Fix RegisterPackageAsync to prevent access-after-free with package parameter

[Copilot]

Issue

The PackageDeploymentManager.RegisterPackageAsync() method fails while the WinRT counterpart PackageManager.RegisterPackageByFullNameAsync() succeeds. This occurred due to an access-after-free issue with the package parameter.

Root Cause

The bug was in RegisterPackageAsync() and similar methods when passing a packageFullName or packageFamilyName parameter. These methods were defined with parameters of type hstring (passing by value) rather than const winrt::hstring& (passing by reference).

When these methods use co_await, the parameter value might not be properly captured, leading to accessing memory that has been freed after the initial async operation starts. As noted in the issue, this manifests as:

• Methods returning with PackageDeploymentStatus::CompletedFailure, but empty error properties
• Remote procedure call failures
• Behavior that depends on heap layout, working in simple cases but failing in larger applications

Fix

Changed the parameter type in the following methods from hstring package to const winrt::hstring& package:

• RegisterPackageAsync
• AddPackageAsync
• StagePackageAsync
• RemovePackageAsync
• ResetPackageAsync
• RepairPackageAsync
• ProvisionPackageAsync
• DeprovisionPackageAsync

This ensures that parameters are properly referenced and captured before any co_await operations occur.

No IDL changes were needed since it uses String which maps to the C++ implementation.

Fixes #5.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.