@co0ontty/wand 4.93.0 → 4.94.0

package/dist/tui/index.js

@@ -110,9 +110,9 @@ export function startTui(deps) {
         layout,
         updateConfirmBody: ({ current, latest, channelLabel }) => `通道 ${channelLabel}：当前 ${current} → 最新 ${latest}，是否立即升级？`,
         installServiceBody: (isRoot) => process.platform === "linux"
-            ? `将写入 /etc/systemd/system/wand.service，systemctl enable --now，开机自启。\n${isRoot ? "当前是 root，可以直接装。" : "⚠ 需要 root,请退出 TUI 后直接跑 sudo wand service:install。"}\n不想要 root？退出 TUI 跑 wand service:install --user (登出会被回收)。`
+            ? `将写入 /etc/systemd/system/wand.service，systemctl enable --now，开机自启。\n${isRoot ? "当前是 root，可以直接装。" : "需要管理员权限，将自动申请 sudo，请在终端输入密码。"}\n不想要 root？退出 TUI 跑 wand service:install --user (登出会被回收)。`
             : process.platform === "darwin"
-                ? `将写入 /Library/LaunchDaemons/com.wand.web.plist，launchctl load，开机自启。\n${isRoot ? "当前是 root,可以直接装。" : "⚠ 需要 root,请退出 TUI 后直接跑 sudo wand service:install。"}`
+                ? `将写入 /Library/LaunchDaemons/com.wand.web.plist，launchctl load，开机自启。\n${isRoot ? "当前是 root,可以直接装。" : "需要管理员权限，将自动申请 sudo，请在终端输入密码。"}`
                 : "当前平台暂不支持。",
         onServiceChanged: refreshAll,
     });

package/dist/tui/service-actions.js

@@ -5,9 +5,10 @@
  *   - 升级确认弹窗文案（attach 模式要提醒按 R 重启服务）
  *   - 注册系统服务的说明正文（attach 模式没有本地会话列表，装卸后不刷新界面）
  */
-import { checkUpdate, installService, installUpdate, isServiceInstalled, readUpdateChannel, uninstallService, } from "./commands.js";
+import { checkUpdate, installUpdate, isServiceInstalled, readUpdateChannel, } from "./commands.js";
 import { repairServiceUnitAfterUpdate } from "../service-self-repair.js";
 import { runOffMicrotask } from "./runtime-utils.js";
+import { runTuiServiceCommand } from "./service-command.js";
 export function createServiceActions(options) {
     const { layout } = options;
     async function handleUpdate() {
@@ -51,7 +52,7 @@ export function createServiceActions(options) {
             layout.showToast("服务已安装，按 Shift+S 卸载", "warn", 2500);
             return;
         }
-        // 默认装 system-wide。非 root 时 installService 会返回明确错误,toast 自然展示。
+        // 默认装 system-wide；确认后让独立 CLI 自动申请 sudo。
         const isRoot = typeof process.getuid === "function" ? process.getuid() === 0 : false;
         const ok = await layout.confirm({
             title: "注册为系统服务",
@@ -59,7 +60,7 @@ export function createServiceActions(options) {
         });
         if (!ok)
             return;
-        const r = await runOffMicrotask(() => installService({ configPath: options.configPath }));
+        const r = await runTuiServiceCommand(layout, "service:install", options.configPath);
         layout.showToast(r.message, r.ok ? "success" : "error", 5000);
         if (r.detail)
             layout.showDetail(r.ok ? "服务安装详情" : "服务安装失败", r.detail);
@@ -76,7 +77,7 @@ export function createServiceActions(options) {
         });
         if (!ok)
             return;
-        const r = await runOffMicrotask(() => uninstallService());
+        const r = await runTuiServiceCommand(layout, "service:uninstall", options.configPath);
         layout.showToast(r.message, r.ok ? "success" : "error", 4000);
         if (r.detail)
             layout.showDetail(r.ok ? "服务卸载详情" : "服务卸载失败", r.detail);

package/dist/tui/service-command.d.ts

@@ -0,0 +1,6 @@
+import type { CommandResult } from "./commands.js";
+import type { LayoutHandle } from "./layout.js";
+/** Give sudo the real terminal, never route password keystrokes through TUI.
+ * Run a separate CLI asynchronously so an embedded server can still drain Core.
+ */
+export declare function runTuiServiceCommand(layout: LayoutHandle, command: string, configPath: string): Promise<CommandResult>;

