[jonathanpeppers]

Summary

Align mobile dotnet watch WebSocket authentication with the
build-owned key model introduced for WASM/browser tools in
#56118.

• Generate and reuse an RSA key pair in the project's intermediate output.
• Supply the public key through the workload's existing
  RuntimeEnvironmentVariable items, rather than from watch.
• Verify the provider's secret echo before sending initialization or
  accepting Hot Reload updates.
• Share key creation and validation code between separate mobile and
  Static Web Assets tasks.

Browser refresh server behavior and dotnet run -e semantics remain
unchanged.

Validation

• Built the SDK, including both injected-agent target frameworks.
• Ran focused key-generation, WebSocket, mobile watch, and browser
  regression tests.
• Reviewed current dotnet/android and dotnet/macios integration.
  Real-device execution was not performed.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Device-dependent key lookup and private-key file permissions need correction before approval.

1 open issue

• Resolve project graph after final device and runtime selection · New

What changed in this PR

Aligns mobile dotnet watch authentication with the build-owned key model used by browser tools.

Changes:

• Generates reusable keys and supplies the public key through runtime environment items.
• Verifies the provider’s secret echo before initialization.
• Shares key handling and adds authentication, build, and lifecycle tests.

File	Description
test/​TestAssets/​TestProjects/​WatchMobileApp/​WatchMobileApp.csproj	Enables runtime environment support.
test/​Microsoft.NET.Sdk.StaticWebAssets.Tests/​StaticWebAssets/​EnsureHotReloadBrowserToolsKeyTest.cs	Tests key-write failures.
test/​Microsoft.NET.Build.Tests/​GivenThatWeWantToBuildANetCoreApp.cs	Tests key generation, reuse, and cleanup.
test/​Microsoft.Extensions.DotNetDeltaApplier.Tests/​WebSocketTransportTests.cs	Tests authentication and connection handling.
test/​dotnet-watch.Tests/​HotReload/​MobileHotReloadTests.cs	Checks bootstrap environment isolation.
src/​Tasks/​Microsoft.NET.Build.Tasks/​targets/​Microsoft.NET.Sdk.targets	Generates and supplies mobile keys.
src/​Tasks/​Microsoft.NET.Build.Tasks/​Microsoft.NET.Build.Tasks.csproj	Includes shared key handling.
src/​Tasks/​Microsoft.NET.Build.Tasks/​EnsureHotReloadWebSocketKey.cs	Adds the mobile key-generation task.
src/​StaticWebAssetsSdk/​Tasks/​Microsoft.NET.Sdk.StaticWebAssets.Tasks.csproj	Includes shared key handling.
src/​StaticWebAssetsSdk/​Tasks/​EnsureHotReloadBrowserToolsKey.cs	Delegates to the shared helper.
src/​StaticWebAssetsSdk/​AGENTS.md	Documents shared key handling.
src/​Dotnet.Watch/​Watch/​AppModels/​MobileAppModel.cs	Resolves mobile key output paths.
src/​Dotnet.Watch/​HotReloadClient/​WebSocketClientTransport.cs	Loads build keys and echoes secrets.
src/​Dotnet.Watch/​HotReloadClient/​Web/​BrowserToolsBuildOutputs.cs	Supports mobile key filenames.
src/​Dotnet.Watch/​HotReloadAgent.Host/​WebSocketTransport.cs	Verifies provider authentication.
src/​Common/​HotReloadKeyPair.cs	Centralizes key creation and validation.
documentation/​specs/​dotnet-watch-for-maui.md	Updates the mobile authentication contract.

