Add CLI installation source to main telemetry

[Damian Edwards (DamianEdwards)]

Description

CLI usage telemetry currently identifies the effective release channel but cannot distinguish how the CLI was installed. Add aspire.cli.install.source to the aspire/cli/main event so usage can be broken down by installation mechanism, independently of aspire.cli.identity.channel.

The property reports script, winget, npm, dotnet-tool, brew, mise, nix, pr, localhive, or unknown. Bash and PowerShell installers both report script.

• Prefer known install-sidecar sources, then use the existing WinGet ownership signal, npm launcher marker, mise installation paths, and .NET-tool detection as fallbacks.
• Detect WinGet on the first invocation without requiring bundle extraction or writing a sidecar.
• Recognize mise's normal and explicit GitHub-backend Aspire directories, including custom install/data roots, without treating the presence of mise environment variables alone as provenance. Normalize custom roots consistently with the executable path, including macOS /private aliases.
• Keep values bounded: do not export arbitrary sidecar strings or installation paths. Run detection only when the main activity is created; other events and existing identity tags are unchanged.
• Document the detection behavior and add focused coverage for source precedence, unknown/malformed provenance, path boundaries, platform comparisons, read-only WinGet, symlinks, and event scope.

Validation

Ran the focused Aspire.Cli.Tests classes for installation-source detection, main-event wiring, npm/.NET-tool detection, CLI telemetry, CLI bootstrap, and path helpers: 296 passed, with one Linux-only bootstrap test skipped on Windows. Platform-gated macOS regression cases were added for custom mise roots but could not be exercised on this Windows host. git diff --check passed.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20590

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20590"

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation is bounded, fault-tolerant, correctly scoped, and comprehensively tested.

Review effort: Balanced
Findings: None

What changed in this PR

Adds bounded CLI installation-source telemetry to the main CLI activity.

Changes:

• Detects sidecar, WinGet, npm, mise, and .NET-tool provenance.
• Adds focused telemetry and detection tests.
• Documents precedence, supported values, and scope.

File	Description
src/​Aspire.Cli/​Acquisition/​InstallSourceDetector.cs	Implements source detection.
src/​Aspire.Cli/​Program.cs	Adds the tag to main telemetry.
src/​Aspire.Cli/​Telemetry/​TelemetryConstants.cs	Defines the telemetry tag.
src/​Aspire.Cli/​Utils/​NpmInstallDetection.cs	Exposes npm marker validation.
tests/​Aspire.Cli.Tests/​Acquisition/​InstallSourceDetectorTests.cs	Covers detection and precedence.
tests/​Aspire.Cli.Tests/​ProgramTests.cs	Verifies event wiring and scope.
tests/​Aspire.Cli.Tests/​TestServices/​TestWindowsRegistryReader.cs	Adds configurable registry probing.
docs/​specs/​install-routes.md	Documents telemetry behavior.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Tests selector

2 / 99 PR test projects · 4 PR jobs, from 7 changed files.

Selected PR test projects (2 / 99)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests

Selected PR jobs (4)

cli-starter-validation, extension-e2e, polyglot, typescript-api-compat

---

How these were chosen — grouped by what changed

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Cli.Tests/Acquisition/InstallSourceDetectorTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/ProgramTests.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

🧪 tests/Aspire.Cli.Tests/TestServices/TestWindowsRegistryReader.cs (changed test)
→ 1 directly: Aspire.Cli.Tests

Job reasons

Job	Triggered by
cli-starter-validation	affected project Aspire.Cli
extension-e2e	• src/Aspire.Cli/Acquisition/InstallSourceDetector.cs, src/Aspire.Cli/Program.cs, src/Aspire.Cli/Telemetry/TelemetryConstants.cs, src/Aspire.Cli/Utils/NpmInstallDetection.cs • affected project Aspire.Cli
polyglot	affected project Aspire.Cli
typescript-api-compat	affected project Aspire.Cli

---

Selection computed for commit b716d2f.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation is bounded, documented, and supported by focused coverage for its principal platform and precedence risks.

Review effort: Balanced
Findings: None

[aspire-repo-bot]

Pull request created: #1807

Generated by PR Documentation Check · copilot · auto · 57.9 AIC · ⌖ 26.1 AIC · ⊞ 20.3K

[aspire-repo-bot]

📝 Documentation has been drafted in microsoft/aspire.dev#1807 targeting release/17.0.

Triggered signals: defaults_or_constants_file_changed (new InstallSource tag constant added to src/Aspire.Cli/Telemetry/TelemetryConstants.cs) and pr_body_has_cli_flag_mention. Added a new data-point row to reference/cli/microsoft-collected-cli-telemetry.mdx's existing "Data points" table documenting the new aspire.cli.install.source telemetry property added to the aspire/cli/main event, listing the possible values (script, winget, npm, dotnet-tool, brew, mise, nix, pr, localhive, unknown) per the source PR description, consistent with the table's existing format and privacy framing.

Note

This draft PR needs human review before merging.