forcetypeassert 6→0（缓存 list 断言、relay/flared 中间件契约断言、图片压缩 flight 断言，全部带检查+安全失败路径）；errname 1→0；prealloc 2 处（另 1 处与 repo mnd 冲突，用命名常量解决）。nilnil 保留（not-found/可选结果惯例，含接口契约注释）。

Result: {"status":"keep","total_issues":15,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":14,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":43}

.auto/log.jsonl

@@ -6,3 +6,4 @@
 {"run":5,"commit":"d0414b4","metric":45,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":7,"golint_total":44,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":38},"status":"keep","description":"canonicalheader 8→0 + usestdlibvars 3→0：header key 改为 Go 规范大小写（wire 格式本就如此，纯代码修正）、HTTP 方法常量替代字符串字面量。","timestamp":1786873098921,"segment":0,"confidence":2.1724137931034484,"asi":{"hypothesis":"canonicalheader+usestdlibvars --fix：Header key 统一规范大小写、GET/OPTIONS 等方法常量","insight":"GitHub header 修正前后的 wire 格式完全一致（Go 在 Set 时本来就会规范化），纯代码层面修正，零行为风险；下次遇到同类 100% 安全","next_action_hint":"剩余：errorlint(12) 需逐处人工判断（其中 3 处 err != context.Canceled、2 处 %v wrap、若干 ==/类型断言）；recvcheck(7) 是模型接收者一致性；wastedassign(7) 删 TODO 赋值；intrange(3)/modernize(5)/nilnil(3)/prealloc(3)/forcetypeassert(3)/errname(1)/eslint(1)"}}
 {"run":6,"commit":"ce28f63","metric":38,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":37,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":47},"status":"keep","description":"wastedassign 7→0：删除 7 处死初始化（snapshot.go 三连、push 三件套 content、format.go numStr），改 var 声明，零行为变化。","timestamp":1786873485497,"segment":0,"confidence":2.978723404255319,"asi":{"hypothesis":"wastedassign 7→0：删除 7 处死初始化（x := \"\" 后所有分支都赋值）改为 var 声明","insight":"replace 工具会归一化 replacement_text 的前导空白；对需要缩进的编辑直接用 sed/gofmt -w 处理更稳","next_action_hint":"剩余：errorlint(12)、recvcheck(7)、modernize(5)、intrange(3)、nilnil(3)、prealloc(3)、forcetypeassert(3)、errname(1)、eslint(1)"}}
 {"run":7,"commit":"288b74d","metric":33,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":32,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":45},"status":"keep","description":"intrange 3→0 + modernize 5→3：for i:=0;i<len/N;i++ → range len/N（8 处）；time.Time 字段 omitempty→omitzero（wire 输出一致）；SplitSeq；min() 简化。刻意保留 lark.go omitzero（会改变 wire 行为）。","timestamp":1786873629461,"segment":0,"confidence":4.166666666666667,"asi":{"hypothesis":"intrange(3) + modernize 剩余（2 个 time.Time omitempty→omitzero + SplitSeq + min）","insight":"lark.go larkTextContent omitempty→omitzero 会改变 wire（普通 struct 无 IsZero，当前恒序列化，改后零值省略）—— 判定为行为变化，故意保留；time.Time 字段 omitempty/omitzero 输出一致，可安全替换","next_action_hint":"剩余：errorlint(12) 大头（3 处 != context.Canceled 需确认 runner 是否 wrap；%v→%w 2 处；若干 ==err / 类型断言）；recvcheck(7)；forcetypeassert(3)；nilnil(3)；prealloc(3)；errname(1)；eslint(1)"}}
+{"run":8,"commit":"86fad02","metric":22,"metrics":{"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":1,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":21,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":46},"status":"keep","description":"errorlint 12→1：3 处 cmd 入口 err!=context.Canceled→errors.Is（防御性，当前 runner 不 wrap 语义不变）；2 处 strconv.NumError 断言、1 处 viper 断言、2 处 ==io.EOF、2 处 ==redis.Nil、1 处 ==gorm.ErrRecordNotFound→errors.As/Is；8 处 %v→%w 保留错误链。刻意保留 telegram.go 单处 %v（原始错误仅作上下文文本，wrap 会改变 errors.Is 匹配语义）。","timestamp":1786873923775,"segment":0,"confidence":4.195121951219512,"asi":{"hypothesis":"errorlint 12→1：errors.Is/As 替代 ==/类型断言（防御 wrap），%v→%w 保留错误链","insight":"errorlint 结果在并行分析时一度不稳定（可能文件缓存竞争），多跑一次确认；telegram.go 的 %v 是刻意保留原始 HTML 错误为文本（只 wrap fallbackErr），判定为合理例外，不计为负债。错误链保留（%w）对多错误组合消息（manager.go、restart_unix.go、service.go）是净收益，调用方无 Is 匹配这些次要错误","next_action_hint":"剩余：recvcheck(7)、forcetypeassert(3)、nilnil(3)、prealloc(3)、modernize(3=lark omitzero 刻意保留)、errname(1)、eslint(1)"}}

