mingdao-harness 0.2.4 → 0.2.5

package/src/skills.js

@@ -15,7 +15,7 @@ import { skillDirHash, readSourceMeta } from './skill-lib.js';
 
 const BUILTIN_DIR = fileURLToPath(new URL('../skills', import.meta.url));
 
-export function skillDirs(workingDir) {
+export function skillDirs(/** @type {any} */ workingDir) {
   return [
     { dir: path.join(mingdaoHome(), 'skills'), source: 'user' },
     { dir: path.join(workingDir, '.mingdao', 'skills'), source: 'project' },
@@ -23,7 +23,7 @@ export function skillDirs(workingDir) {
   ];
 }
 
-function readDescription(skillMd) {
+function readDescription(/** @type {any} */ skillMd) {
   try {
     const text = fs.readFileSync(skillMd, 'utf8');
     const fm = text.match(/^---\n([\s\S]*?)\n---/);
@@ -39,7 +39,7 @@ function readDescription(skillMd) {
 }
 
 // 完整性校验（P3-3）：带指纹（sha256）来源记录的技能，内容与安装时不一致 → 拒绝加载
-function isTampered(dir) {
+function isTampered(/** @type {any} */ dir) {
   const meta = readSourceMeta(dir);
   if (!meta?.sha256) return false; // 旧版安装（无指纹）不拦截
   try {
@@ -50,14 +50,14 @@ function isTampered(dir) {
 }
 
 // 被篡改的用户级技能清单（CLI/WebUI 提示用；这些技能已被 listSkills 排除加载）
-export function tamperedSkillNames(workingDir) {
+export function tamperedSkillNames(/** @type {any} */ workingDir) {
   const dir = path.join(mingdaoHome(), 'skills');
-  const out = [];
+  const /** @type {any} */ out = [];
   let entries;
   try {
     entries = fs.readdirSync(dir, { withFileTypes: true });
   } catch {
-    return out;
+    return /** @type {any} */ out;
   }
   for (const e of entries) {
     if (!e.isDirectory()) continue;
@@ -75,7 +75,7 @@ export function tamperedSkillNames(workingDir) {
   return out;
 }
 
-export function listSkills(workingDir) {
+export function listSkills(/** @type {any} */ workingDir) {
   const seen = new Set();
   const out = [];
   for (const { dir, source } of skillDirs(workingDir)) {
@@ -108,7 +108,7 @@ export function listSkills(workingDir) {
   return out;
 }
 
-export function loadSkill(workingDir, name) {
+export function loadSkill(/** @type {any} */ workingDir, /** @type {any} */ name) {
   const s = listSkills(workingDir).find((x) => x.name === name);
   if (!s) return null;
   try {
@@ -118,14 +118,14 @@ export function loadSkill(workingDir, name) {
   }
 }
 
-function sourceLabel(source) {
+function sourceLabel(/** @type {any} */ source) {
   if (source === 'user') return '（用户级）';
   if (source === 'builtin') return '（内置）';
   return '';
 }
 
 // 注入系统提示的技能清单（仅名称+描述）
-export function skillsRegistryBlock(workingDir) {
+export function skillsRegistryBlock(/** @type {any} */ workingDir) {
   const skills = listSkills(workingDir);
   if (!skills.length) return '';
   return (

package/src/sync-server.js

@@ -39,9 +39,14 @@ const INVITE_CODES = new Set(
     .filter(Boolean)
 );
 
+/** @type {(...a: any[]) => void} */
 const log = (...a) => console.log(new Date().toISOString(), ...a);
 
 // ---------- 存储 ----------
+/**
+ * @param {any} file
+ * @param {any} fallback
+ */
 function readJson(file, fallback) {
   try {
     return JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -49,6 +54,10 @@ function readJson(file, fallback) {
     return fallback;
   }
 }
+/**
+ * @param {any} file
+ * @param {any} obj
+ */
 function writeJson(file, obj) {
   fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
   atomicWriteFileSync(file, JSON.stringify(obj, null, 2) + '\n', { mode: 0o600 }); // 质检 H4
@@ -59,12 +68,15 @@ function usersFile() {
 function devicesFile() {
   return path.join(ACTIVE_DIR, 'devices.json');
 }
+/** @param {any} username */
 function userDir(username) {
   return path.join(ACTIVE_DIR, 'data', username);
 }
+/** @param {any} username */
 function sessionsDir(username) {
   return path.join(userDir(username), 'sessions');
 }
+/** @param {any} username */
 function metaFile(username) {
   return path.join(userDir(username), 'meta.json');
 }
@@ -75,8 +87,13 @@ function acceptedFile() {
   return path.join(ACTIVE_DIR, 'accepted.json');
 }
 
