@bitkyc08/opencodex 2.6.1 → 2.6.2

package/src/lib/eventstream-decoder.ts

@@ -0,0 +1,244 @@
+/**
+ * `application/vnd.amazon.eventstream` decoder.
+ *
+ * Ported from jawcode `packages/ai/src/providers/aws-eventstream.ts` (verbatim logic).
+ * Foundational dependency for AWS-eventstream providers: kiro (CodeWhisperer
+ * GenerateAssistantResponse) and amazon-bedrock (Converse). Self-contained — only
+ * uses Buffer / DataView / TextDecoder (Bun + Node compatible).
+ *
+ * Wire format (all integers big-endian):
+ *
+ *   [total length     u32]
+ *   [headers length   u32]
+ *   [prelude CRC32    u32]   <- CRC over the first 8 bytes
+ *   [headers          headers_length]
+ *   [payload          total_length - headers_length - 16]
+ *   [message CRC32    u32]   <- CRC over the entire message minus the trailing 4 bytes
+ *
+ * Headers: a sequence of `[name_len u8][name utf8][value_type u8][value …]`.
+ */
+
+const PRELUDE_LEN = 8;
+const PRELUDE_CRC_LEN = 4;
+const MESSAGE_CRC_LEN = 4;
+const HEADER_BLOCK_OFFSET = PRELUDE_LEN + PRELUDE_CRC_LEN;
+const MIN_MESSAGE_LEN = HEADER_BLOCK_OFFSET + MESSAGE_CRC_LEN;
+const MAX_MESSAGE_LEN = 16 * 1024 * 1024;
+
+export interface EventStreamMessage {
+	/** Header casing is preserved verbatim (e.g. `:event-type`, `:message-type`). */
+	headers: Record<string, string>;
+	payload: Uint8Array;
+}
+
+/** CRC32 (IEEE / zlib polynomial 0xEDB88320), matches `@aws-crypto/crc32`. */
+const CRC_TABLE = (() => {
+	const t = new Uint32Array(256);
+	for (let i = 0; i < 256; i++) {
+		let c = i;
+		for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+		t[i] = c >>> 0;
+	}
+	return t;
+})();
+
+export function crc32(bytes: Uint8Array, seed = 0): number {
+	let c = (seed ^ 0xffffffff) >>> 0;
+	for (let i = 0; i < bytes.length; i++) c = (CRC_TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8)) >>> 0;
+	return (c ^ 0xffffffff) >>> 0;
+}
+
+/**
+ * Decode a single, fully buffered eventstream message. Throws if the framing is
+ * malformed or either CRC mismatches.
+ */
+export function decodeMessage(frame: Uint8Array): EventStreamMessage {
+	if (frame.length < MIN_MESSAGE_LEN) throw new Error("eventstream: frame too short");
+	const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+	const total = view.getUint32(0, false);
+	if (total !== frame.length) throw new Error(`eventstream: framed length ${total} != buffer ${frame.length}`);
+	if (total > MAX_MESSAGE_LEN) throw new Error(`eventstream: total length ${total} exceeds maximum`);
+	const headersLen = view.getUint32(4, false);
+	const preludeCrc = view.getUint32(8, false);
+	const computedPreludeCrc = crc32(frame.subarray(0, PRELUDE_LEN));
+	if (computedPreludeCrc !== preludeCrc) throw new Error("eventstream: prelude CRC mismatch");
+	if (headersLen > total - MIN_MESSAGE_LEN) throw new Error("eventstream: headers length exceeds frame payload");
+	const msgCrc = view.getUint32(total - MESSAGE_CRC_LEN, false);
+	const computedMsgCrc = crc32(frame.subarray(0, total - MESSAGE_CRC_LEN));
+	if (computedMsgCrc !== msgCrc) throw new Error("eventstream: message CRC mismatch");
+
+	const headersBytes = frame.subarray(HEADER_BLOCK_OFFSET, HEADER_BLOCK_OFFSET + headersLen);
