Fix Corepack shim and disable it by default

src/artifacts-helper/README.md

@@ -24,7 +24,7 @@ Configures Codespace to authenticate with Azure Artifact feeds
 | npxAlias | Create alias for npx | boolean | true |
 | rushAlias | Create alias for rush | boolean | true |
 | pnpmAlias | Create alias for pnpm | boolean | true |
-| corepackAlias | Create alias for corepack | boolean | true |
+| corepackAlias | Create alias for corepack | boolean | false |
 | azAlias | Create alias for az (Azure CLI) | boolean | true |
 | shimDirectory | Directory where the shims will be installed. This must be in $PATH, and needs to be as early as possible in priority for the scripts to override the base executables. | string | /usr/local/share/codespace-shims |
 | targetFiles | Comma separated list of files to write to. Default is '/etc/bash.bashrc,/etc/zsh/zshrc' for root and '~/.bashrc,~/.zshrc' for non-root | string | DEFAULT |

src/artifacts-helper/devcontainer-feature.json

@@ -1,7 +1,7 @@
 {
     "name": "Azure Artifacts Credential Helper",
     "id": "artifacts-helper",
-    "version": "3.1.0",
+    "version": "3.1.1",
     "description": "Configures Codespace to authenticate with Azure Artifact feeds",
     "options": {
         "nugetURIPrefixes": {
@@ -51,7 +51,7 @@
         },
         "corepackAlias": {
             "type": "boolean",
-            "default": true,
+            "default": false,
             "description": "Create alias for corepack"
         },
         "azAlias": {

src/artifacts-helper/install.sh

@@ -11,7 +11,7 @@ ALIAS_YARN="${YARNALIAS:-"true"}"
 ALIAS_NPX="${NPXALIAS:-"true"}"
 ALIAS_RUSH="${RUSHALIAS:-"true"}"
 ALIAS_PNPM="${PNPMALIAS:-"true"}"
-ALIAS_COREPACK="${COREPACKALIAS:-"true"}"
+ALIAS_COREPACK="${COREPACKALIAS:-"false"}"
 ALIAS_AZ="${AZALIAS:-"true"}"
 INSTALL_PIP_HELPER="${PYTHON:-"false"}"
 SHIM_DIRECTORY="${SHIMDIRECTORY:-"/usr/local/share/codespace-shims/"}"

src/artifacts-helper/scripts/corepack

@@ -1,15 +1,40 @@
 #!/bin/bash
 
+source "$(dirname "$0")"/resolve-shim.sh
+
 # If ACTIONS_ID_TOKEN_REQUEST_URL is set, we're in GitHub Actions - skip Azure DevOps setup
+if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
+  source "$(dirname "$0")"/auth-ado.sh
+fi
+
+# Corepack otherwise uses `which corepack`, which resolves to this shim and causes
+# enable/disable to modify the protected shim directory instead of Node's bin directory.
+COREPACK_EXE="$(resolve_shim)"
+COREPACK_ARGS=("$@")
+case "${1:-}" in
+  enable|disable)
+    INSTALL_DIRECTORY_SET=false
+    for arg in "${COREPACK_ARGS[@]:1}"; do
+      if [[ "${arg}" == "--install-directory" || "${arg}" == --install-directory=* ]]; then
+        INSTALL_DIRECTORY_SET=true
+        break
+      fi
+    done
+
+    if [[ "${INSTALL_DIRECTORY_SET}" == "false" ]]; then
+      COREPACK_ARGS=(
+        "${1}"
+        "--install-directory"
+        "$(dirname "${COREPACK_EXE}")"
+        "${COREPACK_ARGS[@]:1}"
+      )
+    fi
+    ;;
+esac
+
 if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
-  source "$(dirname "$0")"/resolve-shim.sh
-  COREPACK_EXE="$(resolve_shim)"
-  "${COREPACK_EXE}" "$@"
+  "${COREPACK_EXE}" "${COREPACK_ARGS[@]}"
   exit $?
 fi
 
