Move skills to .agent directory

Avoid ObjectDisposedException when sending SignalR updates after the
30-second delay by accessing clients through IHubContext instead of
the disposed hub instance.

Signed-off-by: Tim Krampitz <Tim.Krampitz@live.com>

.agents/skills/aspire-init/SKILL.md

@@ -0,0 +1,146 @@
+---
+name: aspire-init
+description: >-
+  **WORKFLOW SKILL** - First-run flow for adding Aspire to a repo. Picks `aspire new`
+  (greenfield) or `aspire init` (existing repo), drops the AppHost skeleton, then hands
+  off to `aspireify` for resource wiring.
+  USE FOR: aspire init, aspire new, aspire-starter, aspire-ts-starter, aspire-py-starter,
+  add Aspire to existing repo, scaffold Aspire app, bootstrap Aspire, no AppHost detected,
+  install aspireify, generated .aspire/modules.
+  DO NOT USE FOR: AppHost wiring on an existing AppHost (use aspireify), start/stop/wait
+  (use aspire-orchestration), deploy/publish (use aspire-deployment), logs/traces (use
+  aspire-monitoring), repo that already has an AppHost.
+  INVOKES: aspire CLI (init, new, doctor), aspireify (handoff after skeleton drop).
+  FOR SINGLE OPERATIONS: Run `aspire init` or `aspire new TEMPLATE` directly.
+license: MIT
+metadata:
+  author: Microsoft
+  version: "0.0.1"
+---
+
+# Aspire Init
+
+> **First-run only.** This skill owns the skeleton drop and template choice for repositories
+> that do not yet have an Aspire AppHost. Once the skeleton is in place, hand off to
+> [`aspireify`](../aspireify/SKILL.md) for the actual resource wiring.
+
+## Prerequisites
+
+| Requirement | Install |
+|-------------|---------|
+| .NET 10.0 SDK | https://dotnet.microsoft.com/download |
+| Aspire CLI (curl installer) | `curl -sSL https://aspire.dev/install.sh \| bash` |
+| Aspire CLI (NativeAOT global tool) | `dotnet tool install -g Aspire.Cli` (.NET 10 required) |
+| Diagnose missing prerequisites | `aspire doctor` |
+
+> Aspire ships the CLI as a NativeAOT .NET global tool — instant startup, no JIT warmup.
+> The curl/PowerShell installer remains supported for environments without .NET 10.
+
+## Detection
+
+Activate **only** when adding Aspire to a workspace that does not yet have one. Confirm ALL
+of the following before running `aspire init`:
+
+| Signal | How to Detect | Meaning |
+|--------|---------------|---------|
+| No C# AppHost | No `.csproj` containing `Aspire.AppHost.Sdk` | OK to init |
+| No file-based AppHost | No `apphost.cs` with `#:sdk Aspire.AppHost.Sdk` | OK to init |
+| No TypeScript AppHost | No `apphost.ts` in repo root | OK to init |
+| No Aspire config | No `aspire.config.json` in repo root | OK to init |
+| User intent | Explicit "add Aspire", "scaffold Aspire", "aspire init" | OK to init |
+
+If **any** AppHost signal is already present, **do not run `aspire init`**. Route to
+[`aspireify`](../aspireify/SKILL.md) (re-wire) or
+[`aspire-orchestration`](../aspire-orchestration/SKILL.md) (lifecycle).
+
+## Decision: `aspire new` vs `aspire init`
+
+| Situation | Command | Why |
+|-----------|---------|-----|
+| Empty directory or brand-new project | `aspire new <template>` | Generates a full starter solution |
+| Existing repo with services to model | `aspire init` | Drops minimal skeleton + `aspire.config.json` next to existing code |
+| User wants a sample to learn from | `aspire new aspire-starter` | Includes ApiService + Web + ServiceDefaults |
+| User wants the smallest possible scaffold | `aspire new aspire-empty` (C#) or `aspire new aspire-ts-empty` (TS) | No resources pre-wired |
+| User wants Python services | `aspire new aspire-py-starter` (TypeScript AppHost drives Python) | **Not** `dotnet new` — that template was removed in 13.3 |
+
+See [references/templates.md](references/templates.md) for the complete template list and
+options.
+
+## Workflow A — `aspire new <template>` (new project)
+
+For brand-new projects in an empty or non-existent directory:
+
+1. Confirm prerequisites with `aspire doctor` if the CLI install is uncertain.
+2. Pick a template from [references/templates.md](references/templates.md).
+3. Run the template, append `--non-interactive` for agent flows:
+   ```bash
+   aspire new aspire-starter --name MyApp --output ./MyApp --non-interactive
+   ```
+4. The new directory is fully wired by the template — **no aspireify handoff needed**.
+5. Route to [`aspire-orchestration`](../aspire-orchestration/SKILL.md) for first run
+   (`aspire start`).
+
+## Workflow B — `aspire init` (existing repo)
+
+For repositories that already contain services (Express API, .NET API, Python service, etc.)
+and need an AppHost added alongside them:
+
+1. Verify the [Detection](#detection) table — confirm **no** AppHost is present.
+2. Run `aspire init`, choosing language explicitly for non-interactive flows:
+   ```bash
+   aspire init --language csharp --non-interactive
+   # or
+   aspire init --language typescript --non-interactive
+   ```
+3. `aspire init` drops:
+   - The AppHost skeleton (`apphost.cs` with `#:sdk` directives, **or** `apphost.ts` with the
+     generated `.aspire/modules/` folder)
+   - AppHost configuration describing language + AppHost path
+   - The **`aspireify`** agent skill into the project's skill directory (same one
+     `aspire agent init` uses)
+4. **Hand off to `aspireify`** — `aspire init` does **not** wire resources, projects, or
+   integrations on its own.
+5. After `aspireify` finishes wiring, validate via `aspire start`
+   ([`aspire-orchestration`](../aspire-orchestration/SKILL.md)).
+
+See [references/init-workflow.md](references/init-workflow.md) for the full sequence
+including what `aspire.config.json` contains and what to do if `aspire init` fails partway.
+
+## Handoff Rules
+
+| After `aspire init` / `aspire new` finishes... | Route To |
+|------------------------------------------------|----------|
+| Skeleton dropped, resources need wiring | → `aspireify` skill (in-plugin or project-local) |
+| Skeleton dropped, validate it starts | → `aspire-orchestration` (run `aspire start`) |
+| New project from template, ready to run | → `aspire-orchestration` |
+| User asks to deploy after init | → `aspire-deployment` |
+| User asks for logs/traces after init | → `aspire-monitoring` |
+| Existing AppHost detected — do NOT run init | → `aspireify` (re-wire) or `aspire-orchestration` (lifecycle) |
+
+## Project-Local Skill Override
+
+If `.agents/skills/aspire-init/SKILL.md` exists project-locally (legacy install from an
+older `aspire init` run), **warn the user and defer to it**. The legacy project-local skill
+may carry repo-specific guidance that should not be overridden by this in-plugin skill.
+
+The project-local `aspireify` skill (installed by `aspire init`) takes precedence
+over this plugin's in-plugin `aspireify` for the same reason — defer to the project-local
+copy and warn.
+
+## Error Handling
+
+| Symptom | Cause | Action |
+|---------|-------|--------|
+| `aspire init` reports AppHost already exists | Repo already has an AppHost | Stop. Route to `aspireify` (re-wire) or `aspire-orchestration` (lifecycle) |
+| `aspire init` fails in non-interactive mode without `--language` | Multiple language paths available | Re-run with `--language csharp` or `--language typescript` |
+| `aspire new` rejects `--output` path | Path exists and is non-empty | Use a different `--output` or empty the directory |
+| `aspire` command not found | CLI not installed | `dotnet tool install -g Aspire.Cli` (.NET 10) or `curl -sSL https://aspire.dev/install.sh \| bash` |
+| `aspire doctor` reports missing .NET 10 | SDK missing | Install .NET 10 SDK before retrying |
+| `aspire init` succeeded but no `aspireify` skill installed | Agent skill directory not detected | Run `aspire agent init` to install `aspireify`, then continue wiring |
+| Skeleton dropped but resources not wired | Expected — `aspire init` does not wire | Hand off to `aspireify` |
+
+## References
+
+- [templates.md](references/templates.md) — `aspire new` templates and options
+- [init-workflow.md](references/init-workflow.md) — `aspire init` flow, `aspire.config.json`
+  layout, and `aspireify` handoff

.agents/skills/aspire-init/references/init-workflow.md

@@ -0,0 +1,123 @@
+# `aspire init` Workflow
+
+Reference for the `aspire init` flow on existing repositories. Source:
+https://aspire.dev/reference/cli/commands/aspire-init/.
+
+## What `aspire init` Does
+
+`aspire init` initializes Aspire support in an existing repo or workspace. It scaffolds a
+**minimal AppHost skeleton** plus an `aspire.config.json`, then optionally installs the
+**`aspireify`** agent skill so the AI coding agent can complete the wiring.
+
+It does **not**:
+
+- Wire resources, projects, or integrations into the AppHost
+- Modify existing project files
+- Change the repo's .NET SDK version (`global.json` is left alone)
+- Trust the developer certificate (run `aspire certs trust` separately if needed)
+
+## Command and Options
+
+```bash
+aspire init [options]
+```
+
+| Option | Purpose |
+|--------|---------|
+| `--language` | `csharp` or `typescript`. Required in `--non-interactive` mode if both paths are available |
+| `--channel` | `stable` (default), `staging`, `daily` |
+| `--non-interactive` | **Required for agent execution.** Disables prompts and spinners |
+| `--nologo` | Suppress startup banner / telemetry notice |
+| `--banner` | Show the animated welcome banner |
+| `-l, --log-level` | `Critical`, `Debug`, `Error`, `Information`, `None`, `Trace`, `Warning` |
+| `--wait-for-debugger` | Pause until a debugger attaches |
+| `-?, -h, --help` | Print help |
+
+## What Gets Dropped
+
+### C# Path (`--language csharp`)
+
+- **`apphost.cs`** — single-file AppHost using `#:sdk Aspire.AppHost.Sdk` and `#:package`
+  directives. No `.csproj` is created in the file-based mode.
+- **`aspire.config.json`** at repo root.
+
+### TypeScript Path (`--language typescript`)
+
+- **`apphost.ts`** at repo root.
+- **`.aspire/modules/`** generated folder (do not edit by hand — regenerate with `aspire add`).
+- **`aspire.config.json`** at repo root.
+
+### `aspireify` Skill
+
+- A Markdown skill file is installed into the AI agent's skill directory — the same
+  directory chosen by `aspire agent init` (e.g., `.agents/skills/aspireify/`,
+  `.github/skills/aspireify/`, `.claude/skills/aspireify/`, or `.opencode/skill/aspireify/`).
+- The skill instructs the agent to scan the repo, propose a resource graph, edit the
+  AppHost, and validate via `aspire start`.
+
+## `aspire.config.json` Layout
+
+| Field | Values | Meaning |
+|-------|--------|---------|
+| `appHost.language` | `"csharp"` or `"typescript/nodejs"` | Which AppHost syntax to use |
+| `appHost.path` | Path to AppHost file or directory | Where the AppHost lives |
+
+C# has two sub-modes the agent may encounter:
+
+- **Single-file** — `appHost.path` points at `apphost.cs` (uses `#:sdk` directive).
+- **Full project** — `appHost.path` points at a directory containing a `.csproj` plus
+  `Program.cs`. In solution-backed repos, full project mode lets the AppHost participate in IDE and solution workflows.
+
+## End-to-End Sequence
+
+1. **Pre-flight** — verify no AppHost already exists. If one does, stop and route to
+   `aspireify` or `aspire-orchestration`.
+2. **Run init**:
+   ```bash
+   aspire init --language <csharp|typescript> --non-interactive
+   ```
+3. **Confirm artifacts** — `apphost.cs` (or `apphost.ts` + `.aspire/modules/`) and
+   `aspire.config.json` should be in the repo root.
+4. **Confirm `aspireify` skill installed** — the agent's skill directory contains
+   `aspireify/SKILL.md`. If missing, run `aspire agent init` to install it.
+5. **Hand off to `aspireify`** for wiring:
+   - Scan repo and discover existing projects, services, containers
+   - Ask the user clarifying questions (which services to orchestrate, hardcoded ports,
+     whether to map env vars or switch to Aspire service discovery)
+   - Wire resources with `WithReference`, `WaitFor`, endpoints, volumes
+   - Optionally configure OpenTelemetry
+   - Validate with a smoke-test `aspire start`
+6. **Validate** — once `aspireify` finishes wiring, run `aspire start` (handled by
+   `aspire-orchestration`) and confirm resources reach a healthy state.
+
+## Project-Local Skill Precedence
+
+`aspire init` installs `aspireify` into the project's skill directory when an agent skill location is detected.
+When a project-local `.agents/skills/aspireify/SKILL.md` (or equivalent location) is
+present, **defer to it and warn the user** — the project-local copy may carry repo-specific
+guidance.
+
+The same precedence applies to a legacy `.agents/skills/aspire-init/SKILL.md` from older
+`aspire init` runs: warn and defer.
+
+## Failure Modes and Recovery
+
+| Symptom | Cause | Recovery |
+|---------|-------|----------|
+| `aspire init` reports an AppHost already exists | Repo is already an Aspire app | Stop. Route to `aspireify` or `aspire-orchestration` |
+| `aspire init` fails without `--language` in `--non-interactive` | CLI needs the language explicitly when prompts are disabled | Re-run with `--language csharp` or `--language typescript` |
+| Skeleton dropped but no `aspireify` skill | Agent skill directory not detected during init | Run `aspire agent init` to install `aspireify`, then continue |
+| `apphost.cs` references a missing `#:package` | Channel mismatch or transient feed issue | Re-run with `--channel stable` (or `daily` for pre-release) |
+| `aspire start` after wiring fails immediately | Wiring incomplete or wrong AppHost path | Re-invoke `aspireify`; confirm `aspire.config.json` `appHost.path` is correct |
+
+## Don't Do This
+
+- **Don't run `aspire init` if any AppHost signal already exists** — it duplicates the
+  skeleton and confuses subsequent tooling.
+- **Don't edit `.aspire/modules/`** in TypeScript AppHosts. Use `aspire add` to regenerate APIs;
+  use `aspire restore` if files are missing.
+- **Don't install the obsolete Aspire workload** (`dotnet workload install aspire`). Use
+  `aspire init`, `aspire new`, or `aspire add` instead.
+- **Don't perform the resource wiring inside this skill.** Hand off to `aspireify`. This
+  skill's job ends when the skeleton + `aspire.config.json` + `aspireify` skill are in
+  place.

