Reject --add-source when package source mapping is enabled

[Copilot]

Package source mapping filters sources to only those explicitly configured for each package pattern. Adding sources via --add-source bypasses this configuration, causing NuGet to fail later with unclear errors when the added source isn't in the mapping.

Changes

• Early validation: Added ValidateSourceMappingCompatibility method in LoadDefaultSources that detects when both package source mapping is enabled and AdditionalSourceFeed is populated, throwing immediately before NuGet operations
• Clear error message: Added CannotUseAddSourceWithSourceMapping resource string directing users to update their NuGet.config instead
• Test coverage: Added RejectsAdditionalSourceFeedsWhenMappingActive test verifying the validation triggers correctly

Example

Before this change, users would see confusing NuGet errors:

$ dotnet tool install mytool --add-source https://feed.example.com
error: Package 'mytool' is not found in the following primary source(s): ...

After this change:

$ dotnet tool install mytool --add-source https://feed.example.com
error: The --add-source option cannot be combined with package source mapping. To use an additional source, update your NuGet configuration file's source mapping settings. Learn more: https://aka.ms/nuget-package-source-mapping

Note: --source (which replaces all sources) remains compatible with package source mapping.

[!WARNING]

Original prompt

It does not make sense to use Package source mapping and the --add-source flag when using the .NET CLI. Today, we handle the source mapping configuration first and then add additional sources. This should error in nuget because the added source isn't in the source mapping. We should instead detect this situation in the .NET CLI and provide a more actionable error message that the --add-source option is not supported with package source mapping.

sdk/src/Cli/dotnet/NugetPackageDownloader/NuGetPackageDownloader.cs

Lines 412 to 444 in 10993e6

	}
	if (packageSourceLocation?.AdditionalSourceFeed?.Any() ?? false)
	{
	foreach (string source in packageSourceLocation?.AdditionalSourceFeed)
	{
	if (string.IsNullOrWhiteSpace(source))
	{
	continue;
	}
	PackageSource packageSource = new(source);
	if (packageSource.TrySourceAsUri == null)
	{
	_verboseLogger.LogWarning(string.Format(
	CliStrings.FailedToLoadNuGetSource,
	source));
	continue;
	}
	if (defaultSources.Any(defaultSource => defaultSource.SourceUri == packageSource.SourceUri))
	{
	continue;
	}
	defaultSources.Add(packageSource);
	}
	}
	return defaultSources;
	}
	public IEnumerable<PackageSource> LoadNuGetSources(PackageId packageId, PackageSourceLocation packageSourceLocation = null, PackageSourceMapping packageSourceMapping = null)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[marcpopMSFT]

@copilot The new warning is a little wordy. Can you remove the second sentence and modify the last sentence to read "To use an additional source, update your NuGet..."

[marcpopMSFT]

Tested and it works well. Error message is too long though so asked it to shorten the message. Nobody's got time to read all that.

[Copilot]

@copilot The new warning is a little wordy. Can you remove the second sentence and modify the last sentence to read "To use an additional source, update your NuGet..."

Updated the error message as requested in commit 43fdca5. The message now reads: "The --add-source option cannot be combined with package source mapping. To use an additional source, update your NuGet configuration file's source mapping settings. Learn more: https://aka.ms/nuget-package-source-mapping"

[Copilot]

Pull request overview

This PR improves the .NET CLI’s handling of NuGet Package Source Mapping by proactively rejecting --add-source when source mapping is enabled, producing a clearer, actionable error earlier in execution.

Changes:

• Added early validation in NuGetPackageDownloader.LoadDefaultSources to reject AdditionalSourceFeed when package source mapping is enabled.
• Introduced a new localized resource string (CannotUseAddSourceWithSourceMapping) for a clearer error message.
• Added a unit test to verify the new validation behavior.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.

File	Description
test/Microsoft.DotNet.PackageInstall.Tests/NuGetPackageInstallerTests.cs	Adds/adjusts tests to cover the new “reject --add-source with source mapping” validation path.
src/Cli/dotnet/NugetPackageDownloader/NuGetPackageDownloader.cs	Implements early compatibility validation between package source mapping and CLI-provided additional sources.
src/Cli/dotnet/CliStrings.resx	Adds the new user-facing error message resource.
src/Cli/dotnet/xlf/CliStrings.*.xlf	Adds the new trans-unit for localization across supported languages.