install.sh

#!/usr/bin/env bash
# install.sh — Claude Code pentesting setup (HTB + Bug Bounty)
# https://github.com/tostolaza/Claude-pentesting-config
# Target: Kali Linux (also works on Ubuntu/Debian/macOS)
set -euo pipefail

# ── colours ────────────────────────────────────────────────────────────────────
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; NC='\033[0m'

info()    { echo -e "${CYAN}[*]${NC} $*"; }
ok()      { echo -e "${GREEN}[+]${NC} $*"; }
warn()    { echo -e "${YELLOW}[!]${NC} $*"; }
die()     { echo -e "${RED}[✗]${NC} $*" >&2; exit 1; }
skip()    { echo -e "    ${NC}[-]${NC} saltando $*"; }
section() { echo -e "\n${BOLD}── $* ──${NC}"; }

# ── helpers ────────────────────────────────────────────────────────────────────
have() { command -v "$1" &>/dev/null; }

ask_yes_no() {
    local prompt="$1" default="${2:-y}"
    local yn
    if [[ "$default" == "y" ]]; then
        read -rp "$(echo -e "${YELLOW}[?]${NC} $prompt [Y/n] ")" yn
        yn="${yn:-y}"
    else
        read -rp "$(echo -e "${YELLOW}[?]${NC} $prompt [y/N] ")" yn
        yn="${yn:-n}"
    fi
    [[ "$yn" =~ ^[Yy]$ ]]
}

pip_install() {
    local pkg="$1"
    if have pip3; then
        pip3 install --quiet --break-system-packages "$pkg" 2>/dev/null \
            || pip3 install --quiet "$pkg" 2>/dev/null \
            || warn "pip install $pkg falló — instalar manualmente"
    fi
}

go_install() {
    local pkg="$1" bin="$2"
    have "$bin" && { ok "$bin ya instalado"; return; }
    if have go; then
        info "Instalando $bin via go..."
        go install "$pkg" 2>/dev/null && ok "$bin instalado" || warn "go install $pkg falló"
    else
        warn "$bin no encontrado y go no disponible — instalar manualmente"
    fi
}

clone_if_missing() {
    local name="$1" url="$2" dest="$3"
    if [[ -d "$dest/.git" ]]; then
        info "$name ya clonado — actualizando..."
        git -C "$dest" pull --quiet 2>/dev/null || true
    else
        info "Clonando $name..."
        git clone --depth=1 "$url" "$dest" 2>/dev/null && ok "$name clonado" \
            || warn "No se pudo clonar $name"
    fi
}

uninstall_config() {
    section "Desinstalación"

    warn "Esto eliminará toda la configuración de Claude pentesting"
    echo "  - ~/.claude/"
    echo "  - ~/.local/bin/htb"
    echo "  - ~/.local/bin/bb"
    echo "  - Líneas de PATH en .bashrc/.zshrc/.profile/.bash_profile"
    echo ""

    if ! ask_yes_no "¿Continuar con la desinstalación?" n; then
        echo "Desinstalación cancelada"
        exit 0
    fi

    # Backup antes de eliminar
    if [[ -d "$HOME/.claude" ]]; then
        BACKUP="$HOME/.claude.uninstall-backup.$(date +%Y%m%d-%H%M%S)"
        info "Creando backup en $BACKUP"
        cp -r "$HOME/.claude" "$BACKUP"
        ok "Backup creado"

        info "Eliminando ~/.claude/"
        rm -rf "$HOME/.claude"
        ok "~/.claude/ eliminado"
    fi

    # Eliminar wrappers
    for wrapper in "$HOME/.local/bin/htb" "$HOME/.local/bin/bb"; do
        if [[ -f "$wrapper" ]]; then
            info "Eliminando $(basename "$wrapper")"
            rm -f "$wrapper"
            ok "$(basename "$wrapper") eliminado"
        fi
    done