+/** @type {(s: any) => string} */
 const sha = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
 // 常量时间比较（P3-10）：token/密码哈希等值判断防时序侧信道
+/**
+ * @param {any} a
+ * @param {any} b
+ */
 function safeEqualHex(a, b) {
   try {
     const ba = Buffer.from(String(a), 'hex');
@@ -87,9 +104,18 @@ function safeEqualHex(a, b) {
   }
 }
 // 密码存储用 scrypt（带盐 KDF）；旧数据兼容：verify 时 sha256 回退
+/**
+ * @param {any} password
+ * @param {any} salt
+ */
 function hashPassword(password, salt) {
   return crypto.scryptSync(String(password), String(salt), 32).toString('hex');
 }
+/**
+ * @param {any} password
+ * @param {any} salt
+ * @param {any} hash
+ */
 function verifyPassword(password, salt, hash) {
   if (!hash) return false;
   try {
@@ -98,9 +124,11 @@ function verifyPassword(password, salt, hash) {
   // 兼容早期 sha256 存储
   return safeEqualHex(hash, sha(`${salt}:${password}`));
 }
+/** @param {any} u */
 function isValidUsername(u) {
   return typeof u === 'string' && /^[A-Za-z0-9_.-]{2,32}$/.test(u) && u !== '.' && u !== '..';
 }
+/** @param {any} n */
 function isValidSessionName(n) {
   return typeof n === 'string' && /^[\w\u4e00-\u9fa5.-]{1,140}\.jsonl$/.test(n) && !n.includes('..');
 }
@@ -108,6 +136,7 @@ function isValidSessionName(n) {
 // ---------- 限速（防爆破/枚举；内存表，进程级） ----------
 const TRUST_PROXY = process.env.SYNC_TRUST_PROXY === '1'; // 仅部署在可信反代后时开启
 const rateBuckets = new Map();
+/** @param {any} req */
 function clientKey(req) {
   let ip = req.socket?.remoteAddress || 'x';
   if (TRUST_PROXY) {
@@ -116,6 +145,7 @@ function clientKey(req) {
   }
   return ip;
 }
+/** @param {any} req */
 function rateLimited(req, limit = 20, extra = '') {
   // 质检 M5：键 = IP + 路由 + 用户名——单账号爆破按用户名限（分布式 IP 无法绕过）；
   // 表满按最旧淘汰而非整表 clear（整表 clear 可被攻击者重置全员限额）
@@ -140,11 +170,13 @@ function rateLimited(req, limit = 20, extra = '') {
 }
 
 // ---------- HTTP 工具 ----------
+/** @param {any} req */
 function readBody(req, limit = MAX_BODY) {
   return new Promise((resolve, reject) => {
+    /** @type {any[]} */
     const chunks = [];
     let size = 0;
-    req.on('data', (d) => {
+    req.on('data', (/** @type {any} */ d) => {
       size += d.length;
       if (size > limit) {
         reject(new Error('body 超限'));
@@ -157,20 +189,27 @@ function readBody(req, limit = MAX_BODY) {
     req.on('error', reject);
   });
 }
+/**
+ * @param {any} res
+ * @param {any} code
+ * @param {any} obj
+ */
 function json(res, code, obj) {
   const body = JSON.stringify(obj);
   res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
   res.end(body);
 }
+/** @param {any} req */
 async function parseBody(req) {
   try {
     return JSON.parse(await readBody(req) || '{}');
   } catch (e) {
-    return { __error: e.message };
+    return { __error: /** @type {any} */ (e).message };
   }
 }
 
 // ---------- 认证 ----------
+/** @param {any} req */
 function tokenOf(req) {
   const h = req.headers.authorization || '';
   const m = h.match(/^Bearer\s+(.+)$/i);
@@ -181,6 +220,7 @@ const deviceTokenCache = new Map();
 function invalidateDeviceCache() {
   deviceTokenCache.clear();
 }
+/** @param {any} token */
 function findDeviceByToken(token) {
   if (!token) return null;
   const tokenHash = sha(token);
@@ -202,9 +242,12 @@ function findDeviceByToken(token) {
 
