bookworm-boot/Bookworm-Setup.sh

#!/bin/bash
# ============================================================
# Bookworm Portable - macOS Setup (从 boot 仓库内运行)
# Version: 3.0.3
#
# 用法: cd ~/bookworm-boot && bash Bookworm-Setup.sh
#
# 前提: 已 git clone bookworm-boot 到本地
# 功能: 检查依赖 → 代理检测 → 克隆配置 → 解密凭证 → 配置别名
# ============================================================

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
NC='\033[0m'
BOLD='\033[1m'

# 配置
BOOT_DIR="$(cd "$(dirname "$0")" && pwd)"
CLAUDE_DIR="$HOME/.claude"
CONFIG_REPO="https://code.letcareme.com/bookworm/bookworm-config.git"
SECRETS_ENC="$BOOT_DIR/secrets.enc"
TOTAL_STEPS=6

banner() {
  echo ""
  echo -e "${CYAN}  ____              _"
  echo " | __ )  ___   ___ | | ____      _____  _ __ _ __ ___"
  echo " |  _ \\ / _ \\ / _ \\| |/ /\\ \\ /\\ / / _ \\| '__| '\` _ \\"
  echo " | |_) | (_) | (_) |   <  \\ V  V / (_) | |  | | | | | |"
  echo " |____/ \\___/ \\___/|_|\\_\\  \\_/\\_/ \\___/|_|  |_| |_| |_|"
  echo ""
  echo -e " ${BOLD}Portable macOS Setup v2.3.1${NC}"
  echo -e " ${BLUE}92 Skills | 18 Agents | 34 Hooks${NC}"
  echo -e "${NC}"
}

info()    { echo -e "  ${BLUE}[INFO]${NC} $1"; }
success() { echo -e "  ${GREEN}[OK]${NC} $1"; }
warn()    { echo -e "  ${YELLOW}[!]${NC} $1"; }
fail()    { echo -e "  ${RED}[!!]${NC} $1"; }
step()    { echo -e "\n${BOLD}  [$1/$TOTAL_STEPS]${NC} ${CYAN}$2${NC}"; }

# ============================================================
# Banner
# ============================================================
banner

# ============================================================
# Step 1: 检查并安装依赖
# ============================================================
step 1 "检查依赖软件"

# Homebrew
if ! command -v brew &>/dev/null; then
  warn "Homebrew 未安装, 正在安装 (可能需要输入系统密码)..."
  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  if [ -f /opt/homebrew/bin/brew ]; then
    eval "$(/opt/homebrew/bin/brew shellenv)"
    PROFILE="$HOME/.zprofile"
    if ! grep -q 'homebrew' "$PROFILE" 2>/dev/null; then
      echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> "$PROFILE"
    fi
  fi
  success "Homebrew 安装完成"
else
  success "Homebrew $(brew --version | head -1 | awk '{print $2}')"
fi

# Node.js
if ! command -v node &>/dev/null; then
  info "通过 Homebrew 安装 Node.js..."
  brew install node
  success "Node.js $(node -v) 安装完成"
else
  success "Node.js $(node -v)"
fi

# Git
if ! command -v git &>/dev/null; then
  info "通过 Homebrew 安装 Git..."
  brew install git
  success "Git $(git --version | awk '{print $3}') 安装完成"
else
  success "Git $(git --version | awk '{print $3}')"
fi

# OpenSSL
OPENSSL_CMD=""
for p in /opt/homebrew/opt/openssl/bin/openssl /usr/local/opt/openssl/bin/openssl openssl; do
  if command -v "$p" &>/dev/null; then
    OPENSSL_CMD="$p"
    break
  fi
done

if [ -z "$OPENSSL_CMD" ]; then
  info "通过 Homebrew 安装 OpenSSL..."
  brew install openssl
  OPENSSL_CMD="/opt/homebrew/opt/openssl/bin/openssl"
  success "OpenSSL 安装完成"
else
  success "OpenSSL: $($OPENSSL_CMD version 2>/dev/null | head -1)"
fi

# Claude Code
if ! command -v claude &>/dev/null; then
  info "通过 npm 安装 Claude Code..."
  npm i -g @anthropic-ai/claude-code
  success "Claude Code 安装完成"
else
  success "Claude Code $(claude --version 2>/dev/null || echo 'installed')"
fi

