@bogyie/opencode-kiro-plugin 0.2.13 → 0.3.0

package/README.md

@@ -40,7 +40,7 @@ The plugin resolves credentials in this order:
 
 When no usable Kiro CLI session is available, open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The plugin starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. The same auth method also works from OpenCode's CLI provider connect flow.
 
-The plugin does not start login during OpenCode startup or as a side effect of a model request. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If no credential is available, requests fail with `KIRO_AUTH_ERROR` and you can connect from OpenCode's provider connector or run `kiro-cli login` manually. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+The plugin does not start login during OpenCode startup. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If a model request fails because credentials are missing or rejected, the plugin starts one shared Kiro CLI login session and still returns `KIRO_AUTH_ERROR` for that failed request; retry after the login completes. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and applies the same login-on-auth-failure behavior. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 

package/dist/cli-transport.d.ts

@@ -6,6 +6,7 @@ import { type ChildProcess } from "node:child_process";
 export interface CliChatTransportOptions {
     readonly runner?: CommandRunner;
     readonly spawner?: CliChatSpawner;
+    readonly loginStarter?: () => void;
     readonly trustAllTools?: boolean;
     readonly requestTimeoutMs?: number;
 }

package/dist/cli-transport.js

@@ -1,4 +1,4 @@
-import { runCommand } from "./auth.js";
+import { runCommand, startKiroCliLoginOnce } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
 import { spawn } from "node:child_process";
 export function promptForCli(request) {
@@ -84,20 +84,34 @@ class AsyncQueue {
 export class KiroCliChatTransport {
     #runner;
     #spawner;
+    #loginStarter;
     #trustAllTools;
     #requestTimeoutMs;
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
         this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
+        this.#loginStarter = options.loginStarter ?? (() => {
+            startKiroCliLoginOnce();
+        });
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
+    #startLoginAfterAuthFailure() {
+        try {
+            this.#loginStarter();
+        }
+        catch {
+            // Keep the original model-call auth error visible to OpenCode.
+        }
+    }
     async generate(request) {
         const result = await this.#runner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }), {
             timeoutMs: this.#requestTimeoutMs,
         });
         if (!result.ok) {
             const authError = result.stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
             throw new KiroPluginError(result.stderr.trim() || "kiro-cli chat failed", authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502);
         }
         const text = sanitizeCliChatOutput(result.stdout);
@@ -149,6 +163,8 @@ export class KiroCliChatTransport {
                 return;
             }
             const authError = stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
             queue.fail(new KiroPluginError(stderr.trim() || `kiro-cli chat exited${code === null ? "" : ` with code ${code}`}${signal ? ` and signal ${signal}` : ""}`, authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502));
         });
         try {

package/dist/kiro-rest-transport.d.ts

@@ -17,6 +17,7 @@ export type KiroRestFetch = (input: RequestInfo | URL, init?: RequestInit) => Pr
 export interface KiroRestTransportDependencies {
     readonly fetcher?: KiroRestFetch;
     readonly credentialProvider?: KiroCredentialProvider;
+    readonly loginStarter?: () => void;
 }
 export declare function toKiroRestPayload(request: KiroGenerateRequest, profileArn?: string): Record<string, unknown>;
 export declare class KiroRestTransport implements KiroTransport {

package/dist/kiro-rest-transport.js

@@ -1,5 +1,5 @@
 import { KiroPluginError } from "./errors.js";
-import { readKiroCliSessionCredential, regionFromProfileArn, } from "./auth.js";
+import { readKiroCliSessionCredential, regionFromProfileArn, startKiroCliLoginOnce, } from "./auth.js";
 const DEFAULT_USER_AGENT = "KiroIDE";
 const DEFAULT_AGENT_MODE = "vibe";
 const STREAMING_SDK_VERSION = "1.0.34";
@@ -313,15 +313,28 @@ export class KiroRestTransport {
     #options;
     #fetcher;
     #credentialProvider;
+    #loginStarter;
     constructor(options, dependencies = {}) {
         this.#options = options;
         this.#fetcher = dependencies.fetcher ?? fetch;
         this.#credentialProvider = dependencies.credentialProvider ?? (() => readKiroCliSessionCredential());
+        this.#loginStarter = dependencies.loginStarter ?? (() => {
+            startKiroCliLoginOnce();
+        });
+    }
+    #startLoginAfterAuthFailure() {
+        try {
+            this.#loginStarter();
+        }
+        catch {
+            // Keep the original model-call auth error visible to OpenCode.
+        }
     }
     async #credentials() {
         const session = this.#options.accessToken ? undefined : await this.#credentialProvider();
         const accessToken = this.#options.accessToken ?? session?.accessToken;
         if (!accessToken) {
+            this.#startLoginAfterAuthFailure();
             throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Connect Kiro from OpenCode's provider connector or run `kiro-cli login`.", "KIRO_AUTH_ERROR", 401);
         }
         const profileArn = this.#options.profileArn ?? session?.profileArn;
@@ -355,6 +368,8 @@ export class KiroRestTransport {
                 lastError = new KiroPluginError(message, code, response.status);
                 if (response.status === 429 || response.status >= 500)
                     continue;
+                if (code === "KIRO_AUTH_ERROR")
+                    this.#startLoginAfterAuthFailure();
                 throw lastError;
             }
             if (!response.body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.13",
+  "version": "0.3.0",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",