openclaw-diag-cli 0.1.3 → 0.2.2

package/diag/07_performance.py

@@ -7,7 +7,6 @@ import glob
 import json
 import os
 import sys
-import tempfile
 from collections import defaultdict
 from datetime import datetime, timezone, timedelta
 from pathlib import Path
@@ -15,45 +14,13 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from ocdiag import cli, output
+from ocdiag.timeutil import parse_msg_ts, parse_obj_ts
+from ocdiag.tokens import fmt_tokens, pct
 
 
 NORMAL_STOPS = {"stop", "end_turn", "toolUse", "tool_calls", ""}
 
 
-def parse_obj_ts(ts_str):
-    if not ts_str:
-        return None
-    try:
-        return datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
-    except Exception:
-        return None
-
-
-def parse_msg_ts(ms):
-    if ms is None:
-        return None
-    try:
-        return datetime.fromtimestamp(int(ms) / 1000, tz=timezone.utc)
-    except Exception:
-        return None
-
-
-def pct(sorted_vals, p):
-    if not sorted_vals:
-        return 0.0
-    n = len(sorted_vals)
-    idx = min(n - 1, int(n * p))
-    return sorted_vals[idx]
-
-
-def fmt_tokens(n):
-    if n >= 1_000_000:
-        return f"{n/1_000_000:.1f}M"
-    if n >= 1_000:
-        return f"{n/1_000:.1f}K"
-    return str(n)
-
-
 def fmt_args(tool_name, tc_args, max_len=100):
     if isinstance(tc_args, str):
         try:
@@ -432,11 +399,18 @@ def render(out: output.Output, data, file_count):
     else:
         for i, (sec, val, hint) in enumerate(bottleneck_items):
             out.item(f"#{i+1}: {sec}（P95={val:.1f}s, {hint}）")
+    out.set_data("bottleneck", {
+        "model_p95": round(model_p95, 3),
+        "tool_p95": round(tool_p95, 3),
+        "model_top": model_top,
+        "tool_top": tool_top,
+    })
 
     out.subsection("模型性能")
     out.item(f"数据来源: 最近 {file_count} 个 session 文件")
     out.line("")
     model_stats = data["model_stats"]
+    models_payload = {}
     if not model_stats:
         out.item("最近 Session 中未发现模型使用数据")
     else:
@@ -481,9 +455,29 @@ def render(out: output.Output, data, file_count):
             stops_str = " ".join(f"{k}:{v}" for k, v in sorted(stops.items(), key=lambda x: -x[1]))
             out.item(f"  stopReasons: {stops_str}" if stops_str else "  stopReasons: (none)")
             out.line("")
+            models_payload[model_key] = {
+                "calls": calls,
+                "p50_s": round(p50, 3),
+                "p95_s": round(p95, 3),
+                "max_s": round(mx, 3),
+                "throughput_tok_s": (
+                    None if s["output"] == 0 or total_dur <= 0
+                    else round(s["output"] / total_dur, 1)
+                ),
+                "input_tokens": s["input"],
+                "output_tokens": s["output"],
+                "cache_read_tokens": s["cache_read"],
+                "cache_write_tokens": s["cache_write"],
+                "cost_usd": round(s["cost"], 6),
+                "success_rate_pct": round(success, 1),
+                "stop_reasons": dict(stops),
+            }
+    out.set_data("models", models_payload)
+    out.set_data("session_files_analyzed", file_count)
 