.agents/skills/aspire-init/references/templates.md

@@ -0,0 +1,92 @@
+# `aspire new` Templates
+
+Reference for choosing and invoking templates with `aspire new`. Source:
+https://aspire.dev/reference/cli/commands/aspire-new/
+
+## Template List
+
+| Template | Description | AppHost Language |
+|----------|-------------|------------------|
+| `aspire-starter` | Starter App (ASP.NET Core / Blazor) | C# |
+| `aspire-ts-cs-starter` | Starter App (ASP.NET Core / React) | C# |
+| `aspire-py-starter` | Starter App (FastAPI / React) | **TypeScript** (drives Python) |
+| `aspire-ts-starter` | Starter App (Express / React) | TypeScript |
+| `aspire-empty` | Minimal scaffold, no resources pre-wired | C# |
+| `aspire-ts-empty` | Minimal scaffold, no resources pre-wired | TypeScript |
+
+> **Important — Python starter changed in 13.3.** `dotnet new aspire-py-starter` was removed.
+> The current path is `aspire new aspire-py-starter`, and the AppHost is **TypeScript**, not
+> C#. The TypeScript AppHost orchestrates the FastAPI service plus the React frontend.
+
+## Common Options
+
+| Option | Purpose |
+|--------|---------|
+| `-n, --name` | Name of the project to create |
+| `-o, --output` | Output path. Defaults to `./<template-name>` (auto-suffixed if non-empty) |
+| `-s, --source` | NuGet source for the project templates |
+| `-v, --version` | Version of the project templates to use |
+| `--channel` | Template channel: `stable` (default), `staging`, `daily` |
+| `--non-interactive` | **Required for agent execution.** Disables prompts and spinners |
+| `--nologo` | Suppress startup banner / telemetry notice |
+| `--suppress-agent-init` | Skip the post-create prompt to configure AI agent environments |
+| `-l, --log-level` | `Critical`, `Debug`, `Error`, `Information`, `None`, `Trace`, `Warning` |
+
+## Template-Specific Options
+
+### `aspire-py-starter`
+
+| Option | Values | Default |
+|--------|--------|---------|
+| `--use-redis-cache` | `true` / `false` | Prompts interactively |
+
+```bash
+aspire new aspire-py-starter --use-redis-cache true --non-interactive
+```
+
+## Interactive Prompts (avoid by passing flags)
+
+| Prompt | What It Decides | Skip With |
+|--------|------------------|-----------|
+| Project name | Output directory name | `--name <value>` |
+| Template version | Which release to use | `--version <value>` |
+| Output folder | Where files land | `--output <value>` |
+| Use `*.dev.localhost` URLs? | HTTPS subdomain launch profile vs `http://localhost:<port>` | Pass `--non-interactive` to take the default (No, standard localhost) |
+
+If a project picks `*.dev.localhost`, the user must trust the developer certificate first:
+
+```bash
+aspire certs trust
+```
+
+## Output Path Validation
+
+- Invalid characters (e.g., null bytes) are rejected with an error.
+- Existing **non-empty** directories are rejected — pick a new `--output` or empty the target.
+- When `--output` is omitted, the CLI derives the directory from the template name and
+  appends a numeric suffix (`./aspire-starter-2`, `./aspire-starter-3`, ...) if the default
+  already exists.
+
+## Examples
+
+```bash
+# Interactive — CLI prompts for name, output, version
+aspire new aspire-starter
+
+# Non-interactive C# empty scaffold pinned to a specific version
+aspire new aspire-empty --version <version> --name aspireapp --output ./dev --non-interactive
+
+# Pre-release templates from the daily channel
+aspire new aspire-starter --channel daily
+
+# TypeScript-AppHost-driven Python starter with Redis cache
+aspire new aspire-py-starter --use-redis-cache true --name py-shop --output ./py-shop --non-interactive
+```
+
+## When `aspire new` Is Wrong
+
+| Situation | Use Instead |
+|-----------|-------------|
+| Repo already contains services to model | `aspire init` (Workflow B in [SKILL.md](../SKILL.md)) |
+| AppHost already exists in the repo | `aspireify` (re-wire) or `aspire-orchestration` (lifecycle) |
+| Need to add an integration to an existing AppHost | `aspire add <package>` (handled by `aspire-orchestration`) |

.agents/skills/aspire-monitoring/SKILL.md

@@ -0,0 +1,197 @@
+---
+name: aspire-monitoring
+description: >-
+  **ANALYSIS SKILL** - Observe Aspire apps: logs, traces, metrics, resource state,
+  telemetry export, browser telemetry, and the standalone dashboard. Routes between local
+  Aspire CLI, AKS workload diagnostics, and deployed Azure resource health.
+  USE FOR: aspire logs, aspire otel logs, aspire otel traces, aspire otel spans, aspire
+  describe, aspire ps, aspire export, aspire dashboard run, --include-hidden, browser logs
+  in dashboard, WithBrowserLogs, App Insights query, AKS pod logs, container app logs.
+  DO NOT USE FOR: start/stop/wait (use aspire-orchestration), deploy/publish/destroy (use
+  aspire-deployment), AppHost code edits like WithBrowserLogs() (use aspireify), Azure
+  provisioning (use azure-prepare).
+  INVOKES: aspire CLI, azure-diagnostics (deployed Azure), kubectl + Container Insights.
+  FOR SINGLE OPERATIONS: Run the aspire CLI command directly for quick log or describe lookups.
+license: MIT
+metadata:
+  author: Microsoft
+  version: "0.0.1"
+---
+
+# Aspire Monitoring
+
+> Aspire CLI provides full observability **locally**. For deployed apps, route to platform-specific tools.
+
+## Diagnostics Bridge — Where To Look
+
+| Need | Environment | Tool | Command / Route |
+|------|------------|------|-----------------|
+| Console logs | Local dev | Aspire CLI | `aspire logs <resource>` |
+| Structured logs | Local dev | Aspire CLI | `aspire otel logs [resource]` |
+| Distributed traces | Local dev | Aspire CLI | `aspire otel traces [resource]` |
+| Span detail | Local dev | Aspire CLI | `aspire otel spans [resource]` |
+| Resource state | Local dev | Aspire CLI | `aspire describe` (add `--include-hidden` if a resource is missing) |
+| Telemetry export | Local dev | Aspire CLI | `aspire export [resource]` |
+| Standalone dashboard | Any (no AppHost) | Aspire CLI | `aspire dashboard run` (foreground/blocking — see below) |
+| Browser console / network / screenshots | Local dev (frontend) | Aspire dashboard | Surfaced via `Aspire.Hosting.Browsers` + `WithBrowserLogs()` |
+| AppHost / deployment definition | Authoring | aspire-deployment skill | → `aspire-deployment` skill |
+| AKS workload (pod logs, pod state) | Deployed AKS | kubectl + Container Insights | `kubectl logs <pod>`, `kubectl describe pod <pod>`, Container Insights in Azure Monitor |
+| Azure resource health (App Insights, Front Door, NSP, private endpoint) | Deployed Azure | azure-diagnostics | → `azure-diagnostics` skill |
+| App Service / Container Apps logs | Deployed Azure | azure-diagnostics | → `azure-diagnostics` skill |
+| Logs/state | Deployed Docker / Compose | Docker CLI | `docker logs <container>`, `docker compose logs <service>` |
+
+**Decision tree:**
+
+1. Is this about **AppHost code or deployment definition**? → `aspire-deployment` skill.
+2. Is the app **running locally** via `aspire start`? → Aspire CLI.
+3. Is it deployed to **AKS**? → kubectl + Container Insights for workload; `azure-diagnostics` for the cluster's Azure resources.
+4. Is it deployed to **other Azure** (App Service, Container Apps)? → `azure-diagnostics`.
+5. Is it deployed to **Docker / Compose**? → `docker` / `docker compose` CLI.
+
+See [diagnostics-bridge.md](references/diagnostics-bridge.md) for detailed routing.
+
+## Investigation Workflow
+
+When something is wrong, investigate before editing code:
+
+1. `aspire describe` — check resource state and endpoints
+2. `aspire otel logs <resource>` — structured logs first
+3. `aspire logs <resource>` — console output as secondary view
+4. `aspire otel traces <resource>` — cross-service activity
+5. `aspire export` — zipped telemetry snapshot for deeper analysis
+
+## Local Commands Reference
+
+| Command | Purpose | Example |
+|---------|---------|---------|
+| `aspire logs <resource>` | Console stdout/stderr | `aspire logs apiservice` |
+| `aspire logs --follow` | Stream logs in real-time | `aspire logs apiservice --follow` |
+| `aspire otel logs` | Structured OpenTelemetry logs | `aspire otel logs` |
+| `aspire otel traces` | Distributed trace data | `aspire otel traces` |
+| `aspire otel spans` | Individual span detail | `aspire otel spans` |
+| `aspire otel logs --trace-id <id>` | Logs correlated to trace (⚠️ verify flag) | `aspire otel logs --trace-id abc123` |
+| `aspire otel logs --dashboard-url` | Query a standalone dashboard (login URL or base URL + `--api-key`) | `aspire otel logs --dashboard-url "http://localhost:18888/login?t=TOKEN" --follow` |
+| `aspire otel traces --dashboard-url` | Query a standalone dashboard | `aspire otel traces --dashboard-url "http://localhost:18888/login?t=TOKEN"` |
+| `aspire describe` | Resource state, endpoints, health | `aspire describe --format Json` |
+| `aspire describe --include-hidden` | Include proxies, helper containers, migrations | `aspire describe --include-hidden --format Json` |
+| `aspire ps --format Json` | Resource list with state (filtered) | `aspire ps --format Json` |
+| `aspire ps --include-hidden --format Json` | Resource list with hidden resources | `aspire ps --include-hidden --format Json` |
+| `aspire export` | Portable telemetry bundle | `aspire export` |
+| `aspire dashboard run` | Standalone dashboard (foreground/blocking) | `aspire dashboard run` |
+
+### Hidden resources are filtered by default
+
+`aspire ps`, `aspire describe`, and other CLI commands filter out resources marked hidden in the AppHost (proxies, helper containers, migrations). The default output is correct for normal app inspection. Add `--include-hidden` when:
+
+- Debugging proxies, sidecar/helper containers, or migration jobs.
+- An expected resource is "missing" from `aspire ps` / `aspire describe`.
+- Triaging connectivity or wiring issues that may involve infrastructure resources.
+
+### Tips for Agents
+
+```bash
+# ✅ Use --format Json for machine parsing (supported: ps, describe, start)
+aspire describe --format Json
+
+# ✅ When a resource you expect is missing, retry with --include-hidden
+aspire ps --include-hidden --format Json | jq '.[] | {name, displayName, state, hidden}'
+
+# ✅ Get endpoints from describe, not guessing ports
+ENDPOINT=$(aspire describe apiservice --format Json | jq -r '.endpoints[0].url')
+
+# ✅ Use --apphost <path> when multiple AppHosts exist
+aspire describe --apphost ./src/MyApp.AppHost/
+```
+
+## Known Diagnostics Issues
+
+| Issue | Symptom | Workaround |
+|-------|---------|-----------|
+| TS AppHost DNS failure ([#15782](https://github.com/microsoft/aspire/issues/15782)) | `aspire otel` "No such host" for `*.dev.localhost` | Use `--dashboard-url localhost:PORT` |
+| `--isolated` mode telemetry ([#16107](https://github.com/microsoft/aspire/issues/16107)) | OTEL port not randomized in isolated mode | Avoid `--isolated` if telemetry is needed |
+| Resource missing from `aspire ps` / `aspire describe` | Hidden-by-default resources such as proxies, helpers, or migrations | Re-run with `--include-hidden` |
+
+> **Resolved in 13.3**: The standalone-dashboard workaround for [#16236](https://github.com/microsoft/aspire/issues/16236) is obsolete — use `aspire dashboard run` (see below).
+
+## Standalone Dashboard (`aspire dashboard run`)
+
+`aspire dashboard run` launches the Aspire Dashboard without an AppHost, so any OTLP-emitting application (Aspire or not) can stream telemetry into it.
+
+```bash
+aspire dashboard run
+# Dashboard:  http://localhost:18888/login?t=<TOKEN>
+# OTLP/gRPC:  http://localhost:4317
+# OTLP/HTTP:  http://localhost:4318
+```
+
+> ⚠️ **Foreground / blocking.** `aspire dashboard run` does **not** return until you stop it (Ctrl-C). Agents must treat it as a long-running background process — start it with the bash tool's `mode="async"`, capture the dashboard URL and token from initial output, and leave it running. Do **not** invoke it as a one-shot synchronous command, and do **not** wait for it to "finish".
+
+### Connect the Aspire CLI to a standalone dashboard
+
+`aspire otel logs` and `aspire otel traces` accept `--dashboard-url`. The simplest form passes the full login URL printed by `aspire dashboard run` — the CLI normalizes it automatically:
+
+```bash
+# Stream structured logs from a standalone dashboard (login URL form)
+aspire otel logs --dashboard-url "http://localhost:18888/login?t=TOKEN" --follow
+
+# Search recent traces
+aspire otel traces --dashboard-url "http://localhost:18888/login?t=TOKEN"
+```
+
+For dashboards configured with API-key authentication (e.g., the standalone container image with a separate API key), pass `--api-key` alongside the base `--dashboard-url`:
+
+```bash
+aspire otel logs --dashboard-url https://my-dashboard.example.com --api-key "$DASHBOARD_API_KEY" --follow
+```
+
+The container-image standalone dashboard still works for environments where the CLI isn't available.
+
+## Browser Telemetry (`Aspire.Hosting.Browsers`)
+
+The `Aspire.Hosting.Browsers` integration captures **browser console logs, network requests, and screenshots** from frontend resources during local development and surfaces them in the dashboard alongside server-side telemetry. Frontend resources opt in via `WithBrowserLogs()`.
+
+| Need | Action |
+|------|--------|
+| Inspect browser telemetry that is already wired | Open the dashboard; browser logs / network / screenshots appear next to server telemetry for the resource |
+| Confirm a frontend has it enabled | Check the AppHost for `.WithBrowserLogs()` on the resource (e.g., `AddViteApp("frontend").WithBrowserLogs()`) |
+| Add `WithBrowserLogs()` to a resource | → **`aspireify` skill** (AppHost authoring) — do not edit the AppHost from this skill |
+
+When parsing telemetry programmatically, browser logs surface as additional OTLP log records associated with the frontend resource — `aspire otel logs <frontend-resource>` returns them alongside server logs.
+
+## Dashboard UX Features
+
+Agents inspecting a running dashboard should know:
+
+- **Notification center** (bell icon, top-right) — surfaces results of resource commands and lifecycle events. Inline command responses appear here instead of being scraped from the logs panel.
+- **Rebuild command** — available on container and project resources; rebuilds the image and restarts the resource without restarting the whole AppHost. Result lands in the notification center.
+- **Structured command results** — custom resource commands return `ExecuteCommandResult` with a `Message` payload that the dashboard renders inline; HTTP commands set `HttpCommandResultMode.Auto | Json | Text | None` to control how the response body is shown.
+
+> Authoring custom commands or `WithBrowserLogs()` calls is AppHost work — route to **`aspireify`**. This skill is for *observing* what those features surface in the dashboard.
+
+## Why Aspire CLI Can't Do Remote Diagnostics
+
+The Aspire CLI talks to a *running AppHost* through a local backchannel socket at `~/.aspire/backchannels/`. This is **by design** — there is no remote backchannel. For deployed apps, route to platform-specific tools (azure-diagnostics, kubectl, docker).
+
+**Exception**: if a Dashboard is reachable (deployed alongside the app, or running standalone), `aspire otel logs` and `aspire otel traces` can query it via `--dashboard-url` (login URL form) and optional `--api-key` (see the Standalone Dashboard section above). This does **not** apply to `aspire logs` or `aspire describe`.
+
+## Handoff Rules
+
+| Scenario | Route To |
+|----------|----------|
+| Start/stop/wait/rebuild lifecycle | → `aspire-orchestration` skill |
+| Deploy, publish, pipeline steps, AppHost compute environment binding | → `aspire-deployment` skill |
+| AppHost code changes (`WithBrowserLogs()`, custom commands, `WithHttpCommand`) | → `aspireify` skill |
+| Deployed Azure resource health (App Insights, Front Door, NSP, private endpoint, ACA, App Service) | → `azure-diagnostics` skill (azure-skills) |
+| AKS workload diagnostics (pod logs, pod state, Container Insights) | → `kubectl` + Azure Monitor Container Insights |
+| Docker / Compose container logs | → `docker logs` / `docker compose logs` |
+
+## Project-Local Skill Routing
+
+If `.agents/skills/aspire/SKILL.md` exists (from `aspire agent init`), see its
+`references/monitoring.md` for deeper telemetry workflow guidance.
+
+## References
+
+- [diagnostics-bridge.md](references/diagnostics-bridge.md) — Local vs deployed routing detail
+- [monitoring.md](references/monitoring.md) — Telemetry inspection and export patterns
+- [playwright-handoff.md](references/playwright-handoff.md) — Find the correct Aspire frontend URL before browser testing

