@bogyie/opencode-kiro-plugin 0.2.11 → 0.2.13

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, choose the `Kiro CLI login` auth method in OpenCode. The plugin starts `kiro-cli login --use-device-flow`, opens the browser through the official CLI login flow, and waits until `kiro-cli whoami` succeeds.
+When no usable Kiro CLI session is available, open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The plugin starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. The same auth method also works from OpenCode's CLI provider connect flow.
 
-Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+The plugin does not start login during OpenCode startup or as a side effect of a model request. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If no credential is available, requests fail with `KIRO_AUTH_ERROR` and you can connect from OpenCode's provider connector or run `kiro-cli login` manually. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 

package/dist/auth.d.ts

@@ -32,7 +32,9 @@ export interface KiroCliSessionCredentialOptions {
 }
 export interface KiroLoginSession {
     readonly url: string;
+    readonly code: string | undefined;
     readonly instructions: string;
+    waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
@@ -42,7 +44,9 @@ export declare function runCommand(command: string, args: ReadonlyArray<string>,
 export declare function regionFromProfileArn(profileArn: string | undefined): string | undefined;
 export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
+export declare function extractKiroLoginCode(output: string): string | undefined;
 export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
+export declare function startKiroCliLoginOnce(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function redacted(value: string | undefined): string | undefined;
 export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunner): Promise<AuthDiagnostics>;
 export declare function resolveApiKey(auth: () => Promise<{

package/dist/auth.js

@@ -8,6 +8,9 @@ const execFileAsync = promisify(execFile);
 export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export const DEFAULT_KIRO_CLI_DB_PATH = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
 export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer:odic:token"];
+const LOGIN_REUSE_WINDOW_MS = 2 * 60 * 1000;
+let sharedLoginSession;
+let sharedLoginStartedAt = 0;
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -98,6 +101,9 @@ function firstUrl(text) {
 export function extractKiroLoginUrl(output) {
     return firstUrl(output) ?? KIRO_LOGIN_URL;
 }
+export function extractKiroLoginCode(output) {
+    return /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
+}
 export function startKiroCliLogin(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
     const child = spawner("kiro-cli", ["login", "--use-device-flow"]);
     let output = "";
@@ -117,15 +123,25 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
         get url() {
             return extractKiroLoginUrl(output);
         },
+        get code() {
+            return extractKiroLoginCode(output);
+        },
         get instructions() {
-            const url = extractKiroLoginUrl(output);
-            const code = /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
-            return [
-                "Complete Kiro CLI login in the browser.",
-                `URL: ${url}`,
-                ...(code ? [`Code: ${code}`] : []),
-                "The plugin will continue after `kiro-cli whoami` succeeds.",
-            ].join("\n");
+            const code = extractKiroLoginCode(output);
+            return code ? `Enter code: ${code}` : "Complete Kiro CLI login in your browser. This window will close automatically.";
+        },
+        async waitForPrompt(timeoutMs = 15_000) {
+            const deadline = Date.now() + timeoutMs;
+            while (Date.now() < deadline) {
+                if (extractKiroLoginCode(output))
+                    return true;
+                if (firstUrl(output))
+                    return true;
+                if (exited && exitCode !== 0)
+                    return false;
+                await delay(100);
+            }
+            return Boolean(extractKiroLoginCode(output) || firstUrl(output));
         },
         async waitForAuth(runner = runCommand) {
             const deadline = Date.now() + 10 * 60 * 1000;
@@ -141,6 +157,40 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
         },
     };
 }
+export function startKiroCliLoginOnce(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
+    const now = Date.now();
+    if (sharedLoginSession && now - sharedLoginStartedAt < LOGIN_REUSE_WINDOW_MS)
+        return sharedLoginSession;
+    const session = startKiroCliLogin(spawner);
+    const wrapped = {
+        get url() {
+            return session.url;
+        },
+        get code() {
+            return session.code;
+        },
+        get instructions() {
+            return session.instructions;
+        },
+        waitForPrompt(timeoutMs) {
+            return session.waitForPrompt(timeoutMs);
+        },
+        async waitForAuth(runner) {
+            try {
+                return await session.waitForAuth(runner);
+            }
+            finally {
+                if (sharedLoginSession === wrapped) {
+                    sharedLoginSession = undefined;
+                    sharedLoginStartedAt = 0;
+                }
+            }
+        },
+    };
+    sharedLoginSession = wrapped;
+    sharedLoginStartedAt = now;
+    return wrapped;
+}
 export function redacted(value) {
     if (!value)
         return undefined;

