File Manager

The File Manager (/servers/:id/files) is a full-screen file workspace for a server, in the spirit of cPanel’s File Manager — a folder tree, a sortable file list and a built-in code editor, so you can browse, edit, upload and reorganise files without opening an SFTP client or an SSH session. Reach it from a server’s side menu under Tools → File Manager. Available on all plans.

Edit a file, step by step

1. Open File Manager. It boots into the first site on the server (or the one you came from); use the site switcher in the footer to jump to another site, or — if you’re the org owner — switch to the Server root scope.
2. Navigate with the folder tree on the left or by double-clicking folders in the list. The breadcrumb at the top shows where you are and lets you jump back up.
3. Click a text file (.php, .css, .js, .env, .conf, …) to open it in the built-in editor — syntax highlighting, find/replace, and a Format button for supported languages.
4. Make your changes and click Save. The file is written back through the agent and the list refreshes.

What else you can do

The workspace is a right-click-driven file browser — everything below is on the context menu (or the ⋯ button on a row), the toolbar, or a keyboard shortcut:

• Create — New folder and New file (Text, PHP, HTML, CSS, JS, JSON, Markdown, Shell, or empty) from the toolbar or the empty-area menu.
• Upload — drop or pick files; small files relay through the control plane, large files stream, and (where enabled) very large files go straight to the box.
• Download — a single file, streamed with no size cap.
• Rename — inline (also F2 on a single selection).
• Cut / Copy / Paste and Move to… / Copy to… — the transfer drawer browses the tree; owners can also transfer across sites on the same server, or across servers to another box in the account.
• Compress — zip or tar.gz an item or a multi-selection, with a live progress bar.
• Extract — unpack a .zip, .tar.gz, .tgz or .tar archive in place.
• Change permissions — a chmod grid (owner/group/other × read/write/execute), optionally recursive.
• Properties — type, size, owner, permissions and modified time.
• Delete / Move to Trash — Trash is a per-scope .Trash folder you can Restore from or Empty; items auto-purge after 30 days.
• Search — find files by name under the current root.
• Sort, filter and reveal hidden files, multi-select with a drag marquee, and toggle a light/dark theme (this route has its own toolbar).

How it works

File Manager does not use the panel’s job queue — every action is a direct fs.* RPC to the server’s agent, fronted by /v1/servers/:id/fs/* on the control plane. Reads are GETs (fs.list, fs.stat, fs.read, fs.dirsize, fs.search); writes are PUT/POST and are audited (fs.write, fs.mkdir, fs.move, fs.copy, fs.delete, fs.chmod, fs.compress, fs.extract, fs.upload). Compress and extract stream per-file progress over SSE.

The agent owns the sandbox: it jails every path, defends against symlink escapes, and chowns new files to the right user. Two scopes exist:

• Per-site — jailed to the site user’s home (/home/<slug>). Any org member can read; changing files needs an admin or operator role.
• Server root — the whole /home tree, owner-only (org owner or a super-admin).

Nothing is stored on the control plane — the files live on your box; MZPanel only brokers access and writes the audit log.

Big files and transfers have their own paths:

• Uploads — up to ~64 MB relay through the API; larger files stream over binary WebSocket frames; and when direct-to-box ingress is configured, the browser PUTs straight to the box at https://<id>.box.mzpanel.com/… (up to 2 GB), bypassing the control plane entirely.
• Downloads — small files come back base64 through one RPC (≤64 MB); larger files stream over binary frames with no cap.
• Cross-server Copy/Move — the box tars the selection and pushes it directly to the destination box over an ephemeral, IP-restricted SSH key (tar | ssh); bytes never pass through MZPanel. It requires you to own both servers in the same account, and both agents online.

API & automation

File Manager is a set of HTTP endpoints, not mz CLI commands — there is no on-box mz fs verb, and the on-box AI reaches files the same way you’d read them in a shell. To automate from the control plane, drive the fs.* routes directly:

GET  /v1/servers/:id/fs/list?scope=site&domain=<domain>&path=/     # browse
GET  /v1/servers/:id/fs/read?scope=site&domain=<domain>&path=…     # read a file
PUT  /v1/servers/:id/fs/write                                      # write a file
POST /v1/servers/:id/fs/move | /copy | /delete | /chmod            # mutate

See the HTTP API reference (programmatic access is a Max-plan feature).

Gotchas & troubleshooting

• Server-root scope is owner-only. Team members with an operator/admin role can work inside each site’s files, but the whole-server /home view is restricted to the org owner. Members simply won’t see the Server root option.
• The agent must be online. Every action is live; if the box is offline the workspace can’t list or edit — bring the agent back and reload.
• Binary files can’t be edited. Clicking a non-text file downloads it instead; the editor only opens text. If a file looks binary, you’ll be told to download it.
• Extract only handles zip / tar.gz / tgz / tar. The agent’s extractor is pure-Go; .gz, .bz2 and .xz on their own aren’t offered for Extract even though they can be produced elsewhere.
• Trash is a convention, not a system feature. Deleted items move to a per-scope .Trash folder; the 30-day auto-purge runs when you open Trash (there’s no server-side cron), so an untouched box keeps expired items until the next visit. “Delete permanently” skips Trash entirely.
• Direct-to-box upload needs ingress configured. When the server has direct ingress enabled you get 2 GB straight-to-box uploads; otherwise the panel silently falls back to relaying through the API (≤64 MB per file).
• Cross-server transfer isn’t tier-gated yet. It’s owner-only and same-account by design; the intended Pro+ plan gate is deferred to the billing phase, so during the current phase it’s available on every tier.

Related

• Sites — the web apps whose files you’re editing.
• The HTTP API — driving MZPanel programmatically.
• Troubleshooting — when something doesn’t load.