@allbluecn/web-app 0.19.2 → 0.19.4

package/src/components/tiptap/lib/doc-group.ts

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { m } from "@/paraglide/messages.js"
+
+/**
+ * 文档引用（mention / docCard）的 docGroup 公共解析。
+ *
+ * 历史包袱：节点 attrs.docGroup 持久化的是【当前 locale 的 i18n 标签】
+ * （reference-dropdown-menu 直接写入 documentSuggestion.search 返回的 group 字段），
+ * 非稳定 id。跨 locale 文档会失配——这是数据层遗留，修复需迁移存储格式（待决策）。
+ * 本模块收敛「标签 → 稳定标识」的唯一映射，图标与路由两处消费，禁止再各自内联。
+ */
+
+export type DocGroupIconKey =
+  | "scale"
+  | "shield-check"
+  | "book-marked"
+  | "bookmark"
+
+/** docGroup（i18n 标签）→ 稳定图标 key；无匹配返回 null（由调用方回落 type 图标）。 */
+export function docGroupIconKey(docGroup: string): DocGroupIconKey | null {
+  const map: Record<string, DocGroupIconKey> = {
+    [m["editor_laws-regulations"]()]: "scale",
+    [m["editor_industry-compliance"]()]: "shield-check",
+    [m["editor_dictionary-entry"]()]: "book-marked",
+    [m["editor_website-bookmark"]()]: "bookmark",
+  }
+  return map[docGroup] ?? null
+}
+
+/** docGroup（i18n 标签）→ knowledge 路由段（与 src/routes/_nav/knowledge/* 实际目录一致）。 */
+export function docGroupRouteSegment(docGroup: string): string | null {
+  const map: Record<string, string> = {
+    [m["editor_laws-regulations"]()]: "laws",
+    [m["editor_industry-compliance"]()]: "compliance",
+    [m["editor_dictionary-entry"]()]: "dictionaries",
+    [m["editor_website-bookmark"]()]: "bookmarks",
+  }
+  return map[docGroup] ?? null
+}
+
+/** 新标签页打开文档引用；未识别分组回落通用文档页（沿用既有行为）。 */
+export function openDocRefInNewTab(id: string, docGroup: string): void {
+  const segment = docGroup ? docGroupRouteSegment(docGroup) : null
+  const url = segment ? `/knowledge/${segment}/${id}` : `/knowledge/doc/${id}`
+  window.open(url, "_blank", "noopener,noreferrer")
+}

package/src/components/tiptap/lib/utils/platform.ts

@@ -17,21 +17,22 @@
 
 import { MAC_SYMBOLS } from "./constants"
 
-export function cn(
-  ...classes: (string | boolean | undefined | null)[]
-): string {
-  return classes.filter(Boolean).join(" ")
-}
+// 审计 🔵：本文件此前的 filter/join 版 cn 与全局 @/lib/utils（clsx + tailwind-merge）
+// 双轨并存，冲突类取舍不一致。统一收敛到全局实现，保持既有导出路径不变。
+export { cn } from "@/lib/utils"
 
 /**
  * Determines if the current platform is macOS
  * @returns boolean indicating if the current platform is Mac
  */
 export function isMac(): boolean {
-  return (
-    typeof navigator !== "undefined" &&
-    navigator.platform.toLowerCase().includes("mac")
-  )
+  if (typeof navigator === "undefined") return false
+  // navigator.platform 已废弃；优先 userAgentData.platform（结构化探测，不引 any）
+  const uaPlatform = (
+    navigator as Navigator & { userAgentData?: { platform?: string } }
+  ).userAgentData?.platform
+  const platform = (uaPlatform ?? navigator.platform) || ""
+  return platform.toLowerCase().includes("mac")
 }
 
 /**

package/src/components/tiptap/lib/utils/selection.ts

@@ -114,7 +114,7 @@ export function selectCurrentBlockContent(editor: Editor) {
   if (!selection.empty) return
 
   const $pos = selection.$from
-  let blockNode = null
+  let blockNode: PMNode | null = null
   let blockPos = -1
 
   for (let depth = $pos.depth; depth >= 0; depth--) {
@@ -122,7 +122,7 @@ export function selectCurrentBlockContent(editor: Editor) {
     const pos = $pos.start(depth)
 
     if (node.isBlock && node.textContent.trim()) {
-      blockNode = node as any
+      blockNode = node
       blockPos = pos
       break
     }
@@ -130,7 +130,7 @@ export function selectCurrentBlockContent(editor: Editor) {
 
   if (blockNode && blockPos >= 0) {
     const from = blockPos
-    const to = blockPos + (blockNode as any).nodeSize - 2
+    const to = blockPos + blockNode.nodeSize - 2
 
     if (from < to) {
       const $from = doc.resolve(from)

package/src/components/tiptap/lib/utils/url.ts

@@ -18,18 +18,19 @@
 import { MAX_FILE_SIZE } from "./constants"
 
