ominfra 0.0.0.dev154__py3-none-any.whl → 0.0.0.dev155__py3-none-any.whl

ominfra/scripts/manage.py

@@ -92,9 +92,16 @@ CallableVersionOperator = ta.Callable[['Version', str], bool]
 CommandT = ta.TypeVar('CommandT', bound='Command')
 CommandOutputT = ta.TypeVar('CommandOutputT', bound='Command.Output')
 
+# deploy/paths.py
+DeployPathKind = ta.Literal['dir', 'file']  # ta.TypeAlias
+DeployPathSpec = ta.Literal['app', 'tag']  # ta.TypeAlias
+
 # ../../omlish/argparse/cli.py
 ArgparseCommandFn = ta.Callable[[], ta.Optional[int]]  # ta.TypeAlias
 
+# ../../omlish/lite/contextmanagers.py
+ExitStackedT = ta.TypeVar('ExitStackedT', bound='ExitStacked')
+
 # ../../omlish/lite/inject.py
 U = ta.TypeVar('U')
 InjectorKeyCls = ta.Union[type, ta.NewType]
@@ -528,19 +535,28 @@ class MainConfig:
 
 
 ########################################
-# ../system/config.py
+# ../deploy/config.py
 
 
 @dc.dataclass(frozen=True)
-class SystemConfig:
-    platform: ta.Optional[str] = None
+class DeployConfig:
+    deploy_home: ta.Optional[str] = None
 
 
 ########################################
-# ../system/types.py
+# ../deploy/types.py
 
 
-SystemPlatform = ta.NewType('SystemPlatform', str)
+DeployHome = ta.NewType('DeployHome', str)
+
+DeployApp = ta.NewType('DeployApp', str)
+DeployTag = ta.NewType('DeployTag', str)
+DeployRev = ta.NewType('DeployRev', str)
+
+
+class DeployAppTag(ta.NamedTuple):
+    app: DeployApp
+    tag: DeployTag
 
 
 ########################################
@@ -1221,8 +1237,6 @@ def async_cached_nullary(fn):  # ta.Callable[..., T]) -> ta.Callable[..., T]:
 """
 TODO:
  - def maybe(v: lang.Maybe[T])
- - patch / override lite.check ?
-  - checker interface?
 """
 
 
@@ -1937,6 +1951,489 @@ def set_process_deathsig(sig: int) -> bool:
         return False
 