    # Eliminar líneas de PATH
    PATH_LINE='export PATH="$HOME/.local/bin:$HOME/go/bin:$PATH"'
    for rc in "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.profile" "$HOME/.bash_profile"; do
        if [[ -f "$rc" ]] && grep -q 'local/bin' "$rc" 2>/dev/null; then
            info "Limpiando PATH en $(basename "$rc")"
            # Crear archivo temporal sin las líneas de PATH
            grep -v 'local/bin.*go/bin.*PATH' "$rc" > "${rc}.tmp" || true
            mv "${rc}.tmp" "$rc"
            ok "PATH limpiado en $(basename "$rc")"
        fi
    done

    ok "Desinstalación completada"
    echo ""
    echo "  Backup disponible en: $BACKUP"
    echo "  Para reinstalar: bash install.sh"
    echo ""
}

# ── flags ──────────────────────────────────────────────────────────────────────
YOLO=false
SKIP_TOOLS=false
WITH_BURP_MCP=false
UNINSTALL=false
for arg in "$@"; do
    case "$arg" in
        --yolo)           YOLO=true ;;
        --skip-tools)     SKIP_TOOLS=true ;;
        --with-burp-mcp)  WITH_BURP_MCP=true ;;
        --uninstall)      UNINSTALL=true ;;
        --help|-h)
            cat <<EOF
Uso: bash install.sh [--yolo] [--skip-tools] [--with-burp-mcp] [--uninstall]

  (por defecto)  Modo seguro: defaultMode=default con allowlist explícita.
                 Claude pedirá permiso antes de ejecutar la mayoría de tools.

  --yolo         Modo bypass: defaultMode=bypassPermissions.
                 Claude ejecuta sin preguntar. Úsalo solo en máquinas
                 aisladas que controles por completo. Los hooks son tu
                 único filtro.

  --skip-tools   Salta la instalación de tools de Go/pip.

  --with-burp-mcp  Configura el MCP server de Burp Suite en settings.json
                   (puerto 9876, localhost). Requiere la extensión MCP
                   Server instalada en Burp. Hace backup previo.

  --uninstall    Desinstala la configuración de Claude pentesting.
                 Elimina ~/.claude/, wrappers y líneas de PATH.
EOF
            exit 0 ;;
    esac
done

# ── constants ──────────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_URL="https://github.com/tostolaza/Claude-pentesting-config"
CLAUDE_DIR="$HOME/.claude"
BIN_DIR="$HOME/.local/bin"
HTB_BASE="$HOME/labs/htb"
BB_BASE="$HOME/bb-lab"
# Versión testada. Actualizar al validar una nueva release.
CLAUDE_TESTED_VERSION="2.1.138"
CLAUDE_MIN_VERSION="2.0.0"

mkdir -p "$BIN_DIR" "$CLAUDE_DIR"

# ── uninstall check ────────────────────────────────────────────────────────────
if $UNINSTALL; then
    uninstall_config
    exit 0
fi

# ── banner ─────────────────────────────────────────────────────────────────────
echo -e "${BOLD}"
echo "╔══════════════════════════════════════════════╗"
echo "║   Claude Code — Instalador config pentesting ║"
echo "║          HTB + Bug Bounty + Kali             ║"
echo "╚══════════════════════════════════════════════╝"
echo -e "${NC}"

$YOLO && echo -e "${RED}${BOLD}  ⚠  --yolo: bypassPermissions. Los hooks son tu único filtro.${NC}\n" || true

# ── 1. OS detection ────────────────────────────────────────────────────────────
section "Sistema"

OS="$(uname -s)"
IS_KALI=false
IS_DEBIAN=false

case "$OS" in
    Linux)
        if grep -qi "kali" /etc/os-release 2>/dev/null; then
            IS_KALI=true
            ok "Kali Linux detectado"
        elif grep -qi "debian\|ubuntu" /etc/os-release 2>/dev/null; then
            IS_DEBIAN=true
            ok "Debian/Ubuntu detectado"
        else
            ok "Linux detectado"
        fi ;;
    Darwin) ok "macOS detectado" ;;
    *)      die "OS no soportado: $OS" ;;
esac

