parrot-blackbox 1.0.15 → 1.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "parrot-blackbox",
-  "version": "1.0.15",
+  "version": "1.0.18",
   "description": "Crash-proof, multi-cloud backup & recovery automation for Parrot OS. Daily/weekly off-disk backups with automatic catch-up, smart storage across many MEGA + Google Drive accounts, Timeshift snapshot backups and one-command restore.",
   "type": "module",
   "main": "src/cli.js",

package/src/backup/restore.js

@@ -19,7 +19,7 @@ import { stateDir, timeshiftDir } from '../core/paths.js';
 import { refreshAccounts } from '../storage/accounts.js';
 import { discoverManifest, restoreArtifact } from '../storage/archive.js';
 import { listLocalSnapshots } from './snapshot.js';
-import { sudoInteractive } from '../util/sudo.js';
+import { ensureSudo, sudoInteractive } from '../util/sudo.js';
 import { bytesHuman } from '../util/misc.js';
 
 /** Restore a file backup generation into a writable local directory. */
@@ -67,6 +67,7 @@ export async function restoreSnapshot({ id, accounts, cfg, toDir, confirm = fals
 
   // Run the actual restore (interactive sudo → the password prompt is visible).
   console.log(`\nRestoring snapshot ${id} over the current system…\n`);
+  await ensureSudo();
   const res = await sudoInteractive(['timeshift', '--restore', '--snapshot', id, '--yes']);
   if (res.exitCode !== 0) throw new Error(`timeshift --restore failed (exit ${res.exitCode})`);
   journal('restore', `snapshot id=${id} RESTORED`);
@@ -79,6 +80,7 @@ async function placeIntoTimeshift(id, tmpRoot, cfg, privileged) {
   const base = determineSnapshotBase();
   const target = path.join(base, id);
   const cmd = `mkdir -p ${shq(base)} && rm -rf ${shq(target)} && cp -a ${shq(tmpRoot)}/. ${shq(target)}/ && chown -R root:root ${shq(target)}`;
+  await ensureSudo();
   const res = await sudoInteractive(['bash', '-c', cmd]);
   if (res.exitCode !== 0) throw new Error(`could not move snapshot into ${base} (exit ${res.exitCode})`);
   return target;

package/src/backup/snapshot.js

@@ -11,13 +11,13 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execa, execaSync } from 'execa';
 import { loadConfig, loadState, saveState, journal, hasCommandSync } from '../core/store.js';
-import { timeshiftDir } from '../core/paths.js';
+import { timeshiftDir, stateDir, configFile, manifestsDir } from '../core/paths.js';
 import { iso, clock } from '../core/time.js';
 import { refreshAccounts } from '../storage/accounts.js';
 import { planAndPlace } from '../storage/allocator.js';
 import { listArtifacts, removeArtifact } from '../storage/archive.js';
 import { planPrune } from './retention.js';
-import { sudoInteractive, sudoNonInteractive, sudoInteractiveCapture } from '../util/sudo.js';
+import { sudoInteractive, sudoNonInteractive, sudoInteractiveCapture, sudoExecSync, ensureSudo } from '../util/sudo.js';
 
 export class SudoDeferredError extends Error {
   constructor() {
@@ -96,6 +96,7 @@ function findPathInLine(line) {
 async function runTimeshiftList({ privileged = 'noninteractive' } = {}) {
   if (privileged === 'interactive') {
     try {
+      await ensureSudo();
       const res = await sudoInteractiveCapture(['timeshift', '--list']);
       return (res.exitCode === 0 ? res.stdout : res.stdout || res.stderr) || '';
     } catch {
@@ -124,6 +125,7 @@ export async function createSnapshot({ comment, privileged = 'noninteractive' }
 
   let createOut = '';
   if (privileged === 'interactive') {
+    await ensureSudo();
     const res = await sudoInteractiveCapture(args);
     if (res.exitCode !== 0) throw new Error(`timeshift --create failed (exit ${res.exitCode})`);
     createOut = `${res.stdout || ''} ${res.stderr || ''}`;
@@ -154,6 +156,7 @@ export async function createSnapshot({ comment, privileged = 'noninteractive' }
 export async function deleteSnapshot(name, { privileged = 'noninteractive' } = {}) {
   const args = ['timeshift', '--delete', '--snapshot', name];
   if (privileged === 'interactive') {
+    await ensureSudo();
     const res = await sudoInteractive(args);
     if (res.exitCode !== 0) throw new Error(`timeshift --delete ${name} failed (exit ${res.exitCode})`);
     return true;
@@ -201,15 +204,10 @@ export function snapshotDirFor(snapshot, { privileged = 'noninteractive' } = {})
     