+	const payload = frame.subarray(HEADER_BLOCK_OFFSET + headersLen, total - MESSAGE_CRC_LEN);
+	return { headers: parseHeaders(headersBytes), payload };
+}
+
+function parseHeaders(buf: Uint8Array): Record<string, string> {
+	const out: Record<string, string> = {};
+	const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+	const decoder = new TextDecoder();
+	let p = 0;
+	const need = (n: number, label: string) => {
+		if (p + n > buf.length) throw new Error(`eventstream: truncated header ${label}`);
+	};
+	while (p < buf.length) {
+		need(1, "name length");
+		const nameLen = view.getUint8(p);
+		p += 1;
+		need(nameLen, "name");
+		const name = decoder.decode(buf.subarray(p, p + nameLen));
+		p += nameLen;
+		need(1, "type");
+		const type = view.getUint8(p);
+		p += 1;
+		switch (type) {
+			case 0: // bool true
+				out[name] = "true";
+				break;
+			case 1: // bool false
+				out[name] = "false";
+				break;
+			case 2: // byte
+				need(1, "byte value");
+				out[name] = String(view.getInt8(p));
+				p += 1;
+				break;
+			case 3: // short
+				need(2, "short value");
+				out[name] = String(view.getInt16(p, false));
+				p += 2;
+				break;
+			case 4: // integer
+				need(4, "integer value");
+				out[name] = String(view.getInt32(p, false));
+				p += 4;
+				break;
+			case 5: // long — decimal string to avoid precision loss
+				need(8, "long value");
+				out[name] = bigIntFromBytes(buf.subarray(p, p + 8)).toString();
+				p += 8;
+				break;
+			case 6: {
+				// byte array — base64 for safe transport
+				need(2, "byte-array length");
+				const len = view.getUint16(p, false);
+				p += 2;
+				need(len, "byte-array value");
+				out[name] = Buffer.from(buf.buffer, buf.byteOffset + p, len).toString("base64");
+				p += len;
+				break;
+			}
+			case 7: {
+				// string
+				need(2, "string length");
+				const len = view.getUint16(p, false);
+				p += 2;
+				need(len, "string value");
+				out[name] = decoder.decode(buf.subarray(p, p + len));
+				p += len;
+				break;
+			}
+			case 8: // timestamp (ms since epoch as i64)
+				need(8, "timestamp value");
+				out[name] = new Date(Number(bigIntFromBytes(buf.subarray(p, p + 8)))).toISOString();
+				p += 8;
+				break;
+			case 9: {
+				// uuid
+				need(16, "uuid value");
+				const u = buf.subarray(p, p + 16);
+				const hex: string[] = [];
+				for (let i = 0; i < 16; i++) hex.push(u[i].toString(16).padStart(2, "0"));
+				out[name] =
+					`${hex.slice(0, 4).join("")}-${hex.slice(4, 6).join("")}-${hex.slice(6, 8).join("")}-${hex.slice(8, 10).join("")}-${hex.slice(10, 16).join("")}`;
+				p += 16;
+				break;
+			}
+			default:
+				throw new Error(`eventstream: unknown header value type ${type}`);
+		}
+	}
+	return out;
+}
+
+function bigIntFromBytes(b: Uint8Array): bigint {
+	let v = 0n;
+	for (let i = 0; i < b.length; i++) v = (v << 8n) | BigInt(b[i]);
+	// sign-extend (two's complement)
+	if (b.length === 8 && b[0] & 0x80) v -= 1n << 64n;
+	return v;
+}
+
+/**
+ * Async generator that consumes a `ReadableStream<Uint8Array>` (a fetch response
+ * body) and yields fully-framed messages, handling arbitrary chunk boundaries.
+ */
+export async function* decodeEventStream(source: ReadableStream<Uint8Array>): AsyncGenerator<EventStreamMessage> {
