Nova Advanced Command Runner Laravel Package

Product Decisions This Supports

Whether to build an internal ops console — and how far to invest. This package is best used as a cheap probe, not a platform bet. Run a scoped pilot with a handful of trusted admins, instrument it (command usage frequency, support tickets avoided, time-to-recovery on routine incidents), and let that data decide whether an "operations console" is a real roadmap item or a nice-to-have. If it earns its keep, the eventual answer is likely a thin in-house Nova tool with allowlists, RBAC, and audit logging baked in — this package gets you the experiment, not the product.

Build vs. buy vs. adopt-and-own. MIT licensing makes adoption easy, but the honest framing is adopt and own. With 18 stars, 0 dependents, and no release since August 2020, there is no vendor, no SLA, and no security response. Treat the decision as: fork it and maintain it internally, or build the equivalent (~200 lines of Nova tooling) with your guardrails from day one. "Buy" is not on the table.

Scope definition for admin-surface features. The package forces a useful product question: which routine operations should be self-service for admins and support engineers versus gated behind SSH and on-call? Good initial use cases are cache/config clears, queue restarts, scheduler and migration status checks, log tailing, staging resets, and support diagnostics. Explicitly out of scope: customer-facing access, free-form bash in production, anything destructive or secret-exposing.

Roadmap sequencing against existing observability. This is not a deployment tool and should never be positioned as one. It sits downstream of CI/CD and alongside Horizon/Nova metrics as a convenience layer for small maintenance tasks. If the roadmap already has a deployment pipeline or admin-console initiative, this package is a stopgap at best and a competing surface at worst.

Guardrails as a launch requirement, not a follow-up. Any decision to ship this internally should carry non-negotiable gates: a curated command allowlist with stable keys and human labels, environment-specific command sets (narrow in production, broader in staging/local), role-based access via a Nova gate, an explicit env flag that disables the tool unless set, and audit logging of actor, command, timestamp, exit code, and output. The config file is the product surface — treat it with the same review rigor as application code.

When to Consider This Package

Consider it if:

• You already run Laravel Nova and need a fast internal or staging stopgap for routine maintenance.
• Access is confined to a small, trusted admin/ops group, and you can enforce a strict command allowlist of named, argument-free commands.
• Non-production environments are the default scope and production is explicitly excluded or gated behind an env flag.
• You are prepared to pin compatible Laravel/Nova versions, security-review the process-execution layer, fork the source, and assign internal ownership for compatibility and patches.
• Audit logging, RBAC, environment gating, and output redaction are already in place or can be added in the same release.

Look elsewhere if:

• The target is production with sensitive data, compliance obligations, multi-tenant isolation, or any customer-facing exposure.
• You need vendor support, an SLA, active maintenance, or broad ecosystem validation.
• You cannot enforce allowlists or audit trails, or arbitrary shell execution is unacceptable in your threat model.
• You are on Nova 4/5 or a modern Laravel/PHP stack. A 2020-era tool predates current tool registration and asset conventions — assume breakage until a spike proves otherwise.
• Commands are long-running enough to block a web worker or exceed max_execution_time; those belong in queued jobs or CLI, not a dashboard button.

How to Pitch It (Stakeholders)

To executives: "This is a low-cost internal ops accelerator: trusted admins can run routine Laravel commands from Nova instead of SSH, which could shorten incident response and cut repetitive support work. Two caveats. It is a small, stale open-source package — no release since 2020, no maintainer — and by design it exposes command execution through an admin panel. Recommendation: fund a time-boxed pilot in a non-production environment with allowlists, role-based access, and audit logging, and measure ticket reduction and recovery time. Do not make it production-critical without an explicit ownership and maintenance plan. If the pilot validates the need, we build a thin internal version we control."

To engineering: "MIT-licensed Nova tool for running Artisan and shell commands with a curated command list, live-ish output, and history. Mechanically it's a small install — register the tool, publish config, define commands. The real work is around it: version compatibility with our Nova/Laravel majors is unverified and likely broken on 4+, the PHP-FPM user's permissions and PATH differ from ours, output isn't truly streamed, and interactive commands will hang. Treat adoption as a fork: pin the commit, review the process-execution layer line by line, and add allowlists, environment gating, and audit logs ourselves. The config file stays the extension point — wrap anything complex in a custom Artisan command and expose the wrapper, never free-form shell. If that fork cost approaches the cost of a purpose-built command catalog with the same guardrails, build it — lower long-term ownership risk."