evidence-agent 安裝精靈(install.sh)Implementation Plan

#!/usr/bin/env bash
# 極簡 assert helper（無外部框架）。每個 assert 印 PASS/FAIL，累計失敗數。
ASSERT_FAILS=0
assert_eq() { # $1=expected $2=actual $3=msg
  if [ "$1" = "$2" ]; then printf 'PASS: %s\n' "$3"
  else printf 'FAIL: %s\n  expected=[%s]\n  actual=  [%s]\n' "$3" "$1" "$2"; ASSERT_FAILS=$((ASSERT_FAILS+1)); fi
}
assert_contains() { # $1=haystack $2=needle $3=msg
  case "$1" in *"$2"*) printf 'PASS: %s\n' "$3";; *) printf 'FAIL: %s\n  [%s] does not contain [%s]\n' "$3" "$1" "$2"; ASSERT_FAILS=$((ASSERT_FAILS+1));; esac
}
assert_not_contains() { # $1=haystack $2=needle $3=msg
  case "$1" in *"$2"*) printf 'FAIL: %s\n  [%s] unexpectedly contains [%s]\n' "$3" "$1" "$2"; ASSERT_FAILS=$((ASSERT_FAILS+1));; *) printf 'PASS: %s\n' "$3";; esac
}
assert_summary() { if [ "$ASSERT_FAILS" -eq 0 ]; then printf '\nALL PASS\n'; else printf '\n%d FAILED\n' "$ASSERT_FAILS"; exit 1; fi; }

#!/usr/bin/env bash
set -u
DIR="$(cd "$(dirname "$0")" && pwd)"
. "$DIR/assert.sh"
. "$DIR/../install-lib.sh"   # source 函式（install-lib.sh 不得在 source 時執行副作用）
# 後續 Task 在此追加測試
assert_summary

#!/usr/bin/env bash
# evidence-agent 安裝精靈函式庫。被 install.sh 與 test 同時 source。
# 關鍵：本檔被 source 時【不得】有副作用（只定義函式），否則測試會誤跑。
# ── log_* ── / ── pf_* ── / ── cfg_* ── / ── orch_* ── / ── vrf_* ──（各 Task 填入）

#!/usr/bin/env bash
set -eu
DIR="$(cd "$(dirname "$0")" && pwd)"
. "$DIR/install-lib.sh"
echo "TODO: wire stages"

cd ~/Projects/Billows/Audit-Manager/evidence-agent
git add deploy/test/assert.sh deploy/test/test_install_lib.sh deploy/install-lib.sh deploy/install.sh
git commit -m "feat(install): scaffold 安裝精靈骨架 + 自帶 shell 測試 harness

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

# log_redact 應遮蔽密碼樣式的值
out="$(log_redact "DB_PASSWORD=sup3rs3cret other=ok")"
assert_not_contains "$out" "sup3rs3cret" "log_redact 遮蔽密碼值"
assert_contains "$out" "other=ok" "log_redact 保留非敏感內容"

log_info()  { printf '\033[0;36m[i]\033[0m %s\n' "$*"; }
log_ok()    { printf '\033[0;32m[✓]\033[0m %s\n' "$*"; }
log_warn()  { printf '\033[0;33m[!]\033[0m %s\n' "$*" >&2; }
log_err()   { printf '\033[0;31m[✗]\033[0m %s\n' "$*" >&2; }
# 遮蔽 KEY=VALUE 中疑似敏感欄位的值（印 log 前過濾，永不外漏明文）
log_redact() {
  printf '%s' "$1" | sed -E 's/(PASSWORD|SECRET_KEY|TOKEN|ACCESS_KEY)=[^[:space:]]*/\1=***REDACTED***/g'
}
# 互動提問：$1=提示 $2=預設值（可空）；回傳使用者輸入或預設
ask() {
  _p="$1"; _d="${2:-}"
  if [ -n "$_d" ]; then printf '%s [%s]: ' "$_p" "$_d" >&2; else printf '%s: ' "$_p" >&2; fi
  IFS= read -r _ans || true
  if [ -z "$_ans" ]; then printf '%s' "$_d"; else printf '%s' "$_ans"; fi
}

git add deploy/install-lib.sh deploy/test/test_install_lib.sh
git commit -m "feat(install): log/ask 輸出函式 + log_redact 敏感值遮蔽

