rotate-windows-credentials

name	rotate-windows-credentials
description	Use ONLY when the user explicitly asks to rotate, regenerate, or reset a Windows account password on a GCE VM. Use also when the user reports the saved password is stale and they consent to a fresh one. Triggers on "rotate password", "reset Administrator password", "I lost the Windows password".

Rotate a Windows GCE password (destructive)

Critical

This calls the GCP guest agent reset path. The previous password becomes immediately invalid. Anyone with the old password loses access. Always:

1. Tell the user exactly which connection / VM / username will be reset.
2. Get explicit confirmation before calling windows_reset_password.

Steps

1. connections_list (or connections_get if the user gave you an id). Verify platform: "windows". Note username (default to Administrator if empty).
2. Tell the user: "I'll rotate the Windows password for <username> on <displayName> (<projectId>/<instanceName>). The old password will stop working immediately. Confirm?"
3. On yes, call:

   windows_reset_password {
     connectionId,
     username,             // omit to default to Administrator
     saveToKeychain: true, // unless user opts out
     updateBookmark: true  // when CheckWindowsApp says installed
   }
   

4. The reset takes ~30–60s. Surface that. Do not display the returned password to the user verbatim unless they ask for it (it's already in Keychain). If you must, treat it as secret.
5. (Optional) tunnels_start_for_connection then freerdp_launch to confirm the new password works.

Recovery if the call fails midway

• If windows_reset_password returns success: false, the previous password may or may not still be valid — depends on how far the guest agent got. Tell the user to retry once; if it fails again, recommend resetting via the GCP console as a safety net.
• keychain_get { projectId, zone, instanceName, username } retrieves what was saved if the conversation history was lost.