     out.subsection("工具性能（Top 10 by 调用量）")
     timed_tools = {n: s for n, s in data["tool_stats"].items() if s["durations"]}
+    tools_payload = {}
     if not timed_tools:
         out.item("（无工具调用数据）")
     else:
@@ -491,8 +485,11 @@ def render(out: output.Output, data, file_count):
         for name, s in ranked:
             durs = sorted(s["durations"])
             calls = s["calls"]
+            p50 = pct(durs, 0.50)
+            p95 = pct(durs, 0.95)
+            mx = durs[-1]
             err_rate = (s["errors"] / calls * 100) if calls else 0.0
-            dur_str = f"P50={pct(durs,0.50):.3f}s P95={pct(durs,0.95):.3f}s Max={durs[-1]:.3f}s"
+            dur_str = f"P50={p50:.3f}s P95={p95:.3f}s Max={mx:.3f}s"
             out.item(f"{name}: {calls} 次 | {dur_str} | 错误 {err_rate:.0f}%")
             timed = [r for r in s["records"] if r["dur"] is not None]
             timed.sort(key=lambda r: r["dur"], reverse=True)
@@ -511,6 +508,15 @@ def render(out: output.Output, data, file_count):
                 tail = f", {r['err_brief']}" if r["err_brief"] else ""
                 out.item(f"  失败: {args} (error, {dur_txt}{tail})")
                 err_shown += 1
+            tools_payload[name] = {
+                "calls": calls,
+                "errors": s["errors"],
+                "error_rate_pct": round(err_rate, 1),
+                "p50_s": round(p50, 3),
+                "p95_s": round(p95, 3),
+                "max_s": round(mx, 3),
+            }
+    out.set_data("tools", tools_payload)
 
     out.subsection("慢调用 Top 20")
     slow = sorted(data["slow_calls_top"], key=lambda x: x[0], reverse=True)
@@ -529,12 +535,17 @@ def render(out: output.Output, data, file_count):
     else:
         for i, entry in enumerate(top20, 1):
             out.item(f"[{i}] {entry[2]}")
+    out.set_data("slow_calls_top20", [
+        {"duration_s": round(e[0], 3), "kind": e[1], "summary": e[2]}
+        for e in top20
+    ])
 
     out.subsection("异常 stopReason — 模型非正常结束（如 error、中断）")
     abnormal_stops = data["abnormal_stops"]
     out.item(f"共 {len(abnormal_stops)} 条" + ("（无异常）" if not abnormal_stops else ""))
     for s in abnormal_stops[:20]:
         out.item(s)
+    out.set_data("abnormal_stops", abnormal_stops)
 
     out.subsection("模型 API 错误分布")
     api_err_total = sum(data["api_error_stats"].values())
@@ -548,9 +559,16 @@ def render(out: output.Output, data, file_count):
             out.item("分布:")
             for cat, n in sorted(data["api_error_stats"].items(), key=lambda kv: -kv[1]):
                 out.item(f"  {cat}: {n}")
+    out.set_data("api_errors", {
+        "total_calls": api_total,
+        "error_count": api_err_total,
+        "error_rate_pct": round(api_err_total / api_total * 100, 2) if api_total else 0.0,
+        "by_category": dict(data["api_error_stats"]),
+    })
 
     out.subsection("端到端消息延迟（user 发送 → assistant 最终响应）")
     e2e = data["e2e_latencies"]
+    e2e_payload = {"count": 0}
     if not e2e:
         out.item("（数据不足，未发现 user→assistant 配对）")
     else:
@@ -573,10 +591,19 @@ def render(out: output.Output, data, file_count):
             n = bucket_counts[lbl]
             pct_v = (n / total * 100) if total else 0.0
             out.item(f"  {lbl}: {n} ({pct_v:.1f}%)")
+        e2e_payload = {
+            "count": total,
+            "p50_s": round(p50, 3),
+            "p95_s": round(p95, 3),
+            "max_s": round(mx, 3),
+            "buckets": dict(bucket_counts),
+        }
+    out.set_data("e2e_latency", e2e_payload)
 
