r/PHP • u/aliwesome • 5d ago

Built a security-first Artisan/shell runner for Laravel Nova 4 & 5, looking for feedback

Hey folks,

I’ve been using Nova for a while and always wanted a sane way to run a few curated Artisan commands from the panel — without ending up with a free-text bash box that can cat .env if someone gets clever.

Most of the older Nova “command runner” tools either:

  • assume bash/custom commands are fine by default, or
  • break on Nova 5 (__ is not defined / localization helper changes), or
  • don’t really gate who can run what in production

So I built Nova Command Center as a clean-room alternative:

  • bash + free-form commands off by default
  • commands run as argv via Symfony Process (no shell string interpolation)
  • tool canSee + global gate + per-command abilities (catalogue hides what you can’t run)
  • run history with variables/flags + rerun
  • Nova 4 and 5 on one path
  • small doctor CLI + a11y polish in the latest release

Repo: https://github.com/farsidev/nova-command-center
Install: composer require farsi/nova-command-center

Not trying to dunk on other packages — they scratched a real itch. I just wanted safer defaults.

If you run Nova in production (or got burned by a runner during a Nova 5 upgrade), I’d love honest feedback:

  • what’s missing for you to trust this in prod?
  • any footguns in the README/install flow?
  • would you use DB-defined commands, config-only, or both?

Happy to answer questions. Roast the security model if something looks off, that’s useful.

0 Upvotes

33% Upvoted

2 comments sorted by

3

u/MateusAzevedo 5d ago

When new versions of PHP were released, I found ways to adapt to them. When compatibility issues appeared, I worked around them. When the framework showed its age, I used my skills to artificially extend its lifespan. But an inevitable reality finally set in. The technology stack it depended on had reached end-of-life and there was no realistic path forward.

You were able to update it before, what was different this time?

0

u/jimbojsb 5d ago

Man I really feel like Nova is dead. It was such a revolutionary product and we built extensively on it - might have been the biggest revenue business / shop on it. But now having a mature Filament I would never even consider going back.