use std
use platform/config/accessor.nu *
use primitives/infra/init.nu [get-provisioning-use-sops]
use primitives/io/logging.nu [is-debug-enabled, is-debug-check-enabled]
use primitives/io/error.nu [throw-error]
use primitives/io/interface.nu [_ansi _print]
use domain/ssh/lib.nu [scp_to, ssh_cmd]
#use utils.nu taskserv_get_file
use domain/utils/templates.nu [on_template_path]

def make_cmd_env_temp [
  defs: record
  taskserv_env_path: string
  wk_vars: string
] {
  let tmp_sh      = (mktemp --tmpdir-path $taskserv_env_path --suffix ".sh")
  let cmd_env_temp = ($taskserv_env_path | path join $"cmd_env_(($tmp_sh | path basename))")
  mv $tmp_sh $cmd_env_temp  # rename the mktemp file; avoids leaving tmp.*.sh side-effect
  let nu_lib_dirs = ($env.NU_LIB_DIRS? | default [] | if ($in | describe) == "string" { $in | split row ":" } else { $in } | str join ":")
  ($"export PROVISIONING_VARS=($wk_vars)\nexport PROVISIONING_DEBUG=((is-debug-enabled))\n" +
    $"export NU_LIB_DIRS=($nu_lib_dirs)\n" +
    $"export NU_LOG_LEVEL=($env.NU_LOG_LEVEL? | default '')\n" +
    $"export PROVISIONING_RESOURCES=((get-provisioning-resources))\n" +
    $"export PROVISIONING_SETTINGS_SRC=($defs.settings.src)\nexport PROVISIONING_SETTINGS_SRC_PATH=($defs.settings.src_path)\n" +
    $"export PROVISIONING_KLOUD=($defs.settings | get -o infra | default ($defs.settings.infra_path | path basename))\nexport PROVISIONING_KLOUD_PATH=($defs.settings.infra_path)\n" +
    $"export PROVISIONING_USE_SOPS=((get-provisioning-use-sops))\nexport PROVISIONING_WK_ENV_PATH=($taskserv_env_path)\n" +
    $"export PROVISIONING_WORKSPACES=($defs.settings.src_path | path dirname)\nexport CURRENT_WORKSPACE=($defs.settings.src_path | path basename)\n" +
    # Absolute workspace root for prepare/postrun scripts (src_path is relative, so the
    # PROVISIONING_WORKSPACES double-dirname collapses to ""). Derive from the absolute
    # infra_path the same way the DAG executor does: <ws>/infra/<name> → <ws>.
    $"export PROVISIONING_WORKSPACE_PATH=($defs.settings.infra_path | path dirname | path dirname)\n" +
    $"export SOPS_AGE_KEY_FILE=($env.SOPS_AGE_KEY_FILE? | default '')\nexport PROVISIONING_KAGE=($env.PROVISIONING_KAGE? | default '')\n" +
    $"export SOPS_AGE_RECIPIENTS=($env.SOPS_AGE_RECIPIENTS? | default '')\n"
  ) | save --force $cmd_env_temp
  if (is-debug-enabled) { _print $"cmd_env_temp: ($cmd_env_temp)" }
  $cmd_env_temp
}
def run_cmd [
  cmd_name: string
  title: string
  where: string
  defs: record
  taskserv_env_path: string
  wk_vars: string
] {
  _print (
    $"($title) for (_ansi yellow_bold)($defs.taskserv.name)(_ansi reset) (_ansi default_dimmed)on(_ansi reset) " +
    $"($defs.server.hostname) ($defs.pos.server) ..."
  )
  let runner = (grep "^#!" ($taskserv_env_path | path join $cmd_name) | str trim)
  let run_ops = if (is-debug-enabled) { if ($runner | str contains "bash" ) { "-x" } else { "" } } else { "" }
  let cmd_run_file = make_cmd_env_temp $defs $taskserv_env_path $wk_vars
  if ($cmd_run_file | path exists) and ($wk_vars | path exists) {
    if ($runner | str ends-with "bash" ) {
        $"($run_ops) ($taskserv_env_path | path join $cmd_name) ($wk_vars) ($defs.pos.server) ($defs.pos.taskserv) (^pwd)" | save --append $cmd_run_file
    } else if ($runner | str ends-with "nu" ) {
        $"($env.NU) ($env.NU_ARGS? | default '') ($taskserv_env_path | path join $cmd_name)"  | save --append $cmd_run_file
    } else {
        $"($taskserv_env_path | path join $cmd_name) ($wk_vars)" | save --append $cmd_run_file
    }
    let run_res = (^bash $cmd_run_file | complete)
    if $run_res.exit_code != 0 {
      (throw-error $"🛑 Error server ($defs.server.hostname) taskserv ($defs.taskserv.name)
        ($taskserv_env_path)/($cmd_name) with ($wk_vars) ($defs.pos.server) ($defs.pos.taskserv) (^pwd)"
        $"($run_res.stdout)\n($run_res.stderr)\n"
        $where --span (metadata $run_res).span)
      exit 1
    }
    if (is-debug-enabled) {
      if ($run_res.stdout | is-not-empty) { _print $"($run_res.stdout)" }
      if ($run_res.stderr | is-not-empty) { _print $"($run_res.stderr)" }
    } else {
      rm -f $cmd_run_file
      rm -f ($taskserv_env_path | path join "prepare")
    }
  }
}
export def run_taskserv_library [
    defs: record
    taskserv_path: string
    taskserv_env_path: string
    wk_vars: string
] {

