microsoft · Mitch Denny (mitchdenny) · Sep 18, 2026 · Sep 3, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/Directory.Build.targets b/Directory.Build.targets
@@ -21,6 +21,7 @@
   </ItemGroup>
 
   <Import Project="$(RepositoryEngineeringDir)/NullablePolyfill.targets" />
+  <Import Project="$(MSBuildThisFileDirectory)src/Aspire.Hosting/buildTransitive/Aspire.Hosting.Hex1b.targets" />
 
   <!-- HACK: This resolves issues in CI builds where the extensions.json file is mapped to the incorrect directory. We only want
    to copy the updated extensions.json file once the `_FunctionsExtensionUpdateMetadata` target has completed. -->

diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -118,7 +118,9 @@
     <PackageVersion Include="Grpc.AspNetCore" Version="2.83.0" />
     <PackageVersion Include="Grpc.Net.ClientFactory" Version="2.83.0" />
     <PackageVersion Include="Grpc.Tools" Version="2.83.0" />
-    <PackageVersion Include="Hex1b" Version="0.165.0" />
+    <!-- Keep compatible with @hex1b/web-terminal in src/Aspire.Dashboard/package.json.
+         Native-only Hex1b builds can differ without changing the web terminal package. -->
+    <PackageVersion Include="Hex1b" Version="0.168.0" />
     <PackageVersion Include="Hex1b.McpServer" Version="0.165.0" />
     <PackageVersion Include="Hex1b.Tool" Version="0.165.0" />
     <PackageVersion Include="Humanizer.Core" Version="3.0.10" />

diff --git a/docs/specs/bundle.md b/docs/specs/bundle.md
@@ -169,6 +169,8 @@ aspire-{version}-{platform}/
 
 **Key change from previous layout**: The separate `.NET Runtime` (~106 MB), `dashboard/` (~42 MB), `aspire-server/` (~19 MB), `tools/aspire-nuget/` (~5 MB), and `tools/dev-certs/` directories have been consolidated into a single `managed/aspire-managed` self-contained binary. Certificate management has been moved natively into the CLI itself, eliminating the need for a separate dev-certs tool.
 
+Windows bundles also include `managed/hex1bpty.exe`, `managed/conpty.dll`, and `managed/arm64/OpenConsole.exe`; `win-x64` additionally includes `managed/x64/OpenConsole.exe`. These PTY sidecars stay outside the managed single-file executable because Hex1b locates its helper beside the application. ConPTY selects `OpenConsole.exe` relative to its DLL using the **OS architecture**, so the x64 bundle must retain the ARM64 helper for execution under emulation. `CreateLayout` preserves this layout and fails if a required sidecar is missing.
+
 **Total Bundle Size:**
 - **Unzipped:** ~220 MB (down from ~323 MB — eliminated separate runtime)
 - **Zipped:** ~80 MB

diff --git a/docs/specs/with-terminal.md b/docs/specs/with-terminal.md
diff --git a/eng/Signing.props b/eng/Signing.props
@@ -32,6 +32,7 @@
     <FileSignInfo Include="Dapper.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Fractions.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Hex1b.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="hex1bpty.exe" CertificateName="3PartySHA2" />
     <FileSignInfo Include="IdentityModel.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="IdentityModel.OidcClient.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="KubernetesClient.Basic.dll" CertificateName="3PartySHA2" />
@@ -114,6 +115,8 @@
     <ItemsToSign Condition="$([System.OperatingSystem]::IsWindows())" Include="$(ArtifactsBinDir)Aspire.Managed\**\publish\aspire-managed.exe" />
     <ItemsToSign Condition="$([System.OperatingSystem]::IsLinux())" Include="$(ArtifactsBinDir)Aspire.Managed/**/publish/aspire-managed" />
     <ItemsToSign Condition="$([System.OperatingSystem]::IsMacOS())" Include="$(ArtifactsBinDir)Aspire.Managed/**/publish/aspire-managed" />
+    <!-- Select only Hex1b's unsigned helper, preserving the upstream signatures on ConPTY and OpenConsole. -->
+    <ItemsToSign Condition="$([System.OperatingSystem]::IsWindows())" Include="$(ArtifactsBinDir)Aspire.Managed\**\publish\hex1bpty.exe" />
     <!--
       Note: VS Code extension (.vsix) is NOT included here.
       Signing the VSIX changes its hash, breaking manifest integrity verification.

