- What does stepanenko3/nova-command-runner do?
- It is a Laravel Nova tool that adds a command runner panel to your Nova admin dashboard so you can execute Artisan and bash or shell commands from the browser. It registers as a standard Nova tool with a Vue component and a backend controller that shells out through Symfony Process. There is no data model, no queue integration, and no background worker, so it stays a thin additive layer on top of your existing app. It is intended for developers and admins who want to trigger commands without opening a terminal session.
- How do I install nova-command-runner in a Laravel app?
- Install it with Composer, then register the tool in your app's NovaServiceProvider and publish the package config and frontend assets as described in the README. Because assets are typically pre-built in the package, you normally do not need an npm toolchain on the host. Realistic effort for a working install is roughly half a day to two days, and the larger cost is the security and change-management review rather than the code. Pin the version explicitly in composer.json instead of floating it.
- Which Laravel, Nova, and PHP versions does this package support?
- The package requires Laravel Nova 4 or higher and PHP 8.1 or newer, and it is useless without a paid Nova license since Nova itself is a commercial, per-site product. The evaluation notes that no explicit supported matrix covering Nova 4 versus 5, Laravel 10, 11, or 12, and PHP 8.1 through 8.4 was confirmed from metadata alone. Verify the Nova major version alignment and PHP constraint in the composer.json and README before installing. Do not assume compatibility with a future Nova or Laravel major release.
- Is it safe to run shell commands from the Laravel Nova dashboard?
- This is the central risk of the package: its core function is remote command execution from an authenticated browser session, effectively an RCE endpoint gated by Nova authentication and whatever authorization the tool enforces. A weakness in Nova session handling, a compromised admin account, or a missing per-command gate can turn your admin panel into a shell on the web server. Treat the adoption decision as a security and change-management review measured in days or weeks, not an install task. Review the source for allowlisting, authorization, logging, and timeouts before it touches production.
- Does nova-command-runner support a command allowlist, or can users type any command?
- Metadata alone does not confirm whether the package ships an explicit allowlist or accepts a free-form command string, so treat this as unverified until you read the source. The same applies to whether user-supplied arguments are accepted and, if so, how they are escaped. Check whether there is a Nova authorization gate per tool and per command, or whether access simply follows Nova's global admin role. If no allowlist exists, add one yourself or restrict the tool to non-production environments.
- Is every command invocation logged for auditing?
- It is not confirmed from the package metadata whether invocations are logged at all, or whether the log captures user, command, timestamp, exit code, and output. The evaluation explicitly lists this as a question to resolve through source review, including where any log is retained. If audit logging is missing or insufficient, wrap or extend the tool so every run lands in your existing audit trail. Mutating production operations happening outside your audit trail is the most common failure mode reported for tools like this.
- How does the tool execute commands, and does it handle timeouts and exit codes?
- Execution goes through Symfony Process from a backend controller, so the command runs as the web server user, not as your deploy or CLI user, and environment variables may differ from your terminal context. Whether a timeout is configured, whether stdout and stderr are streamed or buffered, and whether orphaned child processes are left behind on timeout are all unconfirmed and should be checked in the source. Verify that non-zero exit codes are captured and surfaced rather than reporting success regardless. Also confirm the process user has only the filesystem and environment access you intend.
- Should I use nova-command-runner in production?
- It is safer to introduce it in a staging environment first and write an explicit policy for which SSH and terminal workflows you deliberately allow through the browser and which you forbid. The package is additive and coexists with Forge, Envoyer, or GitHub Actions, so it does not need to replace your deploy pipeline. Pin the version, add per-command authorization and an allowlist if the package lacks them, and make sure every invocation is logged. Without those controls, a convenience shortcut can quietly move production mutations outside your audit trail.
- Is nova-command-runner actively maintained, and what is the risk of adopting it?
- It is a single-maintainer package with around 36 stars and zero dependents, so there is no ecosystem validation or third party that has stress-tested edge cases for you. There is no visible commercial backing, which means a future Nova or Laravel major release could strand it. There is also no confirmed information about tests or CI in the metadata. Pin the version, keep a fork or patch path in mind, and plan for the possibility that you maintain it yourself.
- What are the alternatives to using a Nova command runner?
- Most teams already have better-audited paths for the same operations: SSH, Laravel Forge, Envoyer, or CI pipelines such as GitHub Actions, all of which the package coexists with rather than replaces. Laravel's own scheduler and queue workers handle recurring and long-running jobs without exposing a browser-triggered shell. If you only need a handful of safe operations, a small custom Nova tool or artisan command behind a gate gives you far less attack surface. Consider nova-command-runner only for the narrow set of commands your policy explicitly permits through the dashboard.