# ── 2. Dependencias base ───────────────────────────────────────────────────────
section "Dependencias base"

MISSING_DEPS=()
for dep in git curl jq; do
    have "$dep" || MISSING_DEPS+=("$dep")
done

if [[ ${#MISSING_DEPS[@]} -gt 0 ]]; then
    warn "Faltan: ${MISSING_DEPS[*]}"
    if [[ "$IS_KALI" == true || "$IS_DEBIAN" == true ]]; then
        info "Instalando via apt..."
        sudo apt-get install -y -qq "${MISSING_DEPS[@]}" 2>/dev/null && ok "Dependencias instaladas"
    else
        die "Instala manualmente: ${MISSING_DEPS[*]}"
    fi
else
    ok "git, curl, jq — OK"
fi

# ── 3. Claude Code CLI ─────────────────────────────────────────────────────────
section "Claude Code CLI"

install_claude() {
    if have npm; then
        info "Instalando Claude Code via npm..."
        npm install -g @anthropic-ai/claude-code 2>/dev/null && return 0
    fi
    if have curl; then
        info "Instalando Claude Code via installer..."
        curl -fsSL https://claude.ai/install.sh | bash && return 0
    fi
    return 1
}

export PATH="$BIN_DIR:$PATH"

if have claude; then
    CLAUDE_VERSION="$(claude --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
    ok "Claude Code $CLAUDE_VERSION (testada con $CLAUDE_TESTED_VERSION)"
    if [[ "$CLAUDE_VERSION" != "$CLAUDE_TESTED_VERSION" ]]; then
        warn "Versión instalada ($CLAUDE_VERSION) ≠ versión testada ($CLAUDE_TESTED_VERSION)"
        warn "Los hooks pueden comportarse diferente. Actualiza CLAUDE_TESTED_VERSION en install.sh si funciona bien."
    fi
    if [[ "$(printf '%s\n' "$CLAUDE_MIN_VERSION" "$CLAUDE_VERSION" | sort -V | head -1)" != "$CLAUDE_MIN_VERSION" ]]; then
        warn "Versión $CLAUDE_VERSION < mínimo soportado $CLAUDE_MIN_VERSION"
    fi
else
    warn "Claude Code no encontrado"
    if ask_yes_no "¿Instalar Claude Code?"; then
        install_claude || die "Instalación de Claude Code falló"
        export PATH="$BIN_DIR:$PATH"
        have claude && ok "Claude Code instalado: $(claude --version 2>/dev/null | head -1)" \
            || die "Claude Code instalado pero no en PATH — añade $BIN_DIR a PATH"
    fi
fi

# ── 4. Config repo ─────────────────────────────────────────────────────────────
section "Archivos de configuración"

ALREADY_INSTALLED=false
if [[ "$(realpath "$SCRIPT_DIR")" == "$(realpath "$CLAUDE_DIR")" ]]; then
    TMPDIR_REPO="$(mktemp -d)"
    info "Script dentro de ~/.claude — clonando copia fresca..."
    git clone --depth=1 "$REPO_URL" "$TMPDIR_REPO/repo" 2>/dev/null
    SOURCE_DIR="$TMPDIR_REPO/repo"
    ALREADY_INSTALLED=true
elif [[ -f "$SCRIPT_DIR/CLAUDE.md" && -d "$SCRIPT_DIR/hooks" ]]; then
    SOURCE_DIR="$SCRIPT_DIR"
    info "Usando repo local: $SOURCE_DIR"
else
    TMPDIR_REPO="$(mktemp -d)"
    info "Clonando $REPO_URL ..."
    git clone --depth=1 "$REPO_URL" "$TMPDIR_REPO/repo"
    SOURCE_DIR="$TMPDIR_REPO/repo"
    ok "Clonado"
fi