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

# 樁：模擬 `ip route show default` 輸出
ip() { echo "default via 192.168.50.1 dev eth0 src 192.168.50.121 metric 100"; }
assert_eq "192.168.50.121" "$(cfg_derive_ip)" "cfg_derive_ip 從 default route 取 src IP"
unset -f ip

# 推導本機對雲端可達的 IP（default route 的 src）。取不到回空字串，由 caller 改問。
cfg_derive_ip() {
  ip route show default 2>/dev/null \
    | sed -nE 's/.* src ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/p' \
    | head -n1
}

git add deploy/install-lib.sh deploy/test/test_install_lib.sh
git commit -m "feat(install): cfg_derive_ip 從 default route 推導本機 IP

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

pw="$(cfg_gen_password)"
assert_eq "32" "$(printf '%s' "$pw" | wc -c | tr -d ' ')" "cfg_gen_password 長度 32"
# 只含 URL-safe 字元（避免 DB URL 解析問題；雖然 config.py 會 quote_plus，仍從源頭避雷）
clean="$(printf '%s' "$pw" | tr -d 'A-Za-z0-9_-')"
assert_eq "" "$clean" "cfg_gen_password 只含 [A-Za-z0-9_-]"

# 產生 32 字元 URL-safe 隨機密碼。用 LC_ALL=C 處理二進位以相容 mac/Linux。
cfg_gen_password() {
  LC_ALL=C tr -dc 'A-Za-z0-9_-' < /dev/urandom 2>/dev/null | head -c 32
}

tmp="$(mktemp)"; printf 'STORAGE_TYPE=minio\nCLOUD_ENDPOINT=https://c.example.com\n# comment\n\n' > "$tmp"
cfg_load_answers "$tmp"
assert_eq "minio" "${CFG_STORAGE_TYPE:-}" "cfg_load_answers 載入 STORAGE_TYPE"
assert_eq "https://c.example.com" "${CFG_CLOUD_ENDPOINT:-}" "cfg_load_answers 載入 CLOUD_ENDPOINT"
rm -f "$tmp"

# 安全解析 KEY=value（略過註解/空行）；不 source（避免任意執行）。設成 CFG_<KEY>。
cfg_load_answers() {
  [ -f "$1" ] || return 0
  while IFS= read -r _line || [ -n "$_line" ]; do
    case "$_line" in ''|\#*) continue;; esac
    _k="${_line%%=*}"; _v="${_line#*=}"
    case "$_k" in *[!A-Za-z0-9_]*) continue;; esac   # 非法 key 名跳過
    eval "CFG_${_k}=\$_v"
  done < "$1"
}

d="$(mktemp -d)"
CFG_STORAGE_TYPE=minio CFG_DB_PASSWORD="sup3rs3cret" CFG_MINIO_SECRET_KEY="mk-secret" \
CFG_REGISTRATION_TOKEN="tok-123" CFG_CLOUD_ENDPOINT="https://c.example.com" \
CFG_AGENT_BASE_URL="https://192.168.50.121:8443" CFG_MINIO_ENDPOINT="192.168.50.121:9000" \
CFG_MINIO_ACCESS_KEY="admin" CFG_MINIO_BUCKET="guidant-ai" CFG_AGENT_IMAGE="evidence-agent:0.1.0"
cfg_write_env "$d"
cfg_write_answers "$d"
# .env 含密碼且權限 600
assert_contains "$(cat "$d/.env")" "DB_PASSWORD=sup3rs3cret" ".env 含 DB 密碼"
assert_eq "600" "$(stat -f '%Lp' "$d/.env" 2>/dev/null || stat -c '%a' "$d/.env")" ".env 權限 600"
# answers.conf 不含任何密碼/secret/token
ans="$(cat "$d/answers.conf")"
assert_not_contains "$ans" "sup3rs3cret" "answers.conf 不含 DB 密碼"
assert_not_contains "$ans" "mk-secret" "answers.conf 不含 MINIO_SECRET_KEY"
assert_not_contains "$ans" "tok-123" "answers.conf 不含 REGISTRATION_TOKEN"
assert_contains "$ans" "STORAGE_TYPE=minio" "answers.conf 保留非敏感欄位"
rm -rf "$d"

