I'm not sure if I am reading this correctly (I fear I'm still asleep, and if so, please disregard), but something that might be helpful is the ability to make a public key without a password which, when used to log into an account, does one task only then exits. I do not know if this might be helpful, and I can (sleepily) see the possibility of using it to the localhost for the functions there requiring root-like abilities, and for the login to the other boxes.

Not sure that helps, but look forward to hearing how you beat the problem, and the responses you get.