fix(qa): bound docker e2e log replay

scripts/e2e/agent-bundle-mcp-tools-docker.sh

@@ -35,9 +35,9 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker OpenClaw bundle MCP tool availability smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 
-cat "$RUN_LOG"
+docker_e2e_print_log "$RUN_LOG"
 echo "OK"

scripts/e2e/commitments-safety-docker.sh

@@ -31,7 +31,7 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker commitments safety smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 

scripts/e2e/crestodian-first-run-docker.sh

@@ -35,9 +35,9 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker Crestodian first-run smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 
-cat "$RUN_LOG"
+docker_e2e_print_log "$RUN_LOG"
 echo "OK"

scripts/e2e/crestodian-planner-docker.sh

@@ -35,9 +35,9 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker Crestodian planner fallback smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 
-cat "$RUN_LOG"
+docker_e2e_print_log "$RUN_LOG"
 echo "OK"

scripts/e2e/crestodian-rescue-docker.sh

@@ -35,9 +35,9 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker Crestodian rescue smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 
-cat "$RUN_LOG"
+docker_e2e_print_log "$RUN_LOG"
 echo "OK"

scripts/e2e/plugin-binding-command-escape-docker.sh

@@ -40,16 +40,24 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker plugin binding command escape smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 
 if ! node - "$RUN_LOG" <<'NODE'
 const fs = require("node:fs");
 const logPath = process.argv[2];
-const text = fs
-  .readFileSync(logPath, "utf8")
-  .replace(/\x1B\[[0-?]*[ -/]*[@-~]/gu, "");
+const scanBytes = 65536;
+const stat = fs.statSync(logPath);
+const length = Math.min(stat.size, scanBytes);
+const buffer = Buffer.alloc(length);
+const fd = fs.openSync(logPath, "r");
+try {
+  fs.readSync(fd, buffer, 0, length, stat.size - length);
+} finally {
+  fs.closeSync(fd);
+}
+const text = buffer.toString("utf8").replace(/\x1B\[[0-?]*[ -/]*[@-~]/gu, "");
 
 if (!/(?:^|\n)\s*Tests\s+3 passed\b/u.test(text)) {
   console.error("expected focused Vitest summary for exactly 3 passed tests");
@@ -59,7 +67,7 @@ if (!/(?:^|\n)\s*Tests\s+3 passed\b/u.test(text)) {
 NODE
 then
   echo "Docker plugin binding command escape smoke did not stay focused"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit 1
 fi
 

scripts/e2e/session-runtime-context-docker.sh

@@ -32,7 +32,7 @@ set -e
 
 if [ "$status" -ne 0 ]; then
   echo "Docker session runtime context smoke failed"
-  cat "$RUN_LOG"
+  docker_e2e_print_log "$RUN_LOG"
   exit "$status"
 fi
 

scripts/plugin-sdk-surface-report.mjs

@@ -14,7 +14,46 @@ import {
 } from "./lib/plugin-sdk-entries.mjs";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const checkOnly = process.argv.includes("--check");
+function usage() {
+  return `Usage: node scripts/plugin-sdk-surface-report.mjs [--check]
+
+Reports plugin SDK export surface metadata.
+
+Options:
+  --check     Fail when SDK surface budgets are exceeded.
+  -h, --help  Show this help.
+`;
+}
+
+function parseArgs(argv) {
+  const args = { check: false, help: false };
+  for (const arg of argv) {
+    if (arg === "--check") {
+      args.check = true;
+      continue;
+    }
+    if (arg === "--help" || arg === "-h") {
+      args.help = true;
+      continue;
+    }
+    throw new Error(`Unknown plugin SDK surface report option: ${arg}`);
+  }
+  return args;
+}
+
+let cliArgs;
+try {
+  cliArgs = parseArgs(process.argv.slice(2));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+if (cliArgs.help) {
+  process.stdout.write(usage());
+  process.exit(0);
+}
+
+const checkOnly = cliArgs.check;
 const publicEntrypointSet = new Set(publicPluginSdkEntrypoints);
 const localOnlyEntrypointSet = new Set(privateLocalOnlyPluginSdkEntrypoints);
 const deprecatedPublicEntrypointSet = new Set(deprecatedPublicPluginSdkEntrypoints);