package/dist/tui/service-command.js

@@ -0,0 +1,40 @@
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { runCommandInteractive } from "../run-command.js";
+import { getErrorMessage } from "../error-utils.js";
+const activeActions = new WeakSet();
+/** Give sudo the real terminal, never route password keystrokes through TUI.
+ * Run a separate CLI asynchronously so an embedded server can still drain Core.
+ */
+export async function runTuiServiceCommand(layout, command, configPath) {
+    if (activeActions.has(layout))
+        return { ok: false, message: "服务操作正在进行，请等待完成。" };
+    activeActions.add(layout);
+    let resume;
+    // Ctrl+C in cooked mode reaches the foreground process group, including
+    // sudo. Keep blessed from exiting the parent TUI while the child cancels.
+    const onInterrupt = () => { };
+    process.on("SIGINT", onInterrupt);
+    try {
+        resume = layout.screen.program.pause();
+        const compiled = fileURLToPath(new URL("../cli.js", import.meta.url));
+        const cli = existsSync(compiled) ? compiled : fileURLToPath(new URL("../cli.ts", import.meta.url));
+        const code = await runCommandInteractive(process.execPath, [
+            ...process.execArgv, cli, command, "-c", configPath, "--verbose",
+        ]);
+        return { ok: code === 0, message: code === 0 ? `${command} 已完成` : `${command} 未完成 (exit ${code})` };
+    }
+    catch (error) {
+        return { ok: false, message: "服务操作失败", detail: getErrorMessage(error) };
+    }
+    finally {
+        process.off("SIGINT", onInterrupt);
+        try {
+            resume?.();
+        }
+        finally {
+            activeActions.delete(layout);
+            layout.screen.render();
+        }
+    }
+}

package/dist/tui/service-panel.js

@@ -11,7 +11,8 @@
  *   l — 查看最近日志
  *   Esc / q — 关闭面板
  */
-import { installService, isServiceInstalled, serviceLogs, serviceRestart, serviceStart, serviceStatusAsync, serviceStop, uninstallService, } from "./commands.js";
+import { isServiceInstalled, serviceLogs, serviceStatusAsync, } from "./commands.js";
+import { runTuiServiceCommand } from "./service-command.js";
 const panelOpenings = new WeakMap();
 export function openServicePanel(deps) {
     const { layout, configPath } = deps;
@@ -49,8 +50,8 @@ export function openServicePanel(deps) {
         setLastAction(`${label}: ${result.message}`);
     }
     layout.openServicePanel({
-        onStart: () => {
-            handleResult("start", serviceStart());
+        onStart: async () => {
+            handleResult("start", await runTuiServiceCommand(layout, "service:start", configPath));
         },
         onStop: async () => {
             const ok = await layout.confirm({
@@ -59,7 +60,7 @@ export function openServicePanel(deps) {
             });
             if (!ok)
                 return;
-            handleResult("stop", serviceStop());
+            handleResult("stop", await runTuiServiceCommand(layout, "service:stop", configPath));
         },
         onRestart: async () => {
             const ok = await layout.confirm({
@@ -68,7 +69,7 @@ export function openServicePanel(deps) {
             });
             if (!ok)
                 return;
-            handleResult("restart", serviceRestart());
+            handleResult("restart", await runTuiServiceCommand(layout, "service:restart", configPath));
         },
         onInstall: async () => {
             if (isServiceInstalled()) {
@@ -76,11 +77,11 @@ export function openServicePanel(deps) {
                 return;
             }
             const isRoot = typeof process.getuid === "function" ? process.getuid() === 0 : false;
-            const body = `默认装 system-wide(/etc/systemd/system/ 或 /Library/LaunchDaemons/),开机自启、登出不停。${isRoot ? "" : "\n⚠ 需要 root,如果失败请退出 TUI 跑 sudo wand service:install。"}`;
+            const body = `默认装 system-wide(/etc/systemd/system/ 或 /Library/LaunchDaemons/),开机自启、登出不停。${isRoot ? "" : "\n需要管理员权限，将自动申请 sudo，请在终端输入密码。"}`;
             const ok = await layout.confirm({ title: "注册服务", body });
             if (!ok)
                 return;
-            handleResult("install", installService({ configPath }));
+            handleResult("install", await runTuiServiceCommand(layout, "service:install", configPath));
         },
         onUninstall: async () => {
             if (!isServiceInstalled()) {
@@ -93,7 +94,7 @@ export function openServicePanel(deps) {
             });
             if (!ok)
                 return;
-            handleResult("uninstall", uninstallService());
+            handleResult("uninstall", await runTuiServiceCommand(layout, "service:uninstall", configPath));
         },
         onLogs: () => {
             const r = serviceLogs(80);

