@bogyie/opencode-kiro-plugin 0.2.6 → 0.2.8

package/README.md

@@ -37,7 +37,9 @@ The plugin resolves credentials in this order:
 2. OpenCode auth input for provider `kiro`
 3. `kiro-cli whoami` diagnostics for CLI session visibility
 
-Direct fetch mode requires an API key/token usable by the Kiro/CodeWhisperer client. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state.
+When no usable Kiro CLI session is available, choose the `Kiro CLI login` auth method in OpenCode. The plugin starts `kiro-cli login --use-device-flow`, opens the browser through the official CLI login flow, and waits until `kiro-cli whoami` succeeds.
+
+Direct fetch mode requires an API key/token usable by the Kiro/CodeWhisperer client. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -65,9 +67,9 @@ Configure the backend through plugin options:
 
 Supported values:
 
-- `auto`: use CodeWhisperer fetch transport when an API key is available; otherwise use CLI chat fallback.
+- `auto`: use CodeWhisperer fetch transport when an API key is available; otherwise use streaming `cli-chat` with the local Kiro CLI login.
 - `fetch`: require the direct Kiro/CodeWhisperer fetch path. If no usable auth is available, requests fail with a structured backend/auth error.
-- `cli-chat`: call `kiro-cli chat --no-interactive --model <model>`. This is official and stable, and uses the model selected in OpenCode.
+- `cli-chat`: spawn `kiro-cli chat --no-interactive --model <model>` and stream stdout chunks as they arrive. Chunk granularity is controlled by Kiro CLI.
 - `acp`: launch `kiro-cli acp`, initialize a session, optionally set the requested model, send the prompt, and collect `AgentMessageChunk` notifications until `TurnEnd`.
 
 `trustAllTools` affects both `cli-chat` and ACP permission handling. In ACP mode, permission requests are rejected by default and allowed only when `trustAllTools: true`.

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type ChildProcess } from "node:child_process";
 export type AuthMethod = "api-key" | "cli-session" | "none";
 export interface AuthDiagnostics {
     readonly authenticated: boolean;
@@ -16,7 +17,16 @@ export interface CommandRunOptions {
     readonly timeoutMs?: number;
 }
 export type CommandRunner = (command: string, args: ReadonlyArray<string>, options?: CommandRunOptions) => Promise<CommandResult>;
+export type ProcessSpawner = (command: string, args: ReadonlyArray<string>) => ChildProcess;
+export interface KiroLoginSession {
+    readonly url: string;
+    readonly instructions: string;
+    waitForAuth(runner?: CommandRunner): Promise<boolean>;
+}
+export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;
+export declare function extractKiroLoginUrl(output: string): string;
+export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function redacted(value: string | undefined): string | undefined;
 export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunner): Promise<AuthDiagnostics>;
 export declare function resolveApiKey(auth: () => Promise<{

package/dist/auth.js

@@ -1,6 +1,8 @@
 import { execFile } from "node:child_process";
+import { spawn } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -16,6 +18,58 @@ export async function runCommand(command, args, options = {}) {
         };
     }
 }
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function firstUrl(text) {
+    return /https?:\/\/[^\s"'<>]+/.exec(text)?.[0];
+}
+export function extractKiroLoginUrl(output) {
+    return firstUrl(output) ?? KIRO_LOGIN_URL;
+}
+export function startKiroCliLogin(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
+    const child = spawner("kiro-cli", ["login", "--use-device-flow"]);
+    let output = "";
+    let exited = false;
+    let exitCode = null;
+    child.stdout?.on("data", (chunk) => {
+        output += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+        output += chunk.toString("utf8");
+    });
+    child.on("exit", (code) => {
+        exited = true;
+        exitCode = code;
+    });
+    return {
+        get url() {
+            return extractKiroLoginUrl(output);
+        },
+        get instructions() {
+            const url = extractKiroLoginUrl(output);
+            const code = /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
+            return [
+                "Complete Kiro CLI login in the browser.",
+                `URL: ${url}`,
+                ...(code ? [`Code: ${code}`] : []),
+                "The plugin will continue after `kiro-cli whoami` succeeds.",
+            ].join("\n");
+        },
+        async waitForAuth(runner = runCommand) {
+            const deadline = Date.now() + 10 * 60 * 1000;
+            while (Date.now() < deadline) {
+                const auth = await detectAuth(process.env, runner);
+                if (auth.authenticated)
+                    return true;
+                if (exited && exitCode !== 0)
+                    return false;
+                await delay(2000);
+            }
+            return false;
+        },
+    };
+}
 export function redacted(value) {
     if (!value)
         return undefined;