 // ---------- 业务 ----------
 // 质检 A1：通用写互斥（注册/pair/lastSeen/meta 更新串行化），防 devices.json/meta.json 读改写竞态
+/** @type {any} */
 let writeLock = null;
+/** @param {any} fn */
 async function withWriteLock(fn) {
   const prev = writeLock || Promise.resolve();
+  /** @type {any} */
   let release;
   writeLock = new Promise((resolve) => {
     release = resolve;
@@ -216,7 +259,9 @@ async function withWriteLock(fn) {
     release();
   }
 }
+/** @type {any} */
 let registerLock = null;
+/** @param {any} body */
 async function doRegister(body) {
   const username = String(body.username || '').trim();
   const password = String(body.password || '');
@@ -229,6 +274,7 @@ async function doRegister(body) {
     });
   }
   const prev = registerLock;
+  /** @type {any} */
   let release;
   registerLock = new Promise((resolve) => {
     release = resolve;
@@ -247,6 +293,7 @@ async function doRegister(body) {
   }
 }
 
+/** @param {any} body */
 async function doPair(body) {
   const username = String(body.username || '').trim();
   const password = String(body.password || '');
@@ -268,10 +315,12 @@ async function doPair(body) {
   });
 }
 
+/** @param {any} username */
 function doListSessions(username) {
   const dir = sessionsDir(username);
   const meta = readJson(metaFile(username), {});
   const out = [];
+  /** @type {any[]} */
   let entries = [];
   try {
     entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -285,6 +334,10 @@ function doListSessions(username) {
   return out;
 }
 
+/**
+ * @param {any} username
+ * @param {any} body
+ */
 function doPush(username, body) {
   const name = String(body.name || '').trim();
   const content = typeof body.content === 'string' ? body.content : '';
@@ -305,6 +358,10 @@ function doPush(username, body) {
   });
 }
 
+/**
+ * @param {any} username
+ * @param {any} name
+ */
 function doPull(username, name) {
   if (!isValidSessionName(name)) return { notFound: '会话不存在' };
   const file = path.join(sessionsDir(username), name);
@@ -317,6 +374,10 @@ function doPull(username, name) {
   }
 }
 
+/**
+ * @param {any} username
+ * @param {any} name
+ */
 function doDelete(username, name) {
   if (!isValidSessionName(name)) return { notFound: '会话不存在' };
   const dir = sessionsDir(username);
@@ -335,6 +396,10 @@ function doDelete(username, name) {
 }
 
 // ---------- 密码修改 ----------
+/**
+ * @param {any} username
+ * @param {any} body
+ */
 function doChangePassword(username, body) {
   const oldPassword = String(body.oldPassword || '');
   const newPassword = String(body.newPassword || '');
@@ -356,6 +421,10 @@ function doChangePassword(username, body) {
 }
 
 // ---------- 会话分享 ----------
+/**
+ * @param {any} username
+ * @param {any} name
+ */
 function doShareCreate(username, name) {
   if (!isValidSessionName(name)) return { error: `会话名非法：${name}` };
   if (!fs.existsSync(path.join(sessionsDir(username), name))) return { notFound: '你还没有这个会话' };
@@ -367,6 +436,7 @@ function doShareCreate(username, name) {
   return { ok: true, shareId, name };
 }
 
+/** @param {any} username */
 function doShareList(username) {
   const shares = readJson(sharesFile(), {});
   const accepted = readJson(acceptedFile(), {})[username] || {};
@@ -383,6 +453,10 @@ function doShareList(username) {
   return { ok: true, mine, accepted: mineAccepted };
 }
 
+/**
+ * @param {any} username
+ * @param {any} shareId
+ */
 function doShareRevoke(username, shareId) {
   const shares = readJson(sharesFile(), {});
   const s = shares[shareId];
@@ -396,6 +470,10 @@ function doShareRevoke(username, shareId) {
 // 接受/刷新分享：克隆（或更新）到接受者自己的会话列表。
 //  - 首次接受 → 写入同名文件（同名已有不同内容则另存 .shared- 副本，绝不覆盖）
 //  - 再次接受：接受者未修改过副本 → 就地刷新；已修改 → 另存新副本（冲突保留双方）
+/**
+ * @param {any} username
+ * @param {any} shareId
+ */
 function doShareAccept(username, shareId) {
   const shares = readJson(sharesFile(), {});
   const s = shares[shareId];
@@ -453,6 +531,10 @@ function doShareAccept(username, shareId) {
 }
 