internal/apps/openflare/flared/routers.go

@@ -37,7 +37,11 @@ func PostHeartbeat(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 
 	result, err := Heartbeat(c.Request.Context(), node, payload)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -63,7 +67,11 @@ func GetActiveConfig(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 
 	config, err := GetTunnelConfig(c.Request.Context(), node)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -91,7 +99,9 @@ func PostApplyLog(c *gin.Context) {
 		return
 	}
 	if authNode, ok := c.Get(ctxFlaredNodeKey); ok {
-		payload.NodeID = authNode.(*model.OpenFlareNode).NodeID
+		if node, ok := authNode.(*model.OpenFlareNode); ok {
+			payload.NodeID = node.NodeID
+		}
 	}
 
 	log, err := ReportApplyLog(c.Request.Context(), payload)
@@ -115,6 +125,10 @@ func GetWebSocket(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 	ofws.ServeFlared(c, node.NodeID)
 }

internal/apps/openflare/geoip/runtime.go

@@ -26,7 +26,7 @@ const (
 
 var (
 	runtimeOnce       sync.Once
-	runtimeInitErr    error
+	errRuntimeInit    error
 	currentProviderMu sync.RWMutex
 	currentProvider   string
 )
@@ -34,9 +34,9 @@ var (
 // EnsureRuntimeProvider loads GeoIP provider config from SystemConfig.
 func EnsureRuntimeProvider(ctx context.Context) error {
 	runtimeOnce.Do(func() {
-		runtimeInitErr = applyProviderFromSystemConfig(ctx)
+		errRuntimeInit = applyProviderFromSystemConfig(ctx)
 	})
-	return runtimeInitErr
+	return errRuntimeInit
 }
 
 // RefreshRuntimeProvider reapplies GeoIPProvider after config updates.
@@ -115,7 +115,7 @@ func ensureServerMMDB() (string, error) {
 // ResetRuntimeForTest clears lazy-init state for unit tests.
 func ResetRuntimeForTest() {
 	runtimeOnce = sync.Once{}
-	runtimeInitErr = nil
+	errRuntimeInit = nil
 	currentProviderMu.Lock()
 	currentProvider = ""
 	currentProviderMu.Unlock()

internal/apps/openflare/relay/routers.go

@@ -38,7 +38,11 @@ func PostHeartbeat(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 
 	result, err := Heartbeat(c.Request.Context(), node, payload)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -61,6 +65,10 @@ func GetWebSocket(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 	ofws.ServeRelay(c, node.NodeID)
 }

internal/apps/openflare/uptimekuma/client.go

@@ -281,7 +281,8 @@ func (c *SocketIOClient) Emit(event string, args ...any) (string, error) {
 	c.ackChanMap[id] = ch
 	c.ackMutex.Unlock()
 
-	payloadArr := []any{event}
+	payloadArr := make([]any, 1, 1+len(args))
+	payloadArr[0] = event
 	payloadArr = append(payloadArr, args...)
 	bs, err := json.Marshal(payloadArr)
 	if err != nil {

internal/apps/upload/filesrv/file_server.go

@@ -206,7 +206,10 @@ func EnsureCompressedImageCache(
 		return nil, false, err
 	}
 
-	res := result.(compressedImageCacheResult)
+	res, ok := result.(compressedImageCacheResult)
+	if !ok {
+		return nil, false, fmt.Errorf("image compression flight returned unexpected type %T", result)
+	}
 	return res.bytes, res.cached, res.err
 }
 

internal/infra/persistence/postgres.go

@@ -21,6 +21,9 @@ import (
 	"gorm.io/plugin/opentelemetry/tracing"
 )
 
