diff --git a/astrbot/core/utils/trace_store.py b/astrbot/core/utils/trace_store.py
index 9a0be6e9489..01f95a05fd1 100644
--- a/astrbot/core/utils/trace_store.py
+++ b/astrbot/core/utils/trace_store.py
@@ -490,6 +490,8 @@ def list_traces(
         errors: bool = False,
         models: bool = False,
         plugins: bool = False,
+        start_time: int | None = None,
+        end_time: int | None = None,
     ) -> dict:
         """Read one numbered or keyset page, never all stored span bodies.
 
@@ -501,6 +503,8 @@ def list_traces(
             errors: Require an error.
             models: Require an Agent call.
             plugins: Require a plugin call.
+            start_time: Inclusive minimum trace start time, in Unix seconds.
+            end_time: Inclusive maximum trace start time, in Unix seconds.
 
         Returns:
             Summaries, filtered count, next cursor, and storage health.
@@ -515,6 +519,12 @@ def list_traces(
         if page < 1 or (cursor and page != 1):
             raise ValueError("Invalid trace page.")
         conditions, values = [], []
+        if start_time is not None:
+            conditions.append("start_ns >= ?")
+            values.append(start_time * 1_000_000_000)
+        if end_time is not None:
+            conditions.append("start_ns <= ?")
+            values.append(end_time * 1_000_000_000)
         for key, enabled in (
             ("has_errors", errors),
             ("has_models", models),
diff --git a/astrbot/dashboard/api/app.py b/astrbot/dashboard/api/app.py
index 389edbdcb3b..3b15009cfe9 100644
--- a/astrbot/dashboard/api/app.py
+++ b/astrbot/dashboard/api/app.py
@@ -126,7 +126,12 @@ def create_dashboard_asgi_app(
         files=FileService(),
         knowledge_bases=KnowledgeBaseService(core_lifecycle),
         live_chat=LiveChatService(db, core_lifecycle),
-        logs=LogService(log_broker, core_lifecycle.astrbot_config, core=core_lifecycle),
+        logs=LogService(
+            log_broker,
+            core_lifecycle.astrbot_config,
+            core=core_lifecycle,
+            dashboard_static_folder=static_folder,
+        ),
         bots=BotConfigService(core_lifecycle),
         platforms=PlatformService(core_lifecycle),
         providers=ProviderConfigService(core_lifecycle),
diff --git a/astrbot/dashboard/api/logs.py b/astrbot/dashboard/api/logs.py
index da8d5d7601c..9a65a608a0c 100644
--- a/astrbot/dashboard/api/logs.py
+++ b/astrbot/dashboard/api/logs.py
@@ -87,11 +87,18 @@ async def live_logs(
 @router.get("/logs/export")
 async def export_logs(
     redact: bool = Query(default=True),
+    start_time: int | None = Query(default=None, ge=0),
+    end_time: int | None = Query(default=None, ge=0),
     _username: str = Depends(require_dashboard_user),
     service: LogService = Depends(get_service),
 ):
     try:
-        archive_path = await asyncio.to_thread(service.export_logs, redact=redact)
+        archive_path = await asyncio.to_thread(
+            service.export_logs,
+            redact=redact,
+            start_time=start_time,
+            end_time=end_time,
+        )
     except LogServiceError as exc:
         _raise_log_error(exc)
     return FileResponse(
diff --git a/astrbot/dashboard/services/diagnostic_service.py b/astrbot/dashboard/services/diagnostic_service.py
index dc83dd12e09..432eacef79b 100644
--- a/astrbot/dashboard/services/diagnostic_service.py
+++ b/astrbot/dashboard/services/diagnostic_service.py
@@ -8,6 +8,7 @@
 import platform
 import re
 import subprocess
+from datetime import datetime
 from pathlib import Path
 from typing import Any, BinaryIO
 from urllib.parse import quote, quote_plus
@@ -17,7 +18,7 @@
 
 REDACTED = "[REDACTED]"
 _SECRET_KEY = re.compile(
-    r"password|passwd|secret|token$|api[_-]?key|access[_-]?key|private[_-]?key|"
+    r"password|passwd|secret|token$|api[_-]?key|access[_-]?key|private[_-]?key|aes[_-]?key|"
     r"authorization|cookie|credential|(?:client|app|signing|encrypt(?:ion)?)[_-]?key|"
     r"recovery[_-]?code|(?:^|\.)key$|^headers$|^env$",
     re.IGNORECASE,
@@ -26,13 +27,14 @@
 _AUTH = re.compile(r"\b(Bearer|Basic|ApiKey)\s+[^\s\"'<>]+", re.IGNORECASE)
 _COOKIE = re.compile(r"(\b(?:set-cookie|cookie)\s*:\s*)[^\r\n]+", re.IGNORECASE)
 _URL_AUTH = re.compile(r"(https?://)[^/\s@]+@", re.IGNORECASE)
-_ASSIGNMENT = re.compile(
-    r"((?:[\w.-]*(?:token|secret|password|passwd|api[_-]?key|access[_-]?key|"
-    r"(?:client|app|signing|encrypt(?:ion)?)[_-]?key|recovery[_-]?code)"
-    r"[\w.-]*|authorization|cookie|\bkey)[\"']?\s*[:=]\s*)"
-    r"(\"[^\"]*\"|'[^']*'|[^\s&,;}]+)",
+_ASSIGNMENT = re.compile(r"(?<![\w.-])([\w.-]+)[\"']?\s*[:=]\s*")
+_ASSIGNMENT_KEY = re.compile(
+    r"token|secret|password|passwd|api[_-]?key|access[_-]?key|aes[_-]?key|"
+    r"(?:client|app|signing|encrypt(?:ion)?)[_-]?key|recovery[_-]?code|"
+    r"(?:authorization|cookie|\bkey)$",
     re.IGNORECASE,
 )
+_ASSIGNMENT_VALUE = re.compile(r"\"[^\"]*\"|'[^']*'|[^\s&,;}]+")
 _TOKEN = re.compile(
     r"\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|"
     r"eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})"
@@ -49,6 +51,10 @@
     r")(?!\w|\.\w)"
 )
 MAX_LOG_LINE_BYTES = 1024 * 1024
+_LOG_TIMESTAMP = re.compile(
+    r"^\[?(\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}"
+    r"(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?)(?:\]|\s|$)"
+)
 
 
 class DiagnosticRedactor:
@@ -57,6 +63,7 @@ class DiagnosticRedactor:
     def __init__(self, *, enabled: bool = True) -> None:
         self.enabled = enabled
         self.secrets: set[str] = set()
+        self._sorted_secrets: list[str] | None = None
         self.public_ips: dict[str, str] = {}
 
     def collect(self, value: Any, sensitive: bool = False) -> None:
@@ -79,6 +86,7 @@ def collect(self, value: Any, sensitive: bool = False) -> None:
             self.secrets.update(
                 (text, quote(text, safe=""), quote_plus(text), json.dumps(text)[1:-1])
             )
+            self._sorted_secrets = None
 
     def redact(self, value: Any, sensitive: bool = False) -> Any:
         """Return a sanitized copy while retaining containers and boolean flags.
@@ -118,15 +126,59 @@ def text(self, value: str) -> str:
         """
         if not self.enabled:
             return value
-        value = _ANSI.sub("", value)
-        value = _PRIVATE_KEY.sub(REDACTED, value)
-        for secret in sorted(self.secrets, key=len, reverse=True):
-            value = value.replace(secret, REDACTED)
-        value = _AUTH.sub(lambda match: f"{match[1]} {REDACTED}", value)
-        value = _COOKIE.sub(lambda match: f"{match[1]}{REDACTED}", value)
-        value = _URL_AUTH.sub(lambda match: f"{match[1]}{REDACTED}@", value)
-        value = _ASSIGNMENT.sub(lambda match: f"{match[1]}{REDACTED}", value)
-        value = _TOKEN.sub(REDACTED, value)
+        if "\x1b[" in value:
+            value = _ANSI.sub("", value)
+        if "PRIVATE KEY-----" in value:
+            value = _PRIVATE_KEY.sub(REDACTED, value)
+        if self.secrets:
+            if self._sorted_secrets is None:
+                self._sorted_secrets = sorted(self.secrets, key=len, reverse=True)
+            for secret in self._sorted_secrets:
+                value = value.replace(secret, REDACTED)
+        # These cheap substring checks avoid running every regex on ordinary
+        # ASCII log lines. Unicode case-insensitive regex matches can include
+        # characters that lower() does not normalize to the ASCII hint.
+        lowered = value.lower()
+        ascii_only = value.isascii()
+        if not ascii_only or any(
+            prefix in lowered for prefix in ("bearer", "basic", "apikey")
+        ):
+            value = _AUTH.sub(lambda match: f"{match[1]} {REDACTED}", value)
+        if not ascii_only or "cookie" in lowered:
+            value = _COOKIE.sub(lambda match: f"{match[1]}{REDACTED}", value)
+        if "://" in value and "@" in value:
+            value = _URL_AUTH.sub(lambda match: f"{match[1]}{REDACTED}@", value)
+        if not ascii_only or any(
+            hint in lowered
+            for hint in (
+                "token",
+                "secret",
+                "password",
+                "passwd",
+                "key",
+                "code",
+                "authorization",
+                "cookie",
+            )
+        ):
+            # Scan assignment prefixes without consuming ordinary values, which
+            # may themselves contain a nested credential assignment.
+            parts = []
+            end = 0
+            for match in _ASSIGNMENT.finditer(value):
+                if match.start() < end or not _ASSIGNMENT_KEY.search(match[1]):
+                    continue
+                assigned = _ASSIGNMENT_VALUE.match(value, match.end())
+                if assigned is not None:
+                    parts.extend((value[end : match.end()], REDACTED))
+                    end = assigned.end()
+            parts.append(value[end:])
+            value = "".join(parts)
+        if any(
+            prefix in value
+            for prefix in ("sk-", "ghp_", "gho_", "ghu_", "ghs_", "ghr_", "eyJ")
+        ):
+            value = _TOKEN.sub(REDACTED, value)
         parts = []
         end = 0
         for match in _IP_LITERAL.finditer(value):
@@ -136,6 +188,12 @@ def text(self, value: str) -> str:
                 literal[1:-1] if literal.startswith("[") else literal.rstrip(".")
             )
             host, separator, scope = candidate.partition("%")
+            if (
+                ":" in host
+                and "::" not in host
+                and host.count(":") != (6 if "." in host else 7)
+            ):
+                continue
             try:
                 address = ipaddress.ip_address(host)
             except ValueError:
@@ -156,18 +214,29 @@ def text(self, value: str) -> str:
         parts.append(value[end:])
         return "".join(parts)
 
-    def copy_log(self, source: BinaryIO, target: BinaryIO, limit: int) -> bool:
+    def copy_log(
+        self,
+        source: BinaryIO,
+        target: BinaryIO,
+        limit: int,
+        *,
+        start_time: int | None = None,
+        end_time: int | None = None,
+    ) -> bool:
         """Stream complete text lines, skipping oversized lines and private keys.
 