.agents/skills/aspire-monitoring/references/diagnostics-bridge.md

@@ -0,0 +1,209 @@
+# Diagnostics Bridge — Local vs Deployed
+
+> **Purpose**: Route diagnostics requests to the correct tool based on where the application is running.
+
+## Decision Flowchart
+
+```
+Is the request about AppHost code or deployment definition?
+│
+├── YES → Route to aspire-deployment skill (and aspireify for code edits)
+│
+└── NO → Is the app running locally (via aspire start)?
+    │
+    ├── YES → Use Aspire CLI
+    │   ├── Console logs       → aspire logs <resource>
+    │   ├── Structured logs    → aspire otel logs
+    │   ├── Traces             → aspire otel traces
+    │   ├── Spans              → aspire otel spans
+    │   ├── Resource state     → aspire describe   (add --include-hidden if missing)
+    │   ├── Export telemetry   → aspire export
+    │   ├── Filter by trace    → aspire otel logs --trace-id <id> (verify flag)
+    │   └── Standalone dash    → aspire dashboard run  (foreground/blocking)
+    │
+    └── NO (deployed) → Route by target
+        ├── Azure Kubernetes Service (AKS)
+        │   ├── Pod logs           → kubectl logs <pod>
+        │   ├── Pod / workload state → kubectl describe pod <pod>, kubectl get pods
+        │   ├── Cluster Azure resources → azure-diagnostics skill
+        │   └── Cluster-wide telemetry → Azure Monitor Container Insights
+        │
+        ├── Other Azure (App Service, Container Apps) → azure-diagnostics skill
+        │   ├── App logs           → az containerapp logs show / az webapp log tail
+        │   ├── Metrics            → az monitor metrics list
+        │   ├── App Insights       → az monitor app-insights query
+        │   ├── Resource health    → az resource show / AppLens
+        │   └── Front Door / NSP / private endpoint → azure-diagnostics
+        │
+        └── Docker / Compose → Use Docker tooling
+            ├── Container logs     → docker logs <container>
+            ├── Service logs       → docker compose logs <service>
+            └── Resource state     → docker ps / docker compose ps
+```
+
+---
+
+## Local Development — Full Aspire CLI Support
+
+When the app is running locally via `aspire start`, the Aspire CLI provides complete observability:
+
+### How It Works
+
+The Aspire CLI communicates with the running AppHost through a **backchannel socket** at `~/.aspire/backchannels/`. This is a local-only IPC mechanism — it cannot connect to remote instances.
+
+### Available Commands
+
+| Command | Purpose | Example |
+|---------|---------|---------|
+| `aspire logs <resource>` | Console stdout/stderr from a resource | `aspire logs apiservice` |
+| `aspire logs --follow` | Stream logs in real-time | `aspire logs apiservice --follow` |
+| `aspire otel logs` | Structured OpenTelemetry log records | `aspire otel logs` |
+| `aspire otel traces` | Distributed trace data | `aspire otel traces` |
+| `aspire otel spans` | Individual span-level detail | `aspire otel spans` |
+| `aspire otel logs --trace-id <id>` | Logs correlated to a specific trace (⚠️ verify flag in your version) | `aspire otel logs --trace-id abc123` |
+| `aspire otel logs --dashboard-url` | Query a standalone or deployed dashboard | `aspire otel logs --dashboard-url "https://localhost:18888/login?t=TOKEN"` |
+| `aspire describe` | Resource state, endpoints, health (filtered) | `aspire describe --format Json` |
+| `aspire describe --include-hidden` | Include hidden resources (proxies, helpers, migrations) | `aspire describe --include-hidden --format Json` |
+| `aspire ps --include-hidden --format Json` | Resource list including hidden resources | `aspire ps --include-hidden --format Json` |
+| `aspire export` | Export portable telemetry bundle | `aspire export` |
+| `aspire dashboard run` | Run the Aspire Dashboard standalone (foreground/blocking) | `aspire dashboard run` |
+
+### Tips for Agents
+
+```bash
+# ✅ Always use --format Json for machine parsing
+aspire describe --format Json
+
+# ✅ When an expected resource is missing, retry with --include-hidden
+#    Hidden-by-default resources (proxies, helper containers, migrations)
+aspire ps --include-hidden --format Json
+
+# ✅ Get endpoints from describe, not guessing ports
+ENDPOINT=$(aspire describe apiservice --format Json | jq -r '.endpoints[0].url')
+
+# ✅ Correlate logs to a specific request
+aspire otel logs --trace-id <trace-id-from-otel-traces>
+```
+
+---
+
+## Standalone Dashboard — `aspire dashboard run`
+
+`aspire dashboard run` runs the Aspire Dashboard without an AppHost — point any OTLP-emitting application at it (Aspire or not) and telemetry shows up live.
+
+```bash
+aspire dashboard run
+# Dashboard:  http://localhost:18888/login?t=<TOKEN>
+# OTLP/gRPC:  http://localhost:4317
+# OTLP/HTTP:  http://localhost:4318
+```
+
+> ⚠️ **Foreground / blocking.** This command does not return until you stop it (Ctrl-C). Agents must start it as a long-running background process (e.g., bash `mode="async"`), capture the dashboard URL and `t=` token from initial output, and leave it running. Do **not** treat it as a one-shot synchronous command.
+
+### Connect the CLI to a standalone dashboard
+
+The `aspire otel logs` and `aspire otel traces` commands accept `--dashboard-url` (and `--api-key` when the dashboard is configured with API-key auth) so the CLI can query a standalone dashboard without an AppHost.
+
+The simplest form passes the full login URL printed by `aspire dashboard run` — the CLI normalizes login URLs automatically:
+
+```bash
+# Stream structured logs (login URL form — token in URL)
+aspire otel logs --dashboard-url "http://localhost:18888/login?t=TOKEN" --follow
+
+# Search recent traces
+aspire otel traces --dashboard-url "http://localhost:18888/login?t=TOKEN"
+```
+
+For dashboards that use a separate API key (e.g., the standalone container image with API-key auth configured), pass `--api-key` alongside the base URL:
+
+```bash
+aspire otel logs --dashboard-url https://my-dashboard.example.com --api-key "$DASHBOARD_API_KEY" --follow
+```
+
+The container-image standalone dashboard is still available where the CLI isn't an option.
+
+---
+
+## Browser Telemetry (`Aspire.Hosting.Browsers`)
+
+The `Aspire.Hosting.Browsers` integration captures **browser console logs, network requests, and screenshots** from frontend resources during local development. Frontend resources opt in by calling `WithBrowserLogs()` in the AppHost. The data shows up in the dashboard alongside server-side telemetry.
+
+| Need | Action |
+|------|--------|
+| Inspect existing browser telemetry | Open the dashboard or run `aspire otel logs <frontend-resource>` |
+| Check whether a frontend has it enabled | Look for `.WithBrowserLogs()` in the AppHost |
+| Add `WithBrowserLogs()` to a resource | → **`aspireify` skill** (AppHost authoring) |
+
+---
+
+## Deployed Applications — Routing
+
+### Why Aspire CLI Cannot Help Directly
+
+The Aspire CLI's `aspire logs`, `aspire describe`, and other backchannel commands use the local backchannel socket at `~/.aspire/backchannels/`. This is **by design** — there is no remote backchannel. When an app is deployed, the Aspire CLI cannot reach it directly.
+
+**Exception:** if a Dashboard is reachable (deployed alongside the app, or running standalone), `aspire otel logs --dashboard-url` and `aspire otel traces --dashboard-url` (with `--api-key` when the dashboard requires it) can query it remotely. This does **not** extend to `aspire logs` or `aspire describe`.
+
+```bash
+# Limited remote support via deployed Dashboard — login URL form
+aspire otel logs --dashboard-url "https://my-dashboard.azurecontainerapps.io/login?t=TOKEN"
+aspire otel traces --dashboard-url "https://my-dashboard.azurecontainerapps.io/login?t=TOKEN"
+
+# Or with separate API-key auth
+aspire otel logs --dashboard-url https://my-dashboard.azurecontainerapps.io --api-key "$DASHBOARD_API_KEY"
+```
+
+### Three-way deployed routing
+
+| Target | Use | Examples |
+|--------|-----|----------|
+| **AKS workload (pod logs, pod state, container insights)** | `kubectl` + Azure Monitor Container Insights | `kubectl logs <pod>`, `kubectl describe pod <pod>`, Container Insights queries |
+| **Azure resource health** (App Insights, Front Door, NSP, private endpoint, ACA, App Service) | `azure-diagnostics` skill (azure-skills) | `az containerapp logs show`, `az monitor app-insights query`, AppLens |
+| **Docker / Compose** | Docker CLI | `docker logs <container>`, `docker compose logs <service>` |
+
+### azure-diagnostics — quick reference
+
+| Need | azure-diagnostics Approach |
+|------|---------------------------|
+| Application logs | `az containerapp logs show --name APP -g RG --follow` |
+| Metrics | `az monitor metrics list --resource RESOURCE_ID` |
+| App Insights queries | `az monitor app-insights query --analytics-query "KQL"` |
+| Resource health | AppLens MCP tool or `az resource show` |
+| Activity log | `az monitor activity-log list -g RG` |
+| Front Door / NSP / private endpoint | `az network front-door`, `az network perimeter`, AppLens |
+
+### Production Telemetry — Automatic Configuration
+
+Aspire auto-configures Application Insights when `AddAzureApplicationInsights()` is used in the AppHost. Deployed apps export OpenTelemetry data to App Insights automatically, providing:
+
+- Request traces and dependency tracking
+- Exception logging
+- Performance metrics
+- Live Metrics stream
+- Application Map (service topology)
+
+No additional configuration is needed — Aspire wires the connection string during deployment.
+
+## Known Diagnostics Issues
+
+| Issue | Symptom | Workaround |
+|-------|---------|-----------|
+| TS AppHost DNS failure ([#15782](https://github.com/microsoft/aspire/issues/15782)) | `aspire otel` returns "No such host" for `*.dev.localhost` | Use `--dashboard-url localhost:PORT` directly |
+| `--isolated` mode telemetry ([#16107](https://github.com/microsoft/aspire/issues/16107)) | OTEL port not randomized in isolated mode | Avoid `--isolated` if telemetry is needed |
+| Resource missing from `aspire ps` / `aspire describe` | Hidden-by-default resources such as proxies, helpers, or migrations | Re-run with `--include-hidden` |
+
+> **Resolved in 13.3**: The standalone-dashboard workaround for [#16236](https://github.com/microsoft/aspire/issues/16236) is obsolete — `aspire dashboard run` ships in-box (see Standalone Dashboard section above).
+
+---
+
+## Summary: Where to Look
+
+| Question | Local Dev | Deployed |
+|----------|-----------|----------|
+| "What's the status of my resources?" | `aspire describe` (try `--include-hidden` if missing) | Azure Portal / `az containerapp show` / `kubectl describe pod` |
+| "Show me the logs" | `aspire logs <resource>` | `az containerapp logs show` / `kubectl logs <pod>` / `docker logs` |
+| "Show me distributed traces" | `aspire otel traces` | App Insights → Transaction Search |
+| "Why is this resource unhealthy?" | `aspire describe` + `aspire logs` | AppLens / azure-diagnostics / `kubectl describe pod` |
+| "What metrics are available?" | Aspire Dashboard (auto-launched or `aspire dashboard run`) | Azure Monitor / App Insights / Container Insights |
+| "Export telemetry for analysis" | `aspire export` | App Insights export / KQL query |
+| "Browser console / network logs" | Dashboard (with `WithBrowserLogs()` enabled) — N/A in production |

