fix(installer): pass service password via env, not the exe command line

install-service.ps1 previously appended --password <value> to the exe
invocation, exposing the secret on the exe's process command line
(readable by any local process via Win32_Process for the install
window). It now sets WINDOWS_SERVICE_INSTALL_PASSWORD in the environment
and clears it in a finally.

win_service.py reads that variable and splices --password into the
in-memory arg list handed to pywin32 HandleCommandLine (which parses a
Python list and calls CreateService directly), so the password reaches
SCM without ever being a process command-line argument. The splice logic
lives in a new pywin32-free module, service_install_password, with unit
tests for the install/non-install, empty, no-duplication and
non-mutation cases.

SYNC-461

Author: zendern

template/{% if has_backend %}backend{% endif %}/src/backend_api/entrypoint/{% if install_as_windows_service %}service_install_password.py{% endif %}

@@ -0,0 +1,37 @@
+import os
+from collections.abc import Mapping
+from collections.abc import Sequence
+
+# Must match the $env: name set in installer/scripts/install-service.ps1.
+SERVICE_INSTALL_PASSWORD_ENV = "WINDOWS_SERVICE_INSTALL_PASSWORD"
+
+_INSTALL_SUBCOMMAND = "install"
+
+
+def inject_install_password(
+    install_args: Sequence[str],
+    env: Mapping[str, str] | None = None,
+) -> list[str]:
+    """Splice ``--password <value>`` from the environment into an ``install`` arg list.
+
+    install-service.ps1 passes the service password via the environment rather than on the
+    exe's command line (which is readable by any local process for the install window). Here
+    we read it back and insert it into the in-memory arg list handed to pywin32's
+    HandleCommandLine, so the secret reaches CreateService without ever appearing in a
+    process command line.
+
+    pywin32 uses POSIX getopt, which requires options before the subcommand, so the flag is
+    inserted immediately before the ``install`` verb. Any other subcommand, an unset/empty
+    password, or an arg list that already carries ``--password`` is returned unchanged.
+    """
+    args = list(install_args)
+    resolved_env = os.environ if env is None else env
+    password = resolved_env.get(SERVICE_INSTALL_PASSWORD_ENV)
+    if not password:
+        return args
+    if _INSTALL_SUBCOMMAND not in args:
+        return args
+    if "--password" in args:
+        return args
+    idx = args.index(_INSTALL_SUBCOMMAND)
+    return [*args[:idx], "--password", password, *args[idx:]]

template/{% if has_backend %}backend{% endif %}/src/backend_api/entrypoint/{% if install_as_windows_service %}win_service.py{% endif %}

@@ -19,6 +19,7 @@ from ..jinja_constants import APP_NAME
 from ..jinja_constants import WINDOWS_SERVICE_DISPLAY_NAME
 from ..jinja_constants import WINDOWS_SERVICE_NAME
 from .parser import parser
+from .service_install_password import inject_install_password
 
 CRASH_DUMP_FILENAME = "service-crash.log"
 _SERVICE_MANAGEMENT_COMMANDS = frozenset({"install", "start", "stop", "remove", "debug"})
@@ -134,6 +135,10 @@ def dispatch_windows_service(argv: Sequence[str]) -> int:
             # pywin32 reads _exe_args_ at install time and bakes the suffix into the ImagePath
             # registry value itself — no post-install registry patching needed.
             AppService._exe_args_ = subprocess.list2cmdline(["service", *runtime_args])
+            # The service password arrives via the environment, not the command line (which any
+            # local process can read); splice it into the in-memory arg list here so it reaches
+            # CreateService without ever appearing in the exe's process command line.
+            install_args = inject_install_password(install_args)
         win32serviceutil.HandleCommandLine(AppService, argv=[sys.argv[0], *install_args])
     else:
         servicemanager.Initialize()

template/{% if has_backend %}backend{% endif %}/tests/unit/entrypoint/{% if install_as_windows_service %}test_service_install_password.py{% endif %}

