@bogyie/opencode-kiro-plugin 0.2.12 → 0.2.14

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, choose the `Kiro CLI login` auth method in OpenCode. The plugin starts `kiro-cli login --use-device-flow`, opens the browser through the official CLI login flow, and waits until `kiro-cli whoami` succeeds.
+When no usable Kiro CLI session is available, open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The plugin starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. The same auth method also works from OpenCode's CLI provider connect flow.
 
-Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+The plugin does not start login during OpenCode startup. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If a model request fails because credentials are missing or rejected, the plugin starts one shared Kiro CLI login session and still returns `KIRO_AUTH_ERROR` for that failed request; retry after the login completes. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and applies the same login-on-auth-failure behavior. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 

package/dist/auth.d.ts

@@ -32,7 +32,9 @@ export interface KiroCliSessionCredentialOptions {
 }
 export interface KiroLoginSession {
     readonly url: string;
+    readonly code: string | undefined;
     readonly instructions: string;
+    waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
@@ -42,6 +44,7 @@ export declare function runCommand(command: string, args: ReadonlyArray<string>,
 export declare function regionFromProfileArn(profileArn: string | undefined): string | undefined;
 export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
+export declare function extractKiroLoginCode(output: string): string | undefined;
 export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function startKiroCliLoginOnce(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function redacted(value: string | undefined): string | undefined;

package/dist/auth.js

@@ -101,6 +101,9 @@ function firstUrl(text) {
 export function extractKiroLoginUrl(output) {
     return firstUrl(output) ?? KIRO_LOGIN_URL;
 }
+export function extractKiroLoginCode(output) {
+    return /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
+}
 export function startKiroCliLogin(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
     const child = spawner("kiro-cli", ["login", "--use-device-flow"]);
     let output = "";
@@ -120,15 +123,25 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
         get url() {
             return extractKiroLoginUrl(output);
         },
+        get code() {
+            return extractKiroLoginCode(output);
+        },
         get instructions() {
-            const url = extractKiroLoginUrl(output);
-            const code = /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
-            return [
-                "Complete Kiro CLI login in the browser.",
-                `URL: ${url}`,
-                ...(code ? [`Code: ${code}`] : []),
-                "The plugin will continue after `kiro-cli whoami` succeeds.",
-            ].join("\n");
+            const code = extractKiroLoginCode(output);
+            return code ? `Enter code: ${code}` : "Complete Kiro CLI login in your browser. This window will close automatically.";
+        },
+        async waitForPrompt(timeoutMs = 15_000) {
+            const deadline = Date.now() + timeoutMs;
+            while (Date.now() < deadline) {
+                if (extractKiroLoginCode(output))
+                    return true;
+                if (firstUrl(output))
+                    return true;
+                if (exited && exitCode !== 0)
+                    return false;
+                await delay(100);
+            }
+            return Boolean(extractKiroLoginCode(output) || firstUrl(output));
         },
         async waitForAuth(runner = runCommand) {
             const deadline = Date.now() + 10 * 60 * 1000;
@@ -153,9 +166,15 @@ export function startKiroCliLoginOnce(spawner = (command, args) => spawn(command
         get url() {
             return session.url;
         },
+        get code() {
+            return session.code;
+        },
         get instructions() {
             return session.instructions;
         },
+        waitForPrompt(timeoutMs) {
+            return session.waitForPrompt(timeoutMs);
+        },
         async waitForAuth(runner) {
             try {
                 return await session.waitForAuth(runner);

package/dist/cli-transport.js

@@ -1,14 +1,6 @@
-import { runCommand, startKiroCliLoginOnce as startSharedKiroCliLoginOnce } from "./auth.js";
+import { runCommand, startKiroCliLoginOnce } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
 import { spawn } from "node:child_process";
-let lastLoginStartAt = 0;
-function startKiroCliLoginOnce() {
-    const now = Date.now();
-    if (now - lastLoginStartAt < 30_000)
-        return;
-    lastLoginStartAt = now;
-    startSharedKiroCliLoginOnce();
-}
 export function promptForCli(request) {
     const parts = [
         request.system ? `System:\n${request.system}` : "",
@@ -98,7 +90,9 @@ export class KiroCliChatTransport {
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
         this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
-        this.#loginStarter = options.loginStarter ?? startKiroCliLoginOnce;
+        this.#loginStarter = options.loginStarter ?? (() => {
+            startKiroCliLoginOnce();
+        });
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
@@ -107,7 +101,7 @@ export class KiroCliChatTransport {
             this.#loginStarter();
         }
         catch {
-            // Preserve the original auth error. Login launch failures are diagnostic-only here.
+            // Keep the original model-call auth error visible to OpenCode.
         }
     }
     async generate(request) {

