The Problem

Running a full code editor on iPad means shipping not just an editor UI but entire language runtimes. The app needs Python, Node, Clang, PHP, and Java working locally on a device with no package manager and no server. That means bundling hundreds of megabytes of runtimes, language servers, and tooling into an iOS app, and keeping the editor itself responsive while doing it.

What This Does

codeapp is the source for Code App, a desktop-class editor for iPad that embeds real language runtimes rather than calling remote services. The CodeApp/ directory holds the SwiftUI app itself, while LanguageResources/ (14,148 files) contains the bundled Python 3.9.2 runtime, Clang 14, and supporting libraries. Dependencies/ (2,622 files) carries a bundled npm distribution and other tooling, and NodeExtension/ provides a 16-file native extension for Node integration.

The app pairs a VS Code-inspired UI (assets in CodeApp/Assets.xcassets/icons/ include language icons, git status colors, and editor theme colors) with Monaco Editor for editing and native code for terminals, git operations, and LSP support. The README documents working features: version control, embedded terminal with 70+ commands, Node/PHP local web development, Python and C/C++ runtimes, Java via OpenJDK, SSH, and LSP for Python and Java.

How It Is Wired

This repository's wiring is mostly not mapped. The static analysis produced no internal call graph, no entry-point tracing, and no responsibility map beyond directory structure. The clearest signal is the Xcode project: Code.xcodeproj/project.pbxproj defines three schemes (Code App, Code UI, extension), and the build flow starts there. The CodeApp/ directory is the SwiftUI surface; LanguageResources/ and Dependencies/ are bundled, not resolved at build time. The README's build steps are: clone, run ./downloadFrameworks.sh, open Code.xcodeproj, switch to the CodeUI target for simulator runs, then build.

The NodeExtension/ directory is the one place where control likely leaves the Swift process into JavaScript, but the analysis did not trace that path. The SwiftGit2/ and SwiftWS/ directories (38 and 9 files respectively) are supporting libraries for git operations and WebSocket communication, but their call graphs are unmapped.

How To Use It

git clone https://github.com/moses-y/codeapp
cd codeapp
./downloadFrameworks.sh
open Code.xcodeproj

Build via Xcode: select the Code App scheme for device deployment, or Code UI for simulator. The project requires Xcode and an Apple developer signing identity for device installs. The README documents these steps verbatim; there is no package manager setup, no environment variables, and no CLI entry point. The app is distributed via the App Store and TestFlight.

Real-World Use

A developer using this on an iPad can clone a repository, edit Python files with LSP-based autocompletion and diagnostics, run the code against the bundled Python 3.9.2 runtime, and commit changes—all without a Mac or remote server. The embedded Node 18.19.0 runtime lets them run a local web server for frontend development, and the Clang 14 WebAssembly runtime handles C/C++ compilation.

Code Health & Issues

Static analysis produced 8 findings (0 critical, 3 high, 4 medium, 1 low). The high-severity items:

  • High - Committed dependency directory: 9,803 files under LanguageResources/Library/lib/python3.9/site-packages/ are committed, so the running code was never resolved from a manifest. Fix: gitignore, git rm -r --cached, reinstall from lockfile.
  • High - CI never runs tests: 1,389 test files exist, but no workflow in .github/workflows/ invokes a test command. Fix: add a test step to the existing workflow.
  • High - eval() over a runtime value in LanguageResources/Library/lib/python3.9/logging/config.py. Fix: use json.loads or ast.literal_eval.

Medium findings: no permissions: declaration on 3 workflows (2 reference secrets), no Dependabot/Renovate configured, no dependency vulnerability scan in CI, and one 6.3MB binary (LanguageResources/ClangLib/usr/share/magic.mgc) that should move to LFS. One low finding: no timeout-minutes on workflow jobs. The analysis also flagged CodeApp/Constants/Secrets.swift as a secret-shaped path; verify whether it holds real credentials.

The Bottom Line

This is a substantial, working iOS application with real embedded runtimes—the hard part of an iPad code editor. The main risks are operational: committed dependencies that no scanner can see, CI that doesn't run tests, and an eval() in the Python logging module. Anyone forking this should fix the CI and dependency issues before building features.