@bogyie/opencode-kiro-plugin 0.2.8 → 0.2.9

package/README.md

@@ -2,7 +2,7 @@
 
 OpenCode server plugin that registers Kiro as an OpenAI-compatible provider and adapts requests to Kiro backends.
 
-Status: early implementation. The CodeWhisperer streaming transport, CLI chat fallback, model resolver, multimodal request mapping, streaming text, and tool-call chunk mapping are implemented with unit tests. The ACP backend implements JSON-RPC stdio framing, initialize/session/model/prompt flow, streaming text from `AgentMessageChunk`, and basic `ToolCall` streaming; full ACP tool progress/result parity is still in progress.
+Status: early implementation. The direct Kiro REST/EventStream transport, CLI chat fallback, model resolver, multimodal request mapping, streaming text, and tool-call chunk mapping are implemented with unit tests. The ACP backend implements JSON-RPC stdio framing, initialize/session/model/prompt flow, streaming text from `AgentMessageChunk`, and basic `ToolCall` streaming; full ACP tool progress/result parity is still in progress.
 
 ## Install
 
@@ -35,11 +35,12 @@ The plugin resolves credentials in this order:
 
 1. `KIRO_API_KEY`
 2. OpenCode auth input for provider `kiro`
-3. `kiro-cli whoami` diagnostics for CLI session visibility
+3. Local Kiro CLI session token from the Kiro CLI SQLite store
+4. `kiro-cli whoami` diagnostics for CLI session visibility
 
 When no usable Kiro CLI session is available, choose the `Kiro CLI login` auth method in OpenCode. The plugin starts `kiro-cli login --use-device-flow`, opens the browser through the official CLI login flow, and waits until `kiro-cli whoami` succeeds.
 
-Direct fetch mode requires an API key/token usable by the Kiro/CodeWhisperer client. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -67,8 +68,8 @@ Configure the backend through plugin options:
 
 Supported values:
 
-- `auto`: use CodeWhisperer fetch transport when an API key is available; otherwise use streaming `cli-chat` with the local Kiro CLI login.
-- `fetch`: require the direct Kiro/CodeWhisperer fetch path. If no usable auth is available, requests fail with a structured backend/auth error.
+- `auto`: use the direct Kiro REST/EventStream fetch transport. It uses `KIRO_API_KEY` or OpenCode auth when present, otherwise the active Kiro CLI session token.
+- `fetch`: require the direct Kiro REST/EventStream fetch path. If no usable auth is available, requests fail with a structured backend/auth error.
 - `cli-chat`: spawn `kiro-cli chat --no-interactive --model <model>` and stream stdout chunks as they arrive. Chunk granularity is controlled by Kiro CLI.
 - `acp`: launch `kiro-cli acp`, initialize a session, optionally set the requested model, send the prompt, and collect `AgentMessageChunk` notifications until `TurnEnd`.
 
@@ -137,9 +138,9 @@ The plugin injects `provider.kiro` automatically. You only need to add `provider
 - `KIRO_ACP_TIMEOUT`: ACP did not send a `TurnEnd` notification before the prompt timeout.
 - `KIRO_ACP_PROCESS_ERROR` or `KIRO_ACP_PROCESS_EXITED`: `kiro-cli acp` could not start or exited while a request was pending.
 
-Direct fetch mode uses AWS SDK standard retry behavior. Tune `maxAttempts` and `requestTimeoutMs` if you need stricter failure boundaries in automation. Fetch mode also accepts `endpoint`, `profileArn`, `userAgent`, and `agentMode` for controlled environments. `cli-chat` uses `requestTimeoutMs` for the `kiro-cli chat --no-interactive` child process, and ACP uses it while waiting for `session/prompt` completion and `TurnEnd`.
+Direct fetch mode calls Kiro's `generateAssistantResponse` endpoint and can fall back from the `q` endpoint to the CodeWhisperer endpoint on quota or upstream failures. Tune `maxAttempts` and `requestTimeoutMs` if you need stricter failure boundaries in automation. Fetch mode also accepts `endpoint`, `profileArn`, `userAgent`, and `agentMode` for controlled environments. `cli-chat` uses `requestTimeoutMs` for the `kiro-cli chat --no-interactive` child process, and ACP uses it while waiting for `session/prompt` completion and `TurnEnd`.
 
