fix(cli): keep guest AppHost restore on the selected Aspire package source

src/Aspire.Cli/Commands/NewCommand.cs

@@ -412,6 +412,13 @@ protected override async Task<CommandResult> ExecuteAsync(ParseResult parseResul
     {
         using var activity = Telemetry.StartDiagnosticActivity(this.Name);
 
+        var source = parseResult.GetValue(s_sourceOption);
+        if (!string.IsNullOrWhiteSpace(source) && PackageSourceOverrideMappings.HasCredentialMaterial(source))
+        {
+            InteractionService.DisplayError(NewCommandStrings.SourceWithCredentialsCannotBePersisted);
+            return CommandResult.Failure(CliExitCodes.InvalidCommand);
+        }
+
         // Resolve which templates are actually available at runtime (performs
         // async checks like SDK availability). This may be a subset of the
         // templates registered as subcommands.
@@ -448,7 +455,7 @@ protected override async Task<CommandResult> ExecuteAsync(ParseResult parseResul
         {
             Name = parseResult.GetValue(s_nameOption),
             Output = parseResult.GetValue(s_outputOption),
-            Source = parseResult.GetValue(s_sourceOption),
+            Source = source,
             Version = version,
             Channel = parseResult.GetValue(_channelOption) ?? resolvedChannelName,
             Language = selectedLanguageId

src/Aspire.Cli/Commands/RestoreCommand.cs

@@ -99,7 +99,7 @@ protected override async Task<CommandResult> ExecuteAsync(ParseResult parseResul
 
                 var success = await _interactionService.ShowStatusAsync(
                     RestoreCommandStrings.RestoringSdkCode,
-                    async () => await configOnlyGuestProject.BuildAndGenerateSdkAsync(configOnlyProjectDirectory, cancellationToken),
+                    async () => await configOnlyGuestProject.BuildAndGenerateSdkAsync(configOnlyProjectDirectory, cancellationToken: cancellationToken),
                     emoji: KnownEmojis.Gear);
 
                 if (success)
@@ -156,7 +156,7 @@ protected override async Task<CommandResult> ExecuteAsync(ParseResult parseResul
 
                 var success = await _interactionService.ShowStatusAsync(
                     RestoreCommandStrings.RestoringSdkCode,
-                    async () => await guestProject.BuildAndGenerateSdkAsync(directory, cancellationToken),
+                    async () => await guestProject.BuildAndGenerateSdkAsync(directory, cancellationToken: cancellationToken),
                     emoji: KnownEmojis.Gear);
 
                 if (success)

src/Aspire.Cli/Commands/Sdk/SdkDumpCommand.cs

@@ -147,7 +147,7 @@ private async Task<int> DumpCapabilitiesAsync(
             var prepareResult = await appHostServerProject.PrepareAsync(
                 VersionHelper.GetDefaultTemplateVersion(),
                 integrations,
-                cancellationToken);
+                cancellationToken: cancellationToken);
 
             if (!prepareResult.Success)
             {

src/Aspire.Cli/Commands/Sdk/SdkGenerateCommand.cs

@@ -142,7 +142,7 @@ private async Task<int> GenerateSdkAsync(
             var prepareResult = await appHostServerProject.PrepareAsync(
                 VersionHelper.GetDefaultTemplateVersion(),
                 integrations,
-                cancellationToken);
+                cancellationToken: cancellationToken);
 
             if (!prepareResult.Success)
             {

src/Aspire.Cli/NuGet/BundleNuGetService.cs

@@ -164,7 +164,14 @@ public async Task<string> RestorePackagesAsync(
 
         _logger.LogDebug("Restoring {Count} packages", packageList.Count);
         _logger.LogDebug("aspire-managed path: {ManagedPath}", managedPath);
-        _logger.LogDebug("NuGet restore args: {Args}", string.Join(" ", restoreArgs));
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            // Build a redacted copy of the args specifically for the log line so user-supplied
+            // credentialed feeds (e.g., `https://user:pat@host/v3/index.json`, SAS-token URLs) do
+            // not flow to the debug log alongside the rest of the restore invocation. The
+            // original `restoreArgs` list is still passed verbatim to the process below.
+            _logger.LogDebug("NuGet restore args: {Args}", string.Join(" ", BuildRedactedArgsForLog(restoreArgs)));
+        }
 
         var environmentVariables = new Dictionary<string, string>();
         NuGetSignatureVerificationEnabler.Apply(environmentVariables, _features, _executionContext);
@@ -253,6 +260,25 @@ private static bool TryValidatePackageManifest(string manifestPath, ILogger logg
         }
     }
 
