From f32a8535836aab080835a90b729500703004a7c7 Mon Sep 17 00:00:00 2001
From: Your Name <your-email@example.com>
Date: Thu, 19 Feb 2026 10:31:15 -0800
Subject: [PATCH] fix(installer): handle sudo shims that don't support -k flag

On Alpine Linux with doas-sudo-shim, `sudo -k` fails because the
shim doesn't support the -k option. Fall back to running sudo
without -k when it fails.

Fixes #13475
---
 tools/install.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/install.sh b/tools/install.sh
index c31ce2d55..8f5e0326b 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -473,7 +473,10 @@ EOF
   # be prompted for the password either way, so this shouldn't cause any issues.
   #
   if user_can_sudo; then
-    sudo -k chsh -s "$zsh" "$USER"  # -k forces the password prompt
+    # Use -k to invalidate cached credentials (forces password prompt).
+    # Some sudo shims (e.g. doas-sudo-shim on Alpine) don't support -k,
+    # so fall back to running without it.
+    sudo -k chsh -s "$zsh" "$USER" 2>/dev/null || sudo chsh -s "$zsh" "$USER"
   else
     chsh -s "$zsh" "$USER"          # run chsh normally
   fi