diff --git a/eng/github-ci/test-trigger-map.yml b/eng/github-ci/test-trigger-map.yml
@@ -100,6 +100,17 @@ ignore:
 # Path rules: a glob set -> a target set. One mechanism; the comment headers below are organization
 # only. targets may be test: / job: / a GROUP name / ALL.
 path_rules:
+  - paths:
+      - src/Aspire.Dashboard/Components/Controls/TerminalView.razor.js
+      - src/Aspire.Dashboard/Components/Layout/TerminalDock.razor.js
+      - src/Aspire.Dashboard/wwwroot/js/app.js
+      - src/Aspire.Dashboard/wwwroot/js/app-terminalwindow.js
+      - src/Aspire.Dashboard/package.json
+      - src/Aspire.Dashboard/package-lock.json
+      - src/Aspire.Dashboard/wwwroot/js/hex1b-web-terminal/**
+      - tests/Aspire.Dashboard.Components.Tests/JavaScript/**
+    targets: [test:Infrastructure.Tests]
+    reason: DashboardTerminalScriptTests executes the terminal lifecycle JavaScript and reads the paired package assets outside its MSBuild graph.
 
   # --- catch-all: build infrastructure & broadly shared code -> ALL --------------------------
   - paths:

@@ -2132,9 +2132,16 @@ function writeNuGetConfigIfLocalPackageSourcesExist() {
   const sourceEntries = packageSources
     .map((source, index) => `    <add key="e2e-source-${index}" value="${escapeXml(source)}" />`)
     .join('\n');
-  const fallbackSourceEntries = getApprovedFallbackPackageSources()
+  const fallbackSources = getApprovedFallbackPackageSources();
+  const fallbackSourceEntries = fallbackSources
     .map(source => `    <add key="${escapeXml(source.key)}" value="${escapeXml(source.value)}" />`)
     .join('\n');
+  const sourceMappingEntries = [
+    ...packageSources.map((_, index) => `e2e-source-${index}`),
+    ...fallbackSources.map(source => source.key),
+  ].map(key => `    <packageSource key="${escapeXml(key)}">
+      <package pattern="*" />
+    </packageSource>`).join('\n');
   const nugetConfig = `<?xml version="1.0" encoding="utf-8"?>
 <configuration>
   <packageSources>
@@ -2144,6 +2151,7 @@ ${fallbackSourceEntries}
   </packageSources>
   <packageSourceMapping>
     <clear />
+${sourceMappingEntries}
   </packageSourceMapping>
 </configuration>
 `;

@@ -3,6 +3,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { spawnSync } from 'child_process';
+import { runInNewContext } from 'vm';
 import * as ts from 'typescript';
 import * as vm from 'vm';
 import { blazorWasmDebugProofResponseAllowanceMs, blazorWasmDebugProofTimeoutMs, getBlazorWasmDebugProofCleanupTimeoutMs, getBlazorWasmDebugProofControlTimeoutMs } from '../testing/blazorWasmDebugProofTimeouts';
@@ -87,6 +88,27 @@ function runE2eRunnerAsPlatform(extensionRoot: string, platform: 'darwin' | 'lin
     });
 }
 
+function getFixtureNuGetConfigurations(packageSources: readonly string[]): Map<string, string> {
+    const extensionRoot = path.resolve(__dirname, '..', '..');
+    const runner = fs.readFileSync(path.join(extensionRoot, 'scripts', 'run-e2e.js'), 'utf8');
+    const sourceFile = ts.createSourceFile('run-e2e.js', runner, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+    const functionNames = new Set(['writeNuGetConfigIfLocalPackageSourcesExist', 'getApprovedFallbackPackageSources', 'escapeXml']);
+    const declarations = sourceFile.statements.filter((statement): statement is ts.FunctionDeclaration =>
+        ts.isFunctionDeclaration(statement) && statement.name !== undefined && functionNames.has(statement.name.text));
+    assert.strictEqual(declarations.length, functionNames.size);
+
+    // Execute the actual config writer without the runner's CLI downloads, workspace cleanup, or VS Code launch.
+    const configurations = new Map<string, string>();
+    runInNewContext(`${declarations.map(declaration => declaration.getText(sourceFile)).join('\n')}
+writeNuGetConfigIfLocalPackageSourcesExist();`, {
+        fs: { writeFileSync: (file: string, content: string) => configurations.set(file, content) },
+        getLocalPackageSourceDirectories: () => packageSources,
+        runRootNuGetConfigPath: 'run-root/NuGet.config',
+        workspaceNuGetConfigPath: 'workspace/NuGet.config',
+    });
+    return configurations;
+}
+
 function createE2eSpecFixtures(extensionRoot: string, fileNames: readonly string[]): string {
     const testArtifactsRoot = path.join(extensionRoot, '.test-artifacts', 'unit');
     fs.mkdirSync(testArtifactsRoot, { recursive: true });
@@ -916,7 +938,9 @@ builder.Build().Run();
 
