un-boxing-hosting · un-boxing-man · Jul 26, 2026 · Mar 12, 2026 · Mar 12, 2026 · Mar 12, 2026
diff --git a/.cursor/rules/backend-daemon-panel-standards.mdc b/.cursor/rules/backend-daemon-panel-standards.mdc
@@ -0,0 +1,23 @@
+---
+description: Backend development conventions
+globs: daemon/src/**/*.ts, panel/src/**/*.ts,
+alwaysApply: false
+---
+
+# Backend directory structure
+
+Folder names under `daemon/src/*` and `panel/src/app/*` define the layers: route, middleware, service, instance, etc.
+
+# Logging and exceptions
+
+- Use the project **logger** (not raw `console.*`). Use `info` or `error` by context.
+- For external resources (files, network, containers, shell): validate inputs and boundaries; on failure log and rethrow or return a clear result. Do not swallow exceptions.
+
+# Security checks
+
+- For container/command logic: strictly parse and validate config (length, format). Do not pass unvalidated input into command args or config fields.
+- When running shell commands or reading files, if arguments come from the frontend, validate them for security risks.
+
+# Memory and leaks
+
+- For new Maps, queues, Buffer, arrays, etc., add corresponding cleanup/release logic to avoid memory leaks.
diff --git a/.cursor/rules/core-project-conventions.mdc b/.cursor/rules/core-project-conventions.mdc
@@ -0,0 +1,52 @@
+---
+description: Project development conventions
+alwaysApply: true
+---
+
+# Project structure
+
+The codebase is split into: `web backend (panel/*.*)`, `daemon/node (daemon/*.*)`, and `web frontend (frontend/*.*)`.
+
+- **Daemon**: instance processes, containers, files, and terminal management.
+- **Web backend**: user management, node connections, auth, and API.
+- **Web frontend**: UI, backend communication; some features talk to the daemon directly to reduce load.
+
+# Code requirements
+
+- Prefer **minimal changes**. Before coding, check `hooks/services/stores/utils` in the relevant subproject to avoid duplicate logic.
+- All comments and all code must be written in English. If there are any non-English strings, you must use the i18n convention.
+- Do **not** hardcode user-facing text (UI copy or error messages). Use the project i18n flow (backend logs excepted).
+- Code must be **high cohesion, low coupling, reusable**.
+
+# i18n conventions
+
+- **Frontend**: use `t()` from `@/lang/i18n` for all translatable text.
+- **Backend**: use `$t()` (e.g. from `daemon/src/i18n/index.ts`) for all user-facing text and error messages.
+- Store source strings as accurate, short, correct English in `languages/en_us.json`; other locales are added separately.
+
+## i18n parameterized strings
+
+> Frontend and backend use different placeholder syntax. Keys must use the `TXT_CODE` prefix.
+
+```json
+{
+  "TXT_CODE_FILE_ERROR": "File {name} error!",
+  "TXT_CODE_INSTANCE_ERROR": "Exception instance {{uuid}}: {{err}}"
+}
+```
+
+- **Frontend**: one pair of braces `{name}`.
+- **Web backend / Daemon**: two pairs `{{uuid}}`, `{{err}}`.
+
+```vue
+<!-- Web frontend -->
+<template>{{ t("TXT_CODE_FILE_ERROR", { name: props.fileName }) }}</template>
+```
+
+```ts
+// Backend, with parameters
+const errorMsgWithParams = $t("TXT_CODE_INSTANCE_ERROR", {
+  uuid: instance.instanceUuid,
+  err: err
+});
+```
diff --git a/.cursor/rules/frontend-vue-component-standards.mdc b/.cursor/rules/frontend-vue-component-standards.mdc
@@ -0,0 +1,12 @@
+---
+description: Frontend (Vue 3) development conventions
+globs: frontend/src/**/*.vue
+alwaysApply: false
+---
+
+# Vue component conventions
+
+- Use **Vue 3**. Components must use `<script setup lang="ts">`. Use `const` and clear types to express intent.
+- Pass data via Vue’s recommended **props**; do not break one-way data flow.
+- Keep component TS logic short. Move complex logic into dedicated **hooks** by responsibility for reuse.
+- Keep templates short. Extract complex markup into separate Vue components for reuse.
diff --git a/.gitignore b/.gitignore
@@ -17,6 +17,7 @@ production-code/
 test.js
 .idea/
 ai-api.key
+.vs/
 
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json

diff --git a/AGENTS.md b/AGENTS.md
@@ -0,0 +1,129 @@
+---
+description: Core project rules for all AI assistants (Claude, Cursor, etc.)