 // ---------- 路由 ----------
+/**
+ * @param {any} req
+ * @param {any} res
+ */
 async function handle(req, res) {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -569,7 +651,7 @@ async function handle(req, res) {
     }
     return json(res, 404, { error: '未知接口' });
   } catch (e) {
-    log('error', p, e.message);
+    log('error', p, /** @type {any} */ (e).message);
     return json(res, 500, { error: '服务器内部错误' });
   }
 }
@@ -584,6 +666,7 @@ export function runSyncServer({ port, host, dataDir, cert, key } = {}) {
   const certFile = cert || CERT;
   const keyFile = key || KEY;
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  /** @type {(req: any, res: any) => void} */
   const handler = (req, res) => {
     handle(req, res).catch(() => {});
   };

package/src/sync.js

@@ -23,15 +23,21 @@ const insecureOn = () => syncSettings()?.insecure === true;
 
 // 请求级不安全 TLS 传输（P1-6）：为本次请求单独建立 rejectUnauthorized:false 的 https.Agent，
 // 与并发的 provider 请求（各自的 TLS 校验）互不干扰；安全路径仍走 fetch（连接复用）。
+/**
+ * @param {any} target
+ * @param {{ headers?: any, body?: any, timeoutMs?: any, insecure?: any }} opts
+ */
 function rawRequest(target, { headers, body, timeoutMs, insecure }) {
   return new Promise((resolve, reject) => {
     const mod = target.protocol === 'http:' ? http : https;
+    /** @type {any} */
     const opts = { method: 'POST', headers };
     if (insecure && target.protocol === 'https:') opts.agent = new https.Agent({ rejectUnauthorized: false });
     const req = mod.request(target, opts, (res) => {
+      /** @type {any[]} */
       const chunks = [];
       let size = 0;
-      res.on('data', (d) => {
+      res.on('data', (/** @type {any} */ d) => {
         size += d.length;
         if (size > 25 * 1024 * 1024) {
           req.destroy();
@@ -56,6 +62,12 @@ function rawRequest(target, { headers, body, timeoutMs, insecure }) {
   });
 }
 
+/**
+ * @param {any} baseUrl
+ * @param {any} method
+ * @param {any} payload
+ * @param {any} token
+ */
 async function apiCall(baseUrl, method, payload, token, timeoutMs = TIMEOUT_MS, insecure = false) {
   const target = new URL(baseUrl.replace(/\/+$/, '') + method);
   const body = JSON.stringify(payload || {});
@@ -92,7 +104,7 @@ async function apiCall(baseUrl, method, payload, token, timeoutMs = TIMEOUT_MS,
       clearTimeout(timer);
     }
   } catch (e) {
-    if (e.name === 'AbortError' || e.message === '请求超时') throw new Error('请求超时（20s）');
+    if (/** @type {any} */ (e).name === 'AbortError' || /** @type {any} */ (e).message === '请求超时') throw new Error('请求超时（20s）');
     throw e;
   }
 }
@@ -120,6 +132,9 @@ export function syncStatus() {
 }
 
 // 登录/注册 + 设备配对：注册失败（用户不存在）先注册再配对
+/**
+ * @param {{ url?: any, username?: any, password?: any, deviceName?: any, insecure?: any }} opts
+ */
 export async function syncLogin({ url, username, password, deviceName, insecure = false }) {
   const base = String(url || '').trim().replace(/\/+$/, '');
   if (!/^https?:\/\//i.test(base)) return { error: '服务器地址需以 http(s):// 开头' };
@@ -133,8 +148,8 @@ export async function syncLogin({ url, username, password, deviceName, insecure
     try {
       pair = await apiCall(base, '/api/pair', { username: name, password, deviceName: dev }, undefined, TIMEOUT_MS, loginInsecure);
     } catch (e) {
-      if (e.status === 401) return { error: '用户名或密码错误' };
-      if (e.status !== 404) return { error: `连接失败：${e.message}` };
+      if (/** @type {any} */ (e).status === 401) return { error: '用户名或密码错误' };
+      if (/** @type {any} */ (e).status !== 404) return { error: `连接失败：${/** @type {any} */ (e).message}` };
       pair = { notFound: true }; // 用户不存在 → 先注册
     }
     if (pair.notFound) {
@@ -152,9 +167,9 @@ export async function syncLogin({ url, username, password, deviceName, insecure
     saveCredentials(creds);
     return { ok: true, username: name, deviceName: dev, url: base };
   } catch (e) {
-    if (e.status === 401) return { error: '用户名或密码错误' };
-    if (e.status === 404) return { error: '服务器接口不存在（确认是 mingdao 同步服务端）' };
-    return { error: `连接失败：${e.message}` };
+    if (/** @type {any} */ (e).status === 401) return { error: '用户名或密码错误' };
+    if (/** @type {any} */ (e).status === 404) return { error: '服务器接口不存在（确认是 mingdao 同步服务端）' };
+    return { error: `连接失败：${/** @type {any} */ (e).message}` };
   }
 }
 
