- How do I install Filament Command Center in a Laravel app?
- Install it with composer require ssbityukov/filament-command-center, then register CommandCenterPlugin::make() in your panel's panel() method and publish the config file. You also need to define the package's gates before commands become usable, because the default behavior is to deny until your app authorizes them. Optionally publish and run migrations if you want the durable database history driver instead of cache.
- Does Filament Command Center support Laravel 12 and 13 with Filament 5?
- Yes. It requires PHP 8.3+, Laravel 12 or 13, and Filament 5. CI runs 442 tests across PHP 8.3, 8.4, and 8.5 combined with Laravel 12 and 13. Older versions are not listed because they are not tested, not because they are known to break.
- How does the allow-list work, and can users type arbitrary commands?
- Commands must be entries in an allow-list defined in config, the database, or your own source; there is no free-form input field. User input is passed as a single argv element and can never become the binary or an option, so it cannot change the structure of the command line. Anyone who can edit the allow-list, especially via the database source, effectively has deploy-level privilege and should be treated accordingly.
- How do I authorize each command with gates in Filament Command Center?
- Each command can require its own gate, and the package denies access until your application defines and grants that gate. That safe default can make the module invisible to users if the gates are not configured. You should review the default starter allow-list, which includes migrate, down, and up with confirmation, before using it in production.
- Can commands run in the background with live output and cancel support?
- Commands can run synchronously or be queued, with live output, progress, and a cancel action in the panel. For synchronous runs, cancellation is largely ineffective because the cancel flag and the process run in different PHP processes, and cancellation is only noticed between output chunks. Queued execution is the better fit when you need longer-running maintenance tasks and responsive feedback.
- Does Filament Command Center work on Windows?
- No. The package explicitly supports Linux and macOS only; Windows is untested and not claimed. The reason is behavioral: on Unix an argument array goes to proc_open without a shell, while on Windows Symfony converts it to an escaped command string, which is a different guarantee. Mixed-estate teams should account for that constraint.
- How is run history stored, and do I need a migration?
- Run history works without any migration using a cache driver, which is capped, TTL-bounded, and erased by cache:clear. For durable audit history you can publish migrations and use the database driver instead. If you choose the database driver, your team must own retention and pruning.
- How do I validate command definitions in CI with command-center:check?
- Run command-center:check in CI to validate every command definition before deployment. It checks the allow-list entries and helps catch misconfigurations early. The package also ships guard scripts that assert no shell execution primitive exists in src/, reinforcing its argv-based model.
- What are the security risks of running shell commands from a Filament panel?
- The primary risk is privilege, not code quality: anyone who can edit the allow-list can run anything the PHP process can. The database editor is the highest-privilege surface and should be protected like deploy access. The package does not sandbox what a command does after launch, so security depends heavily on which commands you allow and how you protect the panel.
- Is Filament Command Center production-ready, maintained, and what are the alternatives?
- It is a well-engineered but narrowly scoped package with a single-maintainer risk profile, 4 stars, and zero dependents, so treat it as contained internal tooling rather than a strategic platform dependency. It is a Filament port of farsidev/nova-command-center, which is the closest conceptual alternative for Nova users. Production adoption should include owning the allow-list, gates, audit retention, and upgrade review, including post-upgrade verification of custom gate setups after fixes like the queued actor guard bug in 1.0.2.