@bogyie/opencode-kiro-plugin 0.3.0 → 0.3.5

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The plugin starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. The same auth method also works from OpenCode's CLI provider connect flow.
+When no usable Kiro CLI session is available, OpenCode's startup model discovery may start the same Kiro CLI login flow automatically. The plugin runs `kiro-cli login --use-device-flow`, waits for login to complete through `kiro-cli whoami`, and then runs the model discovery command one more time. If that login fails or times out, discovery fails for that startup attempt; it does not loop.
 
-The plugin does not start login during OpenCode startup. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If a model request fails because credentials are missing or rejected, the plugin starts one shared Kiro CLI login session and still returns `KIRO_AUTH_ERROR` for that failed request; retry after the login completes. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and applies the same login-on-auth-failure behavior. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can also open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The connector flow starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If credentials expire during use, direct fetch and `cli-chat` start the shared Kiro login flow, wait for it to complete, and retry the failed request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -77,7 +77,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. By default, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker; bundled metadata is not injected as available models by default.
+The resolver intentionally avoids a hard whitelist. By default, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker; if discovery cannot return any models, the plugin exposes an `auto` placeholder so OpenCode keeps the Kiro provider visible for connection.
 
 Useful options:
 
@@ -127,7 +127,7 @@ This keeps new Kiro model ids usable before the package is updated without adver
 
 The plugin injects `provider.kiro` automatically. You only need to add `provider.kiro.models` yourself when overriding OpenCode model-picker metadata, such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. If this command fails with an auth error, the plugin starts Kiro CLI login, waits for it to finish, and retries the command once. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/auth.d.ts

@@ -37,6 +37,11 @@ export interface KiroLoginSession {
     waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
+export interface KiroLoginFlowOptions {
+    readonly spawner?: ProcessSpawner;
+    readonly runner?: CommandRunner;
+    readonly promptTimeoutMs?: number;
+}
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export declare const DEFAULT_KIRO_CLI_DB_PATH: string;
 export declare const DEFAULT_KIRO_CLI_TOKEN_KEYS: readonly ["kirocli:odic:token", "codewhisperer:odic:token"];
@@ -47,6 +52,7 @@ export declare function extractKiroLoginUrl(output: string): string;
 export declare function extractKiroLoginCode(output: string): string | undefined;
 export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
 export declare function startKiroCliLoginOnce(spawner?: ProcessSpawner): KiroLoginSession;
+export declare function runKiroLoginFlowOnce(options?: KiroLoginFlowOptions): Promise<boolean>;
 export declare function redacted(value: string | undefined): string | undefined;
 export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunner): Promise<AuthDiagnostics>;
 export declare function resolveApiKey(auth: () => Promise<{

package/dist/auth.js

@@ -11,6 +11,7 @@ export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer
 const LOGIN_REUSE_WINDOW_MS = 2 * 60 * 1000;
 let sharedLoginSession;
 let sharedLoginStartedAt = 0;
+let sharedLoginFlow;
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -95,11 +96,59 @@ export async function readKiroCliSessionCredential(options = {}, runner = runCom
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function firstUrl(text) {
-    return /https?:\/\/[^\s"'<>]+/.exec(text)?.[0];
+function urls(text) {
+    return text.match(/https?:\/\/[^\s"'<>]+/g) ?? [];
+}
+function isLocalCallbackUrl(value) {
+    try {
+        const url = new URL(value);
+        const hostname = url.hostname.toLowerCase();
+        return ((hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]") &&
+            url.pathname.includes("/callback"));
+    }
+    catch {
+        return false;
+    }
+}
+function loginUrlFromLocalCallbackUrl(value) {
+    if (!isLocalCallbackUrl(value))
+        return undefined;
+    try {
+        const issuerUrl = new URL(value).searchParams.get("issuer_url");
+        if (!issuerUrl || isLocalCallbackUrl(issuerUrl))
+            return undefined;
+        const parsed = new URL(issuerUrl);
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isKiroSigninUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.hostname.toLowerCase() === "app.kiro.dev" && url.pathname === "/signin";
+    }
+    catch {
+        return false;
+    }
+}
+function firstLoginUrl(text) {
+    const candidates = urls(text);
+    const kiroSigninUrl = candidates.find(isKiroSigninUrl);
+    if (kiroSigninUrl)
+        return kiroSigninUrl;
+    for (const url of candidates) {
+        const callbackLoginUrl = loginUrlFromLocalCallbackUrl(url);
+        if (callbackLoginUrl)
+            return callbackLoginUrl;
+        if (!isLocalCallbackUrl(url))
+            return url;
+    }
+    return undefined;
 }
 export function extractKiroLoginUrl(output) {
-    return firstUrl(output) ?? KIRO_LOGIN_URL;
+    return firstLoginUrl(output) ?? KIRO_LOGIN_URL;
 }
 export function extractKiroLoginCode(output) {
     return /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
@@ -135,13 +184,13 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
             while (Date.now() < deadline) {
                 if (extractKiroLoginCode(output))
                     return true;
-                if (firstUrl(output))
+                if (firstLoginUrl(output))
                     return true;
                 if (exited && exitCode !== 0)
                     return false;
                 await delay(100);
             }
-            return Boolean(extractKiroLoginCode(output) || firstUrl(output));
+            return Boolean(extractKiroLoginCode(output) || firstLoginUrl(output));
         },
         async waitForAuth(runner = runCommand) {
             const deadline = Date.now() + 10 * 60 * 1000;
@@ -191,6 +240,16 @@ export function startKiroCliLoginOnce(spawner = (command, args) => spawn(command
     sharedLoginStartedAt = now;
     return wrapped;
 }
+export async function runKiroLoginFlowOnce(options = {}) {
+    sharedLoginFlow ??= (async () => {
+        const session = startKiroCliLoginOnce(options.spawner);
+        await session.waitForPrompt(options.promptTimeoutMs);
+        return session.waitForAuth(options.runner);
+    })().finally(() => {
+        sharedLoginFlow = undefined;
+    });
+    return sharedLoginFlow;
+}
 export function redacted(value) {
     if (!value)
         return undefined;

