frosh / tools

3.15.3 2026-10-21 17:52 UTC

Requires

• shopware/core: ~6.6.0 || ~6.7.0
• symfony/var-dumper: ^6.0 || ^7.0 || ^8.0

Requires (Dev)

• shopware/elasticsearch: ~6.6.0 || ~6.7.0

MIT

• FriendsOfShopware

Published on Packagist.org on 2026-10-21 17:52 UTC

README

Operator toolkit for Shopware 6 — health checks, cache & queue ops, security audits, logs, Elasticsearch tooling, and more, directly in the Administration.

Maintained by FriendsOfShopware.
Repository: github.com/FriendsOfShopware/FroshTools

Why Frosh Tools?

Shopware shops accumulate operational work that usually needs SSH, Redis CLIs, Elasticsearch dashboards, or ad-hoc scripts. Frosh Tools brings those day-to-day tasks into the Admin under Settings → Plugins → Tools, so merchants and developers can inspect and act without leaving the browser.

For operators	For developers
Clear caches & compile themes	System health + performance recommendations
Inspect queues and scheduled tasks	Feature flags, state machines, webhooks
Read production logs	Elasticsearch console & index lifecycle
Security overview + SBOM export	File integrity for core and extensions
Monitor tasks/queues via CLI mail alerts	Redis namespace/tag cleanup helpers

Compatible with Shopware 6.6 and 6.7.

Shopmon integration

Create or remove monitoring credentials in the Shopmon tab. FroshTools manages a dedicated ACL role and refreshes its permissions on plugin installation and updates. Repeating setup preserves existing credentials.

For automated setup, set both SHOPMON_ACCESS_KEY and SHOPMON_ACCESS_SECRET before installing or updating FroshTools. APP_URL supplies the shop URL. With either credential missing, automatic setup leaves unconfigured shops unchanged; manual setup can generate credentials.

Existing integrations from FroshShopmon are adopted with their credentials and setup code intact. When uninstalling the old FroshShopmon plugin, keep its user data: its uninstall routine otherwise deletes the shared integration. Removing the integration from FroshTools deletes the integration, ACL role, and configuration for both plugins.

Screenshots

System Status

Live health checks (PHP, MySQL, queue, tasks, …) plus performance recommendations with documentation-oriented guidance.

Security Center

Dependency advisories, runtime end-of-life checks, configuration risks, file integrity — and Export SBOM (CycloneDX 1.7 from composer.lock).

Security timeline

Open Security → Timeline to review administrator sign-ins, user and role changes, integration and API-key changes, extension lifecycle events, and password recovery activity. Events are stored in frosh_tools_security_activity. Existing log entries are not imported.

Filter by actor, action, client IP, or UTC date range. JSON export includes every matching event, across pages. Access requires the existing frosh_tools_security:read privilege.

Client IPs come from Symfony's main request and respect the shop's trusted-proxy configuration. The timeline records allowed identifiers and changed field names, never passwords, recovery tokens, or secret values. IP addresses and account identifiers are personal data; restrict access and choose a retention period appropriate for your shop.

The daily frosh_tools.security_activity.cleanup scheduled task retains 90 days by default. Keep scheduled-task and message-queue workers running. Override retention (1–3650 days) in config/packages/frosh_tools.yaml:

frosh_tools:
    security_activity:
        retention_days: 90

Uninstalling with keep user data preserves the timeline; removing user data drops its table. Shopware's own logging remains available independently.

Cache Manager

List cache pools, clear individual pools, compile the theme, and clear PHP OPcache.

Statistics

OPcache hit rate/memory, cache backend metrics, and database server statistics.

Queue Manager

Transport overview (Doctrine, Redis, AMQP, …), message sizes, worker heartbeat, browse/retry/delete messages, purge or reset.

Scheduled Tasks

Inspect all tasks, edit interval & next run, run a single task, register missing tasks.

State Machine Viewer

Interactive diagrams for order, payment, delivery, and other registered state machines.

Log Viewer

Browse any file under var/log/ from the Admin.

Feature Flags

List core and extension feature flags; toggle where supported.

Webhooks

Dedicated list/detail UI for Shopware webhooks (including inline search).