_{Review effort: Balanced}

[tmat]

Looks good, just a few minor things

[tmat]

/backport to release/11.0.2xx

[github-actions]

Started backporting to release/11.0.2xx (link to workflow run)

[github-actions]

@tmat backporting to release/11.0.2xx failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick a138b019f1929caac4086b03428ea4d57e9caa9f

CONFLICT (modify/delete): .github/memory/ARCHITECTURE.md deleted in HEAD and modified in a138b019f1 ([dotnet watch] Align mobile WebSocket authentication with WASM browser tools (#56722)).  Version a138b019f1 ([dotnet watch] Align mobile WebSocket authentication with WASM browser tools (#56722)) of .github/memory/ARCHITECTURE.md left in tree.
Auto-merging src/Dotnet.Watch/AGENTS.md
Auto-merging src/Dotnet.Watch/HotReloadClient/Web/SharedSecretBuildOutputs.cs
Auto-merging src/Dotnet.Watch/Watch/AppModels/WebApplicationAppModel.cs
Auto-merging src/Dotnet.Watch/Watch/Browser/SharedSecretBuildOutputsExtensions.cs
CONFLICT (content): Merge conflict in src/Dotnet.Watch/Watch/Browser/SharedSecretBuildOutputsExtensions.cs
Auto-merging src/Dotnet.Watch/Watch/Build/BuildNames.cs
CONFLICT (content): Merge conflict in src/Dotnet.Watch/Watch/Build/BuildNames.cs
Auto-merging src/StaticWebAssetsSdk/AGENTS.md
Auto-merging src/StaticWebAssetsSdk/Targets/Microsoft.NET.Sdk.StaticWebAssets.HotReload.targets
Auto-merging src/Tasks/Microsoft.NET.Build.Tasks/Microsoft.NET.Build.Tasks.csproj
Auto-merging test/Microsoft.NET.Build.Tests/GivenThatWeWantToBuildANetCoreApp.cs
Auto-merging test/Microsoft.NET.Sdk.StaticWebAssets.Tests/HotReloadBrowserToolsIntegrationTest.cs
error: could not apply a138b019f1... [dotnet watch] Align mobile WebSocket authentication with WASM browser tools (#56722)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: [dotnet watch] Align mobile WebSocket authentication with WASM browser tools
Applying: [dotnet watch] Address mobile authentication review feedback
Using index info to reconstruct a base tree...
A	.github/memory/ARCHITECTURE.md
M	src/Dotnet.Watch/AGENTS.md
M	src/Dotnet.Watch/HotReloadClient/Web/BrowserToolsBuildOutputs.cs
M	src/Dotnet.Watch/Watch/AppModels/MobileAppModel.cs
M	src/Dotnet.Watch/Watch/Browser/BrowserToolsBuildOutputsExtensions.cs
M	src/Dotnet.Watch/Watch/Build/BuildNames.cs
M	src/StaticWebAssetsSdk/Targets/Microsoft.NET.Sdk.StaticWebAssets.HotReload.targets
M	test/Microsoft.NET.Sdk.StaticWebAssets.Tests/HotReloadBrowserToolsIntegrationTest.cs
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): .github/memory/ARCHITECTURE.md deleted in HEAD and modified in [dotnet watch] Address mobile authentication review feedback.  Version [dotnet watch] Address mobile authentication review feedback of .github/memory/ARCHITECTURE.md left in tree.
Auto-merging src/Dotnet.Watch/AGENTS.md
Auto-merging src/Dotnet.Watch/HotReloadClient/Web/SharedSecretBuildOutputs.cs
Auto-merging src/Dotnet.Watch/Watch/AppModels/MobileAppModel.cs
Auto-merging src/Dotnet.Watch/Watch/Browser/SharedSecretBuildOutputsExtensions.cs
CONFLICT (content): Merge conflict in src/Dotnet.Watch/Watch/Browser/SharedSecretBuildOutputsExtensions.cs
Auto-merging src/Dotnet.Watch/Watch/Build/BuildNames.cs
CONFLICT (content): Merge conflict in src/Dotnet.Watch/Watch/Build/BuildNames.cs
Auto-merging src/StaticWebAssetsSdk/Targets/Microsoft.NET.Sdk.StaticWebAssets.HotReload.targets
Auto-merging test/Microsoft.NET.Sdk.StaticWebAssets.Tests/HotReloadBrowserToolsIntegrationTest.cs
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0002 [dotnet watch] Address mobile authentication review feedback
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output