update

backend/pkg/agentcli/agentcli.go

@@ -96,6 +96,7 @@ func NewEngine(cfg EngineConfig) (*Engine, error) {
 			return nil, fmt.Errorf("Kubernetes 模式缺少集群客户端")
 		}
 		kt := cfg.Kubernetes
+		registry.Register(tools.NewKubernetesDiagnoseTool(kt.Client, kt.Namespace))
 		registry.Register(tools.NewKubernetesGetTool(kt.Client, kt.Namespace))
 		registry.Register(tools.NewPodLogsTool(kt.Client, kt.Namespace, kt.PodName, kt.Container))
 		registry.Register(tools.NewPodExecuteTool(kt.Client, kt.Namespace, kt.PodName, kt.Container, coreCfg.ToolTimeout))

backend/pkg/agentcli/core/agent.go

@@ -116,6 +116,7 @@ type Agent struct {
 	evolver     *evolver.EvolverEngine
 	callback    EventCallback
 	totalTokens int
+	cache       map[string]string
 	mu          sync.Mutex
 }
 
@@ -130,7 +131,7 @@ func NewAgent(client llm.Client, registry *tools.Registry, cfg *Config, sc *safe
 	if cfg.MaxContextTokens <= 0 {
 		cfg.MaxContextTokens = 8000
 	}
-	return &Agent{llm: client, registry: registry, config: cfg, safetyCtl: sc, evolver: ev}
+	return &Agent{llm: client, registry: registry, config: cfg, safetyCtl: sc, evolver: ev, cache: make(map[string]string)}
 }
 
 // SetCallback 注入事件回调 // Logan.Li
@@ -293,6 +294,14 @@ func (a *Agent) processToolCalls(ctx context.Context, calls []llm.ToolCall, hist
 			continue
 		}
 
+		if msg := a.suppressBroadKubernetesGet(tc.Function.Name, args, history); msg != "" {
+			a.emit(Event{Type: EventToolCall, Phase: PhaseToolRunning, Round: round, ToolName: tc.Function.Name, ToolArgs: args, Risk: tools.RiskSafe.Display(), Summary: "工具执行中"})
+			a.emit(Event{Type: EventToolResult, Phase: PhaseObserving, Round: round, ToolName: tc.Function.Name,
+				Output: msg, Success: true, Duration: "0s", OutputSize: len(msg)})
+			obs = append(obs, llm.Message{Role: "tool", ToolCallID: tc.ID, Name: tc.Function.Name, Content: msg})
+			continue
+		}
+
 		risk := a.toolRisk(tool, args)
 		a.emit(Event{Type: EventStatus, Phase: PhaseSafety, Round: round, ToolName: tc.Function.Name, ToolArgs: args, Risk: risk.Display(), Summary: "安全检查"})
 
@@ -315,6 +324,16 @@ func (a *Agent) processToolCalls(ctx context.Context, calls []llm.ToolCall, hist
 
 		// 执行
 		a.emit(Event{Type: EventToolCall, Phase: PhaseToolRunning, Round: round, ToolName: tc.Function.Name, ToolArgs: args, Risk: risk.Display(), Summary: "工具执行中"})
+		if cached, ok := a.cachedToolResult(tc.Function.Name, args); ok {
+			a.emit(Event{Type: EventToolResult, Phase: PhaseObserving, Round: round, ToolName: tc.Function.Name,
+				Output: cached, Success: true, Duration: "0s", OutputSize: len(cached)})
+			records = append(records, evolver.ToolCallRecord{
+				ToolName: tc.Function.Name, Args: args, Output: cached,
+				Duration: 0, Success: true, RiskLevel: int(risk),
+			})
+			obs = append(obs, llm.Message{Role: "tool", ToolCallID: tc.ID, Name: tc.Function.Name, Content: cached})
+			continue
+		}
 		toolStart := time.Now()
 		toolCtx, cancel := context.WithTimeout(ctx, a.config.ToolTimeout)
 		result, execErr := tool.Execute(toolCtx, args)
@@ -346,6 +365,7 @@ func (a *Agent) processToolCalls(ctx context.Context, calls []llm.ToolCall, hist
 
 		a.emit(Event{Type: EventToolResult, Phase: PhaseObserving, Round: round, ToolName: tc.Function.Name,
 			Output: output, Success: success, Duration: dur.Truncate(time.Millisecond).String(), OutputSize: len(output)})
+		a.storeToolResult(tc.Function.Name, args, output, success)
 
 		records = append(records, evolver.ToolCallRecord{
 			ToolName: tc.Function.Name, Args: args, Output: output,
@@ -369,6 +389,82 @@ func (a *Agent) processToolCalls(ctx context.Context, calls []llm.ToolCall, hist
 	return obs, records, failInc
 }
 