package/dist/types.d.ts

@@ -3,7 +3,7 @@ export type SessionKind = "pty" | "structured";
 export type { SessionProvider } from "./provider-catalog.js";
 import type { SessionProvider } from "./provider-catalog.js";
 /** "claude-sdk" 是历史值：SDK 执行路径已移除，读旧会话时归一为 claude-cli-print。 */
-export type SessionRunner = "claude-cli" | "claude-cli-print" | "claude-sdk" | "codex-cli-exec" | "opencode-cli-run" | "grok-cli-headless" | "qoder-cli-print" | "pi-cli-json" | "gemini-cli-json" | "pty";
+export type SessionRunner = "claude-cli" | "claude-cli-print" | "claude-sdk" | "codex-cli-exec" | "opencode-cli-run" | "grok-cli-headless" | "qoder-cli-print" | "pi-cli-json" | "pty";
 export type SessionSource = "interactive" | "automation" | "startup";
 export type ExecutionMode = "assist" | "agent" | "agent-max" | "default" | "auto-edit" | "full-access" | "native" | "managed";
 export type AutonomyPolicy = "assist" | "agent" | "agent-max";
@@ -115,6 +115,8 @@ export interface IosIpaConfig {
     currentIpaFile?: string;
 }
 export interface WandConfig {
+    /** Background maintenance for owned temporary files, orphan uploads and diagnostic archives. Deployment-owned. */
+    autoCleanupTemporaryFiles?: boolean;
     host: string;
     port: number;
     /** Enable HTTPS with self-signed certificate (default: false) */
@@ -203,8 +205,6 @@ export interface WandConfig {
     defaultQoderModel?: string;
     /** 新建 Pi 会话时默认使用的 provider/model pattern。 */
     defaultPiModel?: string;
-    /** 新建 Gemini 会话时默认使用的模型。留空则不传 --model，由 gemini 自行决定。 */
-    defaultGeminiModel?: string;
     /** 每工具的命名模型优先链。SQLite 偏好，稳定分组 ID 可用于会话/员工/默认值。 */
     modelGroups?: import("./model-groups.js").ModelGroup[];
     /** 快捷提交生成 commit message / tag 时使用的 CLI。 */
@@ -282,7 +282,7 @@ interface ReasoningEffortInfo {
  * 避免 `max`（旧值，各家含义不同）和 CLI 新增的原生档位冲突。
  */
 export type { SiliconEmployee } from "./ai-team-types.js";
-export type ThinkingEffort = "off" | "standard" | "deep" | "max" | `${"claude" | "codex" | "opencode" | "grok" | "qoder" | "pi" | "gemini"}:${string}`;
+export type ThinkingEffort = "off" | "standard" | "deep" | "max" | `${"claude" | "codex" | "opencode" | "grok" | "qoder" | "pi"}:${string}`;
 export interface WorktreeInfo {
     branch: string;
     path: string;

package/dist/upload-reference-guard.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from "express";
+import type { UploadRepository } from "./storage/uploads-repository.js";
+/** Runs after authentication, before either input owner starts dispatch. */
+export declare function uploadReferenceGuard(uploads: Pick<UploadRepository, "retainManagedUploadReferences">): RequestHandler;

package/dist/upload-reference-guard.js

@@ -0,0 +1,29 @@
+/** Runs after authentication, before either input owner starts dispatch. */
+export function uploadReferenceGuard(uploads) {
+    return (req, _res, next) => {
+        if (req.method !== "POST" || !req.body) {
+            next();
+            return;
+        }
+        const match = req.path.match(/^\/(?:sessions|structured-sessions)\/([^/]+)\/(?:input|messages)$/);
+        if (!match) {
+            next();
+            return;
+        }
+        let sessionId;
+        try {
+            sessionId = decodeURIComponent(match[1]);
+        }
+        catch {
+            next();
+            return;
+        }
+        try {
+            uploads.retainManagedUploadReferences(sessionId, JSON.stringify(req.body));
+            next();
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+}

