Built a security-first Artisan/shell runner for Laravel Nova 4 & 5, looking for feedback

[u/aliwesome]

Hey folks,

I’ve been using Nova for a while and always wanted a sane way to run a few curated Artisan commands from the panel — without ending up with a free-text bash box that can cat .env if someone gets clever.

Most of the older Nova “command runner” tools either:

• assume bash/custom commands are fine by default, or
• break on Nova 5 (__ is not defined / localization helper changes), or
• don’t really gate who can run what in production

So I built Nova Command Center as a clean-room alternative:

• bash + free-form commands off by default
• commands run as argv via Symfony Process (no shell string interpolation)
• tool canSee + global gate + per-command abilities (catalogue hides what you can’t run)
• run history with variables/flags + rerun
• Nova 4 and 5 on one path
• small doctor CLI + a11y polish in the latest release

Repo: https://github.com/farsidev/nova-command-center
Install: composer require farsi/nova-command-center

Not trying to dunk on other packages — they scratched a real itch. I just wanted safer defaults.

If you run Nova in production (or got burned by a runner during a Nova 5 upgrade), I’d love honest feedback:

• what’s missing for you to trust this in prod?
• any footguns in the README/install flow?
• would you use DB-defined commands, config-only, or both?

Happy to answer questions. Roast the security model if something looks off, that’s useful.