The Php Times

Jordan Dalton's Laravel Tackle is an AI coding agent that runs as Artisan commands inside a Laravel application. Because it boots with the framework, it can list routes, read Telescope exceptions, run SELECT queries against the database, and call Pint after editing. The safety layer lives in PHP code: path restrictions, an Artisan allowlist, and a per-session spend limit are config values, not prompt text a model could ignore. The package builds on laravel/ai and defaults to Claude, but AI_CODE_PROVIDER switches it to OpenAI, Gemini, Groq, or a local model via Ollama.

The package ships several agents. ai:code is an interactive REPL with plan mode, slash commands, image attachments, and persistent history. ai:run executes a single task with an exit code and optional --output=json for pipelines. ai:fix starts a focused session from a pasted exception, a Sentry issue (--sentry=ID), or a GitHub issue (--issue=N). ai:review reads a diff or pull request and posts inline comments with severity levels. ai:upgrade takes a Composer package across a major version using its own upgrade guide from vendor/. A self-healer watches failed queue jobs and scheduled tasks, patches code in an isolated worktree, and opens a pull request. Tackle Remote is a companion package exposing the same harness as a mobile browser UI with approval prompts.

Tackle requires PHP 8.3 and Laravel 12 or 13. Install via composer require jordandalton/laravel-tackle, then publish the laravel/ai and tackle configs. The published config/ai.php already carries the Anthropic provider block, so an ANTHROPIC_API_KEY in .env suffices. Switching to Ollama needs AI_CODE_PROVIDER, AI_CODE_MODEL, plus AI_CODE_PRICE_INPUT and AI_CODE_PRICE_OUTPUT set to 0, since the built-in price catalog has no rate for local models. The agent edits files in place unless worktree mode is on, so committing or stashing work first is advised.

The ai:code REPL supports plan mode via --plan: a read-only planning agent investigates the codebase and streams a numbered plan covering files, changes, and risks before anything is written, after which you choose Execute, Revise, or Cancel. /plan does the same per task inside a session. Shell access has four modes: --off refuses everything while keeping read tools available, --approve confirms every command (the default), --allowlist permits only shell_allowlist entries, and --yolo prompts nothing. Transcripts are saved to storage/ai-code/ and resumed on the next run; --session=name keeps separate histories. Past 60,000 characters, Tackle auto-summarizes older exchanges and keeps the last four messages verbatim; /compact forces it, /clear discards history.

All guardrails in config/tackle.php are checked in PHP before a tool runs. Defaults include budget_usd of 1.00 (hard stop, warning at 80 percent), shell mode per environment (production defaults to off), an artisan_allowlist per environment, worktree mode defaulting to true in production, and protected_paths covering .env, storage/*, vendor/*, and .git/*, which blocks reads as well as writes so the agent cannot quote your secrets. Destructive commands like migrate:fresh and db:wipe require terminal confirmation. In worktree mode, edits land in a temp git worktree, the per-turn diff stat is labelled accordingly, and tackle:prune clears leftovers from interrupted runs.

Every agent loads a TACKLE.md from the project root at session start. php artisan tackle:init scans composer.json, the test framework, and app/ structure to write a scaffold with Conventions, Boundaries, and Gotchas headings. Without TACKLE.md, Tackle falls back to AGENTS.md, then CLAUDE.md. Content is capped at 20,000 characters, and the safety layer applies regardless of the file's contents.

ai:review runs a read-only agent with ReadFile, Glob, and SearchCode over a diff, reading the full file around each changed function. Usage: php artisan ai:review for staged and unstaged changes, --against=main for PR-style review, --pr=118 --comment to post inline comments to GitHub. Findings come grouped by file at three severity levels with a verdict of LGTM, LGTM with minor notes, or Needs changes; --fail-on=critical converts that into an exit code for CI. Each posted review embeds an invisible marker recording the covered head commit, so re-runs review only new pushes and exit early with "Nothing new to review" when unchanged; a force-push falls back to a full review, and --full forces one. php artisan tackle:install review scaffolds a GitHub Actions workflow using JordanDalton/tackle-review@v1. Replying to a finding with a /tackle comment triggers ai:respond, which runs the coding agent on the instruction, pushes the commit to the PR branch, and replies with SHA and diff stat. Fork PRs are refused, mismatched checkouts abort, and pure questions are answered without edits.

Self-healing is off by default. Setting AI_CODE_HEALING_ENABLED=true, running the published migration, and starting a worker on the healer queue makes Tackle listen for JobFailed and ScheduledTaskFailed events. A healing agent then runs against a fresh worktree on a tackle/heal-{id} branch with the exception class, message, stack trace, and the full Telescope entry when installed. It applies a minimal fix, runs the test suite, and either opens a pull request with its reasoning or, in patch mode, merges into the working branch and re-dispatches the original job. A #[Healable(false)] attribute exempts jobs, and AI_CODE_HEALING_THRESHOLD=3 waits for three failures before acting. Every attempt lands in a tackle_healing_log table, inspectable via php artisan tackle:healing-log with --type and --outcome filters. Failing tests in patch mode fall back to opening a PR, and healer jobs run with $tries = 1.

tackle:mcp serves the Laravel-aware tools over MCP on stdio, so Claude Code, Cursor, or Zed can call ListRoutes, QueryDatabase, ReadTelescopeEntry, and RunLarastan against the app. The exposed set comes from config('tackle.mcp.tools') and defaults to read and analysis tools only. Path guards, the Artisan allowlist, and the SELECT-only database restriction still apply; AskUser and ConfirmAction are refused because MCP clients have no terminal.

Two limits: the agent has no internet access and works only from workspace files, and the spend limit is estimated from token counts against a built-in price catalogue, so actual billing differs slightly. Tackle is MIT-licensed, currently at v1.27.3 on GitHub, with documentation at tackle.jordandalton.com.