# Backup
if [[ -d "$CLAUDE_DIR" && "$ALREADY_INSTALLED" == false ]]; then
    BACKUP="$HOME/.claude.backup.$(date +%Y%m%d-%H%M%S)"
    warn "~/.claude ya existe"
    if ask_yes_no "¿Hacer backup en $BACKUP?"; then
        cp -r "$CLAUDE_DIR" "$BACKUP"; ok "Backup en $BACKUP"
    fi
fi

mkdir -p "$CLAUDE_DIR"

# Copiar archivos de config (nunca los playbooks — son locales y privados)
FILES_TO_COPY=(CLAUDE.md README.md)
DIRS_TO_COPY=(commands agents hooks skills)

for f in "${FILES_TO_COPY[@]}"; do
    [[ -f "$SOURCE_DIR/$f" ]] || continue
    src="$SOURCE_DIR/$f"; dst="$CLAUDE_DIR/$f"
    [[ "$(realpath "$src")" == "$(realpath "$dst" 2>/dev/null)" ]] && { skip "$f (mismo archivo)"; continue; }
    if [[ -f "$dst" ]]; then
        ask_yes_no "¿Sobreescribir $f?" n && { cp "$src" "$dst"; ok "Actualizado $f"; } || skip "$f"
    else
        cp "$src" "$dst"; ok "Instalado $f"
    fi
done

# Plantillas de playbook — copiar solo si el fichero local no existe
for tmpl in htb-playbook bb-playbook; do
    src="$SOURCE_DIR/${tmpl}.template.md"
    dst="$CLAUDE_DIR/${tmpl}.md"
    [[ -f "$src" ]] || continue
    if [[ ! -f "$dst" ]]; then
        cp "$src" "$dst"
        ok "Creado ${tmpl}.md desde plantilla (rellena con tus lecciones)"
    else
        skip "${tmpl}.md ya existe — no se sobrescribe (usa /remember para añadir entradas)"
    fi
done

for d in "${DIRS_TO_COPY[@]}"; do
    [[ -d "$SOURCE_DIR/$d" ]] || continue
    src="$SOURCE_DIR/$d"; dst="$CLAUDE_DIR/$d"
    [[ "$(realpath "$src")" == "$(realpath "$dst" 2>/dev/null)" ]] && { skip "$d/ (mismo directorio)"; continue; }
    mkdir -p "$dst"
    cp -r "$src/." "$dst/"
    ok "Instalado $d/"
done

chmod +x "$CLAUDE_DIR"/hooks/*.sh 2>/dev/null
ok "Hooks ejecutables"

# Copiar bin/ a ~/.local/bin/
if [[ -d "$SOURCE_DIR/bin" ]]; then
    mkdir -p "$BIN_DIR"
    for bin_file in "$SOURCE_DIR"/bin/*; do
        [[ -f "$bin_file" ]] || continue
        bin_name="$(basename "$bin_file")"
        cp "$bin_file" "$BIN_DIR/$bin_name"
        chmod +x "$BIN_DIR/$bin_name"
    done
    ok "Wrappers htb y bb instalados en $BIN_DIR"
fi

# Copiar templates/
if [[ -d "$SOURCE_DIR/templates" ]]; then
    mkdir -p "$CLAUDE_DIR/templates"
    cp -r "$SOURCE_DIR/templates/." "$CLAUDE_DIR/templates/"
    ok "Templates copiados a $CLAUDE_DIR/templates"

    # También copiar bb-project template al directorio de proyectos
    if [[ -d "$SOURCE_DIR/templates/bb-project" ]]; then
        mkdir -p "$BB_BASE/projects"
        if [[ ! -d "$BB_BASE/projects/bb-template" ]]; then
            cp -r "$SOURCE_DIR/templates/bb-project" "$BB_BASE/projects/bb-template"
            ok "Template bb-project copiado a $BB_BASE/projects/bb-template"
        fi
    fi
fi