.agents/skills/aspire-monitoring/references/monitoring.md

@@ -0,0 +1,161 @@
+# Monitoring
+
+Use this when the task is about inspecting app state, logs, traces, endpoints, or sharable diagnostics.
+
+## Scenario: I Need To Know What Is Running And Where The Endpoints Are
+
+Use these commands when the first job is to inspect current resource state, find URLs, or hand machine-readable app state to another tool.
+
+```bash
+aspire describe
+aspire resources
+aspire describe --apphost <path>
+aspire describe --apphost <path> --format Json
+```
+
+Keep these points in mind:
+
+- Use `aspire describe` first when you need the current state of the running app before deciding what to do next.
+- Use `--apphost <path>` when the workspace has multiple AppHosts or discovery is ambiguous.
+- Prefer `--format Json` when another tool or script needs to consume the result, such as a Playwright handoff or endpoint extraction.
+
+## Scenario: Something Is Wrong, But Investigate Before Editing Code
+
+Use these commands when the task is to diagnose behavior in the live app before making code changes.
+
+```bash
+aspire otel logs [resource] --format Json
+aspire otel traces [resource] --format Json
+aspire otel spans [resource] --format Json
+aspire otel logs --trace-id <id> --format Json
+aspire otel logs [resource] --search "connection timeout"
+aspire otel spans [resource] --search "/api/products"
+aspire logs [resource]
+aspire logs [resource] --search "error"
+```
+
+Keep these points in mind:
+
+- Prefer structured telemetry before raw console logs when possible.
+- Use `aspire logs` as a secondary console-output view after checking structured telemetry.
+- Use the trace-filtered log command when you already have a trace id and want the related log slice.
+- Use `--search` to filter results by a case-insensitive text match across all fields (messages, attribute keys/values, trace/span IDs, resource names, severity, scope names). This is the fastest way to narrow output when you know what you're looking for.
+- Prefer `--format Json` when another tool or script needs to consume the result, such as a Playwright handoff or endpoint extraction.
+- `[resource]` is optional. Include it to filter results to a single resource; omit it to see all resources.
+- `--search` can be combined with other options like `--format Json`, `--trace-id`, `--limit`, and resource filtering.
+
+## Scenario: I Need A Sharable Diagnostics Bundle
+
+Use this command when you need a portable handoff artifact for deeper analysis or for another person to inspect offline.
+
+```bash
+aspire export [resource]
+```
+
+Keep these points in mind:
+
+- Use `aspire export` when you need a sharable bundle of telemetry and resource state.
+- `[resource]` is optional. Include it to filter the export to a single resource; omit it to export all resources.
+- The output is a zip archive (default name `aspire-export-<timestamp>.zip`) containing up to four directories:
+  - `resources/` — one JSON file per resource with resource details (name, type, state, endpoints, environment variables, etc.).
+  - `consolelogs/` — one plain-text file per resource with raw console output lines.
+  - `structuredlogs/` — one JSON file per resource with structured log entries in OTLP format.
+  - `traces/` — one JSON file per resource with distributed traces and spans in OTLP format.
+- When extracting the export for analysis, look at `resources/` first for an overview, then drill into `consolelogs/`, `structuredlogs/` and `traces/` for detailed diagnostics.
+
+## Dashboard Links
+
+Commands like `aspire describe`, `aspire otel logs`, `aspire otel traces`, and `aspire otel spans` may include dashboard URLs in their JSON output. Only use URLs that are explicitly returned by these commands — do not construct dashboard URLs yourself.
+
+When a dashboard link is returned alongside a resource or telemetry entry, make the resource name, trace ID, or span ID a clickable markdown link using the returned URL.
+
+## Displaying Resources
+
+When showing resource state to the user, display the state text with a circle emoji prefix:
+
+- 🟢 Running, healthy
+- 🟡 Starting, waiting
+- 🔴 Failed, error, unhealthy
+- ⚪ Stopped, exited
+
+Link resource names to their dashboard page when the dashboard URL is known.
+
+## Displaying Telemetry
+
+When showing structured logs, prefix each entry with an emoji matching the log level:
+
+- 🔴 Error / Critical
+- 🟡 Warning
+- 🔵 Information
+- ⚪ Debug / Trace
+
+Link resource names to their dashboard resource page. When trace IDs are present, display the first 7 characters and link that value to the full trace detail page.
+
+When showing traces or spans, use 🟢 for success/unset status and 🔴 for error status. Display only the first 7 characters of trace and span IDs, and link those values to their dashboard detail pages.
+
+## Production Monitoring Strategy (Azure)
+
+Aspire auto-configures Application Insights when `AddAzureApplicationInsights()` is used in the AppHost. Deployed Azure apps export OpenTelemetry to App Insights automatically:
+
+- Request traces and dependency tracking
+- Exception logging
+- Performance metrics
+- Live Metrics stream
+- Application Map (service topology)
+
+No additional configuration is needed for Azure once the AppHost and deployment target wire the connection strings during deployment.
+
+> **Docker Compose / Kubernetes**: Auto-configured App Insights does not apply. These targets require platform-native observability (Prometheus, Grafana, ELK, etc.) unless the app is explicitly configured to export OTEL to an external collector.
+
+## Deployed App Monitoring — Route by Target
+
+| Target | Tool | Commands |
+|--------|------|----------|
+| Azure Container Apps / App Service | azure-diagnostics | `az containerapp logs show`, `az webapp log tail`, App Insights |
+| Azure resource health (Front Door, NSP, private endpoint, App Insights) | azure-diagnostics | AppLens, `az monitor app-insights query` |
+| AKS workload (pods, workloads) | kubectl + Container Insights | `kubectl logs <pod>`, `kubectl describe pod <pod>`, Azure Monitor Container Insights |
+| Docker / Compose | Docker CLI | `docker logs <container>`, `docker compose logs <service>` |
+
+## Standalone Dashboard (`aspire dashboard run`)
+
+`aspire dashboard run` launches the Aspire Dashboard without an AppHost, so any OTLP-emitting application can stream telemetry into it.
+
+```bash
+aspire dashboard run
+# Dashboard:  http://localhost:18888/login?t=<TOKEN>
+# OTLP/gRPC:  http://localhost:4317
+# OTLP/HTTP:  http://localhost:4318
+```
+
+> **Foreground / blocking.** `aspire dashboard run` does not return until stopped. Agents must treat it as a long-running background process, capture the dashboard URL and token from initial output, and leave it running. Do not invoke it as a one-shot synchronous command, and do not wait for it to "finish".
+
+### Connect the Aspire CLI to a standalone dashboard
+
+`aspire otel logs` and `aspire otel traces` accept `--dashboard-url`. The simplest form passes the full login URL printed by `aspire dashboard run`; the CLI normalizes it automatically:
+
+```bash
+aspire otel logs --dashboard-url "http://localhost:18888/login?t=TOKEN" --follow
+aspire otel traces --dashboard-url "http://localhost:18888/login?t=TOKEN"
+```
+
+For dashboards configured with API-key authentication, pass `--api-key` alongside the base `--dashboard-url`:
+
+```bash
+aspire otel logs --dashboard-url https://my-dashboard.example.com --api-key "$DASHBOARD_API_KEY" --follow
+```
+
+## Browser Telemetry
+
+Frontend resources opted into `Aspire.Hosting.Browsers` via `WithBrowserLogs()` surface browser console logs, network requests, and screenshots in the dashboard alongside server-side telemetry.
+
+| Need | Action |
+|------|--------|
+| Inspect browser telemetry that is already wired | Open the dashboard; browser logs / network / screenshots appear next to server telemetry for the resource |
+| Confirm a frontend has it enabled | Check the AppHost for `.WithBrowserLogs()` on the resource |
+| Add `WithBrowserLogs()` to a resource | Route to `aspireify`; this is AppHost authoring, not monitoring |
+
+## Why Aspire CLI Can't Do Remote Diagnostics
+
+The Aspire CLI talks to a *running AppHost* through a local backchannel socket at `~/.aspire/backchannels/`. This is by design — there is no remote backchannel. For deployed apps, route to platform-specific tools such as azure-diagnostics, kubectl, or Docker.
+
+**Exception**: if a Dashboard is reachable (deployed alongside the app, or running standalone), `aspire otel logs` and `aspire otel traces` can query it via `--dashboard-url` and optional `--api-key`. This does not apply to `aspire logs` or `aspire describe`.

.agents/skills/aspire-monitoring/references/playwright-handoff.md

@@ -0,0 +1,21 @@
+# Playwright Handoff
+
+Use this when Playwright CLI is already configured and the next step is browser testing against a running Aspire app.
+
+## Scenario: I Need The Right Frontend URL Before Browser Testing
+
+Use these commands when the task is to discover the live frontend endpoint from Aspire state and then hand that URL to Playwright.
+
+```bash
+aspire describe --format Json
+aspire describe --apphost <path> --format Json
+playwright-cli --help
+```
+
+Keep these points in mind:
+
+- Aspire discovers the endpoint first; Playwright uses the discovered endpoint after the handoff.
+- Prefer `aspire describe --format Json` when the URL needs to be consumed by a script or passed to another tool.
+- Use `--apphost <path>` when multiple AppHosts exist and the user is asking about one specific app.
+- Do not guess frontend endpoints without first consulting Aspire state.
+- If multiple frontends exist, use Aspire state to disambiguate which URL Playwright should use.

.agents/skills/aspire-orchestration/SKILL.md

@@ -0,0 +1,204 @@
+---
+name: aspire-orchestration
+description: >-
+  **WORKFLOW SKILL** — Manage Aspire AppHost lifecycle and recover from file locks,
+  port conflicts, and orphaned processes. WHEN: "start my Aspire app", "aspire start",
+  "aspire stop", "aspire wait", "restart the API service", "file lock error",
+  "MSB3491", "CS2012", "port already in use", "upgrade Aspire CLI", "aspire update --self",
+  "proxies missing in aspire ps", "--include-hidden", "aspire integration list",
+  "aspire integration search", "default watch", "hot reload". INVOKES: aspire CLI
+  (start, stop, wait, ps, resource, integration, add, init, doctor, update, restore).
+  FOR SINGLE OPERATIONS: Run the aspire CLI command directly.
+license: MIT
+metadata:
+  author: Microsoft
+  version: "0.0.1"
+---
+
+# Aspire Orchestration
+
+> **MANDATORY COMPLIANCE** — This skill prevents agent self-harm in Aspire projects.
+> Violating these rules causes file locks, orphaned processes, and user frustration ([#15801](https://github.com/microsoft/aspire/issues/15801)).
+
+## Prerequisites
+
+| Requirement | Install |
+|-------------|---------|
+| .NET 10.0 SDK | https://dotnet.microsoft.com/download |
+| Aspire CLI (curl/PowerShell) | `curl -sSL https://aspire.dev/install.sh \| bash` |
+| Aspire CLI (NativeAOT global tool, .NET 10) | `dotnet tool install -g Aspire.Cli` |
+
+Either install method works. The `dotnet tool install` path produces a NativeAOT binary
+(instant startup, no JIT warmup) and is the recommended option when .NET 10 is already present.
+
+## Detection
+
+Activate when ANY signal is present:
+
+| Signal | How to Detect | Confidence |
+|--------|---------------|------------|
+| C# AppHost | `.csproj` containing `Aspire.AppHost.Sdk` | ✅ Definitive |
+| File-based C# AppHost | `apphost.cs` or `.cs` file with `#:sdk Aspire.AppHost.Sdk` | ✅ Definitive |
+| TypeScript AppHost | `apphost.ts` file in project | ✅ Definitive |
+| Aspire config | `aspire.config.json` in project root | High |
+| Aspire settings | `.aspire/` directory present | High |
+| Generated TS modules | `.aspire/modules/` directory present | High |
+| Service defaults | `Aspire.ServiceDefaults` in project references | Medium |
+
+See [detection.md](references/detection.md) for detailed fingerprinting.
+
+## Safety Guardrails
+
+| Situation | ✅ ALWAYS Do | ❌ NEVER Do |
+|-----------|-------------|------------|
+| Start an Aspire app | `aspire start` | `dotnet run` on AppHost |
+| Wait for resource ready | `aspire wait <resource>` | `curl` / HTTP polling loops |
+| Code changed in a resource | Prefer resource commands, runtime watch/HMR, dashboard actions, or IDE-managed debugging | `dotnet build` against locked files |
+| Task complete | `aspire stop` | Leave processes running |
+| Check resource status | `aspire describe` / `aspire ps` | Manual process inspection |
+| Working in git worktree | `aspire start --isolated` | `aspire start` without isolation |
+| Running from AI agent | Add `--non-interactive` to all commands | Assuming interactive terminal |
+| Editing unfamiliar API | `aspire docs search <topic>` then `aspire docs api search <query>` for API reference | Guessing API shape |
+| C# AppHost API inspection | Use `dotnet-inspect` skill (if available) for local symbols | Guessing overloads or builder chains |
+| Adding custom dashboard/resource commands | `aspire docs search "custom resource commands"` first | Inventing `WithCommand` patterns without docs |
+| Installing Aspire support | Use `aspire add` or `aspire init` | ~~`dotnet workload install aspire`~~ (obsolete) |
+
+See [safety-guardrails.md](references/safety-guardrails.md) for detailed rules and recovery patterns.
+
+## Default Workflow
+
+1. Confirm workspace is Aspire — identify the AppHost
+2. `aspire start` (or `aspire start --isolated` in worktrees)
+3. `aspire wait <resource>` before interacting with any resource
+4. `aspire describe` to inspect state, then work
+5. If AppHost code changed, rerun `aspire start`; if only one resource changed, prefer the resource's commands/watch/HMR/debug workflow
+6. `aspire stop` when cleanup is explicitly requested or needed to release locks/ports
+
+## Quick Reference
+
+| Task | Command |
+|------|---------|
+| Start app (agents) | `aspire start` (background, preferred) |
+| Start app (human) | `aspire run` (foreground, dashboard) |
+| Stop app | `aspire stop` |
+| Wait for resource | `aspire wait <resource>` |
+| Check status | `aspire ps` or `aspire describe` |
+| Show hidden resources (proxies, helpers, migrations) | `aspire ps --include-hidden` / `aspire describe --include-hidden` |
+| Resource operation | `aspire resource <resource-name> <command>` such as `stop`, `start`, or `rebuild` when exposed |
+| Create new project | `aspire new aspire-starter` |
+| Add Aspire to existing | `aspire init` (then hand off to `aspireify` skill for wiring) |
+| Add integration | `aspire add <package>` |
+| Discover integrations | `aspire integration list --format Json` / `aspire integration search <query> --format Json` |
+| Upgrade the CLI itself | `aspire update --self` |
+| Update project package refs | `aspire update` (modifies project files — get user approval) |
+| Restore generated files | `aspire restore` |
+| Environment maintenance | `aspire cache clear`, `aspire certs trust`, `aspire certs clean` |
+| Diagnose environment | `aspire doctor` |
+| Machine-readable output | `--format Json` (supported: `ps`, `describe`, `start`) |
+| Look up API reference | `aspire docs api search <query> --language csharp\|typescript` |
+| Browse API entries | `aspire docs api list <scope>` |
+| Get API detail | `aspire docs api get <id>` |
+
+## Error Handling
+
+| Symptom | Cause | Action |
+|---------|-------|--------|
+| **File lock errors during build (`MSB3491`, `CS2012`)** | **Aspire is running and holds locks on `bin/`, `obj/`, and assemblies.** | **Run `aspire stop` first**, then rebuild or `aspire start`. Do NOT conclude the project has a permanent build failure. |
+| "Port already in use" | Previous instance running | `aspire stop`, then `aspire start` |
+| Resource not found | App not started or name wrong | `aspire ps` to check |
+| Build errors in resource | Code error, not Aspire issue | Fix code, then use resource commands/watch/HMR/debug workflow or rerun `aspire start` if AppHost code changed |
+| Environment issues | Missing SDK or tools | `aspire doctor` to diagnose |
+| JSON parse failure from `aspire start` | Mixed human/JSON output ([#15843](https://github.com/microsoft/aspire/issues/15843)) | Strip non-JSON lines before parsing |
+| `aspire wait` rejects name | Use `displayName` not `name` ([#15842](https://github.com/microsoft/aspire/issues/15842)) | Use `displayName` from `aspire ps --format Json` |
+| `aspire ps` hangs | AppHost on breakpoint ([#15576](https://github.com/microsoft/aspire/issues/15576)) | Use timeout, check AppHost process |
+| `aspire agent init` fails | Non-interactive terminal ([#16264](https://github.com/microsoft/aspire/issues/16264)) | Run from standard terminal |
+| Docker daemon unavailable | Container-backed resources fail to start | Start Docker Desktop, then `aspire start` |
+| Multiple AppHosts detected | Wrong AppHost targeted | Use `--apphost <path>` to specify explicitly |
+
+### 🔒 File-Lock Recovery (MSB3491 / CS2012) — Always `aspire stop` First
+
+When a build fails with `error MSB3491: Could not write to output file ...` or
+`error CS2012: Cannot open ... for writing`, the project itself is healthy —
+**Aspire is running and holding file locks** on the resource's output assemblies.
+The recovery is always the same:
+
+```bash
+# ✅ Correct recovery sequence
+aspire stop              # release the locks
+# ... then either rebuild / restart one resource if the resource exposes commands ...
+aspire resource <name> rebuild   # example: C# project resource with rebuild command
+# ... or restart the whole AppHost ...
+aspire start             # if AppHost code changed or Aspire was already stopped
+```
+
+| ❌ NEVER do | ✅ ALWAYS do |
+|------------|-------------|
+| Tell the user the project has a permanent build failure | Recognize the lock as Aspire holding outputs and run `aspire stop` |
+| `dotnet build` again with locks held | `aspire stop` first, then `dotnet build` (or prefer resource commands/watch/HMR/debug workflow) |
+| Delete `bin/` / `obj/` to "fix" the lock | `aspire stop` — deletion may succeed but the next build relocks |
+| `pkill dotnet` or `kill <PID>` to free locks | `aspire stop` — clean shutdown via the CLI, no orphans |
+| Tell the user to "reboot" or "restart your machine" | `aspire stop` — single command, instant fix |
+
+The same rule applies to any "file in use", "cannot access the file", or
+"another process is using" error during a build of an Aspire-managed resource.
+
+## Handoff Rules
+
+| Scenario | Route To |
+|----------|----------|
+| AppHost wiring after `aspire init` (scan repo, add resources, ServiceDefaults/OTel) | → `aspireify` skill ([`../aspireify/SKILL.md`](../aspireify/SKILL.md)) or project-local `.agents/skills/aspireify/SKILL.md` |
+| Browser logs (`Aspire.Hosting.Browsers` / `WithBrowserLogs()`) and dashboard authoring | → `aspireify` skill (code edits) and `aspire-monitoring` (discovery) |
+| Custom resource commands (`WithCommand`, `ExecuteCommandResult`, `HttpCommandResultMode`) | → `aspireify` skill |
+| Lifecycle hooks (`SubscribeBeforeStart`, `SubscribeAfterResourcesCreated`, BeforeStart pipeline phase) | → `aspireify` skill |
+| Endpoint authoring (`WithEndpoint` updates, `ExcludeReferenceEndpoint` flag) | → `aspireify` skill |
+| Deploy, publish, pipeline steps, `aspire destroy` | → `aspire-deployment` skill |
+| Logs, traces, metrics, dashboard, `aspire dashboard run` | → `aspire-monitoring` skill |
+| Deployed app diagnostics | → `azure-diagnostics` skill (azure-skills) |
+
+## Runtime Settings And Environment
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `ASPIRE_ENABLE_CONTAINER_TUNNEL` | `true` | Container tunnel provides uniform host connectivity across Docker Desktop, Docker Engine, and Podman. Set to `false` to opt out. |
+| `ASPIRE_ENVIRONMENT` | unset | Selects the environment-specific config profile — controls which `appsettings.{environment}.json` is loaded and which environment is reported in dashboard telemetry. |
+| `ASPIRE_DCP_USE_DEVELOPER_CERTIFICATE` | `true` | The Aspire trusted developer certificate is used by DCP on Windows. Set to `false` to opt out. |
+| `features.defaultWatchEnabled` | false unless configured | Enables Aspire default watch for supported C# and TypeScript AppHosts. Do not treat this as per-resource rebuild, restart, or hot reload for resource source changes. |
+
+## TypeScript AppHost Note
+
+Detection covers TS AppHosts (`apphost.ts`), but **all TS AppHost authoring is delegated to `aspireify`**.
+Current rules to apply when handing off:
+
+| Rule | Why |
+|------|-----|
+| Prefer unified `withEnvironment(name, value)` over deprecated per-kind helpers (`withEnvironmentEndpoint`, `withEnvironmentParameter`, `withEnvironmentConnectionString`, `withEnvironmentExpression`, `withEnvironmentFromOutput`, `withEnvironmentFromKeyVaultSecret`) | Per-kind helpers are deprecated — single API now handles all value types |
+| Never edit `.aspire/modules/` directly | Generated; use `aspire add <package>` to regenerate and `aspire restore` to recover missing files |
+| Use `aspire docs api search <query> --language typescript` for API lookup | TS surface differs from C# |
+
+## Skill Routing — In-Plugin Sibling Skills
+
+After `aspire init` drops a skeleton AppHost + `aspire.config.json`, route AppHost wiring
+(scan repo → propose resource graph → edit AppHost → wire `Aspire.ServiceDefaults` / OTel →
+validate via `aspire start`) to the in-plugin **aspireify** skill: [`../aspireify/SKILL.md`](../aspireify/SKILL.md).
+For first-run flows that only need the skeleton drop, see the in-plugin **aspire-init** skill:
+[`../aspire-init/SKILL.md`](../aspire-init/SKILL.md). This orchestration skill stays focused
+on lifecycle (start/stop/wait/restart) and never edits AppHost code itself.
+
+## Project-Local Skill Precedence
+
+If `.agents/skills/aspire/SKILL.md` exists (from `aspire agent init`), defer to it for:
+C# AppHost editing, TS AppHost editing, Playwright handoff, investigation workflows.
+Safety guardrails from this plugin ALWAYS apply.
+
+If `.agents/skills/aspireify/SKILL.md` exists project-locally (installed by `aspire init` in
+current Aspire), **warn the user** that a project-local aspireify skill is present and **defer to it**
+for AppHost wiring instead of the in-plugin sibling. Same precedence rule as the project-local
+`aspire` skill above: project-local wins, plugin guardrails still apply.
+
+## References
+
+- [safety-guardrails.md](references/safety-guardrails.md) — Detailed rules and recovery patterns
+- [detection.md](references/detection.md) — Project fingerprinting
+- [app-commands.md](references/app-commands.md) — App lifecycle and bootstrap commands
+- [resource-management.md](references/resource-management.md) — Resource wait, restart, and operations
+- [agent-workflows.md](references/agent-workflows.md) — Common agent investigation, integration, TypeScript, and handoff workflows