+	const reader = source.getReader();
+	let buf: Uint8Array = new Uint8Array(0);
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (value && value.length > 0) buf = buf.length === 0 ? value : Buffer.concat([buf, value]);
+			let offset = 0;
+			while (buf.length - offset >= 4) {
+				const dv = new DataView(buf.buffer, buf.byteOffset + offset, buf.length - offset);
+				const total = dv.getUint32(0, false);
+				if (total < MIN_MESSAGE_LEN) throw new Error(`eventstream: total length ${total} below minimum`);
+				if (total > MAX_MESSAGE_LEN) throw new Error(`eventstream: total length ${total} exceeds maximum`);
+				if (buf.length - offset < total) break;
+				const frame = buf.subarray(offset, offset + total);
+				yield decodeMessage(frame);
+				offset += total;
+			}
+			if (offset > 0) buf = buf.slice(offset);
+			if (buf.length > MAX_MESSAGE_LEN) throw new Error(`eventstream: buffered frame exceeds maximum ${MAX_MESSAGE_LEN}`);
+			if (done) break;
+		}
+		if (buf.length > 0) throw new Error("eventstream: truncated message at end of stream");
+	} finally {
+		// Early termination (consumer break/return, turn abort, or an HTTP/2 mid-body reset) can leave
+		// an in-flight `reader.read()` pending when this generator's `finally` runs. Releasing the lock
+		// does NOT settle that orphaned read — Bun then surfaces it as an off-path
+		// `unhandledRejection: TypeError: null is not an object` that no caller try/catch can intercept.
+		// Cancel first (settles the pending read + closes the body), then release. On a clean `done`
+		// finish the read is already settled, so cancel() is a harmless no-op.
+		try {
+			await reader.cancel();
+		} catch {
+			/* body already errored/closed — nothing to cancel */
+		}
+		try {
+			reader.releaseLock();
+		} catch {
+			/* lock already released by cancel() on some runtimes */
+		}
+	}
+}
+
+/** Build a single eventstream frame (string headers only) — used by tests and fixtures. */
+export function encodeMessage(headers: Record<string, string>, payload: Uint8Array): Uint8Array {
+	const enc = new TextEncoder();
+	const headerParts: Uint8Array[] = [];
+	for (const [name, value] of Object.entries(headers)) {
+		const nameBytes = enc.encode(name);
+		const valueBytes = enc.encode(value);
+		const head = new Uint8Array(1 + nameBytes.length + 1 + 2);
+		const hv = new DataView(head.buffer);
+		hv.setUint8(0, nameBytes.length);
+		head.set(nameBytes, 1);
+		hv.setUint8(1 + nameBytes.length, 7); // string type
+		hv.setUint16(1 + nameBytes.length + 1, valueBytes.length, false);
+		headerParts.push(head, valueBytes);
+	}
+	const headersBytes = Buffer.concat(headerParts.map(p => Buffer.from(p)));
+	const total = HEADER_BLOCK_OFFSET + headersBytes.length + payload.length + MESSAGE_CRC_LEN;
+	const frame = new Uint8Array(total);
+	const dv = new DataView(frame.buffer);
+	dv.setUint32(0, total, false);
+	dv.setUint32(4, headersBytes.length, false);
+	dv.setUint32(8, crc32(frame.subarray(0, PRELUDE_LEN)), false);
+	frame.set(headersBytes, HEADER_BLOCK_OFFSET);
+	frame.set(payload, HEADER_BLOCK_OFFSET + headersBytes.length);
+	dv.setUint32(total - MESSAGE_CRC_LEN, crc32(frame.subarray(0, total - MESSAGE_CRC_LEN)), false);
+	return frame;
+}