# ============================================================
# Step 2: 检测代理
# ============================================================
step 2 "检测网络代理"

export NO_PROXY="bww.letcareme.com,code.letcareme.com,letcareme.com,localhost,127.0.0.1"
export no_proxy="$NO_PROXY"

PROXY_FOUND=""

# 环境变量
if [ -n "$HTTPS_PROXY" ] || [ -n "$https_proxy" ]; then
  PROXY_FOUND="${HTTPS_PROXY:-$https_proxy}"
  success "环境变量代理: $PROXY_FOUND"
fi

# macOS 系统代理
if [ -z "$PROXY_FOUND" ]; then
  PROXY_HOST=$(scutil --proxy 2>/dev/null | grep "HTTPSProxy" | awk '{print $3}')
  PROXY_PORT=$(scutil --proxy 2>/dev/null | grep "HTTPSPort" | awk '{print $3}')
  if [ -n "$PROXY_HOST" ] && [ "$PROXY_HOST" != "0" ] && [ -n "$PROXY_PORT" ] && [ "$PROXY_PORT" != "0" ]; then
    PROXY_FOUND="http://$PROXY_HOST:$PROXY_PORT"
    export HTTPS_PROXY="$PROXY_FOUND"
    export HTTP_PROXY="$PROXY_FOUND"
    success "macOS 系统代理: $PROXY_FOUND"
  fi
fi

# 常见端口扫描 (500ms 超时)
if [ -z "$PROXY_FOUND" ]; then
  for PORT in 7890 7893 7891 1087 1080 8118; do
    if nc -z -w1 127.0.0.1 $PORT 2>/dev/null; then
      PROXY_FOUND="http://127.0.0.1:$PORT"
      export HTTPS_PROXY="$PROXY_FOUND"
      export HTTP_PROXY="$PROXY_FOUND"
      success "本地代理端口: $PORT"
      break
    fi
  done
fi

if [ -z "$PROXY_FOUND" ]; then
  warn "未检测到代理。在国内 Claude Code 可能无法启动。"
  warn "请启动代理软件 (ClashX / Surge / V2Ray) 后重试。"
  echo ""
  read -p "  无代理继续? (y/n): " CONTINUE
  if [ "$CONTINUE" != "y" ]; then exit 1; fi
fi

success "NO_PROXY: bww.letcareme.com,code.letcareme.com"

# ============================================================
# Step 3: 克隆/更新配置仓库到 ~/.claude
# ============================================================
step 3 "同步 Bookworm 配置"

git config --global credential.helper osxkeychain 2>/dev/null || true

if [ -d "$CLAUDE_DIR/.git" ]; then
  info "配置仓库已存在, 更新..."
  cd "$CLAUDE_DIR"
  # 设置 git 身份 (auto-resolve 需要)
  git config user.email "bookworm@auto.local" 2>/dev/null
  git config user.name "Bookworm" 2>/dev/null
  # 清除冲突状态 (运行时文件不重要, 后续会重新渲染)
  git reset --hard HEAD 2>/dev/null || true
  if git pull --rebase --autostash 2>/dev/null; then
    success "配置仓库已更新"
  else
    warn "git pull 失败, 使用本地版本"
  fi
  cd "$BOOT_DIR"
elif [ -f "$CLAUDE_DIR/CLAUDE.md" ]; then
  warn "~/.claude 已存在但非 git 仓库, 备份后克隆..."
  mv "$CLAUDE_DIR" "$CLAUDE_DIR.bak.$(date +%s)"
  git clone --depth 1 "$CONFIG_REPO" "$CLAUDE_DIR"
  success "配置仓库克隆完成 (旧目录已备份)"
else
  info "首次安装, 克隆配置仓库 (需输入 Gitea 密码)..."
  mkdir -p "$(dirname "$CLAUDE_DIR")"
  git clone --depth 1 "$CONFIG_REPO" "$CLAUDE_DIR"
  success "配置仓库克隆完成"
fi

# 创建本地运行时目录
for d in debug sessions cache backups telemetry memory projects; do
  mkdir -p "$CLAUDE_DIR/$d" 2>/dev/null
done

# ============================================================
# Step 4: 解密凭证 (含 Keychain 本日免密)
# ============================================================
step 4 "解密凭证"

