@bogyie/opencode-kiro-plugin 0.2.7 → 0.2.8

package/README.md

@@ -37,6 +37,8 @@ The plugin resolves credentials in this order:
 2. OpenCode auth input for provider `kiro`
 3. `kiro-cli whoami` diagnostics for CLI session visibility
 
+When no usable Kiro CLI session is available, choose the `Kiro CLI login` auth method in OpenCode. The plugin starts `kiro-cli login --use-device-flow`, opens the browser through the official CLI login flow, and waits until `kiro-cli whoami` succeeds.
+
 Direct fetch mode requires an API key/token usable by the Kiro/CodeWhisperer client. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type ChildProcess } from "node:child_process";
 export type AuthMethod = "api-key" | "cli-session" | "none";
 export interface AuthDiagnostics {
     readonly authenticated: boolean;
@@ -16,7 +17,16 @@ export interface CommandRunOptions {
     readonly timeoutMs?: number;
 }
 export type CommandRunner = (command: string, args: ReadonlyArray<string>, options?: CommandRunOptions) => Promise<CommandResult>;
+export type ProcessSpawner = (command: string, args: ReadonlyArray<string>) => ChildProcess;
+export interface KiroLoginSession {
+    readonly url: string;
+    readonly instructions: string;
+    waitForAuth(runner?: CommandRunner): Promise<boolean>;
+}
+export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;
+export declare function extractKiroLoginUrl(output: string): string;
+export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function redacted(value: string | undefined): string | undefined;
 export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunner): Promise<AuthDiagnostics>;
 export declare function resolveApiKey(auth: () => Promise<{

package/dist/auth.js

@@ -1,6 +1,8 @@
 import { execFile } from "node:child_process";
+import { spawn } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -16,6 +18,58 @@ export async function runCommand(command, args, options = {}) {
         };
     }
 }
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function firstUrl(text) {
+    return /https?:\/\/[^\s"'<>]+/.exec(text)?.[0];
+}
+export function extractKiroLoginUrl(output) {
+    return firstUrl(output) ?? KIRO_LOGIN_URL;
+}
+export function startKiroCliLogin(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
+    const child = spawner("kiro-cli", ["login", "--use-device-flow"]);
+    let output = "";
+    let exited = false;
+    let exitCode = null;
+    child.stdout?.on("data", (chunk) => {
+        output += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+        output += chunk.toString("utf8");
+    });
+    child.on("exit", (code) => {
+        exited = true;
+        exitCode = code;
+    });
+    return {
+        get url() {
+            return extractKiroLoginUrl(output);
+        },
+        get instructions() {
+            const url = extractKiroLoginUrl(output);
+            const code = /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
+            return [
+                "Complete Kiro CLI login in the browser.",
+                `URL: ${url}`,
+                ...(code ? [`Code: ${code}`] : []),
+                "The plugin will continue after `kiro-cli whoami` succeeds.",
+            ].join("\n");
+        },
+        async waitForAuth(runner = runCommand) {
+            const deadline = Date.now() + 10 * 60 * 1000;
+            while (Date.now() < deadline) {
+                const auth = await detectAuth(process.env, runner);
+                if (auth.authenticated)
+                    return true;
+                if (exited && exitCode !== 0)
+                    return false;
+                await delay(2000);
+            }
+            return false;
+        },
+    };
+}
 export function redacted(value) {
     if (!value)
         return undefined;

package/dist/cli-transport.d.ts

@@ -6,6 +6,7 @@ import { type ChildProcess } from "node:child_process";
 export interface CliChatTransportOptions {
     readonly runner?: CommandRunner;
     readonly spawner?: CliChatSpawner;
+    readonly loginStarter?: () => void;
     readonly trustAllTools?: boolean;
     readonly requestTimeoutMs?: number;
 }

package/dist/cli-transport.js

@@ -1,6 +1,14 @@
-import { runCommand } from "./auth.js";
+import { runCommand, startKiroCliLogin } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
 import { spawn } from "node:child_process";
+let lastLoginStartAt = 0;
+function startKiroCliLoginOnce() {
+    const now = Date.now();
+    if (now - lastLoginStartAt < 30_000)
+        return;
+    lastLoginStartAt = now;
+    startKiroCliLogin();
+}
 export function promptForCli(request) {
     const parts = [
         request.system ? `System:\n${request.system}` : "",
@@ -84,20 +92,32 @@ class AsyncQueue {
 export class KiroCliChatTransport {
     #runner;
     #spawner;
+    #loginStarter;
     #trustAllTools;
     #requestTimeoutMs;
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
         this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
+        this.#loginStarter = options.loginStarter ?? startKiroCliLoginOnce;
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
+    #startLoginAfterAuthFailure() {
+        try {
+            this.#loginStarter();
+        }
+        catch {
+            // Preserve the original auth error. Login launch failures are diagnostic-only here.
+        }
+    }
     async generate(request) {
         const result = await this.#runner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }), {
             timeoutMs: this.#requestTimeoutMs,
         });
         if (!result.ok) {
             const authError = result.stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
             throw new KiroPluginError(result.stderr.trim() || "kiro-cli chat failed", authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502);
         }
         const text = sanitizeCliChatOutput(result.stdout);
@@ -149,6 +169,8 @@ export class KiroCliChatTransport {
                 return;
             }
             const authError = stderr.toLowerCase().includes("not logged in");
+            if (authError)
+                this.#startLoginAfterAuthFailure();
             queue.fail(new KiroPluginError(stderr.trim() || `kiro-cli chat exited${code === null ? "" : ` with code ${code}`}${signal ? ` and signal ${signal}` : ""}`, authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502));
         });
         try {

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, redacted, resolveApiKey } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/index.js

@@ -2,7 +2,7 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, redacted, resolveApiKey } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey } from "./auth.js";
+import { detectAuth, resolveApiKey, startKiroCliLogin } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -168,6 +168,22 @@ export function createKiroPlugin() {
             auth: {
                 provider: options.providerID,
                 methods: [
+                    {
+                        type: "oauth",
+                        label: "Kiro CLI login",
+                        authorize: async () => {
+                            const session = startKiroCliLogin();
+                            return {
+                                url: session.url,
+                                instructions: session.instructions,
+                                method: "auto",
+                                callback: async () => {
+                                    const authenticated = await session.waitForAuth();
+                                    return authenticated ? { type: "success", key: "kiro-plugin-local-transport" } : { type: "failed" };
+                                },
+                            };
+                        },
+                    },
                     {
                         type: "api",
                         label: "Kiro API key",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",