package/src/lib/token-estimate.ts

@@ -0,0 +1,43 @@
+/**
+ * Heuristic token-estimation sidecar.
+ *
+ * Some providers (notably kiro / CodeWhisperer) return no token usage in their stream, so Codex's
+ * usage display and auto-compact (which read response.completed.usage) never engage. This module
+ * provides a cheap, dependency-free char-based estimate to fill that gap.
+ *
+ * Grounding (web): 1 token ~= 4 chars for English prose; empirical model ratios are ~Claude 3.5,
+ * ~GPT 3.6, ~Gemini 3.8 chars/token (within ~10%). Code / JSON / tool-args (the dominant Codex
+ * traffic) pack MORE tokens per char, so a lower chars-per-token ratio is used for those models.
+ * Over-counting fails safe (auto-compact fires earlier); under-counting risks context overflow.
+ */
+
+/** Generic English-prose fallback ratio (chars per token). */
+const DEFAULT_CHARS_PER_TOKEN = 4;
+
+/**
+ * Kiro routes code/JSON-heavy agent traffic whose true ratio is ~3.0-3.3 chars/token. 3.5 keeps a
+ * small safety margin (slight over-count) without wildly inflating; tune toward 3.3 if overflow is
+ * ever observed. All kiro models are text LLMs, so a single ratio applies to the whole family.
+ */
+const KIRO_CHARS_PER_TOKEN = 3.5;
+
+const KIRO_MODEL_PREFIXES = ["kiro", "claude", "deepseek", "minimax", "glm", "qwen"];
+
+/** Model-aware chars-per-token ratio. Unknown models fall back to the generic English ratio. */
+export function charsPerToken(modelId?: string): number {
+  if (!modelId) return DEFAULT_CHARS_PER_TOKEN;
+  const id = modelId.toLowerCase();
+  if (KIRO_MODEL_PREFIXES.some(p => id.startsWith(p))) return KIRO_CHARS_PER_TOKEN;
+  return DEFAULT_CHARS_PER_TOKEN;
+}
+
+/**
+ * Estimate the token count of a text blob. Pure and deterministic.
+ * Returns 0 for empty/whitespace-free-empty input; otherwise ceil(length / ratio), min 1.
+ */
+export function estimateTokens(text: string, modelId?: string): number {
+  if (!text) return 0;
+  const len = text.length;
+  if (len === 0) return 0;
+  return Math.max(1, Math.ceil(len / charsPerToken(modelId)));
+}

package/src/oauth/anthropic.ts

@@ -128,7 +128,7 @@ export async function loginAnthropic(
       ctrl.onProgress?.("Found Claude Code token, importing automatically");
       if (local.expires >= Date.now() + 60_000) return local;
       try {
-        return await refreshAnthropicToken(local.refresh);
+        return { ...(await refreshAnthropicToken(local.refresh)), source: "local-cli" };
       } catch (error) {
         if (importLocal === "only") {
           throw new Error(`Claude Code token expired and could not be refreshed: ${error instanceof Error ? error.message : String(error)}`);

package/src/oauth/index.ts

@@ -6,10 +6,12 @@ import { getCredential, saveCredential } from "./store";
 import { loginXai, refreshXaiToken } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
+import { loginKiro, readKiroCliSqlite, refreshKiroToken } from "./kiro";
 import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 
 const REFRESH_SKEW_MS = 60_000;
+const tokenRefreshes = new Map<string, Promise<string>>();
 
 export interface LoginOpts { forceLogin?: boolean }
 
@@ -52,6 +54,12 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("kimi"),
     defaultModel: oauthDefaultModel("kimi"),
   },
+  kiro: {
+    login: (ctrl) => loginKiro(ctrl),
+    refresh: (rt, signal) => refreshKiroToken(rt, signal),
+    providerConfig: oauthConfig("kiro"),
+    defaultModel: oauthDefaultModel("kiro"),
+  },
   chatgpt: {
     login: loginChatGPT,
     refresh: (rt) => refreshChatGPTToken(rt),
@@ -90,9 +98,47 @@ export async function getValidAccessToken(provider: string): Promise<string> {
   const cred = getCredential(provider);
   if (!cred) throw new OAuthLoginRequiredError(provider);
   if (cred.expires > Date.now() + REFRESH_SKEW_MS) return cred.access;
-  const fresh = await def.refresh(cred.refresh);
-  saveCredential(provider, fresh);
-  return fresh.access;
+  const existing = tokenRefreshes.get(provider);
+  if (existing) return existing;
+  const refresh = refreshAndPersistAccessToken(provider, def, cred).finally(() => {
+    if (tokenRefreshes.get(provider) === refresh) tokenRefreshes.delete(provider);
+  });
+  tokenRefreshes.set(provider, refresh);
+  return refresh;
+}
+
+function readFreshKiroCliCredential(): OAuthCredentials | undefined {
+  const imported = readKiroCliSqlite();
+  if (!imported || imported.expires <= Date.now() + REFRESH_SKEW_MS) return undefined;
+  return { access: imported.access, refresh: imported.refresh, expires: imported.expires, source: "local-cli" };
+}
+
+async function refreshAndPersistAccessToken(
+  provider: string,
+  def: OAuthProviderDef,
+  cred: OAuthCredentials,
+): Promise<string> {
+  if (provider === "kiro") {
+    const imported = readFreshKiroCliCredential();
+    if (imported) {
+      saveCredential(provider, imported);
+      return imported.access;
+    }
+  }
+  try {
+    const fresh = await def.refresh(cred.refresh);
+    saveCredential(provider, { ...fresh, source: fresh.source ?? cred.source ?? "oauth" });
+    return fresh.access;
+  } catch (err) {
+    if (provider === "kiro") {
+      const imported = readFreshKiroCliCredential();
+      if (imported) {
+        saveCredential(provider, imported);
+        return imported.access;
+      }
+    }
+    throw err;
+  }
 }
 
