Download the PHP package elitedevsquad/sidecar-laravel without Composer

DevSquad Sidecar

A Laravel library that lets developers and QA test Laravel apps directly from the browser — run Tinker code, artisan commands, manipulate the fake clock, and impersonate users.

Requirements: PHP ^8.2, Laravel ^11

Install

Run from inside your Laravel project root:

The script handles everything automatically:

• composer require elitedevsquad/sidecar-laravel --dev
• Publishes config/devsquad-sidecar.php
• Writes all .env variables (auto-detects APP_URL, mail server, git remote)
• Mirrors keys into .env.example
• Injects the CSRF meta tag into any blade layout that has <html>, <body> and <meta>

After running, complete the User Mapping step below.

Manual Setup

If you prefer not to use the install script:

Then add the env variables below, configure user mapping, and ensure the CSRF meta tag is in your main layout:

User Mapping

In AppServiceProvider.php, configure Sidecar inside a class_exists() guard so the app does not break when the package is absent (e.g. production with --no-dev):

Environment Variables

The install script writes these automatically. Reference for manual setup or code review:

DS_SIDECAR_ALLOWED_IPS supports exact IPs, CIDR ranges, and prefix matching:

*`DS_SIDECARPRESENCE** — who is testing a shared environment and the timeline of what they ran. Off on local, on everywhere else unless set tofalse. Stored instorage/app/sidecar/;php artisan sidecar:activity:clearremoves old activity (--days=N,--all,--dry-run`) and runs daily when the schedule switch is on.

HEADER_BRANCH_NAME — on servers without git (e.g. Envoyer), inject via release hook:

Frontend

Laravel apps (auto-inject enabled): no action needed. The Sidecar JS is injected automatically before </body> on every non-production HTML response.

Laravel apps with Vite (auto-inject disabled): if you set DS_SIDECAR_AUTO_INJECT_ASSETS=false in your .env, load Sidecar manually in your JavaScript entry point:

Then build your assets:

External apps (Next.js, Nuxt, etc.): the bundle is served by the Laravel route GET /__devsquad-sidecar/assets/js and reads window.__sidecarBaseUrl at runtime to prefix all API calls.

Fake Clock:

• Setting a clock anchors "now" at the chosen instant and keeps ticking in real time (it no longer freezes time).
• Web requests are scoped to your browser session, so a clock you set never leaks to other users or guests — normal app pages keep real time for everyone else.
• The clock is also mirrored to the shared cache, so CLI processes such as php artisan schedule:run pick it up. Each scheduler tick is a fresh process that re-reads the clock, so changing or resetting it takes effect without restarting anything.
• It is disabled in production and can be toggled with DS_SIDECAR_FAKE_CLOCK_ENABLED.
• A clock can be set for a while (ttl, in seconds): it then returns to real time on its own, in the browser, the scheduler and the workers. Without a ttl it stays until it is reset.
• Queue workers (queue:work, Horizon) read the clock again before each job, so a change takes effect without restarting them. Octane still captures it at boot.
• With DS_SIDECAR_FAKE_CLOCK_DATABASE (on by default when APP_ENV=sandbox), the database's NOW() and CURRENT_TIMESTAMP move with the clock, on MySQL and MariaDB. SYSDATE() does not.