FR-186 · 需求索引 · 本頁由 build 掃資料夾生成
FR-177 之後 Agent 又進了 199 個 commit（授權照、長輪詢、首次設定、TPM 加密都是新程式），整包重掃一次：新程式有沒有洞、上次 22 條修正有沒有守住。只掃不修。
🔴 35 棒已全部掃完並驗收：1 條高、14 條中、15 條低，全部在 Agent。修正卡開在 FR-195（母卡 CM-3822）。 逐棒報告在 Agent repo
docs/security-scan/FR-186/scan-*.md；下方「35 棒」表的狀態欄尚未逐列更新。
資安掃描系列第八個 arc。跨 arc 結論在
security-scan-consolidated/；作業手冊.claude/skills/security-scan-lead/SKILL.md。前一輪 FR-177。
FR-177 掃的是 Agent 63334f4，22 條全修完。之後 FR-179／181／182／183／185 又進了 199 個 commit、134 個檔、約 6,000 行，其中授權照、長輪詢指令通道、首次設定與換主系統、主機端設定檔加密與 TPM 密封是全新的；22 條修正本身也沒被工具複查過。
範圍是整包出貨給客戶的程式：guidant_agent/ 全部、common/integrity、common/util、config/config.py、main_app.py、兩份 install.sh 與 scripts/install/lib/、compose 部署設定。不掃：scripts/build/（自家 CI，不出貨）、tests、docs、純 error code 表、空 __init__.py。合計約 40,500 行。
每棒約 1,000 行（FR-177 驗證的安全線，研究員讀太多會被工具 180 秒看門狗誤殺），按業務模組垂直切，同批範圍不重疊、只新增報告檔，合回不衝突。FR-177 掃過的棒沿用舊卡「重點看什麼」並加一條回歸檢查（對應總表 #219～240）；新程式的棒由首腦讀碼後寫重點。
兩支 install.sh 各約 3,000 行、中文 2.4 萬字，超過安全線，各自單獨一批（批 5、6），卡上寫「第二個 failed 就停」；跑不完再拆成按函式區段的子棒。
| 批 | 棒 | 卡 | 範圍 | 檔／行 | 狀態 |
|---|---|---|---|---|---|
| 1 | S1a 首次設定、換主系統、改本機位址（FR-179／183 新程式） | CM-3676 | guidant_agent/sync/app/enroll_service.py、guidant_agent/sync/enroll_command.py、guidant_agent/sync/base_url_command.py、guidant_agent/console/api/setup_routes.py、guidant_agent/console/api/cloud_change_routes.py |
5 檔／999 行 | 未開工 |
| 1 | S1b 註冊、憑證與 Agent 身分 | CM-3677 | guidant_agent/sync/app/enroll.py、guidant_agent/sync/domain/registration.py、guidant_agent/sync/domain/agent_auth.py、guidant_agent/sync/adapters/cert_files.py、guidant_agent/platform/agent_identity.py |
5 檔／1133 行 | 未開工 |
| 1 | S2 主系統通道、信任錨、憑證換發、設定拉取 | CM-3678 | guidant_agent/sync/app/cert_renew.py、guidant_agent/sync/app/cloud_trust.py、guidant_agent/sync/ports/cloud_trust.py、guidant_agent/sync/adapters/cloud_channel.py、guidant_agent/sync/adapters/cloud_http.py、guidant_agent/sync/ports/cloud_channel.py、guidant_agent/sync/app/agent_status.py、guidant_agent/sync/app/config_pull.py |
8 檔／1029 行 | 未開工 |
| 1 | S3 長輪詢指令通道（FR-181 新程式） | CM-3679 | guidant_agent/sync/app/command_pull.py、guidant_agent/sync/app/reply_sender.py、guidant_agent/sync/app/task_intake.py、guidant_agent/sync/ports/command_handler.py、guidant_agent/files/api/commands.py、guidant_agent/scan/api/commands.py、guidant_agent/sync/app/log_query.py、guidant_agent/platform/query_args.py、guidant_agent/sync/api/cmd_logs.py、guidant_agent/sync/app/task_queue.py、guidant_agent/sync/__init__.py |
11 檔／1065 行 | 未開工 |
| 1 | S4 8443 資料面與證據檔取送 | CM-3680 | guidant_agent/sync/api/data_plane_server.py、guidant_agent/sync/api/data_plane_auth.py、guidant_agent/sync/api/cmd_config.py、guidant_agent/sync/api/cmd_credentials.py、guidant_agent/sync/api/cmd_restart.py、guidant_agent/sync/api/cmd_tasks.py、guidant_agent/sync/api/cmd_update.py、guidant_agent/shared/tls_server.py、guidant_agent/files/api/blob.py、guidant_agent/files/api/blob_route.py、guidant_agent/files/app/blob_ops.py、guidant_agent/files/app/evidence_files.py、guidant_agent/files/app/evidence_sha256.py |
