docs: update app settings & multitask & data-management & JIT-Less diagnose, add containers and external data guide

Author: boa-z

docs/guides/app-settings.md

@@ -5,7 +5,7 @@ sidebar_position: 3
 
 # App Settings
 
-Open app settings by long-pressing an app card in LiveContainer and tapping `Settings`.
+Open app settings by holding an app card in LiveContainer and tapping `Settings`.
 
 This page documents current options in the app settings UI and clarifies differences from older docs.
 
@@ -100,6 +100,7 @@ These are per-app compatibility toggles and should be changed one at a time when
 
 ## Related
 
+- [Multiple Containers and External Data Folder](./containers-and-external-data.md)
 - [JIT Support](./jit-support.md)
 - [Tweaks](./tweaks.md)
 - [Multiple Instances](./multiple-livecontainers.md)

docs/guides/containers-and-external-data.md

@@ -0,0 +1,78 @@
+---
+title: Multiple Containers and External Data Folder
+sidebar_position: 4
+---
+
+# Multiple Containers and External Data Folder
+
+By using multiple containers within a single application, you can maintain entirely separate, isolated data sets and bind external folders directly as container storage. This functionality allows you to manage multiple accounts simultaneously without the friction of repeated logins and provides the flexibility to start with a fresh application state while keeping all your existing data intact.
+
+## Open container settings
+
+1. Hold an app card in LiveContainer.
+2. Tap `Settings`.
+3. Go to the `Container` section.
+
+## Create multiple containers for one app
+
+### Create a new local container
+
+1. Tap `New Data Folder`.
+2. Enter a display name.
+3. Confirm to create.
+
+The container is then added to this app.
+
+### Switch container when launching
+
+When an app has multiple containers:
+
+1. Hold the app card.
+2. Use the `Containers` picker in the context menu.
+3. Select the container you want.
+
+### Set default container
+
+1. Open a container entry in app settings.
+2. Tap `Set Default Container`.
+
+This is the container the app uses by default when you tap `Run`.
+
+## Add an external data folder
+
+1. In app settings, tap `Select External Storage`.
+2. Pick a folder in the system file picker.
+3. LiveContainer creates a bookmark and binds this folder as a container.
+
+:::note
+Most apps do not support containers on external storage and are very likely to crash.
+
+If this external folder later becomes unavailable, this container can become partially unavailable until access is restored.
+:::
+
+## Container operations
+
+Open a container detail page to manage it.
+
+- `Container Name`: only changes the name shown in LiveContainer UI. It does not rename the actual container folder.
+- `Container Folder Name`: shows the real folder identifier for this container. Use this value to confirm exact paths or troubleshoot data location. This field is read-only in app settings.
+- `Isolate App Group`: routes app-group container paths for the guest app to this container's isolated location instead of the shared app-group path. This helps reduce cross-container data mixing for app-group-based data.
+- `Spoof Identifier For Vendor`: generates and stores a persistent spoofed `identifierForVendor` for this container. This helps separate app identity state between containers for apps that rely on `identifierForVendor`.
+- `Set Default Container`: makes this container the default one used when you tap `Run`.
+- `Open Data Folder`: opens this container's data folder for manual file import, export, or inspection.
+- `Unbind`: removes this container from the app's container list, but keeps container files on disk.
+- `Delete Data`: removes files inside this container but keeps the container entry and `LCContainerInfo.plist`.
+- `Clean Keychain`: removes keychain data associated with this container.
+- `Remove Container`: removes the container entry and deletes the container folder.
+
+## Limits and behavior
+
+- Maximum containers per app: `128` (limited by keychain group pool).
+- If a container is currently in use by a running LiveContainer instance, destructive operations are blocked.
+- Shared/private app conversion may move data paths. Re-check container selection after conversion.
+
+## Related
+
+- [App Settings](./app-settings.md)
+- [Data Management](./data-management.md)
+- [Multiple LiveContainers](./multiple-livecontainers.md)

docs/guides/data-management.md

@@ -9,39 +9,53 @@ sidebar_position: 4
 Some actions are destructive. Back up important app/container data first.
 :::
 