package/dist/cli-transport.d.ts

@@ -1,17 +1,23 @@
 import type { CommandRunner } from "./auth.js";
 import type { KiroTransport } from "./fetch-adapter.js";
 import type { KiroGenerateRequest } from "./request-adapter.js";
-import type { KiroGenerateResponse } from "./response-adapter.js";
+import type { KiroGenerateResponse, KiroStreamEvent } from "./response-adapter.js";
+import { type ChildProcess } from "node:child_process";
 export interface CliChatTransportOptions {
     readonly runner?: CommandRunner;
+    readonly spawner?: CliChatSpawner;
+    readonly loginStarter?: () => void;
     readonly trustAllTools?: boolean;
     readonly requestTimeoutMs?: number;
 }
+export type CliChatSpawner = (command: string, args: ReadonlyArray<string>) => ChildProcess;
 export declare function promptForCli(request: KiroGenerateRequest): string;
 export declare function cliChatArgs(request: KiroGenerateRequest, options?: Pick<CliChatTransportOptions, "trustAllTools">): string[];
 export declare function sanitizeCliChatOutput(output: string): string;
+export declare function sanitizeCliChatStreamingOutput(output: string): string;
 export declare class KiroCliChatTransport implements KiroTransport {
     #private;
     constructor(options?: CliChatTransportOptions);
     generate(request: KiroGenerateRequest): Promise<KiroGenerateResponse>;
+    stream(request: KiroGenerateRequest): AsyncIterable<KiroStreamEvent>;
 }