Features

Administration — Tools module

Area	Capabilities
System Status	Health checkers (PHP/FPM, MySQL, queue lag, scheduled tasks, composer audit summary, debug/prod mode, …) and a large set of performance recommendations (admin worker, mail-over-queue, increment storage, OPcache flags, ES, product-stream indexing, …).
Data integrity	Data that Shopware accepts but that breaks the storefront, checkout or administration, or makes the shop silently behave wrong. Products: canonical products of other products or on products without variants, missing or foreign main variants and covers, variants without options or with duplicate options, missing configurator settings, products hidden by a missing display group, gaps or overlaps in advanced prices, maximum below minimum order quantity, deleted delivery times, layouts of the wrong type, invalid main categories, dynamic product groups without filters that are still in use, descriptions too long for Elasticsearch on Shopware < 6.6.6.0. Configuration: invalid rules, flows and dynamic product groups, rule conditions and flow actions referencing deleted entities, flow mail templates without complete default translation, payment methods and tax providers whose plugin or app is gone, tax rules for individual states that match no state, delivery times with unsupported units, currency roundings with interval zero and invalid currency factors, countries requiring a state without states, unavailable default countries, languages without translation code, inactive navigation categories, shop pages pointing to deleted layouts, link categories without target, media folders with a deleted configuration, product comparisons with a missing currency, promotion discounts for missing set groups, number ranges without type or for a sales channel, unassigned default payment/shipping methods and domain languages/currencies, active shipping methods without prices, duplicate delivery times, categories sorted after a non-sibling. Customers: shared email addresses (core uniqueness rules), missing or foreign default addresses, requested customer groups that no longer exist. Results are cached for 5 minutes; Refresh runs the checks again.
Security Center	Severity overview; Packagist dependency advisories; PHP / MySQL / Symfony / Shopware EOL; environment risks; core & extension file integrity; CycloneDX 1.7 SBOM export.
Cache	Pool listing with clear actions, theme compile, OPcache clear.
Statistics	OPcache, cache-adapter, and database metrics for capacity troubleshooting.
Queue	Multi-transport support (Doctrine, Redis, AMQP, fallback); browse without consuming (or fetch+requeue); retry failed messages; purge transport; reset queue.
Scheduled Tasks	List, run, deactivate; edit interval & next execution; register tasks.
State Machines	Diagram viewer for any registered state machine.
Log Viewer	Read var/log/*.log in the browser.
Feature Flags	Inspect and toggle flags from core/plugins.
Elasticsearch	Status, indices, reindex, alias switch, unused/orphaned cleanup, console. Optional show_all_indices.
Fastly	Purge all / by URL and basic stats when Fastly is configured.
Shopmon	Optional integration setup for external Shopmon monitoring.
Apps	External reachability of APP_URL checked by the Cloudflare Worker, Shopware account login status, current Shop App ID with password-confirmed reveal/copy, installed app list, and password-confirmed reset of the Shop App ID with uninstall of all apps.
Webhooks	Separate Admin module to create, search, and manage webhooks.

The Apps reachability check uses the public Cloudflare Worker at https://app-url-check.fos.gg. The Worker calls the FroshTools probe on APP_URL and verifies a fresh challenge response.

Status badge in the Admin sidebar

On Shopware 6.6 / 6.7.13 the existing sw-version layout and health status dot are preserved. On Shopware 6.7.15 / trunk, warning or critical health replaces the sidebar Administration title with a badge that links to Tools, with the Shopware version beside it. The badge stays inside the header mt-text so the 40px row is not stretched. When healthy, the Administration title remains visible with a green status dot that links to Tools.

Console commands

Command	Purpose
frosh:dev:robots-txt	Block crawlers on test shops (-r to revert)
frosh:composer-plugin:update	Update Composer-managed plugins
frosh:monitor <sales-channel-id>	Email alert when queues/tasks exceed grace times
frosh:es:delete-unused-indices	Delete unused Elasticsearch indices
frosh:extension:checksum:check [name]	Verify extension file integrity
frosh:extension:checksum:create [name]	Create extension checksum manifests
frosh:redis-namespace:list	List Redis namespaces (experimental)
frosh:redis-namespace:cleanup	Clean Redis namespaces (--dry-run supported) (experimental)
frosh:redis-tag:cleanup	Clean Redis tags
frosh:twig:warmup	Warm Twig template cache
frosh-tools:health-check-json	Print merged health-check results as JSON (CI / monitoring)
frosh-tools:data-integrity-check-json	Print data integrity check results as JSON