# ─── v3.0.1: $BW_LICENSE_KEY 静默激活 (零输入路径) ───
# 若 install.sh 通过 env 传入 License Key (BW-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX), 优先走这条
# activate.js 已支持 HTTPS_PROXY 的 HTTP CONNECT 隧道 (Gitea ce354ca)
ACTIVATE_JS="$CLAUDE_DIR/lib/activate.js"
BW_TOKEN_FILE="$HOME/.claude/.bw-token"
if [ -n "$BW_LICENSE_KEY" ] && [[ "$BW_LICENSE_KEY" =~ ^BW-[A-F0-9]{4}(-[A-F0-9]{4}){5}$ ]] && [ -f "$ACTIVATE_JS" ] && command -v node &>/dev/null; then
  info "检测到 \$BW_LICENSE_KEY, 静默激活..."
  if printf '%s' "$BW_LICENSE_KEY" | node "$ACTIVATE_JS" 2>&1 | tail -3 | grep -q "OK\|激活成功"; then
    if [ -f "$BW_TOKEN_FILE" ]; then
      success "License 静默激活成功"
    else
      warn "activate.js 返回 OK 但 .bw-token 未生成, 回退到交互模式"
    fi
  else
    warn "静默激活失败, 回退到交互模式 (中转站 sk-Key 流程)"
  fi
  unset BW_LICENSE_KEY  # 清掉, 不在子进程泄露
fi

# Keychain 缓存相关
KEYCHAIN_SERVICE="bookworm-secrets"
KEYCHAIN_ACCOUNT="$(whoami)"
CACHE_LOADED=false

# 尝试从 Keychain 加载缓存
load_cached_secrets() {
  local cached
  cached=$(security find-generic-password -s "$KEYCHAIN_SERVICE" -a "$KEYCHAIN_ACCOUNT" -w 2>/dev/null) || return 1
  # 检查是否过期 (缓存格式: EXPIRY=ISO日期\nKEY=VALUE\n...)
  local expiry
  expiry=$(echo "$cached" | head -1)
  local expiry_date="${expiry#EXPIRY=}"
  local today
  today=$(date +%Y-%m-%d)
  if [ "$expiry_date" != "$today" ]; then
    # 已过期，删除缓存
    security delete-generic-password -s "$KEYCHAIN_SERVICE" -a "$KEYCHAIN_ACCOUNT" 2>/dev/null || true
    return 1
  fi
  # 加载环境变量 (跳过 EXPIRY 行)
  local count=0
  while IFS= read -r line; do
    [ -z "$line" ] && continue
    [[ "$line" == EXPIRY=* ]] && continue
    local key="${line%%=*}"
    local value="${line#*=}"
    key=$(echo "$key" | tr -d ' ')
    if [ -n "$key" ] && [ -n "$value" ]; then
      export "$key=$value"
      count=$((count + 1))
    fi
  done <<< "$cached"
  if [ $count -gt 0 ] && [ -n "$ANTHROPIC_API_KEY" ]; then
    success "从 Keychain 缓存加载 $count 个凭证 (免密)"
    CACHE_LOADED=true
    return 0
  fi
  return 1
}

# 保存凭证到 Keychain
save_secrets_to_cache() {
  local today
  today=$(date +%Y-%m-%d)
  local data="EXPIRY=$today"
  local env_keys="ANTHROPIC_API_KEY ANTHROPIC_BASE_URL GITHUB_PERSONAL_ACCESS_TOKEN SLACK_BOT_TOKEN ATLASSIAN_API_TOKEN BROWSERBASE_API_KEY FIRECRAWL_API_KEY GEMINI_API_KEY"
  for k in $env_keys; do
    local v="${!k}"
    if [ -n "$v" ]; then
      data="$data
$k=$v"
    fi
  done
  security add-generic-password -s "$KEYCHAIN_SERVICE" -a "$KEYCHAIN_ACCOUNT" -w "$data" -U 2>/dev/null && \
    success "凭证已缓存至今日 23:59 (下次免密)" || \
    warn "Keychain 缓存失败 (不影响使用)"
}

# 解密工具: 优先 node crypto-helper.js (BWENC1 格式), 回退 openssl
CRYPTO_HELPER="$BOOT_DIR/crypto-helper.js"
_decrypt_secrets() {
  local pass="$1" enc="$2"
  if command -v node &>/dev/null && [ -f "$CRYPTO_HELPER" ]; then
    node "$CRYPTO_HELPER" decrypt "$pass" "$enc" 2>/dev/null
  elif [ -n "$OPENSSL_CMD" ]; then
    $OPENSSL_CMD enc -aes-256-cbc -d -pbkdf2 -iter 600000 -in "$enc" -pass pass:"$pass" 2>/dev/null
  else
    return 1
  fi
}