 
+########################################
+# ../../../omlish/os/linux.py
+"""
+➜  ~ cat /etc/os-release
+NAME="Amazon Linux"
+VERSION="2"
+ID="amzn"
+ID_LIKE="centos rhel fedora"
+VERSION_ID="2"
+PRETTY_NAME="Amazon Linux 2"
+
+➜  ~ cat /etc/os-release
+PRETTY_NAME="Ubuntu 22.04.5 LTS"
+NAME="Ubuntu"
+VERSION_ID="22.04"
+VERSION="22.04.5 LTS (Jammy Jellyfish)"
+VERSION_CODENAME=jammy
+ID=ubuntu
+ID_LIKE=debian
+UBUNTU_CODENAME=jammy
+
+➜  omlish git:(master) docker run -i python:3.12 cat /etc/os-release
+PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
+NAME="Debian GNU/Linux"
+VERSION_ID="12"
+VERSION="12 (bookworm)"
+VERSION_CODENAME=bookworm
+ID=debian
+"""
+
+
+@dc.dataclass(frozen=True)
+class LinuxOsRelease:
+    """
+    https://man7.org/linux/man-pages/man5/os-release.5.html
+    """
+
+    raw: ta.Mapping[str, str]
+
+    # General information identifying the operating system
+
+    @property
+    def name(self) -> str:
+        """
+        A string identifying the operating system, without a version component, and suitable for presentation to the
+        user. If not set, a default of "NAME=Linux" may be used.
+
+        Examples: "NAME=Fedora", "NAME="Debian GNU/Linux"".
+        """
+
+        return self.raw['NAME']
+
+    @property
+    def id(self) -> str:
+        """
+        A lower-case string (no spaces or other characters outside of 0-9, a-z, ".", "_" and "-") identifying the
+        operating system, excluding any version information and suitable for processing by scripts or usage in generated
+        filenames. If not set, a default of "ID=linux" may be used. Note that even though this string may not include
+        characters that require shell quoting, quoting may nevertheless be used.
+
+        Examples: "ID=fedora", "ID=debian".
+        """
+
+        return self.raw['ID']
+
+    @property
+    def id_like(self) -> str:
+        """
+        A space-separated list of operating system identifiers in the same syntax as the ID= setting. It should list
+        identifiers of operating systems that are closely related to the local operating system in regards to packaging
+        and programming interfaces, for example listing one or more OS identifiers the local OS is a derivative from. An
+        OS should generally only list other OS identifiers it itself is a derivative of, and not any OSes that are
+        derived from it, though symmetric relationships are possible. Build scripts and similar should check this
+        variable if they need to identify the local operating system and the value of ID= is not recognized. Operating
+        systems should be listed in order of how closely the local operating system relates to the listed ones, starting
+        with the closest. This field is optional.
+
+        Examples: for an operating system with "ID=centos", an assignment of "ID_LIKE="rhel fedora"" would be
+        appropriate. For an operating system with "ID=ubuntu", an assignment of "ID_LIKE=debian" is appropriate.
+        """
+
+        return self.raw['ID_LIKE']
+
+    @property
+    def pretty_name(self) -> str:
+        """
+        A pretty operating system name in a format suitable for presentation to the user. May or may not contain a
+        release code name or OS version of some kind, as suitable. If not set, a default of "PRETTY_NAME="Linux"" may be
+        used
+
+        Example: "PRETTY_NAME="Fedora 17 (Beefy Miracle)"".
+        """
+
+        return self.raw['PRETTY_NAME']
+
+    @property
+    def cpe_name(self) -> str:
+        """
+        A CPE name for the operating system, in URI binding syntax, following the Common Platform Enumeration
+        Specification[4] as proposed by the NIST. This field is optional.
+
+        Example: "CPE_NAME="cpe:/o:fedoraproject:fedora:17""
+        """
+
+        return self.raw['CPE_NAME']
+
+    @property
+    def variant(self) -> str:
+        """
+        A string identifying a specific variant or edition of the operating system suitable for presentation to the
+        user. This field may be used to inform the user that the configuration of this system is subject to a specific
+        divergent set of rules or default configuration settings. This field is optional and may not be implemented on
+        all systems.
+
+        Examples: "VARIANT="Server Edition"", "VARIANT="Smart Refrigerator Edition"".
+
+        Note: this field is for display purposes only. The VARIANT_ID field should be used for making programmatic
+        decisions.
+
+        Added in version 220.
+        """
+
+        return self.raw['VARIANT']
+
+    @property
+    def variant_id(self) -> str:
+        """
+        A lower-case string (no spaces or other characters outside of 0-9, a-z, ".", "_" and "-"), identifying a
+        specific variant or edition of the operating system. This may be interpreted by other packages in order to
+        determine a divergent default configuration. This field is optional and may not be implemented on all systems.
+
+        Examples: "VARIANT_ID=server", "VARIANT_ID=embedded".
+
+        Added in version 220.
+        """
+
+        return self.raw['variant_id']
+
+    # Information about the version of the operating system
+
+    @property
+    def version(self) -> str:
+        """
+        A string identifying the operating system version, excluding any OS name information, possibly including a
+        release code name, and suitable for presentation to the user. This field is optional.
+
+        Examples: "VERSION=17", "VERSION="17 (Beefy Miracle)"".
+        """
+
+        return self.raw['VERSION']
+
+    @property
+    def version_id(self) -> str:
+        """
+        A lower-case string (mostly numeric, no spaces or other characters outside of 0-9, a-z, ".", "_" and "-")
+        identifying the operating system version, excluding any OS name information or release code name, and suitable
+        for processing by scripts or usage in generated filenames. This field is optional.
+
+        Examples: "VERSION_ID=17", "VERSION_ID=11.04".
+        """
+
+        return self.raw['VERSION_ID']
+
+    @property
+    def version_codename(self) -> str:
+        """
+        A lower-case string (no spaces or other characters outside of 0-9, a-z, ".", "_" and "-") identifying the
+        operating system release code name, excluding any OS name information or release version, and suitable for
+        processing by scripts or usage in generated filenames. This field is optional and may not be implemented on all
+        systems.
+
+        Examples: "VERSION_CODENAME=buster", "VERSION_CODENAME=xenial".
+
+        Added in version 231.
+        """
+
+        return self.raw['VERSION_CODENAME']
+
+    @property
+    def build_id(self) -> str:
+        """
+        A string uniquely identifying the system image originally used as the installation base. In most cases,
+        VERSION_ID or IMAGE_ID+IMAGE_VERSION are updated when the entire system image is replaced during an update.
+        BUILD_ID may be used in distributions where the original installation image version is important: VERSION_ID
+        would change during incremental system updates, but BUILD_ID would not. This field is optional.
+
+        Examples: "BUILD_ID="2013-03-20.3"", "BUILD_ID=201303203".
+
+        Added in version 200.
+        """
+
+        return self.raw['BUILD_ID']
+
+    @property
+    def image_id(self) -> str:
+        """
+        A lower-case string (no spaces or other characters outside of 0-9, a-z, ".", "_" and "-"), identifying a
+        specific image of the operating system. This is supposed to be used for environments where OS images are
+        prepared, built, shipped and updated as comprehensive, consistent OS images. This field is optional and may not
+        be implemented on all systems, in particularly not on those that are not managed via images but put together and
+        updated from individual packages and on the local system.
+
+        Examples: "IMAGE_ID=vendorx-cashier-system", "IMAGE_ID=netbook-image".
+
+        Added in version 249.
+        """
+
+        return self.raw['IMAGE_ID']
+
+    @property
+    def image_version(self) -> str:
+        """
+        A lower-case string (mostly numeric, no spaces or other characters outside of 0-9, a-z, ".", "_" and "-")
+        identifying the OS image version. This is supposed to be used together with IMAGE_ID described above, to discern
+        different versions of the same image.
+
+        Examples: "IMAGE_VERSION=33", "IMAGE_VERSION=47.1rc1".
+
+        Added in version 249.
+        """
+
+        return self.raw['IMAGE_VERSION']
+
+    # To summarize: if the image updates are built and shipped as comprehensive units, IMAGE_ID+IMAGE_VERSION is the
+    # best fit. Otherwise, if updates eventually completely replace previously installed contents, as in a typical
+    # binary distribution, VERSION_ID should be used to identify major releases of the operating system.  BUILD_ID may
+    # be used instead or in addition to VERSION_ID when the original system image version is important.
+
+    #
+
+    # Presentation information and links
+
+    # Links to resources on the Internet related to the operating system.  HOME_URL= should refer to the homepage of the
+    # operating system, or alternatively some homepage of the specific version of the operating system.
+    # DOCUMENTATION_URL= should refer to the main documentation page for this operating system.  SUPPORT_URL= should
+    # refer to the main support page for the operating system, if there is any. This is primarily intended for operating
+    # systems which vendors provide support for.  BUG_REPORT_URL= should refer to the main bug reporting page for the
+    # operating system, if there is any. This is primarily intended for operating systems that rely on community QA.
+    # PRIVACY_POLICY_URL= should refer to the main privacy policy page for the operating system, if there is any. These
+    # settings are optional, and providing only some of these settings is common. These URLs are intended to be exposed
+    # in "About this system" UIs behind links with captions such as "About this Operating System", "Obtain Support",
+    # "Report a Bug", or "Privacy Policy". The values should be in RFC3986 format[5], and should be "http:" or "https:"
+    # URLs, and possibly "mailto:" or "tel:". Only one URL shall be listed in each setting. If multiple resources need
+    # to be referenced, it is recommended to provide an online landing page linking all available resources.
+
+    # Examples: "HOME_URL="https://fedoraproject.org/"", "BUG_REPORT_URL="https://bugzilla.redhat.com/"".
+
+    @property
+    def home_url(self) -> str:
+        return self.raw['HOME_URL']
+
+    @property
+    def documentation_url(self) -> str:
+        return self.raw['DOCUMENTATION_URL']
+
+    @property
+    def support_url(self) -> str:
+        return self.raw['SUPPORT_URL']
+
+    @property
+    def bug_report_url(self) -> str:
+        return self.raw['BUG_REPORT_URL']
+
+    @property
+    def privacy_policy_url(self) -> str:
+        return self.raw['PRIVACY_POLICY_URL']
+
+    @property
+    def support_end(self) -> str:
+        """
+        The date at which support for this version of the OS ends. (What exactly "lack of support" means varies between
+        vendors, but generally users should assume that updates, including security fixes, will not be provided.) The
+        value is a date in the ISO 8601 format "YYYY-MM-DD", and specifies the first day on which support is not
+        provided.
+
+        For example, "SUPPORT_END=2001-01-01" means that the system was supported until the end of the last day of the
+        previous millennium.
+
+        Added in version 252.
+        """
+
+        return self.raw['SUPPORT_END']
+
+    @property
+    def logo(self) -> str:
+        """
+        A string, specifying the name of an icon as defined by freedesktop.org Icon Theme Specification[6]. This can be
+        used by graphical applications to display an operating system's or distributor's logo. This field is optional
+        and may not necessarily be implemented on all systems.
+
+        Examples: "LOGO=fedora-logo", "LOGO=distributor-logo-opensuse"
+
+        Added in version 240.
+        """
+
+        return self.raw['LOGO']
+
+    @property
+    def ansi_color(self) -> str:
+        """
+        A suggested presentation color when showing the OS name on the console. This should be specified as string
+        suitable for inclusion in the ESC [ m ANSI/ECMA-48 escape code for setting graphical rendition. This field is
+        optional.
+
+        Examples: "ANSI_COLOR="0;31"" for red, "ANSI_COLOR="1;34"" for light blue, or "ANSI_COLOR="0;38;2;60;110;180""
+        for Fedora blue.
+        """
+
+        return self.raw['ANSI_COLOR']
+
+    @property
+    def vendor_name(self) -> str:
+        """
+        The name of the OS vendor. This is the name of the organization or company which produces the OS. This field is
+        optional.
+
+        This name is intended to be exposed in "About this system" UIs or software update UIs when needed to distinguish
+        the OS vendor from the OS itself. It is intended to be human readable.
+
+        Examples: "VENDOR_NAME="Fedora Project"" for Fedora Linux, "VENDOR_NAME="Canonical"" for Ubuntu.
+
+        Added in version 254.
+        """
+
+        return self.raw['VENDOR_NAME']
+
+    @property
+    def vendor_url(self) -> str:
+        """
+        The homepage of the OS vendor. This field is optional. The VENDOR_NAME= field should be set if this one is,
+        although clients must be robust against either field not being set.
+
+        The value should be in RFC3986 format[5], and should be "http:" or "https:" URLs. Only one URL shall be listed
+        in the setting.
+
+        Examples: "VENDOR_URL="https://fedoraproject.org/"", "VENDOR_URL="https://canonical.com/"".
+
+        Added in version 254.
+        """
+
+        return self.raw['VENDOR_URL']
+
+    # Distribution-level defaults and metadata
+
+    @property
+    def default_hostname(self) -> str:
+        """
+        A string specifying the hostname if hostname(5) is not present and no other configuration source specifies the
+        hostname. Must be either a single DNS label (a string composed of 7-bit ASCII lower-case characters and no
+        spaces or dots, limited to the format allowed for DNS domain name labels), or a sequence of such labels
+        separated by single dots that forms a valid DNS FQDN. The hostname must be at most 64 characters, which is a
+        Linux limitation (DNS allows longer names).
+
+        See org.freedesktop.hostname1(5) for a description of how systemd-hostnamed.service(8) determines the fallback
+        hostname.
+
+        Added in version 248.
+        """
+
+        return self.raw['DEFAULT_HOSTNAME']
+
+    @property
+    def architecture(self) -> str:
+        """
+        A string that specifies which CPU architecture the userspace binaries require. The architecture identifiers are
+        the same as for ConditionArchitecture= described in systemd.unit(5). The field is optional and should only be
+        used when just single architecture is supported. It may provide redundant information when used in a GPT
+        partition with a GUID type that already encodes the architecture. If this is not the case, the architecture
+        should be specified in e.g., an extension image, to prevent an incompatible host from loading it.
+
+        Added in version 252.
+        """
+
+        return self.raw['ARCHITECTURE']
+
+    @property
+    def sysext_level(self) -> str:
+        """
+        A lower-case string (mostly numeric, no spaces or other characters outside of 0-9, a-z, ".", "_" and "-")
+        identifying the operating system extensions support level, to indicate which extension images are supported. See
+        /usr/lib/extension-release.d/extension-release.IMAGE, initrd[2] and systemd-sysext(8)) for more information.
+
+        Examples: "SYSEXT_LEVEL=2", "SYSEXT_LEVEL=15.14".
+
+        Added in version 248.
+        """
+
+        return self.raw['SYSEXT_LEVEL']
+
+    @property
+    def confext_level(self) -> str:
+        """
+        Semantically the same as SYSEXT_LEVEL= but for confext images. See
+        /etc/extension-release.d/extension-release.IMAGE for more information.
+
+        Examples: "CONFEXT_LEVEL=2", "CONFEXT_LEVEL=15.14".
+
+        Added in version 254.
+        """
+
+        return self.raw['CONFEXT_LEVEL']
+
+    @property
+    def sysext_scope(self) -> str:
+        """
+        Takes a space-separated list of one or more of the strings "system", "initrd" and "portable". This field is only
+        supported in extension-release.d/ files and indicates what environments the system extension is applicable to:
+        i.e. to regular systems, to initrds, or to portable service images. If unspecified, "SYSEXT_SCOPE=system
+        portable" is implied, i.e. any system extension without this field is applicable to regular systems and to
+        portable service environments, but not to initrd environments.
+
+        Added in version 250.
+        """
+
+        return self.raw['SYSEXT_SCOPE']
+
+    @property
+    def confext_scope(self) -> str:
+        """
+        Semantically the same as SYSEXT_SCOPE= but for confext images.
+
+        Added in version 254.
+        """
+
+        return self.raw['CONFEXT_SCOPE']
+
+    @property
+    def portable_prefixes(self) -> str:
+        """
+        Takes a space-separated list of one or more valid prefix match strings for the Portable Services[3] logic. This
+        field serves two purposes: it is informational, identifying portable service images as such (and thus allowing
+        them to be distinguished from other OS images, such as bootable system images). It is also used when a portable
+        service image is attached: the specified or implied portable service prefix is checked against the list
+        specified here, to enforce restrictions how images may be attached to a system.
+
+        Added in version 250.
+        """
+
+        return self.raw['PORTABLE_PREFIXES']
+
+    #
+
+    DEFAULT_PATHS: ta.ClassVar[ta.Sequence[str]] = [
+        '/etc/os-release',
+        '/usr/lib/os-release',
+    ]
+
+    @classmethod
+    def read(cls, *paths: str) -> ta.Optional['LinuxOsRelease']:
+        for fp in (paths or cls.DEFAULT_PATHS):
+            if not os.path.isfile(fp):
+                continue
+            with open(fp) as f:
+                src = f.read()
+            break
+        else:
+            return None
+
+        raw = cls._parse_os_release(src)
+
+        return cls(raw)
+
+    @classmethod
+    def _parse_os_release(cls, src: str) -> ta.Mapping[str, str]:
+        dct: ta.Dict[str, str] = {}
+
+        for l in src.splitlines():
+            if not (l := l.strip()):
+                continue
+            if l.startswith('#') or '=' not in l:
+                continue
+
+            k, _, v = l.partition('=')
+            if k.startswith('"'):
+                k = k[1:-1]
+            if v.startswith('"'):
+                v = v[1:-1]
+
+            dct[k] = v
+
+        return dct
+
+
 ########################################
 # ../../../omdev/packaging/specifiers.py
 # Copyright (c) Donald Stufft and individual contributors.
@@ -2610,43 +3107,264 @@ def build_command_name_map(crs: CommandRegistrations) -> CommandNameMap:
 
 
 ########################################
-# ../remote/config.py
+# ../deploy/paths.py
+"""
+~deploy
+  deploy.pid (flock)
+  /app
+    /<appspec> - shallow clone
+  /conf
+    /env
+      <appspec>.env
+    /nginx
+      <appspec>.conf
+    /supervisor
+      <appspec>.conf
+  /venv
+    /<appspec>
+
+?
+  /logs
+    /wrmsr--omlish--<spec>
+
+spec = <name>--<rev>--<when>
+
+==
+
+for dn in [
+    'app',
+    'conf',
+    'conf/env',
+    'conf/nginx',
+    'conf/supervisor',
+    'venv',
+]:
+
+==
 
+"""
 
-@dc.dataclass(frozen=True)
-class RemoteConfig:
-    payload_file: ta.Optional[str] = None
 
-    set_pgid: bool = True
+##
 
-    deathsig: ta.Optional[str] = 'KILL'
 
-    pycharm_remote_debug: ta.Optional[PycharmRemoteDebug] = None
+DEPLOY_PATH_SPEC_PLACEHOLDER = '@'
+DEPLOY_PATH_SPEC_SEPARATORS = '-.'
 
-    forward_logging: bool = True
+DEPLOY_PATH_SPECS: ta.FrozenSet[str] = frozenset([
+    'app',
+    'tag',  # <rev>-<dt>
+])
 
-    timebomb_delay_s: ta.Optional[float] = 60 * 60.
 