 /**
@@ -205,7 +251,8 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
 export async function runLogin(provider: string, ctrl: OAuthController, opts?: LoginOpts): Promise<OAuthCredentials> {
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
-  const cred = await def.login(ctrl, opts);
+  const rawCred = await def.login(ctrl, opts);
+  const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
   saveCredential(provider, cred);
   const config = loadConfig();
   upsertOAuthProvider(config, provider);
@@ -221,10 +268,10 @@ export async function runLogin(provider: string, ctrl: OAuthController, opts?: L
 const loginState = new Map<string, { error?: string; done: boolean }>();
 const loginAbort = new Map<string, AbortController>();
 
-export function getLoginStatus(provider: string): { loggedIn: boolean; email?: string; error?: string; done: boolean } {
+export function getLoginStatus(provider: string): { loggedIn: boolean; email?: string; source?: OAuthCredentials["source"]; error?: string; done: boolean } {
   const cred = getCredential(provider);
   const st = loginState.get(provider);
-  return { loggedIn: !!cred, email: maskEmail(cred?.email) ?? undefined, error: st?.error, done: st?.done ?? false };
+  return { loggedIn: !!cred, email: maskEmail(cred?.email) ?? undefined, source: cred?.source, error: st?.error, done: st?.done ?? false };
 }
 
