fix: sanitize code review routing copy

config.py

@@ -402,7 +402,7 @@ YOUTUBE_API_KEY = os.getenv('YOUTUBE_API_KEY', '')
 # ==========================================
 # 系統版本與路徑
 # ==========================================
-SYSTEM_VERSION = "V10.679"
+SYSTEM_VERSION = "V10.680"
 LOG_FILE_PATH = os.path.join(BASE_DIR, 'logs/system.log')
 public_url = PUBLIC_URL  # 用於模板顯示
 

docs/AI_INTELLIGENCE_MODULE_SOT.md

@@ -756,3 +756,4 @@ POSTGRES_HOST=momo-db
 | 2026-06-25 | 部署監控不得用退役正式域名判定失敗 | V10.677 起 CI/CD 狀態 API 與 active blackbox 監控預設以 `PUBLIC_URL` / `PROD_BASE_URL` 對齊現行正式入口 `https://mo.wooo.work/health`，不再把 `momo.wooo.work` timeout 判成正式部署失敗；Webcrumbs loader fallback 也改為資訊級降級訊號，避免健康頁與 log 產生假紅燈。 |
 | 2026-06-25 | 匯入任務公開摘要不得回傳資料表或本機檔案定位 | V10.678 起 `/api/import_jobs` / `/api/import_job/<id>` 的 `import_summary` 只回傳營運摘要、日期範圍、匯入筆數與同步狀態，不再外露 `table_name`、`synced_to`、`daily_sales_snapshot`、`realtime_sales_monthly`、Google Drive file id 或本機暫存路徑。 |
 | 2026-06-25 | 部署後 Code Review 不得把模型 timeout 寫成部署錯誤 | V10.679 起本地掃描可收斂的 Code Review 報告不再顯示「最後錯誤 / all hosts failed / OpenClaw timeout」等模型內部訊息；歷史 API 讀舊紀錄時也即時轉為「AI 延伸分析暫時略過，已以本地掃描完成部署後檢查」。 |
+| 2026-06-25 | Code Review 歷史理由不得外露模型路由 | V10.680 起 Code Review history 的 `ea_decision.reasoning` 與舊報告讀取層會把 OpenClaw、GCP-A/GCP-B、111 重分析、fallback 等內部模型路由轉成「AI 延伸分析暫時不可用時，維持本地掃描收斂」。 |

services/code_review_pipeline_service.py

@@ -134,12 +134,36 @@ def _public_openclaw_report(report: Any) -> str:
     if not text:
         return ""
     text = _OPENCLAW_RAW_ERROR_RE.sub("；AI 延伸分析暫時略過，已以本地掃描完成部署後檢查", text)
+    text = re.sub(
+        r"GCP-A/GCP-B\s+AI 架構檢查\s+不可用時暫停 111 重分析，避免拖高 fallback 主機負載。",
+        "AI 延伸分析不可用時，以本地掃描收斂，避免拖高模型主機負載。",
+        text,
+    )
     text = text.replace("本地降級報告", "本地掃描報告")
     text = text.replace("deterministic scan", "本地掃描")
     text = text.replace("OpenClaw", "AI 架構檢查")
+    text = text.replace("fallback", "備援")
     return text
 
 
+def _public_ea_decision(ea: Any) -> Dict[str, Any]:
+    if not isinstance(ea, dict):
+        return {}
+    public = dict(ea)
+    reasoning = str(public.get("reasoning") or "")
+    if reasoning:
+        reasoning = re.sub(
+            r"但需優化架構以暫停 GCP-A/GCP-B OpenClaw 不可用時的 111 重分析，避免增加 fallback 主機負載。",
+            "AI 延伸分析暫時不可用時，維持本地掃描收斂，避免影響正式服務。",
+            reasoning,
+        )
+        reasoning = reasoning.replace("OpenClaw", "AI 架構檢查")
+        reasoning = reasoning.replace("deterministic scan", "本地掃描")
+        reasoning = reasoning.replace("fallback", "備援")
+        public["reasoning"] = reasoning
+    return public
+
+
 def _code_review_ollama_host_reachable(host: str) -> bool:
     """Short-circuit dead GCP Ollama hosts before a generate timeout."""
     if not CODE_REVIEW_OLLAMA_HOST_PREFLIGHT_ENABLED:
@@ -1219,7 +1243,7 @@ def get_history(limit: int = 20) -> List[Dict]:
                 "auto_fix":         meta.get("auto_fix_triggered", False),
                 "findings":         content.get("findings", []),
                 "openclaw_report":  _public_openclaw_report(content.get("openclaw_report", "")),
-                "ea_decision":      content.get("ea_decision", {}),
+                "ea_decision":      _public_ea_decision(content.get("ea_decision", {})),
                 "created_at":       r[4].isoformat() if r[4] else "",
                 "status":           r[5] or "active",
             })

tests/test_code_review_claude_routing.py

@@ -490,6 +490,7 @@ def test_openclaw_skips_111_and_cloud_by_default_when_gcp_pair_fails(monkeypatch
     assert "本地掃描報告" in result
     assert "最後錯誤" not in result
     assert "all hosts failed" not in result
+    assert "OpenClaw" not in result
     assert [call["model"] for call in calls] == ["qwen2.5-coder:7b", "gemma3:4b"]
     assert not any("192.168.0.111" in call["host"] for call in calls)
     fake_claude.generate.assert_not_called()