From 7b83a19db0989ae4677c798869941238e677a82e Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Wed, 3 Jun 2026 10:14:17 +1000
Subject: [PATCH] fix: InstallTasks fails when settings WinRM lines lack dollar
 sign (2.0.9-SAC)

Defer login_monitor.settings.ps1 dot-source until after -InstallTasks so broken WinRM assignments cannot abort task registration. Deploy repairs settings lines missing $ before variable names.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Deploy-LoginMonitor.ps1 | 36 ++++++++++++++++++++++++++++++++++++
 Login_Monitor.ps1       | 26 +++++++++++++++++++++-----
 version.txt             |  2 +-
 3 files changed, 58 insertions(+), 6 deletions(-)

diff --git a/Deploy-LoginMonitor.ps1 b/Deploy-LoginMonitor.ps1
index 2840abb..a33c727 100644
--- a/Deploy-LoginMonitor.ps1
+++ b/Deploy-LoginMonitor.ps1
@@ -500,6 +500,41 @@ function Test-RdpMonitorSettingsNeedsWinRmInboundBlock {
     return $false
 }
 
+function Repair-RdpMonitorSettingsWinRmLinesIfInvalid {
+    param([string]$LocalSettings)
+    if (-not (Test-Path -LiteralPath $LocalSettings)) { return $false }
+
+    $c = Get-RdpMonitorSettingsRaw -Path $LocalSettings
+    if ([string]::IsNullOrWhiteSpace($c)) { return $false }
+
+    $winRmNames = @(
+        'EnableWinRmInboundMonitoring',
+        'WinRmLogName',
+        'WinRmInboundShellEventIds',
+        'WinRmCorrelateSecurity4624',
+        'WinRm4624CorrelationWindowSeconds',
+        'WinRmIgnoreLocalSource',
+        'WinRmIgnoreMachineAccounts'
+    )
+    $newContent = $c
+    $fixed = $false
+    foreach ($name in $winRmNames) {
+        $escaped = [regex]::Escape($name)
+        $pattern = "(?m)^(\s*)(?<![\$])$escaped(\s*=)"
+        if ($newContent -match $pattern) {
+            $newContent = [regex]::Replace($newContent, $pattern, ('${1}$' + $name + '${2}'))
+            $fixed = $true
+        }
+    }
+    if (-not $fixed) { return $false }
+
+    $bak = "$LocalSettings.bak.$(Get-Date -Format 'yyyyMMdd_HHmmss')"
+    Copy-Item -LiteralPath $LocalSettings -Destination $bak -Force
+    [System.IO.File]::WriteAllText($LocalSettings, $newContent.TrimEnd() + "`r`n", $Utf8Bom)
+    Write-DeployLog "login_monitor.settings.ps1: исправлены WinRM-строки без `$ (резервная копия: $bak)"
+    return $true
+}
+
 function Sync-RdpMonitorSettingsWinRmInboundBlock {
     param([string]$LocalSettings)
     if (-not (Test-Path -LiteralPath $LocalSettings)) { return $false }
@@ -597,6 +632,7 @@ function Invoke-RdpMonitorSettingsPostPatches {
     if (Update-RdpMonitorSettingsServerDisplayNameHintIfMissing -LocalSettings $LocalSettings) { $changed = $true }
     if (Sync-RdpMonitorSettingsDailyReportPatches -LocalSettings $LocalSettings) { $changed = $true }
     if (Sync-RdpMonitorSettingsExchangeNoisePatches -LocalSettings $LocalSettings) { $changed = $true }
+    if (Repair-RdpMonitorSettingsWinRmLinesIfInvalid -LocalSettings $LocalSettings) { $changed = $true }
     if (Sync-RdpMonitorSettingsWinRmInboundBlock -LocalSettings $LocalSettings) { $changed = $true }
     return $changed
 }
diff --git a/Login_Monitor.ps1 b/Login_Monitor.ps1
index 3fee122..9968898 100644
--- a/Login_Monitor.ps1
+++ b/Login_Monitor.ps1
@@ -82,7 +82,7 @@ $script:MonitorStopRequested = $false
 # строки ниже, если правки «мелкие» и вы не хотите менять отображаемую версию в логах).
 # Рекомендация: при значимых релизах меняйте и $ScriptVersion, и version.txt одинаково; при только
 # исправлениях на шаре — достаточно поднять patch в version.txt (например 1.3.0.1).
-$ScriptVersion = "2.0.8-SAC"
+$ScriptVersion = "2.0.9-SAC"
 
 # Логи (все под InstallRoot)
 $LogFile = Join-Path $script:InstallRoot "Logs\login_monitor.log"
@@ -230,10 +230,6 @@ $SacFallbackFailures = 5
 
 $script:LoginMonitorSettingsFile = Join-Path $script:InstallRoot 'login_monitor.settings.ps1'
 $script:LoginMonitorSettingsLoaded = $false
-if (Test-Path -LiteralPath $script:LoginMonitorSettingsFile) {
-    . $script:LoginMonitorSettingsFile
-    $script:LoginMonitorSettingsLoaded = $true
-}
 
 # ============================================
 # ИНИЦИАЛИЗАЦИЯ
@@ -655,6 +651,24 @@ if ($InstallTasks) {
     exit 0
 }
 
+function Import-LoginMonitorSettingsFile {
+    if ($script:LoginMonitorSettingsLoaded) { return $true }
+    if (-not (Test-Path -LiteralPath $script:LoginMonitorSettingsFile)) { return $false }
+    try {
+        . $script:LoginMonitorSettingsFile
+        $script:LoginMonitorSettingsLoaded = $true
+        return $true
+    } catch {
+        $msg = $_.Exception.Message
+        if (Get-Command Write-Log -ErrorAction SilentlyContinue) {
+            Write-Log "ОШИБКА: login_monitor.settings.ps1 — $msg"
+        } else {
+            Write-Host "ОШИБКА: login_monitor.settings.ps1 — $msg"
+        }
+        exit 1
+    }
+}
+
 # Только запись restart.request — без проверки администратора (Deploy/GPO может вызывать из SYSTEM).
 if ($RequestRestart) {
     $restartMode = if ($Recycle) { 'recycle' } else { 'settings' }
@@ -663,6 +677,8 @@ if ($RequestRestart) {
     exit 0
 }
 
+Import-LoginMonitorSettingsFile | Out-Null
+
 # --- Учётные данные Telegram (открытый текст или DPAPI Base64) ---
 if (-not [string]::IsNullOrWhiteSpace($TelegramBotTokenProtectedB64)) {
     try {
diff --git a/version.txt b/version.txt
index cb2aef5..6c7c89b 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-2.0.8-SAC
+2.0.9-SAC