13 檔／869 行 | 未開工 |
| 1 | S5 線上更新鏈 | CM-3681 | guidant_agent/sync/app/update_sync.py、guidant_agent/sync/app/update_events.py、guidant_agent/sync/app/update_log_upload.py、guidant_agent/console/api/update_routes.py |
4 檔／1014 行 | 未開工 |
| 1 | S6 檢測規則包下載與解壓 | CM-3682 | guidant_agent/sync/app/profile_cache.py、guidant_agent/sync/app/profile_sync.py、guidant_agent/shared/archive_safety.py |
3 檔／1081 行 | 未開工 |
| 1 | S7 簽章驗證核心、啟動完整性閘、漏洞庫同步 | CM-3683 | guidant_agent/sync/app/vulndb_sync.py、guidant_agent/sync/app/vulndb_bundle.py、common/integrity/__init__.py、common/integrity/public_keys.py、common/integrity/startup_gate.py、common/integrity/verify.py、main_app.py、guidant_agent/platform/agent_tree_verify.py |
8 檔／1047 行 | 未開工 |
| 2 | S8 授權目標清冊與結果回報 outbox | CM-3684 | guidant_agent/sync/app/allowed_targets.py、guidant_agent/sync/app/outbox.py、guidant_agent/sync/app/event_sender.py、guidant_agent/sync/adapters/outbox_repo.py、guidant_agent/sync/ports/target_authorizer.py、guidant_agent/sync/ports/result_outbox.py |
6 檔／994 行 | 未開工 |
| 2 | L1 Agent 授權照與 sync 閘門（FR-182 新程式） | CM-3685 | guidant_agent/license/__init__.py、guidant_agent/license/app/check.py、guidant_agent/license/app/gate.py、guidant_agent/license/app/install.py、guidant_agent/license/app/online_activate.py、guidant_agent/license/app/opener.py、guidant_agent/license/app/store.py、guidant_agent/license/domain/status.py、guidant_agent/console/api/license_routes.py、guidant_agent/platform/fingerprint.py、guidant_agent/platform/host_identity.py、guidant_agent/platform/bootstrap.py |
12 檔／911 行 | 未開工 |
| 2 | I1 主控台本機登入、鎖定與 session | CM-3686 | guidant_agent/identity/app/local_login.py、guidant_agent/identity/app/local_auth.py、guidant_agent/identity/app/session.py、guidant_agent/identity/app/session_file.py、guidant_agent/identity/app/credentials.py、guidant_agent/identity/app/local_credentials.py、guidant_agent/identity/domain/lockout.py、guidant_agent/identity/adapters/credential_repo.py、guidant_agent/console/api/local_auth_routes.py |
9 檔／1222 行 | 未開工 |
| 2 | I2 LDAP 登入、離線操作者、來源網段白名單 | CM-3687 | guidant_agent/identity/adapters/ldap_source.py、guidant_agent/identity/app/ldap_source.py、guidant_agent/identity/app/offline_operators.py、guidant_agent/identity/app/offline_login_window.py、guidant_agent/identity/app/allow_cidr.py、guidant_agent/identity/domain/allow_cidr.py、guidant_agent/identity/ports/source_cidr_guard.py、guidant_agent/identity/adapters/operator_repo.py、guidant_agent/console/api/ldap_routes.py |
9 檔／1104 行 | 未開工 |
| 2 | K1 主控台守門殼、頁面與紀錄路由 | CM-3688 | guidant_agent/console/api/__init__.py、guidant_agent/console/api/pages.py、guidant_agent/console/__init__.py、guidant_agent/console/app/body_limit.py、guidant_agent/console/app/inline_policy.py、guidant_agent/console/app/view_audit.py、guidant_agent/console/migrations.py、guidant_agent/console/api/log_routes.py、guidant_agent/console/api/keys_routes.py、guidant_agent/console/api/runs_routes.py |