-    heartbeat_interval_s: float = 3.
+class DeployPathError(Exception):
+    pass
 
-    use_in_process_remote_executor: bool = False
 
+@dc.dataclass(frozen=True)
+class DeployPathPart(abc.ABC):  # noqa
+    @property
+    @abc.abstractmethod
+    def kind(self) -> DeployPathKind:
+        raise NotImplementedError
 
-########################################
-# ../remote/payload.py
+    @abc.abstractmethod
+    def render(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        raise NotImplementedError
 
 
-RemoteExecutionPayloadFile = ta.NewType('RemoteExecutionPayloadFile', str)
+#
 
 
-@cached_nullary
-def _get_self_src() -> str:
-    return inspect.getsource(sys.modules[__name__])
+class DirDeployPathPart(DeployPathPart, abc.ABC):
+    @property
+    def kind(self) -> DeployPathKind:
+        return 'dir'
 
+    @classmethod
+    def parse(cls, s: str) -> 'DirDeployPathPart':
+        if DEPLOY_PATH_SPEC_PLACEHOLDER in s:
+            check.equal(s[0], DEPLOY_PATH_SPEC_PLACEHOLDER)
+            return SpecDirDeployPathPart(s[1:])
+        else:
+            return ConstDirDeployPathPart(s)
 
-def _is_src_amalg(src: str) -> bool:
-    for l in src.splitlines():  # noqa
-        if l.startswith('# @omlish-amalg-output '):
+
+class FileDeployPathPart(DeployPathPart, abc.ABC):
+    @property
+    def kind(self) -> DeployPathKind:
+        return 'file'
+
+    @classmethod
+    def parse(cls, s: str) -> 'FileDeployPathPart':
+        if DEPLOY_PATH_SPEC_PLACEHOLDER in s:
+            check.equal(s[0], DEPLOY_PATH_SPEC_PLACEHOLDER)
+            if not any(c in s for c in DEPLOY_PATH_SPEC_SEPARATORS):
+                return SpecFileDeployPathPart(s[1:], '')
+            else:
+                p = min(f for c in DEPLOY_PATH_SPEC_SEPARATORS if (f := s.find(c)) > 0)
+                return SpecFileDeployPathPart(s[1:p], s[p:])
+        else:
+            return ConstFileDeployPathPart(s)
+
+
+#
+
+
+@dc.dataclass(frozen=True)
+class ConstDeployPathPart(DeployPathPart, abc.ABC):
+    name: str
+
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.name)
+        check.not_in('/', self.name)
+        check.not_in(DEPLOY_PATH_SPEC_PLACEHOLDER, self.name)
+
+    def render(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        return self.name
+
+
+class ConstDirDeployPathPart(ConstDeployPathPart, DirDeployPathPart):
+    pass
+
+
+class ConstFileDeployPathPart(ConstDeployPathPart, FileDeployPathPart):
+    pass
+
+
+#
+
+
+@dc.dataclass(frozen=True)
+class SpecDeployPathPart(DeployPathPart, abc.ABC):
+    spec: str  # DeployPathSpec
+
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.spec)
+        for c in [*DEPLOY_PATH_SPEC_SEPARATORS, DEPLOY_PATH_SPEC_PLACEHOLDER, '/']:
+            check.not_in(c, self.spec)
+        check.in_(self.spec, DEPLOY_PATH_SPECS)
+
+    def _render_spec(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        if specs is not None:
+            return specs[self.spec]  # type: ignore
+        else:
+            return DEPLOY_PATH_SPEC_PLACEHOLDER + self.spec
+
+
+@dc.dataclass(frozen=True)
+class SpecDirDeployPathPart(SpecDeployPathPart, DirDeployPathPart):
+    def render(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        return self._render_spec(specs)
+
+
+@dc.dataclass(frozen=True)
+class SpecFileDeployPathPart(SpecDeployPathPart, FileDeployPathPart):
+    suffix: str
+
+    def __post_init__(self) -> None:
+        super().__post_init__()
+        if self.suffix:
+            for c in [DEPLOY_PATH_SPEC_PLACEHOLDER, '/']:
+                check.not_in(c, self.suffix)
+
+    def render(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        return self._render_spec(specs) + self.suffix
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DeployPath:
+    parts: ta.Sequence[DeployPathPart]
+
+    def __post_init__(self) -> None:
+        check.not_empty(self.parts)
+        for p in self.parts[:-1]:
+            check.equal(p.kind, 'dir')
+
+        pd = {}
+        for i, p in enumerate(self.parts):
+            if isinstance(p, SpecDeployPathPart):
+                if p.spec in pd:
+                    raise DeployPathError('Duplicate specs in path', self)
+                pd[p.spec] = i
+
+        if 'tag' in pd:
+            if 'app' not in pd or pd['app'] >= pd['tag']:
+                raise DeployPathError('Tag spec in path without preceding app', self)
+
+    @property
+    def kind(self) -> ta.Literal['file', 'dir']:
+        return self.parts[-1].kind
+
+    def render(self, specs: ta.Optional[ta.Mapping[DeployPathSpec, str]] = None) -> str:
+        return os.path.join(  # noqa
+            *[p.render(specs) for p in self.parts],
+            *([''] if self.kind == 'dir' else []),
+        )
+
+    @classmethod
+    def parse(cls, s: str) -> 'DeployPath':
+        tail_parse: ta.Callable[[str], DeployPathPart]
+        if s.endswith('/'):
+            tail_parse = DirDeployPathPart.parse
+            s = s[:-1]
+        else:
+            tail_parse = FileDeployPathPart.parse
+        ps = check.non_empty_str(s).split('/')
+        return cls([
+            *([DirDeployPathPart.parse(p) for p in ps[:-1]] if len(ps) > 1 else []),
+            tail_parse(ps[-1]),
+        ])
+
+
+##
+
+
+class DeployPathOwner(abc.ABC):
+    @abc.abstractmethod
+    def get_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        raise NotImplementedError
+
+
+########################################
+# ../remote/config.py
+
+
+@dc.dataclass(frozen=True)
+class RemoteConfig:
+    payload_file: ta.Optional[str] = None
+
+    set_pgid: bool = True
+
+    deathsig: ta.Optional[str] = 'KILL'
+
+    pycharm_remote_debug: ta.Optional[PycharmRemoteDebug] = None
+
+    forward_logging: bool = True
+
+    timebomb_delay_s: ta.Optional[float] = 60 * 60.
+
+    heartbeat_interval_s: float = 3.
+
+
+########################################
+# ../remote/payload.py
+
+
+RemoteExecutionPayloadFile = ta.NewType('RemoteExecutionPayloadFile', str)
+
+
+@cached_nullary
+def _get_self_src() -> str:
+    return inspect.getsource(sys.modules[__name__])
+
+
+def _is_src_amalg(src: str) -> bool:
+    for l in src.splitlines():  # noqa
+        if l.startswith('# @omlish-amalg-output '):
             return True
     return False
 
@@ -2671,6 +3389,90 @@ def get_remote_payload_src(
     return importlib.resources.files(__package__.split('.')[0] + '.scripts').joinpath('manage.py').read_text()
 
 
+########################################
+# ../targets/targets.py
+"""
+It's desugaring. Subprocess and locals are only leafs. Retain an origin?
+** TWO LAYERS ** - ManageTarget is user-facing, ConnectorTarget is bound, internal
+"""
+
+
+##
+
+
+class ManageTarget(abc.ABC):  # noqa
+    def __init_subclass__(cls, **kwargs: ta.Any) -> None:
+        super().__init_subclass__(**kwargs)
+
+        check.state(cls.__name__.endswith('ManageTarget'))
+
+
+#
+
+
+@dc.dataclass(frozen=True)
+class PythonRemoteManageTarget:
+    DEFAULT_PYTHON: ta.ClassVar[str] = 'python3'
+    python: str = DEFAULT_PYTHON
+
+
+#
+
+
+class RemoteManageTarget(ManageTarget, abc.ABC):
+    pass
+
+
+class PhysicallyRemoteManageTarget(RemoteManageTarget, abc.ABC):
+    pass
+
+
+class LocalManageTarget(ManageTarget, abc.ABC):
+    pass
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class SshManageTarget(PhysicallyRemoteManageTarget, PythonRemoteManageTarget):
+    host: ta.Optional[str] = None
+    username: ta.Optional[str] = None
+    key_file: ta.Optional[str] = None
+
+    def __post_init__(self) -> None:
+        check.non_empty_str(self.host)
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class DockerManageTarget(RemoteManageTarget, PythonRemoteManageTarget):  # noqa
+    image: ta.Optional[str] = None
+    container_id: ta.Optional[str] = None
+
+    def __post_init__(self) -> None:
+        check.arg(bool(self.image) ^ bool(self.container_id))
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class InProcessManageTarget(LocalManageTarget):
+    class Mode(enum.Enum):
+        DIRECT = enum.auto()
+        FAKE_REMOTE = enum.auto()
+
+    mode: Mode = Mode.DIRECT
+
+
+@dc.dataclass(frozen=True)
+class SubprocessManageTarget(LocalManageTarget, PythonRemoteManageTarget):
+    pass
+
+
 ########################################
 # ../../../omlish/argparse/cli.py
 """
@@ -2943,6 +3745,78 @@ class ArgparseCli:
         return await fn()
 
 
+########################################
+# ../../../omlish/lite/contextmanagers.py
+
+
+##
+
+
+class ExitStacked:
+    _exit_stack: ta.Optional[contextlib.ExitStack] = None
+
+    def __enter__(self: ExitStackedT) -> ExitStackedT:
+        check.state(self._exit_stack is None)
+        es = self._exit_stack = contextlib.ExitStack()
+        es.__enter__()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        if (es := self._exit_stack) is None:
+            return None
+        self._exit_contexts()
+        return es.__exit__(exc_type, exc_val, exc_tb)
+
+    def _exit_contexts(self) -> None:
+        pass
+
+    def _enter_context(self, cm: ta.ContextManager[T]) -> T:
+        es = check.not_none(self._exit_stack)
+        return es.enter_context(cm)
+
+
+##
+
+
+@contextlib.contextmanager
+def defer(fn: ta.Callable) -> ta.Generator[ta.Callable, None, None]:
+    try:
+        yield fn
+    finally:
+        fn()
+
+
+@contextlib.contextmanager
+def attr_setting(obj, attr, val, *, default=None):  # noqa
+    not_set = object()
+    orig = getattr(obj, attr, not_set)
+    try:
+        setattr(obj, attr, val)
+        if orig is not not_set:
+            yield orig
+        else:
+            yield default
+    finally:
+        if orig is not_set:
+            delattr(obj, attr)
+        else:
+            setattr(obj, attr, orig)
+
+
+##
+
+
+class aclosing(contextlib.AbstractAsyncContextManager):  # noqa
+    def __init__(self, thing):
+        self.thing = thing
+
+    async def __aenter__(self):
+        return self.thing
+
+    async def __aexit__(self, *exc_info):
+        await self.thing.aclose()
+
+
 ########################################
 # ../../../omlish/lite/inject.py
 
@@ -4111,7 +4985,8 @@ def configure_standard_logging(
 """
 TODO:
  - pickle stdlib objs? have to pin to 3.8 pickle protocol, will be cross-version
- - nonstrict toggle
+ - namedtuple
+ - literals
 """
 
 
@@ -4401,14 +5276,18 @@ class ObjMarshalerManager:
     ) -> ObjMarshaler:
         if isinstance(ty, type):
             if abc.ABC in ty.__bases__:
-                return PolymorphicObjMarshaler.of([  # type: ignore
+                impls = [ity for ity in deep_subclasses(ty) if abc.ABC not in ity.__bases__]  # type: ignore
+                if all(ity.__qualname__.endswith(ty.__name__) for ity in impls):
+                    ins = {ity: snake_case(ity.__qualname__[:-len(ty.__name__)]) for ity in impls}
+                else:
+                    ins = {ity: ity.__qualname__ for ity in impls}
+                return PolymorphicObjMarshaler.of([
                     PolymorphicObjMarshaler.Impl(
                         ity,
-                        ity.__qualname__,
+                        itn,
                         rec(ity),
                     )
-                    for ity in deep_subclasses(ty)
-                    if abc.ABC not in ity.__bases__
+                    for ity, itn in ins.items()
                 ])
 
             if issubclass(ty, enum.Enum):
@@ -4655,41 +5534,6 @@ class Interp:
     version: InterpVersion
 