+// cachedToolResult 返回同一任务内只读工具的缓存结果，避免 LLM 重复消耗 token。 // Logan.Li
+func (a *Agent) cachedToolResult(toolName string, args map[string]interface{}) (string, bool) {
+	if !cacheableTool(toolName) {
+		return "", false
+	}
+	key := toolCacheKey(toolName, args)
+	if key == "" {
+		return "", false
+	}
+	if out, ok := a.cache[key]; ok {
+		return "已复用本轮任务缓存结果；不要重复查询同一对象，请基于首次结果总结，或改用更具体的 name/status_filter/pod 参数补查。\n\n" + out, true
+	}
+	return "", false
+}
+
+// storeToolResult 缓存成功的只读工具输出。 // Logan.Li
+func (a *Agent) storeToolResult(toolName string, args map[string]interface{}, output string, success bool) {
+	if !success || !cacheableTool(toolName) {
+		return
+	}
+	key := toolCacheKey(toolName, args)
+	if key == "" {
+		return
+	}
+	a.cache[key] = output
+}
+
+func cacheableTool(toolName string) bool {
+	switch toolName {
+	case "kubernetes_diagnose", "kubernetes_get", "pod_logs", "aiops_asset_search", "aiops_alert_list", "aiops_metric_summary":
+		return true
+	default:
+		return false
+	}
+}
+
+func toolCacheKey(toolName string, args map[string]interface{}) string {
+	b, err := json.Marshal(args)
+	if err != nil {
+		return ""
+	}
+	return toolName + ":" + string(b)
+}
+
+// suppressBroadKubernetesGet 在聚合诊断后拦截全量 K8s 查询，迫使模型按异常对象下钻。 // Logan.Li
+func (a *Agent) suppressBroadKubernetesGet(toolName string, args map[string]interface{}, history map[string]int) string {
+	if a.config.Mode != "kubernetes" && a.config.Mode != "k8s" {
+		return ""
+	}
+	if toolName != "kubernetes_get" || !hasDiagnoseHistory(history) {
+		return ""
+	}
+	resource := strings.ToLower(strings.TrimSpace(fmt.Sprint(args["resource"])))
+	name := strings.TrimSpace(fmt.Sprint(args["name"]))
+	labelSelector := strings.TrimSpace(fmt.Sprint(args["label_selector"]))
+	statusFilter := strings.TrimSpace(fmt.Sprint(args["status_filter"]))
+	if name != "" && name != "<nil>" || labelSelector != "" && labelSelector != "<nil>" || statusFilter != "" && statusFilter != "<nil>" {
+		return ""
+	}
+	switch resource {
+	case "pods", "pod", "deployments", "deployment", "deploy", "services", "service", "svc", "nodes", "node", "events", "event":
+		return "已拦截全量 Kubernetes 查询：本轮已经执行过 kubernetes_diagnose，里面包含异常 Workload、异常 Pod、Top Events 和节点摘要。请不要再次拉全量资源；如需补证据，请按诊断结果中的具体对象调用 kubernetes_get(name/status_filter) 或 pod_logs(pod)。"
+	default:
+		return ""
+	}
+}
+
+func hasDiagnoseHistory(history map[string]int) bool {
+	for key, count := range history {
+		if count > 0 && strings.HasPrefix(key, "kubernetes_diagnose:") {
+			return true
+		}
+	}
+	return false
+}
+
 // triggerEvolve 异步触发进化（带超时 + panic 恢复，绝不阻塞主循环） // Logan.Li
 func (a *Agent) triggerEvolve(ctx context.Context, query, serverHost, answer string, records []evolver.ToolCallRecord, success bool, start time.Time) {
 	if a.evolver == nil {
@@ -522,34 +618,46 @@ func (a *Agent) trimMessages(msgs []llm.Message) []llm.Message {
 	return ensureToolMessageIntegrity(result)
 }
 
-// ensureToolMessageIntegrity 确保 tool 消息前面有对应 assistant(tool_calls) // Logan.Li
+// ensureToolMessageIntegrity 确保 assistant(tool_calls) 后紧跟完整 tool 结果组 // Logan.Li
 func ensureToolMessageIntegrity(msgs []llm.Message) []llm.Message {
-	validIDs := make(map[string]bool)
-	for _, m := range msgs {
-		if m.Role == "assistant" {
-			for _, tc := range m.ToolCalls {
-				validIDs[tc.ID] = true
-			}
-		}
-	}
 	out := make([]llm.Message, 0, len(msgs))
-	for i, m := range msgs {
+	for i := 0; i < len(msgs); i++ {
+		m := msgs[i]
 		if m.Role == "tool" {
-			if !validIDs[m.ToolCallID] || i == 0 || msgs[i-1].Role != "assistant" {
-				continue
-			}
-			matched := false
-			for _, tc := range msgs[i-1].ToolCalls {
-				if tc.ID == m.ToolCallID {
-					matched = true
-					break
-				}
-			}
-			if !matched {
-				continue
+			continue
+		}
+		if m.Role != "assistant" || len(m.ToolCalls) == 0 {
+			out = append(out, m)
+			continue
+		}
+
+		required := make(map[string]bool, len(m.ToolCalls))
+		for _, tc := range m.ToolCalls {
+			if tc.ID != "" {
+				required[tc.ID] = true
 			}
 		}
-		out = append(out, m)
+		if len(required) == 0 {
+			continue
+		}
+
+		seen := make(map[string]bool, len(required))
+		tools := make([]llm.Message, 0, len(required))
+		j := i + 1
+		for ; j < len(msgs) && msgs[j].Role == "tool"; j++ {
+			tm := msgs[j]
+			if !required[tm.ToolCallID] || seen[tm.ToolCallID] {
+				continue
+			}
+			seen[tm.ToolCallID] = true
+			tools = append(tools, tm)
+		}
+
+		if len(seen) == len(required) {
+			out = append(out, m)
+			out = append(out, tools...)
+		}
+		i = j - 1
 	}
 	return out
 }

