From 191fb4e2cfaea9547d2a1a3700cd531552808f51 Mon Sep 17 00:00:00 2001
From: PTah <papatramp@gmail.com>
Date: Sat, 20 Jun 2026 19:46:22 +1000
Subject: [PATCH] fix: WinRM RDP update only via git clone on client (0.20.13)

---
 backend/app/services/winrm_connect.py | 25 +++----------------------
 backend/app/version.py                |  2 +-
 backend/tests/test_winrm_connect.py   |  7 +++----
 frontend/src/version.ts               |  2 +-
 4 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/backend/app/services/winrm_connect.py b/backend/app/services/winrm_connect.py
index 5ac8bbc..07abcc4 100644
--- a/backend/app/services/winrm_connect.py
+++ b/backend/app/services/winrm_connect.py
@@ -311,34 +311,14 @@ def _rdp_update_powershell_script(
     )
     safe_branch = _powershell_literal_path((git_branch or "main").strip() or "main")
     body = (
-        "function Invoke-RdpDeploy {\n"
-        "  param([string]$Path)\n"
-        "  Write-Output \"Running: $Path\"\n"
-        "  & $Path\n"
-        "}\n"
-        "$deployCandidates = [System.Collections.Generic.List[string]]::new()\n"
-        "if ($env:USERDOMAIN) {\n"
-        "  $deployCandidates.Add((Join-Path \"\\\\$($env:USERDOMAIN)\\NETLOGON\\RDP-login-monitor\" 'Deploy-LoginMonitor.ps1'))\n"
-        "}\n"
-        "try {\n"
-        "  $dom = (Get-CimInstance Win32_ComputerSystem -ErrorAction Stop).Domain\n"
-        "  if ($dom) {\n"
-        "    $deployCandidates.Add((Join-Path \"\\\\$dom\\NETLOGON\\RDP-login-monitor\" 'Deploy-LoginMonitor.ps1'))\n"
-        "  }\n"
-        "} catch { }\n"
-        "foreach ($p in $deployCandidates) {\n"
-        "  if (Test-Path -LiteralPath $p) {\n"
-        "    Invoke-RdpDeploy $p\n"
-        "    exit 0\n"
-        "  }\n"
-        "}\n"
         f"$gitUrl = '{safe_repo}'\n"
         f"$branch = '{safe_branch}'\n"
         "$repoDir = Join-Path $env:ProgramData 'RDP-login-monitor\\_sac_git'\n"
         "$gitCmd = Get-Command git.exe -ErrorAction SilentlyContinue\n"
         "if (-not $gitCmd) {\n"
-        "  throw 'Deploy-LoginMonitor.ps1 not on NETLOGON and git.exe missing; set win_agent_update_script in SAC or install Git'\n"
+        "  throw 'git.exe not found on client PC — install Git for Windows or set win_agent_update_script in SAC'\n"
         "}\n"
+        "Write-Output \"git: $gitUrl (branch $branch) -> $repoDir\"\n"
         "if (-not (Test-Path -LiteralPath (Join-Path $repoDir '.git'))) {\n"
         "  if (Test-Path -LiteralPath $repoDir) { Remove-Item -LiteralPath $repoDir -Recurse -Force }\n"
         "  New-Item -ItemType Directory -Path (Split-Path $repoDir -Parent) -Force | Out-Null\n"
@@ -354,6 +334,7 @@ def _rdp_update_powershell_script(
         "}\n"
         "$deploy = Join-Path $repoDir 'Deploy-LoginMonitor.ps1'\n"
         "if (-not (Test-Path -LiteralPath $deploy)) { throw \"Deploy-LoginMonitor.ps1 missing in git checkout: $repoDir\" }\n"
+        "Write-Output \"Running: $deploy -SourceShareRoot $repoDir\"\n"
         "& $deploy -SourceShareRoot $repoDir\n"
     )
     return _wrap_powershell_body(body)
diff --git a/backend/app/version.py b/backend/app/version.py
index fbfdaff..d9cc3d5 100644
--- a/backend/app/version.py
+++ b/backend/app/version.py
@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.12"
+APP_VERSION = "0.20.13"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"
diff --git a/backend/tests/test_winrm_connect.py b/backend/tests/test_winrm_connect.py
index 563151f..6d1c03e 100644
--- a/backend/tests/test_winrm_connect.py
+++ b/backend/tests/test_winrm_connect.py
@@ -7,14 +7,13 @@ from app.services.winrm_connect import (
 )
 
 
-def test_rdp_update_default_script_uses_netlogon_and_git_fallback():
+def test_rdp_update_default_script_clones_git_and_runs_local_deploy():
     script = _rdp_update_powershell_script("")
     assert "$ProgressPreference = 'SilentlyContinue'" in script
-    assert "NETLOGON\\RDP-login-monitor" in script
-    assert "Deploy-LoginMonitor.ps1" in script
+    assert "NETLOGON" not in script
     assert "_sac_git" in script
     assert "git.kalinamall.ru/PapaTramp/RDP-login-monitor.git" in script
-    assert "ProgramData\\RDP-login-monitor\\Deploy-LoginMonitor.ps1" not in script
+    assert "-SourceShareRoot $repoDir" in script
 
 
 def test_rdp_update_default_script_honors_sac_git_settings():
diff --git a/frontend/src/version.ts b/frontend/src/version.ts
index a0cde1c..251fa47 100644
--- a/frontend/src/version.ts
+++ b/frontend/src/version.ts
@@ -1,4 +1,4 @@
 /** Fallback до загрузки /health; при релизе держите в sync с backend/app/version.py */
 export const APP_NAME = "Security Alert Center";
-export const APP_VERSION = "0.20.12";
+export const APP_VERSION = "0.20.13";
 export const APP_VERSION_LABEL = `${APP_NAME} v.${APP_VERSION}`;