         Args:
             source: An already verified regular file, positioned at its start.
             target: Open ZIP entry for redacted text.
             limit: Maximum source bytes to consume, fixed before reading.
+            start_time: Inclusive minimum record time, in Unix seconds.
+            end_time: Inclusive maximum record time, in Unix seconds.
 
         Returns:
             Whether content was omitted to respect line or file limits.
         """
-        if not self.enabled:
+        filtering = start_time is not None or end_time is not None
+        if not self.enabled and not filtering:
             remaining = limit
             while remaining:
                 chunk = source.read(min(remaining, MAX_LOG_LINE_BYTES))
@@ -179,35 +248,88 @@ def copy_log(self, source: BinaryIO, target: BinaryIO, limit: int) -> bool:
         truncated = False
         oversized = False
         private_key = False
+        pending: list[str] = []
+        pending_bytes = 0
         remaining = limit
+        include_record = not filtering
         while remaining:
             line = source.readline(min(remaining, MAX_LOG_LINE_BYTES + 1))
             if not line:
                 break
             remaining -= len(line)
+            if filtering and not oversized and not private_key:
+                # Timestamp-free continuation lines inherit their record's
+                # selection; content before the first dated record is excluded.
+                prefix = line[:160].decode("utf-8", errors="replace")
+                match = _LOG_TIMESTAMP.match(_ANSI.sub("", prefix))
+                timestamp = None
+                dated_record = match is not None
+                try:
+                    if match is not None:
+                        timestamp = datetime.fromisoformat(
+                            match[1].replace("Z", "+00:00").replace(",", ".")
+                        ).timestamp()
+                    elif prefix.startswith("{"):
+                        record = json.loads(line)
+                        if isinstance(record, dict):
+                            dated_record = True
+                            if "time_unix_nano" in record:
+                                timestamp = int(record["time_unix_nano"]) / 1e9
+                            elif isinstance(record.get("time"), (int, float)):
+                                timestamp = record["time"]
+                            elif "start_time_unix_nano" in record:
+                                timestamp = int(record["start_time_unix_nano"]) / 1e9
+                except (ValueError, TypeError, OverflowError, OSError):
+                    pass
+                if dated_record:
+                    include_record = (
+                        timestamp is not None
+                        and (start_time is None or timestamp >= start_time)
+                        and (end_time is None or timestamp <= end_time)
+                    )
             complete = line.endswith(b"\n") or len(line) <= MAX_LOG_LINE_BYTES
             if oversized or not complete:
                 oversized = not line.endswith(b"\n")
-                truncated = True
-                continue
+                if self.enabled:
+                    truncated = True
+                    continue
             # Never emit a fragment cut at the export boundary: it could be a token.
             if not remaining and not line.endswith(b"\n") and source.read(1):
                 truncated = True
                 break
+            if not self.enabled:
+                if include_record:
+                    target.write(line)
+                continue
             text = line.decode("utf-8", errors="replace")
             if "-----BEGIN " in text and "PRIVATE KEY-----" in text:
-                private_key = True
-                target.write((REDACTED + "\n").encode())
-            if private_key:
+                private_key = not ("-----END " in text and "PRIVATE KEY-----" in text)
+                text = REDACTED + "\n"
+            elif private_key:
                 if "-----END " in text and "PRIVATE KEY-----" in text:
                     private_key = False
                 continue
-            target.write(self.text(text).encode("utf-8"))
+            if not include_record:
+                continue
+            pending.append(text)
+            pending_bytes += len(line)
+            # Keep complete lines together while amortizing regex and ZIP writes
+            # across a bounded batch instead of repeating them for every line.
+            if pending_bytes >= 64 * 1024:
+                target.write(self.text("".join(pending)).encode("utf-8"))
+                pending.clear()
+                pending_bytes = 0
+        if pending:
+            target.write(self.text("".join(pending)).encode("utf-8"))
         return truncated
 
 
 def collect_diagnostics(
-    config: dict, core: Any = None, *, redact: bool = True
+    config: dict,
+    core: Any = None,
+    *,
+    redact: bool = True,
+    webui_version: str | None = None,
 ) -> tuple[dict, DiagnosticRedactor]:
     """Snapshot configuration, plugin status and environment for a log export.
 
@@ -215,6 +337,7 @@ def collect_diagnostics(
         config: Running global configuration.
         core: Running lifecycle, when metadata is available.
         redact: Whether to mask credentials throughout the bundle.
+        webui_version: Version declared by the active WebUI assets, if available.
 
     Returns:
         JSON sections and a redactor seeded from all available credentials.
@@ -281,6 +404,7 @@ def collect_diagnostics(
         pass
     sections["environment.json"] = {
         "astrbot_version": __version__,
+        "webui_version": webui_version,
         "commit": commit,
         "python_version": platform.python_version(),
         "os": platform.system(),
diff --git a/astrbot/dashboard/services/log_service.py b/astrbot/dashboard/services/log_service.py
index fa368ee58ab..08a7511b89b 100644
--- a/astrbot/dashboard/services/log_service.py
+++ b/astrbot/dashboard/services/log_service.py
@@ -16,6 +16,7 @@
 from astrbot.core import LogBroker, logger
 from astrbot.core.config.astrbot_config import AstrBotConfig
 from astrbot.core.config.default import VERSION
+from astrbot.core.dashboard_assets import get_dashboard_version
 from astrbot.core.utils.astrbot_path import get_astrbot_data_path, get_astrbot_temp_path
 from astrbot.core.utils.storage_cleaner import StorageCleaner
 from astrbot.core.utils.trace_store import get_trace_store
@@ -28,11 +29,17 @@ class LogServiceError(Exception):
 
 class LogService:
     def __init__(
-        self, log_broker: LogBroker, config: AstrBotConfig, *, core=None
+        self,
+        log_broker: LogBroker,
+        config: AstrBotConfig,
+        *,
+        core=None,
+        dashboard_static_folder: str | None = None,
     ) -> None:
         self.log_broker = log_broker
         self.config = config
         self.core = core
+        self.dashboard_static_folder = dashboard_static_folder
         self._export_lock = threading.Lock()
 
     @staticmethod
@@ -86,11 +93,19 @@ def get_log_history(self) -> dict:
             logger.error(f"获取日志历史失败: {exc}")
             raise LogServiceError(f"获取日志历史失败: {exc}") from exc
 
-    def export_logs(self, *, redact: bool = True) -> Path:
+    def export_logs(
+        self,
+        *,
+        redact: bool = True,
+        start_time: int | None = None,
+        end_time: int | None = None,
+    ) -> Path:
         """Build one diagnostic ZIP in a worker thread.
 
         Args:
             redact: Mask credentials unless the administrator explicitly opts out.
+            start_time: Inclusive minimum log or trace start time, in Unix seconds.
+            end_time: Inclusive maximum log or trace start time, in Unix seconds.
 