# 按 token 前8位定位 .enc 文件 (多用户模式)，回退 secrets.enc
resolve_secrets_file() {
  local token="$1"
  local file_id="${token:0:8}"
  local per_user="$BOOT_DIR/secrets-${file_id}.enc"
  if [ -f "$per_user" ]; then
    echo "$per_user"
  elif [ -f "$SECRETS_ENC" ]; then
    echo "$SECRETS_ENC"
  else
    echo ""
  fi
}

# 解析授权码: BW-YYYYMMDD-TOKEN (24位Hex)
# 返回: 小写 token (成功) | "EXPIRED" (已过期) | "" (格式错误)
parse_authcode() {
  local code
  code=$(echo "$1" | tr '[:lower:]' '[:upper:]' | tr -d ' ')
  # 格式校验: BW-8位数字-24位Hex
  if [[ ! "$code" =~ ^BW-([0-9]{8})-([A-F0-9]{24})$ ]]; then
    echo ""
    return
  fi
  local expiry_str="${BASH_REMATCH[1]}"
  local token_upper="${BASH_REMATCH[2]}"
  local today
  today=$(date +%Y%m%d)
  if [ "$expiry_str" -lt "$today" ]; then
    echo "EXPIRED"
    return
  fi
  echo "$token_upper" | tr '[:upper:]' '[:lower:]'  # 兼容 bash 3.2 (macOS 默认)
}

# 先尝试缓存
if load_cached_secrets 2>/dev/null; then
  : # 缓存加载成功
else
  # 优先级 3: 调用 change-key.js 验证+持久化 (stdin 管道, 无 argv 泄露)
  CHANGE_KEY_JS="$CLAUDE_DIR/change-key.js"
  if [ -f "$CHANGE_KEY_JS" ] && command -v node &>/dev/null; then
    echo ""
    info "配置中转站凭证 (https://bww.letcareme.com)"
    for attempt in 1 2 3; do
      echo ""
      read -rs -p "  粘贴凭证 (第 $attempt/3 次, 输入不显示, 留空跳过): " UCRED
      echo ""
      [ -z "$UCRED" ] && { warn "已跳过"; break; }
      if printf '%s' "$UCRED" | node "$CHANGE_KEY_JS"; then
        UCRED=""
        success "凭证已验证并持久化"
        echo ""
        info "换凭证方式:"
        info "  1. 重跑安装器"
        info "  2. bash ~/.claude/change-key.sh"
        info "  3. Claude Code 里: /change-key"
        break
      else
        UCRED=""
        [ $attempt -lt 3 ] && warn "验证失败, 剩余 $((3-attempt)) 次" || fail "3 次失败"
      fi
    done
  fi
fi