-OpenAI-compatible `temperature`, `max_tokens`, `max_completion_tokens`, `reasoning_effort`, `reasoning.effort`, and `thinking.effort` are preserved for direct fetch mode through Kiro's `additionalModelRequestFields` path on a best-effort basis.
+OpenAI-compatible `temperature`, `max_tokens`, and `max_completion_tokens` are preserved for direct fetch mode through Kiro's `inferenceConfig` fields on a best-effort basis.
 
 When Kiro emits token metadata in direct fetch mode, non-streaming responses map it to OpenAI-compatible `usage` fields.
 When Kiro emits reasoning text, it is preserved separately from assistant text as `reasoning_content`.

package/dist/auth.d.ts

@@ -18,13 +18,29 @@ export interface CommandRunOptions {
 }
 export type CommandRunner = (command: string, args: ReadonlyArray<string>, options?: CommandRunOptions) => Promise<CommandResult>;
 export type ProcessSpawner = (command: string, args: ReadonlyArray<string>) => ChildProcess;
+export interface KiroCliSessionCredential {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly expiresAt?: string;
+    readonly profileArn?: string;
+    readonly region: string;
+    readonly source: string;
+}
+export interface KiroCliSessionCredentialOptions {
+    readonly dbPath?: string;
+    readonly tokenKeys?: ReadonlyArray<string>;
+}
 export interface KiroLoginSession {
     readonly url: string;
     readonly instructions: string;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
+export declare const DEFAULT_KIRO_CLI_DB_PATH: string;
+export declare const DEFAULT_KIRO_CLI_TOKEN_KEYS: readonly ["kirocli:odic:token", "codewhisperer:odic:token"];
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;
+export declare function regionFromProfileArn(profileArn: string | undefined): string | undefined;
+export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
 export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function redacted(value: string | undefined): string | undefined;

package/dist/auth.js

@@ -1,8 +1,13 @@
 import { execFile } from "node:child_process";
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
+export const DEFAULT_KIRO_CLI_DB_PATH = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
+export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer:odic:token"];
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -18,6 +23,72 @@ export async function runCommand(command, args, options = {}) {
         };
     }
 }
+function sqlString(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function jsonObject(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function stringField(input, ...keys) {
+    for (const key of keys) {
+        const value = input?.[key];
+        if (typeof value === "string" && value.trim())
+            return value.trim();
+    }
+    return undefined;
+}
+export function regionFromProfileArn(profileArn) {
+    const match = /^arn:aws:codewhisperer:([^:]+):/.exec(profileArn?.trim() ?? "");
+    return match?.[1];
+}
+async function sqliteValue(dbPath, table, key, runner) {
+    if (!existsSync(dbPath))
+        return undefined;
+    const result = await runner("sqlite3", [dbPath, `select value from ${table} where key=${sqlString(key)} limit 1`], {
+        timeoutMs: 5000,
+    });
+    if (!result.ok)
+        return undefined;
+    const value = result.stdout.trim();
+    return value || undefined;
+}
+function profileArnFromState(value) {
+    if (!value)
+        return undefined;
+    if (value.startsWith("arn:aws:codewhisperer:"))
+        return value;
+    const parsed = jsonObject(value);
+    return stringField(parsed, "profileArn", "arn", "id");
+}
+export async function readKiroCliSessionCredential(options = {}, runner = runCommand) {
+    const dbPath = options.dbPath ?? DEFAULT_KIRO_CLI_DB_PATH;
+    const tokenKeys = options.tokenKeys ?? DEFAULT_KIRO_CLI_TOKEN_KEYS;
+    const profileArn = profileArnFromState(await sqliteValue(dbPath, "state", "api.codewhisperer.profile", runner));
+    for (const key of tokenKeys) {
+        const raw = await sqliteValue(dbPath, "auth_kv", key, runner);
+        const parsed = raw ? jsonObject(raw) : undefined;
+        const accessToken = stringField(parsed, "access_token", "accessToken", "token");
+        if (!accessToken)
+            continue;
+        const refreshToken = stringField(parsed, "refresh_token", "refreshToken");
+        const expiresAt = stringField(parsed, "expires_at", "expiresAt", "expiration");
+        return {
+            accessToken,
+            ...(refreshToken ? { refreshToken } : {}),
+            ...(expiresAt ? { expiresAt } : {}),
+            ...(profileArn ? { profileArn } : {}),
+            region: regionFromProfileArn(profileArn) ?? "us-east-1",
+            source: key,
+        };
+    }
+    return undefined;
+}
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/index.d.ts