# Crear directorios de proyecto
mkdir -p "$HTB_BASE" "$BB_BASE/projects"
ok "Directorios de proyecto creados"

# ── 5. Settings ────────────────────────────────────────────────────────────────
section "Settings"

SETTINGS_FILE="$CLAUDE_DIR/settings.json"

if [[ -f "$SETTINGS_FILE" ]]; then
    warn "settings.json existe — sin cambios"
    CURRENT_MODE="$(python3 -c "import json; print(json.load(open('$SETTINGS_FILE')).get('permissions',{}).get('defaultMode','?'))" 2>/dev/null || echo '?')"
    info "  defaultMode actual: $CURRENT_MODE"
    info "  Borra $SETTINGS_FILE y re-ejecuta con/sin --yolo para cambiar."
elif $YOLO; then
    TMPL="$SOURCE_DIR/settings.yolo.json"
    [[ -f "$TMPL" ]] && cp "$TMPL" "$SETTINGS_FILE" || \
        printf '{"permissions":{"defaultMode":"bypassPermissions"}}\n' > "$SETTINGS_FILE"
    ok "settings.json (bypassPermissions — --yolo)"
    warn "Hooks block-dangerous, scope-check y egress-guard son tu único guardrail."
else
    TMPL="$SOURCE_DIR/settings.default.json"
    [[ -f "$TMPL" ]] && cp "$TMPL" "$SETTINGS_FILE" || \
        printf '{"permissions":{"defaultMode":"default"}}\n' > "$SETTINGS_FILE"
    ok "settings.json (default + allowlist)"
    info "  Usa --yolo para instalar en modo bypassPermissions."
fi

# settings.local.json con rutas absolutas
cat > "$CLAUDE_DIR/settings.local.json" <<JSON
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/block-dangerous.sh"},
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/egress-guard.sh"},
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/scope-check.sh"},
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/evidence-gate.sh"}
        ]
      },
      {
        "matcher": "Write",
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/report-gate.sh"}
        ]
      },
      {
        "matcher": "WebFetch|WebSearch",
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/scope-check.sh"}
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/auto-timeline.sh"},
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/time-budget.sh"}
        ]
      }
    ],
    "SessionStart": [
      {
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/session-id-guard.sh"},
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/session-context.sh"}
        ]
      }
    ],
    "PreCompact": [
      {
        "hooks": [
          {"type": "command", "command": "${CLAUDE_DIR}/hooks/pre-compact-backup.sh"}
        ]
      }
    ]
  }
}
JSON
ok "settings.local.json (hooks registrados)"

# ── 5b. Burp Suite MCP (opt-in) ────────────────────────────────────────────────
if $WITH_BURP_MCP; then
    section "Burp Suite MCP"

    if [[ -f "$SETTINGS_FILE" ]]; then
        BURP_BACKUP="${SETTINGS_FILE}.pre-burp-mcp.$(date +%Y%m%d-%H%M%S)"
        cp "$SETTINGS_FILE" "$BURP_BACKUP"
        ok "Backup en $BURP_BACKUP"
    fi

    if have jq && [[ -f "$SETTINGS_FILE" ]]; then
        TMP_SETTINGS="$(mktemp)"
        jq '.mcpServers["burp"] = {"type":"http","url":"http://127.0.0.1:9876/mcp"}' \
            "$SETTINGS_FILE" > "$TMP_SETTINGS" \
            && mv "$TMP_SETTINGS" "$SETTINGS_FILE" \
            && ok "Burp MCP server añadido a settings.json (127.0.0.1:9876)" \
            || warn "No pude modificar settings.json — añade manualmente"
    else
        warn "jq no disponible o settings.json ausente — añade mcpServers manualmente"
    fi
    info "Recuerda: instala la extensión 'MCP Server' en Burp (BApp Store) y arráncala."
    info "Doc: integrations/burp-mcp/README.md"
else
    info "Burp MCP disponible — ver integrations/burp-mcp/ (usa --with-burp-mcp para auto-instalar)"
fi

