
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
codemirror-cel
Advanced tools
CodeMirror 6 extension for CEL (Common Expression Language) with LSP-powered diagnostics, autocompletion, hover, and semantic highlighting via a WASM language server.
A CodeMirror 6 extension that adds full language support for CEL (Common Expression Language) — powered by a WASM language server running in a Web Worker.
All of this runs entirely in the browser — no server required.
npm install codemirror-cel
import { cel } from "codemirror-cel";
import { basicSetup } from "codemirror";
import { EditorState } from "@codemirror/state";
import { EditorView } from "@codemirror/view";
const worker = new Worker(
new URL("codemirror-cel/worker", import.meta.url),
{ type: "module" },
);
const celExtensions = await cel({
worker,
variables: [
{ name: "user", type: { kind: "map", keyType: "string", valueType: "dyn" } },
{ name: "now", type: "timestamp" },
],
functions: [
{
name: "isEmail",
params: [{ name: "value", type: "string" }],
returnType: "bool",
},
],
});
new EditorView({
parent: document.getElementById("editor")!,
state: EditorState.create({
doc: 'user.email.endsWith("@acme.com") && isEmail(user.email)',
extensions: [basicSetup, ...celExtensions],
}),
});
The cel() function accepts a CelConfig object:
| Option | Type | Default | Description |
|---|---|---|---|
worker | Worker | (required) | A Web Worker running the celsp WASM language server. |
variables | VariableDeclaration[] | [] | Variables available in the CEL environment. |
functions | FunctionDeclaration[] | [] | Custom function declarations for the type-checker. |
rootUri | string | "file:///" | LSP workspace root URI. |
documentUri | string | "file:///cel.cel" | URI for the document being edited. |
languageId | string | "cel" | Language ID sent to the LSP server. |
hoverShowErrors | boolean | false | Include check-error details in hover tooltips. |
Variables use CEL's type system:
// Primitive types
{ name: "active", type: "bool" }
{ name: "count", type: "int" }
{ name: "score", type: "double" }
{ name: "name", type: "string" }
{ name: "now", type: "timestamp" }
{ name: "ttl", type: "duration" }
// List type
{ name: "tags", type: { kind: "list", elementType: "string" } }
// Map type
{ name: "headers", type: { kind: "map", keyType: "string", valueType: "string" } }
// Nested types
{ name: "matrix", type: { kind: "list", elementType: { kind: "list", elementType: "int" } } }
Functions declare parameter names, types, and a return type:
{
name: "clamp",
params: [
{ name: "value", type: "double" },
{ name: "min", type: "double" },
{ name: "max", type: "double" },
],
returnType: "double",
}
The extension runs a fork of
celsp by ponix-dev
— a CEL language server written in Rust — compiled to WebAssembly inside a Web Worker.
LSP messages are bridged between the worker and CodeMirror via postMessage.
Semantic highlighting is handled through a custom side-channel (since the upstream
CodeMirror LSP plugin doesn't support semantic tokens) and integrates with whatever
HighlightStyle you have active (e.g. oneDark).
Unlicense — public domain.
FAQs
CodeMirror 6 extension for CEL (Common Expression Language) with LSP-powered diagnostics, autocompletion, hover, and semantic highlighting via a WASM language server.
We found that codemirror-cel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.