fix(kirocrew): pin stable release to 0.6.0

packs/kirocrew/PLAN.md

@@ -53,7 +53,7 @@ Source: https://kiro.dev/docs/crew/installation.md
 
 | Step | Description | Notes |
 |------|-------------|-------|
-| 6 | Ensure Python ≥ 3.10 (3.12 recommended) | AL2023 current AMIs ship 3.11+; if somehow missing, `dnf install python3.11`. Ubuntu 22.04 ships 3.10. |
+| 6 | Discover Python ≥ 3.12 for optional pipx | KiroCrew v0.6.0 requires Python 3.12+. The official installer provisions a managed CPython 3.12 by default, so a host such as Ubuntu 22.04 may have no supported system interpreter and still install successfully. |
 | 7 | Install pipx (if not present) | KiroCrew installer prefers pipx; pre-install for cleaner management |
 | 8 | Run upstream KiroCrew installer | `curl -fsSL https://download.crew.kiro.dev/cli.sh \| sh -s -- --channel <channel> [--version <ver>]` |
 | 9 | Verify `kirocrew` binary in PATH | `kirocrew --version`; fail with actionable message if not found |
@@ -77,12 +77,12 @@ Source: https://kiro.dev/docs/crew/installation.md
 - Installs via **pipx** (preferred, if available) or a managed venv at `~/.kiro/crew-venv` (BESIDE the data home, not inside it)
 - Binary: `~/.local/bin/kirocrew`
 - Channels: `stable` (default), `nightly`, `insider` (env: `KIROCREW_CHANNEL`)
-- Requires: curl, openssl, Python ≥ 3.10, sha256sum/shasum
+- Requires: curl, openssl, and Python ≥ 3.12 only when using system Python; the default path provisions managed CPython 3.12, plus sha256sum/shasum
 
 ### Installer error handling:
 - If `download.crew.kiro.dev` is unreachable: `fail` with actionable message (check DNS/firewall/proxy)
 - If signature verification fails: upstream installer already aborts — we propagate
-- If Python < 3.10: attempt `dnf install python3.11` (AL2023) or fail with clear prereq message
+- If no supported system Python is available: skip pipx pre-installation and let the upstream installer provision managed CPython 3.12; an explicit system-Python opt-out fails with a clear prerequisite message
 