 
-########################################
-# ../bootstrap.py
-
-
-@dc.dataclass(frozen=True)
-class MainBootstrap:
-    main_config: MainConfig = MainConfig()
-
-    remote_config: RemoteConfig = RemoteConfig()
-
-    system_config: SystemConfig = SystemConfig()
-
-
-########################################
-# ../commands/execution.py
-
-
-CommandExecutorMap = ta.NewType('CommandExecutorMap', ta.Mapping[ta.Type[Command], CommandExecutor])
-
-
-class LocalCommandExecutor(CommandExecutor):
-    def __init__(
-            self,
-            *,
-            command_executors: CommandExecutorMap,
-    ) -> None:
-        super().__init__()
-
-        self._command_executors = command_executors
-
-    async def execute(self, cmd: Command) -> Command.Output:
-        ce: CommandExecutor = self._command_executors[type(cmd)]
-        return await ce.execute(cmd)
-
-
 ########################################
 # ../commands/marshal.py
 
@@ -4715,6 +5559,34 @@ def install_command_marshaling(
         )
 
 
+########################################
+# ../commands/ping.py
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class PingCommand(Command['PingCommand.Output']):
+    time: float = dc.field(default_factory=time.time)
+
+    @dc.dataclass(frozen=True)
+    class Output(Command.Output):
+        time: float
+
+
+class PingCommandExecutor(CommandExecutor[PingCommand, PingCommand.Output]):
+    async def execute(self, cmd: PingCommand) -> PingCommand.Output:
+        return PingCommand.Output(cmd.time)
+
+
+########################################
+# ../commands/types.py
+
+
+CommandExecutorMap = ta.NewType('CommandExecutorMap', ta.Mapping[ta.Type[Command], CommandExecutor])
+
+
 ########################################
 # ../deploy/commands.py
 
@@ -4828,24 +5700,72 @@ class RemoteChannelImpl(RemoteChannel):
 
 
 ########################################
-# ../system/commands.py
+# ../system/platforms.py
 
 
 ##
 
 
 @dc.dataclass(frozen=True)
-class CheckSystemPackageCommand(Command['CheckSystemPackageCommand.Output']):
-    @dc.dataclass(frozen=True)
-    class Output(Command.Output):
-        pass
+class Platform(abc.ABC):  # noqa
+    pass
 
 
-class CheckSystemPackageCommandExecutor(CommandExecutor[CheckSystemPackageCommand, CheckSystemPackageCommand.Output]):
-    async def execute(self, cmd: CheckSystemPackageCommand) -> CheckSystemPackageCommand.Output:
-        log.info('Checking system package!')
+class LinuxPlatform(Platform, abc.ABC):
+    pass
+
+
+class UbuntuPlatform(LinuxPlatform):
+    pass
+
+
+class AmazonLinuxPlatform(LinuxPlatform):
+    pass
+
+
+class GenericLinuxPlatform(LinuxPlatform):
+    pass
+
+
+class DarwinPlatform(Platform):
+    pass
+
+
+class UnknownPlatform(Platform):
+    pass
+
+
+##
+
+
+def _detect_system_platform() -> Platform:
+    plat = sys.platform
+
+    if plat == 'linux':
+        if (osr := LinuxOsRelease.read()) is None:
+            return GenericLinuxPlatform()
+
+        if osr.id == 'amzn':
+            return AmazonLinuxPlatform()
+
+        elif osr.id == 'ubuntu':
+            return UbuntuPlatform()
+
+        else:
+            return GenericLinuxPlatform()
 
-        return CheckSystemPackageCommand.Output()
+    elif plat == 'darwin':
+        return DarwinPlatform()
+
+    else:
+        return UnknownPlatform()
+
+
+@cached_nullary
+def detect_system_platform() -> Platform:
+    platform = _detect_system_platform()
+    log.info('Detected platform: %r', platform)
+    return platform
 
 
 ########################################
@@ -5032,6 +5952,25 @@ def subprocess_close(
     proc.wait(timeout)
 
 
+########################################
+# ../commands/local.py
+
+
+class LocalCommandExecutor(CommandExecutor):
+    def __init__(
+            self,
+            *,
+            command_executors: CommandExecutorMap,
+    ) -> None:
+        super().__init__()
+
+        self._command_executors = command_executors
+
+    async def execute(self, cmd: Command) -> Command.Output:
+        ce: CommandExecutor = self._command_executors[type(cmd)]
+        return await ce.execute(cmd)
+
+
 ########################################
 # ../remote/execution.py
 """
@@ -5409,7 +6348,7 @@ class RemoteCommandExecutor(CommandExecutor):
             self,
             cmd: Command,
             *,
-            log: ta.Optional[logging.Logger] = None,
+            log: ta.Optional[logging.Logger] = None,  # noqa
             omit_exc_object: bool = False,
     ) -> CommandOutputOrException:
         try:
@@ -5429,6 +6368,15 @@ class RemoteCommandExecutor(CommandExecutor):
             return r
 
 
+########################################
+# ../system/config.py
+
+
+@dc.dataclass(frozen=True)
+class SystemConfig:
+    platform: ta.Optional[Platform] = None
+
+
 ########################################
 # ../../../omlish/lite/asyncio/subprocesses.py
 
@@ -5591,6 +6539,13 @@ async def asyncio_subprocess_communicate(
     return await AsyncioProcessCommunicator(proc).communicate(input, timeout)  # noqa
 
 
+@dc.dataclass(frozen=True)
+class AsyncioSubprocessOutput:
+    proc: asyncio.subprocess.Process
+    stdout: ta.Optional[bytes]
+    stderr: ta.Optional[bytes]
+
+
 async def asyncio_subprocess_run(
         *args: str,
         input: ta.Any = None,  # noqa
@@ -5598,7 +6553,7 @@ async def asyncio_subprocess_run(
         check: bool = False,  # noqa
         capture_output: ta.Optional[bool] = None,
         **kwargs: ta.Any,
-) -> ta.Tuple[ta.Optional[bytes], ta.Optional[bytes]]:
+) -> AsyncioSubprocessOutput:
     if capture_output:
         kwargs.setdefault('stdout', subprocess.PIPE)
         kwargs.setdefault('stderr', subprocess.PIPE)
@@ -5617,7 +6572,11 @@ async def asyncio_subprocess_run(
             stderr=stderr,
         )
 
-    return stdout, stderr
+    return AsyncioSubprocessOutput(
+        proc,
+        stdout,
+        stderr,
+    )
 
 
 ##
@@ -5630,7 +6589,7 @@ async def asyncio_subprocess_check_call(
         timeout: ta.Optional[float] = None,
         **kwargs: ta.Any,
 ) -> None:
-    _, _ = await asyncio_subprocess_run(
+    await asyncio_subprocess_run(
         *args,
         stdout=stdout,
         input=input,
@@ -5646,7 +6605,7 @@ async def asyncio_subprocess_check_output(
         timeout: ta.Optional[float] = None,
         **kwargs: ta.Any,
 ) -> bytes:
-    stdout, stderr = await asyncio_subprocess_run(
+    out = await asyncio_subprocess_run(
         *args,
         stdout=asyncio.subprocess.PIPE,
         input=input,
@@ -5655,7 +6614,7 @@ async def asyncio_subprocess_check_output(
         **kwargs,
     )
 
-    return check.not_none(stdout)
+    return check.not_none(out.stdout)
 
 
 async def asyncio_subprocess_check_output_str(*args: str, **kwargs: ta.Any) -> str:
@@ -5811,6 +6770,21 @@ class InterpInspector:
 INTERP_INSPECTOR = InterpInspector()
 
 
+########################################
+# ../bootstrap.py
+
+
+@dc.dataclass(frozen=True)
+class MainBootstrap:
+    main_config: MainConfig = MainConfig()
+
+    deploy_config: DeployConfig = DeployConfig()
+
+    remote_config: RemoteConfig = RemoteConfig()
+
+    system_config: SystemConfig = SystemConfig()
+
+
 ########################################
 # ../commands/subprocess.py
 
@@ -5882,146 +6856,190 @@ class SubprocessCommandExecutor(CommandExecutor[SubprocessCommand, SubprocessCom
 
 
 ########################################
-# ../remote/_main.py
+# ../deploy/git.py
+"""
+TODO:
+ - 'repos'?
+
+git/github.com/wrmsr/omlish <- bootstrap repo
+ - shallow clone off bootstrap into /apps
+
+github.com/wrmsr/omlish@rev
+"""
 
 
 ##
 
 
-class _RemoteExecutionLogHandler(logging.Handler):
-    def __init__(self, fn: ta.Callable[[str], None]) -> None:
-        super().__init__()
-        self._fn = fn
+@dc.dataclass(frozen=True)
+class DeployGitRepo:
+    host: ta.Optional[str] = None
+    username: ta.Optional[str] = None
+    path: ta.Optional[str] = None
 
-    def emit(self, record):
-        msg = self.format(record)
-        self._fn(msg)
+    def __post_init__(self) -> None:
+        check.not_in('..', check.non_empty_str(self.host))
+        check.not_in('.', check.non_empty_str(self.path))
+
+
+@dc.dataclass(frozen=True)
+class DeployGitSpec:
+    repo: DeployGitRepo
+    rev: DeployRev
 
 
 ##
 
 
-class _RemoteExecutionMain:
+class DeployGitManager(DeployPathOwner):
     def __init__(
             self,
-            chan: RemoteChannel,
+            *,
+            deploy_home: DeployHome,
     ) -> None:
         super().__init__()
 
-        self._chan = chan
-
-        self.__bootstrap: ta.Optional[MainBootstrap] = None
-        self.__injector: ta.Optional[Injector] = None
-
-    @property
-    def _bootstrap(self) -> MainBootstrap:
-        return check.not_none(self.__bootstrap)
-
-    @property
-    def _injector(self) -> Injector:
-        return check.not_none(self.__injector)
+        self._deploy_home = deploy_home
+        self._dir = os.path.join(deploy_home, 'git')
 
-    #
+        self._repo_dirs: ta.Dict[DeployGitRepo, DeployGitManager.RepoDir] = {}
 
-    def _timebomb_main(
-            self,
-            delay_s: float,
-            *,
-            sig: int = signal.SIGINT,
-            code: int = 1,
-    ) -> None:
-        time.sleep(delay_s)
+    def get_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        return {
+            DeployPath.parse('git'),
+        }
 
-        if (pgid := os.getpgid(0)) == os.getpid():
-            os.killpg(pgid, sig)
+    class RepoDir:
+        def __init__(
+                self,
+                git: 'DeployGitManager',
+                repo: DeployGitRepo,
+        ) -> None:
+            super().__init__()
 