  if not ($taskserv_path | path exists) { return false }
  let prov_resources_path = ($defs.settings.data | get -o prov_resources_path | default "" | str replace  "~" $env.HOME)
  let taskserv_server_name = $defs.server.hostname
  rm -rf ...(glob ($taskserv_env_path | path join "*.ncl")) ($taskserv_env_path |path join "nickel")
  mkdir ($taskserv_env_path | path join "nickel")

  let err_out = ($taskserv_env_path | path join (mktemp --tmpdir-path $taskserv_env_path --suffix ".err" | path basename))
  let nickel_temp = ($taskserv_env_path | path join "nickel"| path join (mktemp --tmpdir-path $taskserv_env_path --suffix ".ncl" | path basename))

  let wk_format = if (get-provisioning-wk-format) == "json" { "json" } else { "yaml" }
  # Resolve component config: prefer settings.data.taskservs.<name> (explicit), fall back to
  # settings.data.components.<name> (most workspaces expose components, not taskservs).
  let _ts_from_taskservs  = ($defs.settings.data | get -o taskservs   | default {} | get -o $defs.taskserv.name | default {})
  let taskserv_settings = if ($defs.taskserv.name | is-not-empty) and ($defs.settings.data | get -o components | default {} | get -o $defs.taskserv.name | is-not-empty) {
    ($defs.settings.data | get -o components | default {} | get -o $defs.taskserv.name | default {}) | merge $_ts_from_taskservs
  } else {
    $_ts_from_taskservs
  }
  # merge order: static schema settings overlay defs defaults, but runtime-set fields
  # (cmd_task, profile) from $defs.taskserv must always win — they carry handler intent
  # (e.g. cmd_task="reinstall" for reset ops) that the schema default would overwrite.
  let merged_taskserv   = ($defs.taskserv | merge $taskserv_settings)
  let runtime_overrides = ($defs.taskserv | select -o cmd_task profile)
  let wk_data = {
    defs: $defs.settings.data,
    pos: $defs.pos,
    server: $defs.server,
    taskserv: ($merged_taskserv | merge $runtime_overrides)
  }
  if $wk_format == "json" {
    $wk_data | to json | save --force $wk_vars
  } else {
    $wk_data | to yaml | save --force $wk_vars
  }
  # Pre-compute Nickel template paths so we can gate the import on actual file presence
  let nickel_taskserv_path = if ($taskserv_path | path join "nickel" | path join $"($defs.taskserv.name).ncl" | path exists) {
    ($taskserv_path | path join "nickel" | path join $"($defs.taskserv.name).ncl")
  } else if ($taskserv_path | path dirname | path join "nickel" | path join $"($defs.taskserv.name).ncl" | path exists) {
    ($taskserv_path | path dirname | path join "nickel" | path join $"($defs.taskserv.name).ncl")
  } else if ($taskserv_path | path dirname | path join "default" | path join "nickel" | path join $"($defs.taskserv.name).ncl" | path exists) {
    ($taskserv_path | path dirname | path join "default" | path join "nickel" | path join $"($defs.taskserv.name).ncl")
  } else { "" }
  let nickel_taskserv_profile_path = if ($taskserv_path | path join "nickel" | path join $"($defs.taskserv.profile).ncl" | path exists) {
    ($taskserv_path | path join "nickel" | path join $"($defs.taskserv.profile).ncl")
  } else if ($taskserv_path | path dirname | path join "nickel" | path join $"($defs.taskserv.profile).ncl" | path exists) {
    ($taskserv_path | path dirname | path join "nickel" | path join $"($defs.taskserv.profile).ncl")
  } else if ($taskserv_path | path dirname | path join "default" | path join "nickel" | path join $"($defs.taskserv.profile).ncl" | path exists) {
    ($taskserv_path | path dirname | path join "default" | path join "nickel" | path join $"($defs.taskserv.profile).ncl")
  } else { "" }
  let has_ncl_files = ($nickel_taskserv_path != "" or $nickel_taskserv_profile_path != "")

