{
  "id": "deck-sudo",
  "command": "deck-sudo <command> [args...]",
  "summary": "Runs a command as root by respawning via systemd-run --user, escaping the agent sandbox's no_new_privs.",
  "intent_phrases": ["run this as root", "I need sudo", "install a system package", "restart a system service"],
  "replaces": ["sudo <command>", "pkexec <command>", "run0 <command>"],
  "preconditions": "Password file present (its absence is the owner's revocation, never work around it).",
  "effects": "Spawns a fresh process tree via systemd-run --user that authenticates and runs <command> as root.",
  "risk": "destructive",
  "example": "deck-sudo systemctl restart overdeck-collector",
  "help_probe": null
}