# ── 6. Repos de skills y herramientas ─────────────────────────────────────────
section "Repos de skills"

mkdir -p "$BB_BASE/repos"

clone_if_missing "claude-bug-bounty" \
    "https://github.com/shuvonsec/claude-bug-bounty.git" \
    "$BB_BASE/repos/claude-bug-bounty"

clone_if_missing "communitytools" \
    "https://github.com/transilienceai/communitytools.git" \
    "$BB_BASE/repos/communitytools"

clone_if_missing "trailofbits-skills" \
    "https://github.com/trailofbits/skills.git" \
    "$BB_BASE/repos/trailofbits-skills"

clone_if_missing "awesome-claude-skills-security" \
    "https://github.com/Eyadkelleh/awesome-claude-skills-security.git" \
    "$BB_BASE/repos/awesome-claude-skills-security"

# MCP bugbounty server (solo si hay Docker)
if have docker; then
    clone_if_missing "bugbounty-mcp-server" \
        "https://github.com/gokulapap/bugbounty-mcp-server.git" \
        "$BB_BASE/repos/bugbounty-mcp-server"
fi


# Enlazar skills de claude-bug-bounty → ~/.claude/skills/
if [[ -d "$BB_REPO/skills" ]]; then
    info "Enlazando skills de claude-bug-bounty..."
    mkdir -p "$CLAUDE_DIR/skills"
    for skill_dir in "$BB_REPO"/skills/*/; do
        [[ -d "$skill_dir" ]] || continue
        skill_name="$(basename "$skill_dir")"
        target="$CLAUDE_DIR/skills/$skill_name"
        if [[ -d "$target" && ! -L "$target" ]]; then
            mv "$target" "${target}.manual-backup"
        fi
        if [[ ! -L "$target" ]]; then
            ln -sf "$skill_dir" "$target"
            ok "  skill: $skill_name"
        fi
    done
fi

# Enlazar slash commands de claude-bug-bounty
if [[ -d "$BB_REPO/commands" ]]; then
    for cmd_file in "$BB_REPO"/commands/*.md; do
        [[ -f "$cmd_file" ]] || continue
        cmd_name="$(basename "$cmd_file")"
        [[ ! -f "$CLAUDE_DIR/commands/$cmd_name" ]] && \
            ln -sf "$cmd_file" "$CLAUDE_DIR/commands/$cmd_name"
    done
    ok "Slash commands de claude-bug-bounty enlazados"
fi

# ── 7. Herramientas opcionales ────────────────────────────────────────────────
section "Herramientas opcionales"

# Instalar tools desde claude-bug-bounty si existe
BB_REPO="$BB_BASE/repos/claude-bug-bounty"
if [[ -d "$BB_REPO" && -x "$BB_REPO/install_tools.sh" ]]; then
    if ask_yes_no "¿Instalar herramientas de seguridad desde claude-bug-bounty?" n; then
        info "Ejecutando install_tools.sh desde claude-bug-bounty..."
        cd "$BB_REPO" && ./install_tools.sh 2>/dev/null || warn "Algunas herramientas fallaron"
        cd - > /dev/null
        ok "Herramientas de seguridad instaladas"
    fi
else
    info "claude-bug-bounty no encontrado o install_tools.sh no disponible"
    info "Las herramientas se pueden instalar después clonando:"
    info "  git clone https://github.com/shuvonsec/claude-bug-bounty.git"
    info "  cd claude-bug-bounty && ./install_tools.sh"
fi

# ── 8. Playwright MCP ──────────────────────────────────────────────────────────
section "Playwright MCP"

if have npm; then
    if npx playwright --version &>/dev/null 2>&1; then
        ok "Playwright ya instalado"
    elif ask_yes_no "¿Instalar Playwright MCP? (útil para testing web interactivo)" n; then
        info "Instalando Playwright MCP..."
        npm install -g @playwright/mcp 2>/dev/null \
            && npx playwright install chromium 2>/dev/null \
            && ok "Playwright MCP instalado" \
            || warn "Playwright falló — instalar manualmente: npm install -g @playwright/mcp"
    fi
else
    skip "Playwright (npm no disponible)"
fi