         assert.ok(runner.includes("['Directory.Build.props', 'Directory.Build.targets', 'Directory.Packages.props']"));
         assert.ok(runner.includes("fs.writeFileSync(path.join(shortRunRoot, fileName), '<Project />\\n');"));
-        assert.ok(runner.replace(/\r\n/g, '\n').includes('<packageSourceMapping>\n    <clear />\n  </packageSourceMapping>'));
+        for (const config of getFixtureNuGetConfigurations(['/packages/local']).values()) {
+            assert.ok(config.includes('<packageSourceMapping>\n    <clear />\n'));
+        }
     });
 
     test('requires only the debugger VSIX dependencies shared by browser and Azure Functions shards', () => {
@@ -1125,6 +1149,56 @@ builder.Build().Run();
         assert.ok(writeConfig.includes('fs.writeFileSync(workspaceNuGetConfigPath, nugetConfig);'));
     });
 
+    test('uses only local and approved package feeds in both fixture restore scopes', () => {
+        const configurations = getFixtureNuGetConfigurations(['/packages/local', '/packages/<preview> & "daily"']);
+        const expectedConfig = `<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="e2e-source-0" value="/packages/local" />
+    <add key="e2e-source-1" value="/packages/&lt;preview&gt; &amp; &quot;daily&quot;" />
+    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
+    <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
+    <add key="dotnet9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
+    <add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
+    <add key="dotnet-libraries" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-libraries/nuget/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <clear />
+    <packageSource key="e2e-source-0">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="e2e-source-1">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet-public">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet-eng">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet9">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet10">
+      <package pattern="*" />
+    </packageSource>
+    <packageSource key="dotnet-libraries">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
+`;
+        assert.deepStrictEqual([...configurations], [
+            ['run-root/NuGet.config', expectedConfig],
+            ['workspace/NuGet.config', expectedConfig],
+        ]);
+    });
+
+    test('does not write fixture NuGet configurations without local package sources', () => {
+        assert.deepStrictEqual([...getFixtureNuGetConfigurations([])], []);
+    });
+
     test('suppresses evaluation diagnostics for intentional E2E AppHost interaction APIs', () => {
         const extensionRoot = path.resolve(__dirname, '..', '..');
         const runner = fs.readFileSync(path.join(extensionRoot, 'scripts', 'run-e2e.js'), 'utf8');

diff --git a/playground/Terminals/Terminals.AppHost/AppHost.cs b/playground/Terminals/Terminals.AppHost/AppHost.cs
@@ -5,6 +5,8 @@
 // because this playground project intentionally exercises the experimental API.
 #pragma warning disable ASPIRETERMINAL001
 
+using Terminals.AppHost;
+
 var builder = DistributedApplication.CreateBuilder(args);
 
 // A multi-replica project that calls `WithTerminal()` so each replica gets its
@@ -19,10 +21,42 @@
         options.Columns = 120;
         options.Rows = 32;
         options.ShowTerminalHost = true;
-    });
+    })
+    // Opens a shell owned by the AppHost rather than orchestrated by Aspire. It has nothing to do with `repl`;
+    // commands just need a host resource to hang off.
+    .WithAppHostShellCommand()
+    // Drives an interactive console program from AppHost code: the terminal is shown in a dialog, but the guesses
+    // are typed by the AppHost, which reads each reply back off the screen and bisects until it wins.
+    .WithNumberGuessCommand()
+    // Automates a terminal the AppHost does NOT own: it joins `shell`'s existing terminal as an extra viewer and
+    // types into it, which is what shelling into a resource from AppHost code looks like.
+    .WithAutomateResourceTerminalCommand("shell");
+
+// Long-running container that the "Shell into container" interaction command execs into. Aspire is not orchestrating
+// the exec — the AppHost shells out to `docker exec` — so the container needs a stable, predictable name.
+var shellbox = builder.AddContainer("shellbox", "alpine")
+    .WithContainerName("terminals-playground-shellbox")
+    .WithArgs("sleep", "infinity")
+    .WithContainerShellCommand()
+    // Same shell, but delivered as a tab in the dashboard's terminal dock (backtick shortcut) rather than a modal dialog.
+    .WithDockShellCommand();
+
+// Latest Node.js image, kept alive so the "Node REPL" interaction command can exec into it. The Node REPL is a
+// readline app, so it exercises cursor addressing, history, and tab completion across the tunnel in a way a plain
+// shell prompt does not. `sleep infinity` replaces the image's default CMD ("node") — an interactive REPL with no TTY
+// attached would exit immediately. The entrypoint (docker-entrypoint.sh) is left alone so PATH is set up normally.
+builder.AddContainer("noderepl", "node", "latest")
+    .WithContainerName("terminals-playground-noderepl")
+    .WithArgs("sleep", "infinity")
+    .WithNodeReplCommand();
 