  if (get-use-nickel) and $has_ncl_files {
    if (which nickel | is-empty) {
      _print $"❗(_ansi red_bold)nickel binary not found(_ansi reset) — install nickel or set PROVISIONING_USE_NICKEL=false to skip"
      return false
    }
    cd $defs.settings.infra_path
    if ($nickel_temp | path exists) { rm -f $nickel_temp }
    let res = (^nickel import -m $wk_format $wk_vars -o $nickel_temp | complete)
    if $res.exit_code != 0 {
      _print $"❗Nickel import (_ansi red_bold)($wk_vars)(_ansi reset) Errors found "
      _print $res.stdout
      rm -f $nickel_temp
      cd $env.PWD
      return false
    }
    # Very important! Remove external block for import and re-format it
    open $nickel_temp -r | lines | find -v --regex "^{" | find -v --regex "^}" | save -f $nickel_temp
    let res = (^nickel fmt $nickel_temp | complete)
    if $nickel_taskserv_path != "" and ($nickel_taskserv_path | path exists) {
      if (is-debug-enabled) {
        _print $"adding task name: ($defs.taskserv.name) ->  ($nickel_taskserv_path)"
      }
      cat $nickel_taskserv_path | save --append $nickel_temp
    }
    if $nickel_taskserv_profile_path != "" and ($nickel_taskserv_profile_path | path exists) {
      if (is-debug-enabled) {
        _print $"adding task profile: ($defs.taskserv.profile) ->  ($nickel_taskserv_profile_path)"
      }
      cat $nickel_taskserv_profile_path | save --append $nickel_temp
    }
    let keys_path_config = (get-keys-path)
    if $keys_path_config != "" {
      #use sops on_sops
      let keys_path = ($defs.settings.src_path | path join $keys_path_config)
      if not ($keys_path | path exists) {
        if (is-debug-enabled) {
          _print $"❗Error KEYS_PATH (_ansi red_bold)($keys_path)(_ansi reset) found "
        } else {
          _print $"❗Error (_ansi red_bold)KEYS_PATH(_ansi reset) not found "
        }
        return false
      }
      (on_sops d $keys_path) | save --append $nickel_temp
      let nickel_defined_taskserv_path = if ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $"($defs.taskserv.profile).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $"($defs.taskserv.profile).ncl")
      } else if ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname |  path join $"($defs.taskserv.profile).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $"($defs.taskserv.profile).ncl")
      } else if ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $"($defs.taskserv.profile).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $"($defs.taskserv.profile).ncl")
      } else if ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $"($defs.taskserv.name).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $"($defs.taskserv.name).ncl")
      } else if ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $defs.taskserv.profile |  path join $"($defs.taskserv.name).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs" | path join $defs.server.hostname | path join $defs.taskserv.profile |  path join $"($defs.taskserv.name).ncl")
      } else if ($defs.settings.src_path | path join "extensions" | path join "taskservs"| path join $"($defs.taskserv.name).ncl" | path exists ) {
        ($defs.settings.src_path | path join "extensions" | path join "taskservs"| path join $"($defs.taskserv.name).ncl")
      } else { "" }
      if $nickel_defined_taskserv_path != "" and ($nickel_defined_taskserv_path | path exists) {
        if (is-debug-enabled) {
          _print $"adding defs taskserv: ($nickel_defined_taskserv_path)"
        }
        cat $nickel_defined_taskserv_path | save --append $nickel_temp
      }
      let res = (^nickel $nickel_temp -o $wk_vars | complete)
      if $res.exit_code != 0 {
        _print $"❗Nickel errors (_ansi red_bold)($nickel_temp)(_ansi reset) found "
        _print $res.stdout
        _print $res.stderr
        rm -f $wk_vars
        cd $env.PWD
        return false
      }
      rm -f $nickel_temp $err_out
    } else if ( $defs.settings.src_path | path join "extensions" | path join "taskservs"| path join $"($defs.taskserv.name).yaml" | path exists) {