cfg_write_env() {
  _d="$1"; _f="$_d/.env"
  umask 077                       # 確保新檔預設不可被他人讀
  {
    printf 'AGENT_IMAGE=%s\n' "${CFG_AGENT_IMAGE:-evidence-agent:0.1.0}"
    printf 'STORAGE_TYPE=%s\n' "${CFG_STORAGE_TYPE:-minio}"
    printf 'MINIO_ENDPOINT=%s\n' "${CFG_MINIO_ENDPOINT:-}"
    printf 'MINIO_ACCESS_KEY=%s\n' "${CFG_MINIO_ACCESS_KEY:-}"
    printf 'MINIO_SECRET_KEY=%s\n' "${CFG_MINIO_SECRET_KEY:-}"
    printf 'MINIO_BUCKET=%s\n' "${CFG_MINIO_BUCKET:-}"
    printf 'BASE_DIR=%s\n' "${CFG_BASE_DIR:-/data/upload}"
    printf 'DB_PASSWORD=%s\n' "${CFG_DB_PASSWORD:-}"
    printf 'AGENT_AUTH_MODE=%s\n' "${CFG_AGENT_AUTH_MODE:-full}"
    printf 'CLOUD_ENDPOINT=%s\n' "${CFG_CLOUD_ENDPOINT:-}"
    printf 'REGISTRATION_TOKEN=%s\n' "${CFG_REGISTRATION_TOKEN:-}"
    printf 'AGENT_BASE_URL=%s\n' "${CFG_AGENT_BASE_URL:-}"
    printf 'HEARTBEAT_INTERVAL_SEC=%s\n' "${CFG_HEARTBEAT_INTERVAL_SEC:-300}"
  } > "$_f"
  chmod 600 "$_f"
}
# answers.conf：只寫非敏感欄位（白名單），方便複製到別台 / 版控。
cfg_write_answers() {
  _d="$1"; _f="$_d/answers.conf"
  {
    printf '# evidence-agent 無人值守安裝答案（不含任何密碼/secret/token）\n'
    printf '# 用法：./install.sh --config answers.conf --non-interactive\n'
    printf 'STORAGE_TYPE=%s\n' "${CFG_STORAGE_TYPE:-minio}"
    printf 'MINIO_ENDPOINT=%s\n' "${CFG_MINIO_ENDPOINT:-}"
    printf 'MINIO_ACCESS_KEY=%s\n' "${CFG_MINIO_ACCESS_KEY:-}"
    printf 'MINIO_BUCKET=%s\n' "${CFG_MINIO_BUCKET:-}"
    printf 'BASE_DIR=%s\n' "${CFG_BASE_DIR:-/data/upload}"
    printf 'CLOUD_ENDPOINT=%s\n' "${CFG_CLOUD_ENDPOINT:-}"
    printf 'AGENT_BASE_URL=%s\n' "${CFG_AGENT_BASE_URL:-}"
    printf 'HEARTBEAT_INTERVAL_SEC=%s\n' "${CFG_HEARTBEAT_INTERVAL_SEC:-300}"
  } > "$_f"
}

assert_eq "0" "$(pf_has_cmd sh; echo $?)" "pf_has_cmd 偵測存在的指令"
assert_eq "1" "$(pf_has_cmd __definitely_no_such_cmd__; echo $?)" "pf_has_cmd 偵測不存在的指令"
# pf_check_port 用樁判斷：樁 ss 回有人 listen 8443 → 應回非 0（被占用）
ss() { echo "LISTEN 0 0 0.0.0.0:8443 0.0.0.0:*"; }
assert_eq "1" "$(pf_check_port 8443; echo $?)" "pf_check_port 偵測 8443 被占用"
ss() { echo ""; }
assert_eq "0" "$(pf_check_port 8443; echo $?)" "pf_check_port 偵測 8443 空閒"
unset -f ss

pf_has_cmd() { command -v "$1" >/dev/null 2>&1; }
# port 被 listen 回 1（占用），空閒回 0。優先 ss，退而求其次 netstat。
pf_check_port() {
  _p="$1"
  if pf_has_cmd ss; then
    ss -ltn 2>/dev/null | grep -qE "[:.]$_p[[:space:]]" && return 1 || return 0
  elif pf_has_cmd netstat; then
    netstat -ltn 2>/dev/null | grep -qE "[:.]$_p[[:space:]]" && return 1 || return 0
  fi
  return 0   # 無工具可查時不擋（保守放行，README 提醒人工確認）
}
# host 指紋來源檔可讀（Linux only；mac 上會 false，僅 Linux 部署時呼叫）
pf_check_host_files() {
  [ -r /sys/class/dmi/id/product_uuid ] && [ -r /etc/machine-id ]
}
# 確保 image 在；不在則 docker load 同目錄精確檔名 image tar。
pf_ensure_image() {
  _img="$1"; _dir="$2"
  if docker image inspect "$_img" >/dev/null 2>&1; then return 0; fi
  _tar="$_dir/$(printf '%s' "$_img" | tr ':' '-').image.tar"   # evidence-agent-0.1.0.image.tar
  if [ -f "$_tar" ]; then log_info "載入 image: $_tar"; docker load -i "$_tar"; else
    log_err "找不到 image $_img,也找不到 $_tar"; return 1; fi
}

    ports:
      - "8080:8000"

