null). Because modern browsers block localStorage access in sandboxed iframes without allow-same-origin, tools like Vue and Pinia hot reload require disabling the iframe sandbox during local UI development:

Ensure this remains enabled outside of UI development sessions.

Documentation (Docusaurus)

The documentation site is located in the docs/ workspace:

Documentation

Full syntax guides and API references are available on the project's official website:

• Getting Started: Installation & Configuration
• Language Reference: Basic Syntax · Scripting

• API Reference: Database · Options · Network Sites · Users · Posts · Media · Files · HTTP · Console · IP Lookup · Graph

• Security & Environment: Security Model

Documentation is available in Spanish.

Contributing

Contributions, feedback, and technical proposals are managed according to the guidelines in CODE_OF_CONDUCT.md.

• Branching Strategy:
  • The master branch is the central integration branch and always reflects the latest tested code.
  • Working branches should originate from and target master via Pull Requests using standard prefixes:
  • fix/<description> for bug fixes.
  • improve/<description> for performance, documentation, or tooling improvements.
  • feature/<description> for new capabilities.
  • Releases are cut from master using semantic version tags (v*).
• Pull Requests: Pull requests should provide a clear rationale for the change. Rigid commit formats are not required; descriptive clarity is sufficient.
• Validation: All pull requests must pass the automated GitHub Actions checks (linting and test suites). Running pnpm run lint and pnpm run test locally prior to submission is recommended to catch issues early.

Security Inquiries

Potential security vulnerabilities should not be reported through public issue trackers. Consult SECURITY.md for supported versions and coordinated disclosure procedures.

Reports may be submitted via the GitHub Security Advisories interface or by emailing [email protected].

License

Expression Lab is open-source software distributed under the terms of the GNU General Public License v2.0 or later (GPL-2.0-or-later).