Why the agent takes no shell commands

Every control panel has the same shape: something a person clicks, and something with root that does the work. The interesting question is what travels between them.

The usual answer is a command line. It is the fastest thing to build and the hardest thing to keep safe, because every value a customer controls — a domain, a database name, a file path — eventually lands inside a string that a shell will parse. Getting that right once is easy. Getting it right in every place, forever, while the panel grows, is the part nobody manages.

What we do instead

Maran's root daemon accepts named operations with typed, validated arguments, and nothing else. There is no operation that takes a command to run. A domain is not escaped before it reaches a configuration file — it is validated as a domain, which is to say letters, digits, hyphens and dots, so there is no newline in it to end one directive and begin another.

The practical effect is that the set of things the daemon can be made to do is finite, written down, and reviewable. An operation that does not exist in the contract cannot be requested, however inventive the request.

What it costs

Every new capability is a contract change rather than a new string. That is slower, and deliberately so: adding one means deciding what its arguments are, what counts as valid, and what happens when the host disagrees — before any of it ships.

It also rules out a class of feature a panel could otherwise offer: "run this command for me". We think that is the right trade for software that holds root on a server somebody else's customers live on.