 /**
- * Handles image upload with progress tracking and abort capability
+ * 图片上传：读为 data URL 返回（与项目约定一致：图片走 dataURL 不落 Blob 表）。
+ * 审计 🟠 修复：原实现是演示假代码（setTimeout 模拟进度 + 恒返回占位图路径），
+ * 用户上传任何图片都会「假成功」插入一张 404 占位图。
  * @param file The file to upload
  * @param onProgress Optional callback for tracking upload progress
  * @param abortSignal Optional AbortSignal for cancelling the upload
- * @returns Promise resolving to the URL of the uploaded image
+ * @returns Promise resolving to the data URL of the uploaded image
  */
 export const handleImageUpload = async (
   file: File,
   onProgress?: (event: { progress: number }) => void,
   abortSignal?: AbortSignal
 ): Promise<string> => {
-  // Validate file
   if (!file) {
     throw new Error("No file provided")
   }
@@ -40,17 +41,30 @@ export const handleImageUpload = async (
     )
   }
 
-  // For demo/testing: Simulate upload progress. In production, replace the following code
-  // with your own upload implementation.
-  for (let progress = 0; progress <= 100; progress += 10) {
-    if (abortSignal?.aborted) {
-      throw new Error("Upload cancelled")
+  if (abortSignal?.aborted) {
+    throw new Error("Upload cancelled")
+  }
+
+  onProgress?.({ progress: 10 })
+
+  const dataUrl = await new Promise<string>((resolve, reject) => {
+    const reader = new FileReader()
+    reader.onload = () => {
+      if (typeof reader.result === "string") resolve(reader.result)
+      else reject(new Error("Failed to read file"))
     }
-    await new Promise((resolve) => setTimeout(resolve, 500))
-    onProgress?.({ progress })
+    reader.onerror = () => reject(new Error("Failed to read file"))
+    reader.onabort = () => reject(new Error("Upload cancelled"))
+    abortSignal?.addEventListener("abort", () => reader.abort(), { once: true })
+    reader.readAsDataURL(file)
+  })
+
+  if (abortSignal?.aborted) {
+    throw new Error("Upload cancelled")
   }
 
-  return "/images/tiptap-ui-placeholder-image.jpg"
+  onProgress?.({ progress: 100 })
+  return dataUrl
 }
 
 type ProtocolOptions = {

package/src/components/tiptap/mindmap/lib/menu-actions.ts

@@ -112,8 +112,16 @@ export function startArrowMode(mind: MindElixir, options: ArrowModeOptions): voi
   tip.className = "tips"
   tip.textContent = options.clickTargetLabel
   mind.container.appendChild(tip)
-  const handleClick = (event: MouseEvent) => {
+  // 兜底清理：任意点击（含画布外）消费掉监听并移除提示；Esc 主动取消；
+  // 编辑器卸载（容器脱离文档）时下一次交互自愈，不再残留 document 级监听与 tips div
+  const cleanup = () => {
+    document.removeEventListener("click", handleClick)
+    document.removeEventListener("keydown", handleKeydown)
     tip.remove()
+  }
+  const handleClick = (event: MouseEvent) => {
+    cleanup()
+    if (!mind.container?.isConnected) return
     const target = event.target
     const clicked =
       target instanceof HTMLElement
@@ -128,7 +136,11 @@ export function startArrowMode(mind: MindElixir, options: ArrowModeOptions): voi
       bidirectional: options.bidirectional,
     })
   }
-  mind.map.addEventListener("click", handleClick, { once: true })
+  const handleKeydown = (event: KeyboardEvent) => {
+    if (event.key === "Escape") cleanup()
+  }
+  document.addEventListener("click", handleClick, { once: true })
+  document.addEventListener("keydown", handleKeydown)
 }
 
 export interface MenuActionOptions {

package/src/components/tiptap/mindmap/mind-map.tsx

@@ -288,7 +288,16 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
     void mindRef.current?.beginEdit()
   }, { target: containerRef, enabled: shortcutContext === "selected" })
 