         Returns:
             Private temporary archive; the response removes it after delivery.
@@ -98,14 +113,29 @@ def export_logs(self, *, redact: bool = True) -> Path:
         Raises:
             LogServiceError: If an export is running or safe export is unavailable.
         """
+        if start_time is not None and end_time is not None and start_time > end_time:
+            raise LogServiceError("Start time must not be after end time")
         if not self._export_lock.acquire(blocking=False):
             raise LogServiceError("Another log export is already running")
         archive_path = None
         try:
             sections, redactor = collect_diagnostics(
-                self.config, self.core, redact=redact
+                self.config,
+                self.core,
+                redact=redact,
+                webui_version=asyncio.run(
+                    get_dashboard_version(self.dashboard_static_folder)
+                ),
             )
             cached = list(self.log_broker.log_cache)
+            if start_time is not None or end_time is not None:
+                cached = [
+                    item
+                    for item in cached
+                    if isinstance(item.get("time"), (int, float))
+                    and (start_time is None or item["time"] >= start_time)
+                    and (end_time is None or item["time"] <= end_time)
+                ]
             logs = [
                 str(item.get("data", ""))
                 for item in cached
@@ -131,6 +161,13 @@ def export_logs(self, *, redact: bool = True) -> Path:
                 "astrbot_version": VERSION,
                 "exported_at": time.strftime("%Y-%m-%d %H:%M:%S %z"),
                 "redacted": redact,
+                "time_range": {
+                    "start_time": start_time,
+                    "end_time": end_time,
+                    "disk_log_timezone": list(time.tzname),
+                    "undated_logs": "Only continuations of matching dated records are included when a range is selected.",
+                    "trace_selection": "Trace start time; matching traces retain their complete details.",
+                },
                 "privacy_notice": (
                     "Known credentials are masked and public IP addresses use consistent aliases. Local addresses, conversations and personal data may remain; review before sharing."
                     if redact
@@ -169,7 +206,9 @@ def export_logs(self, *, redact: bool = True) -> Path:
             if trace_path.is_file():
                 try:
                     store = get_trace_store(self.config)
-                    page = store.list_traces(limit=50)
+                    page = store.list_traces(
+                        limit=50, start_time=start_time, end_time=end_time
+                    )
                     history_bytes = 0
                     for summary in page["traces"]:
                         detail = store.get_trace(summary["trace_id"])
@@ -217,8 +256,8 @@ def export_logs(self, *, redact: bool = True) -> Path:
             )
             used_names = {
                 "manifest.json",
-                "memory/logs.txt",
-                "memory/traces.jsonl",
+                "logs/astrbot.in-memory.log",
+                "traces/history.in-memory.jsonl",
                 "traces/history.jsonl",
                 *sections,
             }
@@ -297,7 +336,13 @@ def export_logs(self, *, redact: bool = True) -> Path:
                                 )
                                 continue
                             with archive.open(arcname, "w", force_zip64=True) as target:
-                                truncated = redactor.copy_log(source, target, limit)
+                                truncated = redactor.copy_log(
+                                    source,
+                                    target,
+                                    limit,
+                                    start_time=start_time,
+                                    end_time=end_time,
+                                )
                             budget -= min(info.st_size, 64 * 1024 * 1024, budget)
                             if truncated:
                                 manifest["truncated"].append(arcname)
@@ -307,11 +352,11 @@ def export_logs(self, *, redact: bool = True) -> Path:
                             {"name": arcname, "reason": type(exc).__name__}
                         )
                 archive.writestr(
-                    "memory/logs.txt",
+                    "logs/astrbot.in-memory.log",
                     redactor.text("".join(f"{line}\n" for line in logs)),
                 )
                 archive.writestr(
-                    "memory/traces.jsonl",
+                    "traces/history.in-memory.jsonl",
                     "".join(
                         json.dumps(redactor.redact(trace), ensure_ascii=False) + "\n"
                         for trace in traces
diff --git a/changelogs/unreleased.md b/changelogs/unreleased.md
index ae1c1a30c18..a01be2f2a0f 100644
--- a/changelogs/unreleased.md
+++ b/changelogs/unreleased.md
@@ -52,6 +52,9 @@
 
 ## Logs
 
+- WebUI: Diagnostic export moved from `System Settings → General → Cache` to a dedicated `System Settings → Maintenance → Diagnostics` item.
+- WebUI：诊断包导出入口从 `系统设置 → 常规 → 缓存` 移至独立的 `系统设置 → 维护 → 诊断` 项。
+
 - Add structured source, plugin, platform, and category metadata for in-memory log filtering.
 - Logs: top-row filters → the Filters sidebar, with combined level/source/plugin/platform/keyword filtering and an option to hide user-chat logs.
 - Core source label → System; plugin selectors prefer display names and show IDs as subtitles.
diff --git a/dashboard/src/api/generated/openapi-v1/types.gen.ts b/dashboard/src/api/generated/openapi-v1/types.gen.ts
index 5612c2b7feb..98286cbbbe0 100644
--- a/dashboard/src/api/generated/openapi-v1/types.gen.ts
+++ b/dashboard/src/api/generated/openapi-v1/types.gen.ts
@@ -3733,10 +3733,18 @@ export type GetLogHistoryError = unknown;
 
 export type ExportLogsData = {
     query?: {
+        /**
+         * Inclusive maximum log timestamp or trace start time, in Unix seconds. Omit for no upper bound. Must not be before start_time. Matching traces retain their complete details.
+         */
+        end_time?: number;
         /**
          * Mask recognized credentials. Disable only for private diagnosis.
          */
         redact?: boolean;
+        /**
+         * Inclusive minimum log timestamp or trace start time, in Unix seconds. Omit for no lower bound. Undated standalone log content is excluded when a time bound is set.
+         */
+        start_time?: number;
     };
 };
 
diff --git a/dashboard/src/api/v1.ts b/dashboard/src/api/v1.ts
index 0a5ed42d7a9..a0dae2cab70 100644
--- a/dashboard/src/api/v1.ts
+++ b/dashboard/src/api/v1.ts
@@ -1240,9 +1240,9 @@ export const logApi = {
   history() {
     return typed<{ logs?: OpenConfig[] }>(openApiV1.getLogHistory());
   },
-  exportArchive(redact = true) {
+  exportArchive(redact = true, startTime?: number, endTime?: number) {
     return openApiV1.exportLogs({
-      query: { redact },
+      query: { redact, start_time: startTime, end_time: endTime },
       responseType: 'blob',
     }) as Promise<AxiosResponse<Blob>>;
   },
diff --git a/dashboard/src/components/shared/LogExportButton.vue b/dashboard/src/components/shared/LogExportButton.vue
index 5a6157ad64e..2806278d8fd 100644
--- a/dashboard/src/components/shared/LogExportButton.vue
+++ b/dashboard/src/components/shared/LogExportButton.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref } from "vue";
+import { computed, onBeforeUnmount, ref } from "vue";
 import { logApi } from "@/api/v1";
 import { useModuleI18n } from "@/i18n/composables";
 import { useToast } from "@/utils/toast";
@@ -7,20 +7,73 @@ import { useToast } from "@/utils/toast";
 const { tm } = useModuleI18n("features/console");
 const toast = useToast();
 const exporting = ref(false);
+const exportHint = ref<"stillExporting" | "largeExport" | null>(null);
+let exportTimers: ReturnType<typeof setTimeout>[] = [];
+onBeforeUnmount(() => {
+  for (const timer of exportTimers) clearTimeout(timer);
+  exportTimers = [];
+});
 const dialog = ref(false);
 const redact = ref(true);
+const timeRange = ref<number | "custom">(86400);
+const timeRangeItems = computed(() => [
+  { title: tm("exportLogs.lastHour"), value: 3600 },
+  { title: tm("exportLogs.last12Hours"), value: 43200 },
+  { title: tm("exportLogs.lastDay"), value: 86400 },
+  { title: tm("exportLogs.last3Days"), value: 259200 },
+  { title: tm("exportLogs.customRange"), value: "custom" },
+]);
+const startTime = ref("");
+const endTime = ref("");
+const timeRangeError = computed(() => {
+  if (timeRange.value !== "custom") return "";
+  const start = new Date(startTime.value).getTime();
+  const end = new Date(endTime.value).getTime();
+  return Number.isFinite(start) && Number.isFinite(end) && start <= end
+    ? ""
+    : tm("exportLogs.invalidTimeRange");
+});
 const attachTarget = ref<Element>();
 
 function openDialog() {
   redact.value = true;
+  timeRange.value = 86400;
+  const now = Math.floor(Date.now() / 1000) * 1000;
+  [startTime.value, endTime.value] = [now - 24 * 60 * 60 * 1000, now].map(
+    (timestamp) => {
+      const date = new Date(timestamp);
+      return new Date(timestamp - date.getTimezoneOffset() * 60 * 1000)
+        .toISOString()
+        .slice(0, 19);
+    },
+  );
   attachTarget.value = document.fullscreenElement || undefined;
   dialog.value = true;
 }
 
