Files

How it works

The panel starts a klyrn files-helper subprocess running as the account's Unix user, and that process does the work. The kernel decides what the helper can reach, so it cannot reach a path the account cannot. The helper has a ten-minute ceiling.

Uploads and downloads pass through a staging directory that only the panel user can write into and only root can list. Core accepts a staged file only if it is a regular, non-symlink file directly inside that directory and owned by the panel user.

Inside the account, user-supplied paths are resolved with openat2 and RESOLVE_BENEATH. ../ and a symlink out of the tree both fail in the kernel.

What you can do

Browse and read

List a directory, open a file in the editor.

Write

Save an edited file, create a directory.

Rename, delete, chmod

The ordinary operations, on one entry or a selection.

Upload and download

Through the staging handshake above. Downloads are recorded in the audit log.

Copy and move

Whole trees. A symlink inside the tree is refused, and free space is checked first.

Compress and extract

Create an archive from a selection, or unpack one.

Each is a typed operation with its own validator and its own audit entry. None takes a command string, so no shell is involved.

The code editor

Opening a file can start the full code editor: a file tree, tabs, search and replace, quick open and a focus mode. It can fill the whole width of the screen.

The administrator decides who gets it under Settings, Features. Without it, files open in the simple editor.

Live preview

The preview shows the site beside the code, as visitors will see it. It reloads on every save, and an HTML file updates as you type.

It works for PHP, WordPress, HTML and Node.js apps. It is served from a hostname of its own, so a site's code never runs next to the panel.

The AI assistant

The assistant sits beside the code. Ask it to explain a file, find a bug or make a change. A change comes back as a diff, and you apply it with one click.

It needs a provider under Settings, AI, which the administrator sets up. See the AI provider.

AI tools on a site's files

AI tools makes a key for one site. The key reaches only that site's folder, expires, and can be revoked at any time.

Claude Code, Cursor and VS Code connect with it through the MCP endpoint at /api/v1/mcp. Each read and write runs as the account, like every other file operation on this page.

When the account is over its limit

Four operations grow the account: upload, extract, copy and compress. They are refused when the account is over its disk limit. The message gives the limit, the usage and the age of the measurement.

Delete, rename, chmod, write and mkdir keep working. Deleting is the way back under the limit. An account 2 MB over can still edit .htaccess or wp-config.php to fix its own site.

A refusal also schedules a fresh measurement, so "delete some files and try again" works within about a minute. See Resource limits.

.htaccess

nginx does not read .htaccess. A file left behind by a migration is inert.

KLYRN reads the file, translates the rules it understands into the site's nginx configuration, and shows you the translation before applying it. Rules it cannot translate are listed. See Migration.