      cat ($defs.settings.src_path | path join "extensions" | path join "taskservs"| path join $"($defs.taskserv.name).yaml") | tee { save -a $wk_vars } | ignore
    }
    cd $env.PWD
  }
  (open -r $wk_vars | str replace --all "NOW" $env.NOW | save -f $wk_vars)
  if $defs.taskserv_install_mode == "library" {
    let taskserv_data = (open $wk_vars)
    let quiet = if (is-debug-enabled) { false } else { true }
    if $taskserv_data.taskserv? != null and $taskserv_data.taskserv.copy_paths? != null {
      #use utils/files.nu *
      for it in $taskserv_data.taskserv.copy_paths {
        let it_list = ($it | split row "|" | default [])
        let cp_source = ($it_list | get -o 0 | default "")
        let cp_target = ($it_list | get -o 1 | default "")
        if ($cp_source | path exists) {
          copy_prov_files $cp_source "." ($taskserv_env_path | path join $cp_target) false $quiet
        } else if ($prov_resources_path | path join $cp_source | path exists) {
          copy_prov_files $prov_resources_path $cp_source ($taskserv_env_path | path join $cp_target) false $quiet
        } else if ($"($prov_resources_path)/($cp_source)" | path exists) {
          copy_prov_file ($prov_resources_path | path join $cp_source) ($taskserv_env_path | path join $cp_target) $quiet
        }
      }
    }
  }
  rm -f ($taskserv_env_path | path join "nickel") ...(glob $"($taskserv_env_path)/*.ncl")
  on_template_path $taskserv_env_path $wk_vars true true
  let env_file = ($taskserv_env_path | path join $"env-($defs.taskserv.name)")
  if ($env_file | path exists) {
    let env_content = (open -r $env_file
      | lines
      | each {|l| $l | str replace --all "\t" "" | str trim --left }
      | where {|l| ($l | is-not-empty) }
      | str join "\n")
    $env_content | save -f $env_file
  }
  if ($taskserv_env_path | path join "prepare" | path exists) {
    run_cmd "prepare" "prepare" "run_taskserv_library" $defs $taskserv_env_path $wk_vars
    if ($taskserv_env_path | path join "resources" | path exists) {
      on_template_path ($taskserv_env_path | path join "resources") $wk_vars false true
    }
  }
  # SOPS credential injection: decrypt {name}.sops.yaml from workspace secrets → _credentials.env.
  # Runs only when _credentials.env is absent (Nickel pipeline may have written it earlier).
  # Mirrors the dotenv injection in components.nu so install scripts can always source it.
  let sops_creds_path = ($taskserv_env_path | path join "_credentials.env")
  if not ($sops_creds_path | path exists) {
    let sops_secret = ($defs.settings.infra_path | path join "secrets" | path join $"($defs.taskserv.name).sops.yaml")
    let sops_kage   = ($defs.settings.infra_path | path join ".kage")
    let sops_conf   = ($defs.settings.infra_path | path join "sops.yaml")
    if ($sops_secret | path exists) and ($sops_kage | path exists) and ($sops_conf | path exists) {
      let sops_dec = do {
        with-env { SOPS_AGE_KEY_FILE: $sops_kage } {
          ^sops --decrypt --config $sops_conf --output-type dotenv $sops_secret
        }
      } | complete
      if $sops_dec.exit_code == 0 {
        ($sops_dec.stdout | lines | each {|line|
          if ($line | is-empty) or ($line | str starts-with "#") or not ($line | str contains "=") {
            $line
          } else {
            let kv = ($line | split row "=" | collect)
            $"(($kv | first))='(($kv | skip 1 | str join "=" | str replace --all "'" "'\\''" ))'"
          }
        } | str join "\n") + "\n" | save --force $sops_creds_path
      } else if (is-debug-enabled) {
        _print $"⚠ SOPS decrypt skipped for ($defs.taskserv.name): ($sops_dec.stderr | str trim)"
      }
    }
  }
  if not (is-debug-enabled) {
    rm -f ...(glob $"($taskserv_env_path)/*.j2") $err_out $nickel_temp
  }
  true
}
export def run_taskserv [
    defs: record
    taskserv_path: string
    env_path: string
] {
  if  not ($taskserv_path | path exists) { return false }
  let prov_resources_path = ($defs.settings.data | get -o prov_resources_path | default "" | str replace  "~" $env.HOME)
  let taskserv_server_name = $defs.server.hostname

