[Mitch Denny (mitchdenny)]

Description

Backport of #21276 to release/13.6.

Use the shared directory helper when creating the CLI logs directory.

Fixes # (issue)

Validation

• ./restore.sh — passed, 0 warnings and 0 errors.
• MSBUILDTERMINALLOGGER=false dotnet test --project tests/Aspire.Cli.Tests/Aspire.Cli.Tests.csproj --no-launch-profile -- --filter-class '*.FileLoggerProviderTests' --filter-class '*.ProgramTests' --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true' — passed, 23 tests, 0 failures and 0 skipped.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

Customer Impact

Makes CLI log creation use the shared helper.

Testing

Release restore passed; 23 focused logger and startup tests passed (exact commands recorded above).

Risk

Low. Localized CLI log creation change; no public API changes.

Regression?

Unknown.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21282

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21282"

[Copilot]

🟡 Changes recommended

Docker diagnostic exports retain owner-only permissions, preventing non-root host runners from collecting root-owned logs.

1 open issue

• Make exported Docker diagnostics logs readable by non-root runners · New

What changed in this PR

Backports #21276 to release/13.6, using the shared directory helper and tightening Unix permissions for CLI diagnostic logs.

Changes:

• Restricts log files to 0600 and repairs the dedicated logs directory to 0700, while preserving existing custom-directory permissions.
• Handles access-denied failures without preventing CLI startup.
• Adds permission and logging regression tests, plus diagnostic privacy documentation.

File	Description
tests/​Aspire.Cli.Tests/​Diagnostics/​FileLoggerProviderTests.cs	Tests permissions, access failures, and log persistence.
src/​Aspire.Cli/​README.md	Documents log privacy and sensitive content.
src/​Aspire.Cli/​Program.cs	Passes the dedicated logs directory to the provider.
src/​Aspire.Cli/​Diagnostics/​FileLoggerProvider.cs	Applies private Unix permissions and handles creation failures.

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching 'eng/Versions.props' selects ALL

---

Selection computed for commit 2bdc68a.

[Copilot]

🔵 Needs a closer look

The previously reported container-to-host diagnostic export compatibility concern remains unresolved in the supplied review context.

No open issues 🎉

1 resolved since last review

• Make exported Docker diagnostics logs readable by non-root runners

_{Review effort: Balanced}

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[aspire-repo-bot]

✅ No documentation update needed.

excluded → backport. exclusion_reasons: base_branch_is_release, title_release_prefix ([release/13.6]), body_backport_marker. Triggered signals: pr_body_has_cli_flag_mention (evidence: test command --no-launch-profile in PR body). Docs belong to the original forward PR; no docs PR drafted.