+---
+
+## 1. Project Overview
+
+- **Structure**
+  - **Web backend**: `panel/*.*`
+  - **Daemon / node worker**: `daemon/*.*`
+  - **Web frontend**: `frontend/*.*`
+- **Responsibilities**
+  - **Daemon**: instance processes, containers, files, terminal management.
+  - **Web backend**: user management, node connections, auth, API.
+  - **Web frontend**: UI, talks to backend; some features talk directly to daemon to reduce load.
+
+## 2. General Coding Rules
+
+- **Minimal changes**: Prefer small, focused edits. Before adding new logic, check existing `hooks`, `services`, `stores`, `utils` in the relevant subproject and reuse when possible.
+- **Language for code & comments**: All **code and comments must be written in English**.
+- **User-facing text & i18n**
+  - Do **not** hardcode user-facing strings (UI labels, messages, errors, etc.).
+  - Always use the project i18n flow (backend logs are the only common exception).
+- **Design quality**
+  - Aim for **high cohesion, low coupling, reusable** code.
+
+## 3. i18n Conventions
+
+- **Frontend (Vue)**: use `t()` from `@/lang/i18n` for all translatable text.
+- **Backend / Daemon**: use `$t()` (e.g. from `daemon/src/i18n/index.ts`) for all user-facing text and error messages.
+- **Source language**: Add/keep source strings as short, correct English in `languages/en_us.json`. Other locales (e.g. `zh_CN`, `zh_TW`) are translations.
+
+### 3.1 Parameterized Strings
+
+- Keys for dynamic / parameterized messages use the `TXT_CODE_*` prefix.
+- **Different placeholder syntax**:
+  - **Frontend**: one pair of braces: `{name}`.
+  - **Backend / Daemon**: double braces: `{{uuid}}`, `{{err}}`, etc.
+
+Example definition:
+
+```json
+{
+  "TXT_CODE_FILE_ERROR": "File {name} error!",
+  "TXT_CODE_INSTANCE_ERROR": "Exception instance {{uuid}}: {{err}}"
+}
+```
+
+Example usage (frontend):
+
+```vue
+<template>{{ t("TXT_CODE_FILE_ERROR", { name: props.fileName }) }}</template>
+```
+
+Example usage (backend / daemon):
+
+```ts
+const errorMsgWithParams = $t("TXT_CODE_INSTANCE_ERROR", {
+  uuid: instance.instanceUuid,
+  err: err
+});
+```
+
+## 4. Backend (Daemon & Panel) Conventions
+
+- **Scope**
+  - Applies to backend code in `daemon/src/**/*.ts` and `panel/src/app/**/*.ts`.
+
+### 4.1 Directory / Layering
+
+- Folder names under `daemon/src/*` and `panel/src/app/*` express layers:
+  - routes, middleware, services, instances, etc.
+- When adding backend logic, place it in the appropriate layer and keep responsibilities clear.
+
+### 4.2 Logging & Exceptions
+
+- Use the project **logger** (not raw `console.*`).
+  - Use severity (`info`, `error`, etc.) according to context.
+- For external resources (files, network, containers, shell):
+  - Validate inputs and boundaries before acting.
+  - On failure, log relevant context and then either:
+    - Rethrow, or
+    - Return a clear, typed result that the caller can handle.
+  - Do **not** silently swallow exceptions.
+
+### 4.3 Security
+
+- For containers and command execution:
+  - Strictly parse and validate configuration (length, format, allowed values).
+  - Never pass unvalidated input into shell command arguments or container config fields.
+- When reading files or running commands with arguments from the frontend:
+  - Validate paths, IDs, and other inputs for security risks.
+
+### 4.4 Memory & Resource Management
+
+- When introducing new long-lived structures (e.g. `Map`, queues, buffers, arrays, streams):
+  - Ensure there is corresponding cleanup / release logic.
+  - Avoid unbounded growth (e.g. clear maps, trim logs, close streams).
+
+## 5. Frontend (Vue 3) Conventions
+
+- **Scope**
+  - Applies to Vue components under `frontend/src/**/*.vue`.
+
+### 5.1 Components & Scripts
+
+- Use **Vue 3** with `<script setup lang="ts">`.
+- Prefer `const` and explicit TypeScript types to clarify intent.
+- Keep component logic small and focused:
+  - Extract complex logic into dedicated **hooks** (composables) grouped by responsibility for reuse.
+
+### 5.2 Templates & Structure
+
+- Keep templates as simple and readable as possible.
+- If the template becomes large or complex:
+  - Extract parts into smaller reusable components.
