A native Mac file manager for SSH hosts
All your servers, side by side. Nothing runs until you've read it.
pālana puts every machine you can ssh into beside your local files. Browse, copy, and manage files from a keyboard-first dual-pane window that shows the exact command before it runs. When two servers can talk directly, the bytes stay off your Mac. Where a host runs ZFS, pālana speaks it natively—where none does, you'll never see it.
Terminal tools. A readable interface.
macOS 14+ · free & open source, GPL-3.0 · signed & notarized · your servers need nothing new
move · move to another machine 1 entry · 41.3 GB jodo:/tank/media/camera → koan:/rpool/cold $ rsync -a -s --partial --info=progress2 …
Drawn to scale, not a screenshot—every area, labeled →
The central rule
See the operation before it changes anything.
pālana builds a plan first: the operation, the transfer route, and the commands it will run. It waits for Enter. Everything else follows from that constraint.
See the command. Then run it.
Press m and nothing moves. The plan opens. A move across ZFS datasets is a copy followed by a verified delete, not a rename. pālana states that before it runs, shows the command, and keeps the delete gated until the copy checks out.
Press ⏎ to run it. Press esc to leave it alone. Read the plan model →
move · copy then delete the original 1 entry · 41.3 GB jodo:/tank/media/camera → jodo:/rust/archive how: runs locally on the one host involved $ rsync -a -s --partial --info=progress2 /tank/media/camera/archive-2025 /rust/archive/ runs only after the copy above is verified: $ rm -rf /tank/media/camera/archive-2025
Your Mac starts the job. The servers move the data.
For a copy between two servers, pālana forwards your SSH agent so jodo authenticates to koan directly. Your key stays on your Mac. The 41 GB moves host to host instead of across your Wi-Fi twice.
If a route must pass through your Mac—because it is one end, or as
a fallback—the plan's how: line says so. You do not choose
the transport. You do get to see it.
Cross-host moves →
Dataset boundaries are visible.
pālana marks dataset boundaries in the pane and changes the plan when you cross one. Press Z for the host's dataset tree: create, snapshot, roll back, and destroy. Every action opens a plan first. Destruction also requires you to type the word.
Moving a whole dataset between ZFS machines uses
zfs send | ssh | zfs receive when it can—block-level and
typically much faster than a file-by-file transfer. ZFS is an addition,
not a requirement—hosts without it get everything else unchanged.
ZFS, natively →
move · move to another machine
how: zfs send/receive, run host-to-host · using the forwarded ssh key
$ zfs snapshot -r tank/sage/jodo/kanyo@palana-20260716-101530
$ zfs send -R -v tank/sage/jodo/kanyo@palana-20260716-101530 | ssh koan 'zfs receive -u rpool/sage/koan/kanyo'
runs only after the copy above is verified: $ zfs destroy -r rpool/sage/koan/kanyo@palana-20260716-101530
runs only after the copy above is verified: $ zfs destroy -r tank/sage/jodo/kanyo
All your hosts. One key.
Press f for your hosts, pools, datasets, capabilities, and the date each host was last probed. r probes a host again in place. ⏎ points a pane at it and closes the view.
F opens the full map—every mount on every machine—for a second display. See the field →
A small key grammar.
Arrows work. So do the vim keys. Six lowercase verbs, a few prefixes, and a consistent set of rules make the rest of the keyboard learnable.
The rest of the tool.
Drag and drop, with a plan
Between panes, from Finder, or into folder rows. A drop builds a plan like any other verb. Hold ⌥ to make it a move.
Edit remote files in your own editor
Open a server's config in your Mac app; saving offers to send it back. If the file changed remotely, it always asks first.
Preview follows selection
The right pane tracks the cursor in the left: text, images, and PDFs. Remote reads stay small.
Your shell, per host
Your actual ssh runs in the bottom panel: one warm session per machine, with keyboard handover shown.
Favorites, local or global
Favorites belong to a host by default. Promote one to global and it appears in every host menu.
Add hosts without editing config
The form shows the exact block it will write to ~/.ssh/config, after backing the file up.
One master zoom
The whole surface scales together, 0.8× to 1.6×. Light and dark, both warm, matching the app.
A plain-text log
Every executed operation appends to a text file in Application Support. It is yours to grep.
Errors that explain the fix
When something cannot happen, pālana states the reason and usually puts the fix beside it.
No background process.
pālana runs when you open it and stops when you close it. No daemon, no launch agent, no polling, no telemetry—there is no component that could outlive the window. Closed means closed.
Dry-run by default. A plan on screen changes nothing. Enter runs it. Esc does not.
Deletion follows verification. The destructive half of a move runs only after visible count checks agree on both ends.
Commands remain portable. Every command works from your terminal because pālana uses your own ssh underneath.
State without surveillance. The field map records what pālana found and when. It refreshes only when you ask.
Implementation
Built in the open.
Swift 6, strict concurrency, SwiftPM. The logic lives in
PalanaCore, a headless library with more than 97% test
coverage. The app renders state and forwards intent. It cannot compose
a shell command on its own. All host contact goes through the system
ssh binary via Process, with one ControlMaster
session per host. There is no embedded SSH stack to audit.
The command line remains first-class. Every plan is a command you can paste. The operations log and state files are plain text you can grep. A real shell sits under the panes. The GUI drives the same tools you do.
The design record is public in the repo's ho-process/:
architectural decisions, their reasoning, and the code they scoped.
How it works →
Get pālana
Free to use. Free to inspect.
pālana for Mac
- v0.4-beta (July 2026)—signed & notarized
.dmg· release notes - macOS 14 or later
- Nothing to install on your servers
- 1.0 signed builds will be $29—the source stays free forever
- File a real issue during the beta: your 1.0 license is on me
GitHub
- Full source—
swift buildand go - The public build record (
ho-process/) - Issues and feedback welcome
- Copyleft-protected, forever