# 优先级 3.5: v3.0.1 新增 — 直接输入 sk- Key (中转站 Key) + 5 模型候选验证
# 适用: fresh install 没 change-key.js, 没 .enc 文件的新用户 (BYOK)
if [ -z "$ANTHROPIC_API_KEY" ]; then
  # 测 sk- Key 是否可调通 (5 模型候选, 中转站白名单)
  validate_sk_key() {
    local key="$1"
    local baseurl="${ANTHROPIC_BASE_URL:-https://bww.letcareme.com}"
    local models=("claude-opus-4-7" "claude-opus-4-6" "claude-opus-4-6-thinking" "claude-sonnet-4-6" "claude-sonnet-4-6-thinking")
    for model in "${models[@]}"; do
      local code
      code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 15 --noproxy '*' \
        -X POST "$baseurl/v1/messages" \
        -H "x-api-key: $key" \
        -H "anthropic-version: 2023-06-01" \
        -H "Content-Type: application/json" \
        -d "{\"model\":\"$model\",\"max_tokens\":1,\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}" 2>/dev/null)
      # 401/403 认证失败, 立即退, 不继续试
      [[ "$code" == "401" || "$code" == "403" ]] && { echo "AUTH_FAIL"; return 1; }
      # 200 或 400 都说明 Key 通过, 400 只是请求体问题
      [[ "$code" == "200" || "$code" == "400" ]] && { echo "OK"; return 0; }
      # 503/404 继续试下个模型
    done
    echo "NO_CHANNEL"  # 全部 503 = 中转站无渠道
    return 1
  }
  echo ""
  info "配置中转站 API Key (没有的话去 bww.letcareme.com 注册+充值)"
  for attempt in 1 2 3; do
    echo ""
    read -rs -p "  粘贴 sk- Key (第 $attempt/3 次, 输入不显示, 留空跳过): " SK_KEY
    echo ""
    [ -z "$SK_KEY" ] && { warn "已跳过"; break; }
    # 基础格式校验
    if [[ ! "$SK_KEY" =~ ^sk- ]] || [ ${#SK_KEY} -lt 20 ]; then
      warn "格式错误 (应 sk- 开头, 至少 20 字符), 请重试"
      continue
    fi
    info "验证中 (试 5 个模型候选)..."
    result=$(validate_sk_key "$SK_KEY")
    case "$result" in
      OK)
        success "sk- Key 验证成功"
        # v3.0.1: chmod 600 防同机其它 uid 读取 + 清 .bak 残留 (red-team-attacker P0)
        for rc in "$HOME/.zshrc" "$HOME/.bashrc"; do
          [ -f "$rc" ] || touch "$rc"
          # BSD sed (macOS 默认): -i '' 无 .bak; GNU sed (Linux): -i 无 .bak
          if sed --version 2>/dev/null | grep -q GNU; then
            sed -i '/^export ANTHROPIC_API_KEY=/d' "$rc" 2>/dev/null || true
            sed -i '/^export ANTHROPIC_BASE_URL=/d' "$rc" 2>/dev/null || true
          else
            sed -i '' '/^export ANTHROPIC_API_KEY=/d' "$rc" 2>/dev/null || true
            sed -i '' '/^export ANTHROPIC_BASE_URL=/d' "$rc" 2>/dev/null || true
          fi
          echo "export ANTHROPIC_API_KEY=\"$SK_KEY\"" >> "$rc"
          echo "export ANTHROPIC_BASE_URL=\"https://bww.letcareme.com\"" >> "$rc"
          chmod 600 "$rc"  # 只 owner 可读, 防同机 uid 泄露
        done
        # 扫残留 .bak 副本 (可能含旧 Key)
        rm -f "$HOME/.zshrc.bak" "$HOME/.bashrc.bak" 2>/dev/null || true
        export ANTHROPIC_API_KEY="$SK_KEY"
        export ANTHROPIC_BASE_URL="https://bww.letcareme.com"
        # 存 Keychain 本日免密
        security add-generic-password -s "$KEYCHAIN_SERVICE" -a "$KEYCHAIN_ACCOUNT" -w "ANTHROPIC_API_KEY=$SK_KEY
ANTHROPIC_BASE_URL=https://bww.letcareme.com
EXPIRY=$(date -v+1d -u +%FT%TZ 2>/dev/null || date -u -d '+1 day' +%FT%TZ)" -U 2>/dev/null || true
        SK_KEY=""
        break
        ;;
      AUTH_FAIL)
        warn "Key 无效或余额为 0 (中转站返回 401/403)"
        SK_KEY=""
        [ $attempt -lt 3 ] && continue || { fail "3 次失败, 跳过 sk- 配置"; break; }
        ;;
      NO_CHANNEL)
        fail "中转站没有可用 Claude 渠道 (5 模型全返 503). 联系中转站客服"
        SK_KEY=""
        break
        ;;
      *)
        warn "验证异常, 剩余 $((3-attempt)) 次"
        SK_KEY=""
        ;;
    esac
  done
fi