package/dist/cli-transport.js

@@ -1,5 +1,14 @@
-import { runCommand } from "./auth.js";
+import { runCommand, startKiroCliLogin } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
+import { spawn } from "node:child_process";
+let lastLoginStartAt = 0;
+function startKiroCliLoginOnce() {
+    const now = Date.now();
+    if (now - lastLoginStartAt < 30_000)
+        return;
+    lastLoginStartAt = now;
+    startKiroCliLogin();
+}
 export function promptForCli(request) {
     const parts = [
         request.system ? `System:\n${request.system}` : "",
@@ -29,21 +38,86 @@ export function sanitizeCliChatOutput(output) {
     }
     return lines.join("\n").trim();
 }
+export function sanitizeCliChatStreamingOutput(output) {
+    const text = output.replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "").replace(/\r/g, "");
+    const lines = text
+        .split("\n")
+        .filter((line) => !line.includes("Credits:"));
+    if (lines[0]?.trimStart().startsWith(">")) {
+        lines[0] = lines[0].replace(/^\s*>\s*/, "");
+    }
+    return lines.join("\n");
+}
+class AsyncQueue {
+    #values = [];
+    #waiting = [];
+    #closed = false;
+    #error;
+    push(value) {
+        if (this.#closed || this.#error)
+            return;
+        this.#values.push(value);
+        this.#wake();
+    }
+    close() {
+        this.#closed = true;
+        this.#wake();
+    }
+    fail(error) {
+        this.#error = error;
+        this.#wake();
+    }
+    #wake() {
+        for (const resolve of this.#waiting.splice(0))
+            resolve();
+    }
+    async *[Symbol.asyncIterator]() {
+        for (;;) {
+            if (this.#values.length > 0) {
+                const value = this.#values.shift();
+                if (value !== undefined)
+                    yield value;
+                continue;
+            }
+            if (this.#error)
+                throw this.#error;
+            if (this.#closed)
+                return;
+            await new Promise((resolve) => {
+                this.#waiting.push(resolve);
+            });
+        }
+    }
+}
 export class KiroCliChatTransport {
     #runner;
+    #spawner;
+    #loginStarter;
     #trustAllTools;
     #requestTimeoutMs;
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
+        this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
+        this.#loginStarter = options.loginStarter ?? startKiroCliLoginOnce;
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
+    #startLoginAfterAuthFailure() {
+        try {
+            this.#loginStarter();
+        }
+        catch {
+            // Preserve the original auth error. Login launch failures are diagnostic-only here.
+        }
+    }
     async generate(request) {
         const result = await this.#runner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }), {
             timeoutMs: this.#requestTimeoutMs,
         });
         if (!result.ok) {
             const authError = result.stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
             throw new KiroPluginError(result.stderr.trim() || "kiro-cli chat failed", authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502);
         }
         const text = sanitizeCliChatOutput(result.stdout);
@@ -55,4 +129,57 @@ export class KiroCliChatTransport {
             modelId: request.modelId,
         };
     }
+    async *stream(request) {
+        const child = this.#spawner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }));
+        const queue = new AsyncQueue();
+        let rawStdout = "";
+        let emittedText = "";
+        let stderr = "";
+        let sawText = false;
+        const timer = setTimeout(() => {
+            child.kill();
+            queue.fail(new KiroPluginError("Timed out waiting for kiro-cli chat response.", "KIRO_TIMEOUT", 504));
+        }, this.#requestTimeoutMs);
+        child.stdout?.on("data", (chunk) => {
+            rawStdout += chunk.toString("utf8");
+            const cleaned = sanitizeCliChatStreamingOutput(rawStdout);
+            if (!cleaned.startsWith(emittedText))
+                return;
+            const delta = cleaned.slice(emittedText.length);
+            emittedText = cleaned;
+            if (!delta)
+                return;
+            sawText = true;
+            queue.push({ type: "text", text: delta, modelId: request.modelId });
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            queue.fail(new KiroPluginError(error.message, "KIRO_CLI_FAILED", 502));
+        });
+        child.on("exit", (code, signal) => {
+            clearTimeout(timer);
+            if (code === 0) {
+                if (sawText)
+                    queue.close();
+                else
+                    queue.fail(new KiroPluginError(stderr.trim() || "kiro-cli chat completed without returning assistant text", "KIRO_EMPTY_RESPONSE", 502));
+                return;
+            }
+            const authError = stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
+            queue.fail(new KiroPluginError(stderr.trim() || `kiro-cli chat exited${code === null ? "" : ` with code ${code}`}${signal ? ` and signal ${signal}` : ""}`, authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502));
+        });
+        try {
+            yield* queue;
+        }
+        finally {
+            clearTimeout(timer);
+            if (!child.killed && child.exitCode === null)
+                child.kill();
+        }
+    }
 }

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc }
 export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, JsonRpcMessage } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
-export { createKiroPlugin, KiroPlugin } from "./plugin.js";
-export { detectAuth, redacted, resolveApiKey } from "./auth.js";
+export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/index.js

@@ -1,8 +1,8 @@
 import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
-export { createKiroPlugin, KiroPlugin } from "./plugin.js";
-export { detectAuth, redacted, resolveApiKey } from "./auth.js";
+export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/plugin.d.ts