    # full 模式不對外 publish 8080：控制面 agent 主動撥出、資料面走 nginx:8443。
    # demo（none 模式）測試需要直打 8080 時，疊用 docker-compose.demo.yml。

# demo / 測試用（AGENT_AUTH_MODE=none，雲端直打 8080，不經 mTLS）。
# 用法：docker compose -f docker-compose.yml -f docker-compose.demo.yml up -d
# ⚠️ 正式環境一律 full，不要疊這個 override（會繞過 mTLS）。
services:
  file-agent:
    ports:
      - "8080:8000"

git add deploy/docker-compose.yml deploy/docker-compose.demo.yml
git commit -m "feat(install): full 模式 base compose 不對外 publish 8080,demo override 才加回

控制面 agent 主動撥出、資料面走 nginx:8443，enroll 期間亦不需 8080。
解決安裝精靈 review 的 8080 繞過 mTLS 與 enroll 期 port 衝突疑慮。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

d="$(mktemp -d)"; mkdir -p "$d/certs"
# 還沒有 agent.crt → 1 秒 timeout 應逾時回非 0
assert_eq "1" "$(orch_wait_cert "$d/certs" 1 1; echo $?)" "orch_wait_cert 無憑證逾時回非 0"
# 放上 agent.crt → 應立即回 0
: > "$d/certs/agent.crt"
assert_eq "0" "$(orch_wait_cert "$d/certs" 2 1; echo $?)" "orch_wait_cert 憑證就緒回 0"
rm -rf "$d"

# 輪詢 certs/agent.crt 出現（= 雲端簽回憑證、enroll 成功）。逾時回 1。
orch_wait_cert() {
  _dir="$1"; _timeout="${2:-120}"; _interval="${3:-3}"; _waited=0
  while [ "$_waited" -lt "$_timeout" ]; do
    [ -f "$_dir/agent.crt" ] && return 0
    sleep "$_interval"; _waited=$((_waited+_interval))
  done
  return 1
}
# 以下為 docker 薄包裝（Linux 手動驗；DRY_RUN 時只印不執行）。
orch_compose() { if [ "${DRY_RUN:-0}" = "1" ]; then log_info "[dry-run] docker compose $*"; else docker compose "$@"; fi; }
orch_up_agent() { orch_compose up -d file-agent agent-db; }
orch_up_nginx() { orch_compose --profile full up -d nginx; }
orch_dump_agent_log() { orch_compose logs --tail 50 file-agent; }

out="$(vrf_print_handoff 'https://192.168.50.121:8443')"
assert_contains "$out" "https://192.168.50.121:8443" "交棒訊息含 base_url"
assert_contains "$out" "storage-config" "交棒訊息提示回雲端設 storage-config"
# vrf_local_tls 回傳碼：400/000 視為通，其餘（含 500/502 死站）視為失敗（stub curl）
curl() { echo 400; }; assert_eq "0" "$(vrf_local_tls; echo $?)" "vrf_local_tls 400 視為通"
curl() { echo 000; }; assert_eq "0" "$(vrf_local_tls; echo $?)" "vrf_local_tls 000(握手失敗)放行"
curl() { echo 500; }; assert_eq "1" "$(vrf_local_tls; echo $?)" "vrf_local_tls 500 視為失敗"
unset -f curl