-  useImperativeHandle(ref, () => ({ instance: mindRef.current }), [])
+  useImperativeHandle(
+    ref,
+    () => ({
+      // getter 而非快照：实例在异步 IIFE 中稍后才创建，求值一次的快照恒为 null
+      get instance() {
+        return mindRef.current
+      },
+    }),
+    []
+  )
 
   const resolvedThemeRef = useRef(resolvedTheme)
   useEffect(() => {
@@ -309,8 +318,17 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
     onSelectNodesRef.current = onSelectNodes
   }, [onChange, onOperation, onSelectNodes])
 
-  const isInternalChangeRef = useRef(false)
-  const initialDataRef = useRef(data)
+  // 内部变更回显判定：记录最后一次 onChange 发出的数据引用，[data] effect 里
+  // 与 prop data 比对——引用相同即内部回显，跳过 refresh。替代旧的一次性
+  // isInternalChangeRef 标志：非受控用法（onChange 后不回传）下旧标志滞留 true
+  // 会误吞下一次外部更新，引用比对无此竞态。
+  const lastEmittedDataRef = useRef<MindElixirData | null>(null)
+  // 始终指向最新 data prop：实例重建（如 readonly 切换触发）时用当前内容 init，
+  // 而非首次挂载快照（旧 initialDataRef 会让重建后的导图回退到旧内容）
+  const latestDataRef = useRef(data)
+  useEffect(() => {
+    latestDataRef.current = data
+  }, [data])
   const initialBranchStyleRef = useRef(branchStyle)
 
   const applyLayout = useCallback((mind: MindElixirInstance, next: MindMapLayout) => {
@@ -326,7 +344,7 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
       setLayout(next)
       const updated = { ...withBranchStyle(mind.getData(), next.style), direction: next.direction }
       if (onChangeRef.current) {
-        isInternalChangeRef.current = true
+        lastEmittedDataRef.current = updated
         onChangeRef.current(updated, { action: "layoutChange" })
       }
     },
@@ -355,7 +373,8 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
     if (!containerRef.current || mindRef.current) return
     let isSubscribed = true
     let mind: MindElixirInstance | null = null
-    const initialData = initialDataRef.current || MindElixir.new(m.mindmap_defaultTopic())
+    // 重建场景（readonly 等 prop 变化触发 effect 重跑）用最新 data 初始化，避免内容回退
+    const initialData = latestDataRef.current || MindElixir.new(m.mindmap_defaultTopic())
     const initialStyle = initialBranchStyleRef.current
 
     void (async () => {
@@ -433,7 +452,7 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
         }
         if (onOperationRef.current) onOperationRef.current(operation)
         if (onChangeRef.current) {
-          isInternalChangeRef.current = true
+          lastEmittedDataRef.current = instance.getData()
           onChangeRef.current(instance.getData(), operation)
         }
       })
@@ -458,7 +477,22 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
 
     return () => {
       isSubscribed = false
+      // 销毁旧实例：mind-elixir destroy 会移除挂在 selectionContainer（document.body）
+      // 上的 viselect 框选裁剪层、解绑 bus/键盘监听并清空容器 DOM。
+      // 不销毁则每次 prop 触发重建都泄漏一个实例 + 一层 body 级 DOM。
+      if (mind) {
+        try {
+          mind.destroy()
+        } catch (error) {
+          console.error(
+            m.mindmap_errors_initFailed(),
+            error instanceof Error ? error.message : "unknown",
+          )
+        }
+      }
       mindRef.current = null
+      setMindInstance(null)
+      setIsLoaded(false)
     }
   }, [
     contextMenu,
@@ -474,10 +508,8 @@ export const MindMap = forwardRef<MindMapRef, MindMapProps>(function MindMap(
   useEffect(() => {
     const mind = mindRef.current
     if (!mind || !data || !isLoaded) return
-    if (isInternalChangeRef.current) {
-      isInternalChangeRef.current = false
-      return
-    }
+    // prop data 是内部 onChange 回显（同一引用）时不 refresh；真正外部更新（引用不同）照常刷新
+    if (lastEmittedDataRef.current === data) return
     mind.refresh(data)
     const next = layoutOfData(data)
     if (!isSameLayout(next, layoutRef.current)) {

package/src/components/tiptap/node/doc-card-node-view.tsx

@@ -26,11 +26,13 @@ import {
   ShieldCheck,
   BookMarked,
   Bookmark,
+  Trash2,
 } from "lucide-react"
 import { NotionAvatar } from "@/components/shared-kit/avatars/notion-avatar"
 import { toAvatarShape } from "@/components/shared-kit/avatars/avatar-shape"
 
 import { formatDate } from "../lib/datetime.ts"
+import { docGroupIconKey } from "../lib/doc-group.ts"
 import { useTimezone } from "@/components/shared-kit/timezone/timezone-provider"
 import { useEditorServices, type DocumentPreviewData } from "../notion-like/index.ts"
 import { m } from "@/paraglide/messages.js";
@@ -42,17 +44,19 @@ const TYPE_ICONS: Record<string, typeof FileText> = {
   table: Grid3X3,
 }
 