package/dist/upload-routes.d.ts

@@ -1,7 +1,11 @@
 import type { Express } from "express";
 import type { SessionRegistry } from "./session-registry.js";
+import type { UploadRepository } from "./storage/uploads-repository.js";
+export declare function invalidateUploadUsage(cwd: string): void;
 export interface UploadRouteOptions {
     /** Test seam: per-directory byte ceiling. */
     maxDirBytes?: number;
+    uploads?: Pick<UploadRepository, "recordManagedUploads">;
+    temporaryRoot?: string;
 }
 export declare function registerUploadRoutes(app: Express, sessions: Pick<SessionRegistry, "getLatest">, options?: UploadRouteOptions): void;

package/dist/upload-routes.js

@@ -1,9 +1,12 @@
 import { randomBytes } from "node:crypto";
-import { readdir, stat, unlink, mkdir } from "node:fs/promises";
+import { readdir, stat, lstat, realpath, unlink, mkdir, open } from "node:fs/promises";
+import { createReadStream, createWriteStream } from "node:fs";
+import { pipeline } from "node:stream/promises";
 import path from "node:path";
 import multer, { MulterError } from "multer";
 import { asyncRoute } from "./express-async.js";
 import { HttpError } from "./http-error.js";
+import { assertPlainTempPath, createManagedTemporary } from "./managed-temp.js";
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
 const MAX_FILES = 5;
 /** Per working directory ceiling for everything ever uploaded there (in-process accounting). */
@@ -18,6 +21,19 @@ function sanitizeFilename(name) {
  * needs to grow; deleting files outside the server simply makes the cap conservative.
  */
 const uploadUsage = new Map();
+export function invalidateUploadUsage(cwd) { uploadUsage.delete(path.join(cwd, UPLOAD_DIR_NAME)); }
+async function reserveUploadUsage(dir, incoming, maximum) {
+    for (;;) {
+        const pending = seedUploadUsage(dir);
+        const current = await pending;
+        if (uploadUsage.get(dir) !== pending)
+            continue;
+        if (current + incoming > maximum)
+            return false;
+        uploadUsage.set(dir, Promise.resolve(current + incoming));
+        return true;
+    }
+}
 function seedUploadUsage(dir) {
     let usage = uploadUsage.get(dir);
     if (!usage) {
@@ -52,6 +68,8 @@ async function removeFiles(paths) {
 }
 /** multer 的限额错误改成稳定的 413，其他错误原样交给统一错误处理。 */
 function uploadErrorHandler(error, _req, res, next) {
+    if (_req.aborted)
+        return;
     if (error instanceof MulterError && (error.code === "LIMIT_FILE_SIZE" || error.code === "LIMIT_FILE_COUNT" || error.code === "LIMIT_UNEXPECTED_FILE")) {
         next(new HttpError(413, "payload_too_large", error.code === "LIMIT_FILE_SIZE" ? "单个文件不能超过 10 MB。" : `一次最多上传 ${MAX_FILES} 个文件。`));
         return;
@@ -60,29 +78,64 @@ function uploadErrorHandler(error, _req, res, next) {
 }
 export function registerUploadRoutes(app, sessions, options = {}) {
     const maxDirBytes = options.maxDirBytes ?? MAX_UPLOAD_DIR_BYTES;
-    const storage = multer.diskStorage({
-        destination(req, _file, cb) {
-            const cwd = req.uploadCwd;
-            if (!cwd) {
-                cb(new Error("会话不存在。"), "");
-                return;
-            }
-            const uploadDir = path.join(cwd, UPLOAD_DIR_NAME);
-            // Async mkdir keeps the event loop free while a large upload is being accepted.
-            mkdir(uploadDir, { recursive: true }).then(() => cb(null, uploadDir), (error) => cb(error instanceof Error ? error : new Error(String(error)), ""));
-        },
-        filename(_req, file, cb) {
-            const ts = Date.now();
-            const rand = randomBytes(4).toString("hex");
-            const safe = sanitizeFilename(file.originalname);
-            cb(null, `${ts}-${rand}-${safe}`);
+    const storage = {
+        _handleFile(req, file, cb) {
+            void (async () => {
+                const request = req;
+                const cwd = request.uploadCwd;
+                if (!cwd)
+                    throw new Error("会话不存在。");
+                const uploadDir = path.join(await realpath(cwd), UPLOAD_DIR_NAME);
+                assertPlainTempPath(uploadDir);
+                await mkdir(uploadDir, { recursive: true, mode: 0o700 });
+                assertPlainTempPath(uploadDir);
+                if (request.uploadClosed || req.aborted)
+                    throw new Error("Upload closed before receiving files.");
+                if (options.temporaryRoot)
+                    request.uploadTemporary ??= createManagedTemporary("upload-stage", options.temporaryRoot);
+                const destination = request.uploadTemporary?.directory ?? path.join(cwd, UPLOAD_DIR_NAME);
+                const filename = `${Date.now()}-${randomBytes(4).toString("hex")}-${sanitizeFilename(file.originalname)}`;
+                const filePath = path.join(destination, filename);
+                const output = createWriteStream(filePath, { flags: "wx", mode: 0o600 });
+                const writers = request.uploadWriters ??= new Set();
+                writers.add(output);
+                let opened = false;
+                output.once("open", () => { opened = true; });