# /health 200 視為 OK（樁：測試可 shadow curl）
vrf_local_health() { _code="$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8000/health 2>/dev/null || echo 000)"; [ "$_code" = "200" ]; }
# 本機打 nginx:8443，預期被 mTLS 擋成 400 → 證明 TLS+port 通。
# 400=mTLS 正常擋；000=curl 對 mTLS 握手失敗（部分環境如此）也放行；其餘（500/502/死站）視為失敗。
vrf_local_tls() {
  _code="$(curl -sk -o /dev/null -w '%{http_code}' https://localhost:8443/ 2>/dev/null || echo 000)"
  case "$_code" in 400|000) return 0;; *) return 1;; esac
}
vrf_certs_present() { _d="$1"; [ -f "$_d/agent.crt" ] && [ -f "$_d/agent.key" ] && [ -f "$_d/ca.crt" ]; }
vrf_print_handoff() {
  _base="$1"
  cat <<EOF
─────────────────────────────────────────────
安裝完成（本機這側驗證通過）。下一步請在雲端做：
  1) 用該 tenant 帳號登入前端 → 儲存設定(storage-config) → storage_type 選 remote_agent
     → 選這台 agent（base_url = $_base）→ 存檔
  2) 從雲端那台（有 client 憑證）跑三層認證驗證：
       不帶憑證 → 400 / 帶憑證 → 200 / /blob 不帶 JWT → 401
     （指令見 deploy/README.md §9-1）
─────────────────────────────────────────────
EOF
}

#!/usr/bin/env bash
set -eu
DIR="$(cd "$(dirname "$0")" && pwd)"
. "$DIR/install-lib.sh"

CONFIG_FILE=""; NON_INTERACTIVE=0; DRY_RUN=0
while [ $# -gt 0 ]; do case "$1" in
  --config) CONFIG_FILE="$2"; shift 2;;
  --non-interactive) NON_INTERACTIVE=1; shift;;
  --dry-run) DRY_RUN=1; shift;;
  -h|--help) echo "用法: ./install.sh [--config answers.conf] [--non-interactive] [--dry-run]"; exit 0;;
  *) log_err "未知參數: $1"; exit 2;;
esac; done
export DRY_RUN

# 載入既有設定當預設（重跑友善）：先 .env 後 answers.conf 後 --config
cfg_load_answers "$DIR/.env"
cfg_load_answers "$DIR/answers.conf"
[ -n "$CONFIG_FILE" ] && cfg_load_answers "$CONFIG_FILE"

# ① Preflight（dry-run 跳過所有環境相依檢查，方便 mac 上驗流程）
log_info "① Preflight 檢查"
if [ "$DRY_RUN" != "1" ]; then
  pf_has_cmd docker || { log_err "未找到 docker，請先安裝 Docker 與 compose plugin"; exit 1; }
  docker compose version >/dev/null 2>&1 || { log_err "未找到 docker compose v2 plugin"; exit 1; }
  pf_check_host_files || { log_err "讀不到 /sys/class/dmi/id/product_uuid 或 /etc/machine-id（agent 必須跑在 Linux）"; exit 1; }
  pf_check_port 8443 || { log_err "port 8443 已被占用，請先釋放再重跑"; exit 1; }
  pf_ensure_image "${CFG_AGENT_IMAGE:-evidence-agent:0.1.0}" "$DIR/.." || exit 1
fi

# ② 設定收集
log_info "② 設定收集"
if [ "$NON_INTERACTIVE" = "0" ]; then
  CFG_STORAGE_TYPE="$(ask '儲存模式 (minio/local)' "${CFG_STORAGE_TYPE:-minio}")"
  if [ "$CFG_STORAGE_TYPE" = "minio" ]; then
    CFG_MINIO_ENDPOINT="$(ask 'MinIO endpoint (LAN IP:9000)' "${CFG_MINIO_ENDPOINT:-}")"
    CFG_MINIO_ACCESS_KEY="$(ask 'MinIO access key' "${CFG_MINIO_ACCESS_KEY:-}")"
    CFG_MINIO_SECRET_KEY="$(ask 'MinIO secret key' "${CFG_MINIO_SECRET_KEY:-}")"
    CFG_MINIO_BUCKET="$(ask 'MinIO bucket' "${CFG_MINIO_BUCKET:-guidant-ai}")"
  fi
  CFG_CLOUD_ENDPOINT="$(ask '雲端 base URL (不含 /api/1.0)' "${CFG_CLOUD_ENDPOINT:-}")"
  CFG_REGISTRATION_TOKEN="$(ask '註冊 token (雲端管理頁產生)' "${CFG_REGISTRATION_TOKEN:-}")"
  if [ -z "${CFG_DB_PASSWORD:-}" ]; then
    _g="$(ask 'agent DB 密碼 (留空=自動產生強密碼)' '')"
    [ -z "$_g" ] && _g="$(cfg_gen_password)" && log_ok "已自動產生 agent DB 密碼（寫入 .env，不顯示）"
    CFG_DB_PASSWORD="$_g"
  fi
  _ip="$(cfg_derive_ip)"
  CFG_AGENT_BASE_URL="$(ask '本機對雲端可達 URL (必須 https + 8443)' "${CFG_AGENT_BASE_URL:-https://${_ip}:8443}")"
fi
CFG_AGENT_AUTH_MODE=full
# 必填校驗
for _req in CLOUD_ENDPOINT REGISTRATION_TOKEN AGENT_BASE_URL DB_PASSWORD; do
  eval "_v=\${CFG_$_req:-}"; [ -n "$_v" ] || { log_err "缺必填: $_req"; exit 2; }
done
case "$CFG_AGENT_BASE_URL" in https://*:8443) :;; *) log_err "AGENT_BASE_URL 必須是 https://<ip>:8443"; exit 2;; esac
cfg_write_env "$DIR"; cfg_write_answers "$DIR"
log_ok "已寫出 $DIR/.env (600) 與 $DIR/answers.conf (無密碼)"