 async function exportLogs() {
+  if (timeRangeError.value || exporting.value) return;
   exporting.value = true;
+  exportHint.value = null;
+  exportTimers = [
+    setTimeout(() => { exportHint.value = "stillExporting"; }, 5000),
+    setTimeout(() => { exportHint.value = "largeExport"; }, 10000),
+  ];
   try {
-    const response = await logApi.exportArchive(redact.value);
+    const range = timeRange.value;
+    const end =
+      range === "custom"
+        ? Math.floor(new Date(endTime.value).getTime() / 1000)
+        : Math.floor(Date.now() / 1000);
+    const start =
+      range === "custom"
+        ? Math.floor(new Date(startTime.value).getTime() / 1000)
+        : end - range;
+    const response = await logApi.exportArchive(
+      redact.value,
+      start,
+      end,
+    );
     const disposition = String(response.headers["content-disposition"] || "");
     const url = URL.createObjectURL(response.data);
     const anchor = document.createElement("a");
@@ -36,6 +89,9 @@ async function exportLogs() {
   } catch {
     toast.error(tm("exportLogs.failed"));
   } finally {
+    for (const timer of exportTimers) clearTimeout(timer);
+    exportTimers = [];
+    exportHint.value = null;
     exporting.value = false;
   }
 }
@@ -48,6 +104,7 @@ async function exportLogs() {
         v-bind="props"
         size="small"
         variant="tonal"
+        color="primary"
         prepend-icon="mdi-download"
         :loading="exporting"
         @click="openDialog"
@@ -68,6 +125,44 @@ async function exportLogs() {
       }}</v-card-title>
       <v-card-text class="pa-6 pb-2">
         <p>{{ tm("exportLogs.contents") }}</p>
+        <v-select
+          v-model="timeRange"
+          :items="timeRangeItems"
+          :label="tm('exportLogs.timeRange')"
+          :disabled="exporting"
+          variant="outlined"
+          density="comfortable"
+          hide-details
+          class="mt-4"
+        />
+        <template v-if="timeRange === 'custom'">
+          <v-text-field
+            v-model="startTime"
+            type="datetime-local"
+            :label="tm('exportLogs.startTime')"
+            :max="endTime"
+            :disabled="exporting"
+            variant="outlined"
+            density="comfortable"
+            step="1"
+            hide-details
+            class="mt-3"
+          />
+          <v-text-field
+            v-model="endTime"
+            type="datetime-local"
+            :label="tm('exportLogs.endTime')"
+            :min="startTime"
+            :disabled="exporting"
+            :error-messages="timeRangeError"
+            :hint="tm('exportLogs.timeRangeHint')"
+            variant="outlined"
+            density="comfortable"
+            persistent-hint
+            step="1"
+            class="mt-3"
+          />
+        </template>
         <v-checkbox
           v-model="redact"
           :label="tm('exportLogs.redact')"
@@ -79,6 +174,12 @@ async function exportLogs() {
         <v-alert :type="redact ? 'info' : 'warning'" variant="tonal" class="mt-2">{{
           tm(redact ? "exportLogs.privacy" : "exportLogs.rawPrivacy")
         }}</v-alert>
+        <small
+          v-if="exporting && exportHint"
+          class="d-block mt-3 text-medium-emphasis"
+          role="status"
+          aria-live="polite"
+        >{{ tm(`exportLogs.${exportHint}`) }}</small>
       </v-card-text>
       <v-card-actions class="pa-4">
         <v-spacer />
@@ -89,6 +190,7 @@ async function exportLogs() {
           variant="tonal"
           color="primary"
           :loading="exporting"
+          :disabled="Boolean(timeRangeError)"
           @click="exportLogs"
           >{{ tm("exportLogs.download") }}</v-btn
         >
diff --git a/dashboard/src/components/shared/StorageCleanupPanel.vue b/dashboard/src/components/shared/StorageCleanupPanel.vue
index 8b37f0b5808..79d46ba911d 100644
--- a/dashboard/src/components/shared/StorageCleanupPanel.vue
+++ b/dashboard/src/components/shared/StorageCleanupPanel.vue
@@ -12,7 +12,6 @@
                     <v-chip size="small" variant="tonal" class="storage-cleanup-chip">
                         {{ formatBytes(storageStatus.total_bytes || 0) }}
                     </v-chip>
-                    <LogExportButton />
                     <v-menu location="bottom end">
                         <template #activator="{ props }">
                             <v-btn
@@ -55,7 +54,6 @@
 <script setup>
 import { computed, onMounted, ref } from 'vue';
 import { statsApi } from '@/api/v1';
-import LogExportButton from '@/components/shared/LogExportButton.vue';
 import { useModuleI18n } from '@/i18n/composables';
 import { useToastStore } from '@/stores/toast';
 import { askForConfirmation, useConfirmDialog } from '@/utils/confirmDialog';
diff --git a/dashboard/src/i18n/locales/en-US/features/console.json b/dashboard/src/i18n/locales/en-US/features/console.json
index 4f2f2ebaed7..089be29862d 100644
--- a/dashboard/src/i18n/locales/en-US/features/console.json
+++ b/dashboard/src/i18n/locales/en-US/features/console.json
@@ -50,7 +50,19 @@
     "cancel": "Cancel",
     "redact": "Redact credentials (recommended)",
     "rawPrivacy": "Redaction is off: the bundle retains original passwords, keys, tokens, public IPs and other sensitive information. Use only for private diagnosis with someone you trust; do not upload it to public issues or group chats.",
-    "download": "Download bundle"
+    "download": "Download bundle",
+    "startTime": "Start time",
+    "endTime": "End time",
+    "timeRangeHint": "Choose start and end times in your browser’s local time.",
+    "invalidTimeRange": "Select valid times. Start time must not be after end time.",
+    "timeRange": "Log time range",
+    "lastHour": "Last hour",
+    "last12Hours": "Last 12 hours",
+    "lastDay": "Last day",
+    "last3Days": "Last 3 days",
+    "customRange": "Custom",
+    "stillExporting": "Still exporting.",
+    "largeExport": "There is a large amount of log data. Export is still in progress. Please wait."
   },
   "debugHint": {
     "text": "Debug logs can be enabled in \"Configuration File → System → Console Log Level\""
diff --git a/dashboard/src/i18n/locales/en-US/features/settings.json b/dashboard/src/i18n/locales/en-US/features/settings.json
index 0f6bbb95a38..6a7840a1d89 100644
--- a/dashboard/src/i18n/locales/en-US/features/settings.json
+++ b/dashboard/src/i18n/locales/en-US/features/settings.json
@@ -155,6 +155,10 @@
         "cleanupWithTracesSuccess": "Cleared {count} files and {traces} traces, freeing {size}"
       },
       "confirmWithTraces": "Clean {target} now? Historical traces cannot be recovered. Running traces are retained."
+    },
+    "diagnostics": {
+      "title": "Diagnostics",
+      "subtitle": "Export a diagnostic bundle to troubleshoot AstrBot."
     }
   },
   "backup": {
diff --git a/dashboard/src/i18n/locales/ja-JP/features/console.json b/dashboard/src/i18n/locales/ja-JP/features/console.json
index 276aa944272..c83f73ad793 100644
--- a/dashboard/src/i18n/locales/ja-JP/features/console.json
+++ b/dashboard/src/i18n/locales/ja-JP/features/console.json
@@ -50,7 +50,19 @@
     "cancel": "キャンセル",
     "redact": "認証情報をマスクする（推奨）",
     "rawPrivacy": "マスクが無効です。パスワード、キー、トークン、公開 IP などの機密情報が元のまま含まれます。信頼できる相手との非公開の診断にのみ使用し、公開 Issue やグループチャットに投稿しないでください。",
-    "download": "診断パッケージをダウンロード"
+    "download": "診断パッケージをダウンロード",
+    "startTime": "開始日時",
+    "endTime": "終了日時",
+    "timeRangeHint": "ブラウザーの現地時間で開始日時と終了日時を選択してください。",
+    "invalidTimeRange": "有効な日時を選択し、開始日時を終了日時以前にしてください。",
+    "timeRange": "ログの期間",
+    "lastHour": "過去1時間",
+    "last12Hours": "過去12時間",
+    "lastDay": "過去1日",
+    "last3Days": "過去3日",
+    "customRange": "カスタム",
+    "stillExporting": "出力中です。",
+    "largeExport": "ログの量が多いため、出力を続けています。しばらくお待ちください。"
   },
   "debugHint": {
     "text": "Debug ログは「設定ファイル → システム → コンソールログレベル」で有効にできます"
diff --git a/dashboard/src/i18n/locales/ja-JP/features/settings.json b/dashboard/src/i18n/locales/ja-JP/features/settings.json
index 53ab164eecb..477b703716b 100644
--- a/dashboard/src/i18n/locales/ja-JP/features/settings.json
+++ b/dashboard/src/i18n/locales/ja-JP/features/settings.json
@@ -155,6 +155,10 @@
         "cleanupWithTracesSuccess": "{count} ファイルと {traces} 件のトレースを消去し、{size} を解放しました"
       },
       "confirmWithTraces": "{target}を消去しますか？過去のトレースは復元できません。実行中のトレースは保持します。"
+    },
+    "diagnostics": {
+      "title": "診断",
+      "subtitle": "診断パッケージを出力して AstrBot の問題を調査します。"
     }
   },
   "backup": {
diff --git a/dashboard/src/i18n/locales/ru-RU/features/console.json b/dashboard/src/i18n/locales/ru-RU/features/console.json
index f49d956a896..dd60e7c9c3a 100644
--- a/dashboard/src/i18n/locales/ru-RU/features/console.json
+++ b/dashboard/src/i18n/locales/ru-RU/features/console.json
@@ -50,7 +50,19 @@
     "cancel": "Отмена",
     "redact": "Скрывать учётные данные (рекомендуется)",
     "rawPrivacy": "Маскирование отключено: архив содержит исходные пароли, ключи, токены, публичные IP и другие конфиденциальные данные. Используйте его только для частной диагностики с доверенным человеком; не публикуйте в открытых задачах или групповых чатах.",
-    "download": "Скачать архив"
+    "download": "Скачать архив",
+    "startTime": "Начало периода",
+    "endTime": "Конец периода",
+    "timeRangeHint": "Выберите начало и конец периода в местном времени браузера.",
+    "invalidTimeRange": "Выберите корректные даты. Начало периода не может быть позже конца.",
+    "timeRange": "Период журналов",
+    "lastHour": "Последний час",
+    "last12Hours": "Последние 12 часов",
+    "lastDay": "Последний день",
+    "last3Days": "Последние 3 дня",
+    "customRange": "Свой период",
+    "stillExporting": "Экспорт продолжается.",
+    "largeExport": "Журналов много. Экспорт продолжается, пожалуйста, подождите."
   },
   "debugHint": {
     "text": "Для отображения Debug-логов необходимо установить соответствующий уровень в «Конфигурация → Система → Уровень логирования»"
diff --git a/dashboard/src/i18n/locales/ru-RU/features/settings.json b/dashboard/src/i18n/locales/ru-RU/features/settings.json
index a3b76243b22..9b4587c1dcf 100644
--- a/dashboard/src/i18n/locales/ru-RU/features/settings.json
+++ b/dashboard/src/i18n/locales/ru-RU/features/settings.json
@@ -155,6 +155,10 @@
                 "cleanupWithTracesSuccess": "Очищено {count} файлов и {traces} трассировок, освобождено {size}"
             },
             "confirmWithTraces": "Очистить {target}? Историю трассировок нельзя восстановить. Выполняющиеся трассы сохраняются."
+        },
+        "diagnostics": {
+            "title": "Диагностика",
+            "subtitle": "Экспорт диагностического архива для поиска причин неполадок AstrBot."
         }
     },
     "backup": {
diff --git a/dashboard/src/i18n/locales/zh-CN/features/console.json b/dashboard/src/i18n/locales/zh-CN/features/console.json
index 3ec96e5ddb0..3048b4f4567 100644
--- a/dashboard/src/i18n/locales/zh-CN/features/console.json
+++ b/dashboard/src/i18n/locales/zh-CN/features/console.json
@@ -45,12 +45,24 @@
     "button": "导出诊断包",
     "hint": "导出排障所需的日志、Trace、配置、插件状态和运行环境。",
     "failed": "诊断包导出失败，请稍后重试。",
-    "contents": "包含现有磁盘及轮转日志、最近最多 500 条缓存、可用的 Trace 历史、AstrBot 配置、插件状态和运行环境。导出不受页面筛选影响；未开启文件日志或 Trace 也可导出已有内容。",
-    "privacy": "已识别的密码、密钥和 Token 将自动遮盖，公网 IP 替换为包内统一编号；内网、回环等非公网地址保留。日志、Trace 和设置仍可能包含聊天内容、账号及其他个人信息，分享前请检查。文件仅下载到本地。",
+    "contents": "导出 AstrBot 运行日志、追踪日志、配置文件、插件状态和运行环境，用于故障诊断。",
+    "privacy": "将遮盖经过识别的密码、密钥、公网 IP 地址等敏感信息。但仍可能包含聊天内容等信息。分享前请检查，不要发给不可信的人。",
     "cancel": "取消",
     "redact": "脱敏导出（推荐）",
-    "rawPrivacy": "已关闭脱敏：诊断包将保留原始密码、密钥、Token、公网 IP 等敏感信息。仅用于可信的私下排障，请勿上传至公开 Issue 或群聊。",
-    "download": "下载诊断包"
+    "rawPrivacy": "已关闭脱敏，诊断包将保留密码、密钥、Token、公网 IP 等敏感信息。请不要分享至公开 Issue 或群聊。",
+    "download": "下载诊断包",
+    "startTime": "开始时间",
+    "endTime": "结束时间",
+    "timeRangeHint": "按浏览器本地时间选择起止时间。",
+    "invalidTimeRange": "请选择有效的起止时间，开始时间不得晚于结束时间。",
+    "timeRange": "日志时间范围",
+    "lastHour": "近 1 小时",
+    "last12Hours": "近 12 小时",
+    "lastDay": "近 1 天",
+    "last3Days": "近 3 天",
+    "customRange": "自定义",
+    "stillExporting": "仍在导出中。",
+    "largeExport": "日志量大，导出仍在进行，请稍等。"
   },
   "debugHint": {
     "text": "Debug 日志需要在「配置文件 → 系统 → 控制台日志级别」中开启"
diff --git a/dashboard/src/i18n/locales/zh-CN/features/settings.json b/dashboard/src/i18n/locales/zh-CN/features/settings.json
index 5d043d30ef6..8a1c3c31c23 100644
--- a/dashboard/src/i18n/locales/zh-CN/features/settings.json
+++ b/dashboard/src/i18n/locales/zh-CN/features/settings.json
@@ -155,6 +155,10 @@
         "cleanupWithTracesSuccess": "已清理 {count} 个文件和 {traces} 条追踪，释放 {size}"
       },
       "confirmWithTraces": "确定要清理 {target} 吗？历史追踪数据将无法恢复，运行中的追踪会保留。"
+    },
+    "diagnostics": {
+      "title": "诊断",
+      "subtitle": "导出诊断包，帮助排查 AstrBot 运行问题。"
     }
   },
   "backup": {
diff --git a/dashboard/src/views/Settings.vue b/dashboard/src/views/Settings.vue
index e4a869a6892..efcadc4b22c 100644
--- a/dashboard/src/views/Settings.vue
+++ b/dashboard/src/views/Settings.vue
@@ -210,6 +210,16 @@
                                 </div>
                             </div>
 