10 檔／984 行 | 未開工 |
| 2 | K2 主控台操作路由：維運、掃描、網診、工具、檔案 | CM-3689 | guidant_agent/console/api/ops_routes.py、guidant_agent/console/api/scan_routes.py、guidant_agent/console/api/netdiag_routes.py、guidant_agent/console/api/tools.py、guidant_agent/console/api/files.py |
5 檔／1065 行 | 未開工 |
| 2 | K3 主控台聚合層：總覽、心跳欄位、更新頁 | CM-3690 | guidant_agent/console/app/overview.py、guidant_agent/console/app/heartbeat.py、guidant_agent/console/app/targets.py、guidant_agent/console/app/update_console.py |
4 檔／754 行 | 未開工 |
| 2 | F1 瀏覽器直傳 8444、儲存設定與檔案保護 | CM-3691 | guidant_agent/files/api/browser_plane.py、guidant_agent/files/app/storage_settings.py、guidant_agent/files/app/storage_stats.py、guidant_agent/files/app/storage_trust.py、guidant_agent/files/app/file_protect.py、guidant_agent/files/app/setup_cert.py、guidant_agent/files/app/ports.py、guidant_agent/files/__init__.py、guidant_agent/files/adapters/customer_files_repo.py、guidant_agent/files/migrations.py、guidant_agent/files/ports/evidence_store.py |
11 檔／996 行 | 未開工 |
| 3 | C1 SonarQube connector（單檔） | CM-3692 | guidant_agent/scan/adapters/connectors/sonarqube.py |
1 檔／1711 行 | 未開工 |
| 3 | C2 CINC Auditor／InSpec connector | CM-3693 | guidant_agent/scan/adapters/connectors/inspec.py、guidant_agent/scan/adapters/connectors/inspec_config.py、guidant_agent/scan/adapters/connectors/inspec_host_keys.py |
3 檔／1126 行 | 未開工 |
| 3 | C3 Nmap connector＋SSH 主機金鑰 | CM-3694 | guidant_agent/scan/adapters/connectors/nmap.py、guidant_agent/scan/adapters/connectors/ssh_host_keys.py |
2 檔／790 行 | 未開工 |
| 3 | C4 OWASP ZAP connector＋工具 TLS | CM-3695 | guidant_agent/scan/adapters/connectors/zap.py、guidant_agent/scan/adapters/connectors/zap_client.py、guidant_agent/scan/adapters/connectors/tool_tls.py |
3 檔／802 行 | 未開工 |
| 3 | C5 OpenSCAP＋OpenVAS connector | CM-3696 | guidant_agent/scan/adapters/connectors/openscap.py、guidant_agent/scan/adapters/connectors/openvas.py、guidant_agent/scan/adapters/connectors/openvas_tls.py |
3 檔／881 行 | 未開工 |
| 3 | C6 SBOM 三檔、connector 基底與登記、工具執行紀錄 | CM-3697 | guidant_agent/scan/adapters/connectors/sbom_scan.py、guidant_agent/scan/adapters/connectors/sbom_tools.py、guidant_agent/scan/adapters/connectors/sbom_coverage.py、guidant_agent/scan/adapters/connectors/base.py、guidant_agent/scan/adapters/connectors/__init__.py、guidant_agent/scan/adapters/connectors/tool_run_log.py |
6 檔／1091 行 | 未開工 |
| 3 | X1 掃描任務執行與工具帳密 | CM-3698 | guidant_agent/scan/app/task_executor.py、guidant_agent/scan/app/running_tasks.py、guidant_agent/scan/app/task_sinks.py、guidant_agent/scan/app/credential_handover.py、guidant_agent/scan/app/credential_resolver.py、guidant_agent/scan/app/credential_store.py、guidant_agent/scan/app/secret_form.py、guidant_agent/scan/adapters/credential_store.py、guidant_agent/scan/api/routes/credential_route.py、guidant_agent/scan/api/routes/detection_route.py、guidant_agent/scan/ports/secret_fields.py、guidant_agent/scan/ports/connector.py、guidant_agent/scan/app/cancel.py、guidant_agent/scan/app/probe.py |