     if (device && deviceResult.exitCode === 0) {
       // Create temporary mount point
-      const mkdirCmd = privileged === 'interactive' ? ['sudo', 'mkdir', '-p', mountPoint] : ['sudo', '-n', 'mkdir', '-p', mountPoint];
-      execaSync(mkdirCmd[0], mkdirCmd.slice(1), { reject: false });
+      sudoExecSync(['mkdir', '-p', mountPoint]);
       
       // Mount BTRFS root subvolume (subvolid=5 contains all subvolumes including snapshots)
-      const mountCmd = privileged === 'interactive' 
-        ? ['sudo', 'mount', '-o', 'subvolid=5', device, mountPoint]
-        : ['sudo', '-n', 'mount', '-o', 'subvolid=5', device, mountPoint];
-      
-      const mountResult = execaSync(mountCmd[0], mountCmd.slice(1), { reject: false, timeout: 5000 });
+      const mountResult = sudoExecSync(['mount', '-o', 'subvolid=5', device, mountPoint]);
       
       if (mountResult.exitCode === 0) {
         // Search for the snapshot in the mounted root subvolume
@@ -228,9 +226,8 @@ export function snapshotDirFor(snapshot, { privileged = 'noninteractive' } = {})
         }
         
         // Unmount if we didn't find anything
-        const umountCmd = privileged === 'interactive' ? ['sudo', 'umount', mountPoint] : ['sudo', '-n', 'umount', mountPoint];
-        execaSync(umountCmd[0], umountCmd.slice(1), { reject: false });
-        execaSync('sudo', ['-n', 'rmdir', mountPoint], { reject: false });
+        sudoExecSync(['umount', mountPoint]);
+        sudoExecSync(['rmdir', mountPoint]);
       }
     }
   } catch {
@@ -245,8 +242,8 @@ export function snapshotDirFor(snapshot, { privileged = 'noninteractive' } = {})
 export function cleanupSnapshotMount(snapshot) {
   if (snapshot._tempMount) {
     try {
-      execaSync('sudo', ['-n', 'umount', snapshot._tempMount], { reject: false });
-      execaSync('sudo', ['-n', 'rmdir', snapshot._tempMount], { reject: false });
+      sudoExecSync(['umount', snapshot._tempMount]);
+      sudoExecSync(['rmdir', snapshot._tempMount]);
       delete snapshot._tempMount;
     } catch {
       /* best effort */
@@ -262,26 +259,31 @@ export function cleanupSnapshotMount(snapshot) {
 export async function runSnapshotBackup(cfg, state, { due, privileged = 'noninteractive', onProgress } = {}) {
   journal('snapshots', `start due=${due} privileged=${privileged}`);
   const accounts = await refreshAccounts(cfg);
+  
+  if (accounts.length === 0) {
+    throw new Error('no storage accounts configured — add one with `parrot-blackbox account add`');
+  }
 
-  // Resume logic: if the most recent local snapshot has no local manifest,
-  // it means its previous upload failed or was interrupted. We should resume it
-  // to avoid re-uploading everything to a new snapshot ID.
+  let created = null;
   const localSnaps = await listLocalSnapshots({ privileged });
-  const manifestLocalDir = process.env.PBB_MANIFESTS_DIR || path.join(process.env.PBB_STATE_DIR || '.', 'manifests');
   
