fix: UTF-8 BOM in RDP bundle zip for Russian Windows PowerShell (0.20.16)

backend/app/services/rdp_bundle_delivery.py

@@ -10,6 +10,8 @@ from pathlib import Path
 from threading import Lock
 
 TTL_SECONDS = 600
+_UTF8_BOM = b"\xef\xbb\xbf"
+_BOM_SUFFIXES = {".ps1", ".txt"}
 
 _lock = Lock()
 _entries: dict[str, tuple[bytes, float]] = {}
@@ -21,13 +23,23 @@ def _prune_expired(now: float) -> None:
         _entries.pop(token, None)
 
 
+def _bundle_file_bytes(path: Path) -> bytes:
+    data = path.read_bytes()
+    if path.suffix.lower() in _BOM_SUFFIXES and not data.startswith(_UTF8_BOM):
+        return _UTF8_BOM + data
+    return data
+
+
 def build_rdp_bundle_zip(repo_dir: Path, filenames: tuple[str, ...]) -> bytes:
     buffer = io.BytesIO()
     with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED) as archive:
         for name in filenames:
             path = repo_dir / name
             if path.is_file():
-                archive.write(path, name)
+                info = zipfile.ZipInfo(name)
+                info.compress_type = zipfile.ZIP_DEFLATED
+                info.flag_bits |= 0x800
+                archive.writestr(info, _bundle_file_bytes(path))
     return buffer.getvalue()
 
 

backend/app/services/winrm_connect.py

@@ -339,7 +339,7 @@ def _deploy_from_staging_body(staging_path: str) -> str:
         "$deploy = Join-Path $staging 'Deploy-LoginMonitor.ps1'\n"
         "if (-not (Test-Path -LiteralPath $deploy)) { throw \"Deploy-LoginMonitor.ps1 missing in staging\" }\n"
         "Write-Output \"Running: $deploy -SourceShareRoot $staging\"\n"
-        "& $deploy -SourceShareRoot $staging\n"
+        "powershell.exe -NoProfile -ExecutionPolicy Bypass -File $deploy -SourceShareRoot $staging\n"
     )
 
 
@@ -358,7 +358,8 @@ def _download_bundle_body(staging_path: str, bundle_url: str) -> str:
         "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n"
         "Write-Output \"Downloading bundle: $url\"\n"
         "Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing\n"
-        "Expand-Archive -LiteralPath $zip -DestinationPath $staging -Force\n"
+        "Add-Type -AssemblyName System.IO.Compression.FileSystem\n"
+        "[System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $staging)\n"
         "Remove-Item -LiteralPath $zip -Force\n"
         "Write-Output \"Bundle extracted to $staging\"\n"
     )

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.15"
+APP_VERSION = "0.20.16"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"