@@ -3,12 +3,14 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";
 export { getKiroCliStatus, getKiroCliVersion } from "./kiro-cli.js";
 export { additionalModelRequestFields, CodeWhispererKiroTransport, collectAssistantText, createCodeWhispererClient, streamAssistantText, toGenerateAssistantResponseInput, usageFromMetadataEvent, } from "./kiro-transport.js";
+export { KiroRestTransport, toKiroRestPayload } from "./kiro-rest-transport.js";
+export type { KiroRestTransportOptions } from "./kiro-rest-transport.js";
 export { ModelCache } from "./model-cache.js";
 export { discoverModelsFromCommand, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
 export { ModelResolutionError, ModelResolver, normalizeModelName } from "./model-resolver.js";

package/dist/index.js

@@ -2,12 +2,13 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, redacted, resolveApiKey, startKiroCliLogin } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";
 export { getKiroCliStatus, getKiroCliVersion } from "./kiro-cli.js";
 export { additionalModelRequestFields, CodeWhispererKiroTransport, collectAssistantText, createCodeWhispererClient, streamAssistantText, toGenerateAssistantResponseInput, usageFromMetadataEvent, } from "./kiro-transport.js";
+export { KiroRestTransport, toKiroRestPayload } from "./kiro-rest-transport.js";
 export { ModelCache } from "./model-cache.js";
 export { discoverModelsFromCommand, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
 export { ModelResolutionError, ModelResolver, normalizeModelName } from "./model-resolver.js";

package/dist/kiro-rest-transport.d.ts

@@ -0,0 +1,27 @@
+import { type KiroCliSessionCredential } from "./auth.js";
+import type { KiroTransport } from "./fetch-adapter.js";
+import type { KiroGenerateRequest } from "./request-adapter.js";
+import type { KiroGenerateResponse, KiroStreamEvent } from "./response-adapter.js";
+export interface KiroRestTransportOptions {
+    readonly region: string;
+    readonly accessToken?: string;
+    readonly endpoint?: string;
+    readonly profileArn?: string;
+    readonly userAgent?: string;
+    readonly agentMode?: string;
+    readonly maxAttempts?: number;
+    readonly requestTimeoutMs?: number;
+}
+export type KiroCredentialProvider = () => Promise<KiroCliSessionCredential | undefined>;
+export type KiroRestFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export interface KiroRestTransportDependencies {
+    readonly fetcher?: KiroRestFetch;
+    readonly credentialProvider?: KiroCredentialProvider;
+}
+export declare function toKiroRestPayload(request: KiroGenerateRequest, profileArn?: string): Record<string, unknown>;
+export declare class KiroRestTransport implements KiroTransport {
+    #private;
+    constructor(options: KiroRestTransportOptions, dependencies?: KiroRestTransportDependencies);
+    generate(request: KiroGenerateRequest): Promise<KiroGenerateResponse>;
+    stream(request: KiroGenerateRequest): AsyncIterable<KiroStreamEvent>;
+}

