fix: WinRM RDP update PowerShell quoting via EncodedCommand (0.20.10)

Broken -Command quotes caused ParserError on remote hosts; run deploy script through base64-encoded PowerShell.

backend/app/services/winrm_connect.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import base64
 import socket
 from dataclasses import dataclass
 
@@ -140,17 +141,37 @@ def run_winrm_logoff(*, target: str, user: str, password: str, session_id: int)
     )
 
 
+def _encode_powershell(script: str) -> str:
+    return base64.b64encode(script.encode("utf-16-le")).decode("ascii")
+
+
+def _powershell_literal_path(path: str) -> str:
+    return path.replace("'", "''")
+
+
 def _winrm_rdp_update_remote_cmd(script_path: str) -> str:
     script = script_path.strip()
     if script:
-        return f'powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{script}"'
+        literal = _powershell_literal_path(script)
+        ps = (
+            f"$p = '{literal}'\n"
+            "if (-not (Test-Path -LiteralPath $p)) { throw 'Deploy script not found' }\n"
+            "& $p"
+        )
+    else:
+        ps = (
+            "$candidates = @(\n"
+            "  (Join-Path $env:ProgramData 'LoginMonitor\\Deploy-LoginMonitor.ps1'),\n"
+            "  (Join-Path $env:USERPROFILE 'Deploy-LoginMonitor.ps1')\n"
+            ")\n"
+            "$p = $candidates | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1\n"
+            "if (-not $p) { throw 'Deploy-LoginMonitor.ps1 not found' }\n"
+            "& $p"
+        )
+    encoded = _encode_powershell(ps)
     return (
-        "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "
-        '"& { $candidates = @('
-        "(Join-Path $env:ProgramData 'LoginMonitor' 'Deploy-LoginMonitor.ps1'),"
-        "(Join-Path $env:USERPROFILE 'Deploy-LoginMonitor.ps1')"
-        '); $p = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1; '
-        "if (-not $p) { throw 'Deploy-LoginMonitor.ps1 not found' }; & $p }'"
+        "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass "
+        f"-EncodedCommand {encoded}"
     )
 
 

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.9"
+APP_VERSION = "0.20.10"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"