backend/pkg/agentcli/core/agent_test.go

@@ -0,0 +1,98 @@
+package core
+
+import (
+	"testing"
+
+	"ezops/pkg/agentcli/llm"
+)
+
+func TestEnsureToolMessageIntegrityKeepsCompleteMultiToolGroup(t *testing.T) {
+	msgs := []llm.Message{
+		{Role: "system", Content: "sys"},
+		{Role: "user", Content: "查看异常副本"},
+		{Role: "assistant", Content: "并行检查", ToolCalls: []llm.ToolCall{
+			{ID: "call-1", Type: "function", Function: llm.FunctionCall{Name: "kubernetes_get", Arguments: "{}"}},
+			{ID: "call-2", Type: "function", Function: llm.FunctionCall{Name: "kubernetes_get", Arguments: "{}"}},
+			{ID: "call-3", Type: "function", Function: llm.FunctionCall{Name: "kubernetes_get", Arguments: "{}"}},
+		}},
+		{Role: "tool", ToolCallID: "call-1", Name: "kubernetes_get", Content: "deployments"},
+		{Role: "tool", ToolCallID: "call-2", Name: "kubernetes_get", Content: "statefulsets"},
+		{Role: "tool", ToolCallID: "call-3", Name: "kubernetes_get", Content: "pods"},
+	}
+
+	got := ensureToolMessageIntegrity(msgs)
+	if len(got) != len(msgs) {
+		t.Fatalf("完整多工具结果组应全部保留，got=%d want=%d", len(got), len(msgs))
+	}
+	for i := 3; i < len(got); i++ {
+		if got[i].Role != "tool" || got[i].ToolCallID == "" {
+			t.Fatalf("第 %d 条工具结果异常: %+v", i, got[i])
+		}
+	}
+}
+
+func TestEnsureToolMessageIntegrityDropsIncompleteToolGroup(t *testing.T) {
+	msgs := []llm.Message{
+		{Role: "system", Content: "sys"},
+		{Role: "assistant", Content: "并行检查", ToolCalls: []llm.ToolCall{
+			{ID: "call-1", Type: "function", Function: llm.FunctionCall{Name: "kubernetes_get", Arguments: "{}"}},
+			{ID: "call-2", Type: "function", Function: llm.FunctionCall{Name: "kubernetes_get", Arguments: "{}"}},
+		}},
+		{Role: "tool", ToolCallID: "call-1", Name: "kubernetes_get", Content: "deployments"},
+		{Role: "user", Content: "继续"},
+	}
+
+	got := ensureToolMessageIntegrity(msgs)
+	if len(got) != 2 {
+		t.Fatalf("不完整工具结果组应整体丢弃，got=%d want=2: %+v", len(got), got)
+	}
+	if got[0].Role != "system" || got[1].Role != "user" {
+		t.Fatalf("剩余消息异常: %+v", got)
+	}
+}
+
+func TestSuppressBroadKubernetesGetAfterDiagnose(t *testing.T) {
+	agent := NewAgent(nil, nil, &Config{Mode: "kubernetes"}, nil, nil)
+	history := map[string]int{`kubernetes_diagnose:{"namespace":"astralx"}`: 1}
+	msg := agent.suppressBroadKubernetesGet("kubernetes_get", map[string]interface{}{"resource": "pods"}, history)
+	if msg == "" {
+		t.Fatal("expected broad pods query to be suppressed after diagnose")
+	}
+}
+
+func TestSuppressBroadKubernetesGetBlocksAllPodAliasesAfterDiagnose(t *testing.T) {
+	agent := NewAgent(nil, nil, &Config{Mode: "kubernetes"}, nil, nil)
+	history := map[string]int{`kubernetes_diagnose:{"namespace":"astralx","focus":"all"}`: 1}
+	for _, resource := range []string{"pods", "pod"} {
+		msg := agent.suppressBroadKubernetesGet("kubernetes_get", map[string]interface{}{"resource": resource}, history)
+		if msg == "" {
+			t.Fatalf("expected broad %s query to be suppressed after diagnose", resource)
+		}
+	}
+}
+
+func TestSuppressBroadKubernetesGetAllowsFilteredQuery(t *testing.T) {
+	agent := NewAgent(nil, nil, &Config{Mode: "kubernetes"}, nil, nil)
+	history := map[string]int{`kubernetes_diagnose:{"namespace":"astralx"}`: 1}
+	msg := agent.suppressBroadKubernetesGet("kubernetes_get", map[string]interface{}{
+		"resource": "pods", "status_filter": "NotRunning",
+	}, history)
+	if msg != "" {
+		t.Fatalf("expected filtered pods query to pass, got %q", msg)
+	}
+}
+
+func TestSuppressBroadKubernetesGetAllowsStatusFilteredPodsAfterDiagnose(t *testing.T) {
+	agent := NewAgent(nil, nil, &Config{Mode: "kubernetes"}, nil, nil)
+	history := map[string]int{`kubernetes_diagnose:{"namespace":"astralx","focus":"pods"}`: 1}
+	cases := []map[string]interface{}{
+		{"resource": "pods", "status_filter": "NotRunning"},
+		{"resource": "pod", "status_filter": "CrashLoopBackOff"},
+	}
+	for _, args := range cases {
+		msg := agent.suppressBroadKubernetesGet("kubernetes_get", args, history)
+		if msg != "" {
+			t.Fatalf("expected status_filter query to pass for args=%v, got %q", args, msg)
+		}
+	}
+}

backend/pkg/agentcli/guardrail/sanitize.go

@@ -0,0 +1,108 @@
+// Package guardrail 提供 Agent CLI 输入输出治理能力。 // Logan.Li
+package guardrail
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"regexp"
+	"strings"
+)
+
+var sensitivePatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)(bearer\s+)[a-z0-9._~+/=-]{16,}`),
+	regexp.MustCompile(`(?i)((?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|secret[_-]?key)\s*[:=]\s*)[^\s'"&]+`),
+	regexp.MustCompile(`(?i)((?:mysql|postgres|postgresql|redis|mongodb)://[^:\s/@]+:)[^@\s]+(@)`),
+	regexp.MustCompile(`(?is)-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----`),
+	regexp.MustCompile(`(?i)((?:Cookie|Set-Cookie):\s*)[^\r\n]+`),
+	regexp.MustCompile(`(?i)(AKIA[0-9A-Z]{16})`),
+}
+
+var sensitiveKeys = map[string]bool{
+	"password": true, "passwd": true, "pwd": true, "secret": true,
+	"token": true, "api_key": true, "apikey": true, "access_key": true,
+	"secret_key": true, "private_key": true, "cookie": true,
+}
+
+// SanitizeText 脱敏工具输出、LLM 文本和错误信息，避免敏感信息进入前端/DB/记忆。 // Logan.Li
+func SanitizeText(input string) string {
+	if input == "" {
+		return ""
+	}
+	out := input
+	for _, re := range sensitivePatterns {
+		out = re.ReplaceAllStringFunc(out, func(match string) string {
+			if strings.Contains(match, "PRIVATE KEY") {
+				return "[REDACTED_PRIVATE_KEY]"
+			}
+			sub := re.FindStringSubmatch(match)
+			if len(sub) >= 3 {
+				return sub[1] + "[REDACTED]" + sub[2]
+			}
+			if len(sub) >= 2 {
+				return sub[1] + "[REDACTED]"
+			}
+			return "[REDACTED]"
+		})
+	}
+	return out
+}
+
+// SanitizeJSON 脱敏 JSON 文本；非法 JSON 时退回文本脱敏。 // Logan.Li
+func SanitizeJSON(raw string) string {
+	if strings.TrimSpace(raw) == "" {
+		return raw
+	}
+	var v interface{}
+	if err := json.Unmarshal([]byte(raw), &v); err != nil {
+		return SanitizeText(raw)
+	}
+	v = sanitizeValue(v)
+	b, err := json.Marshal(v)
+	if err != nil {
+		return SanitizeText(raw)
+	}
+	return string(b)
+}
+
+func sanitizeValue(v interface{}) interface{} {
+	switch val := v.(type) {
+	case map[string]interface{}:
+		out := make(map[string]interface{}, len(val))
+		for k, item := range val {
+			if sensitiveKeys[strings.ToLower(strings.ReplaceAll(k, "-", "_"))] {
+				out[k] = "[REDACTED]"
+				continue
+			}
+			out[k] = sanitizeValue(item)
+		}
+		return out
+	case []interface{}:
+		for i := range val {
+			val[i] = sanitizeValue(val[i])
+		}
+		return val
+	case string:
+		return SanitizeText(val)
+	default:
+		return val
+	}
+}
+
+// NewTraceID 生成短 trace id，便于串联一次 Agent 任务。 // Logan.Li
+func NewTraceID() string {
+	return "tr-" + randomHex(12)
+}
+
+// NewSpanID 生成短 span id，便于串联工具和消息事件。 // Logan.Li
+func NewSpanID() string {
+	return "sp-" + randomHex(8)
+}
+
+func randomHex(n int) string {
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return "0000000000000000"
+	}
+	return hex.EncodeToString(buf)
+}