-  let created = null;
-  // Look at snapshots from newest to oldest
+  // Look at snapshots from newest to oldest; find the most recent one that
+  // belongs to parrot-blackbox and has not been fully uploaded yet.
   for (let i = localSnaps.length - 1; i >= 0; i--) {
     const s = localSnaps[i];
     if (s.tags.includes('W') || (s.line && s.line.includes('parrot-blackbox'))) {
-      const manPath = path.join(manifestLocalDir, `snapshots-${s.name}.json`);
-      if (!fs.existsSync(manPath)) {
+      // Check for the manifest FILE on disk — this is the authoritative source.
+      // state.manifests (the in-memory JSON blob) may be empty on the first run
+      // or after a reinstall, so we cannot rely on it alone.
+      const manifestFile = path.join(manifestsDir(), `snapshots-${s.name}.json`);
+      const isUploaded = fs.existsSync(manifestFile);
+      if (!isUploaded) {
         created = s;
         journal('snapshots', `resuming upload for incomplete snapshot ${s.name}`);
+        console.log(`\n⏳ Resuming incomplete upload for snapshot ${s.name} (from tracker)...`);
         break;
       } else {
-        // The most recent parrot-blackbox snapshot is fully uploaded. We can break
-        // and create a new one.
+        // The most recent parrot-blackbox snapshot is fully uploaded — create a new one.
         break;
       }
     }
@@ -296,15 +298,21 @@ export async function runSnapshotBackup(cfg, state, { due, privileged = 'noninte
   let manifest;
   try {
     const bin = process.argv[1] || 'parrot-blackbox';
-    const outPath = path.join(process.env.PBB_STATE_DIR || '/tmp', `manifest-${created.name}.json`);
-    const baseArgs = [process.execPath, bin, '_internal_upload', dir, 'snapshots', created.name, cfg.storage.remoteRoot, String(cfg.storage.chunkSize), outPath];
-    const args = process.env.PBB_SUDO_DIRECT === '1' ? baseArgs : ['-E', ...baseArgs];
+    const outPath = path.join(stateDir(), `manifest-${created.name}.json`);
+    const envVars = {
+      HOME: process.env.HOME,
+      PBB_STATE_DIR: stateDir(),
+      PBB_CONFIG_FILE: configFile()
+    };
+    const cmdArgs = [process.execPath, bin, '_internal_upload', dir, 'snapshots', created.name, cfg.storage.remoteRoot, String(cfg.storage.chunkSize), outPath];
+    const args = process.env.PBB_SUDO_DIRECT === '1' ? cmdArgs : ['-E', ...cmdArgs];
     
     let res;
     if (privileged === 'interactive') {
-      res = await sudoInteractive(args);
+      await ensureSudo();
+      res = await sudoInteractive(args, { env: envVars });
     } else {
-      res = await sudoNonInteractive(args);
+      res = await sudoNonInteractive(args, { env: envVars });
     }
     
     if (res.exitCode !== 0) {

package/src/cli.js

@@ -97,7 +97,7 @@ async function snapshotList() {
   const accs = listAccounts();
   console.log(`${pc.bold('\nLocal snapshots (Timeshift):')}`);
   try {
-    const local = await listLocalSnapshots({ privileged: 'noninteractive' });
+    const local = await listLocalSnapshots({ privileged: process.stdin.isTTY ? 'interactive' : 'noninteractive' });
     if (local.length === 0) console.log(`  ${pc.dim('none')}`);
     for (const s of local) console.log(`  - ${pc.cyan(s.name)}  ${pc.dim(s.tags)}`);
   } catch (e) {
@@ -379,7 +379,7 @@ const main = defineCommand({
         return runSelfUpdate({ force: process.argv.includes('--force') });
 
       case 'run':
-        process.exitCode = await invokeRun('noninteractive');
+        process.exitCode = await invokeRun(process.stdin.isTTY ? 'interactive' : 'noninteractive');
         return;
 
       case 'force':

package/src/commands/setup.js

@@ -9,6 +9,7 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { execa } from 'execa';
 import { loadConfig, journal, hasCommandSync } from '../core/store.js';
+import { ensureSudo, sudoInteractive } from '../util/sudo.js';
 import { listAccounts, refreshAccounts, poolSummary } from '../storage/accounts.js';
 import { installService } from './service.js';
 import { runDueJobs } from '../daemon/scheduler.js';
@@ -58,7 +59,8 @@ async function ensureSystemTools() {
     s.stop('');
     try {
       const args = pm === 'pacman' ? ['-S', '--noconfirm', tool.pkg] : [pm, 'install', '-y', tool.pkg];
-      const res = await execa('sudo', args, { stdio: 'inherit', reject: false });
+      await ensureSudo();
+      const res = await sudoInteractive([pm, ...args.slice(1)]);
       if (res.exitCode === 0 && hasCommandSync(tool.bin)) {
         p.log.success(`${pc.cyan(tool.bin)} installed.`);
         installed.push(tool.bin);

package/src/commands/tools.js

@@ -8,6 +8,7 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { execa } from 'execa';
 import { hasCommandSync } from '../core/store.js';
+import { ensureSudo, sudoInteractive } from '../util/sudo.js';
 