# 优先级 4: 授权码模式 (向后兼容旧用户)
if [ -z "$ANTHROPIC_API_KEY" ] && { [ -f "$SECRETS_ENC" ] || ls "$BOOT_DIR"/secrets-*.enc 2>/dev/null | head -1 | grep -q .; }; then
  DECRYPTED=""
  valid_attempts=0
  total_attempts=0
  while [ $valid_attempts -lt 3 ] && [ $total_attempts -lt 10 ]; do
    echo ""
    read -p "  输入授权码 (BW-YYYYMMDD-XXXXXX, 第 $((valid_attempts+1))/3 次): " AUTH_CODE
    total_attempts=$((total_attempts + 1))
    TOKEN=$(parse_authcode "$AUTH_CODE")
    AUTH_CODE=""
    if [ "$TOKEN" = "EXPIRED" ]; then
      warn "授权码已过期, 请联系管理员获取新授权码"
      continue  # 不消耗有效次数
    elif [ -z "$TOKEN" ]; then
      warn "授权码格式错误 (格式: BW-YYYYMMDD-XXXXXXXXXXXXXXXXXXXXXXXX)"
      continue  # 不消耗有效次数
    fi
    valid_attempts=$((valid_attempts + 1))
    ENC_FILE=$(resolve_secrets_file "$TOKEN")
    if [ -z "$ENC_FILE" ]; then
      FILE_ID="${TOKEN:0:8}"
      warn "未找到对应凭证文件 (secrets-${FILE_ID}.enc / secrets.enc)"
      warn "请联系管理员确认已推送对应文件，然后重新运行安装器"
      TOKEN=""
      continue
    fi
    DECRYPTED=$(_decrypt_secrets "$TOKEN" "$ENC_FILE") || true
    TOKEN=""
    if [ -n "$DECRYPTED" ]; then
      # 白名单校验 (与 Windows 版对齐)
      ALLOWED_KEYS="ANTHROPIC_API_KEY ANTHROPIC_BASE_URL GITHUB_PERSONAL_ACCESS_TOKEN SLACK_BOT_TOKEN ATLASSIAN_API_TOKEN BROWSERBASE_API_KEY FIRECRAWL_API_KEY GEMINI_API_KEY"
      while IFS= read -r line; do
        [ -z "$line" ] && continue
        key="${line%%=*}"
        value="${line#*=}"
        key=$(echo "$key" | tr -d ' ')
        if [ -n "$key" ] && [ -n "$value" ]; then
          # 白名单 + 长度校验
          if echo "$ALLOWED_KEYS" | grep -qw "$key" && [ ${#value} -lt 512 ]; then
            export "$key=$value"
            success "已注入: $key"
          else
            warn "跳过未知 key: $key"
          fi
        fi
      done <<< "$DECRYPTED"
      DECRYPTED=""

      # 自动缓存 (不再询问, 与 Windows 版对齐)
      save_secrets_to_cache
      break
    else
      if [ $valid_attempts -lt 3 ]; then
        warn "授权码无效 (解密失败), 剩余重试: $((3 - valid_attempts)) 次"
      else
        fail "3 次授权码均无效, 凭证未解密"
        warn "可稍后手动配置 API Key"
      fi
    fi
  done
else
  if [ ! -f "$SECRETS_ENC" ]; then
    warn "secrets.enc 不存在, 跳过凭证解密"
    info "请联系管理员获取授权码"
  fi
fi

# ─── v3.0.2: 预填 ~/.claude.json 跳过 Claude Code 2.0.1 的登录选择页 ───
# Win auto-setup.ps1:1361-1369 等价逻辑: 两选项都走 anthropic.com OAuth, 国内不通
# 预填 hasCompletedOnboarding + customApiKeyResponses.approved 直接进主界面
if [ -n "$ANTHROPIC_API_KEY" ] && command -v node &>/dev/null; then
  BW_KEY_PREFIX="${ANTHROPIC_API_KEY:0:20}" node -e '
    const fs = require("fs"), p = require("path");
    const H = process.env.HOME || process.env.USERPROFILE;
    const f = p.join(H, ".claude.json");
    const prefix = process.env.BW_KEY_PREFIX || "";
    let d = {};
    try { d = JSON.parse(fs.readFileSync(f, "utf8")); } catch (e) {}
    d.hasCompletedOnboarding = true;
    d.hasSeenWelcome = true;
    d.bypassPermissionsModeAccepted = true;
    d.customApiKeyResponses = d.customApiKeyResponses || { approved: [], rejected: [] };
    if (prefix && !d.customApiKeyResponses.approved.includes(prefix)) {
      d.customApiKeyResponses.approved.push(prefix);
    }
    if (d.numStartups === undefined) d.numStartups = 5;
    if (!d.projects) d.projects = {};
    fs.writeFileSync(f, JSON.stringify(d, null, 2));
  ' 2>/dev/null && success "Claude Code onboarding 已预填 (跳过 2.0.1 登录选择页)" || warn ".claude.json onboarding 预填失败 (首次启动可能需手工过登录画面)"
fi