-        os._exit(code)  # noqa
+            self._git = git
+            self._repo = repo
+            self._dir = os.path.join(
+                self._git._dir,  # noqa
+                check.non_empty_str(repo.host),
+                check.non_empty_str(repo.path),
+            )
 
-    @cached_nullary
-    def _timebomb_thread(self) -> ta.Optional[threading.Thread]:
-        if (tbd := self._bootstrap.remote_config.timebomb_delay_s) is None:
-            return None
+        @property
+        def repo(self) -> DeployGitRepo:
+            return self._repo
 
-        thr = threading.Thread(
-            target=functools.partial(self._timebomb_main, tbd),
-            name=f'{self.__class__.__name__}.timebomb',
-            daemon=True,
-        )
+        @property
+        def url(self) -> str:
+            if self._repo.username is not None:
+                return f'{self._repo.username}@{self._repo.host}:{self._repo.path}'
+            else:
+                return f'https://{self._repo.host}/{self._repo.path}'
 
-        thr.start()
+        async def _call(self, *cmd: str) -> None:
+            await asyncio_subprocess_check_call(
+                *cmd,
+                cwd=self._dir,
+            )
 
-        log.debug('Started timebomb thread: %r', thr)
+        @async_cached_nullary
+        async def init(self) -> None:
+            os.makedirs(self._dir, exist_ok=True)
+            if os.path.exists(os.path.join(self._dir, '.git')):
+                return
 
-        return thr
+            await self._call('git', 'init')
+            await self._call('git', 'remote', 'add', 'origin', self.url)
 
-    #
+        async def fetch(self, rev: DeployRev) -> None:
+            await self.init()
+            await self._call('git', 'fetch', '--depth=1', 'origin', rev)
 
-    @cached_nullary
-    def _log_handler(self) -> _RemoteLogHandler:
-        return _RemoteLogHandler(self._chan)
+        async def checkout(self, rev: DeployRev, dst_dir: str) -> None:
+            check.state(not os.path.exists(dst_dir))
 
-    #
+            await self.fetch(rev)
 
-    async def _setup(self) -> None:
-        check.none(self.__bootstrap)
-        check.none(self.__injector)
+            # FIXME: temp dir swap
+            os.makedirs(dst_dir)
 
-        # Bootstrap
+            dst_call = functools.partial(asyncio_subprocess_check_call, cwd=dst_dir)
+            await dst_call('git', 'init')
 
-        self.__bootstrap = check.not_none(await self._chan.recv_obj(MainBootstrap))
+            await dst_call('git', 'remote', 'add', 'local', self._dir)
+            await dst_call('git', 'fetch', '--depth=1', 'local', rev)
+            await dst_call('git', 'checkout', rev)
 
-        if (prd := self._bootstrap.remote_config.pycharm_remote_debug) is not None:
-            pycharm_debug_connect(prd)
+    def get_repo_dir(self, repo: DeployGitRepo) -> RepoDir:
+        try:
+            return self._repo_dirs[repo]
+        except KeyError:
+            repo_dir = self._repo_dirs[repo] = DeployGitManager.RepoDir(self, repo)
+            return repo_dir
 
-        self.__injector = main_bootstrap(self._bootstrap)
+    async def checkout(self, spec: DeployGitSpec, dst_dir: str) -> None:
+        await self.get_repo_dir(spec.repo).checkout(spec.rev, dst_dir)
 
-        self._chan.set_marshaler(self._injector[ObjMarshalerManager])
 
-        # Post-bootstrap
+########################################
+# ../deploy/venvs.py
+"""
+TODO:
+ - interp
+ - share more code with pyproject?
+"""
 
-        if self._bootstrap.remote_config.set_pgid:
-            if os.getpgid(0) != os.getpid():
-                log.debug('Setting pgid')
-                os.setpgid(0, 0)
 
-        if (ds := self._bootstrap.remote_config.deathsig) is not None:
-            log.debug('Setting deathsig: %s', ds)
-            set_process_deathsig(int(signal.Signals[f'SIG{ds.upper()}']))
+class DeployVenvManager(DeployPathOwner):
+    def __init__(
+            self,
+            *,
+            deploy_home: DeployHome,
+    ) -> None:
+        super().__init__()
 
-        self._timebomb_thread()
+        self._deploy_home = deploy_home
+        self._dir = os.path.join(deploy_home, 'venvs')
 
-        if self._bootstrap.remote_config.forward_logging:
-            log.debug('Installing log forwarder')
-            logging.root.addHandler(self._log_handler())
+    def get_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        return {
+            DeployPath.parse('venvs/@app/@tag/'),
+        }
 
-    #
+    async def setup_venv(
+            self,
+            app_dir: str,
+            venv_dir: str,
+            *,
+            use_uv: bool = True,
+    ) -> None:
+        sys_exe = 'python3'
 
-    async def run(self) -> None:
-        await self._setup()
+        await asyncio_subprocess_check_call(sys_exe, '-m', 'venv', venv_dir)
 
-        executor = self._injector[LocalCommandExecutor]
+        #
 
-        handler = _RemoteCommandHandler(self._chan, executor)
+        venv_exe = os.path.join(venv_dir, 'bin', 'python3')
 
-        await handler.run()
+        #
 
+        reqs_txt = os.path.join(app_dir, 'requirements.txt')
 
-def _remote_execution_main() -> None:
-    rt = pyremote_bootstrap_finalize()  # noqa
+        if os.path.isfile(reqs_txt):
+            if use_uv:
+                await asyncio_subprocess_check_call(venv_exe, '-m', 'pip', 'install', 'uv')
+                pip_cmd = ['-m', 'uv', 'pip']
+            else:
+                pip_cmd = ['-m', 'pip']
 
-    async def inner() -> None:
-        input = await asyncio_open_stream_reader(rt.input)  # noqa
-        output = await asyncio_open_stream_writer(rt.output)
+            await asyncio_subprocess_check_call(venv_exe, *pip_cmd,'install', '-r', reqs_txt)
 
-        chan = RemoteChannelImpl(
-            input,
-            output,
+    async def setup_app_venv(self, app_tag: DeployAppTag) -> None:
+        await self.setup_venv(
+            os.path.join(self._deploy_home, 'apps', app_tag.app, app_tag.tag),
+            os.path.join(self._deploy_home, 'venvs', app_tag.app, app_tag.tag),
         )
 
-        await _RemoteExecutionMain(chan).run()
-
-    asyncio.run(inner())
-
 
 ########################################
 # ../remote/spawning.py
@@ -6196,25 +7214,24 @@ class AptSystemPackageManager(SystemPackageManager):
     }
 
     async def update(self) -> None:
-        await asyncio_subprocess_check_call('apt', 'update', env={**os.environ, **self._APT_ENV})
+        await asyncio_subprocess_check_call('sudo', 'apt', 'update', env={**os.environ, **self._APT_ENV})
 
     async def upgrade(self) -> None:
-        await asyncio_subprocess_check_call('apt', 'upgrade', '-y', env={**os.environ, **self._APT_ENV})
+        await asyncio_subprocess_check_call('sudo', 'apt', 'upgrade', '-y', env={**os.environ, **self._APT_ENV})
 
     async def install(self, *packages: SystemPackageOrStr) -> None:
         pns = [p.name if isinstance(p, SystemPackage) else p for p in packages]  # FIXME: versions
-        await asyncio_subprocess_check_call('apt', 'install', '-y', *pns, env={**os.environ, **self._APT_ENV})
+        await asyncio_subprocess_check_call('sudo', 'apt', 'install', '-y', *pns, env={**os.environ, **self._APT_ENV})
 
     async def query(self, *packages: SystemPackageOrStr) -> ta.Mapping[str, SystemPackage]:
         pns = [p.name if isinstance(p, SystemPackage) else p for p in packages]
-        cmd = ['dpkg-query', '-W', '-f=${Package}=${Version}\n', *pns]
-        stdout, stderr = await asyncio_subprocess_run(
-            *cmd,
+        out = await asyncio_subprocess_run(
+            'dpkg-query', '-W', '-f=${Package}=${Version}\n', *pns,
             capture_output=True,
             check=False,
         )
         d: ta.Dict[str, SystemPackage] = {}
-        for l in check.not_none(stdout).decode('utf-8').strip().splitlines():
+        for l in check.not_none(out.stdout).decode('utf-8').strip().splitlines():
             n, v = l.split('=', 1)
             d[n] = SystemPackage(
                 name=n,
@@ -6223,6 +7240,33 @@ class AptSystemPackageManager(SystemPackageManager):
         return d
 
 
+class YumSystemPackageManager(SystemPackageManager):
+    async def update(self) -> None:
+        await asyncio_subprocess_check_call('sudo', 'yum', 'check-update')
+
+    async def upgrade(self) -> None:
+        await asyncio_subprocess_check_call('sudo', 'yum', 'update')
+
+    async def install(self, *packages: SystemPackageOrStr) -> None:
+        pns = [p.name if isinstance(p, SystemPackage) else p for p in packages]  # FIXME: versions
+        await asyncio_subprocess_check_call('sudo', 'yum', 'install', *pns)
+
+    async def query(self, *packages: SystemPackageOrStr) -> ta.Mapping[str, SystemPackage]:
+        pns = [p.name if isinstance(p, SystemPackage) else p for p in packages]
+        d: ta.Dict[str, SystemPackage] = {}
+        for pn in pns:
+            out = await asyncio_subprocess_run(
+                'rpm', '-q', pn,
+                capture_output=True,
+            )
+            if not out.proc.returncode:
+                d[pn] = SystemPackage(
+                    pn,
+                    check.not_none(out.stdout).decode().strip(),
+                )
+        return d
+
+
 ########################################
 # ../../../omdev/interp/providers.py
 """
@@ -6285,139 +7329,342 @@ class RunningInterpProvider(InterpProvider):
 
 
 ########################################
-# ../remote/connection.py
+# ../commands/inject.py
 
 
 ##
 
 
-class RemoteExecutionConnector(abc.ABC):
-    @abc.abstractmethod
-    def connect(
-            self,
-            tgt: RemoteSpawning.Target,
-            bs: MainBootstrap,
-    ) -> ta.AsyncContextManager[RemoteCommandExecutor]:
-        raise NotImplementedError
+def bind_command(
+        command_cls: ta.Type[Command],
+        executor_cls: ta.Optional[ta.Type[CommandExecutor]],
+) -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind(CommandRegistration(command_cls), array=True),
+    ]
+
+    if executor_cls is not None:
+        lst.extend([
+            inj.bind(executor_cls, singleton=True),
+            inj.bind(CommandExecutorRegistration(command_cls, executor_cls), array=True),
+        ])
+
+    return inj.as_bindings(*lst)
 
 
 ##
 
 
-class PyremoteRemoteExecutionConnector(RemoteExecutionConnector):
-    def __init__(
-            self,
-            *,
-            spawning: RemoteSpawning,
-            msh: ObjMarshalerManager,
-            payload_file: ta.Optional[RemoteExecutionPayloadFile] = None,
-    ) -> None:
-        super().__init__()
+@dc.dataclass(frozen=True)
+class _FactoryCommandExecutor(CommandExecutor):
+    factory: ta.Callable[[], CommandExecutor]
 