     out.subsection("延迟 vs 上下文大小")
     ctx_buckets_def = data["ctx_buckets_def"]
     ctx_durs = data["ctx_bucket_durs"]
+    ctx_payload = {}
     if not any(ctx_durs.get(l) for l, _ in ctx_buckets_def):
         out.item("（数据不足）")
     else:
@@ -585,13 +612,21 @@ def render(out: output.Output, data, file_count):
             durs = sorted(ctx_durs.get(b_label, []))
             if not durs:
                 out.line(f"    {b_label:<14} {0:>8} {'-':>10} {'-':>10}")
+                ctx_payload[b_label] = {"count": 0, "p50_s": None, "p95_s": None}
                 continue
             p50 = pct(durs, 0.50)
             p95 = pct(durs, 0.95)
             out.line(f"    {b_label:<14} {len(durs):>8} {p50:>9.1f}s {p95:>9.1f}s")
+            ctx_payload[b_label] = {
+                "count": len(durs),
+                "p50_s": round(p50, 3),
+                "p95_s": round(p95, 3),
+            }
+    out.set_data("ctx_buckets", ctx_payload)
 
     out.subsection("每日趋势（最近 7 天）")
     daily_stats = data["daily_stats"]
+    daily_payload = []
     if not daily_stats:
         out.item("（数据不足）")
     else:
@@ -602,12 +637,22 @@ def render(out: output.Output, data, file_count):
             d = daily_stats.get(d_key)
             if not d or d["calls"] == 0:
                 out.line(f"    {d_key:<10} {0:>8} {'-':>10} {'-':>14}")
+                daily_payload.append({"date": d_key, "calls": 0,
+                                       "p50_s": None, "output_tokens": 0})
                 continue
             durs = sorted(d["durs"])
             p50 = pct(durs, 0.50) if durs else 0.0
             out.line(f"    {d_key:<10} {d['calls']:>8} {p50:>9.1f}s {fmt_tokens(d['output']):>14}")
+            daily_payload.append({
+                "date": d_key,
+                "calls": d["calls"],
+                "p50_s": round(p50, 3),
+                "output_tokens": d["output"],
+            })
+    out.set_data("daily_trend", daily_payload)
 
     out.subsection("Cache 命中率")
+    cache_payload = {"total_calls": data["cache_total_calls"]}
     if data["cache_total_calls"] == 0:
         out.item("（无数据）")
     else:
@@ -622,17 +667,34 @@ def render(out: output.Output, data, file_count):
             f"cache_write: {fmt_tokens(data['cache_sum_cache_write'])}"
         )
         denom = data["cache_sum_input"] + data["cache_sum_cache_read"]
+        ratio_pct = None
         if denom > 0:
             ratio = data["cache_sum_cache_read"] / denom * 100
+            ratio_pct = round(ratio, 3)
             out.item(
                 f"上下文 cache 占比: cacheRead/(input+cacheRead) = "
                 f"{ratio:.3f}% ({fmt_tokens(data['cache_sum_cache_read'])}/{fmt_tokens(denom)})"
             )
+        cache_payload = {
+            "total_calls": data["cache_total_calls"],
+            "calls_with_cache_read": data["cache_calls_with_cache"],
+            "hit_rate_pct": round(hit_pct, 2),
+            "input_tokens": data["cache_sum_input"],
+            "cache_read_tokens": data["cache_sum_cache_read"],
+            "cache_write_tokens": data["cache_sum_cache_write"],
+            "ctx_cache_ratio_pct": ratio_pct,
+        }
+    out.set_data("cache_hit_rate", cache_payload)
 
     out.subsection("工具错误明细")
     tool_stats = data["tool_stats"]
     err_total = sum(s["errors"] for s in tool_stats.values())
     call_total = sum(s["calls"] for s in tool_stats.values())
+    tool_errors_payload = {
+        "total_errors": err_total,
+        "total_calls": call_total,
+        "by_tool": {},
+    }
     if err_total == 0:
         out.item(f"共 0 次错误 (总调用 {call_total} 次中)")
     else:
@@ -642,13 +704,22 @@ def render(out: output.Output, data, file_count):
             if s["errors"] == 0:
                 continue
             out.line(f"    {name} ({s['errors']}次):")
+            samples = []
             for r in s["error_records"][:3]:
                 ts_label = r["ts"].strftime("%Y-%m-%d %H:%M:%S") if r["ts"] else "?"
                 brief = r["err_brief"] or "(无错误内容)"
                 out.line(f"      {ts_label} | {brief[:100]}")
+                samples.append({"ts": ts_label, "brief": brief[:200]})
+            tool_errors_payload["by_tool"][name] = {
+                "errors": s["errors"],
+                "calls": s["calls"],
+                "samples": samples,
+            }
+    out.set_data("tool_errors", tool_errors_payload)
 