.agents/skills/aspire-orchestration/references/agent-workflows.md

@@ -0,0 +1,119 @@
+# Aspire Agent Workflows
+
+Use these patterns when a task needs investigation or orchestration rather than a one-off command lookup.
+
+## Scenario: I Am In A Worktree And Need A Safe Background Run
+
+Start the AppHost with `aspire start` so the CLI manages background execution. In git worktrees, use `--isolated` to avoid port conflicts and shared local state:
+
+```bash
+aspire start --isolated
+```
+
+If the next step depends on one resource, wait for it explicitly:
+
+```bash
+aspire start --isolated
+aspire wait myapi
+```
+
+Keep these points in mind:
+
+- In a git worktree, rerun `aspire start --isolated` whenever AppHost changes need to be picked up.
+- Outside worktrees, rerun `aspire start`.
+- Avoid `aspire run` in normal agent workflows because it blocks the terminal.
+
+## Scenario: I Changed Code While The AppHost Is Running
+
+Classify the change before restarting anything:
+
+1. If the AppHost model, AppHost code, integrations, resource definitions, or AppHost-level configuration changed, rerun the same AppHost start command. In a git worktree, use `aspire start --isolated`.
+2. If one resource's implementation changed, keep the AppHost running and use a resource-specific workflow.
+3. If an IDE is managing debugging or hot reload, defer to the IDE and avoid overlapping Aspire CLI restart, rebuild, or watch behavior.
+
+Use resource commands when the running AppHost already knows about the resource and only that resource needs to be operated on. Choose the resource command path that matches the resource.
+
+For a C# project resource that exposes rebuild:
+
+```bash
+aspire resource api rebuild
+aspire wait api
+```
+
+For a resource that needs a process restart and does not have a better resource-specific command:
+
+```bash
+aspire resource api stop
+aspire resource api start
+aspire wait api
+```
+
+Keep these points in mind:
+
+- Use `aspire resource <resource-name> <command>` as the command shape.
+- Use `aspire resource <resource-name> rebuild` when a C# project resource exposes rebuild and you need the resource to pick up compiled changes.
+- Use runtime or framework-native hot reload/watch for resource implementation loops when that workflow is available.
+- For frontend resources, remember that frameworks such as Vite, Next.js, and similar client-side JavaScript stacks often enable hot module replacement (HMR) by default. If HMR is already applying the change through the resource's dev server, do not force a resource or AppHost restart.
+- Do not restart the whole AppHost just because one resource changed or one resource needs to be rebuilt.
+- Aspire default watch is controlled by `features.defaultWatchEnabled`; use it for AppHost-centered CLI watch behavior, not as a replacement for resource-specific or IDE hot reload workflows.
+
+## Scenario: Something Is Wrong, But Do Not Edit Code Yet
+
+Inspect the live app before editing code:
+
+1. `aspire describe` to check resource state.
+2. `aspire otel logs <resource>` to inspect structured logs. Add `--search "<term>"` to filter by keyword.
+3. `aspire logs <resource>` to inspect console output. Add `--search "<term>"` to filter by keyword.
+4. `aspire otel traces <resource>` to follow cross-service activity. Add `--search "<term>"` to narrow results.
+5. `aspire export` when you need a zipped telemetry snapshot for deeper analysis or handoff.
+
+## Scenario: I Need To Add An Integration, Understand An API, Or Add A Custom Command Safely
+
+Use integration search to find the package when needed, then use the docs commands for the workflow and the API reference commands if you need the concrete API entry:
+
+```bash
+aspire integration search postgres
+aspire docs search postgres
+aspire docs get <slug>
+aspire docs api search postgres --language csharp
+aspire docs api get <id>
+aspire add <package>
+```
+
+For dashboard or custom resource commands, use docs for the pattern and API docs for the specific entry:
+
+```bash
+aspire docs search "custom resource commands"
+aspire docs get custom-resource-commands
+aspire docs api search WithCommand --language csharp
+```
+
+Keep these points in mind:
+
+- Read the docs before editing the AppHost so the implementation follows a documented Aspire pattern instead of guessing the workflow.
+- Use `aspire integration list` when the user asks to discover available integrations before changing the AppHost, or `aspire integration search <query>` when the package ID is unknown.
+- Use `aspire docs api` when you need the C# or TypeScript reference entry for the exact API you are about to call.
+- If the AppHost is C# and you need to understand local overloads or builder chains, use the `dotnet-inspect` skill if it is available after checking the Aspire API reference.
+- After adding an integration, restart with `aspire start` so the updated AppHost takes effect.
+
+## Scenario: The AppHost Is TypeScript And Generated APIs Matter
+
+If the AppHost is `apphost.ts`, the `.aspire/modules/` directory contains generated TypeScript modules that expose Aspire APIs.
+
+- Do not edit `.aspire/modules/` directly.
+- Use `aspire add <package>` to regenerate the available APIs when adding integrations.
+- Use `aspire restore` if `.aspire/modules/` disappeared after a pull, clean, or branch switch.
+- Inspect `.aspire/modules/aspire.ts` after regeneration or restore to see the newly available APIs.
+
+## Scenario: I Need Secrets, Deployment, Or A Playwright Handoff
+
+Use `aspire secret` for AppHost user secrets, especially connection strings and passwords:
+
+```bash
+aspire secret set Parameters:postgres-password MySecretValue
+aspire secret list
+```
+
+Use `aspire publish` and `aspire deploy` for full deployment work, or `aspire do <step>` when the user only wants one named pipeline step such as seeding data or pushing containers.
+
+If Playwright CLI is configured in the environment, use Aspire to discover the endpoint first and let Playwright use that discovered URL afterward. When multiple frontends exist or the URL needs to be passed to another tool, prefer `aspire describe --format Json` before the Playwright handoff.

.agents/skills/aspire-orchestration/references/app-commands.md

@@ -0,0 +1,123 @@
+# App Commands
+
+Use this when the task is about app-level lifecycle, bootstrap, or AppHost-wide maintenance.
+
+## Start The App Safely In The Background
+
+```bash
+aspire start
+aspire start --isolated
+aspire stop
+```
+
+- Use `aspire start` for normal background AppHost execution.
+- In git worktrees or when another local instance may already be running, use `aspire start --isolated`.
+- To restart after AppHost changes, rerun the same start command.
+- Use `aspire stop` when cleanup is explicitly requested, ports/locks need to be released, or you are finished with a started instance that the user did not ask to keep running.
+- Avoid `aspire run` in agent workflows — it blocks the terminal.
+
+### `aspire run` vs `aspire start`
+
+| Command | Mode | Use Case |
+|---------|------|----------|
+| `aspire run` | Foreground (interactive) | Human developer at terminal |
+| `aspire start` | Background (detached) | **AI agents — always prefer** |
+| `aspire run --detach` | Background | Alternative to `aspire start` |
+
+## Create A New Aspire App Or Add Aspire To An Existing App
+
+```bash
+aspire new
+aspire init
+aspire init --language typescript
+```
+
+- Use `aspire new` when creating a brand-new Aspire app from scratch.
+- Use `aspire init` when adding Aspire to an existing application.
+
+## After `aspire init` — Hand Off to `aspireify`
+
+`aspire init` drops a minimal AppHost skeleton + AppHost configuration into the
+repo and installs the **`aspireify`** agent skill alongside it. `aspire init` itself does not
+wire resources, projects, or integrations. Hand off the wiring step to:
+
+1. The in-plugin sibling skill: [`../../aspireify/SKILL.md`](../../aspireify/SKILL.md), or
+2. The project-local `.agents/skills/aspireify/SKILL.md` if `aspire init` installed it
+   (project-local wins — defer to it and warn the user).
+
+The aspireify workflow:
+
+1. **Scan** the repository — discover .NET projects, Node.js apps, Python/Go services, docker-compose files
+2. **Present findings** — confirm with user which services to include
+3. **Wire the AppHost** — add resources using 3-tier API preference:
+   - Tier 1: First-party `Aspire.Hosting.*` (e.g., `AddPostgres`, `AddRedis`, `AddViteApp`, `AddNextJsApp`)
+   - Tier 2: Community Toolkit `CommunityToolkit.Aspire.Hosting.*` (e.g., `AddGolangApp`)
+   - Tier 3: Raw fallbacks (`AddExecutable`, `AddDockerfile`, `AddContainer`)
+4. **Configure dependencies** — ServiceDefaults for .NET, OTel for non-.NET
+5. **Validate** — `aspire start` until all resources are healthy
+
+### Key Init Rules
+
+- **Never install the obsolete Aspire workload** (`dotnet workload install aspire`)
+- **Never change the repo's .NET SDK version** (don't modify root `global.json`)
+- **Never change existing project target frameworks** (older TFMs work with newer AppHost)
+- **Always use `aspire docs search` before writing AppHost code** — don't guess APIs
+- **Never hardcode URLs** — use endpoint references (`WithReference`, `WithEnvironment` with expressions)
+- **Never overwrite existing files** — augment and merge
+- **Adapt the AppHost to the app**, not the other way around
+
+### Init Config: `aspire.config.json`
+
+Read `aspire.config.json` at repo root for init context:
+
+| Field | Values | Meaning |
+|-------|--------|---------|
+| `appHost.language` | `"typescript/nodejs"` or `"csharp"` | AppHost syntax to use |
+| `appHost.path` | Path to AppHost file/dir | Where to edit |
+
+C# has two sub-modes:
+- **Single-file**: `appHost.path` → `apphost.cs` (uses `#:sdk` directive)
+- **Full project**: `appHost.path` → directory with `.csproj` + `Program.cs`
+
+## Find The Right AppHost Or Refresh AppHost-Wide Support
+
+```bash
+aspire ps
+aspire integration list --format Json
+aspire integration search <query> --format Json
+aspire add <package>
+aspire update --self        # upgrades the Aspire CLI itself (NativeAOT global tool or curl install)
+aspire update               # updates project package references / aspire.config.json
+aspire restore
+```
+
+- Use `aspire ps` first to discover which AppHost is already running.
+- Use `aspire integration list --format Json` and `aspire integration search <query> --format Json` for read-only integration discovery.
+- Use `aspire add <package>` to add integrations and regenerate AppHost APIs when you are ready to mutate the AppHost.
+- Use **`aspire update --self`** to upgrade the Aspire CLI itself — the safe, no-side-effect upgrade path agents can run unattended.
+- Use **`aspire update` (no `--self`)** to refresh AppHost package references and bump pinned versions in `aspire.config.json`. This **modifies project files** — get user approval before running unattended (CI / agent flows).
+- Use `aspire restore` after pulls, cleans, or missing generated files.
+- Use `--apphost <path>` when the workspace has multiple AppHosts. The CLI's global config validates configured AppHost paths to catch typos early.
+
+## Key Rules
+
+- **Never install the obsolete Aspire workload** (`dotnet workload install aspire`). Use `aspire add`, `aspire init`, or `aspire new` instead.
+- **Never edit `.aspire/modules/` directly** in TypeScript AppHosts. Use `aspire add <package>` to regenerate APIs, `aspire restore` if files are missing.
+- For unfamiliar C# AppHost APIs, use `aspire docs search` as primary reference. If the `dotnet-inspect` skill is available, use it to inspect local symbols and overloads — but keep docs as the source of truth.
+- For custom dashboard or resource commands (`WithCommand`), always run `aspire docs search "custom resource commands"` before implementing.
+
+## Look Up API Reference Before Editing AppHost Code
+
+```bash
+aspire docs search <query>
+aspire docs get <slug>
+aspire docs api search <query> --language csharp
+aspire docs api search <query> --language typescript
+aspire docs api list <scope>
+aspire docs api get <id>
+```
+
+- Use `aspire docs search` and `aspire docs get` for workflow guidance and documented patterns.
+- Use `aspire docs api search` when you need the C# or TypeScript API reference entry for a resource builder, extension method, or member.
+- Use `aspire docs api list <scope>` to browse children under a language, package, module, type, or symbol.
+- Always specify `--language csharp` or `--language typescript` to get the correct API surface.