@@ -190,15 +205,20 @@ export async function syncRemoteList() {
     const r = await apiCall(g.url, '/api/sessions/list', {}, g.token, TIMEOUT_MS, insecureOn());
     return { ok: true, sessions: r.sessions || [] };
   } catch (e) {
-    return { error: e.message };
+    return { error: /** @type {any} */ (e).message };
   }
 }
 
 // 会话名白名单（与 sync-server 同款）：远端返回的名字不满足即拒绝落盘，防恶意服务器任意文件写
+/** @param {any} n */
 function isValidRemoteName(n) {
   return typeof n === 'string' && /^[\w\u4e00-\u9fa5.-]{1,140}\.jsonl$/.test(n) && !n.includes('..');
 }
 // 冲突副本名：时间戳 + 随机后缀，防同一毫秒冲突静默覆盖
+/**
+ * @param {any} base
+ * @param {any} side
+ */
 function conflictCopyName(base, side) {
   return base.replace(/\.jsonl$/, `.${side}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}.jsonl`);
 }
@@ -214,6 +234,7 @@ function readState() {
     return {};
   }
 }
+/** @param {any} state */
 function writeState(state) {
   ensureHome();
   const target = stateFile();
@@ -221,6 +242,7 @@ function writeState(state) {
 }
 
 // 推送单个/全部会话。仅当远端被其他设备改过（mtime 与本地记录不一致且内容不同）才视为冲突并备份远端。
+/** @param {any} [name] */
 export async function syncPush(name) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -257,7 +279,7 @@ export async function syncPush(name) {
     try {
       remote = await apiCall(g.url, '/api/sessions/pull', { name: s.name }, g.token, TIMEOUT_MS, insecureOn());
     } catch (e) {
-      if (e.status !== 404) return { error: `读取远端 ${s.name} 失败：${e.message}` };
+      if (/** @type {any} */ (e).status !== 404) return { error: `读取远端 ${s.name} 失败：${/** @type {any} */ (e).message}` };
     }
     if (remote?.ok) {
       const lastMtime = state[s.name]?.remoteMtime;
@@ -275,7 +297,7 @@ export async function syncPush(name) {
         state[s.name] = { remoteMtime: r.mtime, localMtime: localStat.mtimeMs };
       }
     } catch (e) {
-      return { error: `推送 ${s.name} 失败：${e.message}` };
+      return { error: `推送 ${s.name} 失败：${/** @type {any} */ (e).message}` };
     }
   }
   writeState(state);
@@ -283,6 +305,7 @@ export async function syncPush(name) {
 }
 
 // 拉取单个/全部会话。本地有不同内容时保留本地，远端写入 .remote- 副本。
+/** @param {any} [name] */
 export async function syncPull(name) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -290,9 +313,9 @@ export async function syncPull(name) {
   let sessions;
   try {
     const r = await apiCall(g.url, '/api/sessions/list', {}, g.token, TIMEOUT_MS, insecureOn());
-    sessions = (r.sessions || []).filter((s) => !name || s.name === name);
+    sessions = (r.sessions || []).filter((/** @type {any} */ s) => !name || s.name === name);
   } catch (e) {
-    return { error: `获取远端清单失败：${e.message}` };
+    return { error: `获取远端清单失败：${/** @type {any} */ (e).message}` };
   }
   if (!sessions.length) return { error: name ? `远端没有会话 ${name}` : '远端没有会话' };
   const state = readState();
@@ -330,6 +353,9 @@ export async function syncPull(name) {
 }
 
 // ---------- 密码修改 ----------
+/**
+ * @param {{ oldPassword?: any, newPassword?: any }} opts
+ */
 export async function syncChangePassword({ oldPassword, newPassword }) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -338,12 +364,13 @@ export async function syncChangePassword({ oldPassword, newPassword }) {
     const r = await apiCall(g.url, '/api/password', { oldPassword: oldPassword || '', newPassword }, g.token, TIMEOUT_MS, insecureOn());
     return r.ok ? { ok: true } : { error: r.error || '修改失败' };
   } catch (e) {
-    if (e.status === 401) return { error: '旧密码错误' };
-    return { error: `修改失败：${e.message}` };
+    if (/** @type {any} */ (e).status === 401) return { error: '旧密码错误' };
+    return { error: `修改失败：${/** @type {any} */ (e).message}` };
   }
 }
 