+// baseTracingOptionCount 是 newGORMTracingPlugin 预置的 tracing 选项数量。
+const baseTracingOptionCount = 3
+
 var (
 	db *gorm.DB
 )
@@ -106,7 +109,7 @@ func initPostgres() {
 	}
 
 	if len(dbConfig.Replicas) > 0 {
-		var replicaDialectors []gorm.Dialector
+		var replicaDialectors = make([]gorm.Dialector, 0, len(dbConfig.Replicas))
 		for _, replica := range dbConfig.Replicas {
 			username := replica.Username
 			if username == "" {
@@ -156,11 +159,12 @@ func initPostgres() {
 
 // newGORMTracingPlugin 构造数据库链路追踪插件。查询参数只保留占位符，避免凭据等绑定值进入 Span。
 func newGORMTracingPlugin(attrs []attribute.KeyValue, extraOptions ...tracing.Option) gorm.Plugin {
-	options := []tracing.Option{
+	options := make([]tracing.Option, 0, baseTracingOptionCount+len(extraOptions))
+	options = append(options,
 		tracing.WithoutMetrics(),
 		tracing.WithoutQueryVariables(),
 		tracing.WithAttributes(attrs...),
-	}
+	)
 	options = append(options, extraOptions...)
 	return tracing.NewPlugin(options...)
 }

pkg/cache/disk/cache.go

@@ -123,7 +123,10 @@ func (c *Cache) Set(key string, value []byte, ttl time.Duration) error {
 
 	// Update memory tracker
 	if elem, ok := c.items[key]; ok {
-		item := elem.Value.(*cacheItem)
+		item, ok := elem.Value.(*cacheItem)
+		if !ok {
+			return fmt.Errorf("cache: evict list entry for %q has invalid type %T", key, elem.Value)
+		}
 		c.currentSize += size - item.size
 		item.size = size
 		item.expiredAt = expiredAt
@@ -154,7 +157,11 @@ func (c *Cache) Get(key string) ([]byte, error) {
 		return nil, ErrCacheMiss
 	}
 
-	item := elem.Value.(*cacheItem)
+	item, ok := elem.Value.(*cacheItem)
+	if !ok {
+		c.mu.RUnlock()
+		return nil, ErrCacheMiss
+	}
 	if !item.expiredAt.IsZero() && time.Now().After(item.expiredAt) {
 		c.mu.RUnlock()
 		return c.getAndDeleteIfExpired(key)
@@ -204,7 +211,11 @@ func (c *Cache) getAndDeleteIfExpired(key string) ([]byte, error) {
 		return nil, ErrCacheMiss
 	}
 
-	item := elem.Value.(*cacheItem)
+	item, ok := elem.Value.(*cacheItem)
+	if !ok {
+		_ = c.deleteUnlocked(key)
+		return nil, ErrCacheMiss
+	}
 	if !item.expiredAt.IsZero() && time.Now().After(item.expiredAt) {
 		_ = c.deleteUnlocked(key)
 		return nil, ErrCacheMiss
@@ -234,8 +245,9 @@ func (c *Cache) Delete(key string) error {
 
 func (c *Cache) deleteUnlocked(key string) error {
 	if elem, ok := c.items[key]; ok {
-		item := elem.Value.(*cacheItem)
-		c.currentSize -= item.size
+		if item, ok := elem.Value.(*cacheItem); ok {
+			c.currentSize -= item.size
+		}
 		c.evictList.Remove(elem)
 		delete(c.items, key)
 	}
@@ -288,7 +300,11 @@ func (c *Cache) evict() {
 
 	for c.currentSize > c.maxSize && c.evictList.Len() > 0 {
 		elem := c.evictList.Back()
-		item := elem.Value.(*cacheItem)
+		item, ok := elem.Value.(*cacheItem)
+		if !ok {
+			c.evictList.Remove(elem)
+			continue
+		}
 		c.currentSize -= item.size
 		c.evictList.Remove(elem)
 		delete(c.items, item.key)
@@ -380,7 +396,12 @@ func (c *Cache) cleanExpired() {
 
 	now := time.Now()
 	for key, elem := range c.items {
-		item := elem.Value.(*cacheItem)
+		item, ok := elem.Value.(*cacheItem)
+		if !ok {
+			c.evictList.Remove(elem)
+			delete(c.items, key)
+			continue
+		}
 		if !item.expiredAt.IsZero() && now.After(item.expiredAt) {
 			c.currentSize -= item.size
 			c.evictList.Remove(elem)