package/dist/cli-transport.d.ts

@@ -6,7 +6,6 @@ import { type ChildProcess } from "node:child_process";
 export interface CliChatTransportOptions {
     readonly runner?: CommandRunner;
     readonly spawner?: CliChatSpawner;
-    readonly loginStarter?: () => void;
     readonly trustAllTools?: boolean;
     readonly requestTimeoutMs?: number;
 }

package/dist/cli-transport.js

@@ -1,14 +1,6 @@
-import { runCommand, startKiroCliLogin } from "./auth.js";
+import { runCommand } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
 import { spawn } from "node:child_process";
-let lastLoginStartAt = 0;
-function startKiroCliLoginOnce() {
-    const now = Date.now();
-    if (now - lastLoginStartAt < 30_000)
-        return;
-    lastLoginStartAt = now;
-    startKiroCliLogin();
-}
 export function promptForCli(request) {
     const parts = [
         request.system ? `System:\n${request.system}` : "",
@@ -92,32 +84,20 @@ class AsyncQueue {
 export class KiroCliChatTransport {
     #runner;
     #spawner;
-    #loginStarter;
     #trustAllTools;
     #requestTimeoutMs;
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
         this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
-        this.#loginStarter = options.loginStarter ?? startKiroCliLoginOnce;
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
-    #startLoginAfterAuthFailure() {
-        try {
-            this.#loginStarter();
-        }
-        catch {
-            // Preserve the original auth error. Login launch failures are diagnostic-only here.
-        }
-    }
     async generate(request) {
         const result = await this.#runner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }), {
             timeoutMs: this.#requestTimeoutMs,
         });
         if (!result.ok) {
             const authError = result.stderr.toLowerCase().includes("not logged in");
-            if (authError)
-                this.#startLoginAfterAuthFailure();
             throw new KiroPluginError(result.stderr.trim() || "kiro-cli chat failed", authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502);
         }
         const text = sanitizeCliChatOutput(result.stdout);
@@ -169,8 +149,6 @@ export class KiroCliChatTransport {
                 return;
             }
             const authError = stderr.toLowerCase().includes("not logged in");
-            if (authError)
-                this.#startLoginAfterAuthFailure();
             queue.fail(new KiroPluginError(stderr.trim() || `kiro-cli chat exited${code === null ? "" : ` with code ${code}`}${signal ? ` and signal ${signal}` : ""}`, authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502));
         });
         try {

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/index.js

@@ -2,7 +2,7 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/kiro-rest-transport.js

@@ -322,7 +322,7 @@ export class KiroRestTransport {
         const session = this.#options.accessToken ? undefined : await this.#credentialProvider();
         const accessToken = this.#options.accessToken ?? session?.accessToken;
         if (!accessToken) {
-            throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Run Kiro login and try again.", "KIRO_AUTH_ERROR", 401);
+            throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Connect Kiro from OpenCode's provider connector or run `kiro-cli login`.", "KIRO_AUTH_ERROR", 401);
         }
         const profileArn = this.#options.profileArn ?? session?.profileArn;
         return {

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey, startKiroCliLogin } from "./auth.js";
+import { detectAuth, resolveApiKey, startKiroCliLoginOnce } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -170,14 +170,26 @@ export function createKiroPlugin() {
                         type: "oauth",
                         label: "Kiro CLI login",
                         authorize: async () => {
-                            const session = startKiroCliLogin();
+                            const session = startKiroCliLoginOnce();
+                            await session.waitForPrompt();
                             return {
                                 url: session.url,
                                 instructions: session.instructions,
                                 method: "auto",
                                 callback: async () => {
                                     const authenticated = await session.waitForAuth();
-                                    return authenticated ? { type: "success", key: "kiro-plugin-local-transport" } : { type: "failed" };
+                                    if (!authenticated)
+                                        return { type: "failed" };
+                                    const diagnostics = await detectAuth().catch(() => undefined);
+                                    return {
+                                        type: "success",
+                                        key: "kiro-plugin-local-transport",
+                                        metadata: {
+                                            source: "kiro-cli",
+                                            ...(diagnostics?.account ? { account: diagnostics.account } : {}),
+                                            ...(diagnostics?.region ? { region: diagnostics.region } : {}),
+                                        },
+                                    };
                                 },
                             };
                         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",