Safety

Caution

Buttons runs the commands exactly as they are written.

Review a shared project’s .buttons.json before running its commands — treat it like a Makefile or a package.json script. Commands are not sandboxed; running a button has the same effect as typing that command into a terminal yourself.

Your ~/.buttons.json is personal and is never shared with a project. Keep credentials or environment-specific commands out of a project’s .buttons.json if that file will be committed.

A few things worth knowing:

• Buttons reads scripts from files and stores references to them — it never modifies your package.json, Makefile, composer.json, or justfile.
• Custom commands are stored verbatim and are never rewritten by scanning.
• A script button’s command is recomputed when the underlying script or package manager changes, so it always reflects the current source of truth.