backend/pkg/agentcli/guardrail/sanitize_test.go

@@ -0,0 +1,31 @@
+package guardrail
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
+	input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod"
+	got := SanitizeText(input)
+	for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db"} {
+		if strings.Contains(got, leak) {
+			t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
+		}
+	}
+	if !strings.Contains(got, "[REDACTED]") {
+		t.Fatalf("脱敏标记缺失: %s", got)
+	}
+}
+
+func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
+	got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
+	for _, leak := range []string{"p1", "k1"} {
+		if strings.Contains(got, leak) {
+			t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
+		}
+	}
+	if !strings.Contains(got, `"command":"echo ok"`) {
+		t.Fatalf("非敏感字段不应被改写: %s", got)
+	}
+}

backend/pkg/agentcli/prompt/prompt.go

@@ -51,9 +51,10 @@ func BuildSystemPrompt(mode, targetInfo, toolDescs, evolveContext string) string
 	sb.WriteString("1. 破坏性命令（rm -rf /、mkfs、dd 覆写磁盘等）被严格禁止，绝不执行。\n")
 	sb.WriteString("2. 高危操作（删除 Pod、重启 Deployment、扩缩容、换镜像等）需要用户确认后才能执行。\n")
 	if mode == runModeKubernetes {
-		sb.WriteString("3. 排障时优先使用只读工具：kubernetes_get 查资源状态、pod_logs 看日志；确认根因后再 pod_execute 或 kubernetes_action。\n")
-		sb.WriteString("4. 容器内可能没有 systemctl、宿主机路径；不要假设节点级命令可用。\n")
-		sb.WriteString("5. 未选定 Pod 时，用 kubernetes_get 和 pod_logs（带 pod 参数）排障；选定 Pod 后可直接 pod_execute。\n")
+		sb.WriteString("3. 排障时优先使用只读工具；涉及异常副本、集群健康、Pod 异常、ImagePullBackOff、CrashLoopBackOff、探针失败时，第一步必须调用 kubernetes_diagnose。\n")
+		sb.WriteString("4. kubernetes_diagnose 已聚合 Workload/Pod/Event/Node，不要重复拉全量 pods/deployments/events；只针对异常对象补查 pod_logs 或 kubernetes_get name。\n")
+		sb.WriteString("5. 容器内可能没有 systemctl、宿主机路径；不要假设节点级命令可用。\n")
+		sb.WriteString("6. 未选定 Pod 时，用 kubernetes_diagnose 和必要的 pod_logs（带 pod 参数）排障；选定 Pod 后可直接 pod_execute。\n")
 	} else {
 		sb.WriteString("3. 排障时优先使用只读命令（df/ps/cat/grep/tail/systemctl status/journalctl）收集信息，确认根因后再动手修复。\n")
 		sb.WriteString("4. 不要执行任何你不确定后果的命令；宁可多问用户，也不盲目操作。\n")
@@ -70,7 +71,7 @@ func BuildSystemPrompt(mode, targetInfo, toolDescs, evolveContext string) string
 	sb.WriteString("你采用「思考-行动-观察」循环解决任务：\n")
 	sb.WriteString("1. 思考：分析当前状态，决定下一步。在回复中先用简短文字说明你的判断和计划。\n")
 	if mode == runModeKubernetes {
-		sb.WriteString("2. 行动：优先 kubernetes_get / pod_logs；需要容器内信息时用 pod_execute；变更用 kubernetes_action（一次一步）。\n")
+		sb.WriteString("2. 行动：健康巡检/异常副本先用 kubernetes_diagnose；需要细节时对异常对象调用 kubernetes_get / pod_logs；需要容器内信息时用 pod_execute；变更用 kubernetes_action（一次一步）。\n")
 		sb.WriteString("3. 观察：仔细阅读工具输出；pod_execute 输出含 [exit_code=0] 表示成功。\n")
 	} else {
 		sb.WriteString("2. 行动：调用 ssh_execute 执行命令（一次只做关键的、可验证的一步）。\n")
@@ -98,4 +99,4 @@ func FormatToolDescriptions(items []struct{ Name, Desc string }) string {
 		sb.WriteString(fmt.Sprintf("- %s: %s\n", it.Name, it.Desc))
 	}
 	return sb.String()
-}
+}