+
+### 5.3 Data Flow
+
+- Follow Vue’s recommended one-way data flow:
+  - Pass data via **props**.
+  - Emit events upward instead of mutating parent state directly.
+
+## 6. How AI Assistants Should Behave in This Repo
+
+- Respect all rules above when proposing or editing code.
+- Use the appropriate i18n helper instead of hardcoding user-visible text.
+- Prefer minimal, focused diffs and reuse existing utilities / services when possible.
+- Keep code and comments in English even if conversation language is different.
+
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
@@ -87,7 +87,7 @@ if (!checkName) {
   const errorMsg = $t("TXT_CODE_MY_ERROR"); // Correct approach
 }
 
-// Usage with parameters
+// Usage with parameters, only Web backend, Daemon Backend.
 const errorMsgWithParams = $t("TXT_CODE_INSTANCE_ERROR", {
   uuid: instance.instanceUuid,
   err: err
@@ -98,9 +98,9 @@ languages/en_US.json
 
 ```json
 {
-  // All translation text Keys must be unique, so please use a longer name if possible!
+  // All translation text Keys must be unique, so please use a longer name if possible! frontend only.
   "TXT_CODE_MY_ERROR": "Hello，这是一个错误！",
-  // If parameters are needed, use double curly braces
+  // If parameters are needed, use double curly braces. only Web backend, Daemon Backend.
   "TXT_CODE_INSTANCE_ERROR": "Exception instance {{uuid}}: {{err}}"
 }
 ```

diff --git a/DEVELOPMENT_ZH.md b/DEVELOPMENT_ZH.md
@@ -100,7 +100,7 @@ languages/en_US.json
 {
   // 所有的翻译文案 Key，不可有重复，所以请可能的取一个较长的名字！
   "TXT_CODE_MY_ERROR": "Hello，这是一个错误！",
-  // 如果需要携带参数，使用两个花括号
+  // 如果需要携带参数，Web 后端、Daemon 后端则使用两个花括号
   "TXT_CODE_INSTANCE_ERROR": "Exception instance {{uuid}}: {{err}}"
 }
 ```

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 <div align="center">
   <a href="https://mcsmanager.com/" target="_blank">
-    <img src="https://public-link.oss-cn-shenzhen.aliyuncs.com/mcsm_picture/logo.png" alt="MCSManagerLogo.png" width="510px" />    
+    <img src="./frontend/src/assets/logo.png" alt="MCSManagerLogo.png" width="510px" />    
   </a>
 
   <br />
@@ -203,9 +203,11 @@ services:
     ports:
       - "23333:23333"
     volumes:
+      - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
       - <CHANGE_ME_TO_INSTALL_PATH>/web/data:/opt/mcsmanager/web/data
       - <CHANGE_ME_TO_INSTALL_PATH>/web/logs:/opt/mcsmanager/web/logs
+      - <CHANGE_ME_TO_INSTALL_PATH>/web/public/upload_files:/opt/mcsmanager/web/public/upload_files
 
   daemon:
     image: githubyumao/mcsmanager-daemon:latest
@@ -225,11 +227,11 @@ services:
 Note (Rootless Docker on Linux): the daemon supports `DOCKER_HOST`. If your Docker daemon runs in rootless mode, the socket is usually at `/run/user/<uid>/docker.sock` instead of `/var/run/docker.sock`. In that case, replace the default socket mount with the rootless socket and set `DOCKER_HOST`, for example:
 
 ```yml
-  daemon:
-    environment:
-      - DOCKER_HOST=unix:///run/user/1000/docker.sock
-    volumes:
-      - /run/user/1000/docker.sock:/run/user/1000/docker.sock
+daemon:
+  environment:
+    - DOCKER_HOST=unix:///run/user/1000/docker.sock
+  volumes:
+    - /run/user/1000/docker.sock:/run/user/1000/docker.sock
 ```
 
 Replace `1000` with your actual UID (`id -u`).
@@ -257,6 +259,22 @@ Before contributing code to this project, please make sure to review the followi
 - Please maintain the existing code structure and formatting, **do not apply unnecessary or excessive formatting changes.**
 - All submitted code **must follow internationalization (i18n) standards**.
 
+### Bug Reports
+
+We welcome all bug reports and feedback. Your contributions help us improve the project.
+
+If you encounter any issues, please report them via the [GitHub Issues](https://github.com/MCSManager/MCSManager/issues) page, and we’ll address them as soon as possible.
+
+For serious **security vulnerabilities** that should not be disclosed publicly, please contact us directly at: **support@mcsmanager.com**
+
+Once resolved, we will credit the discoverer in the relevant code or release notes.