  let str_created_taskservs_dirpath = ($defs.settings.data | get -o created_taskservs_dirpath | default "/tmp" |
    str replace "~" $env.HOME | str replace "NOW" $env.NOW | str replace "./" $"($defs.settings.src_path)/")
  let created_taskservs_dirpath = if ($str_created_taskservs_dirpath | str starts-with "/" ) { $str_created_taskservs_dirpath } else { $defs.settings.src_path | path join $str_created_taskservs_dirpath }
  if not ( $created_taskservs_dirpath | path exists) { ^mkdir -p $created_taskservs_dirpath }

  let str_taskserv_env_path = if  $defs.taskserv_install_mode == "server" { $"($env_path)_($defs.taskserv_install_mode)" } else { $env_path }
  let taskserv_env_path = if ($str_taskserv_env_path | str starts-with "/" ) { $str_taskserv_env_path } else { $defs.settings.src_path | path join $str_taskserv_env_path }
  if not ( $taskserv_env_path | path exists) { ^mkdir -p $taskserv_env_path }

  (^cp -pr ...(glob ($taskserv_path | path join "*")) $taskserv_env_path)
  rm -rf ...(glob ($taskserv_env_path | path join "*.ncl"))  ($taskserv_env_path | path join "nickel")

  let wk_vars = ($created_taskservs_dirpath | path join $"($defs.server.hostname).yaml")
  let j2_files = (glob ($taskserv_env_path | path join "*.j2"))

  let res = if $defs.taskserv_install_mode == "library" or ($j2_files | is-not-empty) {
    (run_taskserv_library $defs $taskserv_path $taskserv_env_path $wk_vars)
  } else { true }
  if not $res {
    if not (is-debug-enabled) { rm -f $wk_vars }
    return $res
  }
  let err_out = ($env_path | path join (mktemp --tmpdir-path $env_path --suffix ".err") | path basename)
  let tar_ops = if (is-debug-enabled) { "v" } else { "" }
  let bash_ops = if (is-debug-enabled) { "bash -x" } else { "" }