+    // Returns a redacted copy of the restore args suitable for debug logging. Replaces the value
+    // immediately following each `--source` token with the credential-safe form from
+    // PackageSourceRedactor. Built defensively to handle repeated `--source` flags and a missing
+    // trailing value at the end of the args list.
+    private static IReadOnlyList<string> BuildRedactedArgsForLog(IReadOnlyList<string> args)
+    {
+        var redacted = new List<string>(args.Count);
+        for (var i = 0; i < args.Count; i++)
+        {
+            redacted.Add(args[i]);
+            if (string.Equals(args[i], "--source", StringComparison.Ordinal) && i + 1 < args.Count)
+            {
+                redacted.Add(PackageSourceRedactor.RedactForDisplay(args[++i]));
+            }
+        }
+
+        return redacted;
+    }
+
     internal static string ComputePackageHash(
         List<(string Id, string Version)> packages,
         string tfm,

src/Aspire.Cli/Packaging/NuGetConfigMerger.cs

@@ -42,25 +42,45 @@ public static async Task CreateOrUpdateAsync(DirectoryInfo targetDirectory, Pack
             return;
         }
 
+        await CreateOrUpdateAsync(targetDirectory, mappings, channel.ConfigureGlobalPackagesFolder, confirmationCallback, cancellationToken);
+    }
+
+    /// <summary>
+    /// Creates or updates a NuGet.config file in the specified directory based on the provided package source mappings.
+    /// </summary>
+    public static async Task CreateOrUpdateAsync(
+        DirectoryInfo targetDirectory,
+        PackageMapping[] mappings,
+        bool configureGlobalPackagesFolder = false,
+        Func<FileInfo, XmlDocument?, XmlDocument, CancellationToken, Task<bool>>? confirmationCallback = null,
+        CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(targetDirectory);
+        ArgumentNullException.ThrowIfNull(mappings);
+
+        if (mappings.Length == 0)
+        {
+            return;
+        }
+
         if (!targetDirectory.Exists)
         {
             targetDirectory.Create();
         }
 
         if (!TryFindNuGetConfigInDirectory(targetDirectory, out var nugetConfigFile))
         {
-            await CreateNewNuGetConfigAsync(targetDirectory, channel, confirmationCallback, cancellationToken);
+            await CreateNewNuGetConfigAsync(targetDirectory, mappings, configureGlobalPackagesFolder, confirmationCallback, cancellationToken);
         }
         else
         {
-            await UpdateExistingNuGetConfigAsync(nugetConfigFile, channel, confirmationCallback, cancellationToken);
+            await UpdateExistingNuGetConfigAsync(nugetConfigFile, mappings, configureGlobalPackagesFolder, confirmationCallback, cancellationToken);
         }
     }
 
-    private static async Task CreateNewNuGetConfigAsync(DirectoryInfo targetDirectory, PackageChannel channel, Func<FileInfo, XmlDocument?, XmlDocument, CancellationToken, Task<bool>>? confirmationCallback, CancellationToken cancellationToken)
+    private static async Task CreateNewNuGetConfigAsync(DirectoryInfo targetDirectory, PackageMapping[] mappings, bool configureGlobalPackagesFolder, Func<FileInfo, XmlDocument?, XmlDocument, CancellationToken, Task<bool>>? confirmationCallback, CancellationToken cancellationToken)
     {
-        var mappings = channel.Mappings;
-        if (mappings is null || mappings.Length == 0)
+        if (mappings.Length == 0)
         {
             return;
         }
@@ -83,7 +103,7 @@ private static async Task CreateNewNuGetConfigAsync(DirectoryInfo targetDirector
             }
         }
 
