fix(cli): keep guest AppHost restore on the selected Aspire package source

src/Aspire.Cli/NuGet/BundleNuGetService.cs

@@ -164,7 +164,14 @@ public async Task<string> RestorePackagesAsync(
 
         _logger.LogDebug("Restoring {Count} packages", packageList.Count);
         _logger.LogDebug("aspire-managed path: {ManagedPath}", managedPath);
-        _logger.LogDebug("NuGet restore args: {Args}", string.Join(" ", restoreArgs));
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            // Build a redacted copy of the args specifically for the log line so user-supplied
+            // credentialed feeds (e.g., `https://user:pat@host/v3/index.json`, SAS-token URLs) do
+            // not flow to the debug log alongside the rest of the restore invocation. The
+            // original `restoreArgs` list is still passed verbatim to the process below.
+            _logger.LogDebug("NuGet restore args: {Args}", string.Join(" ", BuildRedactedArgsForLog(restoreArgs)));
+        }
 
         var environmentVariables = new Dictionary<string, string>();
         NuGetSignatureVerificationEnabler.Apply(environmentVariables, _features, _executionContext);
@@ -253,6 +260,25 @@ private static bool TryValidatePackageManifest(string manifestPath, ILogger logg
         }
     }
 
+    // Returns a redacted copy of the restore args suitable for debug logging. Replaces the value
+    // immediately following each `--source` token with the credential-safe form from
+    // PackageSourceRedactor. Built defensively to handle repeated `--source` flags and a missing
+    // trailing value at the end of the args list.
+    private static IReadOnlyList<string> BuildRedactedArgsForLog(IReadOnlyList<string> args)
+    {
+        var redacted = new List<string>(args.Count);
+        for (var i = 0; i < args.Count; i++)
+        {
+            redacted.Add(args[i]);
+            if (string.Equals(args[i], "--source", StringComparison.Ordinal) && i + 1 < args.Count)
+            {
+                redacted.Add(PackageSourceRedactor.RedactForDisplay(args[++i]));
+            }
+        }
+
+        return redacted;
+    }
+
     internal static string ComputePackageHash(
         List<(string Id, string Version)> packages,
         string tfm,

src/Aspire.Cli/Projects/DotNetBasedAppHostServerProject.cs

@@ -259,7 +259,8 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
     /// </summary>
     public async Task<(string ProjectPath, string? ChannelName)> CreateProjectFilesAsync(
         IEnumerable<IntegrationReference> integrations,
-        CancellationToken cancellationToken = default)
+        CancellationToken cancellationToken = default,
+        string? packageSourceOverride = null)
     {
         // Clean obj folder to ensure fresh NuGet restore
         var objPath = Path.Combine(_projectModelPath, "obj");
@@ -351,6 +352,20 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
             }
         }
 
+        // Thread an explicit `--source` override into the restore sources so the dogfood
+        // `aspire new --source <pr-hive>` flow is honored in dev mode (in-repo). Prepending
+        // makes the override the first source NuGet evaluates, which matters when the same
+        // Aspire package version exists in both the hive and a channel feed. Note: unlike
+        // PrebuiltAppHostServer this path does not emit Package Source Mappings, so NuGet
+        // may still consult other sources if the override does not satisfy a request — the
+        // override is best-effort here, sufficient for the in-repo developer scenario where
+        // most Aspire.* dependencies come from ProjectReference, not PackageReference.
+        if (!string.IsNullOrWhiteSpace(packageSourceOverride) &&
+            !channelSources.Contains(packageSourceOverride, StringComparer.OrdinalIgnoreCase))
+        {
+            channelSources.Insert(0, packageSourceOverride);
+        }
+
         // Create the project file
         var doc = CreateProjectFile(integrations);
 