+                output.once("close", () => writers.delete(output));
+                try {
+                    // pipeline closes the disk descriptor when the multipart source fails or disconnects.
+                    await pipeline(file.stream, output);
+                }
+                catch (error) {
+                    if (opened)
+                        await unlink(filePath).catch(() => undefined);
+                    throw error;
+                }
+                return { destination, filename, path: filePath, size: output.bytesWritten };
+            })().then(info => cb(null, info), error => cb(error instanceof Error ? error : new Error(String(error))));
         },
-    });
+        _removeFile(_req, file, cb) { unlink(file.path).then(() => cb(null), error => cb(error.code === "ENOENT" ? null : error)); },
+    };
     const upload = multer({
         storage,
         limits: { fileSize: MAX_FILE_SIZE, files: MAX_FILES },
     });
     function requireUploadSession(req, res, next) {
+        const discardStage = () => {
+            const request = req;
+            if (request.uploadClosed)
+                return;
+            request.uploadClosed = true;
+            const closed = [...(request.uploadWriters ?? [])].map(writer => new Promise(resolve => {
+                writer.once("close", resolve);
+                writer.destroy();
+            }));
+            // Wait for descriptors to close before unlinking; deleted-but-open files still consume disk.
+            void Promise.all(closed).then(() => request.uploadTemporary?.closeAsync());
+        };
+        res.once("finish", discardStage);
+        res.once("close", discardStage);
+        req.once("aborted", discardStage);
         const sessionId = req.params.id;
         // Group chats are structured relay sessions; ProcessManager does not own them.
         // Resolve through the same registry used by the rest of the session API so
@@ -108,12 +161,59 @@ export function registerUploadRoutes(app, sessions, options = {}) {
         }
         const dir = path.join(req.uploadCwd, UPLOAD_DIR_NAME);
         const incoming = files.reduce((total, file) => total + file.size, 0);
-        const current = await seedUploadUsage(dir);
-        if (current + incoming > maxDirBytes) {
+        if (!await reserveUploadUsage(dir, incoming, maxDirBytes)) {
             await removeFiles(files.map((file) => file.path));
             throw new HttpError(413, "payload_too_large", "该会话的上传空间已满，请清理 .wand-uploads 目录后重试。");
         }
-        uploadUsage.set(dir, Promise.resolve(current + incoming));
+        if (req.uploadTemporary) {
+            const promoted = [];
+            try {
+                const targetDir = path.join(await realpath(req.uploadCwd), UPLOAD_DIR_NAME);
+                assertPlainTempPath(targetDir);
+                for (const file of files) {
+                    const destination = path.join(targetDir, path.basename(file.path));
+                    // Exclusive creation never overwrites a collision or user-created redirect.
+                    const output = await open(destination, "wx", 0o600);
+                    promoted.push(destination);
+                    try {
+                        for await (const chunk of createReadStream(file.path))
+                            await output.writeFile(chunk);
+                    }
+                    finally {
+                        await output.close();
+                    }
+                    await unlink(file.path);
+                    file.path = path.join(req.uploadCwd, UPLOAD_DIR_NAME, path.basename(destination));
+                }
+            }
+            catch (error) {
+                await removeFiles(promoted);
+                invalidateUploadUsage(req.uploadCwd);
+                throw error;
+            }
+        }
+        if (options.uploads) {
+            try {
+                const canonicalCwd = await realpath(req.uploadCwd);
+                const receipts = [];
+                for (const file of files) {
+                    const canonicalPath = path.join(canonicalCwd, UPLOAD_DIR_NAME, path.basename(file.path));
+                    assertPlainTempPath(canonicalPath);
+                    const info = await lstat(canonicalPath);
+                    if (!info.isFile())
+                        throw new Error("Upload is not a regular file.");
+                    receipts.push({ filePath: file.path, canonicalPath, cwd: req.uploadCwd,
+                        canonicalCwd, sessionId: req.params.id, device: info.dev, inode: info.ino, size: info.size,
+                        mtimeMs: info.mtimeMs, ctimeMs: info.ctimeMs, createdAt: Date.now() });
+                }
+                options.uploads.recordManagedUploads(receipts);
+            }
+            catch (error) {
+                await removeFiles(files.map(file => file.path));
+                invalidateUploadUsage(req.uploadCwd);
+                throw error;
+            }
+        }
         const result = files.map((f) => ({
             originalName: f.originalname,
             savedPath: f.path,

