feat(desktop): backport the baked EXTERNALLY-MANAGED marker to release/0.6.0

[bolichen97]

Problem / Motivation

release/0.6.0 (the current insider line, v0.6.0-insider.1) carries #7959's provenance gate on the loose EXTERNALLY-MANAGED marker but not #8799, which restores the edition auto-update path that gate closed. On a 0.6.0 insider build every per-user edition install (a Toolbox, Homebrew or ~/Applications tree) reads as bare: the updater is off, the About panel offers no update, the 30 s / 4 h background check never runs, and a remote Linux gateway hides its Toolbox provider.

Why it matters

Insiders on an edition build cannot update through their package manager from inside the app until the next release line, and the internal edition's CR that wires its lanes to the baked marker fails closed against a core that does not read one. 0.6.0 is the line those editions ship on.

What changed (motivation → approach → change)

Straight cherry-pick of a21546ae593bb5c076a0199a130dec346e06a5b9 (#8799), same commit, same rationale -- see that PR for the design discussion and the reviewer rounds. In short:

• website/electron/auto-update.js -- a baked marker (__dirname/EXTERNALLY-MANAGED, inside app.asar, packaged builds only) is read first and trusted as code on every platform, outranking a loose marker; the loose marker keeps fix(desktop): establish EXTERNALLY-MANAGED marker provenance before shelling it #7959's gate. The managed-command lane pins the Windows shell to %SystemRoot%\System32\cmd.exe (no inherited COMSPEC), sets PYTHONNOUSERSITE=1, and derives KIROCREW_MANAGED_ARGV0 = process.execPath for edition wrappers.
• packaging/build-desktop.sh step 3b -- KIROCREW_MANAGED_INSTALL_MARKER=<json> is validated (string fields, reader caps, updateCommand required) and staged for the build only (EXIT trap armed before the copy; stale-marker cleanup ahead of the SKIP_ELECTRON exit).
• fix(hooks) -- cryptography imported lazily in wecom/media.py, weixin/media.py, secrets/vault.py, so the tool-approval import chain no longer needs the wheel; WeCom/Weixin decrypt runs through asyncio.to_thread.
• Docs, package.json build.files, .gitignore, and the shared test/build-time-inputs.js.

Dropped from the backport: the fix(dashboard) SEL deny-path piece (sel.sel_is_warm(), _audit_denied's warm/cold split, test_api_health.py changes, test_sel_startup_warm.py). It hardens the direct-enqueue path that #8741 introduced on main; release/0.6.0 does not carry #8741 and its _audit_denied still runs every deny audit through asyncio.to_thread, so the hazard does not exist on this branch. Those four files stay at the branch's own versions (that was the only cherry-pick conflict).

Tests

• website/electron: node --test on auto-update.test.js / packaging.test.js / shell-contract.test.js -- 199 pass, 0 fail (baked-marker precedence and trust, unpackaged-build gate, constructed-env assertions incl. the pinned shell and KIROCREW_MANAGED_ARGV0, build.files staleness with the shared build-time-inputs set).
• test/test_build_desktop_managed_marker.py (18) -- step 3b accept / reject branches, trap-before-copy and cleanup-before-SKIP_ELECTRON ordering, caps parity with the reader's constants.
• test/test_approval_chain_no_cryptography.py (3) -- the approval chain imports with cryptography blocked; the decrypt helpers still raise ImportError on use.
• test_wecom_media.py, test_weixin_media.py, test_api_health.py -- 144 Python tests pass together on this branch; flake8 and eslint clean.

Manual verification

N/A beyond #8799's -- the diff is byte-identical to the merged commit minus the dropped SEL files; the edition-side lanes exercise it end to end once this is on an insider build.

Related Issues

no linked issue: backport of #8799 to the 0.6.0 insider line.

Pattern harvest

Not generalizable: a release-line backport of an already-reviewed change; the harvest lives on #8799.

Checklist

• At most two commits (one is the norm), with a Conventional Commits title (feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...)
• Existing tests pass and new tests added for new functionality
• Self-review completed; code follows project style guidelines
• Documentation updated (if applicable)
• No secrets, credentials, or internal references in the diff

[github-actions]

UX Review (Fable 5) — ✅ PASS

UX-level review of d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

UX-Verdict: PASS

No user-facing surface changes: build-time marker plumbing, electron update internals, and backend lazy imports — the one UX-adjacent effect (About-panel managed updates now working on Windows/user-owned installs) reuses existing, unchanged UI, and the build gate refusing a marker with no updateCommand prevents the only bad outcome a user could hit (an app that can neither self-update nor be updated).