 export function clearLoginState(provider: string): void {

package/src/oauth/kiro-credentials.ts

@@ -0,0 +1,256 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { Database } from "bun:sqlite";
+
+const DEFAULT_EXPIRES_MS = 3600_000;
+const KIRO_REGION_PATTERN = /^[a-z]{2}(?:-[a-z]+)+-\d$/;
+const CLIENT_ID_HASH_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const TOKEN_KEYS = ["kirocli:social:token", "kirocli:odic:token", "codewhisperer:odic:token"];
+const REGISTRATION_KEYS = ["kirocli:odic:device-registration", "codewhisperer:odic:device-registration"];
+
+export type KiroAuthType = "kiro_desktop" | "aws_sso_oidc";
+export type KiroCredentialSource = "json" | "sqlite";
+export type KiroDiagnosticStatus =
+  | "missing"
+  | "unreadable"
+  | "schema_mismatch"
+  | "invalid_json"
+  | "token_missing"
+  | "token_found"
+  | "registration_found";
+
+export interface KiroImportDiagnostic {
+  location: "kiro-creds-file" | "kiro-cli-db-env" | "kiro-cli-data" | "kiro-cli-linux-data" | "amazon-q-data" | "kiro-sso-cache";
+  status: KiroDiagnosticStatus;
+}
+
+export interface ImportedKiroCredential {
+  access: string;
+  refresh: string;
+  expires: number;
+  source: KiroCredentialSource;
+  authType: KiroAuthType;
+  profileArn?: string;
+  ssoRegion?: string;
+  apiRegion?: string;
+  clientId?: string;
+  clientSecret?: string;
+}
+
+type JsonObject = Record<string, unknown>;
+
+function userHome(): string {
+  return process.env.HOME || homedir();
+}
+
+function expandPath(path: string): string {
+  if (path.startsWith("~/")) return join(userHome(), path.slice(2));
+  return isAbsolute(path) ? path : join(process.cwd(), path);
+}
+
+function stringField(data: JsonObject, ...keys: string[]): string | undefined {
+  for (const key of keys) {
+    const value = data[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return undefined;
+}
+
+function parseExpires(value: unknown): number {
+  if (typeof value === "number" && Number.isFinite(value)) return value < 10_000_000_000 ? value * 1000 : value;
+  if (typeof value === "string" && value.length > 0) {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return Date.now() + DEFAULT_EXPIRES_MS;
+}
+
+export function inferRegionFromProfileArn(arn: string | undefined): string | undefined {
+  if (!arn) return undefined;
+  const region = arn.split(":")[3];
+  return normalizeKiroRegion(region);
+}
+
+export function normalizeKiroRegion(region: string | undefined): string | undefined {
+  const trimmed = region?.trim();
+  return trimmed && KIRO_REGION_PATTERN.test(trimmed) ? trimmed : undefined;
+}
+
+export function requireKiroRegion(region: string | undefined): string {
+  const normalized = normalizeKiroRegion(region);
+  if (!normalized) throw new Error("Kiro: invalid region value.");
+  return normalized;
+}
+
+function jsonCredentialPaths(): string[] {
+  return [process.env.KIRO_CREDS_FILE, process.env.KIRO_CREDENTIALS_FILE]
+    .filter((value): value is string => !!value)
+    .map(expandPath);
+}
+
+function sqliteEntries(): Array<{ location: KiroImportDiagnostic["location"]; path: string }> {
+  const home = userHome();
+  const entries: Array<{ location: KiroImportDiagnostic["location"]; path: string }> = [];
+  if (process.env.KIRO_CLI_DB_FILE) entries.push({ location: "kiro-cli-db-env", path: expandPath(process.env.KIRO_CLI_DB_FILE) });
+  entries.push(
+    { location: "kiro-cli-data", path: join(home, "Library", "Application Support", "kiro-cli", "data.sqlite3") },
+    { location: "kiro-cli-linux-data", path: join(home, ".local", "share", "kiro-cli", "data.sqlite3") },
+    { location: "amazon-q-data", path: join(home, ".local", "share", "amazon-q", "data.sqlite3") },
+    { location: "kiro-sso-cache", path: join(home, ".kiro", "sso", "cache.db") },
+  );
+  return entries;
+}
+
+function credentialFromJson(data: JsonObject, source: KiroCredentialSource): ImportedKiroCredential | undefined {
+  const access = stringField(data, "accessToken", "access_token");
+  if (!access) return undefined;
+  const profileArn = stringField(data, "profileArn", "profile_arn");
+  const ssoRegion = stringField(data, "region");
+  const apiRegion = stringField(data, "apiRegion", "api_region") || inferRegionFromProfileArn(profileArn) || ssoRegion;
+  const clientId = stringField(data, "clientId", "client_id");
+  const clientSecret = stringField(data, "clientSecret", "client_secret");
+  return {
+    access,
+    refresh: stringField(data, "refreshToken", "refresh_token") || "",
+    expires: parseExpires(data.expiresAt ?? data.expires_at),
+    source,
+    authType: clientId && clientSecret ? "aws_sso_oidc" : "kiro_desktop",
+    ...(profileArn ? { profileArn } : {}),
+    ...(ssoRegion ? { ssoRegion } : {}),
+    ...(apiRegion ? { apiRegion } : {}),
+    ...(clientId ? { clientId } : {}),
+    ...(clientSecret ? { clientSecret } : {}),
+  };
+}
+
+function loadEnterpriseRegistration(data: JsonObject): JsonObject | undefined {
+  const hash = stringField(data, "clientIdHash");