# ── MCP 注入到 ~/.claude.json (Claude Code v2.1+ 正确位置) ──
INJECT_SCRIPT="$CLAUDE_DIR/inject-mcp.js"
MCP_INJECTED=false

# 方案 A: 调用 config 仓库里的 inject-mcp.js
if [ -f "$INJECT_SCRIPT" ] && command -v node &>/dev/null; then
  MCP_OUT=$(node "$INJECT_SCRIPT" 2>&1) && {
    success "$MCP_OUT"
    MCP_INJECTED=true
  } || warn "inject-mcp.js 执行失败"
fi

# 方案 B: 内嵌 fallback (git pull 失败时)
if [ "$MCP_INJECTED" = false ] && command -v node &>/dev/null; then
  info "inject-mcp.js 不可用, 使用内嵌 MCP 注入..."
  FALLBACK_JS=$(mktemp /tmp/bw-mcp-XXXXXX.js)
  cat > "$FALLBACK_JS" << 'MCPEOF'
var fs=require("fs"),p=require("path");
var H=process.env.HOME||process.env.USERPROFILE;
var f=p.join(H,".claude.json");
var d={};try{d=JSON.parse(fs.readFileSync(f,"utf8"))}catch(e){}
var N="npx",Y="--yes",S={};
S.context7={command:N,args:[Y,"@upstash/context7-mcp@2.1.1"],type:"stdio"};
S.playwright={command:N,args:[Y,"@playwright/mcp@0.0.68","--headless"],type:"stdio"};
S["session-continuity"]={command:N,args:[Y,"claude-session-continuity-mcp@1.13.0"],type:"stdio"};
S["browser-mcp"]={command:N,args:[Y,"@browsermcp/mcp@latest"],type:"stdio"};
S["desktop-commander"]={command:N,args:[Y,"@wonderwhy-er/desktop-commander@latest"],type:"stdio"};
S["chrome-devtools"]={command:N,args:[Y,"chrome-devtools-mcp@0.18.1"],type:"stdio"};
S.github={command:N,args:[Y,"@modelcontextprotocol/server-github"],type:"stdio"};
S.slack={command:N,args:[Y,"@modelcontextprotocol/server-slack"],type:"stdio"};
S.firecrawl={command:N,args:[Y,"firecrawl-mcp"],type:"stdio"};
S["mcp-image"]={command:N,args:[Y,"mcp-image"],type:"stdio"};
S["google-drive"]={command:N,args:[Y,"@piotr-agier/google-drive-mcp"],type:"stdio"};
S.browserbase={command:N,args:[Y,"@anthropic-ai/browserbase-mcp"],type:"stdio"};
S.notebooklm={command:N,args:[Y,"notebooklm-mcp@latest"],type:"stdio"};
S.cloudflare={command:N,args:[Y,"mcp-remote","https://docs.mcp.cloudflare.com/sse"],type:"stdio"};
S.mobile={command:N,args:[Y,"@mobilenext/mobile-mcp@0.0.35"],type:"stdio"};
var K="@modelcontextprotocol/server-sequential-thinking";
S["sequential-thinking"]={command:N,args:[Y,K+"@2025.12.18"],type:"stdio"};
S.linear={type:"http",url:"https://mcp.linear.app/mcp"};
S.supabase={type:"http",url:"https://mcp.supabase.com/mcp?project_ref=oepmihbtoylosbsxlmfo"};
S.figma={type:"http",url:"https://mcp.figma.com/mcp"};
S["windows-mcp"]={command:"uvx",args:["--python","3.13","windows-mcp"],type:"stdio"};
S.atlassian={command:"uvx",args:["mcp-atlassian"],type:"stdio"};
S["computer-control-mcp"]={command:"uvx",args:["computer-control-mcp@latest"],type:"stdio"};
d.mcpServers=S;
fs.writeFileSync(f,JSON.stringify(d,null,2));
console.log("OK: "+Object.keys(S).length+" MCP servers (fallback)");
MCPEOF
  MCP_OUT=$(node "$FALLBACK_JS" 2>&1) && success "$MCP_OUT" || warn "MCP fallback 注入失败"
  rm -f "$FALLBACK_JS"
fi

