Use temp script for Tower PowerShell deploy

CHANGELOG.md

@@ -11,7 +11,7 @@
 
 - Fixed Tower deploy automation so `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote `.env` before building the all-in-one image.
 - Hardened the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving remote shell variable expansion.
-- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so Bash receives a clean script.
+- The PowerShell wrapper now writes a UTF-8-without-BOM temporary script, copies it with `scp`, runs it with `bash` on Tower and removes the remote temp file while preserving the deploy exit code.
 - Remote `.env` now controls `GEOINTEL_INSTALL_AI=true` by default, with explicit local deploy overrides still supported.
 - Added regression coverage so future deploy changes cannot silently build a GIS-only image while runtime YOLO settings are enabled.
 - No API contract, database migration, provider fetching, fake detections, model download or product feature changed.

backend/tests/test_sprint31_unraid_template.py

@@ -134,9 +134,11 @@ def test_powershell_tower_deploy_streams_remote_script_to_bash() -> None:
     powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
 
     assert "[System.Text.UTF8Encoding]::new($false)" in powershell
-    assert "$OutputEncoding = $utf8NoBom" in powershell
+    assert "[System.IO.File]::WriteAllText($localScriptPath, $remoteScript, $utf8NoBom)" in powershell
-    assert "bash -s" in powershell
+    assert "& scp @scpArgs" in powershell
-    assert "$remoteScript | ssh" in powershell
+    assert "& ssh @sshRunArgs" in powershell
+    assert "bash '$remoteScriptPath'" in powershell
+    assert "rm -f '$remoteScriptPath'" in powershell
     assert "REMOTE_PATH='$RemotePath'" in powershell
     assert "DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi'" in powershell
 

docs/CODEX_EXECUTION_LOG.md

@@ -3,7 +3,7 @@
 Changed:
 - Hardened `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` so the remote Tower `.env` is sourced before building the all-in-one image.
 - Updated the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving Bash variable expansion during `.env`-driven builds.
-- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so the first remote Bash command is not prefixed with a BOM.
+- The PowerShell wrapper now writes a UTF-8-without-BOM temporary script, copies it with `scp`, runs it with `bash` on Tower and removes the remote temp file while preserving the deploy exit code.
 - `GEOINTEL_INSTALL_AI=true` in `/mnt/user/appdata/geointel/.env` now drives the automatic image build by default; explicit local overrides remain possible for one-off deploys.
 - Documented the deploy behavior in `deploy/unraid/README.md`.
 
@@ -16,7 +16,7 @@ Tested:
 - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_uses_single_container_unraid_compose backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env` (`3 passed`).
 - Red step: `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash -q` failed because the PowerShell wrapper passed the remote script as an SSH command argument instead of streaming it to `bash -s`.
 - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env -q` (`3 passed`).
-- Red step: the same PowerShell deploy transport test failed until the wrapper set `[System.Text.UTF8Encoding]::new($false)` for native-command stdin.
+- Red step: the same PowerShell deploy transport test failed until the wrapper wrote a `[System.Text.UTF8Encoding]::new($false)` temp script, copied it via `scp`, ran it through remote `bash` and propagated the remote exit code.
 
 ## Sprint 150 YOLO label visible-ratio gate (2026-07-09)
 

scripts/deploy_tower.ps1

@@ -58,10 +58,37 @@ if [ -x scripts/verify_browser_runtime.sh ]; then
 fi
 '@
 
-$remoteCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash -s"
-
 $utf8NoBom = [System.Text.UTF8Encoding]::new($false)
-[Console]::OutputEncoding = $utf8NoBom
+$localScriptPath = [System.IO.Path]::GetTempFileName()
-$OutputEncoding = $utf8NoBom
+$remoteScriptPath = "/tmp/geointel-deploy-$([System.Guid]::NewGuid().ToString('N')).sh"
 
-$remoteScript | ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i $SshKey $RemoteHost $remoteCommand
+try {
+    [System.IO.File]::WriteAllText($localScriptPath, $remoteScript, $utf8NoBom)
+
+    $scpArgs = @(
+        "-o", "BatchMode=yes",
+        "-o", "StrictHostKeyChecking=accept-new",
+        "-i", $SshKey,
+        $localScriptPath,
+        "${RemoteHost}:$remoteScriptPath"
+    )
+    & scp @scpArgs
+    if ($LASTEXITCODE -ne 0) {
+        exit $LASTEXITCODE
+    }
+
+    $remoteRunCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash '$remoteScriptPath'; status=`$?; rm -f '$remoteScriptPath'; exit `$status"
+    $sshRunArgs = @(
+        "-o", "BatchMode=yes",
+        "-o", "StrictHostKeyChecking=accept-new",
+        "-i", $SshKey,
+        $RemoteHost,
+        $remoteRunCommand
+    )
+    & ssh @sshRunArgs
+    if ($LASTEXITCODE -ne 0) {
+        exit $LASTEXITCODE
+    }
+} finally {
+    Remove-Item -LiteralPath $localScriptPath -Force -ErrorAction SilentlyContinue
+}