From c61cb60c3fe66ef559c59bab966a97654d35304e Mon Sep 17 00:00:00 2001
From: Brad Lance <blance@mrbamm.xyz>
Date: Sun, 5 Jul 2026 19:53:36 -0500
Subject: [PATCH] Unblock WinSCP folder every run and fail loudly if Add-Type
 still can't load it

The Get-WinSCP.ps1 unblock-on-extract fix wasn't enough - if the WinSCP
folder is ever copied again afterward (network share, zip, sync tool),
Windows can reapply Mark-of-the-Web and silently re-block it. Unblock the
whole folder at the top of every engine.ps1 run instead of relying on
setup.bat timing. Also wrapped Add-Type in try/catch so a real load failure
now stops the run with a clear message instead of silently continuing into
a script that would only fail later once it actually tried to upload
something.
---
 engine.ps1 | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/engine.ps1 b/engine.ps1
index 68defc4..0f1a954 100644
--- a/engine.ps1
+++ b/engine.ps1
@@ -51,7 +51,21 @@ if (-not (Test-Path $winscpDll)) {
     Write-Log "error" "WinSCP DLL not found at $winscpDll"
     exit 1
 }
-Add-Type -Path $winscpDll
+
+# Unblock every run, regardless of how the WinSCP folder got here - Windows
+# tags files as untrusted ("Mark of the Web") if they were ever downloaded or
+# copied from a network share/zip, which blocks Add-Type from loading them.
+Get-ChildItem -Path (Join-Path $scriptRoot "WinSCP") -Recurse -File |
+    Unblock-File -ErrorAction SilentlyContinue
+
+try {
+    Add-Type -Path $winscpDll
+} catch {
+    Write-Host "ERROR: Could not load WinSCPnet.dll - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Try deleting the WinSCP\ folder and running setup.bat again." -ForegroundColor Yellow
+    Write-Log "error" "Add-Type failed for $winscpDll : $($_.Exception.Message)"
+    exit 1
+}
 
 # -- Entity config -------------------------------------------------------------
 $entityConfigFile = Join-Path $EntityDir "entity.json"