package/dist/kiro-rest-transport.js

@@ -0,0 +1,390 @@
+import { KiroPluginError } from "./errors.js";
+import { readKiroCliSessionCredential, regionFromProfileArn, } from "./auth.js";
+const DEFAULT_USER_AGENT = "KiroIDE";
+const DEFAULT_AGENT_MODE = "vibe";
+const STREAMING_SDK_VERSION = "1.0.34";
+function base64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+function conversationId(request) {
+    const seed = `${request.modelId}:${request.prompt}:${request.system ?? ""}`;
+    let hash = 0;
+    for (let i = 0; i < seed.length; i += 1) {
+        hash = (hash * 31 + seed.charCodeAt(i)) >>> 0;
+    }
+    return `opencode-${hash.toString(16)}-${Date.now().toString(36)}`;
+}
+export function toKiroRestPayload(request, profileArn) {
+    const history = [
+        ...(request.system
+            ? [
+                {
+                    userInputMessage: {
+                        content: request.system,
+                        modelId: request.modelId,
+                        origin: "AI_EDITOR",
+                    },
+                },
+                {
+                    assistantResponseMessage: {
+                        content: "I will follow these instructions.",
+                    },
+                },
+            ]
+            : []),
+        ...request.history.map((turn) => turn.role === "assistant"
+            ? {
+                assistantResponseMessage: {
+                    content: turn.content,
+                },
+            }
+            : {
+                userInputMessage: {
+                    content: turn.content,
+                    modelId: request.modelId,
+                    origin: "AI_EDITOR",
+                },
+            }),
+    ];
+    const tools = request.tools.map((item) => ({
+        toolSpecification: {
+            name: item.name,
+            ...(item.description ? { description: item.description } : {}),
+            inputSchema: { json: item.inputSchema },
+        },
+    }));
+    const toolResults = request.toolResults.map((item) => ({
+        toolUseId: item.toolUseId,
+        content: [{ text: item.content }],
+        status: "success",
+        ...(item.toolName ? { toolName: item.toolName } : {}),
+    }));
+    const userInputMessageContext = tools.length > 0 || toolResults.length > 0
+        ? {
+            ...(tools.length > 0 ? { tools } : {}),
+            ...(toolResults.length > 0 ? { toolResults } : {}),
+        }
+        : undefined;
+    const inferenceConfig = request.modelOptions.maxTokens !== undefined || request.modelOptions.temperature !== undefined
+        ? {
+            ...(request.modelOptions.maxTokens !== undefined ? { maxTokens: request.modelOptions.maxTokens } : {}),
+            ...(request.modelOptions.temperature !== undefined ? { temperature: request.modelOptions.temperature } : {}),
+        }
+        : undefined;
+    return {
+        conversationState: {
+            chatTriggerType: "MANUAL",
+            conversationId: conversationId(request),
+            currentMessage: {
+                userInputMessage: {
+                    content: request.prompt || "Continue.",
+                    modelId: request.modelId,
+                    origin: "AI_EDITOR",
+                    ...(request.images.length > 0
+                        ? {
+                            images: request.images.map((image) => ({
+                                format: image.format,
+                                source: { bytes: base64(image.bytes) },
+                            })),
+                        }
+                        : {}),
+                    ...(userInputMessageContext ? { userInputMessageContext } : {}),
+                },
+            },
+            ...(history.length > 0 ? { history } : {}),
+        },
+        ...(profileArn ? { profileArn } : {}),
+        ...(inferenceConfig ? { inferenceConfig } : {}),
+    };
+}
+function modelUserAgent(userAgent) {