[UX-REVIEWED] d4788d0

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

A sound backport: the baked-marker trust rests on an equal-power argument (rewriting app.asar already means rewriting the reader), the loose-marker provenance gate stays intact, and the build validator's duplicated caps are test-pinned to the reader's constants.

[DESIGN-REVIEWED] d4788d0

[github-actions]

First Principles Review (Fable 5) — ✅ PASS

Premise-level review of d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

All claims verified. Writing the review.

First-Principles-Verdict: PASS

A cherry-pick backport where every piece removes a named, branch-verified harm — including the one deliberately dropped, whose hazard provably doesn't exist here.

What this change ships

Intent: let insiders on per-user edition installs (Toolbox, Homebrew, ~/Applications) update from inside a 0.6.0 app again — a FIX (restores the capability #7959's provenance gate closed; the feat: title understates that).

1. Edition installs get the updater and About-panel update back via a build-time baked marker — justified (the fix)
2. Windows installs can now honor marker commands, baked shape only — justified, declared
3. New build input KIROCREW_MANAGED_INSTALL_MARKER, validated fail-loud in build-desktop.sh — justified (one external consumer, the edition lane, fails closed without it)
4. Baked marker outranks a loose one when both exist — justified precedence, declared
5. Managed commands' Windows shell pinned to System32 cmd.exe; COMSPEC no longer inherited — derived (agent-untrusted boundary, newly reachable once Windows honors commands)
6. PYTHONNOUSERSITE=1 set in the constructed env — derived, same boundary
7. KIROCREW_MANAGED_ARGV0 handed to marker commands — 0 in-repo consumers (grepped KIROCREW_MANAGED_ARGV0: definition, test, doc only); external edition wrapper is the named consumer
8. Tool approvals no longer need the cryptography wheel — rides along, declared; its defect is real on this branch (hooks.py:1058 imports slack.gateway._is_read_only_tool on the approval path)
9. WeCom/Weixin media decrypt moved off the event loop — rides along, declared
10. The SEL warm/cold piece dropped from the cherry-pick — justified: sel_is_warm absent from src/ (grepped, 0 hits) and this branch's _audit_denied already runs via asyncio.to_thread (telemetry.py:1339)

The fix sits at cause level: #7959's gate structurally refuses every user-owned install, and build-time provenance is the answer to that gate, not a workaround beside it. The riders (items 8–9) shipped in the same merged main commit a21546ae; unlike the dropped SEL piece, their hazard exists on this branch, so excluding them would knowingly leave a defect — their zero option costs mismatched-wheel hosts every tool approval. No undeclared items; the loose marker and the KIROCREW_EXTERNALLY_MANAGED env seam do different jobs (post-hoc and unpackaged-only respectively), so nothing here is a second spelling.

[FIRST-PRINCIPLES-REVIEWED] d4788d0

[github-actions]

GPT 5.6 Review — 🔴 changes requested (blocking)

GPT 5.6 found at least one blocking issue that must be resolved before merging d4788d08ad819b47cfd8133bcf7b4dd712ec3d96. 1 of 1 blocking finding(s) are security-class and were withheld from adjudication, so the blocking verdict stands.

This comment is updated in place on each push.

BLOCKING -- website/electron/auto-update.js:1133 -- The pinned shell trusts a user-writable environment value
? \${process.env.SystemRoot || "C:\Windows"}\System32\cmd.exe`PoisonedHKCU\Environment\SystemRoot-> restarted edition -> managed check -> plantedcmd.exeexecutes. Anchor: residual/security Fix: Resolve System32 through a trusted Windows API for the shell, PATH, and child environment. FINDING -- src/kiro_crew/secrets/vault.py:324 -- Function-localfrom cryptography...imports here and in both media modules violatetop-level-imports-> Fix: use guarded top-level optional imports and raise on feature use when unavailable. [BLOCK-MERGE] d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 [GPT-REVIEWED] d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 False positive or not applicable? A repository writer can comment:/ai-review override gpt d4788d0: `

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed d4788d08ad819b47cfd8133bcf7b4dd712ec3d96 — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] d4788d0

Verdict parsed from the review's SHA-scoped output markers for commit d4788d08ad819b47cfd8133bcf7b4dd712ec3d96.

False positive or not applicable? A repository writer can comment:
/ai-review override fable d4788d08ad819b47cfd8133bcf7b4dd712ec3d96: <one-sentence reason>