Quick actions: project detection, commands and security limits

Quick actions

Quick actions is a sub-tab of a repository's detail inside the Deployments section (Development → Deployments). The panel detects the project type from the files in the repository and offers commands you can run with a single click, without SSH.

How detection works

The panel looks in the repository's root directory for:

• composer.json – a PHP/Composer project
• package.json – a Node.js project (it also detects yarn.lock and offers Yarn instead of NPM)
• artisan – Laravel
• bin/console – Symfony
• wp-config.php or wp-login.php – WordPress

A repository can match several categories at once (e.g. Laravel + Composer + Node); the suggested commands then appear grouped under every matching heading.

Composer

• composer install, composer install --no-dev, composer update
• composer dump-autoload

Node.js / NPM

• npm install / npm ci (or yarn install if the project uses Yarn)
• npm run build, npm run dev (or yarn build, yarn dev)
• npm run prod, if package.json has a prod/production script
• npm run watch, if package.json has a watch script

Laravel

If you need to deploy a Laravel application manually over SSH instead of one click at a time, see Deploying a Laravel application. Quick actions groups its commands into three categories (Deployment, Cache, Info & Debug):

• Deployment: php artisan migrate --force, php artisan optimize, php artisan key:generate --force, php artisan storage:link
• Cache: config:cache, route:cache, view:cache, event:cache, cache:clear, optimize:clear
• Info & Debug: route:list, schedule:list, queue:restart, migrate:status

The Artisan sub-tab next to Quick actions additionally exposes every artisan command of the application, including custom ones, with a form for arguments and options.

Symfony

• bin/console cache:clear, bin/console cache:warmup

WordPress

When wp-config.php is detected, the panel also offers wp core update, wp plugin update --all, wp theme update --all and wp cache flush via WP-CLI.

Fixing permissions

Below the command list is a separate Permissions section with Fix permissions and Fix storage buttons – see Fixing file permissions for details.

Confirming dangerous commands

Commands that can cause data loss or an outage (for example migrate:fresh, migrate:rollback, db:wipe, queue:flush, git reset --hard) require confirmation before they run: the panel shows a random code, and the run button stays disabled until you type it into the field exactly.

Blocked commands

Some commands cannot be run at all through Quick actions or the Artisan sub-tab – the panel rejects them with a "command not allowed" error. These are mainly:

• interactive shells and REPLs (tinker, wp shell, wp eval)
• development servers and long-running processes (serve, queue:work, horizon:work, schedule:work, octane:start)
• test suites (artisan test, dusk, composer test/phpunit/phpstan, npm test, npm run lint)
• code generators (make:*) and debug/secret-exposing commands (debug:*, secrets:decrypt-to-local)

Where commands run, and limits

Every command runs as your hosting user on your hosting, in the selected repository's directory, with a 300-second time limit. For artisan/console commands the panel automatically adds --no-interaction so they don't stall on a confirmation prompt, and adds --force to commands like migrate, db:seed or storage:link if you didn't include it yourself. After Composer commands and artisan cache commands, PHP on the hosting is restarted automatically so the new cache takes effect.