-        self._spawning = spawning
-        self._msh = msh
-        self._payload_file = payload_file
+    def execute(self, i: Command) -> ta.Awaitable[Command.Output]:
+        return self.factory().execute(i)
+
+
+##
+
+
+def bind_commands(
+        *,
+        main_config: MainConfig,
+) -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind_array(CommandRegistration),
+        inj.bind_array_type(CommandRegistration, CommandRegistrations),
+
+        inj.bind_array(CommandExecutorRegistration),
+        inj.bind_array_type(CommandExecutorRegistration, CommandExecutorRegistrations),
+
+        inj.bind(build_command_name_map, singleton=True),
+    ]
 
     #
 
-    @cached_nullary
-    def _payload_src(self) -> str:
-        return get_remote_payload_src(file=self._payload_file)
+    def provide_obj_marshaler_installer(cmds: CommandNameMap) -> ObjMarshalerInstaller:
+        return ObjMarshalerInstaller(functools.partial(install_command_marshaling, cmds))
 
-    @cached_nullary
-    def _remote_src(self) -> ta.Sequence[str]:
-        return [
-            self._payload_src(),
-            '_remote_execution_main()',
-        ]
+    lst.append(inj.bind(provide_obj_marshaler_installer, array=True))
 
-    @cached_nullary
-    def _spawn_src(self) -> str:
-        return pyremote_build_bootstrap_cmd(__package__ or 'manage')
+    #
+
+    def provide_command_executor_map(
+            injector: Injector,
+            crs: CommandExecutorRegistrations,
+    ) -> CommandExecutorMap:
+        dct: ta.Dict[ta.Type[Command], CommandExecutor] = {}
+
+        cr: CommandExecutorRegistration
+        for cr in crs:
+            if cr.command_cls in dct:
+                raise KeyError(cr.command_cls)
+
+            factory = functools.partial(injector.provide, cr.executor_cls)
+            if main_config.debug:
+                ce = factory()
+            else:
+                ce = _FactoryCommandExecutor(factory)
+
+            dct[cr.command_cls] = ce
+
+        return CommandExecutorMap(dct)
+
+    lst.extend([
+        inj.bind(provide_command_executor_map, singleton=True),
+
+        inj.bind(LocalCommandExecutor, singleton=True, eager=main_config.debug),
+    ])
 
     #
 
-    @contextlib.asynccontextmanager
-    async def connect(
+    lst.extend([
+        bind_command(PingCommand, PingCommandExecutor),
+        bind_command(SubprocessCommand, SubprocessCommandExecutor),
+    ])
+
+    #
+
+    return inj.as_bindings(*lst)
+
+
+########################################
+# ../deploy/apps.py
+
+
+def make_deploy_tag(
+        rev: DeployRev,
+        now: ta.Optional[datetime.datetime] = None,
+) -> DeployTag:
+    if now is None:
+        now = datetime.datetime.utcnow()  # noqa
+    now_fmt = '%Y%m%dT%H%M%S'
+    now_str = now.strftime(now_fmt)
+    return DeployTag('-'.join([rev, now_str]))
+
+
+class DeployAppManager(DeployPathOwner):
+    def __init__(
             self,
-            tgt: RemoteSpawning.Target,
-            bs: MainBootstrap,
-    ) -> ta.AsyncGenerator[RemoteCommandExecutor, None]:
-        spawn_src = self._spawn_src()
-        remote_src = self._remote_src()
+            *,
+            deploy_home: DeployHome,
+            git: DeployGitManager,
+            venvs: DeployVenvManager,
+    ) -> None:
+        super().__init__()
 
-        async with self._spawning.spawn(
-                tgt,
-                spawn_src,
-                debug=bs.main_config.debug,
-        ) as proc:
-            res = await PyremoteBootstrapDriver(  # noqa
-                remote_src,
-                PyremoteBootstrapOptions(
-                    debug=bs.main_config.debug,
-                ),
-            ).async_run(
-                proc.stdout,
-                proc.stdin,
-            )
+        self._deploy_home = deploy_home
+        self._git = git
+        self._venvs = venvs
 
-            chan = RemoteChannelImpl(
-                proc.stdout,
-                proc.stdin,
-                msh=self._msh,
-            )
+        self._dir = os.path.join(deploy_home, 'apps')
 
-            await chan.send_obj(bs)
+    def get_deploy_paths(self) -> ta.AbstractSet[DeployPath]:
+        return {
+            DeployPath.parse('apps/@app/@tag'),
+        }
 
-            rce: RemoteCommandExecutor
-            async with contextlib.aclosing(RemoteCommandExecutor(chan)) as rce:
-                await rce.start()
+    async def prepare_app(
+            self,
+            app: DeployApp,
+            rev: DeployRev,
+            repo: DeployGitRepo,
+    ):
+        app_tag = DeployAppTag(app, make_deploy_tag(rev))
+        app_dir = os.path.join(self._dir, app, app_tag.tag)
+
+        #
+
+        await self._git.checkout(
+            DeployGitSpec(
+                repo=repo,
+                rev=rev,
+            ),
+            app_dir,
+        )
+
+        #
+
+        await self._venvs.setup_app_venv(app_tag)
 
-                yield rce
+
+########################################
+# ../remote/_main.py
+
+
+##
+
+
+class _RemoteExecutionLogHandler(logging.Handler):
+    def __init__(self, fn: ta.Callable[[str], None]) -> None:
+        super().__init__()
+        self._fn = fn
+
+    def emit(self, record):
+        msg = self.format(record)
+        self._fn(msg)
 
 
 ##
 
 
-class InProcessRemoteExecutionConnector(RemoteExecutionConnector):
+class _RemoteExecutionMain:
     def __init__(
             self,
-            *,
-            msh: ObjMarshalerManager,
-            local_executor: LocalCommandExecutor,
+            chan: RemoteChannel,
     ) -> None:
         super().__init__()
 
-        self._msh = msh
-        self._local_executor = local_executor
+        self._chan = chan
 
-    @contextlib.asynccontextmanager
-    async def connect(
+        self.__bootstrap: ta.Optional[MainBootstrap] = None
+        self.__injector: ta.Optional[Injector] = None
+
+    @property
+    def _bootstrap(self) -> MainBootstrap:
+        return check.not_none(self.__bootstrap)
+
+    @property
+    def _injector(self) -> Injector:
+        return check.not_none(self.__injector)
+
+    #
+
+    def _timebomb_main(
             self,
-            tgt: RemoteSpawning.Target,
-            bs: MainBootstrap,
-    ) -> ta.AsyncGenerator[RemoteCommandExecutor, None]:
-        r0, w0 = asyncio_create_bytes_channel()
-        r1, w1 = asyncio_create_bytes_channel()
+            delay_s: float,
+            *,
+            sig: int = signal.SIGINT,
+            code: int = 1,
+    ) -> None:
+        time.sleep(delay_s)
 
-        remote_chan = RemoteChannelImpl(r0, w1, msh=self._msh)
-        local_chan = RemoteChannelImpl(r1, w0, msh=self._msh)
+        if (pgid := os.getpgid(0)) == os.getpid():
+            os.killpg(pgid, sig)
 
-        rch = _RemoteCommandHandler(
-            remote_chan,
-            self._local_executor,
+        os._exit(code)  # noqa
+
+    @cached_nullary
+    def _timebomb_thread(self) -> ta.Optional[threading.Thread]:
+        if (tbd := self._bootstrap.remote_config.timebomb_delay_s) is None:
+            return None
+
+        thr = threading.Thread(
+            target=functools.partial(self._timebomb_main, tbd),
+            name=f'{self.__class__.__name__}.timebomb',
+            daemon=True,
         )
-        rch_task = asyncio.create_task(rch.run())  # noqa
-        try:
-            rce: RemoteCommandExecutor
-            async with contextlib.aclosing(RemoteCommandExecutor(local_chan)) as rce:
-                await rce.start()
 
-                yield rce
+        thr.start()
 
-        finally:
-            rch.stop()
-            await rch_task
+        log.debug('Started timebomb thread: %r', thr)
+
+        return thr
+
+    #
+
+    @cached_nullary
+    def _log_handler(self) -> _RemoteLogHandler:
+        return _RemoteLogHandler(self._chan)
+
+    #
+
+    async def _setup(self) -> None:
+        check.none(self.__bootstrap)
+        check.none(self.__injector)
+
+        # Bootstrap
+
+        self.__bootstrap = check.not_none(await self._chan.recv_obj(MainBootstrap))
+
+        if (prd := self._bootstrap.remote_config.pycharm_remote_debug) is not None:
+            pycharm_debug_connect(prd)
+
+        self.__injector = main_bootstrap(self._bootstrap)
+
+        self._chan.set_marshaler(self._injector[ObjMarshalerManager])
+
+        # Post-bootstrap
+
+        if self._bootstrap.remote_config.set_pgid:
+            if os.getpgid(0) != os.getpid():
+                log.debug('Setting pgid')
+                os.setpgid(0, 0)
+
+        if (ds := self._bootstrap.remote_config.deathsig) is not None:
+            log.debug('Setting deathsig: %s', ds)
+            set_process_deathsig(int(signal.Signals[f'SIG{ds.upper()}']))
+
+        self._timebomb_thread()
+
+        if self._bootstrap.remote_config.forward_logging:
+            log.debug('Installing log forwarder')
+            logging.root.addHandler(self._log_handler())
+
+    #
+
+    async def run(self) -> None:
+        await self._setup()
+
+        executor = self._injector[LocalCommandExecutor]
+
+        handler = _RemoteCommandHandler(self._chan, executor)
+
+        await handler.run()
+
+
+def _remote_execution_main() -> None:
+    rt = pyremote_bootstrap_finalize()  # noqa
+
+    async def inner() -> None:
+        input = await asyncio_open_stream_reader(rt.input)  # noqa
+        output = await asyncio_open_stream_writer(rt.output)
+
+        chan = RemoteChannelImpl(
+            input,
+            output,
+        )
+
+        await _RemoteExecutionMain(chan).run()
+
+    asyncio.run(inner())
+
+
+########################################
+# ../system/commands.py
+
+
+##
+
+
+@dc.dataclass(frozen=True)
+class CheckSystemPackageCommand(Command['CheckSystemPackageCommand.Output']):
+    pkgs: ta.Sequence[str] = ()
+
+    def __post_init__(self) -> None:
+        check.not_isinstance(self.pkgs, str)
+
+    @dc.dataclass(frozen=True)
+    class Output(Command.Output):
+        pkgs: ta.Sequence[SystemPackage]
+
+
+class CheckSystemPackageCommandExecutor(CommandExecutor[CheckSystemPackageCommand, CheckSystemPackageCommand.Output]):
+    def __init__(
+            self,
+            *,
+            mgr: SystemPackageManager,
+    ) -> None:
+        super().__init__()
+
+        self._mgr = mgr
+
+    async def execute(self, cmd: CheckSystemPackageCommand) -> CheckSystemPackageCommand.Output:
+        log.info('Checking system package!')
+
+        ret = await self._mgr.query(*cmd.pkgs)
+
+        return CheckSystemPackageCommand.Output(list(ret.values()))
 
 
 ########################################
@@ -6961,54 +8208,183 @@ class SystemInterpProvider(InterpProvider):
             lst.append((e, ev))
         return lst
 