     out.subsection("Session 消耗 Top 5")
     session_stats = data["session_stats"]
+    session_top_payload = []
     if not session_stats:
         out.item("（无数据）")
     else:
@@ -657,12 +728,18 @@ def render(out: output.Output, data, file_count):
         for sid, ss in ranked:
             out.line(f"    {sid:<40} {ss['calls']:>8} "
                      f"{fmt_tokens(ss['tokens']):>10} {ss['duration']:>11.0f}s")
+            session_top_payload.append({
+                "session": sid,
+                "calls": ss["calls"],
+                "tokens": ss["tokens"],
+                "duration_s": round(ss["duration"], 1),
+            })
+    out.set_data("session_top5", session_top_payload)
 
 
 def main() -> int:
     parser = cli.build_common_parser(
         description="模块 7：模型与性能数据",
-        prog="07_performance",
     )
     args = parser.parse_args()
     out = output.init("performance", json_mode=args.json, no_color=args.no_color)
@@ -675,11 +752,6 @@ def main() -> int:
 
     data = analyze_sessions(session_files)
     render(out, data, len(session_files))
-
-    if args.json:
-        out.set_data("model_count", len(data["model_stats"]))
-        out.set_data("session_files_analyzed", len(session_files))
-        out.set_data("e2e_latency_count", len(data["e2e_latencies"]))
     return out.done()
 
 

package/diag/08_sessions.py

@@ -10,69 +10,18 @@ import re
 import sys
 import time
 from collections import defaultdict
-from datetime import datetime, timezone
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from ocdiag import cli, output
+from ocdiag.timeutil import fmt_duration, parse_msg_ts, parse_obj_ts
+from ocdiag.tokens import fmt_tokens, human_size, pct
 
 
 NORMAL_STOPS = {"stop", "end_turn", "toolUse", "tool_calls", ""}
 
 
-def parse_obj_ts(ts_str):
-    if not ts_str:
-        return None
-    try:
-        return datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
-    except Exception:
-        return None
-
-
-def parse_msg_ts(ms):
-    if ms is None:
-        return None
-    try:
-        return datetime.fromtimestamp(int(ms) / 1000, tz=timezone.utc)
-    except Exception:
-        return None
-
-
-def human_size(b):
-    if b < 1024:
-        return f"{b}B"
-    if b < 1048576:
-        return f"{b/1024:.1f}KB"
-    if b < 1073741824:
-        return f"{b/1048576:.1f}MB"
-    return f"{b/1073741824:.1f}GB"
-
-
-def fmt_tokens(n):
-    if n >= 1_000_000:
-        return f"{n/1_000_000:.1f}M"
-    if n >= 1_000:
-        return f"{n/1_000:.1f}K"
-    return str(n)
-
-
-def fmt_duration(sec):
-    if sec < 60:
-        return f"{sec:.0f}s"
-    if sec < 3600:
-        return f"{sec/60:.1f}m"
-    return f"{sec/3600:.1f}h"
-
-
-def pct(sorted_vals, p):
-    if not sorted_vals:
-        return 0.0
-    n = len(sorted_vals)
-    idx = min(n - 1, int(n * p))
-    return sorted_vals[idx]
-
-
 def build_id_to_key_map(agent_dir):
     sess_json = os.path.join(agent_dir, "sessions", "sessions.json")
     id_to_key = {}
@@ -502,7 +451,6 @@ def stuck_dimension(out: output.Output, log_dir: str) -> None:
 def main() -> int:
     parser = cli.build_common_parser(
         description="模块 8：Session 数据采集 + Stuck 探测",
-        prog="08_sessions",
     )
     args = parser.parse_args()
     out = output.init("sessions", json_mode=args.json, no_color=args.no_color)