@@ -0,0 +1,45 @@
+import pytest
+from backend_api.entrypoint.service_install_password import SERVICE_INSTALL_PASSWORD_ENV
+from backend_api.entrypoint.service_install_password import inject_install_password
+
+
+def test_Given_no_password_env_var__Then_args_unchanged():
+    args = ["--username", ".\\svc", "--startup", "auto", "install"]
+
+    assert inject_install_password(args, env={}) == args
+
+
+def test_Given_password_env_var__Then_spliced_before_install_subcommand():
+    # pywin32 uses POSIX getopt, so options must come before the subcommand.
+    args = ["--username", ".\\svc", "--startup", "auto", "install"]
+
+    result = inject_install_password(args, env={SERVICE_INSTALL_PASSWORD_ENV: "s3cret"})
+
+    assert result == ["--username", ".\\svc", "--startup", "auto", "--password", "s3cret", "install"]
+
+
+@pytest.mark.parametrize("verb", ["start", "stop", "remove", "debug"])
+def test_Given_non_install_subcommand__Then_password_not_injected(verb: str):
+    args = [verb]
+
+    assert inject_install_password(args, env={SERVICE_INSTALL_PASSWORD_ENV: "s3cret"}) == args
+
+
+def test_Given_empty_password__Then_treated_as_unset():
+    args = ["install"]
+
+    assert inject_install_password(args, env={SERVICE_INSTALL_PASSWORD_ENV: ""}) == args
+
+
+def test_Given_password_already_present__Then_not_duplicated():
+    args = ["--username", ".\\svc", "--password", "already", "install"]
+
+    assert inject_install_password(args, env={SERVICE_INSTALL_PASSWORD_ENV: "s3cret"}) == args
+
+
+def test_Given_call__Then_input_list_not_mutated():
+    args = ["install"]
+
+    _ = inject_install_password(args, env={SERVICE_INSTALL_PASSWORD_ENV: "s3cret"})
+
+    assert args == ["install"]

template/{% if install_as_windows_service %}installer{% endif %}/scripts/install-service.ps1.jinja

@@ -55,24 +55,25 @@ if ($ServiceAccount -ieq 'custom') {
     & icacls $LogDir /grant "${rightsAccount}:(OI)(CI)M" /T | Out-Null
     if ($LASTEXITCODE -ne 0) { throw "icacls failed to grant Modify on $LogDir for $rightsAccount (exit $LASTEXITCODE)" }
 
-    $installArgs += @('--username', $account, '--password', $Password)
+    # The password is NOT passed on the command line: the exe's process command line is
+    # readable by any local process (Win32_Process) for the install window. It travels via
+    # an environment variable instead, which win_service.py reads and splices into pywin32's
+    # in-memory HandleCommandLine arg list. The var name must match SERVICE_INSTALL_PASSWORD_ENV
+    # in backend_api.entrypoint.service_install_password.
+    $installArgs += @('--username', $account)
+    $env:WINDOWS_SERVICE_INSTALL_PASSWORD = $Password
 }
 
 $installArgs += @('--startup', 'auto', 'install', '--', '--port', $Port, '--log-folder', $LogDir)
 
-$logArgs = @()
-$maskNext = $false
-foreach ($arg in $installArgs) {
-    if ($maskNext) {
-        $logArgs += '***'
-        $maskNext = $false
-        continue
-    }
-    $logArgs += $arg
-    if ($arg -eq '--password') { $maskNext = $true }
+# $installArgs no longer carries the password, so it is safe to log verbatim.
+Write-Host "Installing service: $ExePath $($installArgs -join ' ')"
+try {
+    & $ExePath @installArgs
+}
+finally {
+    Remove-Item Env:\WINDOWS_SERVICE_INSTALL_PASSWORD -ErrorAction SilentlyContinue
 }
-Write-Host "Installing service: $ExePath $($logArgs -join ' ')"
-& $ExePath @installArgs
 if ($LASTEXITCODE -ne 0) { throw "Service install failed (exit $LASTEXITCODE)" }
 
 Write-Host "Starting service $ServiceName"