package/dist/user-profile.d.ts

@@ -8,7 +8,7 @@ import type { ConversationAuthor, WandConfig } from "./types.js";
 export interface UserProfileConfig {
     /** 会话里的署名。留空回落 `DEFAULT_USER_DISPLAY_NAME`，不做多套默认。 */
     name?: string;
-    /** `""`（按名字生成）、`"cat:<n>"`（像素猫毛色）或 `data:image/*;base64,…`（上传图）。 */
+    /** 与员工共用头像格式；空值按稳定 user ID 生成，保留旧像素猫与上传图。 */
     avatar?: string;
 }
 /** 未设置资料时的唯一默认署名。历史数据、客户端兜底与文案都用这一个值。 */

package/dist/user-profile.js

@@ -1,3 +1,4 @@
+import { parsePlushAvatar, parsePlushCatAvatar, parsePlushDogAvatar } from "./plush-avatar.js";
 /** 未设置资料时的唯一默认署名。历史数据、客户端兜底与文案都用这一个值。 */
 export const DEFAULT_USER_DISPLAY_NAME = "我";
 /** 与硅基员工头像同一条白名单与上限，避免两套大小口径。 */
@@ -8,10 +9,14 @@ export const USER_PROFILE_NAME_MAX = 24;
 function clean(value) {
     return typeof value === "string" ? value.trim() : "";
 }
-/** 只接受像素猫毛色与白名单 data URL；其他写法当没配，不猜也不静默改写。 */
+function isAvatar(avatar) {
+    return AVATAR_CAT.test(avatar) || AVATAR_DATA_URL.test(avatar)
+        || !!(parsePlushAvatar(avatar) ?? parsePlushCatAvatar(avatar) ?? parsePlushDogAvatar(avatar));
+}
+/** 与员工共享版本化毛绒格式；仍拒绝外部 URL 和未知版本。 */
 function normalizeAvatar(value) {
     const avatar = clean(value);
-    if (!avatar || AVATAR_CAT.test(avatar) || (avatar.length <= USER_AVATAR_MAX_CHARS && AVATAR_DATA_URL.test(avatar))) {
+    if (!avatar || (avatar.length <= USER_AVATAR_MAX_CHARS && isAvatar(avatar))) {
         return avatar;
     }
     return "";
@@ -41,7 +46,7 @@ export function parseUserProfile(input) {
     const avatarInput = raw.avatar;
     const avatar = clean(avatarInput);
     if (avatar) {
-        if (!AVATAR_CAT.test(avatar) && !AVATAR_DATA_URL.test(avatar)) {
+        if (!isAvatar(avatar)) {
             throw new Error("头像格式无效，请重新选择或上传图片。");
         }
         if (avatar.length > USER_AVATAR_MAX_CHARS)