 if (OperatingSystem.IsWindows())
 {
+    // Local PowerShell launched directly by Hex1b, providing a Docker- and DCP-independent PTY debugging path.
+    shellbox
+        .WithPowerShellDockCommand()
+        .WithCommandPromptDockCommand();
+
     // Single-replica executable wrapping cmd.exe to demonstrate that
     // WithTerminal() also works for arbitrary executables, not just projects.
     builder.AddExecutable("shell", "cmd.exe", ".")
@@ -59,6 +93,16 @@
         .WithTerminal(options => options.ShowTerminalHost = true);
 }
 
+builder.AddDockerfile("notcurses", "../Terminals.Notcurses")
+    .WithTerminal(options =>
+    {
+        // The demo recommends at least 80x45 for its graphics and Unicode workloads:
+        // https://manpages.ubuntu.com/manpages/noble/man1/notcurses-demo.1.html
+        options.Columns = 120;
+        options.Rows = 45;
+        options.ShowTerminalHost = true;
+    });
+
 #if !SKIP_DASHBOARD_REFERENCE
 // This project is only added in playground projects to support development/debugging
 // of the dashboard. It is not required in end developer code. Comment out this code
@@ -70,4 +114,3 @@
 #endif
 
 builder.Build().Run();
-
diff --git a/playground/Terminals/Terminals.AppHost/Scripts/numberguess.cs b/playground/Terminals/Terminals.AppHost/Scripts/numberguess.cs
@@ -0,0 +1,67 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+// A deliberately old-fashioned interactive console game, run as a .NET file-based app
+// (`dotnet run --file numberguess.cs -- <limit>`).
+//
+// It exists to demonstrate driving an interactive process from AppHost code: the AppHost shows this program in an
+// PromptTerminalAsync interaction, then plays it by typing guesses and reading the replies back off the terminal
+// screen. Nothing here knows it is being automated - it is an ordinary Console.ReadLine app.
+//
+// The reply format is the contract the automation relies on, so it is deliberately unambiguous:
+//
+//     Guess #1: 50            <- the prompt, plus the tty's echo of what was typed
+//       >> #1: 50 is too high <- the reply, tagged with the attempt number
+//
+// Tagging each reply with its attempt number means the automation can wait for ">> #3:" and be certain it is
+// reading the response to its third guess rather than a stale line still on screen from an earlier one.
+
+var limit = args.Length > 0 && int.TryParse(args[0], out var parsed) && parsed > 1 ? parsed : 100;
+var secret = Random.Shared.Next(1, limit + 1);
+
+Console.WriteLine();
+Console.WriteLine("+------------------------------------------+");
+Console.WriteLine("|          N U M B E R   G U E S S         |");
+Console.WriteLine("+------------------------------------------+");
+Console.WriteLine();
+Console.WriteLine($"I'm thinking of a number between 1 and {limit}.");
+Console.WriteLine("Type a guess and press Enter. I'll tell you if it's too high or too low.");
+Console.WriteLine();
+
+for (var attempt = 1; ; attempt++)
+{
+    Console.Write($"Guess #{attempt}: ");
+
+    var line = Console.ReadLine();
+    if (line is null)
+    {
+        // stdin closed - the terminal went away.
+        return 1;
+    }
+
+    if (!int.TryParse(line.Trim(), out var guess))
+    {
+        Console.WriteLine($"  >> #{attempt}: '{line.Trim()}' is not a number");
+        continue;
+    }
+
+    if (guess < secret)
+    {
+        Console.WriteLine($"  >> #{attempt}: {guess} is too low");
+    }
+    else if (guess > secret)
+    {
+        Console.WriteLine($"  >> #{attempt}: {guess} is too high");
+    }
+    else
+    {
+        Console.WriteLine($"  >> #{attempt}: {guess} is correct");
+        Console.WriteLine();
+        Console.WriteLine($"Got it in {attempt} {(attempt == 1 ? "guess" : "guesses")}. The number was {secret}.");
+
+        // Block rather than exit so the final screen stays live until whoever owns the terminal tears it down.
+        // Exiting immediately would race the automation's "let the human read the result" pause.
+        Console.ReadLine();
+        return 0;
+    }
+}