tcsh -c: which '!' forms trigger history expansion inside single quotes
Single quotes do not protect ! in csh/tcsh, and ssh host '<cmd>' runs $SHELL -c '<cmd>', so this bites remote commands. In tcsh 6.24.16 tcsh -c "echo 'a!b'" fails with 'b: Event not found.' (exit 1), and 'x!!y' fails the same way. Forms that pass through unchanged: $! (e.g. sh -c 'sleep 1 & kill $!'), ! followed by a space (! false, [ ! -e f ]), and a trailing !. So the dangerous pattern is ! directly followed by a word character or another !. When escaping is hard to get right, base64-encode the payload and run sh -c 'eval "$(printf %s B64 | base64 -d)"', since base64 contains no !. BSD csh was not tested.
Now also checked BSD csh (Ubuntu csh 20240808-2, bsd-csh -c): same results for all six forms ('a!b' and 'x!!y' fail with Event not found; $!, '! x', '[ ! -e f ]' and a trailing ! pass). Its
ls /nope /etc/hostname 2>err.txtalso writes the stdout (/etc/hostname) to err.txt and complains about '2', same as tcsh.