+
+### Acknowledgements
+
+Thanks to the following developers for making important contributions to the security testing of MCSManager!
+
+> [@Cuo256](https://github.com/Cuo256), [@xiaosu](https://github.com/xiaosuawa), [@tianjiefeifei](https://github.com/tianjiefeifei), [9Bakabaka](https://github.com/9Bakabaka)
+
 <br />
 
 ## Development
@@ -308,18 +326,6 @@ MCSManager supports all major modern browsers, including:
 
 <br />
 
-## Bug Reports
-
-We welcome all bug reports and feedback. Your contributions help us improve the project.
-
-If you encounter any issues, please report them via the [GitHub Issues](https://github.com/MCSManager/MCSManager/issues) page, and we’ll address them as soon as possible.
-
-For serious **security vulnerabilities** that should not be disclosed publicly, please contact us directly at: **support@mcsmanager.com**
-
-Once resolved, we will credit the discoverer in the relevant code or release notes.
-
-<br />
-
 ## Contributors
 
 <a href="https://openomy.com/MCSManager/MCSManager" target="_blank" style="display: block; width: 100%;" align="center">

diff --git a/README_DE.md b/README_DE.md
@@ -1,6 +1,6 @@
 <div align="center">
   <a href="https://mcsmanager.com/" target="_blank">
-    <img src="https://public-link.oss-cn-shenzhen.aliyuncs.com/mcsm_picture/logo.png" alt="MCSManagerLogo.png" width="510px" />    
+    <img src="./frontend/src/assets/logo.png" alt="MCSManagerLogo.png" width="510px" />    
   </a>
 
   <br />
@@ -195,9 +195,11 @@ services:
     ports:
       - "23333:23333"
     volumes:
+      - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
       - <CHANGE_ME_TO_INSTALL_PATH>/web/data:/opt/mcsmanager/web/data
       - <CHANGE_ME_TO_INSTALL_PATH>/web/logs:/opt/mcsmanager/web/logs
+      - <CHANGE_ME_TO_INSTALL_PATH>/web/public/upload_files:/opt/mcsmanager/web/public/upload_files
 
   daemon:
     image: githubyumao/mcsmanager-daemon:latest

diff --git a/README_ES.md b/README_ES.md
@@ -1,6 +1,6 @@
 <div align="center">
   <a href="https://mcsmanager.com/" target="_blank">
-    <img src="https://public-link.oss-cn-shenzhen.aliyuncs.com/mcsm_picture/logo.png" alt="MCSManagerLogo.png" width="510px" />    
+    <img src="./frontend/src/assets/logo.png" alt="MCSManagerLogo.png" width="510px" />    
   </a>
 
   <br />
@@ -195,9 +195,11 @@ services:
     ports:
       - "23333:23333"
     volumes:
+      - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
       - <CHANGE_ME_TO_INSTALL_PATH>/web/data:/opt/mcsmanager/web/data
       - <CHANGE_ME_TO_INSTALL_PATH>/web/logs:/opt/mcsmanager/web/logs
+      - <CHANGE_ME_TO_INSTALL_PATH>/web/public/upload_files:/opt/mcsmanager/web/public/upload_files
 
   daemon:
     image: githubyumao/mcsmanager-daemon:latest

diff --git a/README_FR.md b/README_FR.md
@@ -1,6 +1,6 @@
 <div align="center">
   <a href="https://mcsmanager.com/" target="_blank">
-    <img src="https://public-link.oss-cn-shenzhen.aliyuncs.com/mcsm_picture/logo.png" alt="MCSManagerLogo.png" width="510px" />    
+    <img src="./frontend/src/assets/logo.png" alt="MCSManagerLogo.png" width="510px" />    
   </a>
 
   <br />
@@ -195,9 +195,11 @@ services:
     ports:
       - "23333:23333"
     volumes:
+      - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
       - <CHANGE_ME_TO_INSTALL_PATH>/web/data:/opt/mcsmanager/web/data
       - <CHANGE_ME_TO_INSTALL_PATH>/web/logs:/opt/mcsmanager/web/logs
+      - <CHANGE_ME_TO_INSTALL_PATH>/web/public/upload_files:/opt/mcsmanager/web/public/upload_files
 
   daemon:
     image: githubyumao/mcsmanager-daemon:latest
-Original file line number
+Diff line change
@@ Expand Up / @@ -17,6 +17,7 @@ production-code/ @@
     test.js
     .idea/
     ai-api.key
+    .vs/
     # Diagnostic reports (https://nodejs.org/api/report.html)
     report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@@ Expand Down @@