README

Laravel Devtools is a reusable Laravel package that exposes a protected, URL-based internal operations dashboard. It provides safe, audited access to approved operational actions without giving arbitrary shell or infrastructure access.

Features (V1)

• Dashboard overview (/devtools by default)
• Safe command execution from a strict whitelist
• Backup integration powered by spatie/laravel-backup (included as a package dependency)
• Read-only recent log viewing with simple filtering and secret redaction
• Audit log for privileged actions
• Optional Nightwatch deep-link support

Installation

1. Require the package in your host Laravel app:

composer require anthonykusuma/laravel-devtools

1. Publish config and migrations:

php artisan vendor:publish --provider="AnthonyKusuma\\LaravelDevtools\\DevtoolsServiceProvider" --tag=devtools-config
php artisan vendor:publish --provider="AnthonyKusuma\\LaravelDevtools\\DevtoolsServiceProvider" --tag=devtools-migrations

1. Run migrations:

php artisan migrate

1. Define gates in your host app (for example in AuthServiceProvider):

Gate::define('viewDevtools', fn ($user) => $user->is_admin);
Gate::define('runDevtoolsCommands', fn ($user) => $user->is_admin);
Gate::define('triggerDevtoolsBackups', fn ($user) => $user->is_admin);
Gate::define('viewDevtoolsLogs', fn ($user) => $user->is_admin);
Gate::define('viewDevtoolsAudit', fn ($user) => $user->is_admin);

Configuration

Published config: config/devtools.php

Important keys:

• enabled: global package toggle
• path: route prefix (devtools by default)
• middleware: route middleware stack
• gate: base access gate
• features: per-feature toggles
• commands: allowed Artisan commands
• logs: log reader driver/path/max lines
• nightwatch: optional Nightwatch link settings

Assets

The package ships with Blade views and package-scoped CSS/JS under resources/.

Asset development uses Vite + Tailwind:

npm install
npm run build

You can publish package assets with:

php artisan vendor:publish --provider="AnthonyKusuma\\LaravelDevtools\\DevtoolsServiceProvider" --tag=devtools-assets

Security Notes

• Arbitrary command input is not supported.
• Only commands listed in config are executable.
• Privileged actions are audited.
• Log viewer is read-only and bounded.
• Optional integrations fail closed with explicit unavailable states.

Testing

Run package tests:

composer test

Development Roadmap

• Queue support for long-running command/backup actions
• Richer backup status insights when Spatie backup metadata is available
• More advanced log filtering and pagination
• Additional health widgets on dashboard

Public Publishing

For Packagist release steps, see docs/public-release.md.