 export const REQUIRED = [
   { bin: 'rclone', pkg: 'rclone', why: 'talks to MEGA / Google Drive (cloud storage)' },
@@ -59,7 +60,8 @@ export async function ensureSystemTools() {
     s.stop(''); // release the terminal first so the sudo password prompt is usable
     try {
       const args = pm === 'pacman' ? ['-S', '--noconfirm', tool.pkg] : [pm, 'install', '-y', tool.pkg];
-      const res = await execa('sudo', args, { stdio: 'inherit', reject: false });
+      await ensureSudo();
+      const res = await sudoInteractive([pm, ...args.slice(1)]);
       if (res.exitCode === 0 && hasCommandSync(tool.bin)) {
         p.log.success(`${pc.cyan(tool.bin)} installed.`);
         installed.push(tool.bin);

package/src/commands/wizard.js

@@ -319,6 +319,7 @@ export async function runWizard() {
       message: 'What would you like to do?',
       options: [
         { value: 'snapshot', label: '📸 Create snapshot', hint: 'backup your system now' },
+        { value: 'resume', label: '⏳ Resume upload', hint: 'resume incomplete backup uploads' },
         { value: 'backup', label: '💾 Run all backups', hint: 'snapshots + file backups' },
         { value: 'restore', label: '♻️  Restore backup', hint: 'files or system snapshot' },
         { value: 'list', label: '📋 List backups', hint: 'see what\'s saved' },
@@ -348,6 +349,7 @@ export async function runWizard() {
         case 'accounts': await accountsMenu(); break;
         case 'tools': await runToolsCheck(); break;
         case 'snapshot': await snapshotNowAction(); break;
+        case 'resume': await snapshotNowAction(); break;
         case 'backup': await backupNowAction(); break;
         case 'list': await listBackupsAction(); break;
         case 'restore': await restoreMenu(); break;

package/src/lib/self.js

@@ -8,6 +8,7 @@
 import { execa } from 'execa';
 import pc from 'picocolors';
 import { createRequire } from 'node:module';
+import { ensureSudo, sudoInteractive } from '../util/sudo.js';
 
 const require = createRequire(import.meta.url);
 const pkg = require('../../package.json');
@@ -66,9 +67,18 @@ export async function promptSelfUpdate() {
 
   // Release the terminal so npm's progress & any prompts are visible/interruptible.
   console.log();
-  const res = await execa('npm', ['install', '-g', `${NPM_NAME}@latest`], { stdio: 'inherit', reject: false });
+  let res = await execa('npm', ['install', '-g', `${NPM_NAME}@latest`], { stdio: 'inherit', reject: false });
   if (res.exitCode !== 0) {
-    p.log.warn('Update failed. You can retry with: npm install -g ' + NPM_NAME + '@latest');
+    p.log.warn('Update failed. Attempting again with sudo...');
+    try {
+      await ensureSudo();
+      res = await sudoInteractive(['npm', 'install', '-g', `${NPM_NAME}@latest`]);
+    } catch {
+      // Fall through to error
+    }
+  }
+  if (res.exitCode !== 0) {
+    p.log.warn('Update failed. You can retry with: sudo npm install -g ' + NPM_NAME + '@latest');
     return false;
   }
   p.log.success(`Updated to v${latest}. ` + 'Run `parrot-blackbox` again to use the new version.');
@@ -99,9 +109,18 @@ export async function runSelfUpdate({ force = false } = {}) {
   const want = await p.confirm({ message: `Update parrot-blackbox to v${latest} now?`, initialValue: true });
   if (p.isCancel(want) || !want) { p.log.message(pc.dim('Update skipped.')); return false; }
   console.log();
-  const res = await execa('npm', ['install', '-g', `${NPM_NAME}@latest`], { stdio: 'inherit', reject: false });
+  let res = await execa('npm', ['install', '-g', `${NPM_NAME}@latest`], { stdio: 'inherit', reject: false });
+  if (res.exitCode !== 0) {
+    p.log.warn('Update failed. Attempting again with sudo...');
+    try {
+      await ensureSudo();
+      res = await sudoInteractive(['npm', 'install', '-g', `${NPM_NAME}@latest`]);
+    } catch {
+      // Fall through to error
+    }
+  }
   if (res.exitCode !== 0) {
-    p.log.warn('Update failed. You can retry with: npm install -g ' + NPM_NAME + '@latest');
+    p.log.warn('Update failed. You can retry with: sudo npm install -g ' + NPM_NAME + '@latest');
     return false;
   }
   p.log.success(`Updated to v${latest}. Restart parrot-blackbox to use the new version.`);
@@ -112,7 +131,16 @@ export async function runSelfUpdate({ force = false } = {}) {
 export async function selfUninstall() {
   const p = await import('@clack/prompts');
   console.log();
-  const res = await execa('npm', ['uninstall', '-g', NPM_NAME], { stdio: 'inherit', reject: false });
+  let res = await execa('npm', ['uninstall', '-g', NPM_NAME], { stdio: 'inherit', reject: false });
+  if (res.exitCode !== 0) {
+    p.log.warn('Uninstall failed. Attempting again with sudo...');
+    try {
+      await ensureSudo();
+      res = await sudoInteractive(['npm', 'uninstall', '-g', NPM_NAME]);
+    } catch {
+      // Fall through to error
+    }
+  }
   if (res.exitCode === 0) {
     p.log.success(`${NPM_NAME} removed. The parrot-blackbox command is no longer available.`);
     return true;