-        if (channel.ConfigureGlobalPackagesFolder)
+        if (configureGlobalPackagesFolder)
         {
             // Need to modify the temporary config to add globalPackagesFolder before copying
             await AddGlobalPackagesFolderToConfigAsync(tmpConfig.ConfigFile);
@@ -92,10 +112,9 @@ private static async Task CreateNewNuGetConfigAsync(DirectoryInfo targetDirector
         File.Copy(tmpConfig.ConfigFile.FullName, targetPath, overwrite: true);
     }
 
-    private static async Task UpdateExistingNuGetConfigAsync(FileInfo nugetConfigFile, PackageChannel channel, Func<FileInfo, XmlDocument?, XmlDocument, CancellationToken, Task<bool>>? confirmationCallback, CancellationToken cancellationToken)
+    private static async Task UpdateExistingNuGetConfigAsync(FileInfo nugetConfigFile, PackageMapping[] mappings, bool configureGlobalPackagesFolder, Func<FileInfo, XmlDocument?, XmlDocument, CancellationToken, Task<bool>>? confirmationCallback, CancellationToken cancellationToken)
     {
-        var mappings = channel.Mappings;
-        if (mappings is null || mappings.Length == 0)
+        if (mappings.Length == 0)
         {
             return;
         }
@@ -136,7 +155,7 @@ private static async Task UpdateExistingNuGetConfigAsync(FileInfo nugetConfigFil
             }
         }
 
-        if (channel.ConfigureGlobalPackagesFolder)
+        if (configureGlobalPackagesFolder)
         {
             AddGlobalPackagesFolderConfiguration(configContext);
         }
@@ -633,6 +652,17 @@ private static void HandleWildcardMappingForExistingSources(
                 var sourceElement = context.ExistingAdds
                     .FirstOrDefault(add => string.Equals((string?)add.Attribute("key"), sourceKey, StringComparison.OrdinalIgnoreCase));
                 var sourceValue = (string?)sourceElement?.Attribute("value");
+                var isRequiredByCurrentChannel = context.RequiredSources.Contains(sourceKey, StringComparer.OrdinalIgnoreCase) ||
+                    context.RequiredSources.Contains(sourceValue ?? "", StringComparer.OrdinalIgnoreCase);
+                var requiredSourceHasWildcard = context.Mappings.Any(m =>
+                    m.PackageFilter == PackageMapping.AllPackages &&
+                    (string.Equals(m.Source, sourceKey, StringComparison.OrdinalIgnoreCase) ||
+                        string.Equals(m.Source, sourceValue, StringComparison.OrdinalIgnoreCase)));
+
+                if (isRequiredByCurrentChannel && !requiredSourceHasWildcard)
+                {
+                    continue;
+                }
 
                 // For user-defined sources that still have patterns, also give them wildcard patterns
                 // to ensure they can serve other packages too. But skip Microsoft-controlled sources

src/Aspire.Cli/Packaging/PackageSourceOverrideMappings.cs

@@ -0,0 +1,53 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Aspire.Cli.Packaging;
+
+internal static class PackageSourceOverrideMappings
+{
+    internal const string NuGetOrgSource = "https://api.nuget.org/v3/index.json";
+
+    public static PackageMapping[] Create(string packageSourceOverride, PackageChannel? requestedChannel)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(packageSourceOverride);
+        if (HasCredentialMaterial(packageSourceOverride))
+        {
+            throw new ArgumentException("Credential-bearing HTTP sources cannot be persisted.", nameof(packageSourceOverride));
+        }
+
+        var mappings = new List<PackageMapping>
+        {
+            new("Aspire*", packageSourceOverride)
+        };
+
+        if (requestedChannel?.Mappings is not null)
+        {
+            foreach (var mapping in requestedChannel.Mappings)
+            {
+                if (mapping.PackageFilter.StartsWith("Aspire", StringComparison.OrdinalIgnoreCase))
+                {
+                    continue;
+                }
+
+                mappings.Add(mapping);
+            }
+        }
+
+        if (!mappings.Any(static mapping => mapping.PackageFilter == PackageMapping.AllPackages))
+        {
+            mappings.Add(new PackageMapping(PackageMapping.AllPackages, NuGetOrgSource));
+        }
+
+        return [.. mappings.DistinctBy(static mapping => $"{mapping.PackageFilter}\0{mapping.Source}")];
+    }
+
+    public static bool HasCredentialMaterial(string source)
+    {
+        return Uri.TryCreate(source.Trim(), UriKind.Absolute, out var uri) &&
+            (uri.Scheme.Equals(Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase) ||
+                uri.Scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase)) &&
+            (!string.IsNullOrEmpty(uri.UserInfo) ||
+                !string.IsNullOrEmpty(uri.Query) ||
+                !string.IsNullOrEmpty(uri.Fragment));
+    }
+}

