rip out what would be a double sudo before passing to invoke_command when via is :sudo