+                            <div class="settings-item">
+                                <div class="settings-item__label">
+                                    <div class="settings-item__title">{{ tm('system.diagnostics.title') }}</div>
+                                    <div class="settings-item__subtitle">{{ tm('system.diagnostics.subtitle') }}</div>
+                                </div>
+                                <div class="settings-item__control">
+                                    <LogExportButton />
+                                </div>
+                            </div>
+
                             <div class="settings-item">
                                 <div class="settings-item__label">
                                     <div class="settings-item__title">{{ tm('system.restart.title') }}</div>
@@ -482,6 +492,7 @@ import WaitingForRestart from '@/components/shared/WaitingForRestart.vue';
 import ProxySelector from '@/components/shared/ProxySelector.vue';
 import BackupDialog from '@/components/shared/BackupDialog.vue';
 import StorageCleanupPanel from '@/components/shared/StorageCleanupPanel.vue';
+import LogExportButton from '@/components/shared/LogExportButton.vue';
 import DashboardTwoFactorDialog from '@/components/shared/DashboardTwoFactorDialog.vue';
 import ChangelogDialog from '@/components/shared/ChangelogDialog.vue';
 import { restartAstrBot as restartAstrBotRuntime } from '@/utils/restartAstrBot';
diff --git a/docs/en/use/webui.md b/docs/en/use/webui.md
index 465fd956095..3cb1fecf036 100644
--- a/docs/en/use/webui.md
+++ b/docs/en/use/webui.md
@@ -17,6 +17,7 @@ These paths use the current default sidebar with a fixed menu order. Extension i
 | Config → System Config | System Settings → General, Appearance, Network, or Security, depending on the setting |
 | Commands / Command Management | Extensions → Handlers → Command |
 | Standalone MCP / Skills entries | Extensions → MCP Servers / Skills |
+| System Settings → General → Cache → Export diagnostics | System Settings → Maintenance → Diagnostics → Export diagnostics |
 | System Settings → Appearance → Customize Sidebar | Removed; the sidebar uses the default menu layout |
 | Custom Rules / Future Tasks / SubAgents | Custom Rules is under the sidebar `System` group; Future Tasks and SubAgents are under the `Extensions` group |
 
@@ -129,7 +130,7 @@ The page title and section navigation stay fixed while only the settings pane on
 - `Appearance`: theme colors.
 - `Network`: HTTP proxy, Python package sources, and GitHub proxy. For the address to use when AstrBot runs in Docker, see [Deploy with Docker](/en/deploy/astrbot/docker.md).
 - `Security`: WebUI HTTPS, login rate limits, and TOTP.
-- `Maintenance`: backup, restore, and restart.
+- `Maintenance`: backup, restore, diagnostic export, and restart.
 - `OpenAPI`: developer access keys.
 
 System configuration changes save automatically. Check for a successful save message and restart AstrBot if the page indicates that a restart is required.
@@ -168,7 +169,11 @@ Use the `Conversations` tab to find and manage saved conversation records:
 
 The `Logs` tab shows AstrBot runtime logs in real time. You can filter by log level and install missing Pip packages from this page. To view DEBUG logs, first set `Console Log Level` to `DEBUG` under `System Settings → General → Logs`.
 
-Click `Export diagnostics` and confirm the content and privacy notice to download a ZIP. It includes available disk and rotated logs, configured custom logs, up to 500 cached events, available trace history, configuration profiles and routes, plugin versions and status, environment details and a manifest. Existing data remains exportable when file logging or tracing is disabled; missing trace history is recorded without enabling tracing. Trace history is limited to the latest 50 traces and 16 MiB in total. Disk logs are limited to 256 MiB of source data, skipping individual files larger than 64 MiB and, in redacted mode, oversized lines. Truncation and missing items are recorded. Raw databases and plugin source code are excluded. The dialog enables `Redact credentials (recommended)` by default. Recognized credentials are masked, and public IPv4/IPv6 addresses use consistent aliases such as `[PUBLIC_IP_1]` across the bundle. Alternate spellings of the same address share an alias; protocols, ports, paths, local and other non-public addresses remain. No original-address mapping is included. Conversations and personal data may remain; review before sharing. Uncheck this option when diagnosis requires original values. This retains passwords, keys, tokens, public IPs and other sensitive data, and adds `raw` to the filename; share only privately with someone you trust. Reopening the dialog resets the option to enabled. Only authenticated dashboard administrators can download bundles; developer API keys are not accepted. The button in `System Settings → General → Cache` uses the same export.
+Click `Export diagnostics` and confirm the content and privacy notice to download a ZIP. It includes available disk and rotated logs, configured custom logs, up to 500 cached events, available trace history, configuration profiles and routes, plugin versions and status, environment details and a manifest. Existing data remains exportable when file logging or tracing is disabled; missing trace history is recorded without enabling tracing. Trace history is limited to the latest 50 traces and 16 MiB in total. Disk logs are limited to 256 MiB of source data, skipping individual files larger than 64 MiB and, in redacted mode, oversized lines. Truncation and missing items are recorded. Raw databases and plugin source code are excluded. The dialog enables `Redact credentials (recommended)` by default. Recognized credentials are masked, and public IPv4/IPv6 addresses use consistent aliases such as `[PUBLIC_IP_1]` across the bundle. Alternate spellings of the same address share an alias; protocols, ports, paths, local and other non-public addresses remain. No original-address mapping is included. Conversations and personal data may remain; review before sharing. Uncheck this option when diagnosis requires original values. This retains passwords, keys, tokens, public IPs and other sensitive data, and adds `raw` to the filename; share only privately with someone you trust. Reopening the dialog resets the option to enabled. Only authenticated dashboard administrators can download bundles; developer API keys are not accepted. The `Export diagnostics` button under `System Settings → Maintenance → Diagnostics` uses the same export. This settings entry was moved from `System Settings → General → Cache`.
+
+The export dialog offers `Last hour`, `Last 12 hours`, `Last day`, `Last 3 days` and `Custom`, with `Last day` selected by default. Preset ranges are calculated when you click download. Select `Custom` to enter start and end times using your browser’s local time. Only disk logs, cached logs and traces within that range are exported. Timestamp-free continuation lines follow the preceding disk-log record; standalone content without a recognized timestamp is excluded. Disk timestamps without an explicit offset use the server’s local time. Traces are selected by start time and retain their complete details, with the existing limit of the latest 50 matching traces and 16 MiB. Configuration, plugin status and environment details remain current snapshots. The selected range is recorded in `manifest.json`.
+
+In the diagnostic bundle, cached logs are stored in `logs/astrbot.in-memory.log`, cached traces in `traces/history.in-memory.jsonl`, and persisted trace history in `traces/history.jsonl`. The `webui_version` field in `environment.json` records the version declared by the WebUI assets being served, or `null` when unavailable.
 