@@ -2,7 +2,10 @@ import type { Plugin } from "@opencode-ai/plugin";
 import type { KiroAcpTransportOptions } from "./acp-transport.js";
 import type { KiroPluginOptions } from "./config.js";
 import type { KiroTransportOptions } from "./kiro-transport.js";
+type EffectiveBackend = "fetch" | "cli-chat" | "acp" | "none";
+export declare function effectiveBackend(options: Pick<KiroPluginOptions, "backend">, accessToken?: string): EffectiveBackend;
 export declare function acpTransportOptions(options: Pick<KiroPluginOptions, "requestTimeoutMs" | "trustAllTools">): KiroAcpTransportOptions;
 export declare function fetchTransportOptions(options: Pick<KiroPluginOptions, "region" | "endpoint" | "profileArn" | "userAgent" | "agentMode" | "maxAttempts" | "requestTimeoutMs">, accessToken: string): KiroTransportOptions;
 export declare function createKiroPlugin(): Plugin;
 export declare const KiroPlugin: Plugin;
+export {};

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey } from "./auth.js";
+import { detectAuth, resolveApiKey, startKiroCliLogin } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -48,25 +48,34 @@ function bearerToken(init) {
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
-function localTransport(options, accessToken) {
+export function effectiveBackend(options, accessToken) {
+    const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
+        return "acp";
+    if (options.backend === "cli-chat")
+        return "cli-chat";
+    if (options.backend === "fetch")
+        return apiKey && apiKey !== "kiro-plugin-local-transport" ? "fetch" : "none";
+    if (apiKey && apiKey !== "kiro-plugin-local-transport")
+        return "fetch";
+    return "cli-chat";
+}
+function localTransport(options, accessToken) {
+    const backend = effectiveBackend(options, accessToken);
+    if (backend === "acp")
         return new KiroAcpTransport(acpTransportOptions(options));
-    if (options.backend === "cli-chat") {
+    if (backend === "cli-chat") {
         return new KiroCliChatTransport({
             trustAllTools: options.trustAllTools,
             ...(options.requestTimeoutMs ? { requestTimeoutMs: options.requestTimeoutMs } : {}),
         });
     }
-    const apiKey = accessToken || process.env.KIRO_API_KEY;
-    if (apiKey && apiKey !== "kiro-plugin-local-transport") {
+    if (backend === "fetch") {
+        const apiKey = accessToken || process.env.KIRO_API_KEY;
+        if (!apiKey || apiKey === "kiro-plugin-local-transport")
+            return undefined;
         return new CodeWhispererKiroTransport(fetchTransportOptions(options, apiKey));
     }
-    if (options.backend === "auto") {
-        return new KiroCliChatTransport({
-            trustAllTools: options.trustAllTools,
-            ...(options.requestTimeoutMs ? { requestTimeoutMs: options.requestTimeoutMs } : {}),
-        });
-    }
     return undefined;
 }
 export function acpTransportOptions(options) {
@@ -159,6 +168,22 @@ export function createKiroPlugin() {
             auth: {
                 provider: options.providerID,
                 methods: [
+                    {
+                        type: "oauth",
+                        label: "Kiro CLI login",
+                        authorize: async () => {
+                            const session = startKiroCliLogin();
+                            return {
+                                url: session.url,
+                                instructions: session.instructions,
+                                method: "auto",
+                                callback: async () => {
+                                    const authenticated = await session.waitForAuth();
+                                    return authenticated ? { type: "success", key: "kiro-plugin-local-transport" } : { type: "failed" };
+                                },
+                            };
+                        },
+                    },
                     {
                         type: "api",
                         label: "Kiro API key",
@@ -200,6 +225,7 @@ export function createKiroPlugin() {
                             output: [
                                 `provider: ${options.providerID}`,
                                 `backend: ${options.backend}`,
+                                `effective backend: ${effectiveBackend(options)}`,
                                 `region: ${auth.region}`,
                                 `auth: ${auth.method}`,
                                 `authenticated: ${auth.authenticated ? "yes" : "no"}`,
@@ -209,6 +235,7 @@ export function createKiroPlugin() {
                             metadata: {
                                 providerID: options.providerID,
                                 backend: options.backend,
+                                effectiveBackend: effectiveBackend(options),
                                 region: auth.region,
                                 authMethod: auth.method,
                                 authenticated: auth.authenticated,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",