 // ---------- 会话分享与协作 ----------
+/** @param {any} name */
 export async function syncShareCreate(name) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -351,7 +378,7 @@ export async function syncShareCreate(name) {
     const r = await apiCall(g.url, '/api/share/create', { name }, g.token, TIMEOUT_MS, insecureOn());
     return r.ok ? { ok: true, shareId: r.shareId, name: r.name } : { error: r.error };
   } catch (e) {
-    return { error: `分享失败：${e.status === 404 ? '你还没有这个会话' : e.message}` };
+    return { error: `分享失败：${/** @type {any} */ (e).status === 404 ? '你还没有这个会话' : /** @type {any} */ (e).message}` };
   }
 }
 
@@ -362,10 +389,11 @@ export async function syncShareList() {
     const r = await apiCall(g.url, '/api/share/list', {}, g.token, TIMEOUT_MS, insecureOn());
     return { ok: true, mine: r.mine || [], accepted: r.accepted || [] };
   } catch (e) {
-    return { error: `获取分享列表失败：${e.message}` };
+    return { error: `获取分享列表失败：${/** @type {any} */ (e).message}` };
   }
 }
 
+/** @param {any} shareId */
 export async function syncShareAccept(shareId) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -382,10 +410,11 @@ export async function syncShareAccept(shareId) {
     writeState(state);
     return { ok: true, shareId, savedAs: r.savedAs, conflict: r.conflict || false };
   } catch (e) {
-    return { error: `接受分享失败：${e.status === 404 ? '分享不存在（可能已撤销）' : e.message}` };
+    return { error: `接受分享失败：${/** @type {any} */ (e).status === 404 ? '分享不存在（可能已撤销）' : /** @type {any} */ (e).message}` };
   }
 }
 
+/** @param {any} shareId */
 export async function syncShareRevoke(shareId) {
   const g = tokenGuard();
   if (g.error) return { error: g.error };
@@ -393,7 +422,7 @@ export async function syncShareRevoke(shareId) {
     const r = await apiCall(g.url, '/api/share/revoke', { shareId }, g.token, TIMEOUT_MS, insecureOn());
     return r.ok ? { ok: true } : { error: r.error };
   } catch (e) {
-    return { error: `撤销失败：${e.status === 404 ? '分享不存在' : e.status === 403 ? '只能撤销自己的分享' : e.message}` };
+    return { error: `撤销失败：${/** @type {any} */ (e).status === 404 ? '分享不存在' : /** @type {any} */ (e).status === 403 ? '只能撤销自己的分享' : /** @type {any} */ (e).message}` };
   }
 }
 
@@ -421,12 +450,16 @@ export function listSyncConflicts() {
     .map(([base, entries]) => ({
       base,
       localExists: fs.existsSync(path.join(home, 'sessions', base)),
-      entries: entries.sort((a, b) => b.ts - a.ts),
+      entries: entries.sort((/** @type {any} */ a, /** @type {any} */ b) => b.ts - a.ts),
     }))
     .sort((a, b) => a.base.localeCompare(b.base));
 }
 
 // choice: local（保留本地，删除备份）| remote（采用远端备份替换本地）| both（把最新备份转正为可见会话）
+/**
+ * @param {any} base
+ * @param {any} choice
+ */
 export function resolveSyncConflict(base, choice) {
   const home = mingdaoHome();
   if (!/^[\w\u4e00-\u9fa5.-]{1,140}\.jsonl$/.test(base)) return { error: '会话名非法' };
@@ -443,7 +476,7 @@ export function resolveSyncConflict(base, choice) {
       const mm = f.match(m);
       return mm && `${mm[1]}.jsonl` === base;
     })
-    .sort((a, b) => Number(b.match(m)[3]) - Number(a.match(m)[3]));
+    .sort((a, b) => Number(/** @type {any} */ (b.match(m))[3]) - Number(/** @type {any} */ (a.match(m))[3]));
   if (!backups.length) return { error: `没有找到 ${base} 的冲突备份` };
   const newest = backups[0];
   if (choice === 'local') {