Start-TssSecretChangePassword Manual path: SecureString leak + confusing error when -NextPassword supplied without -Type

[jagger]

Summary

Two related issues in the -Type Manual path of Start-TssSecretChangePassword.ps1 surfaced during the 0.62.1 review. Both live in the Manual branch and can be addressed in one PR.

1. NextPassword unwound to plaintext, logged via verbose, BSTR never zeroed

File: src/functions/secrets/Start-TssSecretChangePassword.ps1:74, 91, 94

Line 74 unwinds the -NextPassword [securestring] to plaintext without cleaning up the BSTR:

$rpcBody.data.Add('NextPassword', [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($NextPassword)))

Line 91 embeds the plaintext into $invokeParams.Body via ConvertTo-Json, and line 94 emits the entire body to Write-Verbose. Users running -Verbose (or capturing verbose transcripts for support tickets — which docs/getting_started/troubleshooting.md explicitly encourages) see the plaintext password.

Pre-existing behavior. Not new in 0.62.1, but the release added a new .EXAMPLE demonstrating the Manual path (Read-Host -AsSecureString -Prompt 'New password' ; Start-TssSecretChangePassword ... -NextPassword \$secure), which makes the leak more visible / more likely to be exercised.

Proposed fix:

• Capture the BSTR pointer to a local, use PtrToStringAuto, then call [Runtime.InteropServices.Marshal]::ZeroFreeBSTR(\$bstr) in a finally.
• Before Write-Verbose, produce a redacted copy of the body with NextPassword set to '***REDACTED***'.
• Consider the same treatment for the ShouldProcess message on line 86 which also embeds the body.

2. -NextPassword supplied without -Type now errors instead of prompting

File: src/functions/secrets/Start-TssSecretChangePassword.ps1:75-77

After 0.62.1's default of -Type = 'Random', callers who pass only -NextPassword \$secure (accidentally omitting -Type Manual) hit the Random branch and fail with:

-NextPassword parameter cannot be used with PasswordType of [Random]

In 0.62.0 this scenario would prompt for the mandatory -Type, giving the caller a chance to correct.

Proposed fix: either

• Auto-promote to Manual when -NextPassword is supplied and -Type was not explicitly bound (\$tssParams.ContainsKey('NextPassword') -and -not \$tssParams.ContainsKey('Type')), OR
• Improve the error message to suggest -Type Manual (e.g. Did you mean to pass -Type Manual?).

Discovery

Consolidated PR review of v0.62.0 → dev (0.62.1 candidate). The verbose leak (#1) is pre-existing but surfaced by the new .EXAMPLE. The error-vs-prompt regression (#2) is a direct consequence of the 0.62.1 default change (#444).