backend/pkg/agentcli/tools/kubernetes_diagnose.go

@@ -0,0 +1,601 @@
+// kubernetes_diagnose.go - Kubernetes 异常副本与健康诊断聚合工具 // Logan.Li
+package tools
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	k8sclient "ezops/pkg/kubernetesclient"
+)
+
+const defaultDiagnoseLimit = 8
+
+// KubernetesDiagnoseTool 聚合查询异常 Workload、Pod、Event 和节点健康，减少 LLM 反复拉全量资源。 // Logan.Li
+type KubernetesDiagnoseTool struct {
+	client    *k8sclient.Client
+	namespace string
+}
+
+// NewKubernetesDiagnoseTool 创建 Kubernetes 聚合诊断工具。 // Logan.Li
+func NewKubernetesDiagnoseTool(client *k8sclient.Client, namespace string) *KubernetesDiagnoseTool {
+	return &KubernetesDiagnoseTool{client: client, namespace: namespace}
+}
+
+func (t *KubernetesDiagnoseTool) Name() string { return "kubernetes_diagnose" }
+
+func (t *KubernetesDiagnoseTool) Description() string {
+	return "一键诊断 Kubernetes 命名空间健康和异常副本（只读）。优先用于“异常副本、集群健康、Pod 异常、Deployment 不可用、ImagePullBackOff、CrashLoopBackOff”等任务。" +
+		"工具会聚合 Deployment/StatefulSet/DaemonSet/Pod/Event/Node，只返回异常摘要、可能根因和建议补充检查，避免反复查询全量资源。"
+}
+
+func (t *KubernetesDiagnoseTool) Parameters() map[string]interface{} {
+	return map[string]interface{}{
+		"type": "object",
+		"properties": map[string]interface{}{
+			"namespace": map[string]interface{}{
+				"type":        "string",
+				"description": "命名空间；空则使用会话绑定命名空间",
+			},
+			"focus": map[string]interface{}{
+				"type":        "string",
+				"description": "关注点：replicas|pods|events|image|crash|probe|all，默认 all",
+			},
+			"limit": map[string]interface{}{
+				"type":        "integer",
+				"description": "每类最多返回数量，默认 8，最大 20",
+			},
+		},
+	}
+}
+
+func (t *KubernetesDiagnoseTool) RiskLevel() RiskLevel { return RiskSafe }
+
+func (t *KubernetesDiagnoseTool) Execute(ctx context.Context, args map[string]interface{}) (*Result, error) {
+	ns := strings.TrimSpace(StringParam(args, "namespace"))
+	if ns == "" {
+		ns = t.namespace
+	}
+	if ns == "" {
+		return &Result{Success: false, Error: "namespace 不能为空"}, nil
+	}
+	limit := IntParam(args, "limit")
+	if limit <= 0 {
+		limit = defaultDiagnoseLimit
+	}
+	if limit > 20 {
+		limit = 20
+	}
+	focus := strings.ToLower(strings.TrimSpace(StringParam(args, "focus")))
+	if focus == "" {
+		focus = "all"
+	}
+
+	report, err := t.buildReport(ns, focus, limit)
+	if err != nil {
+		return &Result{Success: false, Error: err.Error(), Output: err.Error()}, nil
+	}
+	b, err := json.MarshalIndent(report, "", "  ")
+	if err != nil {
+		return nil, fmt.Errorf("诊断结果 JSON 序列化失败: %w", err)
+	}
+	return &Result{Success: true, Output: string(b)}, nil
+}
+
+type k8sDiagnoseReport struct {
+	Namespace          string                   `json:"namespace"`
+	Focus              string                   `json:"focus"`
+	Summary            k8sDiagnoseSummary       `json:"summary"`
+	AbnormalWorkloads  []k8sWorkloadFinding     `json:"abnormal_workloads"`
+	AbnormalPods       []k8sPodFinding          `json:"abnormal_pods"`
+	TopEvents          []k8sEventFinding        `json:"top_events"`
+	NodeHealth         []k8sNodeFinding         `json:"node_health,omitempty"`
+	LikelyRootCauses   []string                 `json:"likely_root_causes"`
+	RecommendedActions []string                 `json:"recommended_actions"`
+	NextTools          []map[string]interface{} `json:"next_tools"`
+}
+
+type k8sDiagnoseSummary struct {
+	Deployments       int `json:"deployments"`
+	StatefulSets      int `json:"statefulsets"`
+	DaemonSets        int `json:"daemonsets"`
+	Pods              int `json:"pods"`
+	AbnormalWorkloads int `json:"abnormal_workloads"`
+	AbnormalPods      int `json:"abnormal_pods"`
+	WarningEvents     int `json:"warning_events"`
+	NotReadyNodes     int `json:"not_ready_nodes"`
+}
+
+type k8sWorkloadFinding struct {
+	Kind      string `json:"kind"`
+	Namespace string `json:"namespace"`
+	Name      string `json:"name"`
+	Desired   int    `json:"desired"`
+	Ready     int    `json:"ready"`
+	Available int    `json:"available,omitempty"`
+	Reason    string `json:"reason"`
+	Image     string `json:"image,omitempty"`
+}
+
+type k8sPodFinding struct {
+	Namespace string   `json:"namespace"`
+	Name      string   `json:"name"`
+	Status    string   `json:"status"`
+	Reason    string   `json:"reason"`
+	Restarts  int      `json:"restarts"`
+	Node      string   `json:"node"`
+	IP        string   `json:"ip,omitempty"`
+	Image     string   `json:"image,omitempty"`
+	Owner     string   `json:"owner,omitempty"`
+	Messages  []string `json:"messages,omitempty"`
+}
+
+type k8sEventFinding struct {
+	Type     string `json:"type"`
+	Reason   string `json:"reason"`
+	Object   string `json:"object"`
+	Count    int32  `json:"count"`
+	LastSeen string `json:"last_seen,omitempty"`
+	Message  string `json:"message"`
+}
+
+type k8sNodeFinding struct {
+	Name    string `json:"name"`
+	Ready   string `json:"ready"`
+	Reason  string `json:"reason,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+
+func (t *KubernetesDiagnoseTool) buildReport(ns, focus string, limit int) (*k8sDiagnoseReport, error) {
+	pods, err := t.client.ListPods()
+	if err != nil {
+		return nil, fmt.Errorf("获取 Pod 失败: %w", err)
+	}
+	deployments, err := t.client.ListDeployments()
+	if err != nil {
+		return nil, fmt.Errorf("获取 Deployment 失败: %w", err)
+	}
+	statefulsets, err := t.client.ListStatefulSets()
+	if err != nil {
+		return nil, fmt.Errorf("获取 StatefulSet 失败: %w", err)
+	}
+	daemonsets, err := t.client.ListDaemonSets()
+	if err != nil {
+		return nil, fmt.Errorf("获取 DaemonSet 失败: %w", err)
+	}
+	events, err := t.client.ListEvents(ns)
+	if err != nil {
+		return nil, fmt.Errorf("获取 Event 失败: %w", err)
+	}
+	nodes, _ := t.client.ListNodes()
+
+	report := &k8sDiagnoseReport{Namespace: ns, Focus: focus}
+	report.AbnormalWorkloads = diagnoseWorkloads(ns, deployments.Items, statefulsets.Items, daemonsets.Items)
+	report.AbnormalPods = diagnosePods(ns, pods.Items, deployments.Items)
+	report.TopEvents = diagnoseEvents(events.Items, limit)
+	report.NodeHealth = diagnoseNodes(nodes)
+	report.Summary = k8sDiagnoseSummary{
+		Deployments: countDeployments(ns, deployments.Items), StatefulSets: countStatefulSets(ns, statefulsets.Items),
+		DaemonSets: countDaemonSets(ns, daemonsets.Items), Pods: countPods(ns, pods.Items),
+		AbnormalWorkloads: len(report.AbnormalWorkloads), AbnormalPods: len(report.AbnormalPods),