 ### Data home (`~/.kiro/crew/`, env: `KIROCREW_HOME`):
 ```
@@ -143,8 +143,8 @@ params:
     description: "KiroCrew release channel (stable | nightly | insider)"
     default: "stable"  # confirmed by Roy 2026-08-05
   - name: kirocrew-version
-    description: "Pin KiroCrew to a specific version (leave empty for latest in channel)"
-    default: ""
+    description: "Pin KiroCrew to the published v0.6.0 artifact on the stable channel"
+    default: "0.6.0"
   - name: extras
     description: "Comma-separated pip extras to install after wheel (voice, aws)"
     default: "aws,voice"  # confirmed by Roy 2026-08-05
@@ -245,10 +245,10 @@ pack_banner "kirocrew"
 # PHASE 2: KiroCrew Layer
 # ══════════════════════════════════════════════════════════════════════════
 
-# Step 6: Ensure Python ≥ 3.10
-#   - Check python3.12, python3.11, python3.10, python3 (in order)
-#   - On AL2023 if none ≥3.10: dnf install python3.11
-#   - Fail with clear message if still not available
+# Step 6: Ensure Python ≥ 3.12
+#   - Discover python3.12, python3.13, python3 for optional pipx use
+#   - If no supported system Python exists, let the upstream installer provision managed CPython 3.12
+#   - An explicit system-Python opt-out fails through the upstream installer with a clear message
 
 # Step 7: Install pipx (preferred by upstream installer)
 #   - pip install pipx (if not present)
@@ -516,7 +516,7 @@ Offline tests (no network, no sudo):
 ### Phase 2 feature signals
 - References `download.crew.kiro.dev/cli.sh`
 - References `--channel` flag
-- References Python ≥ 3.10 check
+- References Python ≥ 3.12 check for optional pipx use and managed-Python fallback
 - References `kirocrew doctor`
 - References `kirocrew setup` with TTY guard (`[[ -t 0 ]]`)
 - References pipx
@@ -571,7 +571,7 @@ Offline tests (no network, no sudo):
 | V3-L1 | ExecStart hardcodes binary path | Fixed: uses `__BINPATH__` placeholder, resolved via `command -v kirocrew` at install time |
 | V3-L2 | Step 10 extras path | Fixed: will use resolved path (same as V3-L1 logic) |
 | V3-N1 | pipx inject vs extras syntax | Noted: implementer maps extras→packages (voice→boto3,amazon-transcribe; aws→boto3) |
-| H1 | AL2023 Python version claim | Fixed: AL2023 current AMIs ship 3.11+; script checks available interpreters newest-first |
+| H1 | KiroCrew Python version claim | Updated for v0.6.0: the wheel requires Python 3.12+, while hosts with older system Python delegate to the upstream managed-CPython path. |
 | H2 | Installer URL resilience | Added: clear fail message with actionable hints (DNS/proxy/firewall) |
 | H3 | Missing --model flag | Fixed: arg parser accepts `--model` and ignores with informational log |
 | H4 | Venv path wrong | Fixed: `~/.kiro/crew-venv` (beside data home, not inside — matches upstream) |

packs/kirocrew/install.sh

@@ -29,7 +29,7 @@ PACK_ARG_REGION="$(pack_config_get region "us-east-1")"
 PACK_ARG_FROM_SECRET="$(pack_config_get from-secret "")"
 PACK_ARG_API_KEY="$(pack_config_get kiro-api-key "")"
 PACK_ARG_CHANNEL="$(pack_config_get channel "stable")"
-PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.5.0")"
+PACK_ARG_KIROCREW_VERSION="$(pack_config_get kirocrew-version "0.6.0")"
 PACK_ARG_EXTRAS="$(pack_config_get extras "aws,voice")"
 PACK_ARG_GATEWAY_PORT="$(pack_config_get gateway-port "5476")"
 PACK_ARG_START_GATEWAY="$(pack_config_get start-gateway "true")"
@@ -53,7 +53,7 @@ Options:
   --from-secret        Secrets Manager id/arn for Kiro API key      [default: ""]
   --channel            KiroCrew release channel                     [default: stable]
                        (stable | nightly | insider)
-  --kirocrew-version   Pin KiroCrew version                         [default: 0.5.0]
+  --kirocrew-version   Pin KiroCrew version                         [default: 0.6.0]
                        Channel and version BOTH form the download path
                        (cli/<channel>/<version>/cli-manifest.json), so they
                        must be compatible. This is the published ARTIFACT
@@ -494,53 +494,38 @@ fi
 # PHASE 2: KiroCrew Layer
 # ══════════════════════════════════════════════════════════════════════════════
 
-# ── Step 7: Ensure Python ≥ 3.10 ─────────────────────────────────────────────
-step "Ensuring Python ≥ 3.10 for KiroCrew"
+# ── Step 7: Discover Python ≥ 3.12 for optional pipx ─────────────────────────
+step "Checking for optional Python ≥ 3.12"
 
 KIROCREW_PY=""
-for candidate in python3.13 python3.12 python3.11 python3.10 python3; do
+for candidate in python3.12 python3.13 python3; do
   if command -v "${candidate}" &>/dev/null; then
-    if "${candidate}" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3,10) else 1)' 2>/dev/null; then
+    if "${candidate}" -c 'import sys; raise SystemExit(0 if sys.version_info >= (3,12) else 1)' 2>/dev/null; then
       KIROCREW_PY="${candidate}"
       break
     fi
   fi
 done
 
-# On AL2023, if no ≥3.10 found, try installing python3.11