+    if (userAgent !== DEFAULT_USER_AGENT)
+        return userAgent;
+    const nodeVersion = process.version.replace(/^v/, "");
+    const platform = process.platform === "darwin" ? "darwin" : process.platform;
+    return `aws-sdk-js/${STREAMING_SDK_VERSION} ua/2.1 os/${platform} lang/js md/nodejs#${nodeVersion} api/codewhispererstreaming#${STREAMING_SDK_VERSION} m/E ${DEFAULT_USER_AGENT}`;
+}
+function endpointCandidates(options, region) {
+    if (options.endpoint) {
+        return [options.endpoint.endsWith("/generateAssistantResponse") ? options.endpoint : `${options.endpoint.replace(/\/+$/, "")}/generateAssistantResponse`];
+    }
+    const qEndpoint = `https://q.${region}.amazonaws.com/generateAssistantResponse`;
+    if (region !== "us-east-1")
+        return [qEndpoint];
+    return [qEndpoint, "https://codewhisperer.us-east-1.amazonaws.com/generateAssistantResponse"];
+}
+function headersFor(endpoint, accessToken, options) {
+    const headers = new Headers({
+        authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json",
+        accept: "*/*",
+        "user-agent": modelUserAgent(options.userAgent ?? DEFAULT_USER_AGENT),
+        "x-amz-user-agent": `aws-sdk-js/${STREAMING_SDK_VERSION} ${options.userAgent ?? DEFAULT_USER_AGENT}`,
+        "x-amzn-kiro-agent-mode": options.agentMode ?? DEFAULT_AGENT_MODE,
+        "x-amzn-codewhisperer-optout": "true",
+        "amz-sdk-request": `attempt=1; max=${options.maxAttempts ?? 3}`,
+        "amz-sdk-invocation-id": crypto.randomUUID(),
+    });
+    if (new URL(endpoint).hostname.startsWith("codewhisperer.")) {
+        headers.set("x-amz-target", "AmazonCodeWhispererStreamingService.GenerateAssistantResponse");
+    }
+    return headers;
+}
+function timeoutSignal(timeoutMs) {
+    if (!timeoutMs)
+        return undefined;
+    return AbortSignal.timeout(timeoutMs);
+}
+function stringValue(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function tokenUsage(payload) {
+    const usage = payload.tokenUsage;
+    if (!usage || typeof usage !== "object" || Array.isArray(usage))
+        return undefined;
+    const record = usage;
+    const uncached = numberValue(record.uncachedInputTokens) ?? 0;
+    const cacheRead = numberValue(record.cacheReadInputTokens) ?? 0;
+    const cacheWrite = numberValue(record.cacheWriteInputTokens) ?? 0;
+    const outputTokens = numberValue(record.outputTokens);
+    const inputTokens = numberValue(record.inputTokens) ?? (uncached + cacheRead + cacheWrite || undefined);
+    return inputTokens || outputTokens
+        ? {
+            ...(inputTokens ? { inputTokens } : {}),
+            ...(outputTokens !== undefined ? { outputTokens } : {}),
+        }
+        : undefined;
+}
+function parseHeaders(buffer) {
+    const headers = {};
+    let offset = 0;
+    while (offset < buffer.length) {
+        const nameLength = buffer[offset];
+        if (nameLength === undefined)
+            break;
+        offset += 1;
+        const name = buffer.subarray(offset, offset + nameLength).toString("utf8");
+        offset += nameLength;
+        const type = buffer[offset];
+        offset += 1;
+        if (type === 7) {
+            const valueLength = buffer.readUInt16BE(offset);
+            offset += 2;
+            headers[name] = buffer.subarray(offset, offset + valueLength).toString("utf8");
+            offset += valueLength;
+            continue;
+        }
+        if (type === 6) {
+            const valueLength = buffer.readUInt16BE(offset);
+            offset += 2;
+            headers[name] = buffer.subarray(offset, offset + valueLength);
+            offset += valueLength;
+            continue;
+        }
+        if (type === 0 || type === 1) {
+            headers[name] = type === 0;
+            continue;
+        }
+        if (type === 2) {
+            headers[name] = buffer.readInt8(offset);
+            offset += 1;
+            continue;
+        }
+        if (type === 3) {
