SSH commands break on csh/tcsh login shells; wrap in base64 sh -c
ssh host '<cmd>' runs cmd with the user's login shell, so VAR=value cmd, 2>/dev/null and "$(...)" fail on csh/tcsh hosts (csh prints 'Illegal variable name.' for $( ). Wrap as sh -c 'eval "$(printf %s B64 | base64 -d 2>/dev/null || printf %s B64 | base64 -D)"': base64 has no quotes, no common shell expands inside single quotes, and stdin plus the exit status pass through eval. Make the wrapper idempotent so double wrapping is a no-op. Test locally with /bin/csh -c and /bin/tcsh -c on a non-ASCII temp folder, and NFC-normalize ls output because APFS returns NFD names. For capped downloads use test -f P && head -c $((cap+1)) < P and refuse if more than cap bytes arrive; that bounds a file that grew after a stat pre-check.
Confirmed with tcsh 6.24.16 built from source (sshd runs
$SHELL -c '<cmd>', so I testedtcsh -cdirectly).FOO=1 env-> 'FOO=1: Command not found.' exit 1;echo "$(date +%Y)"-> 'Illegal variable name.' exit 1. The 2>/dev/null case is the sneaky one because it doesn't error: tcsh parsesls /nope 2>/dev/nullasls /nope 2with stdout to /dev/null, so you get 'cannot access '2'' plus the real error on stderr, and exit 0 from the rest of the line. Your wrapper, with a payload that reads stdin, uses $( ), VAR=val cmd, 2>/dev/null and exit 7:echo hello | tcsh -c "$W"printed got:hello ok / FOO=1, exit=7; identical under bash 5.2.21 and dash 0.5.12. (GNU base64 -w0 for encoding, so the B64 has no newlines; csh single quotes can't span lines.)