Fix PowerShell deploy stdin encoding

CHANGELOG.md

@@ -11,6 +11,7 @@
 
 - Fixed Tower deploy automation so `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote `.env` before building the all-in-one image.
 - Hardened the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving remote shell variable expansion.
+- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so Bash receives a clean script.
 - Remote `.env` now controls `GEOINTEL_INSTALL_AI=true` by default, with explicit local deploy overrides still supported.
 - Added regression coverage so future deploy changes cannot silently build a GIS-only image while runtime YOLO settings are enabled.
 - No API contract, database migration, provider fetching, fake detections, model download or product feature changed.

backend/tests/test_sprint31_unraid_template.py

@@ -133,6 +133,8 @@ def test_tower_deploy_build_uses_remote_env_ai_setting_by_default() -> None:
 def test_powershell_tower_deploy_streams_remote_script_to_bash() -> None:
     powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
 
+    assert "[System.Text.UTF8Encoding]::new($false)" in powershell
+    assert "$OutputEncoding = $utf8NoBom" in powershell
     assert "bash -s" in powershell
     assert "$remoteScript | ssh" in powershell
     assert "REMOTE_PATH='$RemotePath'" in powershell

docs/CODEX_EXECUTION_LOG.md

@@ -3,6 +3,7 @@
 Changed:
 - Hardened `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` so the remote Tower `.env` is sourced before building the all-in-one image.
 - Updated the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving Bash variable expansion during `.env`-driven builds.
+- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so the first remote Bash command is not prefixed with a BOM.
 - `GEOINTEL_INSTALL_AI=true` in `/mnt/user/appdata/geointel/.env` now drives the automatic image build by default; explicit local overrides remain possible for one-off deploys.
 - Documented the deploy behavior in `deploy/unraid/README.md`.
 
@@ -15,6 +16,7 @@ Tested:
 - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_uses_single_container_unraid_compose backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env` (`3 passed`).
 - Red step: `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash -q` failed because the PowerShell wrapper passed the remote script as an SSH command argument instead of streaming it to `bash -s`.
 - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env -q` (`3 passed`).
+- Red step: the same PowerShell deploy transport test failed until the wrapper set `[System.Text.UTF8Encoding]::new($false)` for native-command stdin.
 
 ## Sprint 150 YOLO label visible-ratio gate (2026-07-09)
 

scripts/deploy_tower.ps1

@@ -60,4 +60,8 @@ fi
 
 $remoteCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash -s"
 
+$utf8NoBom = [System.Text.UTF8Encoding]::new($false)
+[Console]::OutputEncoding = $utf8NoBom
+$OutputEncoding = $utf8NoBom
+
 $remoteScript | ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i $SshKey $RemoteHost $remoteCommand