CopilotMarketplace DSC resource passes an unsupported name argument to registration

Finding

Severity: Medium. Reviewed commit: 5c38677469756c69f86678c0b907d82e15d0a539.

CopilotMarketplace.Set() calls copilot plugin marketplace add <Name> <Repository>, but the native Copilot CLI contract accepts a single <source> argument, not a custom name followed by a source. The configured Name occupies the source position, so the intended repository is not passed according to the documented command contract.

Source and evidence

• modules/Shmuelie.Dsc/Shmuelie.Dsc.psm1:417-423.
• Native GitHub Copilot CLI 1.0.85, read-only plugin marketplace add --help: Usage: copilot plugin marketplace add <source>. The source accepts owner/repo, URL or local path; no custom-name option is listed.
• Calling the real DSC Set method with only its private CLI helper replaced by a capturing fake produced plugin, marketplace, add, custom-name, owner/catalog for Name=custom-name; Repository=owner/catalog.
• Existing tests assert the same unsupported two-argument sequence, masking the contract mismatch. No marketplace registration was performed during this review.

Expected behavior / acceptance criteria

• Pass the configured repository/source in the supported native source position and do not invent a naming option.
• Clarify how the resource's Name property relates to the marketplace's actual registered identity; align Test/Get so applying the resource can converge.
• Add deterministic command-contract tests against the documented single-source syntax and preserve native failure reporting and argument validation.
• Keep validation non-mutating: use captured fake invocations and read-only native help, not real marketplace registration.

Start at modules/Shmuelie.Dsc/Shmuelie.Dsc.psm1:417-423 and inspect CopilotMarketplace.Set(), then review the existing tests that assert the two-argument command sequence. Compare Set, Test, and Get behavior with the documented single-source syntax using captured fake invocations. Done means the configured source is passed in the supported position, identity semantics are clarified, tests cover convergence and validation, and native failures remain reported.