-if [[ -z "${KIROCREW_PY}" ]] && command -v dnf &>/dev/null; then
-  log "No Python ≥3.10 found; installing python3.11 via dnf..."
-  sudo dnf install -y -q python3.11 2>/dev/null || true
-  if command -v python3.11 &>/dev/null; then
-    KIROCREW_PY="python3.11"
-  fi
-fi
-
-if [[ -z "${KIROCREW_PY}" ]]; then
-  fail "Python ≥3.10 is required for KiroCrew. On Amazon Linux: sudo dnf install python3.11"
+if [[ -n "${KIROCREW_PY}" ]]; then
+  ok "Supported system Python available for optional pipx: ${KIROCREW_PY} ($(${KIROCREW_PY} --version 2>&1))"
+else
+  log "No system Python ≥3.12 found — the upstream installer will provision managed CPython 3.12"
 fi
-ok "Python for KiroCrew: ${KIROCREW_PY} ($(${KIROCREW_PY} --version 2>&1))"
 
-# ── Step 8: Install pipx ─────────────────────────────────────────────────────
-step "Ensuring pipx is available"
+# ── Step 8: Install pipx when a supported system Python is available ──────────
+step "Ensuring pipx is available when possible"
 
-if ! command -v pipx &>/dev/null; then
+if ! command -v pipx &>/dev/null && [[ -n "${KIROCREW_PY}" ]]; then
   log "Installing pipx using ${KIROCREW_PY}..."
   "${KIROCREW_PY}" -m pip install --user pipx 2>/dev/null || true
   export PATH="${HOME}/.local/bin:${PATH}"
 fi
 
-# Verify pipx uses the correct Python (>=3.10), not system 3.9
 if command -v pipx &>/dev/null; then
-  PIPX_PY_VERSION="$(pipx --version 2>/dev/null && python3 -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')" 2>/dev/null || echo "")"
-  # If pipx is linked to a Python < 3.10, reinstall under the correct interpreter
-  if pipx environment 2>/dev/null | grep -q "python3.9\|Python 3.9"; then
-    log "pipx is running under Python 3.9 — reinstalling under ${KIROCREW_PY}"
-    "${KIROCREW_PY}" -m pip install --user --force-reinstall pipx 2>/dev/null || true
-  fi
   ok "pipx available: $(pipx --version 2>/dev/null || echo unknown)"
 else
-  log "pipx not available — upstream installer will use managed venv instead"
+  log "pipx not available — upstream installer will use its managed venv"
 fi
 
 # ── Step 9: Run upstream KiroCrew installer ───────────────────────────────────
@@ -559,10 +544,10 @@ if [[ -n "${KIROCREW_HOME_OVERRIDE}" ]]; then
   export KIROCREW_HOME="${KIROCREW_HOME_OVERRIDE}"
 fi
 
-# Ensure the correct Python is first in PATH for the upstream installer
-# The upstream cli.sh uses `python3` — if system python3 is 3.9 but we have 3.11+
-# available, we need to make sure the right one is found first.
-if [[ "${KIROCREW_PY}" != "python3" ]]; then
+# Ensure a supported system Python is first in PATH for the upstream installer
+# when one is available. Otherwise, leave Python resolution to the upstream
+# installer so it can provision managed CPython 3.12.
+if [[ -n "${KIROCREW_PY}" && "${KIROCREW_PY}" != "python3" ]]; then
   KIROCREW_PY_PATH="$(command -v "${KIROCREW_PY}")"
   KIROCREW_PY_DIR="$(dirname "${KIROCREW_PY_PATH}")"
   # Create a temporary symlink so the upstream installer's `python3` resolves correctly
@@ -584,7 +569,7 @@ curl -fsSL "${KIROCREW_INSTALLER_URL}" -o /tmp/install-kirocrew.sh || {
 if ! sh /tmp/install-kirocrew.sh "${KIROCREW_INSTALLER_ARGS[@]}"; then
   rm -f /tmp/install-kirocrew.sh
   fail "KiroCrew installer failed. Possible causes:
-  - Python: ensure ${KIROCREW_PY} is ≥3.10
+  - Python: KiroCrew v0.6.0 requires 3.12+; the official installer provisions managed CPython 3.12 by default, or use a supported system interpreter
   - OpenSSL: required for signature verification
   - Channel: '${CHANNEL}' may not have a published release yet"
 fi

packs/kirocrew/manifest.yaml

@@ -26,7 +26,7 @@ params:
     default: "stable"
   - name: kirocrew-version
     description: "KiroCrew version passed to the upstream installer as --version. Pinned by default; an empty value does NOT float to the channel's latest, because pack_config_get falls back to the pinned default whenever the configured value is empty. This is the published ARTIFACT version, verified independently of the GitHub release tag. It must match the channel because both values form cli/<channel>/<version>/cli-manifest.json; before changing the pin, confirm that feed/<channel>/latest-cli.json, the manifest, and its wheel URL all publish the exact version."
-    default: "0.5.0"
+    default: "0.6.0"
   - name: extras
     description: "Comma-separated pip extras to install after wheel (voice, aws)"
     default: "aws,voice"

packs/kirocrew/test.sh

@@ -332,10 +332,10 @@ else
   fail "install.sh missing --channel"
 fi
 
-if grep -q 'python3.10\|python3.11\|python3.12\|python3.13' "${INSTALL}"; then
-  pass "install.sh checks Python ≥3.10 candidates"
+if grep -q 'python3.12' "${INSTALL}" && grep -q 'Python ≥3.12' "${INSTALL}"; then
+  pass "install.sh checks Python ≥3.12 candidates"
 else
-  fail "install.sh missing Python version check"
+  fail "install.sh missing Python ≥3.12 check"
 fi
 
 if grep -q 'kirocrew doctor' "${INSTALL}"; then