package/src/util/sudo.js

@@ -1,27 +1,120 @@
 /**
  * Privileged execution.
  *
- *  - `sudoInteractive`  — runs `sudo <args>` with the terminal inherited so the
+ *  - `ensureSudo`          — prompts the user for their sudo password once,
+ *    arming the sudo timestamp so all subsequent calls in the same session
+ *    work without re-prompting (unless the timestamp expires after ~15 min).
+ *    Call this EARLY (e.g. at wizard launch, before any privileged menu item).
+ *  - `sudoExec`            — the ONE wrapper every caller should use. It picks
+ *    interactive vs non-interactive automatically based on TTY, and pre-prompts
+ *    for the password if the timestamp has lapsed.
+ *  - `sudoInteractive`     — runs `sudo <args>` with the terminal inherited so the
  *    password prompt is visible and Ctrl+C works (the gitswitch/theamify/
  *    warp-wizard pattern: callers stop any spinner FIRST).
- *  - `sudoNonInteractive` — runs `sudo -n <args>`; used by the background daemon
- *    so it can *never* hang waiting on a password. When the sudo timestamp has
- *    lapsed the job is deferred and retried later; a single interactive
- *    `parrot-blackbox snapshot now` (or any sudo use on the box) re-arms it.
+ *  - `sudoInteractiveCapture` — same but captures stdout (for `timeshift --list`).
+ *  - `sudoNonInteractive`  — runs `sudo -n <args>`; used by the background daemon
+ *    so it can *never* hang waiting on a password.
  *
  * PBB_SUDO_DIRECT=1 (used by unit tests) bypasses sudo entirely.
  */
 
-import { execa } from 'execa';
+import { execa, execaSync } from 'execa';
 
 function sudoPrefix() {
   return process.env.PBB_SUDO_DIRECT === '1' ? [] : ['sudo'];
 }
 
