From 60cdd6032718ec430799f82061ff8609aa7d1ab4 Mon Sep 17 00:00:00 2001
From: Malin <malin@cloudhost.es>
Date: Thu, 12 Mar 2026 16:53:46 +0100
Subject: [PATCH] fix: strip --install-missing-components + env -u PKG_EXECPATH
 in sudo wrapper

The real issue: PKG_EXECPATH inherited from parent makes pkg bootstrap treat
argv[1] as a module path regardless of arg order. Fix: unset only PKG_EXECPATH
(env -u) so bootstrap starts fresh and loads embedded main. Strip
--install-missing-components since it's not a commander.js flag. Keep all other
env vars for auth/session. Parent handles actual connection after child exits.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn-node/sudo-wrapper.sh | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/vpn-node/sudo-wrapper.sh b/vpn-node/sudo-wrapper.sh
index 813c0ee..fc395e3 100644
--- a/vpn-node/sudo-wrapper.sh
+++ b/vpn-node/sudo-wrapper.sh
@@ -1,19 +1,17 @@
 #!/bin/bash
 # sudo-wrapper.sh
 #
-# purevpn-cli (pkg/Node.js binary) calls:
-#   sudo purevpn-cli --connect <loc> --install-missing-components
+# purevpn-cli calls:  sudo purevpn-cli --connect <loc> --install-missing-components
 #
-# The pkg bootstrap uses argv[1] as the main module path when
-# --install-missing-components is present. With the original call order,
-# argv[1] = '--connect', so pkg tries require('/--connect') → crash.
+# Problem: PKG_EXECPATH inherited from the parent makes the pkg bootstrap treat
+# argv[1] as a module path → "Cannot find module '/--connect'" (or '/--install...')
+# regardless of arg order.
 #
-# Fix: move --install-missing-components to argv[1] position so pkg sees it
-# as its own bootstrap flag instead of a module path.
-#
-# We do NOT use env -i — the child needs parent env vars (auth session, etc).
-# Instead, a depth counter (PUREVPN_SUDO_DEPTH) prevents infinite recursion
-# in case the child also tries to call sudo.
+# Solution:
+#   1. Strip --install-missing-components (not a commander.js flag; causes errors)
+#   2. Unset PKG_EXECPATH only (-u) so the child's bootstrap starts fresh and
+#      loads the embedded main module. All other env vars (auth, session) are kept.
+#   3. Depth guard prevents infinite recursion if the child also tries to sudo.
 
 DEPTH="${PUREVPN_SUDO_DEPTH:-0}"
 if [[ "$DEPTH" -ge 2 ]]; then
@@ -28,8 +26,8 @@ other_args=()
 
 for a in "$@"; do
     case "$a" in
-        -E|-n|-H|--preserve-env|--non-interactive) continue ;;  # sudo flags, ignore
-        --install-missing-components) has_install_flag=true ;;
+        -E|-n|-H|--preserve-env|--non-interactive) continue ;;  # sudo flags, skip
+        --install-missing-components) has_install_flag=true ;;  # strip, don't pass
         *)
             if [[ -z "$binary" ]]; then
                 binary="$a"
@@ -46,9 +44,9 @@ if [[ -z "$binary" ]]; then
 fi
 
 if [[ "$has_install_flag" == "true" ]]; then
-    echo "[sudo-wrapper] reorder (depth=$NEXT_DEPTH): $binary --install-missing-components ${other_args[*]}" >&2
-    exec env PUREVPN_SUDO_DEPTH="$NEXT_DEPTH" \
-        "$binary" "--install-missing-components" "${other_args[@]}"
+    echo "[sudo-wrapper] stripped --install-missing-components, unset PKG_EXECPATH (depth=$NEXT_DEPTH): $binary ${other_args[*]}" >&2
+    exec env -u PKG_EXECPATH PUREVPN_SUDO_DEPTH="$NEXT_DEPTH" \
+        "$binary" "${other_args[@]}"
 else
     echo "[sudo-wrapper] passthrough (depth=$NEXT_DEPTH): $binary ${other_args[*]}" >&2
     exec env PUREVPN_SUDO_DEPTH="$NEXT_DEPTH" \