src/Aspire.Cli/Projects/AppHostServerSession.cs

@@ -203,7 +203,7 @@ public async Task<AppHostServerSessionResult> CreateAsync(
         var appHostServerProject = await _projectFactory.CreateAsync(appHostPath, cancellationToken);
 
         // Prepare the server (create files + build for dev mode, restore packages for prebuilt mode)
-        var prepareResult = await appHostServerProject.PrepareAsync(sdkVersion, integrations, cancellationToken);
+        var prepareResult = await appHostServerProject.PrepareAsync(sdkVersion, integrations, cancellationToken: cancellationToken);
         if (!prepareResult.Success)
         {
             return new AppHostServerSessionResult(

src/Aspire.Cli/Projects/DotNetBasedAppHostServerProject.cs

@@ -259,8 +259,9 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
     /// </summary>
     public async Task<(string ProjectPath, string? ChannelName)> CreateProjectFilesAsync(
         IEnumerable<IntegrationReference> integrations,
-        CancellationToken cancellationToken = default,
-        string? requestedChannel = null)
+        string? requestedChannel = null,
+        string? packageSourceOverride = null,
+        CancellationToken cancellationToken = default)
     {
         // Clean obj folder to ensure fresh NuGet restore
         var objPath = Path.Combine(_projectModelPath, "obj");
@@ -353,6 +354,20 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
             }
         }
 
+        // Thread an explicit `--source` override into the restore sources so the dogfood
+        // `aspire new --source <pr-hive>` flow is honored in dev mode (in-repo). Prepending
+        // makes the override the first source NuGet evaluates, which matters when the same
+        // Aspire package version exists in both the hive and a channel feed. Note: unlike
+        // PrebuiltAppHostServer this path does not emit Package Source Mappings, so NuGet
+        // may still consult other sources if the override does not satisfy a request — the
+        // override is best-effort here, sufficient for the in-repo developer scenario where
+        // most Aspire.* dependencies come from ProjectReference, not PackageReference.
+        if (!string.IsNullOrWhiteSpace(packageSourceOverride) &&
+            !channelSources.Contains(packageSourceOverride, StringComparer.OrdinalIgnoreCase))
+        {
+            channelSources.Insert(0, packageSourceOverride);
+        }
+
         // Create the project file
         var doc = CreateProjectFile(integrations);
 
@@ -424,10 +439,11 @@ private XDocument CreateProjectFile(IEnumerable<IntegrationReference> integratio
     public async Task<AppHostServerPrepareResult> PrepareAsync(
         string sdkVersion,
         IEnumerable<IntegrationReference> integrations,
-        CancellationToken cancellationToken = default,
-        string? requestedChannel = null)
+        string? requestedChannel = null,
+        string? packageSourceOverride = null,
+        CancellationToken cancellationToken = default)
     {
-        var (_, channelName) = await CreateProjectFilesAsync(integrations, cancellationToken, requestedChannel);
+        var (_, channelName) = await CreateProjectFilesAsync(integrations, requestedChannel, packageSourceOverride, cancellationToken);
         var (buildSuccess, buildOutput) = await BuildAsync(cancellationToken);
 
         if (!buildSuccess)