+		WarningEvents: countWarningEvents(events.Items), NotReadyNodes: len(report.NodeHealth),
+	}
+	report.LikelyRootCauses = inferK8sRootCauses(report.AbnormalPods, report.TopEvents)
+	report.RecommendedActions = recommendK8sActions(report.AbnormalPods, report.AbnormalWorkloads)
+	report.NextTools = recommendK8sNextTools(report.AbnormalPods, report.TopEvents, limit)
+	report.AbnormalWorkloads = limitWorkloadFindings(report.AbnormalWorkloads, limit)
+	report.AbnormalPods = limitPodFindings(report.AbnormalPods, limit)
+	return report, nil
+}
+
+func diagnoseWorkloads(ns string, deployments []k8sclient.DeploymentItem, statefulsets []k8sclient.StatefulSetItem, daemonsets []k8sclient.DaemonSetItem) []k8sWorkloadFinding {
+	var out []k8sWorkloadFinding
+	for _, d := range deployments {
+		if d.Metadata.Namespace != ns || d.Spec.Replicas == 0 {
+			continue
+		}
+		if d.Status.ReadyReplicas < d.Spec.Replicas || d.Status.AvailableReplicas < d.Spec.Replicas {
+			out = append(out, k8sWorkloadFinding{
+				Kind: "Deployment", Namespace: d.Metadata.Namespace, Name: d.Metadata.Name,
+				Desired: d.Spec.Replicas, Ready: d.Status.ReadyReplicas, Available: d.Status.AvailableReplicas,
+				Reason: "ready/available replicas less than desired", Image: firstDeploymentImage(d),
+			})
+		}
+	}
+	for _, s := range statefulsets {
+		if s.Metadata.Namespace != ns || s.Spec.Replicas == 0 {
+			continue
+		}
+		if s.Status.ReadyReplicas < s.Spec.Replicas {
+			out = append(out, k8sWorkloadFinding{
+				Kind: "StatefulSet", Namespace: s.Metadata.Namespace, Name: s.Metadata.Name,
+				Desired: s.Spec.Replicas, Ready: s.Status.ReadyReplicas,
+				Reason: "ready replicas less than desired", Image: firstStatefulSetImage(s),
+			})
+		}
+	}
+	for _, d := range daemonsets {
+		if d.Metadata.Namespace != ns || d.Status.DesiredNumberScheduled == 0 {
+			continue
+		}
+		if d.Status.NumberReady < d.Status.DesiredNumberScheduled {
+			out = append(out, k8sWorkloadFinding{
+				Kind: "DaemonSet", Namespace: d.Metadata.Namespace, Name: d.Metadata.Name,
+				Desired: d.Status.DesiredNumberScheduled, Ready: d.Status.NumberReady,
+				Reason: "ready pods less than desired scheduled pods", Image: firstDaemonSetImage(d),
+			})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Kind == out[j].Kind {
+			return out[i].Name < out[j].Name
+		}
+		return out[i].Kind < out[j].Kind
+	})
+	return out
+}
+
+func diagnosePods(ns string, pods []k8sclient.PodItem, deployments []k8sclient.DeploymentItem) []k8sPodFinding {
+	var out []k8sPodFinding
+	for _, p := range pods {
+		if p.Metadata.Namespace != ns {
+			continue
+		}
+		status, reason, restarts, messages := podDiagnosisStatus(p)
+		if !isAbnormalPod(status, reason, restarts) {
+			continue
+		}
+		out = append(out, k8sPodFinding{
+			Namespace: p.Metadata.Namespace, Name: p.Metadata.Name, Status: status, Reason: reason,
+			Restarts: restarts, Node: p.Spec.NodeName, IP: p.Status.PodIP, Image: firstPodImage(p),
+			Owner: inferDeploymentOwner(p, deployments), Messages: messages,
+		})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Reason == out[j].Reason {
+			return out[i].Name < out[j].Name
+		}
+		return podReasonRank(out[i].Reason) < podReasonRank(out[j].Reason)
+	})
+	return out
+}
+
+func podDiagnosisStatus(p k8sclient.PodItem) (string, string, int, []string) {
+	status := p.Status.Phase
+	reason := ""
+	restarts := 0
+	var messages []string
+	for _, cs := range p.Status.ContainerStatuses {
+		if cs.RestartCount > restarts {
+			restarts = cs.RestartCount
+		}
+		if cs.State.Waiting != nil && cs.State.Waiting.Reason != "" {
+			status = cs.State.Waiting.Reason
+			reason = cs.State.Waiting.Reason
+			if cs.State.Waiting.Message != "" {
+				messages = append(messages, truncateK8sText(cs.State.Waiting.Message, 220))
+			}
+		}
+		if cs.LastState.Terminated != nil && cs.LastState.Terminated.Reason != "" {
+			if reason == "" {
+				reason = cs.LastState.Terminated.Reason
+			}
+			msg := fmt.Sprintf("last terminated: %s exit=%d", cs.LastState.Terminated.Reason, cs.LastState.Terminated.ExitCode)
+			messages = append(messages, msg)
+		}
+	}
+	for _, c := range p.Status.Conditions {
+		if c.Type == "Ready" && c.Status != "True" {
+			if reason == "" && c.Reason != "" {
+				reason = c.Reason
+			}
+			if c.Message != "" {
+				messages = append(messages, truncateK8sText(c.Message, 220))
+			}
+		}
+	}
+	if reason == "" {
+		reason = status
+	}
+	return status, reason, restarts, dedupeStrings(messages)
+}
+
+func diagnoseEvents(events []k8sclient.EventItem, limit int) []k8sEventFinding {
+	sort.Slice(events, func(i, j int) bool {
+		return eventTime(events[i]).After(eventTime(events[j]))
+	})
+	var out []k8sEventFinding
+	seen := make(map[string]bool)
+	for _, e := range events {
+		if e.Type != "Warning" && !isImportantEventReason(e.Reason) {
+			continue
+		}
+		key := fmt.Sprintf("%s/%s/%s/%s", e.InvolvedObject.Kind, e.InvolvedObject.Name, e.Reason, e.Message)
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, k8sEventFinding{
+			Type: e.Type, Reason: e.Reason,
+			Object: fmt.Sprintf("%s/%s", e.InvolvedObject.Kind, e.InvolvedObject.Name),
+			Count:  e.Count, LastSeen: eventTime(e).Format(time.RFC3339),
+			Message: truncateK8sText(e.Message, 260),
+		})
+		if len(out) >= limit {
+			break
+		}
+	}
+	return out
+}
+
+func diagnoseNodes(nodes *k8sclient.NodeList) []k8sNodeFinding {
+	if nodes == nil {
+		return nil
+	}
+	var out []k8sNodeFinding
+	for _, n := range nodes.Items {
+		for _, c := range n.Status.Conditions {
+			if c.Type == "Ready" && c.Status != "True" {
+				out = append(out, k8sNodeFinding{Name: n.Metadata.Name, Ready: c.Status, Reason: c.Reason, Message: truncateK8sText(c.Message, 220)})
+				break
+			}
+		}
+	}
+	return out
+}
+
+func inferK8sRootCauses(pods []k8sPodFinding, events []k8sEventFinding) []string {
+	flags := make(map[string]bool)
+	for _, p := range pods {
+		r := strings.ToLower(p.Reason + " " + p.Status)
+		switch {
+		case strings.Contains(r, "imagepull") || strings.Contains(r, "errimagepull"):
+			flags["存在镜像拉取失败，优先检查镜像 tag、Harbor 仓库、imagePullSecrets 和节点到仓库网络。"] = true
+		case strings.Contains(r, "crashloop"):
+			flags["存在容器反复崩溃，优先查看 previous logs、启动参数、依赖连接和最近变更。"] = true
+		case strings.Contains(r, "oom"):
+			flags["存在 OOMKilled 风险，优先检查内存 limit、最近内存趋势和应用内存泄漏。"] = true
+		case strings.Contains(r, "containersnotready") || strings.Contains(r, "unready"):