 Open `Filters` next to the search box to filter by level, source (System/Plugin), individual plugin, and bot platform, or exclude user-chat logs. Combine these conditions with `Search logs`. Plugin menus prefer display names and show plugin IDs as subtitles; `System` replaces the former Core source label.
 
diff --git a/docs/zh/use/webui.md b/docs/zh/use/webui.md
index 6ef574921b8..7420d67ab2e 100644
--- a/docs/zh/use/webui.md
+++ b/docs/zh/use/webui.md
@@ -17,6 +17,7 @@ AstrBot 管理面板具有管理插件、查看日志、可视化配置、查看
 | 配置文件 → 系统配置 | 左下角系统设置 → 常规、外观、网络或安全，按配置用途选择 |
 | 指令管理 | 插件 → 管理行为 → 指令 |
 | 独立 MCP / 技能入口 | 插件 → MCP / 技能 |
+| 系统设置 → 常规 → 缓存 → 导出诊断包 | 系统设置 → 维护 → 诊断 → 导出诊断包 |
 | 系统设置 → 外观 → 自定义侧边栏 | 已移除；侧边栏使用默认菜单布局 |
 | 自定义规则 / 未来任务 / 子代理编排 | 自定义规则位于侧边栏 `系统` 分组，未来任务与子代理编排位于 `扩展功能` 分组 |
 
@@ -129,7 +130,7 @@ ChatUI 支持以下常用能力：
 - `外观`：主题颜色。
 - `网络`：HTTP 代理、Python 依赖源和 GitHub 加速地址。Docker 下的代理填法见 [Docker 部署](/deploy/astrbot/docker.md)。
 - `安全`：WebUI HTTPS、登录限速和 TOTP。
-- `维护`：备份、恢复和重启。
+- `维护`：备份、恢复、诊断包导出和重启。
 - `OpenAPI`：开发者访问密钥。
 
 系统配置修改后自动保存，请确认保存成功提示；如果页面提示需要重启，再按提示重启 AstrBot。
@@ -168,7 +169,11 @@ ChatUI 支持以下常用能力：
 
 `日志` 页面显示 AstrBot 的实时运行日志，可以按日志级别筛选，也可以从页面中安装缺失的 Pip 库。需要查看 DEBUG 日志时，请先在 `系统设置 → 常规 → 日志` 中将 `控制台日志级别` 设为 `DEBUG`。
 
-点击右上角的 `导出诊断包`，确认内容与隐私提示后下载 ZIP。包内包含现有磁盘及轮转日志、自定义路径日志、最近最多 500 条缓存、可用的 Trace 历史、配置及路由、插件版本与状态、运行环境和导出清单。未开启文件日志或 Trace 时，仍可导出已有内容；没有 Trace 历史时会在清单中注明，不会自动开启 Trace。Trace 历史最多导出最近 50 条、合计 16 MiB；磁盘日志合计最多读取 256 MiB、单文件超过 64 MiB 时会跳过，脱敏模式下过长的日志行也会跳过，截断和缺失会记入清单，不包含原始数据库或插件源码。导出弹窗默认勾选 `脱敏导出（推荐）`，自动遮盖已识别的凭据，公网 IPv4/IPv6 地址替换为包内一致的 `[PUBLIC_IP_1]` 等编号，保留协议、端口、路径及内网、回环等非公网地址；同一 IP 的不同写法使用同一编号，不在包内附带原始 IP 对照表，但仍可能包含聊天内容和个人信息，分享前请检查。排障需要原始内容时可取消勾选；此时会保留密码、密钥、Token、公网 IP 等敏感信息，文件名带有 `raw` 标记，请仅私下提供给可信的诊断人员，勿公开上传。每次打开弹窗都会恢复默认勾选。仅控制台管理员可下载，开发者 API Key 不可使用。`系统设置 → 常规 → 缓存` 面板中的按钮使用同一功能。
+点击右上角的 `导出诊断包`，确认内容与隐私提示后下载 ZIP。包内包含现有磁盘及轮转日志、自定义路径日志、最近最多 500 条缓存、可用的 Trace 历史、配置及路由、插件版本与状态、运行环境和导出清单。未开启文件日志或 Trace 时，仍可导出已有内容；没有 Trace 历史时会在清单中注明，不会自动开启 Trace。Trace 历史最多导出最近 50 条、合计 16 MiB；磁盘日志合计最多读取 256 MiB、单文件超过 64 MiB 时会跳过，脱敏模式下过长的日志行也会跳过，截断和缺失会记入清单，不包含原始数据库或插件源码。导出弹窗默认勾选 `脱敏导出（推荐）`，自动遮盖已识别的凭据，公网 IPv4/IPv6 地址替换为包内一致的 `[PUBLIC_IP_1]` 等编号，保留协议、端口、路径及内网、回环等非公网地址；同一 IP 的不同写法使用同一编号，不在包内附带原始 IP 对照表，但仍可能包含聊天内容和个人信息，分享前请检查。排障需要原始内容时可取消勾选；此时会保留密码、密钥、Token、公网 IP 等敏感信息，文件名带有 `raw` 标记，请仅私下提供给可信的诊断人员，勿公开上传。每次打开弹窗都会恢复默认勾选。仅控制台管理员可下载，开发者 API Key 不可使用。`系统设置 → 维护 → 诊断` 中的 `导出诊断包` 按钮使用同一功能；原 `系统设置 → 常规 → 缓存` 中的导出入口已移至此处。
+
+导出弹窗提供 `近 1 小时`、`近 12 小时`、`近 1 天`、`近 3 天` 和 `自定义`，默认选择 `近 1 天`。快捷范围按点击下载时的当前时间计算；选择 `自定义` 后可按浏览器本地时间填写开始和结束时间。仅导出范围内的磁盘日志、缓存日志和 Trace；磁盘日志中的无时间戳续行跟随上一条记录，无法关联到带时间戳记录的内容会排除。磁盘日志未注明时区时按服务端本地时间解析。Trace 按开始时间筛选并保留完整链路，范围内仍最多导出最近 50 条、合计 16 MiB。配置、插件状态和运行环境为导出时的当前快照，所选范围记录在 `manifest.json` 中。
+
+诊断包中的内存日志位于 `logs/astrbot.in-memory.log`，内存 Trace 位于 `traces/history.in-memory.jsonl`，持久化 Trace 历史位于 `traces/history.jsonl`。`environment.json` 的 `webui_version` 记录当前提供服务的 WebUI 资源版本，无法读取时为 `null`。
 
 点击搜索框左侧的“过滤器”，在日志容器左侧按日志级别、来源（系统/插件）、具体插件、机器人平台筛选，也可排除用户对话日志；这些条件可与“搜索日志”叠加使用。插件优先显示 display name，菜单副标题显示插件 ID；“系统”对应原先的 Core 来源。
 