  # Inject common.sh into every bundle so install scripts can source standard helpers.
  # Check components/ first (post-migration location), then legacy taskservs/ fallback.
  let common_sh_src = do {
    let primary = (get-taskservs-path | path join "common.sh")
    if ($primary | path exists) { $primary } else {
      let prov = ($env.PROVISIONING? | default "")
      let legacy = ($prov | path join "catalog" | path join "taskservs" | path join "common.sh")
      if ($legacy | path exists) { $legacy } else { "" }
    }
  }
  if ($common_sh_src | is-not-empty) {
    cp $common_sh_src ($taskserv_env_path | path join "common.sh")
  }

  let prov_bin = ($env.PROVISIONING? | default "/usr/local/provisioning")
  let catalog_lib_path = (($env.PROVISIONING_CATALOG_PATH? | default ($prov_bin | path join "catalog")) | path join "lib")
  if ($catalog_lib_path | path exists) {
    ^cp -rp $catalog_lib_path ($taskserv_env_path | path join "lib")
  }

  # Remove local-only build artefacts and non-essential dirs before bundling.
  # _cri/ contains supplementary CRI configs not referenced by install scripts.
  # prepare and vars.nu are local Nu scripts — rendering helpers, not needed on server.
  # tmp.*.sh and cmd_env_*.sh are build-time side-effects that must never reach the server.
  rm -f ($taskserv_env_path | path join "prepare")
  rm -f ($taskserv_env_path | path join "vars.nu")
  rm -rf ($taskserv_env_path | path join "_cri")
  for pat in ["tmp.*.sh", "cmd_env_*.sh", "tmp.*.err"] {
    let matches = (glob $"($taskserv_env_path)/($pat)")
    if ($matches | is-not-empty) { rm -f ...$matches }
  }

