[Mitch Denny (mitchdenny)]

Description

Use the shared directory helper when creating the CLI logs directory.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21276

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21276"

[Copilot]

🟢 Approval recommended

No blocking issues were identified, and focused regression tests cover the changed behaviors, though tests were not executed in this environment.

No open issues 🎉

What changed in this PR

This PR strengthens CLI diagnostic log privacy by using the shared directory helper and enforcing owner-only Unix permissions.

Changes:

• Restricts Unix log files, including reused files, while preserving existing custom-directory and Windows permissions.
• Handles access-denied initialization failures by warning and disabling file logging.
• Adds regression tests and documents diagnostic log privacy.

File	Description
tests/​Aspire.Cli.Tests/​Diagnostics/​FileLoggerProviderTests.cs	Tests permissions, initialization failures, and log persistence.
src/​Aspire.Cli/​README.md	Documents permissions and sensitive log content.
src/​Aspire.Cli/​Program.cs	Passes the dedicated logs directory to the provider.
src/​Aspire.Cli/​Diagnostics/​FileLoggerProvider.cs	Uses the shared helper and secures file creation and reuse.

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Jose Perez Rodriguez (joperezr)]

LGTM, thanks Mitch

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Tests selector

2 / 100 PR test projects · 4 PR jobs, from 5 changed files.

Selected PR test projects (2 / 100)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests

Selected PR jobs (4)

cli-starter-validation, extension-e2e, polyglot, typescript-api-compat

---

How these were chosen — grouped by what changed

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/Helpers/IntegrationHostLifetimeTestHelper.cs (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/IntegrationHostLifetimeTests.cs (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.Tests/Diagnostics/FileLoggerProviderTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

Job reasons

Job	Triggered by
cli-starter-validation	affected project Aspire.Cli
extension-e2e	• src/Aspire.Cli/Diagnostics/FileLoggerProvider.cs, src/Aspire.Cli/Program.cs • affected project Aspire.Cli
polyglot	affected project Aspire.Cli
typescript-api-compat	affected project Aspire.Cli

---

Selection computed for commit 1655ba8.

[Copilot]

🟡 Changes recommended

The shared Docker E2E exporter still produces private root-owned log copies that prevent non-root hosts from collecting diagnostics.

1 open issue

• Fix E2E diagnostics export permissions for host readability · New

_{Review effort: Balanced}

[Mitch Denny (mitchdenny)]

/backport to release/13.6

[github-actions]

Started backporting to release/13.6 (link to workflow run)

[aspire-repo-bot]

Mitch Denny (@mitchdenny) backporting to release/13.6 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Use shared helper for CLI log creation
Applying: Export container log copies for lifetime test evidence
Using index info to reconstruct a base tree...
A	tests/Aspire.Cli.EndToEnd.Tests/Helpers/IntegrationHostLifetimeTestHelper.cs
A	tests/Aspire.Cli.EndToEnd.Tests/IntegrationHostLifetimeTests.cs
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): tests/Aspire.Cli.EndToEnd.Tests/Helpers/IntegrationHostLifetimeTestHelper.cs deleted in HEAD and modified in Export container log copies for lifetime test evidence.  Version Export container log copies for lifetime test evidence of tests/Aspire.Cli.EndToEnd.Tests/Helpers/IntegrationHostLifetimeTestHelper.cs left in tree.
CONFLICT (modify/delete): tests/Aspire.Cli.EndToEnd.Tests/IntegrationHostLifetimeTests.cs deleted in HEAD and modified in Export container log copies for lifetime test evidence.  Version Export container log copies for lifetime test evidence of tests/Aspire.Cli.EndToEnd.Tests/IntegrationHostLifetimeTests.cs left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0002 Export container log copies for lifetime test evidence
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[aspire-repo-bot]

✅ No documentation update needed.

docs_optional → internal_refactor. No signals triggered (signal_count 0). The PR switches CLI log directory creation to a shared helper (FileLoggerProvider.cs, Program.cs, an internal README, and tests). It adds no new public surface, options, or user-visible strings.