# ── 9. Herramientas de pentesting ──────────────────────────────────────────────
section "Herramientas de pentesting"

if [[ "$SKIP_TOOLS" == true ]]; then
    skip "instalación de tools (--skip-tools)"
else
    # En Kali la mayoría están pre-instalados — solo instalamos lo que falta
    if [[ "$IS_KALI" == true ]]; then
        info "Kali detectado — verificando tools adicionales..."

        # Go tools (ProjectDiscovery) — suelen no estar en Kali base
        if have go || [[ -d "$HOME/go/bin" ]]; then
            export PATH="$HOME/go/bin:$PATH"
            go_install "github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest" "subfinder"
            go_install "github.com/projectdiscovery/httpx/cmd/httpx@latest"           "httpx"
            go_install "github.com/projectdiscovery/katana/cmd/katana@latest"         "katana"
            go_install "github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"      "nuclei"
            go_install "github.com/tomnomnom/waybackurls@latest"                      "waybackurls"
            go_install "github.com/lc/gau/v2/cmd/gau@latest"                         "gau"
            go_install "github.com/tomnomnom/gf@latest"                              "gf"
        else
            warn "Go no encontrado — subfinder/httpx/katana/nuclei no instalados"
            info "  Instala Go: https://go.dev/dl/ o: sudo apt install golang-go"
        fi

        # Python tools via pip
        have certipy-ad  || pip_install "certipy-ad"
        have bloodhound  || pip_install "bloodhound"
        have netexec     || pip_install "netexec"   # nxc (crackmapexec successor)

        # chisel — descarga binario si no está
        if ! have chisel; then
            if ask_yes_no "¿Instalar chisel (proxy/tunnel)?" n; then
                CHISEL_VER="1.9.1"
                ARCH="$(uname -m)"
                case "$ARCH" in
                    x86_64)  CHISEL_ARCH="amd64" ;;
                    aarch64) CHISEL_ARCH="arm64" ;;
                    *)       CHISEL_ARCH="amd64" ;;
                esac
                CHISEL_URL="https://github.com/jpillora/chisel/releases/download/v${CHISEL_VER}/chisel_${CHISEL_VER}_linux_${CHISEL_ARCH}.gz"
                curl -fsSL "$CHISEL_URL" -o /tmp/chisel.gz 2>/dev/null \
                    && gunzip -f /tmp/chisel.gz \
                    && mv /tmp/chisel "$BIN_DIR/chisel" \
                    && chmod +x "$BIN_DIR/chisel" \
                    && ok "chisel $CHISEL_VER instalado" \
                    || warn "chisel falló — instalar manualmente"
            fi
        else
            ok "chisel ya instalado"
        fi

        # Verificar tools críticos pre-instalados en Kali
        KALI_TOOLS=(nmap gobuster ffuf feroxbuster nikto whatweb hydra john hashcat
                    enum4linux smbclient smbmap sqlmap impacket-scripts crackmapexec)
        MISSING_KALI=()
        for tool in "${KALI_TOOLS[@]}"; do
            have "$tool" || MISSING_KALI+=("$tool")
        done
        if [[ ${#MISSING_KALI[@]} -gt 0 ]]; then
            warn "Tools Kali no encontrados: ${MISSING_KALI[*]}"
            if ask_yes_no "¿Instalar via apt?"; then
                sudo apt-get install -y -qq "${MISSING_KALI[@]}" 2>/dev/null \
                    && ok "Tools instalados" || warn "Algunos fallaron"
            fi
        else
            ok "Tools Kali — todos presentes"
        fi

    else
        # No-Kali: solo advertir
        TOOLS_TO_CHECK=(nmap curl python3 git jq)
        for t in "${TOOLS_TO_CHECK[@]}"; do
            have "$t" || warn "$t no encontrado"
        done
        info "Para el conjunto completo de tools, usa Kali Linux."
    fi
fi