Requirements

• Shopware 6.6 or 6.7

• PHP version required by your Shopware minor

• Admin ACL privileges under Settings → Users & permissions (Viewer / Editor per area):

  • Frosh Tools — system status, statistics, feature flags, state machines. Editor grants every Tools write privilege (and pulls in the other viewers).
  • Cache / Queue / Scheduled tasks / Search indices / Security / Fastly / Shopmon / Apps — Viewer to open the tab, Editor for mutations (clear cache, retry/purge, run tasks, reindex, restore files, purge CDN, setup integration, reset Shop App ID).
  • Logs — Viewer only (production log contents).
  • Webhook privileges remain a separate CRUD row.

  Existing roles that only had frosh_tools:read keep the overview tabs; re-open the role and tick the area viewers/editors they should keep. Super-admin is unchanged.

Installation

Composer (recommended)

composer require frosh/tools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clear

Shopware Store package

composer require store.shopware.com/froshtools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clear

Store installs need a valid packages.shopware.com Composer auth token.

From Git (development)

git clone https://github.com/FriendsOfShopware/FroshTools.git custom/plugins/FroshTools
shopware-cli extension prepare custom/plugins/FroshTools
shopware-cli extension build custom/plugins/FroshTools
bin/console plugin:refresh
bin/console plugin:install --activate FroshTools
bin/console cache:clear

After activation, open Settings → Plugins → Tools (or search for “Tools” in the Admin).

Configuration

Optional Symfony config — create config/packages/frosh_tools.yaml:

frosh_tools:
    # Skip specific health/performance checkers by id (when needed)
    checker:
        disabled_checks: []

    # Paths that File Checker should not offer to restore
    file_checker:
        exclude_files:
            - vendor/shopware/core/FirstFile.php
            - vendor/shopware/core/SecondFile.php

    # Elasticsearch manager: list every index instead of only Shopware prefixes
    elasticsearch:
        show_all_indices: false

    # Administration "forgot password" flow (backport of shopware.api.user_recovery.enabled).
    # It is generally recommended to disable it and reset passwords via
    # "bin/console user:change-password" when needed. Also useful when passwords
    # are managed externally, e.g. via SSO.
    user_recovery:
        enabled: true

Plugin system config (Admin → Extensions → Frosh Tools):

• Monitor mail address — recipient for frosh:monitor
• Default queue grace time (minutes) — when a pending message is considered stuck
• Exclude failed queues — ignore transports whose name contains failed (default on)
• Queues to monitor — optional allowlist, e.g. async, low_priority
• Per-queue grace times — optional overrides, e.g. async:15, low_priority:60
• Task grace time (minutes) — when a scheduled task is considered stuck

JSON Schema for IDE validation: frosh-tools-schema.json.

Monitoring & CI hooks

# Human-oriented mail alert (cron)
bin/console frosh:monitor <sales-channel-id>

# Machine-readable health snapshot
bin/console frosh-tools:health-check-json

# Machine-readable data integrity snapshot
bin/console frosh-tools:data-integrity-check-json

Wire the JSON command into uptime checks, deploy gates, or external monitors. The Security Center Export SBOM action produces a CycloneDX 1.7 document suitable for dependency scanners.

Development

# Format / static checks via shopware-cli (Docker)
composer format
composer check

# PHPUnit (from a Shopware project that requires this plugin)
composer phpunit

# Administration unit tests (Shopware 6.6, 6.7, and trunk)
# Requires the Administration source + its node_modules; see
# https://github.com/FriendsOfShopware/vitest-shopware-admin-bridge
cd src/Resources/app/administration
npm ci
npm run test:unit:doctor
npm run test:unit

Admin sources live under src/Resources/app/administration. Rebuild with:

shopware-cli extension build custom/plugins/FroshTools
# or, from the Shopware root:
bin/build-administration.sh

Links

• GitHub Issues — bugs & feature requests
• FriendsOfShopware
• Shopware Store listing (search “Frosh Tools”)
• Maintainer: Soner Sayakci (@shyim)

License

MIT