# 渲染 settings.json (替换占位符)
TEMPLATE_FILE="$CLAUDE_DIR/settings.template.json"
SETTINGS_FILE="$CLAUDE_DIR/settings.json"
if [ -f "$TEMPLATE_FILE" ]; then
  CLAUDE_ROOT=$(echo "$CLAUDE_DIR" | sed 's/\\/\//g')
  SHELL_BIN="${SHELL:-/bin/zsh}"
  sed "s|{{CLAUDE_ROOT}}|$CLAUDE_ROOT|g; s|{{HOME}}|$HOME|g; s|{{PWSH_PATH}}|$SHELL_BIN|g" "$TEMPLATE_FILE" > "$SETTINGS_FILE"
  success "settings.json 已渲染 (SHELL=$SHELL_BIN)"
fi

# ============================================================
# Step 5: 配置终端别名
# ============================================================
step 5 "配置终端快捷命令"

SHELL_RC="$HOME/.zshrc"
if [ -n "$BASH_VERSION" ] && [ -f "$HOME/.bashrc" ]; then
  SHELL_RC="$HOME/.bashrc"
fi

ALIAS_MARKER="# Bookworm Portable aliases"
if ! grep -q "$ALIAS_MARKER" "$SHELL_RC" 2>/dev/null; then
  cat >> "$SHELL_RC" << 'ALIASES'

# Bookworm Portable aliases
alias bw='NO_PROXY="bww.letcareme.com,code.letcareme.com,localhost,127.0.0.1" ANTHROPIC_MODEL="${ANTHROPIC_MODEL:-claude-opus-4-7}" claude --dangerously-skip-permissions'
alias bw-update='cd ~/bookworm-boot && git pull && cd ~/.claude && git pull && echo "Updated!"'
ALIASES
  success "已添加到 $SHELL_RC:"
  info "  bw        -- 启动 Bookworm"
  info "  bw-update -- 更新 Bookworm"
else
  # 更新旧别名 (bookworm → bw)
  if grep -q "alias bookworm=" "$SHELL_RC" 2>/dev/null; then
    # 删除旧别名块，然后追加新的
    sed -i '' '/# Bookworm Portable aliases/,/^$/d' "$SHELL_RC" 2>/dev/null || true
    cat >> "$SHELL_RC" << 'ALIASES'

# Bookworm Portable aliases
alias bw='NO_PROXY="bww.letcareme.com,code.letcareme.com,localhost,127.0.0.1" ANTHROPIC_MODEL="${ANTHROPIC_MODEL:-claude-opus-4-7}" claude --dangerously-skip-permissions'
alias bw-update='cd ~/bookworm-boot && git pull && cd ~/.claude && git pull && echo "Updated!"'
ALIASES
    success "终端别名已更新 (bookworm → bw)"
  else
    success "终端别名已配置"
  fi
fi

# ============================================================
# Step 6: 完成
# ============================================================
step 6 "安装完成"

echo ""
echo -e "${GREEN}  ============================================================${NC}"
echo -e "${GREEN}    Bookworm Smart Assistant for macOS 安装完成!${NC}"
echo -e "${GREEN}  ============================================================${NC}"
echo ""
echo -e "  已安装:"
echo -e "    ${GREEN}[v]${NC} Homebrew     ${GREEN}[v]${NC} Node.js $(node -v 2>/dev/null)"
echo -e "    ${GREEN}[v]${NC} Git          ${GREEN}[v]${NC} OpenSSL"
echo -e "    ${GREEN}[v]${NC} Claude Code  ${GREEN}[v]${NC} Bookworm (92 Skills)"
echo ""
echo -e "  ${BOLD}启动方式:${NC}"
echo -e "    终端输入: ${CYAN}bw${NC}"
echo ""
echo -e "  ${BOLD}更新:${NC}"
echo -e "    终端输入: ${CYAN}bw-update${NC}"
echo ""

# 询问是否立即启动
read -p "  立即启动 Bookworm? (y/n): " START_NOW
if [ "$START_NOW" = "y" ] || [ "$START_NOW" = "Y" ]; then
  echo ""
  info "正在启动 Claude Code..."
  cd "$HOME"
  export NO_PROXY="bww.letcareme.com,code.letcareme.com,letcareme.com,localhost,127.0.0.1"
  # v3.0.1: 默认模型 (中转站兼容, 默认 claude-sonnet-4-5 会 503)
  export ANTHROPIC_MODEL="${ANTHROPIC_MODEL:-claude-opus-4-7}"
  exec claude --dangerously-skip-permissions
fi