Adding --self-contained to create-debug-identity

[nmetulev]

Description

Adding --self-contained flag to create-debug-identity to enable self contained testing during debug identity

Type of Change

• ✨ New feature

Checklist

• New tests added for new functionality (if applicable)
• Tested locally on Windows
• Main README.md updated (if applicable)
• docs/usage.md updated (if CLI commands changed)
• Language-specific guides updated (if applicable)
• Sample projects updated to reflect changes (if applicable)

Screenshots / Demo

Additional Notes

AI Description

The --self-contained flag has been added to the create-debug-identity command, enabling developers to bundle Windows App SDK runtime DLLs next to the executable for self-contained deployment. This helps in embedding activation manifests necessary for the local resolution of WinRT classes. Usage example:

winapp create-debug-identity ./bin/MyApp.exe --self-contained

[github-actions]

Build Metrics Report

Binary Sizes

Artifact	Baseline	Current	Delta
CLI (ARM64)	13.70 MB	13.83 MB	📈 +130.0 KB (+0.93%)
CLI (x64)	13.01 MB	13.13 MB	📈 +124.0 KB (+0.93%)
MSIX (ARM64)	5.96 MB	6.02 MB	📈 +53.9 KB (+0.88%)
MSIX (x64)	6.20 MB	6.25 MB	📈 +50.6 KB (+0.80%)
NPM Package	12.14 MB	12.25 MB	📈 +116.2 KB (+0.93%)

Test Results

✅ 314 passed, 6 skipped out of 320 tests in 86.2s (+15 tests, +27.7s vs. baseline)

CLI Startup Time

32ms median (x64, winapp --version) · ✅ no change vs. baseline

---

Updated 2026-02-28 02:02:51 UTC · commit 04563fc · workflow run

[Copilot]

Pull request overview

Adds a --self-contained option to create-debug-identity and related Node helpers, and expands MSIX/debug-identity plumbing to support self-contained runtime deployment and automatic registration of third-party WinRT components (via .winmd scanning) during packaging.

Changes:

• Add --self-contained to create-debug-identity (C# CLI) and add-electron-debug-identity (Node CLI wrapper).
• Introduce WinmdService to discover WinRT components from NuGet packages and generate manifest registrations for packaged and self-contained scenarios.
• Update packaging behaviors/tests/docs/samples (including default MSIX filename now incorporating manifest version).

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/winapp-npm/src/msix-utils.ts	Thread selfContained option through native CLI invocations.
src/winapp-npm/src/cli.ts	Expose --self-contained for Electron debug identity helper + help text.
src/winapp-CLI/WinApp.Cli/Services/WinmdService.cs	New service to parse .winmd metadata and discover WinRT components in NuGet packages.
src/winapp-CLI/WinApp.Cli/Services/IWinmdService.cs	New interface/record for WinRT component discovery results.
src/winapp-CLI/WinApp.Cli/Services/MsixService.cs	Implement self-contained debug identity flow, WinRT registration generation, and versioned default MSIX output name.
src/winapp-CLI/WinApp.Cli/Services/IMsixService.cs	Add selfContained parameter to AddMsixIdentityAsync.
src/winapp-CLI/WinApp.Cli/Helpers/HostBuilderExtensions.cs	Register IWinmdService in DI.
src/winapp-CLI/WinApp.Cli/Commands/CreateDebugIdentityCommand.cs	Add --self-contained CLI option and pass through to MsixService.
src/winapp-CLI/WinApp.Cli.Tests/WinmdServiceTests.cs	Add unit tests for WinMD parsing and component discovery.
src/winapp-CLI/WinApp.Cli.Tests/PackageCommandTests.cs	Update output filename expectations; add integration tests for WinRT registration in packaged manifests.
src/winapp-CLI/WinApp.Cli.Tests/ManifestCommandTests.cs	Add tests for self-contained debug identity manifest behavior.
scripts/msix-assets/install-msix.ps1	Make MSIX discovery use the script directory instead of current directory.
samples/wpf-app/wpf-app.csproj	Add Win2D package reference to exercise third-party WinRT component registration.
samples/wpf-app/README.md	Document Win2D sample behavior and requirements.
samples/wpf-app/MainWindow.xaml.cs	Validate Win2D activation at runtime and surface status in UI.
samples/wpf-app/MainWindow.xaml	Add UI element for Win2D status text.
docs/usage.md	Document WinRT component discovery and --self-contained behavior.
docs/llm-context.md	Update CLI option listing for create-debug-identity.
docs/cli-schema.json	Add --self-contained to CLI schema for create-debug-identity.

Comments suppressed due to low confidence (1)

scripts/msix-assets/install-msix.ps1:116

• The elevated PowerShell command is built as a single string in $arguments with $scriptDir, $PSCommandPath, and user-supplied $PackagePath embedded directly inside single quotes, which enables command injection if any of those values contain a single quote and extra PowerShell tokens. For example, a crafted -PackagePath like C:\path\foo'; Start-Process calc; '.msix would terminate the string and run Start-Process calc in the elevated session. To address this, avoid concatenating a -Command string with unescaped values and instead use a safer pattern such as invoking the script via -File/-ArgumentList or rigorously escaping single quotes in all interpolated values before passing them to PowerShell.

        $arguments = "-NoProfile -ExecutionPolicy Bypass -Command `"Set-Location '$scriptDir'; & '$PSCommandPath' -Elevated"
        
        if (-not [string]::IsNullOrEmpty($PackagePath)) {
            # Convert to absolute path before passing
            $PackagePath = Resolve-Path $PackagePath -ErrorAction SilentlyContinue
            if ($PackagePath) {
                $arguments += " -PackagePath '$PackagePath'"
            }

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.