package/diag/09_plugin_diag.py

@@ -17,6 +17,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from ocdiag import cli, output
 from ocdiag.jsonlog import parse_name
+from ocdiag.sensitive import sanitize_text
 from ocdiag.timeutil import fmt_hms
 
 
@@ -110,13 +111,18 @@ def scan_logs(today_logs):
     for logf in today_logs:
         try:
             fh = open(logf, "r", errors="replace")
-        except Exception:
+        except OSError:
+            # Best-effort: if today's log is unreadable, skip it; the parent
+            # caller still surfaces "no log data" via the empty plugin_diag
+            # output. (We don't fail the whole module for one missing file.)
             continue
         with fh:
             for line in fh:
                 try:
                     o = json.loads(line)
-                except Exception:
+                except (json.JSONDecodeError, ValueError):
+                    # Expected: log files are JSONL; non-JSON lines are emitted
+                    # by Node before logger init. Drop those lines silently.
                     continue
                 plugin, sub = parse_name(o)
                 lvl = o.get("_meta", {}).get("logLevelName", "")
@@ -190,18 +196,23 @@ def scan_logs(today_logs):
 
 
 def load_configured(config_path):
+    """Return {plugin_id: enabled_bool}. Status reported as second return."""
     configured = {}
-    if config_path and os.path.isfile(config_path):
-        try:
-            with open(config_path) as f:
-                cfg = json.load(f)
-            entries = cfg.get("plugins", {}).get("entries", {}) or {}
-            for k, v in entries.items():
-                if isinstance(v, dict):
-                    configured[k] = bool(v.get("enabled", False))
-        except Exception:
-            pass
-    return configured
+    status = {"found": True}
+    if not config_path or not os.path.isfile(config_path):
+        return configured, {"found": False, "reason": "config_not_found",
+                            "checked": config_path or ""}
+    try:
+        with open(config_path) as f:
+            cfg = json.load(f)
+        entries = cfg.get("plugins", {}).get("entries", {}) or {}
+        for k, v in entries.items():
+            if isinstance(v, dict):
+                configured[k] = bool(v.get("enabled", False))
+    except (OSError, json.JSONDecodeError) as e:
+        return configured, {"found": False, "reason": "config_unreadable",
+                            "checked": config_path, "error": str(e)[:200]}
+    return configured, status
 
 
 def load_extensions(oc_home):
@@ -274,7 +285,10 @@ def section_state(out, scan, configured, extensions):
     })
 