-source "$(dirname "$0")"/auth-ado.sh
-source "$(dirname "$0")"/resolve-shim.sh
-
-COREPACK_EXE="$(resolve_shim)"
-ARTIFACTS_ACCESSTOKEN="${ARTIFACTS_ACCESSTOKEN:-}" "${COREPACK_EXE}" "$@"
+ARTIFACTS_ACCESSTOKEN="${ARTIFACTS_ACCESSTOKEN:-}" "${COREPACK_EXE}" "${COREPACK_ARGS[@]}"

test/artifacts-helper/scenarios.json

@@ -56,7 +56,8 @@
             "artifacts-helper": {
                 "dotnetAlias": true,
                 "npmAlias": true,
-                "nugetAlias": true
+                "nugetAlias": true,
+                "corepackAlias": true
             }
         }
     },
@@ -79,7 +80,8 @@
             "artifacts-helper": {
                 "dotnetAlias": true,
                 "npmAlias": true,
-                "nugetAlias": true
+                "nugetAlias": true,
+                "corepackAlias": true
             }
         }
     },

test/artifacts-helper/test_auth_wait.sh

@@ -7,6 +7,7 @@ source dev-container-features-test-lib || exit 1
 check "dotnet shim exists" test -f /usr/local/share/codespace-shims/dotnet
 check "npm shim exists" test -f /usr/local/share/codespace-shims/npm
 check "nuget shim exists" test -f /usr/local/share/codespace-shims/nuget
+check "corepack shim is disabled by default" test ! -e /usr/local/share/codespace-shims/corepack
 
 # Test that auth-ado.sh can be sourced without exiting the shell
 export MAX_WAIT=5

test/artifacts-helper/test_shim_integration.sh

@@ -36,6 +36,35 @@ check "dotnet alias has quoted path and passes args" grep -q 'dotnet() { ".*/dot
 check "npm alias has quoted path and passes args" grep -q 'npm() { ".*/npm" "\$@"; }' /etc/bash.bashrc
 check "corepack alias has quoted path and passes args" grep -q 'corepack() { ".*/corepack" "\$@"; }' /etc/bash.bashrc
 
+# Verify Corepack lifecycle commands target the real binary directory rather than the shim directory.
+check "corepack enable targets the real binary directory" bash -c '
+    TEST_DIR=$(mktemp -d)
+    trap "rm -rf \"$TEST_DIR\"" EXIT
+    mkdir -p "$TEST_DIR/bin"
+    printf "#!/bin/bash\nprintf \"%%s\\n\" \"\$@\" > \"%s/args\"\n" "$TEST_DIR" > "$TEST_DIR/bin/corepack"
+    chmod +x "$TEST_DIR/bin/corepack"
+
+    PATH="/usr/local/share/codespace-shims:$TEST_DIR/bin:/usr/bin:/bin" \
+      ACTIONS_ID_TOKEN_REQUEST_URL=test \
+      /usr/local/share/codespace-shims/corepack enable pnpm
+
+    diff -u <(printf "enable\n--install-directory\n%s/bin\npnpm\n" "$TEST_DIR") "$TEST_DIR/args"
+'
+
+check "corepack preserves an explicit install directory" bash -c '
+    TEST_DIR=$(mktemp -d)
+    trap "rm -rf \"$TEST_DIR\"" EXIT
+    mkdir -p "$TEST_DIR/bin"
+    printf "#!/bin/bash\nprintf \"%%s\\n\" \"\$@\" > \"%s/args\"\n" "$TEST_DIR" > "$TEST_DIR/bin/corepack"
+    chmod +x "$TEST_DIR/bin/corepack"
+
+    PATH="/usr/local/share/codespace-shims:$TEST_DIR/bin:/usr/bin:/bin" \
+      ACTIONS_ID_TOKEN_REQUEST_URL=test \
+      /usr/local/share/codespace-shims/corepack disable --install-directory /tmp/corepack yarn
+
+    diff -u <(printf "disable\n--install-directory\n/tmp/corepack\nyarn\n") "$TEST_DIR/args"
+'
+
 # Verify newlines between shim definitions (each function should be on its own line)
 check "each shim function is on its own line" bash -c '
     # Count function definitions at line starts - with proper newlines each will start at column 0