# For reconnaissance needs:
Task(
    subagent_type="Explore",
    prompt="Perform comprehensive reconnaissance on target 10.10.10.1. Scan all ports, enumerate services, check for web directories. Return structured findings.",
    description="Full reconnaissance scan",
    model="sonnet"  # Use sonnet for complex tasks
)

# For exploitation needs:
Task(
    subagent_type="general-purpose",
    prompt="Exploit Apache 2.4.29 vulnerability on port 80. Find and adapt exploits, gain shell access, locate user.txt and capture the flag. Return user flag if found.",
    description="Exploit web server",
    model="sonnet"
)

# For privilege escalation:
Task(
    subagent_type="general-purpose",
    prompt="Escalate privileges from www-data to root. Check sudo -l, find SUID binaries, check capabilities, run linpeas if needed. Capture root.txt flag. Return root flag if found.",
    description="Privilege escalation",
    model="sonnet"
)

cat .pentest-state.json | jq

Current Phase: reconnaissance
  → No services discovered yet?
    ✅ Delegate to Explore agent for reconnaissance

Current Phase: exploitation
  → Services found but no access?
    ✅ Delegate to general-purpose agent for exploitation
  → User access gained but no user flag?
    ✅ Delegate to find and read user.txt

Current Phase: privilege_escalation
  → User flag captured but no root access?
    ✅ Delegate to general-purpose agent for privilege escalation
  → Root access gained but no root flag?
    ✅ Delegate to find and read root.txt

Current Phase: completed
  → Both flags captured?
    ✅ Mission complete (Stop hook will allow you to finish)

# Read state to understand where we are
cat .pentest-state.json | jq

User: /start-pentest 10.10.10.1

You:
  1. Read state: cat .pentest-state.json
  2. See: phase=reconnaissance, no services discovered
  3. Delegate: Task(subagent_type="Explore", prompt="Scan 10.10.10.1...")

Agent returns: {services: [22: SSH, 80: HTTP, 445: SMB]}

You:
  1. Analyze: Found SSH, HTTP, SMB
  2. Decide: Try web exploitation first
  3. Delegate: Task(subagent_type="general-purpose", prompt="Enumerate web directories...")

Agent returns: {directories: [/admin, /uploads, /backup]}

You:
  1. Analyze: /uploads might allow file upload
  2. Decide: Test file upload vulnerability
  3. Delegate: Task(subagent_type="general-purpose", prompt="Test file upload on /uploads...")

Agent returns: {access: "webshell", user_flag: "a1b2c3d4..."}

You:
  1. Analyze: User flag captured! ✅
  2. PostToolUse hook automatically updated state
  3. Decide: Need root access now
  4. Delegate: Task(subagent_type="general-purpose", prompt="Escalate to root...")

Agent returns: {root_access: true, root_flag: "def456..."}

You:
  1. Analyze: Root flag captured! ✅
  2. State now shows both flags
  3. Stop hook allows completion
  4. ✅ Mission accomplished

# Don't give up - try a different approach
Task(
    subagent_type="general-purpose",
    prompt="The previous approach failed. Use extended thinking to analyze the target from first principles. Try alternative attack vectors: [list specific alternatives]. Research the specific service versions found and look for CVEs.",
    description="Alternative attack approach"
)