From fe9fe81792f8075d045e8aaea77c2dc0a753dd7f Mon Sep 17 00:00:00 2001 From: "Bode (Kiro Crew Issue Radar)" Date: Wed, 2 Sep 2026 07:08:43 +0000 Subject: [PATCH 1/2] chore(kirocrew): pin KiroCrew to stable 0.4.1 The kirocrew pack pinned 0.3.0 as its default version. Upstream has since cut 0.4.1, which is the current Latest stable release on kirodotdev/KiroCrew, so new installs were landing several releases behind. Bump the pinned default in both places that carry it, and refresh the user-facing text that names the version: - packs/kirocrew/install.sh: pack_config_get fallback, the --kirocrew-version help default, and the stable-lane compatibility note. - packs/kirocrew/manifest.yaml: the param default and the channel/version mismatch example. The channel/version coupling documented in these strings is unchanged: both values still form cli///cli-manifest.json, so an unmatched pair still 403s. Only the version they name moves. Validation: packs/kirocrew/test.sh 73/73 pass, bash -n clean, git diff --check clean, shellcheck -S warning reports only the two pre-existing SC2034 warnings already present on main. --- packs/kirocrew/install.sh | 6 +++--- packs/kirocrew/manifest.yaml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packs/kirocrew/install.sh b/packs/kirocrew/install.sh index 335773b..5339ade 100755 --- a/packs/kirocrew/install.sh +++ b/packs/kirocrew/install.sh @@ -29,7 +29,7 @@ PACK_ARG_REGION="$(pack_config_get region "us-east-1")" PACK_ARG_FROM_SECRET="$(pack_config_get from-secret "")" PACK_ARG_API_KEY="$(pack_config_get kiro-api-key "")" PACK_ARG_CHANNEL="$(pack_config_get channel "stable")" -PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.3.0")" +PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.4.1")" PACK_ARG_EXTRAS="$(pack_config_get extras "aws,voice")" PACK_ARG_GATEWAY_PORT="$(pack_config_get gateway-port "5476")" PACK_ARG_START_GATEWAY="$(pack_config_get start-gateway "true")" @@ -53,10 +53,10 @@ Options: --from-secret Secrets Manager id/arn for Kiro API key [default: ""] --channel KiroCrew release channel [default: stable] (stable | nightly | insider) - --kirocrew-version Pin KiroCrew version [default: 0.3.0] + --kirocrew-version Pin KiroCrew version [default: 0.4.1] Channel and version BOTH form the download path (cli///cli-manifest.json), so they - must be compatible. 0.3.0 was cut on the stable lane + must be compatible. 0.4.1 was cut on the stable lane only: changing --channel without also passing a version that exists on that lane 403s and fails the install. --extras Comma-separated pip extras (aws,voice) [default: aws,voice] diff --git a/packs/kirocrew/manifest.yaml b/packs/kirocrew/manifest.yaml index 26081f5..371fa09 100644 --- a/packs/kirocrew/manifest.yaml +++ b/packs/kirocrew/manifest.yaml @@ -25,8 +25,8 @@ params: description: "KiroCrew release channel (stable | nightly | insider)" default: "stable" - name: kirocrew-version - description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. Must be compatible with the channel: both values form the manifest path cli///cli-manifest.json, and an unmatched pair (e.g. insider/0.3.0) returns 403 and fails the install." - default: "0.3.0" + description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. Must be compatible with the channel: both values form the manifest path cli///cli-manifest.json, and an unmatched pair (e.g. insider/0.4.1) returns 403 and fails the install." + default: "0.4.1" - name: extras description: "Comma-separated pip extras to install after wheel (voice, aws)" default: "aws,voice" From a819f18edd28e1e2bf0f1c5e9368ab6d9792ef66 Mon Sep 17 00:00:00 2001 From: "Bode (Kiro Crew Issue Radar)" Date: Wed, 2 Sep 2026 07:16:29 +0000 Subject: [PATCH 2/2] fix(kirocrew): pin the published artifact version, not the release tag Review caught that the previous commit's pin of "0.4.1" is not installable. The pack passes --version straight to the upstream installer, which builds cli///cli-manifest.json and kirocrew--py3-none-any.whl from it. Upstream tags the release v0.4.1 but publishes the CLI artifact as 0.4.1rc1, so the tag and the artifact version are not interchangeable. Measured against the real CDN the installer uses: stable/0.4.1 cli-manifest.json -> 403 stable/0.4.1rc1 cli-manifest.json -> 200 stable/0.4.1rc1 wheel -> 200 stable/0.3.0 cli-manifest.json -> 200 (old pin, control) feed/stable/latest-cli.json independently reports version 0.4.1rc1 with wheel_url .../cli/stable/0.4.1rc1/kirocrew-0.4.1rc1-py3-none-any.whl, and a host already running the stable lane reports "kirocrew 0.4.1rc1". Pinning "0.4.1" would therefore have 403'd every install -- the exact failure mode this param's own documentation warns about. Changes: - Pin 0.4.1rc1 in the install.sh fallback and the manifest default. - Rewrite the help text and manifest description to say this is the ARTIFACT version rather than the GitHub tag, and to name feed/stable/latest-cli.json as the way to confirm a pin before changing it. The prior wording ("cut on the stable lane only") was also misleading: a v0.4.1-insider.1 prerelease exists, and Insider carries a distinct version identifier. - Add a "version pin consistency" test asserting manifest default == code fallback == help default, so a future bump cannot silently leave one of the three stale. Validation: packs/kirocrew/test.sh 75/75 pass (73 before, +2 new). The new assertion was negative-tested: drifting the manifest default to 9.9.9 in an isolated copy fails with "pin disagrees: manifest='9.9.9' code='0.4.1rc1' help='0.4.1rc1'". bash -n clean on both files, shellcheck -S warning clean on test.sh, and install.sh's warning set is unchanged from origin/main (3 SC2034, pre-existing). --- packs/kirocrew/install.sh | 13 ++++++++----- packs/kirocrew/manifest.yaml | 4 ++-- packs/kirocrew/test.sh | 29 +++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+), 7 deletions(-) diff --git a/packs/kirocrew/install.sh b/packs/kirocrew/install.sh index 5339ade..5d58a4a 100755 --- a/packs/kirocrew/install.sh +++ b/packs/kirocrew/install.sh @@ -29,7 +29,7 @@ PACK_ARG_REGION="$(pack_config_get region "us-east-1")" PACK_ARG_FROM_SECRET="$(pack_config_get from-secret "")" PACK_ARG_API_KEY="$(pack_config_get kiro-api-key "")" PACK_ARG_CHANNEL="$(pack_config_get channel "stable")" -PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.4.1")" +PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.4.1rc1")" PACK_ARG_EXTRAS="$(pack_config_get extras "aws,voice")" PACK_ARG_GATEWAY_PORT="$(pack_config_get gateway-port "5476")" PACK_ARG_START_GATEWAY="$(pack_config_get start-gateway "true")" @@ -53,12 +53,15 @@ Options: --from-secret Secrets Manager id/arn for Kiro API key [default: ""] --channel KiroCrew release channel [default: stable] (stable | nightly | insider) - --kirocrew-version Pin KiroCrew version [default: 0.4.1] + --kirocrew-version Pin KiroCrew version [default: 0.4.1rc1] Channel and version BOTH form the download path (cli///cli-manifest.json), so they - must be compatible. 0.4.1 was cut on the stable lane - only: changing --channel without also passing a version - that exists on that lane 403s and fails the install. + must be compatible. This is the published ARTIFACT + version, not the GitHub release tag: upstream tag + v0.4.1 ships the CLI as 0.4.1rc1, so pinning "0.4.1" + 404s/403s even on stable. Confirm a pin resolves on + its lane before changing either value; the stable lane + publishes feed/stable/latest-cli.json naming it. --extras Comma-separated pip extras (aws,voice) [default: aws,voice] --gateway-port KiroCrew gateway port [default: 5476] --start-gateway Enable systemd service (true|false) [default: true] diff --git a/packs/kirocrew/manifest.yaml b/packs/kirocrew/manifest.yaml index 371fa09..518571e 100644 --- a/packs/kirocrew/manifest.yaml +++ b/packs/kirocrew/manifest.yaml @@ -25,8 +25,8 @@ params: description: "KiroCrew release channel (stable | nightly | insider)" default: "stable" - name: kirocrew-version - description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. Must be compatible with the channel: both values form the manifest path cli///cli-manifest.json, and an unmatched pair (e.g. insider/0.4.1) returns 403 and fails the install." - default: "0.4.1" + description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. This is the published ARTIFACT version, not the GitHub release tag: upstream tag v0.4.1 ships the CLI wheel as 0.4.1rc1. Must be compatible with the channel: both values form the manifest path cli///cli-manifest.json, and a pair that was never published there (e.g. stable/0.4.1, or insider/0.4.1rc1) returns 403 and fails the install." + default: "0.4.1rc1" - name: extras description: "Comma-separated pip extras to install after wheel (voice, aws)" default: "aws,voice" diff --git a/packs/kirocrew/test.sh b/packs/kirocrew/test.sh index a210912..3a744a6 100755 --- a/packs/kirocrew/test.sh +++ b/packs/kirocrew/test.sh @@ -186,6 +186,35 @@ else fail "install.sh --help does not exit 0" fi +# ── version pin consistency ────────────────────────────────────────────────── +# The pinned KiroCrew version is stated in three independent places. They drift +# silently on a version bump, and a stale help/manifest value misleads operators +# into passing a channel/version pair that was never published (403 install). +header "version pin consistency" + +PIN_MANIFEST="$(python3 -c " +import yaml +d = yaml.safe_load(open('${MANIFEST}')) +print(next(p['default'] for p in d.get('params', []) if p['name'] == 'kirocrew-version')) +" 2>/dev/null || true)" + +PIN_CODE="$(sed -n 's/.*pack_config_get kirocrew-version "\([^"]*\)".*/\1/p' "${INSTALL}" | head -1)" + +PIN_HELP="$(bash "${INSTALL}" --help 2>/dev/null \ + | sed -n 's/.*--kirocrew-version .*\[default: \([^]]*\)\].*/\1/p' | head -1)" + +if [[ -n "${PIN_MANIFEST}" && -n "${PIN_CODE}" && -n "${PIN_HELP}" ]]; then + pass "pinned version is discoverable in manifest, code, and help" +else + fail "could not extract pin (manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}')" +fi + +if [[ "${PIN_MANIFEST}" == "${PIN_CODE}" && "${PIN_CODE}" == "${PIN_HELP}" ]]; then + pass "pin agrees across manifest, code fallback, and help (${PIN_CODE})" +else + fail "pin disagrees: manifest='${PIN_MANIFEST}' code='${PIN_CODE}' help='${PIN_HELP}'" +fi + # ── arg parser exit codes ──────────────────────────────────────────────────── header "arg parser exit codes"