+			flags["存在容器未就绪，需结合 readiness/liveness probe、事件和应用日志确认。"] = true
+		case strings.Contains(r, "pending") || strings.Contains(r, "failedscheduling"):
+			flags["存在调度失败或 Pending，优先检查节点资源、污点、亲和性和 PVC。"] = true
+		}
+	}
+	for _, e := range events {
+		msg := strings.ToLower(e.Reason + " " + e.Message)
+		if strings.Contains(msg, "liveness probe") || strings.Contains(msg, "readiness probe") {
+			flags["事件显示健康探针失败，需检查探针路径、超时时间、应用响应耗时和依赖服务。"] = true
+		}
+	}
+	return sortedMapKeys(flags)
+}
+
+func recommendK8sActions(pods []k8sPodFinding, workloads []k8sWorkloadFinding) []string {
+	var out []string
+	if len(workloads) > 0 {
+		out = append(out, "先处理 ready/available 副本不足的 Workload，再回查副本是否恢复。")
+	}
+	if hasPodReason(pods, "ImagePullBackOff") || hasPodReason(pods, "ErrImagePull") {
+		out = append(out, "对镜像拉取失败的 Pod，确认镜像 tag 是否存在、仓库权限是否有效、节点能否访问镜像仓库。")
+	}
+	if hasPodReason(pods, "CrashLoopBackOff") {
+		out = append(out, "对 CrashLoopBackOff 的 Pod，补查 previous logs 和启动命令，避免只看当前空日志。")
+	}
+	if hasPodReason(pods, "ContainersNotReady") {
+		out = append(out, "对未就绪 Pod，查看事件中的 readiness/liveness probe 失败原因和应用健康端点耗时。")
+	}
+	if len(out) == 0 {
+		out = append(out, "当前聚合诊断未发现明显异常；如仍有业务问题，继续按服务名查看日志、Ingress、Service selector 和指标。")
+	}
+	return out
+}
+
+func recommendK8sNextTools(pods []k8sPodFinding, events []k8sEventFinding, limit int) []map[string]interface{} {
+	var out []map[string]interface{}
+	for _, p := range pods {
+		if len(out) >= limit {
+			break
+		}
+		if strings.Contains(strings.ToLower(p.Reason), "imagepull") {
+			out = append(out, map[string]interface{}{"tool": "kubernetes_get", "args": map[string]interface{}{"resource": "events", "name": p.Name}})
+			continue
+		}
+		if p.Status == "CrashLoopBackOff" || p.Restarts >= 5 || strings.Contains(strings.ToLower(p.Reason), "notready") {
+			out = append(out, map[string]interface{}{"tool": "pod_logs", "args": map[string]interface{}{"namespace": p.Namespace, "pod": p.Name, "tail": 120}})
+		}
+	}
+	if len(out) == 0 && len(events) > 0 {
+		out = append(out, map[string]interface{}{"tool": "kubernetes_get", "args": map[string]interface{}{"resource": "events"}})
+	}
+	return out
+}
+
+func isAbnormalPod(status, reason string, restarts int) bool {
+	s := strings.ToLower(status + " " + reason)
+	if status != "Running" && status != "Succeeded" && status != "PodCompleted" && status != "Completed" {
+		return true
+	}
+	if strings.Contains(s, "notready") || strings.Contains(s, "crashloop") || strings.Contains(s, "imagepull") || strings.Contains(s, "oom") {
+		return true
+	}
+	return restarts >= 10
+}
+
+func podReasonRank(reason string) int {
+	r := strings.ToLower(reason)
+	switch {
+	case strings.Contains(r, "imagepull"):
+		return 1
+	case strings.Contains(r, "crashloop"):
+		return 2
+	case strings.Contains(r, "oom"):
+		return 3
+	case strings.Contains(r, "notready"):
+		return 4
+	default:
+		return 9
+	}
+}
+
+func inferDeploymentOwner(p k8sclient.PodItem, deployments []k8sclient.DeploymentItem) string {
+	for _, d := range deployments {
+		if d.Metadata.Namespace != p.Metadata.Namespace || d.Spec.Selector == nil {
+			continue
+		}
+		if labelsMatch(p.Metadata.Labels, d.Spec.Selector.MatchLabels) {
+			return "Deployment/" + d.Metadata.Name
+		}
+	}
+	return ""
+}
+
+func firstDeploymentImage(d k8sclient.DeploymentItem) string {
+	if len(d.Spec.Template.Spec.Containers) == 0 {
+		return ""
+	}
+	return d.Spec.Template.Spec.Containers[0].Image
+}
+
+func firstStatefulSetImage(s k8sclient.StatefulSetItem) string {
+	if len(s.Spec.Template.Spec.Containers) == 0 {
+		return ""
+	}
+	return s.Spec.Template.Spec.Containers[0].Image
+}
+
+func firstDaemonSetImage(d k8sclient.DaemonSetItem) string {
+	if len(d.Spec.Template.Spec.Containers) == 0 {
+		return ""
+	}
+	return d.Spec.Template.Spec.Containers[0].Image
+}
+
+func firstPodImage(p k8sclient.PodItem) string {
+	if len(p.Spec.Containers) == 0 {
+		return ""
+	}
+	return p.Spec.Containers[0].Image
+}
+
+func eventTime(e k8sclient.EventItem) time.Time {
+	if !e.LastTimestamp.IsZero() {
+		return e.LastTimestamp
+	}
+	if !e.EventTime.IsZero() {
+		return e.EventTime
+	}
+	return e.FirstTimestamp
+}
+
+func isImportantEventReason(reason string) bool {
+	r := strings.ToLower(reason)
+	return strings.Contains(r, "failed") || strings.Contains(r, "backoff") || strings.Contains(r, "unhealthy")
+}
+
+func countDeployments(ns string, items []k8sclient.DeploymentItem) int {
+	n := 0
+	for _, it := range items {
+		if it.Metadata.Namespace == ns {
+			n++
+		}
+	}
+	return n
+}
+
+func countStatefulSets(ns string, items []k8sclient.StatefulSetItem) int {
+	n := 0
+	for _, it := range items {
+		if it.Metadata.Namespace == ns {
+			n++
+		}
+	}
+	return n
+}
+
+func countDaemonSets(ns string, items []k8sclient.DaemonSetItem) int {
+	n := 0
+	for _, it := range items {
+		if it.Metadata.Namespace == ns {
+			n++
+		}
+	}
+	return n
+}
+
+func countPods(ns string, items []k8sclient.PodItem) int {
+	n := 0
+	for _, it := range items {
+		if it.Metadata.Namespace == ns {
+			n++
+		}
+	}
+	return n
+}
+
+func countWarningEvents(items []k8sclient.EventItem) int {
+	n := 0
+	for _, it := range items {
+		if it.Type == "Warning" {
+			n++
+		}
+	}
+	return n
+}
+
+func hasPodReason(pods []k8sPodFinding, reason string) bool {
+	needle := strings.ToLower(reason)
+	for _, p := range pods {
+		if strings.Contains(strings.ToLower(p.Reason+" "+p.Status), needle) {
+			return true
+		}
+	}
+	return false
+}
+
+func limitWorkloadFindings(items []k8sWorkloadFinding, limit int) []k8sWorkloadFinding {
+	if len(items) <= limit {
+		return items
+	}
+	return items[:limit]
+}
+
+func limitPodFindings(items []k8sPodFinding, limit int) []k8sPodFinding {
+	if len(items) <= limit {
+		return items
+	}
+	return items[:limit]
+}
+
+func truncateK8sText(s string, max int) string {
+	s = strings.TrimSpace(strings.ReplaceAll(s, "\n", " "))
+	if len([]rune(s)) <= max {
+		return s
+	}
+	r := []rune(s)
+	return string(r[:max]) + "..."
+}
+
+func dedupeStrings(items []string) []string {
+	seen := make(map[string]bool)
+	var out []string
+	for _, item := range items {
+		if item == "" || seen[item] {
+			continue
+		}
+		seen[item] = true
+		out = append(out, item)
+	}
+	return out
+}
+
+func sortedMapKeys(m map[string]bool) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}