+// docGroup → 图标经 lib/doc-group.ts 的稳定 key 解析，禁止以 i18n 译文作查找键
+// （译文随 locale 变化，跨语言文档会静默失配退化为类型图标）
 const GROUP_ICONS: Record<string, typeof FileText> = {
-  [m['editor_laws-regulations']()]: Scale,
-  [m['editor_industry-compliance']()]: ShieldCheck,
-  [m['editor_dictionary-entry']()]: BookMarked,
-  [m['editor_website-bookmark']()]: Bookmark,
+  scale: Scale,
+  "shield-check": ShieldCheck,
+  "book-marked": BookMarked,
+  bookmark: Bookmark,
 }
 
 const MIN_HEIGHT = 200
 export const DEFAULT_HEIGHT = 300
 
-export function DocCardNodeView({ node, deleteNode, selected }: NodeViewProps) {
+export function DocCardNodeView({ node, deleteNode, selected, updateAttributes }: NodeViewProps) {
   const attrs = node.attrs as {
     id: string
     label: string
@@ -74,21 +78,26 @@ export function DocCardNodeView({ node, deleteNode, selected }: NodeViewProps) {
 
   useEffect(() => {
     let cancelled = false
-    const setLoad = setLoading as (v: boolean) => void
-    setLoad(true)
+    setLoading(true)
     const promise = documentSuggestion?.getPreview?.(attrs.id, attrs.docGroup) as Promise<DocumentPreviewData | null> | undefined
-    promise?.then((res) => {
+    if (!promise) {
+      // services 异步注入（首帧可能为空）：无 promise 不能把 loading 钉死，
+      // 置 false 走「未找到」占位；documentSuggestion 就绪后本 effect 会重跑
+      setLoading(false)
+      return
+    }
+    promise.then((res) => {
       if (!cancelled) {
         setData(res)
-        setLoad(false)
+        setLoading(false)
       }
     }).catch(() => {
-      if (!cancelled) setLoad(false)
+      if (!cancelled) setLoading(false)
     })
     return () => {
       cancelled = true
     }
-  }, [attrs.id, attrs.docGroup])
+  }, [attrs.id, attrs.docGroup, documentSuggestion])
 
   const onMouseDown = useCallback(
     (e: React.MouseEvent) => {
@@ -101,6 +110,12 @@ export function DocCardNodeView({ node, deleteNode, selected }: NodeViewProps) {
     [height],
   )
 
+  // 拖拽结束时的高度引用
+  const heightRef = useRef(height)
+  useEffect(() => {
+    heightRef.current = height
+  }, [height])
+
   useEffect(() => {
     if (!dragging) return
     const onMove = (e: MouseEvent) => {
@@ -108,17 +123,22 @@ export function DocCardNodeView({ node, deleteNode, selected }: NodeViewProps) {
       const newH = Math.max(MIN_HEIGHT, startHRef.current + delta)
       setHeight(newH)
     }
-    const onUp = () => setDragging(false)
+    const onUp = () => {
+      setDragging(false)
+      // 审计 🟡：高度此前只存本地 state，刷新/协作同步后回退默认值——
+      // mouseup 时回写节点 attrs 持久化
+      updateAttributes({ cardHeight: heightRef.current })
+    }
     window.addEventListener("mousemove", onMove)
     window.addEventListener("mouseup", onUp)
     return () => {
       window.removeEventListener("mousemove", onMove)
       window.removeEventListener("mouseup", onUp)
     }
-  }, [dragging])
+  }, [dragging, updateAttributes])
 
   const DocIcon = data
-    ? GROUP_ICONS[data.type === "doc" && attrs.docGroup ? attrs.docGroup : ""] ??
+    ? GROUP_ICONS[docGroupIconKey(attrs.docGroup) ?? ""] ??
       TYPE_ICONS[data.type] ??
       FileText
     : FileText
@@ -152,7 +172,7 @@ export function DocCardNodeView({ node, deleteNode, selected }: NodeViewProps) {
               deleteNode()
             }}
           >
-            <FileText className="size-3.5" />
+            <Trash2 className="size-3.5" />
           </button>
         </div>
 

package/src/components/tiptap/node/image-node/image-node-extension.ts

@@ -31,18 +31,37 @@ interface ImageAttributes {
   "data-align"?: string | null
 }
 