+            headers[name] = buffer.readInt16BE(offset);
+            offset += 2;
+            continue;
+        }
+        if (type === 4) {
+            headers[name] = buffer.readInt32BE(offset);
+            offset += 4;
+            continue;
+        }
+        if (type === 5) {
+            headers[name] = Number(buffer.readBigInt64BE(offset));
+            offset += 8;
+            continue;
+        }
+        break;
+    }
+    return headers;
+}
+async function* decodeEventStream(body) {
+    const reader = body.getReader();
+    let buffer = Buffer.alloc(0);
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            buffer = Buffer.concat([buffer, Buffer.from(item.value)]);
+            while (buffer.length >= 16) {
+                const totalLength = buffer.readUInt32BE(0);
+                const headersLength = buffer.readUInt32BE(4);
+                if (totalLength < 16)
+                    throw new KiroPluginError("Kiro returned an invalid event stream frame.", "KIRO_STREAM_ERROR", 502);
+                if (buffer.length < totalLength)
+                    break;
+                const frame = buffer.subarray(0, totalLength);
+                buffer = buffer.subarray(totalLength);
+                const headers = parseHeaders(frame.subarray(12, 12 + headersLength));
+                const payloadBytes = frame.subarray(12 + headersLength, totalLength - 4);
+                if (payloadBytes.length === 0)
+                    continue;
+                const payload = JSON.parse(payloadBytes.toString("utf8"));
+                yield {
+                    eventType: stringValue(headers[":event-type"]) ?? "unknown",
+                    payload,
+                };
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function normalizeChunk(chunk, previous) {
+    const old = previous.value;
+    if (!old) {
+        previous.value = chunk;
+        return chunk;
+    }
+    if (chunk === old || old.startsWith(chunk))
+        return "";
+    if (chunk.startsWith(old)) {
+        previous.value = chunk;
+        return chunk.slice(old.length);
+    }
+    previous.value = chunk;
+    return chunk;
+}
+async function collectChunks(chunks, fallbackModelId) {
+    let text = "";
+    let reasoning = "";
+    let usage;
+    const toolCalls = [];
+    for await (const chunk of chunks) {
+        if (chunk.type === "tool_call") {
+            toolCalls.push(chunk);
+            continue;
+        }
+        if (chunk.type === "reasoning") {
+            reasoning += chunk.text;
+            continue;
+        }
+        text += chunk.text;
+        if (chunk.usage)
+            usage = chunk.usage;
+    }
+    return {
+        text,
+        modelId: fallbackModelId,
+        ...(reasoning ? { reasoning } : {}),
+        ...(toolCalls.length > 0 ? { toolCalls } : {}),
+        ...(usage ? { usage } : {}),
+    };
+}
+export class KiroRestTransport {
+    #options;
+    #fetcher;
+    #credentialProvider;
+    constructor(options, dependencies = {}) {
+        this.#options = options;
+        this.#fetcher = dependencies.fetcher ?? fetch;
+        this.#credentialProvider = dependencies.credentialProvider ?? (() => readKiroCliSessionCredential());
+    }
+    async #credentials() {
+        const session = this.#options.accessToken ? undefined : await this.#credentialProvider();
+        const accessToken = this.#options.accessToken ?? session?.accessToken;
+        if (!accessToken) {
+            throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Run Kiro login and try again.", "KIRO_AUTH_ERROR", 401);
+        }
+        const profileArn = this.#options.profileArn ?? session?.profileArn;
+        return {
+            accessToken,
+            ...(profileArn ? { profileArn } : {}),
+            region: regionFromProfileArn(profileArn) ?? session?.region ?? this.#options.region,
+        };
+    }
+    async generate(request) {
+        return collectChunks(this.stream(request), request.modelId);
