Stream Tower deploy script through bash

CHANGELOG.md

@@ -10,6 +10,7 @@
 ## Sprint 164 Tower AI deploy env hardening (2026-07-11)
 
 - Fixed Tower deploy automation so `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote `.env` before building the all-in-one image.
+- Hardened the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving remote shell variable expansion.
 - Remote `.env` now controls `GEOINTEL_INSTALL_AI=true` by default, with explicit local deploy overrides still supported.
 - Added regression coverage so future deploy changes cannot silently build a GIS-only image while runtime YOLO settings are enabled.
 - No API contract, database migration, provider fetching, fake detections, model download or product feature changed.

backend/tests/test_sprint31_unraid_template.py

@@ -130,6 +130,15 @@ def test_tower_deploy_build_uses_remote_env_ai_setting_by_default() -> None:
         assert 'docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI"' in script
 
 
+def test_powershell_tower_deploy_streams_remote_script_to_bash() -> None:
+    powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
+
+    assert "bash -s" in powershell
+    assert "$remoteScript | ssh" in powershell
+    assert "REMOTE_PATH='$RemotePath'" in powershell
+    assert "DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi'" in powershell
+
+
 def test_live_migration_smoke_supports_dockerman_native_container() -> None:
     script = (ROOT / "scripts" / "live_migration_smoke.sh").read_text(encoding="utf-8")
 

docs/CODEX_EXECUTION_LOG.md

@@ -2,6 +2,7 @@
 
 Changed:
 - Hardened `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` so the remote Tower `.env` is sourced before building the all-in-one image.
+- Updated the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving Bash variable expansion during `.env`-driven builds.
 - `GEOINTEL_INSTALL_AI=true` in `/mnt/user/appdata/geointel/.env` now drives the automatic image build by default; explicit local overrides remain possible for one-off deploys.
 - Documented the deploy behavior in `deploy/unraid/README.md`.
 
@@ -12,6 +13,8 @@ Why:
 Tested:
 - Red step: `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default` failed because the deploy scripts did not source remote `.env` before `docker build`.
 - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_uses_single_container_unraid_compose backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env` (`3 passed`).
+- Red step: `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash -q` failed because the PowerShell wrapper passed the remote script as an SSH command argument instead of streaming it to `bash -s`.
+- `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env -q` (`3 passed`).
 
 ## Sprint 150 YOLO label visible-ratio gate (2026-07-09)
 

scripts/deploy_tower.ps1

@@ -15,24 +15,23 @@ $bootstrapValue = if ($Bootstrap) { "1" } else { "0" }
 
 $remoteScript = @'
 set -euo pipefail
-DEPLOY_GEOINTEL_INSTALL_AI='__INSTALL_AI__'
-git config --global --add safe.directory '__REMOTE_PATH__'
-cd '__REMOTE_PATH__'
+git config --global --add safe.directory "$REMOTE_PATH"
+cd "$REMOTE_PATH"
 
 if [ ! -d .git ]; then
-  if [ '__BOOTSTRAP__' != '1' ]; then
-    echo 'No git checkout found in __REMOTE_PATH__.'
+  if [ "$DEPLOY_BOOTSTRAP" != '1' ]; then
+    echo "No git checkout found in $REMOTE_PATH."
     echo 'Re-run with -Bootstrap for the first deployment bootstrap.'
     exit 2
   fi
   git init
-  git remote add origin '__REMOTE_REPO__'
+  git remote add origin "$REMOTE_REPO"
 fi
 
-git remote get-url origin >/dev/null 2>&1 || git remote add origin '__REMOTE_REPO__'
-git fetch origin '__REMOTE_BRANCH__'
-git reset --hard 'origin/__REMOTE_BRANCH__'
-git branch -M '__REMOTE_BRANCH__'
+git remote get-url origin >/dev/null 2>&1 || git remote add origin "$REMOTE_REPO"
+git fetch origin "$REMOTE_BRANCH"
+git reset --hard "origin/$REMOTE_BRANCH"
+git branch -M "$REMOTE_BRANCH"
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
 if [ -f .env ]; then
@@ -55,15 +54,10 @@ if [ -x scripts/live_migration_smoke.sh ]; then
 fi
 
 if [ -x scripts/verify_browser_runtime.sh ]; then
-  bash scripts/verify_browser_runtime.sh '__FRONTEND_URL__'
+  bash scripts/verify_browser_runtime.sh "$FRONTEND_URL"
 fi
 '@
 
-$remoteScript = $remoteScript.Replace("__INSTALL_AI__", $InstallAi)
-$remoteScript = $remoteScript.Replace("__REMOTE_PATH__", $RemotePath)
-$remoteScript = $remoteScript.Replace("__BOOTSTRAP__", $bootstrapValue)
-$remoteScript = $remoteScript.Replace("__REMOTE_REPO__", $RemoteRepo)
-$remoteScript = $remoteScript.Replace("__REMOTE_BRANCH__", $RemoteBranch)
-$remoteScript = $remoteScript.Replace("__FRONTEND_URL__", $FrontendUrl)
+$remoteCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash -s"
 
-ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i $SshKey $RemoteHost $remoteScript
+$remoteScript | ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i $SshKey $RemoteHost $remoteCommand