# ③ 啟動編排
log_info "③ 啟動編排"
[ "$DRY_RUN" = "1" ] || sh "$DIR/collect-host-id.sh"
( cd "$DIR" && orch_up_agent )   # orch_* 經 orch_compose 在 DRY_RUN 下自我跳過(只印不執行)
log_info "等待 agent 向雲端註冊、簽回憑證 ..."
if [ "$DRY_RUN" != "1" ] && ! ( cd "$DIR" && orch_wait_cert "$DIR/certs" 180 3 ); then
  log_err "等不到 certs/agent.crt（enroll 失敗）。以下為 agent log:"; ( cd "$DIR" && orch_dump_agent_log ); exit 1
fi
( cd "$DIR" && orch_up_nginx )

# ④ 自我驗證 + 交棒
log_info "④ 自我驗證"
if [ "$DRY_RUN" != "1" ]; then
  vrf_certs_present "$DIR/certs" && log_ok "憑證已落地" || log_warn "憑證不齊，請查 agent log"
  vrf_local_health && log_ok "file-agent /health 200" || log_warn "/health 未回 200"
  vrf_local_tls && log_ok "本機 :8443 TLS 通（mTLS 擋為預期）" || log_warn ":8443 未回預期碼（檢查 nginx 是否起來）"
fi
vrf_print_handoff "$CFG_AGENT_BASE_URL"

cd ~/Projects/Billows/Audit-Manager/evidence-agent/deploy
printf 'STORAGE_TYPE=local\nCLOUD_ENDPOINT=https://c.example.com\nAGENT_BASE_URL=https://192.168.50.121:8443\n' > /tmp/ans.conf
# 補密碼/token（非互動需要）
CFG_DB_PASSWORD=x CFG_REGISTRATION_TOKEN=y bash install.sh --config /tmp/ans.conf --non-interactive --dry-run

git add deploy/install.sh deploy/install-lib.sh
git commit -m "feat(install): install.sh 主流程串接四階段 + arg 解析 + dry-run

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

# evidence-agent 無人值守安裝答案範本（複製成 answers.conf;不含任何密碼/secret/token）
# 密碼類（DB_PASSWORD / MINIO_SECRET_KEY / REGISTRATION_TOKEN）安裝時互動補，或由精靈自動產生。
STORAGE_TYPE=minio
MINIO_ENDPOINT=192.168.50.121:9000
MINIO_ACCESS_KEY=admin
MINIO_BUCKET=guidant-ai
CLOUD_ENDPOINT=https://cloud.example.com
AGENT_BASE_URL=https://192.168.50.121:8443
HEARTBEAT_INTERVAL_SEC=300

git add deploy/answers.conf.example deploy/README.md
git commit -m "docs(install): answers.conf 範本 + README 改以 install.sh 為主流程

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"

cd ~/Projects/Billows/Audit-Manager/evidence-agent
docker save evidence-agent:0.1.0 -o evidence-agent-0.1.0.image.tar
tar czf evidence-agent-deploy-0.1.0.tar.gz \
  deploy/install.sh deploy/install-lib.sh deploy/docker-compose.yml deploy/docker-compose.demo.yml \
  deploy/nginx deploy/collect-host-id.sh deploy/.env.example deploy/answers.conf.example deploy/README.md \
  evidence-agent-0.1.0.image.tar

tar xzf evidence-agent-deploy-0.1.0.tar.gz && cd deploy && ./install.sh

docker compose -f docker-compose.yml -f docker-compose.demo.yml config | grep 8080   # 應有 8080