From d57d5ddb2bd6130d1a46e8c87301de63177b1894 Mon Sep 17 00:00:00 2001
From: dex0shubham <shubham03workplace@gmail.com>
Date: Mon, 17 Aug 2026 14:03:38 +0100
Subject: [PATCH] fix(scripts): add UTF-8 BOM so non-ASCII .ps1 survive Windows
 PowerShell 5.1

PS 5.1 parses a BOM-less .ps1 as the system ANSI codepage, garbling the
Chinese / em-dash string literals in five scripts. verify-doc-facts.ps1
failed four checks under 5.1 (CI only ran it under pwsh). Add a BOM to the
five files and a CI guard that fails any non-ASCII .ps1 lacking one.
---
 .github/workflows/ci.yml                      | 24 +++++++++++++++++++
 CHANGELOG.md                                  |  2 ++
 skills/apk-reverse/scripts/frida-run.ps1      |  2 +-
 .../scripts/rebuild-sign-install.ps1          |  2 +-
 skills/ida-reverse/scripts/start.ps1          |  2 +-
 skills/radare2/scripts/recon.ps1              |  2 +-
 skills/scripts/verify-doc-facts.ps1           |  2 +-
 7 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ca6d51..233fb52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -165,6 +165,30 @@ jobs:
           }
           if ($failed -gt 0) { exit 1 }
 
+      - name: Non-ASCII .ps1 must carry a UTF-8 BOM (Windows PowerShell 5.1 safety)
+        shell: pwsh
+        run: |
+          # PS 5.1 parses a BOM-less .ps1 as the system ANSI codepage, garbling
+          # Chinese/em-dash string literals. Every non-ASCII script MUST have a BOM.
+          $files = git ls-files '*.ps1'
+          if (-not $files) { Write-Host 'No .ps1 files tracked'; exit 0 }
+          $bad = 0
+          foreach ($f in $files) {
+            $bytes = [System.IO.File]::ReadAllBytes((Resolve-Path $f))
+            $hasNonAscii = $false
+            foreach ($b in $bytes) { if ($b -ge 0x80) { $hasNonAscii = $true; break } }
+            if (-not $hasNonAscii) { continue }
+            $hasBom = $bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF
+            if ($hasBom) {
+              Write-Host "BOM OK: $f"
+            } else {
+              $bad++
+              Write-Host "::error file=$f::non-ASCII .ps1 lacks a UTF-8 BOM; add one so literals survive Windows PowerShell 5.1"
+            }
+          }
+          if ($bad -gt 0) { Write-Host "$bad file(s) need a UTF-8 BOM"; exit 1 }
+          Write-Host 'All non-ASCII .ps1 carry a UTF-8 BOM'
+
   leak-scan:
     name: field-journal leak scan
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a24ffa4..439e9ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
+### Fixed
+- **Windows PowerShell 5.1 encoding** — added a UTF-8 BOM to five non-ASCII `.ps1` scripts (`skills/scripts/verify-doc-facts.ps1`, `apk-reverse/scripts/frida-run.ps1`, `apk-reverse/scripts/rebuild-sign-install.ps1`, `ida-reverse/scripts/start.ps1`, `radare2/scripts/recon.ps1`). Without a BOM, PS 5.1 parses these files as the system ANSI codepage and garbles their Chinese / em-dash string literals; `verify-doc-facts.ps1` was failing four checks under 5.1 (CI only ran it under `pwsh`, which defaults to UTF-8). CI now guards every non-ASCII `.ps1` for a BOM.
 
 ## [1.0.1] — 2026-08-08
 ### Added
diff --git a/skills/apk-reverse/scripts/frida-run.ps1 b/skills/apk-reverse/scripts/frida-run.ps1
index 94abb4d..daa606c 100644
--- a/skills/apk-reverse/scripts/frida-run.ps1
+++ b/skills/apk-reverse/scripts/frida-run.ps1
@@ -1,4 +1,4 @@
-#requires -Version 5
+#requires -Version 5
 
 [CmdletBinding()]
 param(
diff --git a/skills/apk-reverse/scripts/rebuild-sign-install.ps1 b/skills/apk-reverse/scripts/rebuild-sign-install.ps1
index 0b6d200..ece4d03 100644
--- a/skills/apk-reverse/scripts/rebuild-sign-install.ps1
+++ b/skills/apk-reverse/scripts/rebuild-sign-install.ps1
@@ -1,4 +1,4 @@
-#requires -Version 5
+#requires -Version 5
 
 [CmdletBinding()]
 param(
diff --git a/skills/ida-reverse/scripts/start.ps1 b/skills/ida-reverse/scripts/start.ps1
index 90bce7a..d7f7abb 100644
--- a/skills/ida-reverse/scripts/start.ps1
+++ b/skills/ida-reverse/scripts/start.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
 Start IDA Pro MCP HTTP server (background, non-blocking)
 
diff --git a/skills/radare2/scripts/recon.ps1 b/skills/radare2/scripts/recon.ps1
index b1308da..895f8a5 100644
--- a/skills/radare2/scripts/recon.ps1
+++ b/skills/radare2/scripts/recon.ps1
@@ -1,4 +1,4 @@
-param(
+param(
     [Parameter(Mandatory = $true)]
     [string]$TargetPath,
 
diff --git a/skills/scripts/verify-doc-facts.ps1 b/skills/scripts/verify-doc-facts.ps1
index bfa688d..5e13305 100644
--- a/skills/scripts/verify-doc-facts.ps1
+++ b/skills/scripts/verify-doc-facts.ps1
@@ -1,4 +1,4 @@
-<#
+<#
 .SYNOPSIS
   Verify doc fact tables (capability lists, MCP ports, Burp tool count)
   against source-of-truth (bootstrap-manifest.json / McpHttpServer.java).