    let tar_bin = if (which gtar | is-not-empty) { "gtar" } else { "tar" }
  let res_tar = (with-env { COPYFILE_DISABLE: "1" } { ^$tar_bin --no-xattrs -C $taskserv_env_path $"-c($tar_ops)zmf" (["/tmp" $"($defs.taskserv.name).tar.gz"] | path join) . | complete })
  if $res_tar.exit_code != 0 {
    _print (
      $"🛑 Error (_ansi red_bold)tar taskserv(_ansi reset) server (_ansi green_bold)($defs.server.hostname)(_ansi reset)" +
      $"  taskserv (_ansi yellow_bold)($defs.taskserv.name)(_ansi reset) ($taskserv_env_path) -> (['/tmp' $'($defs.taskserv.name).tar.gz'] | path join)"
    )
    return false
  }
  if $defs.check {
    if not (is-debug-enabled) {
      rm -f $wk_vars
      if $err_out != "" { rm -f $err_out }
      rm -rf ...(glob $"($taskserv_env_path)/*.ncl") ($taskserv_env_path | path join "nickel")
    }
    return true
  }
  let is_local = if $defs.taskserv_install_mode == "local" {
    true  # local mode: always run on provisioning machine regardless of IP
  } else if $nu.os-info.name == "macos" {
    (do -i { ^ifconfig } | default "" | str contains $"($defs.ip)")
  } else {
    (do -i { ^ip addr } | default "" | str contains $"($defs.ip)")
  }
  if $is_local and not (is-debug-check-enabled) {
    if $defs.taskserv_install_mode ==  "getfile" {
      if (taskserv_get_file $defs.settings $defs.taskserv $defs.server $defs.ip true true) { return false }
      return true
    }
    rm -rf (["/tmp" $defs.taskserv.name ] | path join)
    mkdir (["/tmp" $defs.taskserv.name ] | path join)
    cd (["/tmp" $defs.taskserv.name ] | path join)
    ^tar $"x($tar_ops)zmf" (["/tmp" $"($defs.taskserv.name).tar.gz"] | path join)
    let cmd_task = ($defs.taskserv.cmd_task? | default "install")
    # local mode: no sudo — tool (k0sctl etc.) manages its own auth
    let script = $"./install-($defs.taskserv.name).sh"
    let res_run = if $defs.taskserv_install_mode == "local" {
      if (is-debug-enabled) {
        (do { ^bash -x $script $cmd_task } | complete)
      } else {
        (do { ^bash $script $cmd_task } | complete)
      }
    } else {
      if (is-debug-enabled) {
        (do { ^sudo bash -x $script $cmd_task } | complete)
      } else {
        (do { ^sudo bash $script $cmd_task } | complete)
      }
    }
    if $res_run.exit_code != 0 {
      (throw-error $"🛑 Error server ($defs.server.hostname) taskserv ($defs.taskserv.name)
          ./install-($defs.taskserv.name).sh ($defs.pos.server) ($defs.pos.taskserv) (^pwd)"
          $"($res_run.stdout)\n($res_run.stderr)"
          "run_taskserv_library" --span (metadata $res_run).span)
      exit 1
    }
    cd /tmp
    rm -fr (["/tmp" $"($defs.taskserv.name).tar.gz"] | path join) (["/tmp" $"($defs.taskserv.name)"] | path join)
  } else {
    if $defs.taskserv_install_mode == "getfile" {
      if (taskserv_get_file $defs.settings $defs.taskserv $defs.server $defs.ip true false) { return false }
      return true
    }
    if not (is-debug-check-enabled) {
      #use ssh.nu *
      let scp_list: list<string> = ([] | append $"/tmp/($defs.taskserv.name).tar.gz")
      if not (scp_to $defs.settings $defs.server $scp_list "/tmp" $defs.ip) {
        _print (
          $"🛑 Error (_ansi red_bold)ssh_to(_ansi reset) server (_ansi green_bold)($defs.server.hostname)(_ansi reset) [($defs.ip)] " +
          $"  taskserv (_ansi yellow_bold)($defs.taskserv.name)(_ansi reset) /tmp/($defs.taskserv.name).tar.gz"
        )
        return false
      }
      #    $"rm -rf /tmp/($defs.taskserv.name); mkdir -p /tmp/($defs.taskserv.name) ;" +
      let run_ops = if (is-debug-enabled) { "-x" } else { "" }
      let cmd_task = ($defs.taskserv.cmd_task? | default "install")
      # Invoke via `bash` (matching the local branch) so the install script runs
      # regardless of its execute bit — bundle scripts are not guaranteed +x and
      # `sudo ./install-X.sh` on a non-executable file fails with "command not found".
      let cmd = (
          $"rm -rf /tmp/($defs.taskserv.name); mkdir -p /tmp/($defs.taskserv.name) ;" +
          $" cd /tmp/($defs.taskserv.name) ; sudo tar x($tar_ops)zmf /tmp/($defs.taskserv.name).tar.gz &&" +
          $" sudo bash ($run_ops) ./install-($defs.taskserv.name).sh ($cmd_task)"
      )
      if not (ssh_cmd $defs.settings $defs.server false $cmd $defs.ip) {
        _print (
          $"🛑 Error (_ansi red_bold)ssh_cmd(_ansi reset) server (_ansi green_bold)($defs.server.hostname)(_ansi reset) [($defs.ip)] " +
          $"  taskserv (_ansi yellow_bold)($defs.taskserv.name)(_ansi reset) install_($defs.taskserv.name).sh"
        )
        return false
      }
      if not (is-debug-enabled) {
        let rm_cmd = $"sudo rm -f /tmp/($defs.taskserv.name).tar.gz; sudo rm -rf /tmp/($defs.taskserv.name)"
        let _res = (ssh_cmd $defs.settings $defs.server false $rm_cmd $defs.ip)
        rm -f $"/tmp/($defs.taskserv.name).tar.gz"
      }
    }
  }
  if ($taskserv_path | path join "postrun" | path exists ) {
    cp ($taskserv_path | path join "postrun") ($taskserv_env_path | path join "postrun")
    run_cmd "postrun" "PostRune" "run_taskserv_library" $defs $taskserv_env_path $wk_vars
  }
  if not (is-debug-enabled) {
    rm -f $wk_vars
    if $err_out != "" { rm -f $err_out }
    rm -rf ...(glob $"($taskserv_env_path)/*.ncl") ($taskserv_env_path | path join join "nickel")
  }
  true
}