diff --git a/openspec/openapi-v1.yaml b/openspec/openapi-v1.yaml
index 3a22c1d3e80..3eb7b95a3b8 100644
--- a/openspec/openapi-v1.yaml
+++ b/openspec/openapi-v1.yaml
@@ -5101,6 +5101,14 @@ paths:
           in: query
           description: Mask recognized credentials. Disable only for private diagnosis.
           schema: {type: boolean, default: true}
+        - name: start_time
+          in: query
+          description: Inclusive minimum log timestamp or trace start time, in Unix seconds. Omit for no lower bound. Undated standalone log content is excluded when a time bound is set.
+          schema: {type: integer, minimum: 0}
+        - name: end_time
+          in: query
+          description: Inclusive maximum log timestamp or trace start time, in Unix seconds. Omit for no upper bound. Must not be before start_time. Matching traces retain their complete details.
+          schema: {type: integer, minimum: 0}
       responses:
         "200":
           description: Diagnostic ZIP. With redact=false it contains original sensitive values; personal data may remain in either mode.
diff --git a/tests/test_fastapi_v1_dashboard.py b/tests/test_fastapi_v1_dashboard.py
index ba9fb8bd9dd..b0543377b05 100644
--- a/tests/test_fastapi_v1_dashboard.py
+++ b/tests/test_fastapi_v1_dashboard.py
@@ -7,6 +7,7 @@
 import time
 import zipfile
 from dataclasses import dataclass
+from datetime import datetime
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import AsyncMock, Mock
@@ -4389,19 +4390,19 @@ async def test_v1_log_export_packs_log_files_and_memory_logs(
             "external/2/custom.log",
             "external/custom.1.log",
             "external/custom.log",
+            "logs/astrbot.in-memory.log",
             "logs/event_loop_watchdog.log",
             "manifest.json",
-            "memory/logs.txt",
-            "memory/traces.jsonl",
             "plugins.json",
+            "traces/history.in-memory.jsonl",
             "traces/history.jsonl",
         ]
         assert archive.read("external/custom.log") == b"current"
         assert archive.read("external/custom.1.log") == b"rotated"
         assert archive.read("external/2/custom.log") == b"same name"
         assert archive.read("logs/event_loop_watchdog.log") == b"watchdog"
-        assert archive.read("memory/logs.txt").decode() == "[INFO] hello\n"
-        traces = archive.read("memory/traces.jsonl").decode().splitlines()
+        assert archive.read("logs/astrbot.in-memory.log").decode() == "[INFO] hello\n"
+        traces = archive.read("traces/history.in-memory.jsonl").decode().splitlines()
         # Current LogBroker only retains ordinary logs; traces are persisted.
         assert traces == []
         manifest = json.loads(archive.read("manifest.json"))
@@ -4417,6 +4418,140 @@ async def test_v1_log_export_packs_log_files_and_memory_logs(
     assert not any((tmp_path / "data" / "temp" / "log_exports").iterdir())
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("redact", [True, False])
+async def test_diagnostic_export_time_range_filters_logs_and_persisted_traces(
+    monkeypatch, tmp_path, asgi_app, asgi_client, redact
+):
+    from astrbot.core.utils.trace_store import TraceStore
+
+    monkeypatch.setenv("ASTRBOT_ROOT", str(tmp_path))
+    service = asgi_app.state.services.logs
+    base = int(time.time()) - 3600
+    logs_dir = tmp_path / "data" / "logs"
+    logs_dir.mkdir(parents=True)
+    selected = (
+        f"[{datetime.fromtimestamp(base + 1).isoformat(sep=' ')}] token=private-range-value\n"
+        "  selected traceback\n"
+        f"[{datetime.fromtimestamp(base + 2).isoformat(sep=' ')}] last selected log\n"
+    )
+    (logs_dir / "astrbot.log").write_text(
+        "undated preamble\n"
+        f"[{datetime.fromtimestamp(base).isoformat(sep=' ')}] outside-before\n"
+        + selected
+        + f"[{datetime.fromtimestamp(base + 3).isoformat(sep=' ')}] outside-after\n"
+        "  outside traceback\n",
+        encoding="utf-8",
+    )
+    (logs_dir / "undated.log").write_text("unrelated undated log\n", encoding="utf-8")
+    service.log_broker.publish({"time": base, "data": "outside-before"})
+    service.log_broker.publish({"time": base + 1, "data": "selected memory log"})
+    service.log_broker.publish({"time": base + 3, "data": "outside-after"})
+    service.log_broker.log_cache.append({"type": "trace", "time": base, "data": "outside"})
+    service.log_broker.log_cache.append({"type": "trace", "time": base + 1, "data": "selected"})
+    path = logs_dir / "traces.db"
+    service.config["trace_db_path"] = str(path)
+    store = TraceStore(path, {"trace_db_max_mb": 8})
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.log_service.get_trace_store", lambda *_: store
+    )
+    try:
+        for index in range(60):
+            trace_id = f"{index + 1:032x}"
+            stamp = str((base + index) * 1_000_000_000)
+            summary = {
+                "trace_id": trace_id,
+                "root_span_id": "b" * 16,
+                "start_time_unix_nano": stamp,
+                "end_time_unix_nano": stamp,
+                "updated_time_unix_nano": stamp,
+                "state": "completed",
+                "has_errors": False,
+                "has_models": False,
+                "has_plugins": False,
+                "has_commands": False,
+                "span_count": 0,
+                "attributes": {},
+            }
+            assert store.append({"trace": summary, "time_unix_nano": stamp})
+        assert store.flush()
+        response = await asgi_client.get(
+            "/api/v1/logs/export",
+            headers=_jwt_headers(),
+            params={"redact": str(redact).lower(), "start_time": base + 1, "end_time": base + 2},
+        )
+        assert response.status_code == 200
+        with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
+            disk_log = archive.read("logs/astrbot.log").decode()
+            assert disk_log == (
+                selected.replace("private-range-value", "[REDACTED]") if redact else selected
+            )
+            assert archive.read("logs/undated.log") == b""
+            assert archive.read("logs/astrbot.in-memory.log") == b"selected memory log\n"
+            assert json.loads(archive.read("traces/history.in-memory.jsonl"))["data"] == "selected"
+            history = [json.loads(line) for line in archive.read("traces/history.jsonl").splitlines()]
+            assert [item["trace"]["trace_id"] for item in history] == [f"{3:032x}", f"{2:032x}"]
+            assert "config.json" in archive.namelist()
+            assert "environment.json" in archive.namelist()
+            manifest = json.loads(archive.read("manifest.json"))
+            assert manifest["time_range"]["start_time"] == base + 1
+            assert manifest["time_range"]["end_time"] == base + 2
+            assert manifest["memory_logs"] == 1
+            assert manifest["memory_traces"] == 1
+            assert manifest["trace_history"]["count"] == 2
+            assert manifest["trace_history"]["truncated"] is False
+        assert store.list_traces(start_time=base + 58)["total"] == 2
+        assert store.list_traces(end_time=base + 2)["total"] == 3
+    finally:
+        store.close()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ("params", "status"),
+    [
+        ({"start_time": 20, "end_time": 10}, 400),
+        ({"start_time": -1}, 422),
+        ({"end_time": "invalid"}, 422),
+    ],
+)
+async def test_diagnostic_export_rejects_invalid_time_ranges(asgi_client, params, status):
+    response = await asgi_client.get(
+        "/api/v1/logs/export", headers=_jwt_headers(), params=params
+    )
+    assert response.status_code == status
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("webui_version", ["v9.8.7", None])
+async def test_diagnostic_export_includes_active_webui_version(
+    monkeypatch, tmp_path, fake_core_lifecycle, fake_db, webui_version
+):
+    monkeypatch.setenv("ASTRBOT_ROOT", str(tmp_path))
+    static_folder = tmp_path / "custom-webui"
+    assets_folder = static_folder / "assets"
+    assets_folder.mkdir(parents=True)
+    if webui_version is not None:
+        (assets_folder / "version").write_text(webui_version, encoding="utf-8")
+    default_assets = tmp_path / "data" / "dist" / "assets"
+    default_assets.mkdir(parents=True)
+    (default_assets / "version").write_text("v0.0.1", encoding="utf-8")
+    app = create_dashboard_asgi_app(
+        core_lifecycle=fake_core_lifecycle,
+        db=fake_db,
+        jwt_secret=JWT_SECRET,
+        static_folder=str(static_folder),
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        response = await client.get("/api/v1/logs/export", headers=_jwt_headers())
+    assert response.status_code == 200
+    with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
+        environment = json.loads(archive.read("environment.json"))
+    assert environment["webui_version"] == webui_version
+
+
 @pytest.mark.asyncio
 async def test_v1_log_export_skips_files_that_are_not_regular(
     monkeypatch, tmp_path: Path, asgi_client: httpx.AsyncClient
@@ -4463,12 +4598,14 @@ async def test_v1_log_export_keeps_archive_names_unique(
     """Log files never take the names of the generated entries."""
     monkeypatch.setenv("ASTRBOT_ROOT", str(tmp_path))
     data_dir = tmp_path / "data"
-    (data_dir / "memory").mkdir(parents=True)
-    (data_dir / "memory" / "logs.txt").write_text("file log", encoding="utf-8")
+    (data_dir / "logs").mkdir(parents=True)
+    (data_dir / "logs" / "astrbot.in-memory.log").write_text("file log", encoding="utf-8")
+    (data_dir / "traces").mkdir()
+    (data_dir / "traces" / "history.in-memory.jsonl").write_text("file trace", encoding="utf-8")
     (data_dir / "manifest.json").write_text("trace log", encoding="utf-8")
     service = asgi_app.state.services.logs
-    service.config["log_file_path"] = "memory/logs.txt"
-    service.config["trace_log_path"] = "manifest.json"
+    service.config["log_file_path"] = "manifest.json"
+    service.config["trace_log_path"] = "traces/history.in-memory.jsonl"
 
     response = await asgi_client.get("/api/v1/logs/export", headers=_jwt_headers())
 
@@ -4476,10 +4613,15 @@ async def test_v1_log_export_keeps_archive_names_unique(
     with zipfile.ZipFile(io.BytesIO(response.content)) as archive:
         names = archive.namelist()
         assert len(names) == len(set(names))
-        assert archive.read("memory/2/logs.txt") == b"file log"
+        assert archive.read("logs/2/astrbot.in-memory.log") == b"file log"
+        assert archive.read("traces/2/history.in-memory.jsonl") == b"file trace"
         assert archive.read("2/manifest.json") == b"trace log"
         manifest = json.loads(archive.read("manifest.json"))
-    assert sorted(manifest["files"]) == ["2/manifest.json", "memory/2/logs.txt"]
+    assert sorted(manifest["files"]) == [
+        "2/manifest.json",
+        "logs/2/astrbot.in-memory.log",
+        "traces/2/history.in-memory.jsonl",
+    ]
 
 
 @pytest.mark.asyncio
@@ -4576,6 +4718,8 @@ async def test_diagnostic_export_respects_redaction_for_every_section(
     secret = "private/configured+credential"
     plugin_secret = "private-plugin-credential"
     trace_secret = "previous-provider-credential"
+    aes_secret = "private-aes-credential"
+    config["platform"] = [{"encoding_aes_key": aes_secret}]
     config["diagnostic_network"] = {
         "public_endpoint": "http://8.8.8.8:8080/v1",
         "public_ipv6": "https://[2606:4700:4700::1111]:443/v1",
@@ -4596,6 +4740,7 @@ async def test_diagnostic_export_respects_redaction_for_every_section(
     logs = tmp_path / "data/logs"
     logs.mkdir(parents=True)
     (logs / "astrbot.log").write_text(
+        f"{aes_secret}\n"
         f"{secret}\n{quote(secret, safe='')}\n{plugin_secret}\n{trace_secret}\nhttp://8.8.8.8:8080/v1 https://[2606:4700:4700::1111]:443/v1 http://192.168.1.2:6185/health\nAuthorization: Bearer unknown-header-token\nCookie: session=unknown; second=secret\n-----BEGIN PRIVATE KEY-----\nprivate-key-body\n-----END PRIVATE KEY-----\n",
         encoding="utf-8",
     )
@@ -4637,6 +4782,7 @@ def get_trace(self, _trace_id):
             quote(secret, safe=""),
             plugin_secret,
             trace_secret,
+            aes_secret,
             "private-password",
             "private-jwt-secret",
             "unknown-header-token",
@@ -4652,7 +4798,7 @@ def get_trace(self, _trace_id):
         if redact:
             assert exported["diagnostic_network"]["public_endpoint"] == "http://[PUBLIC_IP_1]:8080/v1"
             assert exported["diagnostic_network"]["public_ipv6"] == "https://[PUBLIC_IP_2]:443/v1"
-            assert b"peer=[PUBLIC_IP_1]" in archive.read("memory/logs.txt")
+            assert b"peer=[PUBLIC_IP_1]" in archive.read("logs/astrbot.in-memory.log")
             trace = json.loads(archive.read("traces/history.jsonl"))["spans"][0]["attributes"]
             assert trace["peer"] == "[PUBLIC_IP_1]"
             assert trace["ipv6"] == "[PUBLIC_IP_2]"
@@ -4673,7 +4819,7 @@ def get_trace(self, _trace_id):
         assert manifest["redacted"] is redact
         assert "logs/traces.db" not in archive.namelist()
         assert "logs/binary.log" not in archive.namelist()
-        assert archive.read("memory/traces.jsonl") == b""
+        assert archive.read("traces/history.in-memory.jsonl") == b""
 