14 檔／1152 行 | 未開工 |
| 3 | X2 執行紀錄、本機上傳槽、工具參數白名單 | CM-3699 | guidant_agent/scan/app/local_runs.py、guidant_agent/scan/app/scan_input.py、guidant_agent/scan/app/probe_runner.py、guidant_agent/scan/app/sync_ports.py、guidant_agent/scan/app/catalog.py、guidant_agent/scan/adapters/local_runs_repo.py、guidant_agent/scan/adapters/scan_input_files.py、guidant_agent/scan/domain/local_run.py、guidant_agent/scan/domain/summary.py、guidant_agent/scan/domain/tool_params.py、guidant_agent/scan/migrations.py、guidant_agent/scan/ports/scan_input_slots.py |
12 檔／1050 行 | 未開工 |
| 4 | N1 網路診斷探測 | CM-3700 | guidant_agent/netdiag/adapters/probes |
11 檔／907 行 | 未開工 |
| 4 | N2 網路診斷執行、判讀、儀表板、報告與限制 | CM-3701 | guidant_agent/netdiag/app、guidant_agent/netdiag/domain、guidant_agent/netdiag/__init__.py |
10 檔／1302 行 | 未開工 |
| 4 | P1 祕密保管、診斷包、維運指令、錯誤追蹤 | CM-3702 | guidant_agent/platform/secret_store.py、guidant_agent/platform/support_bundle.py、guidant_agent/platform/ops.py、guidant_agent/platform/local_ops.py、guidant_agent/platform/local_state_cli.py、guidant_agent/platform/error_tracking |
8 檔／965 行 | 未開工 |
| 4 | P2 稽核與系統日誌、模組登記 | CM-3703 | guidant_agent/platform/audit_log.py、guidant_agent/platform/audit_pipeline.py、guidant_agent/platform/audit_import.py、guidant_agent/platform/local_db、guidant_agent/shared/audit.py、guidant_agent/platform/registry.py |
8 檔／1035 行 | 未開工 |
| 4 | P3 容器、背景元件、健康檢查、設定、共用寫檔 | CM-3704 | guidant_agent/platform/container.py、guidant_agent/platform/background.py、guidant_agent/platform/health.py、guidant_agent/platform/clock_skew.py、guidant_agent/platform/disk_space.py、config/config.py、guidant_agent/shared/secure_file.py、guidant_agent/shared/timeouts.py |
8 檔／977 行 | 未開工 |
| 4 | P4 模組接線與 sync 小功能 | CM-3705 | guidant_agent/scan/__init__.py、guidant_agent/identity/__init__.py、guidant_agent/identity/ports/__init__.py、guidant_agent/sync/app/agent_name.py、guidant_agent/sync/app/keys_view.py、guidant_agent/sync/app/file_protect_sync.py、guidant_agent/sync/app/tool_schemas.py、guidant_agent/sync/app/console_ticket.py、guidant_agent/sync/ports/upload_ticket.py、guidant_agent/shared/heartbeat_wake.py、common/util |
16 檔／1049 行 | 未開工 |
| 4 | H3 主機端設定檔加密、TPM 密封、本機管理員與註冊腳本（FR-179 新程式） | CM-3706 | scripts/install/lib/secrets.sh、scripts/install/lib/secrets_cmds.sh、scripts/install/lib/tpm.sh、scripts/install/lib/local_admin.sh、scripts/install/lib/enroll.sh、scripts/install/lib/set_base_url.sh、scripts/install/lib/console_allow_cidr.sh、scripts/install/lib/systemd/guidant-agent-secrets.service |
8 檔／1128 行 | 未開工 |
| 4 | H4 主機端升級與清除腳本 | CM-3707 | scripts/install/lib/upgrade_order.sh、scripts/install/lib/upgrade_runner.sh、scripts/install/lib/upgrade_guard.sh、scripts/install/lib/image_verify.sh、scripts/install/lib/wipe.sh、scripts/install/lib/systemd/guidant-agent-upgrade-boot-check.service、scripts/install/lib/systemd/guidant-agent-upgrade-order.path、scripts/install/lib/systemd/guidant-agent-upgrade-order.service |