backend/pkg/agentcli/tools/kubernetes_diagnose_test.go

@@ -0,0 +1,64 @@
+package tools
+
+import (
+	"testing"
+
+	k8sclient "ezops/pkg/kubernetesclient"
+)
+
+func TestPodDiagnosisStatusDetectsWaitingReason(t *testing.T) {
+	pod := k8sclient.PodItem{
+		Status: k8sclient.PodStatus{
+			Phase: "Pending",
+			ContainerStatuses: []k8sclient.ContainerStatus{{
+				Name: "app",
+				State: k8sclient.ContainerStatusState{Waiting: &k8sclient.ContainerStateWaiting{
+					Reason: "ImagePullBackOff", Message: "Back-off pulling image",
+				}},
+			}},
+		},
+	}
+	status, reason, restarts, messages := podDiagnosisStatus(pod)
+	if status != "ImagePullBackOff" || reason != "ImagePullBackOff" {
+		t.Fatalf("unexpected status=%s reason=%s", status, reason)
+	}
+	if restarts != 0 {
+		t.Fatalf("unexpected restarts=%d", restarts)
+	}
+	if len(messages) != 1 {
+		t.Fatalf("expected waiting message, got %v", messages)
+	}
+	if !isAbnormalPod(status, reason, restarts) {
+		t.Fatal("ImagePullBackOff should be abnormal")
+	}
+}
+
+func TestPodDiagnosisStatusDetectsOOMKilled(t *testing.T) {
+	pod := k8sclient.PodItem{
+		Status: k8sclient.PodStatus{
+			Phase: "Running",
+			ContainerStatuses: []k8sclient.ContainerStatus{{
+				Name: "app", Ready: true, RestartCount: 3,
+				LastState: k8sclient.ContainerStatusState{Terminated: &k8sclient.ContainerStateTerminated{
+					Reason: "OOMKilled", ExitCode: 137,
+				}},
+			}},
+		},
+	}
+	status, reason, restarts, _ := podDiagnosisStatus(pod)
+	if status != "Running" || reason != "OOMKilled" || restarts != 3 {
+		t.Fatalf("unexpected status=%s reason=%s restarts=%d", status, reason, restarts)
+	}
+	if !isAbnormalPod(status, reason, restarts) {
+		t.Fatal("OOMKilled should be abnormal")
+	}
+}
+
+func TestIsAbnormalPodByRestartThreshold(t *testing.T) {
+	if !isAbnormalPod("Running", "Running", 10) {
+		t.Fatal("high restart pod should be abnormal")
+	}
+	if isAbnormalPod("Running", "Running", 2) {
+		t.Fatal("healthy running pod should not be abnormal")
+	}
+}