@@ -422,9 +437,10 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
     public async Task<AppHostServerPrepareResult> PrepareAsync(
         string sdkVersion,
         IEnumerable<IntegrationReference> integrations,
-        CancellationToken cancellationToken = default)
+        CancellationToken cancellationToken = default,
+        string? packageSourceOverride = null)
     {
-        var (_, channelName) = await CreateProjectFilesAsync(integrations, cancellationToken);
+        var (_, channelName) = await CreateProjectFilesAsync(integrations, cancellationToken, packageSourceOverride);
         var (buildSuccess, buildOutput) = await BuildAsync(cancellationToken);
 
         if (!buildSuccess)

src/Aspire.Cli/Projects/GuestAppHostProject.cs

@@ -224,17 +224,18 @@ private string GetPrepareSdkVersion(AspireConfigFile config)
         IAppHostServerProject appHostServerProject,
         string sdkVersion,
         List<IntegrationReference> integrations,
-        CancellationToken cancellationToken)
+        CancellationToken cancellationToken,
+        string? packageSourceOverride = null)
     {
-        var result = await appHostServerProject.PrepareAsync(sdkVersion, integrations, cancellationToken);
+        var result = await appHostServerProject.PrepareAsync(sdkVersion, integrations, cancellationToken, packageSourceOverride: packageSourceOverride);
         return (result.Success, result.Output, result.ChannelName, result.NeedsCodeGeneration);
     }
 
     /// <summary>
     /// Builds the AppHost server project and generates SDK code.
     /// </summary>
     /// <returns><see langword="true"/> if the code was generated successfully; otherwise, <see langword="false"/>.</returns>
-    internal async Task<bool> BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken)
+    internal async Task<bool> BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken, string? packageSourceOverride = null)
     {
         var appHostServerProject = await _appHostServerProjectFactory.CreateAsync(directory.FullName, cancellationToken);
 
@@ -243,7 +244,7 @@ internal async Task<bool> BuildAndGenerateSdkAsync(DirectoryInfo directory, Canc
         var integrations = await GetIntegrationReferencesAsync(config, directory, cancellationToken);
         var sdkVersion = GetPrepareSdkVersion(config);
 
-        var (buildSuccess, buildOutput, _, _) = await PrepareAppHostServerAsync(appHostServerProject, sdkVersion, integrations, cancellationToken);
+        var (buildSuccess, buildOutput, _, _) = await PrepareAppHostServerAsync(appHostServerProject, sdkVersion, integrations, cancellationToken, packageSourceOverride);
         if (!buildSuccess)
         {
             if (buildOutput is not null)
@@ -280,9 +281,9 @@ await GenerateCodeViaRpcAsync(
         return true;
     }
 
-    Task<bool> IGuestAppHostSdkGenerator.BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken)
+    Task<bool> IGuestAppHostSdkGenerator.BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken, string? packageSourceOverride)
     {
-        return BuildAndGenerateSdkAsync(directory, cancellationToken);
+        return BuildAndGenerateSdkAsync(directory, cancellationToken, packageSourceOverride);
     }
 
     // ═══════════════════════════════════════════════════════════════

src/Aspire.Cli/Projects/IAppHostServerProject.cs

@@ -41,11 +41,13 @@ internal interface IAppHostServerProject
     /// <param name="sdkVersion">The Aspire SDK version to use.</param>
     /// <param name="integrations">The integration references (NuGet packages and/or project references) required by the app host.</param>
     /// <param name="cancellationToken">Cancellation token.</param>
+    /// <param name="packageSourceOverride">Optional package source to prefer for Aspire package restore.</param>
     /// <returns>The preparation result indicating success/failure and any output.</returns>
     Task<AppHostServerPrepareResult> PrepareAsync(
         string sdkVersion,
         IEnumerable<IntegrationReference> integrations,
-        CancellationToken cancellationToken = default);
+        CancellationToken cancellationToken = default,
+        string? packageSourceOverride = null);
 
     /// <summary>
     /// Runs the AppHost server process.

src/Aspire.Cli/Projects/IGuestAppHostSdkGenerator.cs

@@ -13,6 +13,7 @@ internal interface IGuestAppHostSdkGenerator
     /// </summary>
     /// <param name="directory">The AppHost project directory.</param>
     /// <param name="cancellationToken">A cancellation token.</param>
+    /// <param name="packageSourceOverride">Optional package source to prefer for Aspire package restore during the build.</param>
     /// <returns><see langword="true"/> if SDK generation succeeded; otherwise, <see langword="false"/>.</returns>
-    Task<bool> BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken);
+    Task<bool> BuildAndGenerateSdkAsync(DirectoryInfo directory, CancellationToken cancellationToken, string? packageSourceOverride = null);
 }