-    #
+    #
+
+    async def get_installed_versions(self, spec: InterpSpecifier) -> ta.Sequence[InterpVersion]:
+        return [ev for e, ev in await self.exe_versions()]
+
+    async def get_installed_version(self, version: InterpVersion) -> Interp:
+        for e, ev in await self.exe_versions():
+            if ev != version:
+                continue
+            return Interp(
+                exe=e,
+                version=ev,
+            )
+        raise KeyError(version)
+
+
+########################################
+# ../remote/connection.py
+
+
+##
+
+
+class PyremoteRemoteExecutionConnector:
+    def __init__(
+            self,
+            *,
+            spawning: RemoteSpawning,
+            msh: ObjMarshalerManager,
+            payload_file: ta.Optional[RemoteExecutionPayloadFile] = None,
+    ) -> None:
+        super().__init__()
+
+        self._spawning = spawning
+        self._msh = msh
+        self._payload_file = payload_file
+
+    #
+
+    @cached_nullary
+    def _payload_src(self) -> str:
+        return get_remote_payload_src(file=self._payload_file)
+
+    @cached_nullary
+    def _remote_src(self) -> ta.Sequence[str]:
+        return [
+            self._payload_src(),
+            '_remote_execution_main()',
+        ]
+
+    @cached_nullary
+    def _spawn_src(self) -> str:
+        return pyremote_build_bootstrap_cmd(__package__ or 'manage')
+
+    #
+
+    @contextlib.asynccontextmanager
+    async def connect(
+            self,
+            tgt: RemoteSpawning.Target,
+            bs: MainBootstrap,
+    ) -> ta.AsyncGenerator[RemoteCommandExecutor, None]:
+        spawn_src = self._spawn_src()
+        remote_src = self._remote_src()
+
+        async with self._spawning.spawn(
+                tgt,
+                spawn_src,
+                debug=bs.main_config.debug,
+        ) as proc:
+            res = await PyremoteBootstrapDriver(  # noqa
+                remote_src,
+                PyremoteBootstrapOptions(
+                    debug=bs.main_config.debug,
+                ),
+            ).async_run(
+                proc.stdout,
+                proc.stdin,
+            )
+
+            chan = RemoteChannelImpl(
+                proc.stdout,
+                proc.stdin,
+                msh=self._msh,
+            )
+
+            await chan.send_obj(bs)
+
+            rce: RemoteCommandExecutor
+            async with aclosing(RemoteCommandExecutor(chan)) as rce:
+                await rce.start()
+
+                yield rce
+
+
+##
+
+
+class InProcessRemoteExecutionConnector:
+    def __init__(
+            self,
+            *,
+            msh: ObjMarshalerManager,
+            local_executor: LocalCommandExecutor,
+    ) -> None:
+        super().__init__()
+
+        self._msh = msh
+        self._local_executor = local_executor
+
+    @contextlib.asynccontextmanager
+    async def connect(self) -> ta.AsyncGenerator[RemoteCommandExecutor, None]:
+        r0, w0 = asyncio_create_bytes_channel()
+        r1, w1 = asyncio_create_bytes_channel()
+
+        remote_chan = RemoteChannelImpl(r0, w1, msh=self._msh)
+        local_chan = RemoteChannelImpl(r1, w0, msh=self._msh)
 
-    async def get_installed_versions(self, spec: InterpSpecifier) -> ta.Sequence[InterpVersion]:
-        return [ev for e, ev in await self.exe_versions()]
+        rch = _RemoteCommandHandler(
+            remote_chan,
+            self._local_executor,
+        )
+        rch_task = asyncio.create_task(rch.run())  # noqa
+        try:
+            rce: RemoteCommandExecutor
+            async with aclosing(RemoteCommandExecutor(local_chan)) as rce:
+                await rce.start()
 
-    async def get_installed_version(self, version: InterpVersion) -> Interp:
-        for e, ev in await self.exe_versions():
-            if ev != version:
-                continue
-            return Interp(
-                exe=e,
-                version=ev,
-            )
-        raise KeyError(version)
+                yield rce
+
+        finally:
+            rch.stop()
+            await rch_task
 
 
 ########################################
-# ../remote/inject.py
+# ../system/inject.py
 
 
-def bind_remote(
+def bind_system(
         *,
-        remote_config: RemoteConfig,
+        system_config: SystemConfig,
 ) -> InjectorBindings:
     lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind(remote_config),
-
-        inj.bind(SubprocessRemoteSpawning, singleton=True),
-        inj.bind(RemoteSpawning, to_key=SubprocessRemoteSpawning),
+        inj.bind(system_config),
     ]
 
     #
 
-    if remote_config.use_in_process_remote_executor:
+    platform = system_config.platform or detect_system_platform()
+    lst.append(inj.bind(platform, key=Platform))
+
+    #
+
+    if isinstance(platform, AmazonLinuxPlatform):
         lst.extend([
-            inj.bind(InProcessRemoteExecutionConnector, singleton=True),
-            inj.bind(RemoteExecutionConnector, to_key=InProcessRemoteExecutionConnector),
+            inj.bind(YumSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=YumSystemPackageManager),
         ])
-    else:
+
+    elif isinstance(platform, LinuxPlatform):
+        lst.extend([
+            inj.bind(AptSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=AptSystemPackageManager),
+        ])
+
+    elif isinstance(platform, DarwinPlatform):
         lst.extend([
-            inj.bind(PyremoteRemoteExecutionConnector, singleton=True),
-            inj.bind(RemoteExecutionConnector, to_key=PyremoteRemoteExecutionConnector),
+            inj.bind(BrewSystemPackageManager, singleton=True),
+            inj.bind(SystemPackageManager, to_key=BrewSystemPackageManager),
         ])
 
     #
 
-    if (pf := remote_config.payload_file) is not None:
-        lst.append(inj.bind(pf, key=RemoteExecutionPayloadFile))
+    lst.extend([
+        bind_command(CheckSystemPackageCommand, CheckSystemPackageCommandExecutor),
+    ])
 
     #
 
@@ -7114,189 +8490,248 @@ DEFAULT_INTERP_RESOLVER = InterpResolver([(p.name, p) for p in [
 
 
 ########################################
-# ../commands/interp.py
+# ../remote/inject.py
 
 
-##
+def bind_remote(
+        *,
+        remote_config: RemoteConfig,
+) -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind(remote_config),
 
+        inj.bind(SubprocessRemoteSpawning, singleton=True),
+        inj.bind(RemoteSpawning, to_key=SubprocessRemoteSpawning),
 
-@dc.dataclass(frozen=True)
-class InterpCommand(Command['InterpCommand.Output']):
-    spec: str
-    install: bool = False
+        inj.bind(PyremoteRemoteExecutionConnector, singleton=True),
+        inj.bind(InProcessRemoteExecutionConnector, singleton=True),
+    ]
 
-    @dc.dataclass(frozen=True)
-    class Output(Command.Output):
-        exe: str
-        version: str
-        opts: InterpOpts
+    #
+
+    if (pf := remote_config.payload_file) is not None:
+        lst.append(inj.bind(pf, key=RemoteExecutionPayloadFile))
 
+    #
 
-class InterpCommandExecutor(CommandExecutor[InterpCommand, InterpCommand.Output]):
-    async def execute(self, cmd: InterpCommand) -> InterpCommand.Output:
-        i = InterpSpecifier.parse(check.not_none(cmd.spec))
-        o = check.not_none(await DEFAULT_INTERP_RESOLVER.resolve(i, install=cmd.install))
-        return InterpCommand.Output(
-            exe=o.exe,
-            version=str(o.version.version),
-            opts=o.version.opts,
-        )
+    return inj.as_bindings(*lst)
 
 
 ########################################
-# ../commands/inject.py
+# ../targets/connection.py
 
 
 ##
 
 
-def bind_command(
-        command_cls: ta.Type[Command],
-        executor_cls: ta.Optional[ta.Type[CommandExecutor]],
-) -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind(CommandRegistration(command_cls), array=True),
-    ]
+class ManageTargetConnector(abc.ABC):
+    @abc.abstractmethod
+    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
+        raise NotImplementedError
 
-    if executor_cls is not None:
-        lst.extend([
-            inj.bind(executor_cls, singleton=True),
-            inj.bind(CommandExecutorRegistration(command_cls, executor_cls), array=True),
-        ])
 
-    return inj.as_bindings(*lst)
+##
 
 
-##
+ManageTargetConnectorMap = ta.NewType('ManageTargetConnectorMap', ta.Mapping[ta.Type[ManageTarget], ManageTargetConnector])  # noqa
 
 
 @dc.dataclass(frozen=True)
-class _FactoryCommandExecutor(CommandExecutor):
-    factory: ta.Callable[[], CommandExecutor]
+class TypeSwitchedManageTargetConnector(ManageTargetConnector):
+    connectors: ManageTargetConnectorMap
 
-    def execute(self, i: Command) -> ta.Awaitable[Command.Output]:
-        return self.factory().execute(i)
+    def get_connector(self, ty: ta.Type[ManageTarget]) -> ManageTargetConnector:
+        for k, v in self.connectors.items():
+            if issubclass(ty, k):
+                return v
+        raise KeyError(ty)
+
+    def connect(self, tgt: ManageTarget) -> ta.AsyncContextManager[CommandExecutor]:
+        return self.get_connector(type(tgt)).connect(tgt)
 
 
 ##
 
 
-def bind_commands(
-        *,
-        main_config: MainConfig,
-) -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind_array(CommandRegistration),
-        inj.bind_array_type(CommandRegistration, CommandRegistrations),
+@dc.dataclass(frozen=True)
+class LocalManageTargetConnector(ManageTargetConnector):
+    _local_executor: LocalCommandExecutor
+    _in_process_connector: InProcessRemoteExecutionConnector
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
 
-        inj.bind_array(CommandExecutorRegistration),
-        inj.bind_array_type(CommandExecutorRegistration, CommandExecutorRegistrations),
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        lmt = check.isinstance(tgt, LocalManageTarget)
 
-        inj.bind(build_command_name_map, singleton=True),
-    ]
+        if isinstance(lmt, InProcessManageTarget):
+            imt = check.isinstance(lmt, InProcessManageTarget)
 
-    #
+            if imt.mode == InProcessManageTarget.Mode.DIRECT:
+                yield self._local_executor
 
-    def provide_obj_marshaler_installer(cmds: CommandNameMap) -> ObjMarshalerInstaller:
-        return ObjMarshalerInstaller(functools.partial(install_command_marshaling, cmds))
+            elif imt.mode == InProcessManageTarget.Mode.FAKE_REMOTE:
+                async with self._in_process_connector.connect() as rce:
+                    yield rce
 
-    lst.append(inj.bind(provide_obj_marshaler_installer, array=True))
+            else:
+                raise TypeError(imt.mode)
+
+        elif isinstance(lmt, SubprocessManageTarget):
+            async with self._pyremote_connector.connect(
+                    RemoteSpawning.Target(
+                        python=lmt.python,
+                    ),
+                    self._bootstrap,
+            ) as rce:
+                yield rce
 
-    #
+        else:
+            raise TypeError(lmt)
 