+  if (!hash) return undefined;
+  if (!CLIENT_ID_HASH_PATTERN.test(hash)) return undefined;
+  const path = join(userHome(), ".aws", "sso", "cache", `${hash}.json`);
+  if (!existsSync(path)) return undefined;
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as JsonObject;
+  } catch {
+    return undefined;
+  }
+}
+
+function readJsonCredentials(diagnostics: KiroImportDiagnostic[]): ImportedKiroCredential | undefined {
+  for (const path of jsonCredentialPaths()) {
+    if (!existsSync(path)) {
+      diagnostics.push({ location: "kiro-creds-file", status: "missing" });
+      continue;
+    }
+    let data: JsonObject;
+    try {
+      const raw = readFileSync(path, "utf8");
+      try {
+        data = JSON.parse(raw) as JsonObject;
+      } catch {
+        diagnostics.push({ location: "kiro-creds-file", status: "invalid_json" });
+        continue;
+      }
+    } catch {
+      diagnostics.push({ location: "kiro-creds-file", status: "unreadable" });
+      continue;
+    }
+    const registration = loadEnterpriseRegistration(data);
+    const merged = registration ? { ...data, ...registration } : data;
+    const credential = credentialFromJson(merged, "json");
+    diagnostics.push({ location: "kiro-creds-file", status: credential ? "token_found" : "token_missing" });
+    if (credential) return credential;
+  }
+  return undefined;
+}
+
+function readStateProfile(db: Database): { profileArn?: string; apiRegion?: string } {
+  try {
+    const row = db.query("SELECT value FROM state WHERE key = ?").get("api.codewhisperer.profile") as { value: string } | null;
+    if (!row) return {};
+    const data = JSON.parse(row.value) as JsonObject;
+    const profileArn = stringField(data, "arn", "profileArn", "profile_arn");
+    return { ...(profileArn ? { profileArn } : {}), ...(profileArn ? { apiRegion: inferRegionFromProfileArn(profileArn) } : {}) };
+  } catch {
+    return {};
+  }
+}
+
+function readSqliteCredentials(diagnostics: KiroImportDiagnostic[]): ImportedKiroCredential | undefined {
+  for (const { location, path } of sqliteEntries()) {
+    if (!existsSync(path)) {
+      diagnostics.push({ location, status: "missing" });
+      continue;
+    }
+    let db: Database | undefined;
+    try {
+      db = new Database(path, { readonly: true });
+      try { db.exec("PRAGMA busy_timeout = 5000"); } catch { /* read-only best effort */ }
+    } catch {
+      diagnostics.push({ location, status: "unreadable" });
+      continue;
+    }
+    try {
+      let tokenData: JsonObject | undefined;
+      for (const key of TOKEN_KEYS) {
+        const row = db.query("SELECT value FROM auth_kv WHERE key = ?").get(key) as { value: string } | null;
+        if (!row) continue;
+        try {
+          tokenData = JSON.parse(row.value) as JsonObject;
+        } catch {
+          diagnostics.push({ location, status: "invalid_json" });
+          continue;
+        }
+        if (stringField(tokenData, "access_token", "accessToken")) break;
+      }
+      if (!tokenData) {
+        diagnostics.push({ location, status: "token_missing" });
+        continue;
+      }
+      let registrationData: JsonObject = {};
+      for (const key of REGISTRATION_KEYS) {
+        const row = db.query("SELECT value FROM auth_kv WHERE key = ?").get(key) as { value: string } | null;
+        if (!row) continue;
+        try {
+          registrationData = JSON.parse(row.value) as JsonObject;
+          diagnostics.push({ location, status: "registration_found" });
+        } catch {
+          diagnostics.push({ location, status: "invalid_json" });
+        }
+        break;
+      }
+      const profile = readStateProfile(db);
+      const merged = { ...registrationData, ...tokenData, ...profile };
+      const credential = credentialFromJson(merged, "sqlite");
+      diagnostics.push({ location, status: credential ? "token_found" : "token_missing" });
+      if (credential) return credential;
+    } catch {
+      diagnostics.push({ location, status: "schema_mismatch" });
+    } finally {
+      db.close();
+    }
+  }
+  return undefined;
+}
+
+export function inspectKiroCredentialSources(): { credential: ImportedKiroCredential | null; diagnostics: KiroImportDiagnostic[] } {
+  const diagnostics: KiroImportDiagnostic[] = [];
+  const json = readJsonCredentials(diagnostics);
+  if (json) return { credential: json, diagnostics };
+  const sqlite = readSqliteCredentials(diagnostics);
+  return { credential: sqlite ?? null, diagnostics };
+}
+
+export function inspectKiroCliSqliteSources(): { credential: ImportedKiroCredential | null; diagnostics: KiroImportDiagnostic[] } {
+  const diagnostics: KiroImportDiagnostic[] = [];
+  return { credential: readSqliteCredentials(diagnostics) ?? null, diagnostics };
+}
+
+export function readImportedKiroCredential(): ImportedKiroCredential | null {
+  return inspectKiroCredentialSources().credential;
+}
+
+export function readKiroCliSqliteCredential(): ImportedKiroCredential | null {
+  return inspectKiroCliSqliteSources().credential;
+}