Every other mutating subcommand (secret, refresh-creds, client add/remove) already re-execs via sudo only when os.geteuid() != 0. cmd_sync was the one exception, calling sudo unconditionally — fails with "No such file or directory: 'sudo'" on minimal root-only images (no sudo binary at all), hit live running `homelab sync` on strong over root SSH. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>