package/dist/kiro-rest-transport.d.ts

@@ -17,6 +17,7 @@ export type KiroRestFetch = (input: RequestInfo | URL, init?: RequestInit) => Pr
 export interface KiroRestTransportDependencies {
     readonly fetcher?: KiroRestFetch;
     readonly credentialProvider?: KiroCredentialProvider;
+    readonly loginStarter?: () => void;
 }
 export declare function toKiroRestPayload(request: KiroGenerateRequest, profileArn?: string): Record<string, unknown>;
 export declare class KiroRestTransport implements KiroTransport {

package/dist/kiro-rest-transport.js

@@ -1,5 +1,5 @@
 import { KiroPluginError } from "./errors.js";
-import { readKiroCliSessionCredential, regionFromProfileArn, } from "./auth.js";
+import { readKiroCliSessionCredential, regionFromProfileArn, startKiroCliLoginOnce, } from "./auth.js";
 const DEFAULT_USER_AGENT = "KiroIDE";
 const DEFAULT_AGENT_MODE = "vibe";
 const STREAMING_SDK_VERSION = "1.0.34";
@@ -313,16 +313,29 @@ export class KiroRestTransport {
     #options;
     #fetcher;
     #credentialProvider;
+    #loginStarter;
     constructor(options, dependencies = {}) {
         this.#options = options;
         this.#fetcher = dependencies.fetcher ?? fetch;
         this.#credentialProvider = dependencies.credentialProvider ?? (() => readKiroCliSessionCredential());
+        this.#loginStarter = dependencies.loginStarter ?? (() => {
+            startKiroCliLoginOnce();
+        });
+    }
+    #startLoginAfterAuthFailure() {
+        try {
+            this.#loginStarter();
+        }
+        catch {
+            // Keep the original model-call auth error visible to OpenCode.
+        }
     }
     async #credentials() {
         const session = this.#options.accessToken ? undefined : await this.#credentialProvider();
         const accessToken = this.#options.accessToken ?? session?.accessToken;
         if (!accessToken) {
-            throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Run Kiro login and try again.", "KIRO_AUTH_ERROR", 401);
+            this.#startLoginAfterAuthFailure();
+            throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Connect Kiro from OpenCode's provider connector or run `kiro-cli login`.", "KIRO_AUTH_ERROR", 401);
         }
         const profileArn = this.#options.profileArn ?? session?.profileArn;
         return {
@@ -355,6 +368,8 @@ export class KiroRestTransport {
                 lastError = new KiroPluginError(message, code, response.status);
                 if (response.status === 429 || response.status >= 500)
                     continue;
+                if (code === "KIRO_AUTH_ERROR")
+                    this.#startLoginAfterAuthFailure();
                 throw lastError;
             }
             if (!response.body)

package/dist/plugin.js

@@ -171,13 +171,25 @@ export function createKiroPlugin() {
                         label: "Kiro CLI login",
                         authorize: async () => {
                             const session = startKiroCliLoginOnce();
+                            await session.waitForPrompt();
                             return {
                                 url: session.url,
                                 instructions: session.instructions,
                                 method: "auto",
                                 callback: async () => {
                                     const authenticated = await session.waitForAuth();
-                                    return authenticated ? { type: "success", key: "kiro-plugin-local-transport" } : { type: "failed" };
+                                    if (!authenticated)
+                                        return { type: "failed" };
+                                    const diagnostics = await detectAuth().catch(() => undefined);
+                                    return {
+                                        type: "success",
+                                        key: "kiro-plugin-local-transport",
+                                        metadata: {
+                                            source: "kiro-cli",
+                                            ...(diagnostics?.account ? { account: diagnostics.account } : {}),
+                                            ...(diagnostics?.region ? { region: diagnostics.region } : {}),
+                                        },
+                                    };
                                 },
                             };
                         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",