fix(winrm): resolve System32 path for cmd test on minimal PATH (0.20.25)

WinRM run_cmd(hostname) failed on hosts where System32 is not in PATH.

backend/app/services/winrm_connect.py

@@ -211,6 +211,28 @@ def _finalize_winrm_run(
     )
 
 
+_SYSTEM32_CMDS = {
+    "hostname": "hostname.exe",
+    "qwinsta": "qwinsta.exe",
+    "logoff": "logoff.exe",
+}
+
+
+def _resolve_winrm_cmd(remote_cmd: str) -> str:
+    """WinRM cmd shell may have minimal PATH — use explicit System32 for built-ins."""
+    text = remote_cmd.strip()
+    if not text:
+        return text
+    parts = text.split(None, 1)
+    name = parts[0].lower()
+    rest = parts[1] if len(parts) > 1 else ""
+    exe = _SYSTEM32_CMDS.get(name)
+    if exe:
+        suffix = f" {rest}" if rest else ""
+        return f"%SystemRoot%\\System32\\{exe}{suffix}"
+    return text
+
+
 def run_winrm_ps(
     *,
     target: str,
@@ -269,7 +291,7 @@ def run_winrm_cmd(
     target = target.strip()
     try:
         session, winrm = _winrm_session(target, user, password, timeout_sec=timeout_sec)
-        result = session.run_cmd(remote_cmd)
+        result = session.run_cmd(_resolve_winrm_cmd(remote_cmd))
     except winrm.exceptions.WinRMTransportError as exc:
         detail = str(exc)
         hint = ""

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.24"
+APP_VERSION = "0.20.25"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"

backend/tests/test_health.py

@@ -4,6 +4,6 @@ from app.version import APP_NAME, APP_VERSION, APP_VERSION_LABEL
 
 
 def test_version_constants():
-    assert APP_VERSION == "0.20.22"
+    assert APP_VERSION == "0.20.25"
     assert APP_NAME == "Security Alert Center"
-    assert APP_VERSION_LABEL == "Security Alert Center v.0.20.22"
+    assert APP_VERSION_LABEL == "Security Alert Center v.0.20.25"

backend/tests/test_winrm_connect.py

@@ -95,6 +95,14 @@ def test_rdp_bundle_zip_roundtrip(tmp_path: Path, monkeypatch):
     assert get_rdp_bundle_zip(token) == zip_bytes
 
 
+def test_resolve_winrm_cmd_uses_system32_for_builtins():
+    from app.services.winrm_connect import _resolve_winrm_cmd
+
+    assert _resolve_winrm_cmd("hostname") == "%SystemRoot%\\System32\\hostname.exe"
+    assert _resolve_winrm_cmd("qwinsta") == "%SystemRoot%\\System32\\qwinsta.exe"
+    assert _resolve_winrm_cmd("logoff 2 /v") == "%SystemRoot%\\System32\\logoff.exe 2 /v"
+
+
 def test_run_winrm_rdp_monitor_update_downloads_bundle_from_sac(tmp_path: Path):
     repo = tmp_path / "repo"
     repo.mkdir()