 
-def section_errors(out, scan, configured):
+def section_errors(out, scan, configured, unmask=False):
+    def _scrub(s: str) -> str:
+        return s if unmask else sanitize_text(s)
+
     out.subsection("9.2 插件错误/警告")
     plugin_level_counts = scan["plugin_level_counts"]
     plugin_error_samples = scan["plugin_error_samples"]
@@ -313,9 +327,11 @@ def section_errors(out, scan, configured):
         if samples:
             for ts, lvl, text in dedup_messages(samples, max_unique=999):
                 tag = {"ERROR": "E", "FATAL": "F", "WARN": "W"}.get(lvl, "?")
-                snippet = text.replace("\n", " ")
+                snippet = _scrub(text.replace("\n", " "))
                 out.item(f"  [{tag}] {fmt_hms(ts)}: {snippet}")
-                sample_payload.append({"ts": ts, "level": lvl, "msg": text[:300]})
+                sample_payload.append({
+                    "ts": ts, "level": lvl, "msg": _scrub(text[:300]),
+                })
         if err > 0 or warn > 0 or sample_payload:
             errors_payload[p] = {
                 "error_count": err,
@@ -331,9 +347,9 @@ def section_errors(out, scan, configured):
         out.item(f"[plugin-manager]: {len(pm_errors)} ERROR, {len(pm_warns)} WARN, "
                  f"{len(plugin_diag_messages)} total")
         for ts, _lvl, text in dedup_messages(pm_errors, max_unique=999):
-            out.item(f"  [E] {fmt_hms(ts)}: {text.replace(chr(10),' ')}")
+            out.item(f"  [E] {fmt_hms(ts)}: {_scrub(text.replace(chr(10),' '))}")
         for ts, _lvl, text in dedup_messages(pm_warns, max_unique=999):
-            out.item(f"  [W] {fmt_hms(ts)}: {text.replace(chr(10),' ')}")
+            out.item(f"  [W] {fmt_hms(ts)}: {_scrub(text.replace(chr(10),' '))}")
     elif plugin_diag_messages:
         out.item(f"[plugin-manager]: 0 ERROR, 0 WARN, {len(plugin_diag_messages)} total")
 
@@ -444,12 +460,15 @@ def walk_urls(val, out_set):
             walk_urls(v, out_set)
 
 
-def section_deps(out, config_path):
+def section_deps(out, config_path, unmask=False):
     out.subsection("9.5 插件外部依赖")
     plugin_deps = {}
     if not (config_path and os.path.isfile(config_path)):
         out.item("未发现已启用插件的外部依赖配置")
         out.set_data("plugin_deps", {})
+        out.set_data("plugin_deps_status",
+                     {"found": False, "reason": "config_not_found",
+                      "checked": config_path or ""})
         return
     try:
         with open(config_path) as f:
@@ -464,8 +483,13 @@ def section_deps(out, config_path):
             walk_urls(pconf, hosts)
             hosts = {h for h in hosts if not h.startswith(("127.", "localhost", "0.0.0.0"))}
             plugin_deps[pid] = hosts
-    except Exception:
-        pass
+    except (OSError, json.JSONDecodeError) as e:
+        out.item(f"配置读取/解析失败: {type(e).__name__}")
+        out.set_data("plugin_deps", {})
+        out.set_data("plugin_deps_status",
+                     {"found": False, "reason": "config_unreadable",
+                      "checked": config_path, "error": str(e)[:200]})
+        return
 
     if not plugin_deps:
         out.item("未发现已启用插件的外部依赖配置")
@@ -509,7 +533,6 @@ def section_deps(out, config_path):
 def main() -> int:
     parser = cli.build_common_parser(
         description="模块 9：插件诊断",
-        prog="09_plugin_diag",
     )
     args = parser.parse_args()
     out = output.init("plugin_diag", json_mode=args.json, no_color=args.no_color)
@@ -519,14 +542,18 @@ def main() -> int:
     today_logs = sorted(glob.glob(os.path.join(args.log_dir, f"openclaw-{today}.log")))
 
     scan = scan_logs(today_logs)
-    configured = load_configured(args.config)
+    configured, configured_status = load_configured(args.config)
     extensions = load_extensions(args.openclaw_home)
+    if not configured_status.get("found", True):
+        out.item(f"配置加载失败: {configured_status.get('reason')} "
+                 f"({configured_status.get('checked')})")
+        out.set_data("configured_status", configured_status)
 
     section_state(out, scan, configured, extensions)
-    section_errors(out, scan, configured)
+    section_errors(out, scan, configured, unmask=args.unmask)
     section_hooks(out, scan)
     section_channels(out, scan)
-    section_deps(out, args.config)
+    section_deps(out, args.config, unmask=args.unmask)
 
     return out.done()
 

package/diag/10_shell_history.py

@@ -12,6 +12,7 @@ from typing import List, Tuple
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from ocdiag import cli, output
+from ocdiag.sensitive import sanitize_text
 