+/**
+ * Prompt the user for their sudo password (if needed) to arm the sudo
+ * timestamp for this session. This is a no-op when:
+ *  - already root (UID 0)
+ *  - PBB_SUDO_DIRECT=1 (test mode)
+ *  - sudo timestamp is already valid
+ *
+ * Safe to call multiple times — it checks `sudo -n true` first, and only
+ * prompts when the timestamp has actually lapsed.
+ */
+export async function ensureSudo() {
+  if (process.env.PBB_SUDO_DIRECT === '1') return true;
+  if (process.getuid && process.getuid() === 0) return true;
+
+  // Check if sudo timestamp is already valid (no prompt needed).
+  const check = await execa('sudo', ['-n', 'true'], { reject: false });
+  if (check.exitCode === 0) return true;
+
+  // Timestamp lapsed — prompt the user for their password.
+  // stdio: 'inherit' keeps the terminal so the user can type the password.
+  console.log('\n🔐 Root privileges required — please enter your sudo password:\n');
+  const res = await execa('sudo', ['-v'], { stdio: 'inherit', reject: false });
+  if (res.exitCode !== 0) {
+    throw new Error('sudo authentication failed — cannot continue without root privileges');
+  }
+  return true;
+}
+
+/**
+ * Synchronous version of ensureSudo for use in sync code paths.
+ * Returns true if sudo is available (timestamp valid or we're root).
+ * Does NOT prompt — use ensureSudo() for that.
+ */
+export function isSudoArmed() {
+  if (process.env.PBB_SUDO_DIRECT === '1') return true;
+  if (process.getuid && process.getuid() === 0) return true;
+  try {
+    const res = execaSync('sudo', ['-n', 'true'], { reject: false });
+    return res.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Smart sudo wrapper — the preferred entry point for ALL privileged calls
+ * from interactive (TTY) code paths. It:
+ *  1. Checks if sudo is armed
+ *  2. If not, prompts the user for password (if TTY)
+ *  3. Then runs the command with sudo
+ *
+ * For daemon/non-interactive use, pass { interactive: false } — it will use
+ * `sudo -n` and never hang on a prompt.
+ */
+export async function sudoExec(args, { interactive = true, capture = false, timeout = 0, env = {} } = {}) {
+  if (interactive && process.stdin.isTTY) {
+    // Ensure the sudo timestamp is armed before running the command.
+    await ensureSudo();
+    if (capture) {
+      return sudoInteractiveCapture(args, { timeout, env });
+    }
+    return sudoInteractive(args, { timeout, env });
+  }
+  return sudoNonInteractive(args, { env });
+}
+
+/**
+ * Synchronous sudo execution for code paths that MUST be sync (e.g. snapshotDirFor).
+ * Requires that ensureSudo() was called earlier in the session.
+ * Falls back to non-interactive sudo; if that fails, falls back to direct execution.
+ */
+export function sudoExecSync(args, { reject = false, env = {} } = {}) {
+  if (process.env.PBB_SUDO_DIRECT === '1') {
+    return execaSync(args[0], args.slice(1), { reject, env: { ...process.env, ...env } });
+  }
+  // Try with sudo (timestamp should be armed from earlier ensureSudo call)
+  const full = ['sudo', '-n', ...args];
+  const res = execaSync(full[0], full.slice(1), { reject: false, env: { ...process.env, ...env } });
+  if (res.exitCode === 0) return res;
+  // If sudo -n fails, try sudo with inherited stdio (will prompt if TTY available)
+  if (process.stdin?.isTTY) {
+    return execaSync('sudo', args, { reject, stdio: 'inherit', env: { ...process.env, ...env } });
+  }
+  // Last resort: try without sudo (some operations work unprivileged)
+  return execaSync(args[0], args.slice(1), { reject: false, env: { ...process.env, ...env } });
+}
+
 /** Interactive sudo baseline for injecting PBB_SUDO_DIRECT consistent with the rest. */
-export async function sudoInteractive(args, { timeout = 0 } = {}) {
+export async function sudoInteractive(args, { timeout = 0, env = {} } = {}) {
   const full = [...sudoPrefix(), ...args];
-  const res = await execa(full[0], full.slice(1), { stdio: 'inherit', reject: false, timeout });
+  const res = await execa(full[0], full.slice(1), { stdio: 'inherit', reject: false, timeout, env: { ...process.env, ...env } });
   if (res.exitCode !== 0) {
     throw new Error(`elevated command failed: ${args.join(' ')} (exit ${res.exitCode})`);
   }
@@ -33,9 +126,9 @@ export async function sudoInteractive(args, { timeout = 0 } = {}) {
  * the parser) while keeping stdin inherited so the password prompt stays
  * usable — like the real sudo, which reads passwords from /dev/tty.
  */
-export async function sudoInteractiveCapture(args, { timeout = 0 } = {}) {
+export async function sudoInteractiveCapture(args, { timeout = 0, env = {} } = {}) {
   const full = [...sudoPrefix(), ...args];
-  const res = await execa(full[0], full.slice(1), { stdin: 'inherit', reject: false, timeout });
+  const res = await execa(full[0], full.slice(1), { stdin: 'inherit', reject: false, timeout, env: { ...process.env, ...env } });
   if (res.exitCode !== 0) {
     throw new Error(`elevated command failed: ${args.join(' ')} (exit ${res.exitCode})`);
   }
@@ -43,9 +136,9 @@ export async function sudoInteractiveCapture(args, { timeout = 0 } = {}) {
 }
 
 /** Non-interactive sudo (daemon-safe). Returns execa result, never hangs. */
-export async function sudoNonInteractive(args) {
+export async function sudoNonInteractive(args, { env = {} } = {}) {
   const full = process.env.PBB_SUDO_DIRECT === '1' ? args : ['sudo', '-n', ...args];
-  const res = await execa(full[0], full.slice(1), { reject: false });
+  const res = await execa(full[0], full.slice(1), { reject: false, env: { ...process.env, ...env } });
   return res;
 }