-## Available tools
+## Clean unused data folders
 
-- clean unused data folders
-- clean keychain
-- move App Group folder between private and shared locations
-- move dangling shared folders out
-- clear icon cache
+:::note
+This action is shown in the primary LiveContainer only.
+:::
+
+Deletes local data folders that are no longer referenced by any app container.
+
+## Move App Group folder
+
+:::note
+This action is shown in the primary LiveContainer only.
+:::
 
-## Recommended usage
+- `Move AppGroup from private to shared`
+- `Move AppGroup from shared to private`
+
+These two actions move App Group files between private and shared locations. They are blocked if the destination side is not empty.
+
+## Move dangling shared folders
+
+:::note
+This action is shown in the primary LiveContainer only.
+:::
 
-### Clean unused data folders
+Moves unreferenced shared resources back to private locations:
 
-Use after deleting apps/containers to remove orphaned folders and reclaim space.
+- shared data folders not used by shared apps
+- shared tweak folders not used by shared apps (except `TweakLoader.dylib`)
 
-### Clean keychain
+Useful after migration/reinstall interruptions.
 
-Use only when credential/keychain state is corrupted and other fixes failed.
+## Clean keychain
 
-### App Group migration actions
+Deletes keychain items (`GenericPassword`, `InternetPassword`, `Certificate`, `Key`, `Identity`) from current keychain scope.
+Use carefully because this is broad and can sign you out of apps.
 
-Use when shared/private storage state is mismatched due to install/path changes.
+## Clear icon cache
 
-### Move dangling shared folders
+Clears app icon cache for currently loaded app list.
 
-Use when shared resources remain in wrong place after migration, reinstall, or interrupted operations.
+## Path tools
 
-## Safe procedure
+Use these tools when you need to inspect files manually or provide exact paths for debugging.
 
-1. Export logs.
-2. Back up critical data.
-3. Run one operation.
-4. Relaunch and verify.
-5. Repeat only if required.
+- `Copy ... Path`: copies the full path for `App Group Container`, `Container`, or `LiveContainer Bundle` to clipboard.
+- `Open in Filza`: appears only when Filza is installed, and opens the selected location directly in Filza.
 
 ## Related
 

docs/guides/jit-less-diagnose-page.md

@@ -1,84 +1,91 @@
 ---
-title: JIT-Less Diagnostics
+title: JIT-Less
 sidebar_position: 9
 ---
 
-# About JIT-Less Diagnose Page
+# JIT-Less
 
-<img width="300" alt="JIT-Less Diagnose Page" src="/img/jit-less-diagnose/1.png" />
+If you are using the bundled SideStore build, complete the setup in [LiveContainer + SideStore: Setup after Installing](/docs/installation/lc_sidestore#setup-after-installing) first.
+If you are using standalone LiveContainer, follow [Standalone LiveContainer: JIT-Less mode setup](/docs/installation/standalone#jit-less-mode-without-jit-recommended).
+
+## JIT-Less actions in Settings
+
+Open `Settings` in LiveContainer and find the `JIT-Less` section.
 
-:::note
-This page exists in LiveContainer 3.1.51+
-:::
+- `Import Certificate`: Import a `.p12` certificate file and password manually from Files.
+- `Import Certificate from SideStore`: Ask your store app to export certificate data to LiveContainer.
+- `Refresh Certificate from SideStore`: Re-import certificate data from your store and overwrite the current one.
+- `Remove Certificate`: Remove imported certificate data/password from LiveContainer.
+- `JIT-Less Diagnose`: Open the diagnosis page to verify entitlement access and certificate state.
+
+On the bundled SideStore build, this refresh can read the certificate directly from the built-in SideStore after confirmation.
+Use `Refresh Certificate from AltStore/SideStore` after you reinstall, re-login, or refresh your store environment, especially if certificate-related checks become stale or fail.
+
+<img width="300" alt="JIT-Less Diagnose Page" src="/img/jit-less-diagnose/1.png" />
 
