System File Manager Integration

Show in Files adds a server to the operating system’s file manager as a location of its own. Other apps can then browse, open and save files on the server over SFTP without PocketCmd being open. Turn it on in a server’s settings.

Platform	Where the server appears
iOS and iPadOS	The Files app, as a location
macOS	Finder, as a location
Windows	File Explorer, as a sidebar entry (the cloud-files mechanism OneDrive uses)
Android	The system file picker, and the “choose a file” chooser of other apps
Linux	Not available

Files are fetched when an app opens them rather than synced in advance, and changes saved in other apps are uploaded back to the server. On iOS, macOS and Android, apps can also create, rename and delete files.

Turn it on

Open the server’s settings and switch on Show in Files. The info button next to it explains what the switch does. Before it can be turned on:

• the server needs a hostname and a username;
• you must have connected to the server in PocketCmd at least once, so its host key is pinned, and the server must still present that key. A different key stops the setup with “Host key does not match the pinned key”;
• the server must not be locked by the Free limit.

When setup succeeds, PocketCmd shows Added to Files with the pinned host key fingerprint and the restriction status described below.

Turning Show in Files off removes the server from the file manager and connects to the server to delete the key line PocketCmd added.

Servers that use an SSH key

For a server that signs in with a key, PocketCmd creates a dedicated Files key for this device and adds it to ~/.ssh/authorized_keys on the server as a restricted line:

restrict,command="internal-sftp -d '/home/you'",expiry-time="YYYYMMDD" ssh-ed25519 AAAA… pocketcmd-files-<device>-<id>

• restrict turns off port forwarding, agent forwarding, X11 forwarding and PTY allocation for this key.
• command="internal-sftp …" limits the key to SFTP. It cannot open a shell or run commands. -d makes the session start in your home folder; it does not confine the key to that folder. To confine it, set up ChrootDirectory on the server.
• expiry-time makes the server reject the key about 90 days after it was enrolled. OpenSSH supports this option from version 8.2; older servers ignore it.
• The comment at the end identifies the device, so the line can be found and removed later.

The Files key is generated in the device’s secure hardware where there is one. On a machine without a secure element, PocketCmd asks before storing a software key, protected by the operating system’s keychain, instead.

Enforced or advisory

During setup PocketCmd checks whether the restriction can be undone from the account it signs in to:

Status	Meaning
Enforced	~/.ssh belongs to another account and is not writable by group or others, so the login account cannot edit authorized_keys.
Advisory	The login account owns ~/.ssh (or it is group- or world-writable). The restriction applies to normal use, but someone holding your unlocked device could rewrite the line and lift it.
Unverified	The check could not run on this server.

Advisory is the normal result on a single-user server, where you own your own ~/.ssh. The server’s settings show the advisory status under the switch. To make it enforced, have an administrator make ~/.ssh owned by another account (for example root) and not writable by your login account, or point AuthorizedKeysFile in sshd_config at a root-owned location. In that setup PocketCmd cannot write the line itself, so the administrator adds it.

Servers that use a password

A server that signs in with a password gets no key. PocketCmd asks you to confirm Enable Files with a stored password? first: the file manager then signs in with a copy of the password that is sealed to this device and usable without your app password. If the device is compromised, the server password is exposed and should be changed. Use a key for any server where that is not acceptable.

Locked servers

When a server is locked by the Free limit, for example after a Pro subscription ends, it stays in the file manager but cannot be reached. Its Show in Files setting reads “Paused: this server is locked by the Free limit”. The key line, pinned host key and stored credentials are kept, and the location works again once the server is active.

In the Android file picker, locked servers are listed last and grayed out. Tapping one explains the lock and points you back to PocketCmd.

Security properties

• Pinned host keys. The file manager integration accepts only the host key pinned when you set it up. It never trusts a new key on first use.
• Signed server list. The list of Files-enabled servers that the file manager reads is signed with this device’s Files key and carries a counter, so it cannot be altered or rolled back to an older version.
• Server permissions apply. Every operation runs as your account on the server, under its normal file permissions.

Removing a lost or retired device

Each device that turns on Show in Files leaves a key line on the server. With sync, PocketCmd also records which servers each device enrolled. After you revoke a device on the team screen, PocketCmd offers Scrub Files access?: Scrub connects to each of those servers you can reach and deletes that device’s key line. Servers that are unreachable at the time stay listed so you can scrub them later.

Revoking a device alone does not remove its key lines. Without scrubbing, a key line stays valid until its expiry date.

PocketCmd’s own folder on iOS

On iOS, PocketCmd’s documents folder appears in the Files app under On My iPhone › PocketCmd (or On My iPad). It holds downloads saved to app storage and uploaded terminal fonts. The app’s databases are stored elsewhere and do not appear there.