.agents/skills/aspire-orchestration/references/detection.md

@@ -0,0 +1,160 @@
+# Detection — Recognizing Aspire Projects
+
+> **Purpose**: How to identify that a project uses Aspire, and which project is the AppHost.
+
+## Detection Signals
+
+### 1. C# AppHost (Definitive — Strongest Signal)
+
+Look for `.csproj` files containing the Aspire AppHost SDK reference:
+
+```xml
+<Project Sdk="Microsoft.NET.Sdk">
+  <Sdk Name="Aspire.AppHost.Sdk" Version="10.0.0" />
+  <!-- ... -->
+</Project>
+```
+
+**Detection method**: Search for `Aspire.AppHost.Sdk` in `.csproj` files:
+
+```bash
+grep -rl "Aspire.AppHost.Sdk" --include="*.csproj" .
+```
+
+This is the **definitive signal** — if a `.csproj` contains this SDK reference, it is an Aspire AppHost project. All Aspire CLI commands should target this project's directory.
+
+### 1b. File-Based C# AppHost (Definitive)
+
+Single-file C# AppHosts use `apphost.cs` (or similar `.cs` files) with SDK directives instead of a `.csproj`:
+
+```cs
+#:sdk Aspire.AppHost.Sdk
+#:property IsAspireHost=true
+
+var builder = DistributedApplication.CreateBuilder(args);
+// ...
+```
+
+**Detection method**: Search for `apphost.cs` or `.cs` files containing `#:sdk Aspire.AppHost.Sdk`:
+
+```bash
+find . -name "apphost.cs" -not -path "*/node_modules/*"
+grep -rl "#:sdk Aspire.AppHost.Sdk" --include="*.cs" .
+```
+
+File-based AppHosts are run the same way: `aspire start` (never `dotnet apphost.cs` directly).
+
+### 2. TypeScript AppHost (Definitive)
+
+Look for an `apphost.ts` file in the project:
+
+```bash
+find . -name "apphost.ts" -not -path "*/node_modules/*"
+```
+
+A TypeScript AppHost uses the `@aspire/apphost` package and defines resources programmatically in TypeScript instead of C#.
+
+### 3. `.aspire/modules/` Directory (High Confidence)
+
+Aspire generates a `.aspire/modules/` directory for TypeScript AppHost support files. Its presence strongly indicates an Aspire project:
+
+```bash
+[ -d ".aspire/modules" ] && echo "Aspire project detected"
+```
+
+### 4. `aspire.config.json` Configuration (High Confidence)
+
+Aspire 13.2+ uses a rooted `aspire.config.json` file (replaces legacy `aspire.json`):
+
+```bash
+[ -f "aspire.config.json" ] && echo "Aspire configuration found"
+# Legacy fallback:
+[ -f "aspire.json" ] && echo "Legacy Aspire config found (pre-13.2)"
+```
+
+### 5. `.aspire/` Directory (High Confidence)
+
+The `.aspire/` directory stores Aspire settings and secrets:
+
+```bash
+[ -d ".aspire" ] && echo "Aspire settings directory found"
+```
+
+### 6. Service Defaults References (Medium Confidence)
+
+Projects that reference `Aspire.ServiceDefaults` are Aspire service projects (not the AppHost, but part of an Aspire solution):
+
+```bash
+grep -rl "Aspire.ServiceDefaults" --include="*.csproj" .
+```
+
+This indicates the project is **part of** an Aspire solution, but these are the service projects, not the AppHost. Look for the AppHost SDK reference separately.
+
+---
+
+## Detection Priority
+
+When scanning a repository, check signals in this order:
+
+| Priority | Signal | What It Means |
+|----------|--------|---------------|
+| 1 | `Aspire.AppHost.Sdk` in `.csproj` | This IS the AppHost — target for `aspire start` |
+| 1b | `apphost.cs` or `#:sdk Aspire.AppHost.Sdk` in `.cs` | File-based C# AppHost — target for `aspire start` |
+| 2 | `apphost.ts` file | TypeScript AppHost — target for `aspire start` |
+| 3 | `.aspire/modules/` directory | Aspire project — look for the AppHost |
+| 4 | `aspire.config.json` or `.aspire/` | Aspire project — look for the AppHost |
+| 5 | `Aspire.ServiceDefaults` references | Part of Aspire solution — AppHost is elsewhere |
+
+## Finding the AppHost Directory
+
+The Aspire CLI commands must be run from the correct context. After detecting an Aspire project:
+
+```bash
+# Find the AppHost project directory
+APPHOST_DIR=$(dirname $(grep -rl "Aspire.AppHost.Sdk" --include="*.csproj" .))
+
+# Or for file-based C# AppHost
+APPHOST_FILE=$(find . -name "apphost.cs" -not -path "*/node_modules/*" | head -1)
+
+# Or for TypeScript
+APPHOST_DIR=$(dirname $(find . -name "apphost.ts" -not -path "*/node_modules/*" | head -1))
+```
+
+## Common Project Structures
+
+### Typical C# Aspire Solution
+
+```
+MyApp/
+├── MyApp.AppHost/              ← AppHost (has Aspire.AppHost.Sdk)
+│   ├── MyApp.AppHost.csproj
+│   └── Program.cs
+├── MyApp.ApiService/           ← Service project
+│   └── MyApp.ApiService.csproj
+├── MyApp.Web/                  ← Frontend project
+│   └── MyApp.Web.csproj
+├── MyApp.ServiceDefaults/      ← Shared defaults
+│   └── MyApp.ServiceDefaults.csproj
+├── .aspire/
+│   └── modules/                ← Aspire-generated
+├── aspire.config.json
+└── MyApp.sln
+```
+
+### Typical TypeScript Aspire Project
+
+```
+MyApp/
+├── apphost.ts                  ← TypeScript AppHost
+├── package.json
+├── src/
+│   ├── api/                    ← Service project
+│   └── web/                    ← Frontend project
+├── .aspire/
+│   └── modules/
+└── aspire.config.json
+```
+
+## Non-Aspire Projects
+
+If none of the detection signals are found, this is **not** an Aspire project. Do not apply Aspire-specific rules. Standard .NET commands (`dotnet run`, `dotnet build`) are appropriate for non-Aspire projects.

.agents/skills/aspire-orchestration/references/resource-management.md

@@ -0,0 +1,38 @@
+# Resource Management
+
+Use this when the task is scoped to one resource or depends on a specific resource becoming healthy.
+
+## Wait For One Resource Before Touching It
+
+```bash
+aspire wait <resource>
+aspire wait <resource> --status up --timeout 60
+```
+
+- Use `aspire wait` before a dependent action when readiness is the blocker.
+- Add `--status` and `--timeout` for explicit readiness conditions.
+- Treat readiness as resource-scoped — a missing ready signal is not a reason to restart the whole AppHost.
+- Use `displayName` from `aspire ps --format Json`, not `name` ([#15842](https://github.com/microsoft/aspire/issues/15842)).
+
+## Fix Or Operate On One Resource Without Bouncing The Whole App
+
+```bash
+aspire resource <resource> start
+aspire resource <resource> stop
+aspire resource <resource> <command>
+```
+
+- Prefer resource-scoped commands when the task doesn't require an AppHost-wide restart.
+- If one resource is wedged, use resource-scoped commands such as `stop`, `start`, or `rebuild` when the resource exposes them before escalating to a full AppHost restart.
+- Use `aspire resource <resource> <command>` when the AppHost exposes resource-specific dashboard or operational commands.
+- If the resource's own framework watch/HMR/debug workflow is already handling the change, do not force an Aspire resource command.
+
+## What Changed Determines the Action
+
+| What Changed | Action | Command |
+|--------------|--------|---------|
+| AppHost project (Program.cs, .csproj) | Full restart | `aspire stop` → edit → `aspire start` |
+| .NET service project (.cs files) | Rebuild/refresh resource if exposed | `aspire resource <name> rebuild` or the resource's IDE/watch workflow |
+| JavaScript/Python/Go files | Usually no Aspire action | File watchers/HMR handle it automatically |
+| Configuration (appsettings.json) | Check first | `aspire describe` then decide |
+| TypeScript AppHost deps | Restore | `aspire restore` |