+    }
+    async *stream(request) {
+        const credentials = await this.#credentials();
+        const payload = toKiroRestPayload(request, credentials.profileArn);
+        let lastError;
+        for (const endpoint of endpointCandidates(this.#options, credentials.region)) {
+            const init = {
+                method: "POST",
+                headers: headersFor(endpoint, credentials.accessToken, this.#options),
+                body: JSON.stringify(payload),
+            };
+            const signal = timeoutSignal(this.#options.requestTimeoutMs);
+            if (signal)
+                init.signal = signal;
+            const response = await this.#fetcher(endpoint, init);
+            if (!response.ok) {
+                const errorBody = await response.text();
+                const message = errorBody || `Kiro API returned HTTP ${response.status}`;
+                const code = response.status === 401 || response.status === 403 ? "KIRO_AUTH_ERROR" : response.status === 429 ? "KIRO_RATE_LIMIT" : "KIRO_UPSTREAM_ERROR";
+                lastError = new KiroPluginError(message, code, response.status);
+                if (response.status === 429 || response.status >= 500)
+                    continue;
+                throw lastError;
+            }
+            if (!response.body)
+                return;
+            const assistant = { value: "" };
+            const reasoning = { value: "" };
+            const toolInputs = new Map();
+            for await (const event of decodeEventStream(response.body)) {
+                if (event.eventType === "assistantResponseEvent") {
+                    const content = stringValue(event.payload.content);
+                    if (!content)
+                        continue;
+                    const text = normalizeChunk(content, assistant);
+                    if (text)
+                        yield { type: "text", text, modelId: request.modelId };
+                    continue;
+                }
+                if (event.eventType === "reasoningContentEvent") {
+                    const content = stringValue(event.payload.text);
+                    if (!content)
+                        continue;
+                    const text = normalizeChunk(content, reasoning);
+                    if (text)
+                        yield { type: "reasoning", text, modelId: request.modelId };
+                    continue;
+                }
+                if (event.eventType === "toolUseEvent") {
+                    const id = stringValue(event.payload.toolUseId) ?? stringValue(event.payload.id) ?? crypto.randomUUID();
+                    const name = stringValue(event.payload.name) ?? stringValue(event.payload.toolName);
+                    if (!name)
+                        continue;
+                    const current = toolInputs.get(id) ?? { name, input: "" };
+                    const input = event.payload.input;
+                    current.input += typeof input === "string" ? input : input && typeof input === "object" ? JSON.stringify(input) : "";
+                    current.name = name;
+                    toolInputs.set(id, current);
+                    if (event.payload.stop === true) {
+                        yield { type: "tool_call", id, name: current.name, arguments: current.input, modelId: request.modelId };
+                        toolInputs.delete(id);
+                    }
+                    continue;
+                }
+                const usage = tokenUsage(event.payload);
+                if (usage)
+                    yield { type: "text", text: "", usage, modelId: request.modelId };
+            }
+            for (const [id, toolCall] of toolInputs) {
+                yield { type: "tool_call", id, name: toolCall.name, arguments: toolCall.input, modelId: request.modelId };
+            }
+            return;
+        }
+        if (lastError)
+            throw lastError;
+    }
+}