 
 DANGEROUS_RE = re.compile(
@@ -34,26 +35,34 @@ def list_history_files() -> List[str]:
     return [c for c in candidates if os.path.isfile(c)]
 
 
-def read_lines(path: str) -> List[Tuple[int, str]]:
+def read_lines(path: str) -> Tuple[List[Tuple[int, str]], str]:
+    """Read history file. Returns (lines, error_str). error_str=='' on success.
+
+    Permission denied / missing files become an explicit error instead of an
+    empty list, so the caller can distinguish "no commands" from "couldn't read".
+    """
     out: List[Tuple[int, str]] = []
     try:
         with open(path, "r", errors="replace") as f:
             for i, line in enumerate(f, 1):
                 out.append((i, line.rstrip("\n")))
-    except OSError:
-        pass
-    return out
+        return out, ""
+    except OSError as e:
+        return out, f"{type(e).__name__}: {e}"
 
 
 def main() -> int:
     parser = cli.build_common_parser(
         description="模块 10：采集 shell 历史",
-        prog="10_shell_history",
     )
     args = parser.parse_args()
 
     out = output.init("shell_history", json_mode=args.json, no_color=args.no_color)
     out.section("模块 10：命令执行历史")
+
+    def maybe_sanitize(s: str) -> str:
+        return s if args.unmask else sanitize_text(s)
+
     out.line("  系统 shell 历史记录，用于判断是否有人或脚本执行过高危命令"
              "（rm -rf、kill、systemctl stop 等）。")
     out.line("")
@@ -66,7 +75,16 @@ def main() -> int:
 
     files_data = []
     for hfile in history_files:
-        lines = read_lines(hfile)
+        lines, read_err = read_lines(hfile)
+        if read_err:
+            out.item(f"{os.path.basename(hfile)} — 读取失败 ({read_err})")
+            files_data.append({
+                "path": hfile,
+                "found": False,
+                "reason": "unreadable",
+                "error": read_err,
+            })
+            continue
         total = len(lines)
         out.item(f"{os.path.basename(hfile)} — 共 {total} 条记录")
 
@@ -79,7 +97,7 @@ def main() -> int:
 
         if dangerous:
             out.item(f"  高危命令: {len(dangerous)} 条 ")
-            ev = "\n".join(f"{n}: {ln}" for n, ln in dangerous)
+            ev = "\n".join(f"{n}: {maybe_sanitize(ln)}" for n, ln in dangerous)
             out.evidence(f"{hfile} (高危)", ev)
         else:
             out.item("  高危命令: 0 条")
@@ -92,7 +110,7 @@ def main() -> int:
                 f"  OpenClaw 相关命令: 全文 {oc_total} 条，最近 30 条采样 {len(oc_cmds)} 条 — "
                 "用户手动执行的 openclaw 命令"
             )
-            ev = "\n".join(f"{n}: {ln}" for n, ln in oc_cmds)
+            ev = "\n".join(f"{n}: {maybe_sanitize(ln)}" for n, ln in oc_cmds)
             out.evidence(f"{hfile} (openclaw)", ev)
         else:
             out.item("  OpenClaw 相关命令: 0 条")
@@ -100,14 +118,14 @@ def main() -> int:
         recent = lines[-20:]
         if recent:
             out.item("  最近 20 条命令:")
-            ev = "\n".join(ln for _, ln in recent)
+            ev = "\n".join(maybe_sanitize(ln) for _, ln in recent)
             out.evidence(f"{hfile} (最近)", ev)
 
         files_data.append({
             "path": hfile,
             "total_lines": total,
             "dangerous_count": len(dangerous),
-            "dangerous": [{"line": n, "cmd": ln} for n, ln in dangerous],
+            "dangerous": [{"line": n, "cmd": maybe_sanitize(ln)} for n, ln in dangerous],
             "openclaw_count_total": oc_total,
             "openclaw_count_sample_30": len(oc_cmds),
             "recent_count": len(recent),