name: Diagnose Cleanup + claw-api (read-only)

# 只读：①查 claw-api 疯狂刷日志的根因 ②盘点还能安全清理的空间。不删任何东西。
on:
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: SSH read-only scan
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.ECS_HOST }}
          username: ${{ secrets.ECS_USER }}
          password: ${{ secrets.ECS_PASSWORD }}
          command_timeout: 9m
          script: |
            echo "###################### 一、claw-api 刷日志根因 ######################"
            echo "===== pm2 describe claw-api ====="
            pm2 describe claw-api 2>/dev/null | grep -iE "status|restart|uptime|script path|exec cwd|pid|unstable" | head -12
            echo "===== claw-api 日志当前大小(截断后是否又涨) ====="
            ls -lh ~/.pm2/logs/claw-api-out.log ~/.pm2/logs/claw-api-error.log 2>/dev/null
            echo "===== out.log 最近 30 行(它在打印啥) ====="
            tail -30 ~/.pm2/logs/claw-api-out.log 2>/dev/null | cut -c1-240
            echo "===== out.log 最重复的 15 种行(定位刷屏内容) ====="
            tail -4000 ~/.pm2/logs/claw-api-out.log 2>/dev/null | sed -E 's/[0-9]{4}-[0-9:.TZ -]+//g; s/[0-9]+/N/g' | sort | uniq -c | sort -rn | head -15 | cut -c1-200
            echo "===== error.log 最近 20 行 ====="
            tail -20 ~/.pm2/logs/claw-api-error.log 2>/dev/null | cut -c1-240
            echo ""
            echo "###################### 二、还能安全清理什么 ######################"
            echo "===== df ====="; df -h / | tail -1
            echo "===== docker 可回收(images/build cache/volumes) ====="
            (command -v docker >/dev/null && docker system df 2>/dev/null) || echo "(无 docker)"
            echo "  --- dangling 悬空镜像 ---"; (command -v docker >/dev/null && docker images -f dangling=true -q 2>/dev/null | wc -l | xargs echo "  悬空镜像数=") || true
            echo "===== 包管理器缓存 ====="
            du -sh /var/cache/apt 2>/dev/null; du -sh /var/cache/yum 2>/dev/null; du -sh /var/cache/dnf 2>/dev/null
            echo "===== conda 包缓存(可 conda clean) ====="; du -sh /opt/miniconda3/pkgs 2>/dev/null
            echo "===== 各种 cache / pm2日志 / journal ====="
            du -sh ~/.cache 2>/dev/null; du -sh ~/.npm 2>/dev/null; du -sh ~/.pm2/logs 2>/dev/null; journalctl --disk-usage 2>/dev/null
            echo "===== 旧构建备份 / 我留的 .dmbak / *.bak / dist.old ====="
            ls -lh /etc/nginx/conf.d/*.dmbak 2>/dev/null
            find /var/www -maxdepth 3 -type d \( -name "dist.old" -o -name "*.bak" -o -name "backup" \) 2>/dev/null | head
            find /var/www -maxdepth 3 -type f \( -name "*.bak" -o -name "*.tar.gz" -o -name "*.zip" \) -size +50M 2>/dev/null -printf '%s\t%p\n' | sort -rn | head -10 | awk '{printf "  %.2fG\t%s\n",$1/1073741824,$2}'
            echo "===== /data/iot 里是否有 logs/node_modules/缓存(可清) ====="
            du -xh --max-depth=2 /data/iot 2>/dev/null | sort -rh | head -12
            find /data/iot -maxdepth 3 -type d -name node_modules 2>/dev/null -printf '%p\n' | head -8
            echo "===== 其它 >100M 的 .log(别的失控日志) ====="
            find / -xdev -type f -name "*.log" -size +100M 2>/dev/null -printf '%s\t%p\n' | sort -rn | head -12 | awk '{printf "  %.2fG\t%s\n",$1/1073741824,$2}'
            echo "===== coredump / crash ====="
            du -sh /var/lib/systemd/coredump 2>/dev/null; du -sh /var/crash 2>/dev/null; ls /var/crash 2>/dev/null | head
            echo "===== 全盘 Top 25 大目录(复核) ====="
            du -xh --max-depth=3 / 2>/dev/null | sort -rh | head -25
            echo "###################### 扫描完成 ######################"