-If you successfully setup JIT-Less mode, your JIT-Less Mode Diagnose should look like the screenshot above. The most important indicator is "Certificate Last Up Date". This field should change if you reopens your store. If not, follow the following instructions to diagnose your setup.
+If you successfully setup JIT-Less mode, your **JIT-Less Mode Diagnose** should look like the screenshot above. The most important indicator is "Certificate Last Update Date". This field should change if you reopens your store. If not, follow the following instructions to diagnose your setup.
 
 ## App Group ID, App Group Accessible, Store
 
-The "App Group ID" field should end with the exact same 10 characters as the "Bundle Identifier". "App Group Accessible" should be "Yes" and "Store" should correctly show your store.
-
-> For example, if your Bundle Identifier is `com.kdt.livecontainer.A1B2C3D4E5` ,then your app group id should be `group.com.SideStore.SideStore.A1B2C3D4E5` if you use SideStore, or `group.com.rileytestut.AltStore.A1B2C3D4E5` if you use AltStore.
-
-If it only say `group.com.SideStore.SideStore` or `Unknown`, then there's something wrong with your SideStore setup. Please check:
-
-- SideStore is installed through AltServer
-- LiveContainer is installed directly through SideStore/AltStore
-- Don't try to install LiveContainer through AltStore PAL
-- Account used to install SideStore and LiveContainer matches. This can be checked by going to iOS settings -> General -> VPN & Device Management -> (your account name). Check if both LiveContainer and SideStore are under the same account.
-
-:::note
-> "Entitlement File" exists in 3.2.51+
-:::
-
-If you meet the above 4 criteria but App Group is still not accessible, tap "Entitlement File" and check the entitlement extracted form LiveContainer's main executable. A correct entitlement may look like this:
-
-```xml
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
- <key>application-identifier</key>
- <string>A1B2C3D4E5.com.kdt.livecontainer.A1B2C3D4E5</string>
- <key>com.apple.developer.team-identifier</key>
- <string>A1B2C3D4E5</string>
- <key>com.apple.security.application-groups</key>
- <array>
-  <string>group.com.rileytestut.AltStore.A1B2C3D4E5</string>               <--- Important!
-  <string>group.com.SideStore.SideStore.A1B2C3D4E5</string>               <--- Important!
- </array>
- <key>get-task-allow</key>
- <true/>
- <key>keychain-access-groups</key>
- <array>
-  <string>A1B2C3D4E5.com.kdt.livecontainer.shared</string>
-  <string>A1B2C3D4E5.com.kdt.livecontainer.shared.1</string>
-  <string>A1B2C3D4E5.com.kdt.livecontainer.shared.2</string>
- </array>
-</dict>
-</plist>
-
-```
+- `App Group ID`: The identifier of the detected App Group.
+  **Expected**: not `Unknown`.
+- `App Group Accessible`: Indicates if LiveContainer can read/write to the shared container path.
+  **Expected**: `Yes`.
+- `Store`: The detected installation source (`AltStore`, `SideStore`, `ADP`, or `Unknown`).
+  **Expected**: matches your real install source and is normally not `Unknown`.
+
+If the App Group is inaccessible, resolve this issue before checking certificate details.
+
+## Entitlement File
+
+Tap `Entitlement File` to inspect the parsing results of the main executable's entitlements.
+
+This view verifies:
+
+- `Bundle Identifier`: Compares app bundle identifier with value derived from `application-identifier`.  
+  **Expected**: marked correct.
+- `Team ID`: Value from `com.apple.developer.team-identifier`.  
+  **Expected**: valid Team ID, not `Unknown`.
+- `get-task-allow`: Whether debug entitlement exists.  
+  **Expected**: `Yes`.
+- `com.apple.security.application-groups Correct`: Checks whether app-groups list is non-empty.  
+  **Expected**: `Yes`.
+- `keychain-access-groups Correct`: Checks whether LiveContainer keychain groups (`.shared` and indexed groups) are complete.  
+  **Expected**: `Yes`.
 