-    def provide_command_executor_map(
-            injector: Injector,
-            crs: CommandExecutorRegistrations,
-    ) -> CommandExecutorMap:
-        dct: ta.Dict[ta.Type[Command], CommandExecutor] = {}
 
-        cr: CommandExecutorRegistration
-        for cr in crs:
-            if cr.command_cls in dct:
-                raise KeyError(cr.command_cls)
+##
 
-            factory = functools.partial(injector.provide, cr.executor_cls)
-            if main_config.debug:
-                ce = factory()
-            else:
-                ce = _FactoryCommandExecutor(factory)
 
-            dct[cr.command_cls] = ce
+@dc.dataclass(frozen=True)
+class DockerManageTargetConnector(ManageTargetConnector):
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
 
-        return CommandExecutorMap(dct)
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        dmt = check.isinstance(tgt, DockerManageTarget)
+
+        sh_parts: ta.List[str] = ['docker']
+        if dmt.image is not None:
+            sh_parts.extend(['run', '-i', dmt.image])
+        elif dmt.container_id is not None:
+            sh_parts.extend(['exec', dmt.container_id])
+        else:
+            raise ValueError(dmt)
 
-    lst.extend([
-        inj.bind(provide_command_executor_map, singleton=True),
+        async with self._pyremote_connector.connect(
+                RemoteSpawning.Target(
+                    shell=' '.join(sh_parts),
+                    python=dmt.python,
+                ),
+                self._bootstrap,
+        ) as rce:
+            yield rce
 
-        inj.bind(LocalCommandExecutor, singleton=True, eager=main_config.debug),
-    ])
 
-    #
+##
 
-    command_cls: ta.Any
-    executor_cls: ta.Any
-    for command_cls, executor_cls in [
-        (SubprocessCommand, SubprocessCommandExecutor),
-        (InterpCommand, InterpCommandExecutor),
-    ]:
-        lst.append(bind_command(command_cls, executor_cls))
 
-    #
+@dc.dataclass(frozen=True)
+class SshManageTargetConnector(ManageTargetConnector):
+    _pyremote_connector: PyremoteRemoteExecutionConnector
+    _bootstrap: MainBootstrap
 
-    return inj.as_bindings(*lst)
+    @contextlib.asynccontextmanager
+    async def connect(self, tgt: ManageTarget) -> ta.AsyncGenerator[CommandExecutor, None]:
+        smt = check.isinstance(tgt, SshManageTarget)
+
+        sh_parts: ta.List[str] = ['ssh']
+        if smt.key_file is not None:
+            sh_parts.extend(['-i', smt.key_file])
+        addr = check.not_none(smt.host)
+        if smt.username is not None:
+            addr = f'{smt.username}@{addr}'
+        sh_parts.append(addr)
+
+        async with self._pyremote_connector.connect(
+                RemoteSpawning.Target(
+                    shell=' '.join(sh_parts),
+                    shell_quote=True,
+                    python=smt.python,
+                ),
+                self._bootstrap,
+        ) as rce:
+            yield rce
 
 
 ########################################
-# ../deploy/inject.py
+# ../deploy/interp.py
 
 
-def bind_deploy(
-) -> InjectorBindings:
-    lst: ta.List[InjectorBindingOrBindings] = [
-        bind_command(DeployCommand, DeployCommandExecutor),
-    ]
+##
 
-    return inj.as_bindings(*lst)
+
+@dc.dataclass(frozen=True)
+class InterpCommand(Command['InterpCommand.Output']):
+    spec: str
+    install: bool = False
+
+    @dc.dataclass(frozen=True)
+    class Output(Command.Output):
+        exe: str
+        version: str
+        opts: InterpOpts
+
+
+class InterpCommandExecutor(CommandExecutor[InterpCommand, InterpCommand.Output]):
+    async def execute(self, cmd: InterpCommand) -> InterpCommand.Output:
+        i = InterpSpecifier.parse(check.not_none(cmd.spec))
+        o = check.not_none(await DEFAULT_INTERP_RESOLVER.resolve(i, install=cmd.install))
+        return InterpCommand.Output(
+            exe=o.exe,
+            version=str(o.version.version),
+            opts=o.version.opts,
+        )
 
 
 ########################################
-# ../system/inject.py
+# ../targets/inject.py
 
 
-def bind_system(
-        *,
-        system_config: SystemConfig,
-) -> InjectorBindings:
+def bind_targets() -> InjectorBindings:
     lst: ta.List[InjectorBindingOrBindings] = [
-        inj.bind(system_config),
+        inj.bind(LocalManageTargetConnector, singleton=True),
+        inj.bind(DockerManageTargetConnector, singleton=True),
+        inj.bind(SshManageTargetConnector, singleton=True),
+
+        inj.bind(TypeSwitchedManageTargetConnector, singleton=True),
+        inj.bind(ManageTargetConnector, to_key=TypeSwitchedManageTargetConnector),
     ]
 
     #
 
-    platform = system_config.platform or sys.platform
-    lst.append(inj.bind(platform, key=SystemPlatform))
+    def provide_manage_target_connector_map(injector: Injector) -> ManageTargetConnectorMap:
+        return ManageTargetConnectorMap({
+            LocalManageTarget: injector[LocalManageTargetConnector],
+            DockerManageTarget: injector[DockerManageTargetConnector],
+            SshManageTarget: injector[SshManageTargetConnector],
+        })
+    lst.append(inj.bind(provide_manage_target_connector_map, singleton=True))
 
     #
 
-    if platform == 'linux':
-        lst.extend([
-            inj.bind(AptSystemPackageManager, singleton=True),
-            inj.bind(SystemPackageManager, to_key=AptSystemPackageManager),
-        ])
+    return inj.as_bindings(*lst)
 
-    elif platform == 'darwin':
-        lst.extend([
-            inj.bind(BrewSystemPackageManager, singleton=True),
-            inj.bind(SystemPackageManager, to_key=BrewSystemPackageManager),
-        ])
 
-    #
+########################################
+# ../deploy/inject.py
 
-    lst.extend([
-        bind_command(CheckSystemPackageCommand, CheckSystemPackageCommandExecutor),
-    ])
 
-    #
+def bind_deploy(
+        *,
+        deploy_config: DeployConfig,
+) -> InjectorBindings:
+    lst: ta.List[InjectorBindingOrBindings] = [
+        inj.bind(deploy_config),
+
+        inj.bind(DeployAppManager, singleton=True),
+        inj.bind(DeployGitManager, singleton=True),
+        inj.bind(DeployVenvManager, singleton=True),
+
+        bind_command(DeployCommand, DeployCommandExecutor),
+        bind_command(InterpCommand, InterpCommandExecutor),
+    ]
+
+    if (dh := deploy_config.deploy_home) is not None:
+        dh = os.path.abspath(os.path.expanduser(dh))
+        lst.append(inj.bind(dh, key=DeployHome))
 
     return inj.as_bindings(*lst)
 
@@ -7310,9 +8745,13 @@ def bind_system(
 
 def bind_main(
         *,
-        main_config: MainConfig,
-        remote_config: RemoteConfig,
-        system_config: SystemConfig,
+        main_config: MainConfig = MainConfig(),
+
+        deploy_config: DeployConfig = DeployConfig(),
+        remote_config: RemoteConfig = RemoteConfig(),
+        system_config: SystemConfig = SystemConfig(),
+
+        main_bootstrap: ta.Optional[MainBootstrap] = None,
 ) -> InjectorBindings:
     lst: ta.List[InjectorBindingOrBindings] = [
         inj.bind(main_config),
@@ -7321,7 +8760,9 @@ def bind_main(
             main_config=main_config,
         ),
 
-        bind_deploy(),
+        bind_deploy(
+            deploy_config=deploy_config,
+        ),
 
         bind_remote(
             remote_config=remote_config,
@@ -7330,10 +8771,17 @@ def bind_main(
         bind_system(
             system_config=system_config,
         ),
+
+        bind_targets(),
     ]
 
     #
 
+    if main_bootstrap is not None:
+        lst.append(inj.bind(main_bootstrap))
+
+    #
+
     def build_obj_marshaler_manager(insts: ObjMarshalerInstallers) -> ObjMarshalerManager:
         msh = ObjMarshalerManager()
         inst: ObjMarshalerInstaller
@@ -7363,8 +8811,12 @@ def main_bootstrap(bs: MainBootstrap) -> Injector:
 
     injector = inj.create_injector(bind_main(  # noqa
         main_config=bs.main_config,
+
+        deploy_config=bs.deploy_config,
         remote_config=bs.remote_config,
         system_config=bs.system_config,
+
+        main_bootstrap=bs,
     ))
 
     return injector
@@ -7378,10 +8830,6 @@ class MainCli(ArgparseCli):
     @argparse_command(
         argparse_arg('--_payload-file'),
 
-        argparse_arg('-s', '--shell'),
-        argparse_arg('-q', '--shell-quote', action='store_true'),
-        argparse_arg('--python', default='python3'),
-
         argparse_arg('--pycharm-debug-port', type=int),
         argparse_arg('--pycharm-debug-host'),
         argparse_arg('--pycharm-debug-version'),
@@ -7390,8 +8838,9 @@ class MainCli(ArgparseCli):
 
         argparse_arg('--debug', action='store_true'),
 
-        argparse_arg('--local', action='store_true'),
+        argparse_arg('--deploy-home'),
 
+        argparse_arg('target'),
         argparse_arg('command', nargs='+'),
     )
     async def run(self) -> None:
@@ -7402,6 +8851,10 @@ class MainCli(ArgparseCli):
                 debug=bool(self.args.debug),
             ),
 
+            deploy_config=DeployConfig(
+                deploy_home=self.args.deploy_home,
+            ),
+
             remote_config=RemoteConfig(
                 payload_file=self.args._payload_file,  # noqa
 
@@ -7412,8 +8865,6 @@ class MainCli(ArgparseCli):
                 ) if self.args.pycharm_debug_port is not None else None,
 
                 timebomb_delay_s=self.args.remote_timebomb_delay_s,
-
-                use_in_process_remote_executor=True,
             ),
         )
 
@@ -7427,6 +8878,11 @@ class MainCli(ArgparseCli):
 
         msh = injector[ObjMarshalerManager]
 
+        ts = self.args.target
+        if not ts.startswith('{'):
+            ts = json.dumps({ts: {}})
+        tgt: ManageTarget = msh.unmarshal_obj(json.loads(ts), ManageTarget)
+
         cmds: ta.List[Command] = []
         cmd: Command
         for c in self.args.command:
@@ -7437,21 +8893,7 @@ class MainCli(ArgparseCli):
 
         #
 
-        async with contextlib.AsyncExitStack() as es:
-            ce: CommandExecutor
-
-            if self.args.local:
-                ce = injector[LocalCommandExecutor]
-
-            else:
-                tgt = RemoteSpawning.Target(
-                    shell=self.args.shell,
-                    shell_quote=self.args.shell_quote,
-                    python=self.args.python,
-                )
-
-                ce = await es.enter_async_context(injector[RemoteExecutionConnector].connect(tgt, bs))  # noqa
-
+        async with injector[ManageTargetConnector].connect(tgt) as ce:
             async def run_command(cmd: Command) -> None:
                 res = await ce.try_execute(
                     cmd,