-const parseImageAttributes = (img: Element): Partial<ImageAttributes> => ({
-  src: img.getAttribute("src"),
-  alt: img.getAttribute("alt"),
-  title: img.getAttribute("title"),
-  width: img.getAttribute("width"),
-  height: img.getAttribute("height"),
-})
+/**
+ * src 协议白名单（与 collab-core 服务端镜像 `knowledge-schema.ts` 的
+ * isSafeKnowledgeImageSrc 同口径）：放行 http(s) / 协议相对 // / 站内相对
+ * （不含「:」）/ data:image/（内联图与 emoji fallback）/ blob:；
+ * 拒绝 javascript: vbscript: 及 data: 非 image（fail-closed：非法 src 归 null）。
+ */
+function isSafeImageSrc(src: string | null): src is string {
+  if (!src) return false
+  if (src.startsWith("data:image/")) return true
+  if (src.startsWith("blob:")) return true
+  if (/^https?:\/\//i.test(src)) return true
+  if (src.startsWith("//")) return true
+  return !src.includes(":")
+}
+
+const parseImageAttributes = (img: Element): Partial<ImageAttributes> => {
+  const rawSrc = img.getAttribute("src")
+  return {
+    src: isSafeImageSrc(rawSrc) ? rawSrc : null,
+    alt: img.getAttribute("alt"),
+    title: img.getAttribute("title"),
+    width: img.getAttribute("width"),
+    height: img.getAttribute("height"),
+  }
+}
 
 function buildImageHTMLAttributes(
   attrs: ImageAttributes
 ): Record<string, string> {
-  const result: Record<string, string> = { src: attrs.src || "" }
+  const safeSrc = isSafeImageSrc(attrs.src) ? attrs.src : ""
+  const result: Record<string, string> = { src: safeSrc }
 
   if (attrs.alt) result.alt = attrs.alt
   if (attrs.title) result.title = attrs.title

package/src/components/tiptap/node/image-node/image-node-view.tsx

@@ -22,6 +22,8 @@ import { NodeSelection } from "@tiptap/pm/state"
 
 import { isValidPosition } from "../../lib/utils.ts"
 
+import { m } from "@/paraglide/messages.js"
+
 import "./image-node-view.scss"
 
 export interface ResizeParams {
@@ -282,7 +284,10 @@ export const ResizableImage: React.FC<ResizableImageProps> = ({
     if (editor?.isEditable && isMountedRef.current) setShowHandles(true)
   }
 
+  // 审计 ⚪：仅在拖拽进行期间挂 window 监听（此前每张图片常驻 4 个 window 级监听，
+  // N 张图 = 4N 个空跑回调），startResize 置 resizeParams 后生效
   useEffect(() => {
+    if (!resizeParams) return
     window.addEventListener("mousemove", windowMouseMoveHandler)
     window.addEventListener("mouseup", windowMouseUpHandler)
     window.addEventListener("touchmove", windowMouseMoveHandler, {
@@ -296,7 +301,7 @@ export const ResizableImage: React.FC<ResizableImageProps> = ({
       window.removeEventListener("touchmove", windowMouseMoveHandler)
       window.removeEventListener("touchend", windowMouseUpHandler)
     }
-  }, [windowMouseMoveHandler, windowMouseUpHandler])
+  }, [windowMouseMoveHandler, windowMouseUpHandler, resizeParams])
 
   useEffect(() => {
     return () => {
@@ -354,7 +359,7 @@ export const ResizableImage: React.FC<ResizableImageProps> = ({
           <NodeViewContent
             as="div"
             className="tiptap-image-caption"
-            data-placeholder="Add a caption..."
+            data-placeholder={m.editor_add_caption_placeholder()}
           />
         )}
       </div>

package/src/components/tiptap/node/image-upload-node/image-upload-node.tsx

@@ -22,6 +22,7 @@ import { Button } from "../../ui-primitive/button/index.tsx"
 import { CloseIcon } from "../../icons/close-icon.tsx"
 import "./image-upload-node.scss"
 import { focusNextNode, isValidPosition } from "../../lib/utils.ts"
+import { m } from "@/paraglide/messages.js"
 
 export interface FileItem {
   /**
@@ -171,7 +172,10 @@ function useFileUpload(options: UploadOptions) {
     }
   }
 