# ── 10. PATH ───────────────────────────────────────────────────────────────────
section "PATH"

LOCAL_BIN="$HOME/.local/bin"
GO_BIN="$HOME/go/bin"
PATH_LINE='export PATH="$HOME/.local/bin:$HOME/go/bin:$PATH"'

for rc in "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.profile" "$HOME/.bash_profile"; do
    [[ -f "$rc" ]] || continue
    if ! grep -q 'local/bin' "$rc" 2>/dev/null; then
        echo "$PATH_LINE" >> "$rc"
        ok "PATH añadido a $rc"
    fi
done

[[ ":$PATH:" != *":$LOCAL_BIN:"* ]] && export PATH="$LOCAL_BIN:$PATH"
[[ -d "$GO_BIN" && ":$PATH:" != *":$GO_BIN:"* ]] && export PATH="$GO_BIN:$PATH"

ok "PATH configurado"

# ── 11. API key ────────────────────────────────────────────────────────────────
section "API key"

if [[ -n "${ANTHROPIC_API_KEY:-}" ]]; then
    ok "ANTHROPIC_API_KEY está configurada"
elif [[ -f "$CLAUDE_DIR/.credentials.json" ]]; then
    ok "Credentials file encontrado"
else
    warn "No hay API key configurada"
    echo -e "  ${CYAN}export ANTHROPIC_API_KEY='sk-ant-...'${NC}"
    echo "  O ejecuta 'claude' y loguéate interactivamente."
fi

# ── 12. Resumen ────────────────────────────────────────────────────────────────
section "Instalación completa"

ok "Instalación completada"
echo ""
echo "  Config     : $CLAUDE_DIR"
echo "  HTB        : $HTB_BASE"
echo "  Bug Bounty : $BB_BASE"
echo ""
echo "  ${BOLD}Wrappers:${NC}"
echo "    htb <machine> <ip> [notas]   Nueva máquina HTB"
echo "    htb <machine>                Reanudar máquina"
echo "    htb auto <machine> <ip>      Modo autónomo (hasta root)"
echo "    htb list                     Listar máquinas"
echo ""
echo "    bb <programa> [notas]        Nuevo programa BB"
echo "    bb auto <programa>           Modo autónomo"
echo "    bb list                      Listar programas"
echo ""
echo "  ${BOLD}Slash commands:${NC}"
echo "    /hunt /recon /scope /triage /proof /validate /dedupe"
echo "    /diff-recon /burp-import /timecheck /chain /report /autopilot"
echo "    /web3-audit /token-scan /surface /pickup /remember /intel"
echo ""
echo "  ${BOLD}Agentes:${NC}"
echo "    web-recon   linux-priv   ad-enum   cred-hunter   htb-pentester"
echo ""
echo "  ${BOLD}Hooks activos:${NC}"
echo "    SessionStart → session-id-guard.sh    (evita doble contexto en subagentes)"
echo "    SessionStart → session-context.sh     (lazy-load playbooks por tags)"
echo "    PreToolUse   → block-dangerous.sh     (comandos destructivos)"
echo "    PreToolUse   → scope-check.sh         (scope enforcement Bash+WebFetch+WebSearch)"
echo "    PreToolUse   → evidence-gate.sh       (bloquea reportes sin evidencia)"
echo "    PreToolUse   → report-gate.sh         (bloquea Write report*.md sin proof.ok)"
echo "    PostToolUse  → auto-timeline.sh       (log + scrubber de secretos)"
echo "    PostToolUse  → time-budget.sh         (regla de 1h sin progreso)"
echo "    PreCompact   → pre-compact-backup.sh"
echo ""
echo "  source ~/.bashrc && htb help"