[release/13.5] Exclude unused hex1bpty.exe from published CLI archives

[aspire-repo-bot]

Backport of #19554 to release/13.5

/cc Mitch Denny (@mitchdenny)

Customer Impact

The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) ship a ~4.9 MB hex1bpty.exe that Aspire never executes. It is Hex1b's out-of-process PTY host, which Hex1b only launches when it owns the pseudo-terminal for a child process — Aspire never takes that path, because DCP creates and owns every PTY we surface and Aspire.TerminalHost only proxies the byte stream DCP is already producing.

Beyond the wasted download (~4.9 MB in the archive, plus the same again inside aspire.exe because Aspire.Managed picks it up and is embedded as the bundle payload), it shows up as an unexplained second executable in the WinGet submission, where every binary in the archive is run through executable and malware checks. That is what stalled the 13.5.0 WinGet publish in microsoft/winget-pkgs#421219. Backporting keeps 13.5 servicing releases publishable without walking an unused binary past store validation each time.

Testing

Verified against real CI-built archives on the source PR (run 32425648015): win-x64 and win-arm64 contain only aspire.exe + Aspire.TypeSystem.xml, while linux-x64 and osx-arm64 still contain libhex1binterop.{so,dylib} (the termios/ioctl shim the TUI does need).

Compared against the same workflow on main (run 32411678172), the sole delta is the removed 4,914,688-byte hex1bpty.exe:

	main	with fix
aspire.exe	152,848,384	152,843,776
Aspire.TypeSystem.xml	75,719	75,719
hex1bpty.exe	4,914,688	absent

Also A/B verified locally (with and without the new PublishHex1bPtyHost opt-out) that this target is what removes the file, and that Aspire.Managed — the bundle payload embedded in aspire.exe — is covered too. No product code changes, so no new tests.

Risk

Very low. Build-only: a single MSBuild target that drops one never-executed file from ResolvedFileToPublish, scoped to src/ so test projects are untouched (the CLI and deployment E2E tests drive real terminals through Hex1b.Automation, which does need the PTY host). Unix native assets are unaffected. libsodium.*, which is present in 13.5 archives but no longer on main, is not touched by this change. PublishHex1bPtyHost=true restores the old behavior if a shipping project ever needs the helper.

Regression?

Yes — new in 13.5. The shipped 13.4.6 Windows archive contains only aspire.exe, Aspire.TypeSystem.xml, and libsodium.dll, with no hex1bpty.exe. The cause is that src/Aspire.Cli/Aspire.Cli.csproj gained a direct Hex1b PackageReference in 13.5 (there is none on release/13.4), which pulled Hex1b's Windows native asset into the CLI publish output for the first time.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19557

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19557"

[Copilot]

Pull request overview

Excludes Hex1b’s unused Windows PTY helper from published Aspire CLI artifacts.

Changes:

• Removes hex1bpty.exe during publish.
• Provides a PublishHex1bPtyHost=true opt-out.
• Preserves Unix native assets and test behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — a rule matching 'eng/Versions.props' selects ALL

---

Selection computed for commit 1e9d561.

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch taken: excluded → base_branch_is_release, head_branch_is_backport, title_release_prefix, body_backport_marker

This PR is a backport (title [release/13.5] ..., body contains Backport of #19554 to release/13.5, and the head is a backport branch) of already-merged PR #19554 on the default branch. Per workflow policy, backport PRs are excluded from docs generation regardless of the underlying signal recommendation — documentation for the underlying change should be authored against the original forward PR (#19554), not duplicated here.

Triggered signals: none (signal_count = 0; recommendation was docs_optional prior to the exclusion override).

Exclusion reasons (from signals.json): base_branch_is_release (base ref is release/13.5), head_branch_is_backport, title_release_prefix (title begins with [release/13.5]), body_backport_marker (body contains explicit Backport of #19554 to release/13.5 marker).

No docs PR drafted.