-  const uploadFiles = async (files: File[]): Promise<string[]> => {
+  /** 上传结果与来源文件保持对位（审计 🟡：原先只返回 url[]，部分失败时 alt/title 配错文件） */
+  const uploadFiles = async (
+    files: File[]
+  ): Promise<Array<{ url: string; name: string }>> => {
     if (!files || files.length === 0) {
       options.onError?.(new Error("No files to upload"))
       return []
@@ -187,11 +191,14 @@ function useFileUpload(options: UploadOptions) {
     }
 
     // Upload all files concurrently
-    const uploadPromises = files.map((file) => uploadFile(file))
+    const uploadPromises = files.map(async (file) => {
+      const url = await uploadFile(file)
+      return url ? { url, name: file.name } : null
+    })
     const results = await Promise.all(uploadPromises)
 
     // Filter out null results (failed uploads)
-    return results.filter((url): url is string => url !== null)
+    return results.filter((item): item is { url: string; name: string } => item !== null)
   }
 
   const removeFileItem = (fileId: string) => {
@@ -200,9 +207,7 @@ function useFileUpload(options: UploadOptions) {
       if (fileToRemove?.abortController) {
         fileToRemove.abortController.abort()
       }
-      if (fileToRemove?.url) {
-        URL.revokeObjectURL(fileToRemove.url)
-      }
+      // url 是上传返回的远程/data 地址，从未 createObjectURL，无需（也不能）revoke
       return prev.filter((item) => item.id !== fileId)
     })
   }
@@ -212,9 +217,6 @@ function useFileUpload(options: UploadOptions) {
       if (item.abortController) {
         item.abortController.abort()
       }
-      if (item.url) {
-        URL.revokeObjectURL(item.url)
-      }
     })
     setFileItems([])
   }
@@ -438,11 +440,13 @@ const DropZoneContent: React.FC<{ maxSize: number; limit: number }> = ({
 
     <div className="tiptap-image-upload-content">
       <span className="tiptap-image-upload-text">
-        <em>Click to upload</em> or drag and drop
+        <em>{m.editor_upload_click()}</em> {m.editor_upload_or_drag()}
       </span>
       <span className="tiptap-image-upload-subtext">
-        Maximum {limit} file{limit === 1 ? "" : "s"}, {maxSize / 1024 / 1024}MB
-        each.
+        {m.editor_upload_limit_hint({
+          limit,
+          maxSize: maxSize / 1024 / 1024,
+        })}
       </span>
     </div>
   </>
@@ -466,19 +470,20 @@ export const ImageUploadNode: React.FC<NodeViewProps> = (props) => {
     useFileUpload(uploadOptions)
 
   const handleUpload = async (files: File[]) => {
-    const urls = await uploadFiles(files)
+    const uploaded = await uploadFiles(files)
 
-    if (urls.length > 0) {
+    if (uploaded.length > 0) {
       const pos = props.getPos()
 
       if (isValidPosition(pos)) {
-        const imageNodes = urls.map((url, index) => {
-          const filename =
-            files[index]?.name.replace(/\.[^/.]+$/, "") || "unknown"
+        // 上传结果自带来源文件名（对位），失败项不会让 alt/title 错配
+        const imageNodes = uploaded.map(({ url, name }) => {
+          const filename = name.replace(/\.[^/.]+$/, "") || "unknown"
           return {
             type: extension.options.type,
+            // 审计 🟡：只挑拣图片节点字段，禁止把 extension.options 整包
+            // （含 upload/onSuccess/onError 函数）展开进文档节点 attrs
             attrs: {
-              ...extension.options,
               src: url,
               alt: filename,
               title: filename,
@@ -532,7 +537,7 @@ export const ImageUploadNode: React.FC<NodeViewProps> = (props) => {
         <div className="tiptap-image-upload-previews">
           {fileItems.length > 1 && (
             <div className="tiptap-image-upload-header">
-              <span>Uploading {fileItems.length} files</span>
+              <span>{m.editor_uploading_files({ count: fileItems.length })}</span>
               <Button
                 type="button"
                 variant="ghost"
@@ -541,7 +546,7 @@ export const ImageUploadNode: React.FC<NodeViewProps> = (props) => {
                   clearAllFiles()
                 }}
               >
-                Clear All
+                {m.editor_clear_all()}
               </Button>
             </div>
           )}