- What is michal78/laravel-pandora?
- Laravel Pandora is an agentic framework for Laravel applications that lets you define agents, tools, approvals, automations and memory under explicit, auditable policy. It ships a durable agent runtime with queue-worker-based execution, streaming, budget and deadline enforcement, provider health monitoring, and a Livewire control center for operating everything. It is strongly Laravel-native, assuming Eloquent, a relational database, queue workers, Livewire and a real local filesystem.
- How do I install laravel-pandora and what does it require?
- Install it with Composer using composer require michal78/laravel-pandora, then follow the installation and quick-start guides in the docs directory. Plan for a Laravel app that can host Livewire in its admin surface, run queue workers, and provide an Eloquent-capable relational database with unique index enforcement. It also expects a real local filesystem because the workspace layer uses local-storage containment. Check the Packagist PHP constraint rather than assuming a minimum version.
- Which Laravel and PHP versions does laravel-pandora support?
- The README badges advertise Laravel 13.x support and link a PHP dependency badge on Packagist, so verify the exact PHP constraint there before committing. The project runs tests, PHPStan at level 8 and Pint via GitHub Actions workflows. The published material does not document a full CI matrix across Laravel, PHP and database combinations, so confirm your specific stack against the repository workflows and tags.
- How does laravel-pandora handle tool approvals and authorization?
- Pandora supports tool delegation with ability intersection and deny lists, so an agent can only exercise abilities that survive the intersection of its own grants, the delegating context and any explicit denies. Authorization is asserted inside each Livewire component rather than through route middleware, which means your Gate definitions must cover package abilities such as tools.io.view. Reviews of the 0.1.x line flagged these delegation deny paths and UI gating as load-bearing controls worth testing in your own app.
- Does laravel-pandora need queue workers, and is it safe with multiple workers?
- Yes, execution is queue-worker-based, and the package is designed for apps already operating Horizon or another queue backend. The concurrency story relies on a database-backed RunLock lease, and 0.1.4 fixed a real defect where the lease could be deleted and five processes could acquire the same run. That fix only matters if you actually run more than one worker, so treat multi-worker testing as a required validation step rather than an optional one.
- Which databases does laravel-pandora support?
- Pandora assumes an Eloquent-capable relational database that enforces unique indexes, and it relies on that behaviour for things like the provider_key unique index. SQLite, MySQL and Postgres differ in how they handle upsert and conflict resolution, which matters for the race-safe provider health write introduced in 0.1.4. Validate the lease semantics and the concurrent write path on your specific engine before rollout, and check the tag diff for any accompanying migrations or index changes.
- Is laravel-pandora production-ready at version 0.1.x?
- It is pre-1.0, so there is no semver stability guarantee on the public surface and you should pin exact versions in composer.json. The 0.1.4 release is a security and correctness hardening patch rather than a feature release, and 0.1.3 shipped two live security fixes, which implies earlier 0.1.x builds carried latent defects in the exact controls you would rely on. The 0.1.4 release notes are truncated mid-sentence in the Fixed section, so diff the tag rather than trusting the changelog alone.
- How do I upgrade from 0.1.3 to 0.1.4, and what about earlier versions?
- The 0.1.3 to 0.1.4 move is a patch-level upgrade with no documented breaking API change, consisting of internal fixes plus new tests. If you are on 0.1.2 or earlier, treat the upgrade as security-driven and prioritise it because 0.1.3 contained two live security fixes. After upgrading, re-verify the provider health write behaviour against your database's upsert semantics and check for new migrations or index changes.
- Where does laravel-pandora store sessions, workspace files and execution traces?
- Sessions, workspace files and execution traces live in your application's database and on the local filesystem owned by the package, since workspaces use local-storage containment with symlink containment checks. That means data residency, retention and PII handling are your responsibility and should be mapped before you put real user data through an agent run. Sessions also apply actor isolation, so review how ActorContext::system labels map to your identity model and whether automation labels could collide with user primary keys.
- How does laravel-pandora compare to other Laravel AI agent packages?
- Pandora differentiates itself by being an operations-first agent runtime rather than a thin LLM wrapper: durable runs, approvals, delegation deny lists, budget and deadline enforcement, provider health monitoring and a Livewire control center. That makes it a good fit for teams that want auditable policy and an admin surface inside an existing Laravel monolith. It is a poor fit for polyglot estates, headless API-first agent platforms, or teams that cannot run multiple queue workers and let the package own workspace paths.