package/dist/plugin.d.ts

@@ -1,11 +1,11 @@
 import type { Plugin } from "@opencode-ai/plugin";
 import type { KiroAcpTransportOptions } from "./acp-transport.js";
 import type { KiroPluginOptions } from "./config.js";
-import type { KiroTransportOptions } from "./kiro-transport.js";
+import type { KiroRestTransportOptions } from "./kiro-rest-transport.js";
 type EffectiveBackend = "fetch" | "cli-chat" | "acp" | "none";
 export declare function effectiveBackend(options: Pick<KiroPluginOptions, "backend">, accessToken?: string): EffectiveBackend;
 export declare function acpTransportOptions(options: Pick<KiroPluginOptions, "requestTimeoutMs" | "trustAllTools">): KiroAcpTransportOptions;
-export declare function fetchTransportOptions(options: Pick<KiroPluginOptions, "region" | "endpoint" | "profileArn" | "userAgent" | "agentMode" | "maxAttempts" | "requestTimeoutMs">, accessToken: string): KiroTransportOptions;
+export declare function fetchTransportOptions(options: Pick<KiroPluginOptions, "region" | "endpoint" | "profileArn" | "userAgent" | "agentMode" | "maxAttempts" | "requestTimeoutMs">, accessToken?: string): KiroRestTransportOptions;
 export declare function createKiroPlugin(): Plugin;
 export declare const KiroPlugin: Plugin;
 export {};

package/dist/plugin.js

@@ -8,7 +8,7 @@ import { startLocalKiroServer } from "./local-server.js";
 import { ModelCache } from "./model-cache.js";
 import { refreshModelCacheFromCommand } from "./model-discovery.js";
 import { ModelResolver, normalizeModelName } from "./model-resolver.js";
-import { CodeWhispererKiroTransport } from "./kiro-transport.js";
+import { KiroRestTransport } from "./kiro-rest-transport.js";
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -55,10 +55,10 @@ export function effectiveBackend(options, accessToken) {
     if (options.backend === "cli-chat")
         return "cli-chat";
     if (options.backend === "fetch")
-        return apiKey && apiKey !== "kiro-plugin-local-transport" ? "fetch" : "none";
+        return "fetch";
     if (apiKey && apiKey !== "kiro-plugin-local-transport")
         return "fetch";
-    return "cli-chat";
+    return "fetch";
 }
 function localTransport(options, accessToken) {
     const backend = effectiveBackend(options, accessToken);
@@ -72,9 +72,7 @@ function localTransport(options, accessToken) {
     }
     if (backend === "fetch") {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
-        if (!apiKey || apiKey === "kiro-plugin-local-transport")
-            return undefined;
-        return new CodeWhispererKiroTransport(fetchTransportOptions(options, apiKey));
+        return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey));
     }
     return undefined;
 }
@@ -87,7 +85,7 @@ export function acpTransportOptions(options) {
 export function fetchTransportOptions(options, accessToken) {
     return {
         region: options.region,
-        accessToken,
+        ...(accessToken ? { accessToken } : {}),
         maxAttempts: options.maxAttempts,
         ...(options.endpoint ? { endpoint: options.endpoint } : {}),
         ...(options.profileArn ? { profileArn: options.profileArn } : {}),

package/docs/e2e-validation.md

@@ -16,7 +16,7 @@ npm run build
 
 ## Backend: fetch
 
-Use this when you have a token/API key that works with the CodeWhisperer/Kiro transport.
+Use this for the default direct Kiro REST/EventStream path. It can use `KIRO_API_KEY`, OpenCode auth, or the active Kiro CLI session token from the local Kiro CLI SQLite store.
 
 Config:
 
@@ -41,7 +41,9 @@ Config:
 Environment:
 
 ```sh
-export KIRO_API_KEY="..."
+kiro-cli whoami
+# Optional explicit token override:
+# export KIRO_API_KEY="..."
 ```
 
 Checks:
@@ -49,7 +51,7 @@ Checks:
 - Text prompt returns a normal assistant response.
 - `stream: true` prompt renders incrementally.
 - A prompt that triggers tool use returns OpenAI-compatible `tool_calls` in both streaming and non-streaming modes.
-- A data URL image or PDF prompt reaches Kiro without external URL fetching.
+- A data URL image prompt reaches Kiro without external URL fetching.
 - Invalid/expired auth returns `KIRO_AUTH_ERROR`, not a raw SDK exception.
 - Rate/quota failure returns `KIRO_RATE_LIMIT`.
 - Lowering `requestTimeoutMs` produces `KIRO_TIMEOUT`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",