.agents/skills/aspire-orchestration/references/safety-guardrails.md

@@ -0,0 +1,272 @@
+# Safety Guardrails — Aspire Agent Rules
+
+> **Purpose**: Detailed explanation of why each guardrail exists, what goes wrong when violated, and how to recover.
+
+## Why These Rules Exist
+
+Issue [#15801](https://github.com/microsoft/aspire/issues/15801) documented 5 specific failures when AI agents work in Aspire projects without guidance. Every rule below directly prevents one or more of these failures.
+
+---
+
+## Rule 1: ALWAYS `aspire start` — NEVER `dotnet run`
+
+### Why `dotnet run` Is Dangerous for AppHosts
+
+The AppHost project is an **orchestrator**, not a regular .NET app. Running it with `dotnet run`:
+
+- **Bypasses the Aspire CLI orchestration layer** — resources don't get managed lifecycle
+- **No dashboard** — the Aspire developer dashboard won't launch
+- **No backchannel** — `aspire wait`, `aspire logs`, `aspire describe` won't work
+- **No resource management** — can't operate on individual resources
+- **Port conflicts** — resources start without coordinated port allocation
+- **No cleanup** — orphaned processes when the host exits
+
+### Correct Pattern
+
+```bash
+# ✅ Start the Aspire app
+aspire start
+
+# ✅ Verify it's running
+aspire ps
+```
+
+### `aspire run` vs `aspire start`
+
+| Command | Mode | Dashboard | Use Case |
+|---------|------|-----------|----------|
+| `aspire run` | Foreground (interactive) | Yes, in terminal | Human developer at terminal |
+| `aspire start` | Background (detached) | No terminal output | **AI agents — always prefer this** |
+| `aspire run --detach` | Background (same as start) | Yes, separate window | Alternative to `aspire start` |
+
+For AI agents, **always use `aspire start`** — it runs in the background and returns control to the agent.
+
+### Recovery If `dotnet run` Was Used
+
+```bash
+# Kill the dotnet process manually (find PID first)
+# Then start correctly:
+aspire start
+```
+
+---
+
+## Rule 2: ALWAYS `aspire wait` — NEVER `curl` Polling
+
+### Why `curl` Polling Is Wrong
+
+Aspire tracks resource readiness internally through health checks, dependency graphs, and startup ordering. Manual HTTP polling:
+
+- **Doesn't know the correct port** — Aspire assigns ports dynamically
+- **Doesn't respect dependency ordering** — a resource may respond to HTTP before its dependencies are ready
+- **Creates false negatives** — health endpoint may not exist or may return 503 during startup
+- **Wastes time** — retry loops with arbitrary delays vs. event-driven readiness
+
+### Correct Pattern
+
+```bash
+# ✅ Wait for a specific resource
+aspire wait apiservice
+
+# ✅ Wait with extended timeout for slow resources
+aspire wait postgres --timeout 120
+
+# ✅ Wait then interact
+aspire wait apiservice && curl $(aspire describe apiservice --format Json | jq -r '.endpoints[0].url')
+```
+
+### Machine-Readable Output
+
+Always use `--format Json` when parsing output programmatically:
+
+```bash
+# ✅ Get resource endpoints as JSON
+aspire describe --format Json
+
+# ❌ Never scrape text output
+aspire describe | grep "http"  # fragile, format may change
+```
+
+---
+
+## Rule 3: Prefer Resource Commands / Watch — NEVER `dotnet build` With Aspire Running
+
+### Why `dotnet build` Causes File-Lock Errors
+
+When Aspire is running, it holds file locks on:
+
+- Output assemblies (`.dll`, `.pdb`) of managed resources
+- Build intermediates in `obj/` directories
+- NuGet package caches being read by running processes
+
+Running `dotnet build` while Aspire holds these locks produces:
+
+```
+error MSB3491: Could not write to output file 'bin/Debug/net10.0/MyService.dll'
+error CS2012: Cannot open 'obj/Debug/net10.0/MyService.dll' for writing
+```
+
+The agent then concludes the project is "un-buildable" — a false conclusion.
+
+### Recovery If `dotnet build` Was Used and Locks Hit
+
+When you see `MSB3491` / `CS2012` / "file in use" / "another process is using":
+
+```bash
+# ✅ Single correct recovery
+aspire stop              # release all Aspire-held locks
+
+# Then EITHER use a resource-scoped command if Aspire is still up + one resource changed:
+aspire resource <name> rebuild
+# OR:
+aspire start             # if AppHost code changed or Aspire was fully stopped
+```
+
+> 🔒 **`aspire stop` is the ONLY first step.** Do not `pkill dotnet`, do not delete
+> `bin/`/`obj/`, do not "reboot to release the lock", and do not tell the user the
+> project has a permanent build failure. The cause is always the same — Aspire is
+> holding the output files — and the fix is always `aspire stop`.
+
+| ❌ NEVER (file-lock recovery) | ✅ ALWAYS |
+|------------------------------|----------|
+| Say the project has a permanent build failure when you see `MSB3491`/`CS2012` | Recognize Aspire is holding locks and run `aspire stop` |
+| `pkill dotnet` / `kill <PID>` | `aspire stop` (clean shutdown via the CLI) |
+| `rm -rf bin obj` to "force" the build | `aspire stop`, then rebuild |
+| Suggest a reboot | `aspire stop` (single command) |
+| Re-run `dotnet build` with Aspire still up | `aspire stop` first; prefer resource commands/watch/HMR/debug workflow |
+
+### What Changed Determines the Action
+
+| What Changed | Action | Command |
+|--------------|--------|---------|
+| AppHost project (Program.cs, .csproj) | Full restart | `aspire stop` → edit → `aspire start` |
+| .NET service project (.cs files) | Rebuild/refresh resource if exposed | `aspire resource <name> rebuild` or the resource's IDE/watch workflow |
+| JavaScript/Python/Go files | Usually no Aspire action | File watchers/HMR handle it automatically |
+| Configuration (appsettings.json) | Check first | `aspire describe` then decide |
+
+---
+
+## Rule 4: Use `aspire stop` For Cleanup — NEVER Leave Unwanted Processes Running
+
+### Why Cleanup Matters
+
+Aspire orchestrates multiple processes (your services, databases, message brokers, etc.). Leaving them running causes:
+
+- **Port conflicts** — next `aspire start` fails because ports are occupied
+- **File locks** — can't build or modify service code
+- **Resource consumption** — databases, Redis, etc. consuming memory
+- **Stale state** — old code running while you've made changes
+- **Orphaned containers** — Docker containers left running
+
+### Correct Pattern
+
+```bash
+# ✅ Stop when cleanup is requested or the user did not ask to keep it running
+aspire stop
+
+# ✅ Verify everything stopped
+aspire ps  # should show no running resources
+```
+
+### Recovery from Orphaned Processes
+
+```bash
+# Check if anything is still running
+aspire ps
+
+# If aspire ps shows nothing but ports are blocked:
+# The previous instance may have crashed. Start fresh:
+aspire start  # will clean up orphaned state
+```
+
+---
+
+## Rule 5: ALWAYS `--format Json` for Machine-Readable Output
+
+### Why JSON Output Matters for Agents
+
+Text output is formatted for humans and may change between versions. JSON output is:
+
+- **Stable** — structured contract unlikely to break
+- **Parseable** — `jq`, Python, or any JSON parser works
+- **Complete** — includes fields not shown in text output
+
+### Examples
+
+```bash
+# ✅ Machine-readable resource list
+aspire ps --format Json
+
+# ✅ Get specific resource details
+aspire describe apiservice --format Json
+
+# ✅ Parse with jq
+aspire describe --format Json | jq '.resources[] | select(.state == "Running")'
+```
+
+### ⚠️ Known JSON Output Issues
+
+| Issue | Workaround |
+|-------|-----------|
+| `aspire start --format json` may emit human-readable text before JSON ([#15843](https://github.com/microsoft/aspire/issues/15843)) | Strip non-JSON lines before parsing |
+| `aspire stop` does NOT support `--format json` yet | Use exit code for success/failure |
+| `aspire ps --format Json` returns `name` and `displayName` fields | Use `displayName` for `aspire wait` — the `name` field may be rejected ([#15842](https://github.com/microsoft/aspire/issues/15842)) |
+
+### Hidden Resources and `--include-hidden`
+
+`aspire ps`, `aspire describe`, and other CLI commands **filter out resources marked as
+hidden in the AppHost** (proxies, helper containers, migration jobs, etc.).
+This filtering is correct for normal workflows — agents and humans see only the resources they
+care about, not the implementation scaffolding.
+
+Use `--include-hidden` when:
+
+| Situation | Why |
+|-----------|-----|
+| Debugging a proxy or sidecar | Proxies are hidden by default; you need their state to diagnose connectivity |
+| Investigating helper containers | Helper containers (e.g. wait-for-it shims, init containers) are hidden |
+| Tracking down migration jobs | Migration / seed jobs are typically hidden once they finish |
+| Expected resources are missing from `aspire ps` | The resource may exist but be marked hidden — confirm with `--include-hidden` before assuming the AppHost is wrong |
+| Parsing for completeness in agent automation | A full-graph view requires explicit opt-in |
+
+```bash
+# ✅ Normal flow — filtered (correct for most tasks)
+aspire ps --format Json
+
+# ✅ Debugging / completeness — include hidden resources
+aspire ps --include-hidden --format Json
+aspire describe --include-hidden --format Json
+```
+
+If a user reports "I can't see my proxy / migration / helper container," reach for
+`--include-hidden` before assuming the AppHost is misconfigured.
+
+---
+
+## Rule 6: ALWAYS `--non-interactive` for Agent Commands
+
+### Why It Matters
+
+AI agents run in non-interactive terminals. Some Aspire CLI commands may prompt for confirmation or input. Always pass `--non-interactive` to prevent hangs:
+
+```bash
+# ✅ Agent-safe commands
+aspire start --non-interactive
+aspire deploy --non-interactive
+aspire agent init --non-interactive
+```
+
+> ⚠️ **Known issue**: `aspire agent init --non-interactive` is broken in some versions ([#16264](https://github.com/microsoft/aspire/issues/16264), [#15071](https://github.com/microsoft/aspire/issues/15071)). If it fails, instruct the user to run it from a standard terminal.
+
+---
+
+## Recovery Patterns Summary
+
+| Mistake Made | Recovery Steps |
+|-------------|---------------|
+| Used `dotnet run` on AppHost | Kill the process, run `aspire start` |
+| Used `dotnet build` and got file locks | `aspire stop`, wait 2s, then `dotnet build` or `aspire start` |
+| Used `curl` polling and got false results | `aspire wait <resource>`, then use endpoints from `aspire describe` |
+| Left Aspire running, now ports conflict | `aspire stop`, then `aspire start` |
+| Resource won't start after code change | Fix code, then use resource commands/watch/HMR/debug workflow or restart the AppHost if the AppHost model changed |
+| Nothing works, environment broken | `aspire doctor` to diagnose, then follow recommendations |

.agents/skills/aspire/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: aspire
+description: >-
+  **WORKFLOW SKILL** - Top-level router for Aspire 13.4 distributed apps. Detects the
+  AppHost, enforces safety guardrails, and routes to the right sub-skill.
+  USE FOR: Aspire AppHost detected, aspire CLI, distributed app, cloud-native .NET,
+  aspire start, aspire stop, aspire resource, aspire deploy, aspire destroy, aspire publish,
+  aspire init, aspire new, aspire add, aspire integration list/search, aspire wait,
+  aspire describe, aspire ps, aspire dashboard run, aspire doctor, aspire update,
+  aspire logs, aspire otel, --include-hidden, aspireify, WithBrowserLogs, custom
+  dashboard/resource commands, .aspire/modules recovery, Playwright URL discovery.
+  DO NOT USE FOR: non-Aspire .NET projects (use dotnet directly), Azure provisioning
+  without Aspire (use azure-prepare), container-only repos with no AppHost, ordinary
+  build/test tasks.
+  INVOKES: aspire-init, aspireify, aspire-orchestration, aspire-deployment, aspire-monitoring.
+  FOR SINGLE OPERATIONS: Route directly to the matching sub-skill.
+license: MIT
+metadata:
+  author: Microsoft
+  version: "0.0.1"
+---
+
+# Aspire
+
+Use this skill when the task involves an Aspire distributed application — operating the
+AppHost or its resources through the Aspire CLI rather than falling back to ad-hoc `dotnet`,
+`docker`, or shell workflows.
+
+## Detection
+
+Activate when ANY signal is present. Use the **Scope** column to decide whether to route to
+the bootstrap skills (`aspire-init` / `aspireify`) or to a runtime sub-skill:
+
+| Signal | How to Detect | Confidence | Scope |
+|--------|---------------|------------|-------|
+| C# AppHost | `.csproj` containing `Aspire.AppHost.Sdk` | ✅ Definitive | AppHost present → orchestration / deployment / monitoring |
+| File-based C# AppHost | `apphost.cs` with `#:sdk Aspire.AppHost.Sdk` | ✅ Definitive | AppHost present → orchestration / deployment / monitoring |
+| TypeScript AppHost | `apphost.ts` file in project | ✅ Definitive | AppHost present → orchestration / deployment / monitoring |
+| Aspire config without AppHost | `aspire.config.json` present **and no AppHost** above | High | Bootstrap → `aspireify` (skeleton dropped, needs wiring) |
+| Aspire config with AppHost | `aspire.config.json` present **and** AppHost above | High | AppHost present → orchestration / deployment / monitoring |
+| Aspire settings | `.aspire/` directory present | High | AppHost present (usually) |
+| Generated TS modules | `.aspire/modules/` directory present | High | AppHost present (TS) |
+| Service defaults | `Aspire.ServiceDefaults` in project references | Medium | AppHost present |
+| **No AppHost, no `aspire.config.json`** | None of the above and user asks to add Aspire | n/a | Bootstrap → `aspire-init` (skeleton drop) |
+
+## Default Workflow
+
+0. **Bootstrap branch** — if **no AppHost exists** in the repo, route to
+   [`aspire-init`](../aspire-init/SKILL.md) for the skeleton drop. If an AppHost stub exists
+   but is **unwired** (no resources declared), route to [`aspireify`](../aspireify/SKILL.md).
+   Only continue with the steps below once a wired AppHost is present.
+1. Confirm workspace is Aspire — identify the AppHost
+2. `aspire start` (or `aspire start --isolated` in worktrees or whenever shared local state is risky)
+3. `aspire wait <resource>` before interacting with any resource
+4. Inspect state with `aspire describe`, `aspire otel logs`, `aspire logs`, `aspire otel traces`, and `aspire export` before making code changes
+5. Before adding integrations, use `aspire integration search <query>` when the package is unknown, then `aspire add <package>` when ready to mutate the AppHost
+6. When code changes, decide whether the AppHost model changed or only one resource changed. Re-run `aspire start` after AppHost changes; otherwise prefer resource commands, runtime watch/HMR, dashboard actions, or IDE-managed debugging as appropriate.
+
+## Key Rules
+
+- **Always** `aspire start`, **never** `dotnet run` on AppHosts
+- **Always** `aspire wait <resource>`, **never** manual HTTP polling
+- Use `aspire resource <resource-name> <command>` for resource operations such as `stop`, `start`, or `rebuild` when available
+- Do not stop or restart the whole AppHost just because one resource changed
+- Use `features.defaultWatchEnabled` only for Aspire default watch; do not treat it as per-resource rebuild, restart, or hot reload
+- Prefer a resource's own framework/runtime hot reload, HMR, or watch workflow when it already handles the change
+- **Always** `aspire docs search <topic>` before editing unfamiliar AppHost APIs
+- **Always** `aspire docs api search <query> --language csharp|typescript` for API reference before editing AppHost code
+- **Always** `--non-interactive` for agent execution
+- Use `aspire integration list --format Json` and `aspire integration search <query> --format Json` for read-only integration discovery
+- **Never** install the obsolete Aspire workload
+- **Never** edit `.aspire/modules/` directly in TypeScript AppHosts
+
+## Routing
+
+| Task | Route To |
+|------|----------|
+| Start, stop, wait, restart, rebuild | → [aspire-orchestration](../aspire-orchestration/SKILL.md) |
+| Create a new Aspire project from a template (`aspire new`) | → [aspire-init](../aspire-init/SKILL.md) (in-plugin) |
+| Add Aspire to an existing repo (`aspire init`, drop skeleton) | → [aspire-init](../aspire-init/SKILL.md) (in-plugin) |
+| Wire AppHost / scaffold resource graph / add integrations after `aspire init` | → [aspireify](../aspireify/SKILL.md) (in-plugin) |
+| Deploy, publish, destroy, pipeline steps | → [aspire-deployment](../aspire-deployment/SKILL.md) |
+| Logs, traces, metrics, dashboard, browser logs | → [aspire-monitoring](../aspire-monitoring/SKILL.md) |
+| Deployed app monitoring (Azure) | → `azure-diagnostics` skill (azure-skills plugin) |
+
+## Sub-Skills
+
+### aspire-init
+First-run flow only. Owns the skeleton drop for repos that do **not** yet have an AppHost —
+picks `aspire new <template>` (greenfield) or `aspire init` (existing repo), runs the CLI,
+and hands off to `aspireify` for the actual wiring. Self-deactivates once the skeleton is in
+place. Do **not** use it on a repo that already contains an AppHost.
+
+### aspireify
+Agentic AppHost wiring after `aspire init` lands the skeleton. Scans the repo, proposes a
+resource graph (Postgres / Redis / Rabbit / etc.), edits the AppHost (C#, file-based C#, or
+TypeScript), wires `Aspire.ServiceDefaults` + OTel, validates with `aspire start`, then
+self-deactivates. Owns current AppHost authoring patterns (`AddNextJsApp`, `AddViteApp`,
+`WithBrowserLogs()`, generated `.aspire/modules/`, unified TS `withEnvironment`,
+endpoint references, and config/secret migration).
+
+### aspire-orchestration
+Lifecycle management: start, stop, wait, resource commands, default watch/HMR guidance, and file-lock recovery.
+Safety guardrails that prevent agent self-harm. Owns `aspire ps` / `aspire describe` /
+`--include-hidden` inspection and CLI upgrades (`aspire update --self`). Does **not** edit
+AppHost code — defers to `aspireify` for wiring.
+
+### aspire-deployment
+Multi-target deployment and tear-down: `aspire deploy`, `aspire publish`, `aspire destroy`,
+`aspire do <step>`. Targets: Azure Container Apps, App Service, AKS, Kubernetes (Helm),
+Docker Compose. Owns current deployment surfaces (Front Door, NSP, AKS hosting, Foundry
+`AddPromptAgent`, JS `PublishAs*`, `--pipeline-log-level`) and 13.4 API naming.
+
+### aspire-monitoring
+Observability: `aspire logs`, `aspire otel`, `aspire describe`, `aspire export`,
+`aspire dashboard run`. Routes between local Aspire CLI diagnostics, AKS workload tooling,
+and deployed-Azure platform tools. Surfaces dashboard features (notification center,
+Rebuild command, browser-logs telemetry).
+
+## Project-Local Skill Override
+
+If any of the following exist project-locally (from `aspire agent init` or Aspire
+`aspire init`), **warn the user** and **defer to the project-local copy** — repo-specific
+guidance there should not be overridden by the in-plugin sibling:
+
+| Project-local file | Precedence |
+|--------------------|-----------|
+| `.agents/skills/aspire/SKILL.md` | This file (top-level router) defers to it for deeper C# / TS AppHost editing, Playwright handoff, investigation workflows. |
+| `.agents/skills/aspireify/SKILL.md` | The in-plugin `aspireify` sibling defers to it for AppHost wiring. |
+| `.agents/skills/aspire-init/SKILL.md` | The in-plugin `aspire-init` sibling defers to it for the skeleton/first-run flow. |
+
+**Safety guardrails from this plugin always apply** even when project-local skills are
+active.
+
+## Prerequisites
+
+| Requirement | Install |
+|-------------|---------|
+| .NET 10.0 SDK | https://dotnet.microsoft.com/download |
+| Aspire CLI (curl/PowerShell) | `curl -sSL https://aspire.dev/install.sh \| bash` |
+| Aspire CLI (NativeAOT global tool, .NET 10) | `dotnet tool install -g Aspire.Cli` |
+
+Either install method works. The `dotnet tool install` path produces a NativeAOT binary
+(instant startup, no JIT warmup) and is recommended when .NET 10 is already present.
+
+## References
+
+- [aspire-13-3-breaking-changes.md](references/aspire-13-3-breaking-changes.md) — Every 13.3
+  breaking change to scrub from agent-generated code, scripts, and CI snippets (rename of
+  `--log-level`, dashboard MCP removal, `NameOutput` → `NameOutputReference`,
+  `AddAndPublishPromptAgent` removal, TS `withEnvironment*` deprecation, and the full
+  13.2 → 13.3 migration checklist).
+- [../aspire-orchestration/references/agent-workflows.md](../aspire-orchestration/references/agent-workflows.md) — Common agent workflows: worktrees, code changes, investigation, integrations, TypeScript generated APIs, secrets, deployment, and Playwright handoff.
+- [../aspire-orchestration/references/app-commands.md](../aspire-orchestration/references/app-commands.md) — App lifecycle, bootstrap, update, restore, docs, and integration discovery commands.
+- [../aspire-orchestration/references/resource-management.md](../aspire-orchestration/references/resource-management.md) — Resource wait and resource-command guidance.
+- [../aspire-monitoring/references/monitoring.md](../aspire-monitoring/references/monitoring.md) — App state, logs, traces, search filtering, dashboard links, and export workflows.
+- [../aspire-monitoring/references/playwright-handoff.md](../aspire-monitoring/references/playwright-handoff.md) — Playwright handoff after Aspire endpoint discovery.
+- [../aspire-deployment/SKILL.md](../aspire-deployment/SKILL.md) — Deployment and pipeline-step workflows.
+- [../aspireify/references/apphost-wiring.md](../aspireify/references/apphost-wiring.md) — C# and TypeScript AppHost API lookup and wiring patterns.