 
 @pytest.mark.asyncio
diff --git a/tests/unit/test_diagnostic_redaction.py b/tests/unit/test_diagnostic_redaction.py
index 4e86b0a64c3..dd8ed914e0f 100644
--- a/tests/unit/test_diagnostic_redaction.py
+++ b/tests/unit/test_diagnostic_redaction.py
@@ -2,6 +2,9 @@
 
 import io
 import json
+import subprocess
+import sys
+from datetime import datetime
 
 import pytest
 
@@ -59,6 +62,81 @@ def test_redacts_known_escaped_and_unconfigured_credentials():
     assert "&x=1" in result
 
 
+@pytest.mark.parametrize(
+    "key",
+    ["api_key", "custom_token_value", "X-Authorization", "X-Cookie", "x.key", "key"],
+)
+def test_sensitive_assignment_names_remain_redacted(key):
+    assert DiagnosticRedactor().text(f'"{key}": "private-value"') == (
+        f'"{key}": [REDACTED]'
+    )
+
+
+@pytest.mark.parametrize(
+    "key",
+    ["encoding_aes_key", "wecomaibot_encoding_aes_key", "aes_key", "aeskey", "encodingAesKey"],
+)
+@pytest.mark.parametrize("enabled", [True, False])
+def test_aes_keys_are_redacted_in_configuration_and_logs(key, enabled):
+    secret = "example-aes-value/+="
+    config = {"platform": [{key: secret}]}
+    redactor = DiagnosticRedactor(enabled=enabled)
+    redactor.collect(config)
+    expected = "[REDACTED]" if enabled else secret
+    assert redactor.redact(config) == {"platform": [{key: expected}]}
+    assert redactor.text(f"configured value: {secret}") == f"configured value: {expected}"
+    assert DiagnosticRedactor(enabled=enabled).text(f'"{key}": "{secret}"') == (
+        f'"{key}": [REDACTED]' if enabled else f'"{key}": "{secret}"'
+    )
+    assert config["platform"][0][key] == secret
+
+
+def test_nested_assignments_and_mixed_case_credentials_remain_redacted():
+    content = (
+        'message="api_key=private-nested-value" normal=visible\n'
+        "AUTHORIZATION=private-authorization\n"
+        "Bearer\tprivate-bearer\n"
+        "recovery-code=private-recovery\n"
+        "Baſic\tprivate-basic\n"
+        "ſecret=private-secret\n"
+        "cookıe: private-cookie\n"
+    )
+    result = DiagnosticRedactor().text(content)
+    assert "private-" not in result
+    assert "normal=visible" in result
+
+
+def test_collecting_credentials_after_redaction_refreshes_the_cache():
+    redactor = DiagnosticRedactor()
+    redactor.collect({"api_key": "first-private-value"})
+    assert redactor.text("first-private-value") == "[REDACTED]"
+    redactor.collect({"api_key": "second-private-value"})
+    assert redactor.text("first-private-value second-private-value") == (
+        "[REDACTED] [REDACTED]"
+    )
+
+
+def test_long_log_tokens_do_not_stall_redaction():
+    """Run adversarial lines outside pytest so a regex regression cannot hang it."""
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-c",
+            "from astrbot.dashboard.services.diagnostic_service import DiagnosticRedactor\n"
+            "redactor = DiagnosticRedactor()\n"
+            "for value in ('a' * 100_000, 'token' * 20_000, 'token' * 20_000 + '='):\n"
+            "    assert redactor.text(value) == value\n"
+            "assert redactor.text('a' * 100_000 + ' token=private-value') == 'a' * 100_000 + ' token=[REDACTED]'\n"
+            "assert redactor.text('token' * 20_000 + '=private-value') == 'token' * 20_000 + '=[REDACTED]'\n",
+        ],
+        capture_output=True,
+        text=True,
+        timeout=5,
+        check=False,
+    )
+    assert result.returncode == 0, result.stderr
+
+
 def test_stream_drops_oversized_lines_without_leaking_suffixes(monkeypatch):
     monkeypatch.setattr(
         "astrbot.dashboard.services.diagnostic_service.MAX_LOG_LINE_BYTES", 32
@@ -78,6 +156,22 @@ def test_stream_redacts_private_key_blocks_and_keeps_unterminated_final_line():
     assert output.getvalue() == b"normal\n[REDACTED]\nlast line"
 
 
+def test_stream_preserves_order_and_privacy_across_batches():
+    prefix = "ordinary 中文\n".encode() * 6000
+    content = (
+        prefix
+        + b"-----BEGIN PRIVATE KEY-----\n"
+        + b"private-key-body\n" * 6000
+        + b"-----END PRIVATE KEY-----\n"
+        + b"api_key=private-value\npeer=8.8.8.8\nlast line"
+    )
+    output = io.BytesIO()
+    assert DiagnosticRedactor().copy_log(io.BytesIO(content), output, len(content)) is False
+    assert output.getvalue() == (
+        prefix + b"[REDACTED]\napi_key=[REDACTED]\npeer=[PUBLIC_IP_1]\nlast line"
+    )
+
+
 def test_stream_does_not_emit_a_credential_fragment_at_size_boundary():
     source = io.BytesIO(b"normal\nBearer private-token-without-newline")
     output = io.BytesIO()
@@ -85,6 +179,92 @@ def test_stream_does_not_emit_a_credential_fragment_at_size_boundary():
     assert output.getvalue() == b"normal\n"
 
 
+@pytest.mark.parametrize("enabled", [True, False])
+def test_stream_time_range_keeps_boundaries_and_traceback_continuations(enabled):
+    before = b"[2026-10-21 10:59:59.999] before\nold traceback\n"
+    selected = (
+        b"[2026-10-21 11:00:00.000] first\nTraceback:\n  selected frame\n"
+        b"[2026-10-21 11:00:01.000] last\n"
+    )
+    after = b"[2026-10-21 11:00:01.001] after\nnew traceback\n"
+    content = b"undated preamble\n" + before + selected + after
+    target = io.BytesIO()
+    assert DiagnosticRedactor(enabled=enabled).copy_log(
+        io.BytesIO(content),
+        target,
+        len(content),
+        start_time=int(datetime(2026, 10, 21, 11).timestamp()),
+        end_time=int(datetime(2026, 10, 21, 11, 0, 1).timestamp()),
+    ) is False
+    assert target.getvalue() == selected
+
+
+@pytest.mark.parametrize("enabled", [True, False])
+@pytest.mark.parametrize(
+    ("start", "end", "expected"),
+    [(10, 20, [0, 1]), (20, None, [1, 2]), (None, 10, [0])],
+)
+def test_stream_time_range_filters_json_records(enabled, start, end, expected):
+    lines = [
+        json.dumps({"time_unix_nano": "10000000000", "data": "first"}) + "\n",
+        json.dumps({"time": 20, "data": "second"}) + "\n",
+        json.dumps({"start_time_unix_nano": "30000000000", "data": "third"}) + "\n",
+    ]
+    content = ("".join(lines) + '{"data": "undated"}\n').encode()
+    target = io.BytesIO()
+    DiagnosticRedactor(enabled=enabled).copy_log(
+        io.BytesIO(content), target, len(content), start_time=start, end_time=end
+    )
+    assert target.getvalue() == "".join(lines[index] for index in expected).encode()
+
+
+@pytest.mark.parametrize(
+    "line",
+    [
+        b"[2026-10-21T03:00:00Z] selected\n",
+        b"2026-10-21T11:00:00+08:00 selected\n",
+        b"[2026-10-21 03:00:00,000+00:00] selected\n",
+    ],
+)
+def test_stream_time_range_respects_explicit_timezone_offsets(line):
+    stamp = int(datetime.fromisoformat("2026-10-21T03:00:00+00:00").timestamp())
+    target = io.BytesIO()
+    DiagnosticRedactor().copy_log(
+        io.BytesIO(line), target, len(line), start_time=stamp, end_time=stamp
+    )
+    assert target.getvalue() == line
+
+
+def test_raw_time_range_preserves_long_lines_and_non_utf8_bytes(monkeypatch):
+    monkeypatch.setattr(
+        "astrbot.dashboard.services.diagnostic_service.MAX_LOG_LINE_BYTES", 32
+    )
+    selected = b"[2026-10-21 11:00:00] " + b"a" * 100 + b"\xff\r\n"
+    content = selected + b"[2026-10-21 11:00:01] excluded\n"
+    stamp = int(datetime(2026, 10, 21, 11).timestamp())
+    target = io.BytesIO()
+    assert DiagnosticRedactor(enabled=False).copy_log(
+        io.BytesIO(content), target, len(content), start_time=stamp, end_time=stamp
+    ) is False
+    assert target.getvalue() == selected
+
+
+def test_stream_time_filter_does_not_expose_private_keys_with_dated_body_lines():
+    content = (
+        b"[2026-10-21 10:00:00] before\n-----BEGIN PRIVATE KEY-----\n"
+        b"[2026-10-21 11:00:00] private-key-body\n-----END PRIVATE KEY-----\n"
+        b"[2026-10-21 11:00:00] selected\n"
+    )
+    target = io.BytesIO()
+    DiagnosticRedactor().copy_log(
+        io.BytesIO(content),
+        target,
+        len(content),
+        start_time=int(datetime(2026, 10, 21, 11).timestamp()),
+    )
+    assert target.getvalue() == b"[2026-10-21 11:00:00] selected\n"
+
+
 def test_disabled_redaction_preserves_structured_values_and_original_log_bytes():
     redactor = DiagnosticRedactor(enabled=False)
     value = {