 The most important part is `com.apple.security.application-groups`, which determines whether LiveContainer can access SideStore's app group.
 This item should exist and its content should look like `group.com.rileytestut.AltStore.A1B2C3D4E5` and `group.com.SideStore.SideStore.A1B2C3D4E5`. If this item is missing or it looks like `group.com.SideStore.SideStore.A1B2C3D4E5.A1B2C3D4E5`, then this is an bug of SideStore, not LiveContainer. The only thing you can do is to remove both LiveContainer and SideStore, and then install them again and check if this issue is solved.
 
 It is reported that if LiveContainer's entitlement is incorrect, you can't activate/deactivate apps in SideStore. **Please do not submit issues about incorrect entitlement as it is not a LiveContainer issue.**
 
-## Patch Detected
+## Certificate details
+
+This section displays the status of the signing certificate used for JIT-less mode.
 
-:::note
-Make sure App Group ID, App Group Accessible and Store are correct before proceeding.
-:::
+- `Certificate Last Up Date`: The timestamp of the last certificate refresh/import.  
+  **Expected**: a real timestamp, not `Unknown`.
+- `Certificate Team ID`: The Team ID extracted from the certificate.  
+  **Expected**: Your Apple Developer Team ID, not `Unknown`.
+- `Expected Team ID`: Team ID read from LiveContainer entitlement, used for mismatch detection.  
+  This row appears only when mismatch is detected.
+- `Certificate Status`: `Valid`, `Revoked`, or `Unknown`.  
+  **Expected**: `Valid`.
+- `Certificate Validate Until`: The expiration date of the certificate.  
+  **Expected**: a real timestamp while certificate is valid.
+- `Certificate Data Found`: whether imported certificate data exists.
+  **Expected**: `Yes`.
+- `Certificate Password Found`: whether imported certificate password exists.
+  **Expected**: `Yes` in normal certificate export/import flows.
 
-It should say "Yes". If not, close your store from the app switcher, reopen it and refresh this diagnose page.
-If still not, patch your store again.
+## Test JIT-Less Mode
 
-## Certificate Data / Password Found, Certificate Last Up Date
+The `Test JIT-Less Mode` button performs a functional validation rather than a static check.
 
-:::note
-Make sure 1 & 2 are correct before proceeding.
-:::
+When tapped, LiveContainer will:
+1. Create a temporary test app bundle.
+2. Sign it using the current certificate and password.
+3. Verify code-sign validity of the signed test dylib (`TestJITLess.dylib`).
 
-If you patched your store correctly, Certificate Data / Password Found should turn to "Yes" if you refresh the diagnose page, and "Certificate Last Up Date" should show the time when you last opens your store.
+The button requires `Certificate Data Found = Yes` to start. If password/config is still invalid, signing fails in this step.
 
-If Certificate Data / Password Found are "Yes", but "Certificate Last Up Date" is unknown, but apps are working correctly, you might have just updated from version prior to 3.1.51, patch your store again and this field should display correctly.
+If this test fails, JIT-less launch will likely fail.

docs/guides/jit-support.md

@@ -19,7 +19,7 @@ Use this order to avoid false failures:
 
 ## Enable JIT for an app
 
-1. Long-press app -> `Settings` -> enable `Launch with JIT`.
+1. Hold app -> `Settings` -> enable `Launch with JIT`.
 2. Configure one enabler below.
 3. Launch app. LiveContainer enters a waiting state until JIT is attached.
 4. If your enabler is manual, trigger JIT while waiting prompt is still open.