.agents/skills/aspire/references/aspire-13-3-breaking-changes.md

@@ -0,0 +1,110 @@
+# Aspire 13.3 Breaking Changes — Agent Reference
+
+Single, agent-facing scrub list of every 13.3 breaking change that may affect agent-generated
+code, scripts, CI snippets, or skill routing. Source:
+[Aspire 13.3 release notes](https://aspire.dev/whats-new/aspire-13-3/).
+
+> Use this page when reviewing AppHost code, CI YAML, or shell snippets for 13.3 compatibility.
+> Agents must scrub for these patterns before recommending or generating code.
+
+## Quick scrub table
+
+| Change | Migration |
+|--------|-----------|
+| `--log-level` → `--pipeline-log-level` on `aspire publish` / `aspire deploy` | Update CI/CD scripts to use `--pipeline-log-level <level>`. |
+| Dashboard MCP server **removed** along with `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` | Use AppHost-level MCP via `aspire agent init`. See [Dashboard MCP migration](#dashboard-mcp-migration). |
+| `NameOutput` → `NameOutputReference` (Azure Network resources) | Replace every `*.NameOutput` with `*.NameOutputReference`. |
+| `OtlpEndpointEnvironmentVariableName` property removed | Remove the property; OTLP endpoint env var is managed automatically. |
+| `AksSkuTier` enum removed | Delete the reference. AKS control-plane defaults to **Free** SKU. |
+| `AddAndPublishPromptAgent` API removed | Use `AddPromptAgent` — returns a working `AzurePromptAgentResource`. |
+| Kubernetes Ingress / Gateway routing types moved namespaces | Update `using` directives where these types are referenced directly. |
+| `package.json` `engines.node` no longer drives Node image selection | Pin Node version explicitly via `WithDockerfile` or your Dockerfile base image. |
+| `dotnet new aspire-py-starter` removed | Use `aspire new aspire-py-starter` (template moved to Aspire CLI; .NET SDK no longer required). |
+| TypeScript per-kind `withEnvironment*` helpers `@deprecated` | Use unified `withEnvironment(name, value)`. See [TS withEnvironment migration](#typescript-withenvironment-migration). |
+| CLI telemetry `--format json` schema aligned with MCP tool format | Update parsers consuming `--format json` from telemetry commands. |
+| `ASPIREEXTENSION001` JS diagnostic ID renamed to `ASPIREJAVASCRIPT001` | Update `#pragma warning disable` and any code-search rules. |
+| Docker Swarm `UpdateConfig` property types changed | Update generated/hand-written Swarm overrides. |
+| `aspire init` no longer wires up the AppHost | Follow with `aspireify` (in-plugin sibling skill or project-local copy). |
+| In-dashboard GitHub Copilot UI removed | Replaced by `aspire agent init`-driven agentic flow (works with Copilot, Claude, Cursor, any MCP/skill agent). |
+
+## TypeScript `withEnvironment` migration
+
+Per-kind helpers are still generated for backward compatibility but marked `@deprecated` and
+slated for removal. Replace every call site with the unified API.
+
+| Old method (deprecated)                              | Replacement                          |
+|------------------------------------------------------|--------------------------------------|
+| `withEnvironmentExpression(name, expr)`              | `withEnvironment(name, expr)`        |
+| `withEnvironmentEndpoint(name, endpoint)`            | `withEnvironment(name, endpoint)`    |
+| `withEnvironmentParameter(name, param)`              | `withEnvironment(name, param)`       |
+| `withEnvironmentConnectionString(name, resource)`    | `withEnvironment(name, resource)`    |
+| `withEnvironmentFromOutput(name, output)`            | `withEnvironment(name, output)`      |
+| `withEnvironmentFromKeyVaultSecret(name, secret)`    | `withEnvironment(name, secret)`      |
+
+The unified `withEnvironment(name, value)` accepts any of: a plain `string`,
+`ReferenceExpression`, `EndpointReference`, parameter builder, connection string resource
+builder, or `IExpressionValue` — one method handles every value kind.
+
+## Dashboard MCP migration
+
+The Aspire dashboard no longer hosts an MCP server, and the
+`ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` environment variable has been removed. AI coding agents
+now connect to your Aspire app through an **AppHost-level MCP server** plus skills wired up by
+`aspire agent init`.
+
+```bash
+# Replace any prior dashboard-MCP setup with:
+aspire agent init
+```
+
+Detection covers GitHub Copilot, Claude, Cursor, and any other agent that supports skills or
+MCP. The previous in-dashboard GitHub Copilot UI has been removed in favor of this flow.
+
+If a script or environment file still sets `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL`, delete it.
+
+## `aspire init` no longer wires the AppHost
+
+In 13.3, `aspire init` drops a skeleton (`aspire.config.json` + AppHost stub) and installs the
+`aspireify` agent skill, but does **not** wire resources, projects, or integrations on its own.
+
+Workflow:
+
+1. `aspire init --language csharp|typescript --non-interactive`
+2. Hand off to the `aspireify` skill (in-plugin sibling or project-local
+   `.agents/skills/aspireify/SKILL.md`) to scan the repo, propose a resource graph, edit the
+   AppHost, wire `Aspire.ServiceDefaults` + OTel, and validate via `aspire start`.
+
+Skills shipped in this plugin:
+
+- `aspire-init` — owns the skeleton drop and template choice.
+- `aspireify` — owns the wiring step after the skeleton lands.
+
+## Migration from Aspire 13.2 to 13.3
+
+Mirror of the upstream checklist plus the items above. Run through each step before
+recommending Aspire-related changes against an existing repo.
+
+1. **Update the CLI** — `aspire update --self`.
+2. **Update your projects** — `aspire update` from the repo root (modifies project package
+   references; get user approval before running in CI).
+3. **Audit `--log-level` usage** in CI/CD pipelines and rename to `--pipeline-log-level`.
+4. **Search for breaking-change identifiers** in AppHost code:
+   - `NameOutput` → `NameOutputReference`
+   - `AddAndPublishPromptAgent` → `AddPromptAgent`
+   - `AksSkuTier` → delete (defaults to Free)
+   - `OtlpEndpointEnvironmentVariableName` → delete
+   - `ASPIREEXTENSION001` → `ASPIREJAVASCRIPT001`
+5. **Replace `dotnet new aspire-py-starter`** with `aspire new aspire-py-starter`.
+6. **Rerun `aspire agent init`** if you previously relied on the dashboard MCP server or its
+   `ASPIRE_DASHBOARD_MCP_ENDPOINT_URL` env var.
+7. **Re-pin Node versions** in Dockerfiles if you were relying on `package.json`
+   `engines.node` for base-image selection.
+8. **Rewire AppHost via `aspireify`** if the repo went through `aspire init` on 13.3 — the
+   skeleton is unwired by design.
+9. **Replace deprecated TS `withEnvironment*` helpers** with the unified
+   `withEnvironment(name, value)` (see [migration table](#typescript-withenvironment-migration)).
+10. **Update Kubernetes Ingress / Gateway `using` directives** if your AppHost references the
+    moved types directly.
+11. **Update consumers of `--format json`** from CLI telemetry commands to the new
+    MCP-aligned schema.
+12. **Update Docker Swarm overrides** for the new `UpdateConfig` property types.

.agents/skills/dotnet-inspect/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: dotnet-inspect
+description: "Query .NET APIs across NuGet packages, platform libraries, and local files. Search for types, list API surfaces, compare and diff versions, find extension methods and implementors. Use whenever you need to answer questions about .NET library contents."
+---
+
+# dotnet-inspect
+
+Query .NET library APIs — the same commands work across NuGet packages, platform libraries (System.*, Microsoft.AspNetCore.*), and local .dll/.nupkg files.
+
+## Quick Decision Tree
+
+- **Code broken?** → `diff --package Foo@old..new` first, then `member --oneline`
+- **Need API surface?** → `member Type --package Foo --oneline` (token-efficient)
+- **Need signatures?** → `member Type --package Foo -m Method` (default shows full signatures + docs)
+- **Need source/IL?** → `member Type --package Foo -m Method -v:d` (adds Source, Lowered C#, IL)
+- **Need constructors?** → `member 'Type<T>' --package Foo -m .ctor` (use `<T>` not `<>`)
+- **Need all overloads?** → `member Type --package Foo --select` (shows `Name:N` indices)
+
+## When to Use This Skill
+
+- **"What types are in this package?"** — `type` discovers types (terse), `find` searches by pattern
+- **"What's the API surface?"** — `type` for discovery, `member` for detailed inspection (docs on)
+- **"What changed between versions?"** — `diff` classifies breaking/additive changes
+- **"This code uses an old API — fix it"** — `diff` the old..new version, then `member --oneline` to see the new API
+- **"What extends this type?"** — `extensions` finds extension methods/properties
+- **"What implements this interface?"** — `implements` finds concrete types
+- **"What does this type depend on?"** — `depends` walks the type hierarchy upward
+- **"What version/metadata does this have?"** — `package` and `library` inspect metadata
+- **"Show me something cool"** — `demo` runs curated showcase queries
+
+## Key Patterns
+
+Use `--oneline` as the default for scanning — it works on `type`, `member`, `find`, `diff`, and `implements`:
+
+```bash
+dnx dotnet-inspect -y -- member JsonSerializer --package System.Text.Json --oneline  # scan members
+dnx dotnet-inspect -y -- type --package System.Text.Json --oneline                   # scan types
+dnx dotnet-inspect -y -- diff --package System.CommandLine@2.0.0-beta4.22272.1..2.0.3 --oneline  # triage changes
+```
+
+Use `--shape` to understand a type's hierarchy and surface at a glance:
+
+```bash
+dnx dotnet-inspect -y -- type 'HashSet<T>' --platform System.Collections --shape
+```
+
+Use `diff` first when fixing broken code — `--oneline` for triage, then full detail on specific types:
+
+```bash
+dnx dotnet-inspect -y -- diff --package System.CommandLine@2.0.0-beta4.22272.1..2.0.3 --oneline  # what changed?
+dnx dotnet-inspect -y -- diff -t Command --package System.CommandLine@2.0.0-beta4.22272.1..2.0.3  # detail on Command
+dnx dotnet-inspect -y -- member Command --package System.CommandLine@2.0.3 --oneline              # new API surface
+```
+
+## Search Scope
+
+Search commands (`find`, `extensions`, `implements`, `depends`) use scope flags:
+
+- **(no flags)** — platform frameworks + Microsoft.Extensions.AI
+- **`--platform`** — all platform frameworks
+- **`--extensions`** — curated Microsoft.Extensions.* packages
+- **`--aspnetcore`** — curated Microsoft.AspNetCore.* packages
+- **`--package Foo`** — specific NuGet package (combinable with scope flags)
+
+`type`, `member`, `library`, `diff` accept `--platform <name>` as a string for a specific platform library.
+
+## Command Reference
+
+| Command | Purpose |
+| ------- | ------- |
+| `type` | **Discover types** — terse output, no docs, use `--shape` for hierarchy |
+| `member` | **Inspect members** — docs on by default, supports dotted syntax (`-m Type.Member`) |
+| `find` | Search for types by glob pattern across any scope |
+| `diff` | Compare API surfaces between versions — breaking/additive classification |
+| `extensions` | Find extension methods/properties for a type |
+| `implements` | Find types implementing an interface or extending a base class |
+| `depends` | Walk the type dependency hierarchy upward (interfaces, base classes) |
+| `package` | Package metadata, files, versions, dependencies, `search` for NuGet discovery |
+| `library` | Library metadata, symbols, references, dependencies |
+| `demo` | Run curated showcase queries — list, invoke, or feeling-lucky |
+
+## Output Limiting
+
+**Do not pipe output through `head`, `tail`, or `Select-Object`.** The tool has built-in line limiting that preserves headers and formatting:
+
+```bash
+dnx dotnet-inspect -y -- member JsonSerializer --package System.Text.Json --oneline -10  # first 10 lines
+dnx dotnet-inspect -y -- find "*Logger*" -n 5                                            # first 5 lines
+dnx dotnet-inspect -y -- member JsonSerializer --package System.Text.Json -v:q -s Methods  # select specific section
+```
+
+- **`-n N` or `-N`** — line limit, like `head`. Keeps headers, truncates cleanly.
+- **`-s Section`** — show only a specific section (glob-capable). Use `-s` alone to list available sections.
+- **`-v:q`** — quiet verbosity for compact summary output.
+
+## Key Syntax
+
+- **Generic types** need quotes: `'Option<T>'`, `'IEnumerable<T>'`
+- **Use `<T>` not `<>`** for generic types — `"Option<>"` resolves to the abstract base, `'Option<T>'` resolves to the concrete generic with constructors
+- **`type` uses `-t`** for type filtering, **`member` uses `-m`** for member filtering (not `--filter`)
+- **Dotted syntax** for `member`: `-m JsonSerializer.Deserialize`
+- **Diff ranges** use `..`: `--package System.Text.Json@9.0.0..10.0.0`
+- **Signatures** include `params` and default values from metadata
+- **Derived types** only show their own members — query the base type too (e.g., `RootCommand` inherits `Add()` and `SetAction()` from `Command`)
+
+## Installation
+
+Use `dnx` (like `npx`). Always use `-y` and `--` to prevent interactive prompts:
+
+```bash
+dnx dotnet-inspect -y -- <command>
+```
+
+## Full Documentation
+
+For comprehensive syntax, edge cases, and the flag compatibility matrix:
+
+```bash
+dnx dotnet-inspect -y -- llmstxt
+```