8 檔／1292 行 | 未開工 |
| 4 | H5 容器部署設定：compose、Dockerfile、systemd | CM-3708 | deploy/docker-compose.yml、deploy/Dockerfile.runtime、deploy/.env.example、scripts/build/systemd/guidant-agent.service |
4 檔／768 行 | 未開工 |
| 5 | H1 主機安裝程式 install.sh（tarball 版，單檔） | CM-3709 | scripts/install/install.sh |
1 檔／3267 行 | 未開工 |
| 6 | H2 主機安裝程式 install.sh（compose 版，單檔） | CM-3710 | deploy/install.sh |
1 檔／2998 行 | 未開工 |
同 FR-177：子卡 Repo＝agent，Model opus、Effort low（工作坊補 [1m]），開場 prompt 在本 repo .claude/workshop-prompts/dispatch-<卡號>.md，前兩行是啟動指令與成本承認句。報告寫在 Agent 卡工作區的 docs/security-scan/FR-186/。
每棒照手冊第五節七步。修正卡全部掃完、驗完才統一開，同檔同根因併一張。掃到 CRITICAL 當場回報決策者。
卡片內容（決策紀錄、驗收條件）以 Notion 為準，本頁只記座標。
| 關係 | 卡號 | 標題 | 狀態 |
|---|---|---|---|
| 母案 | CM-3675 | FR-186 Agent 本體資安掃描第二輪（35 棒 6 批，整包重掃，Opus 1M effort low，只掃不修） | — |
| 子卡 | CM-3676 | S1a 首次設定、換主系統、改本機位址（FR-179／183 新程式） | Not started |
| 子卡 | CM-3677 | S1b 註冊、憑證與 Agent 身分 | Not started |
| 子卡 | CM-3678 | S2 主系統通道、信任錨、憑證換發、設定拉取 | Not started |
| 子卡 | CM-3679 | S3 長輪詢指令通道（FR-181 新程式） | Not started |
| 子卡 | CM-3680 | S4 8443 資料面與證據檔取送 | Not started |
| 子卡 | CM-3681 | S5 線上更新鏈 | Not started |
| 子卡 | CM-3682 | S6 檢測規則包下載與解壓 | Not started |
| 子卡 | CM-3683 | S7 簽章驗證核心、啟動完整性閘、漏洞庫同步 | Not started |
| 子卡 | CM-3684 | S8 授權目標清冊與結果回報 outbox | Not started |
| 子卡 | CM-3685 | L1 Agent 授權照與 sync 閘門（FR-182 新程式） | Not started |
| 子卡 | CM-3686 | I1 主控台本機登入、鎖定與 session | Not started |
| 子卡 | CM-3687 | I2 LDAP 登入、離線操作者、來源網段白名單 | Not started |
| 子卡 | CM-3688 | K1 主控台守門殼、頁面與紀錄路由 | Not started |
| 子卡 | CM-3689 | K2 主控台操作路由：維運、掃描、網診、工具、檔案 | Not started |
| 子卡 | CM-3690 | K3 主控台聚合層：總覽、心跳欄位、更新頁 | Not started |
| 子卡 | CM-3691 | F1 瀏覽器直傳 8444、儲存設定與檔案保護 | Not started |
| 子卡 | CM-3692 | C1 SonarQube connector（單檔） | Not started |
| 子卡 | CM-3693 | C2 CINC Auditor／InSpec connector | Not started |
| 子卡 | CM-3694 | C3 Nmap connector＋SSH 主機金鑰 | Not started |
| 子卡 | CM-3695 | C4 OWASP ZAP connector＋工具 TLS | Not started |
| 子卡 | CM-3696 | C5 OpenSCAP＋OpenVAS connector | Not started |
| 子卡 | CM-3697 | C6 SBOM 三檔、connector 基底與登記、工具執行紀錄 | Not started |
| 子卡 | CM-3698 | X1 掃描任務執行與工具帳密 | Not started |
| 子卡 | CM-3699 | X2 執行紀錄、本機上傳槽、工具參數白名單 | Not started |
| 子卡 | CM-3700 | N1 網路診斷探測 | Not started |
| 子卡 | CM-3701 | N2 網路診斷執行、判讀、儀表板、報告與限制 | Not started |
| 子卡 | CM-3702 | P1 祕密保管、診斷包、維運指令、錯誤追蹤 | Not started |
| 子卡 | CM-3703 | P2 稽核與系統日誌、模組登記 | Not started |
| 子卡 | CM-3704 | P3 容器、背景元件、健康檢查、設定、共用寫檔 | Not started |
| 子卡 | CM-3705 | P4 模組接線與 sync 小功能 | Not started |
| 子卡 | CM-3706 | H3 主機端設定檔加密、TPM 密封、本機管理員與註冊腳本（FR-179 新程式） | Not started |
| 子卡 | CM-3707 | H4 主機端升級與清除腳本 | Not started |
| 子卡 | CM-3708 | H5 容器部署設定：compose、Dockerfile、systemd | Not started |
| 子卡 | CM-3709 | H1 主機安裝程式 install.sh（tarball 版，單檔） | Not started |
| 子卡 | CM-3710 | H2 主機安裝程式 install.sh（compose 版，單檔） | Not started |