package/dist/cli-transport.d.ts

@@ -6,7 +6,7 @@ import { type ChildProcess } from "node:child_process";
 export interface CliChatTransportOptions {
     readonly runner?: CommandRunner;
     readonly spawner?: CliChatSpawner;
-    readonly loginStarter?: () => void;
+    readonly login?: () => Promise<boolean>;
     readonly trustAllTools?: boolean;
     readonly requestTimeoutMs?: number;
 }

package/dist/cli-transport.js

@@ -1,4 +1,4 @@
-import { runCommand, startKiroCliLoginOnce } from "./auth.js";
+import { runCommand, runKiroLoginFlowOnce } from "./auth.js";
 import { KiroPluginError } from "./errors.js";
 import { spawn } from "node:child_process";
 export function promptForCli(request) {
@@ -84,34 +84,22 @@ class AsyncQueue {
 export class KiroCliChatTransport {
     #runner;
     #spawner;
-    #loginStarter;
+    #login;
     #trustAllTools;
     #requestTimeoutMs;
     constructor(options = {}) {
         this.#runner = options.runner ?? runCommand;
         this.#spawner = options.spawner ?? ((command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] }));
-        this.#loginStarter = options.loginStarter ?? (() => {
-            startKiroCliLoginOnce();
-        });
+        this.#login = options.login ?? runKiroLoginFlowOnce;
         this.#trustAllTools = options.trustAllTools === true;
         this.#requestTimeoutMs = options.requestTimeoutMs ?? 120_000;
     }
-    #startLoginAfterAuthFailure() {
-        try {
-            this.#loginStarter();
-        }
-        catch {
-            // Keep the original model-call auth error visible to OpenCode.
-        }
-    }
-    async generate(request) {
+    async #runCliChat(request) {
         const result = await this.#runner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }), {
             timeoutMs: this.#requestTimeoutMs,
         });
         if (!result.ok) {
             const authError = result.stderr.toLowerCase().includes("not logged in");
-            if (authError)
-                this.#startLoginAfterAuthFailure();
             throw new KiroPluginError(result.stderr.trim() || "kiro-cli chat failed", authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502);
         }
         const text = sanitizeCliChatOutput(result.stdout);
@@ -123,7 +111,20 @@ export class KiroCliChatTransport {
             modelId: request.modelId,
         };
     }
-    async *stream(request) {
+    async generate(request) {
+        try {
+            return await this.#runCliChat(request);
+        }
+        catch (error) {
+            if (!(error instanceof KiroPluginError) || error.code !== "KIRO_AUTH_ERROR")
+                throw error;
+            const authenticated = await this.#login();
+            if (!authenticated)
+                throw error;
+            return this.#runCliChat(request);
+        }
+    }
+    async *#streamCliChat(request) {
         const child = this.#spawner("kiro-cli", cliChatArgs(request, { trustAllTools: this.#trustAllTools }));
         const queue = new AsyncQueue();
         let rawStdout = "";
@@ -163,8 +164,6 @@ export class KiroCliChatTransport {
                 return;
             }
             const authError = stderr.toLowerCase().includes("not logged in");
-            if (authError)
-                this.#startLoginAfterAuthFailure();
             queue.fail(new KiroPluginError(stderr.trim() || `kiro-cli chat exited${code === null ? "" : ` with code ${code}`}${signal ? ` and signal ${signal}` : ""}`, authError ? "KIRO_AUTH_ERROR" : "KIRO_CLI_FAILED", authError ? 401 : 502));
         });
         try {
@@ -176,4 +175,17 @@ export class KiroCliChatTransport {
                 child.kill();
         }
     }
+    async *stream(request) {
+        try {
+            yield* this.#streamCliChat(request);
+        }
+        catch (error) {
+            if (!(error instanceof KiroPluginError) || error.code !== "KIRO_AUTH_ERROR")
+                throw error;
+            const authenticated = await this.#login();
+            if (!authenticated)
+                throw error;
+            yield* this.#streamCliChat(request);
+        }
+    }
 }

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";
@@ -12,7 +12,7 @@ export { additionalModelRequestFields, CodeWhispererKiroTransport, collectAssist
 export { KiroRestTransport, toKiroRestPayload } from "./kiro-rest-transport.js";
 export type { KiroRestTransportOptions } from "./kiro-rest-transport.js";
 export { ModelCache } from "./model-cache.js";
-export { discoverModelsFromCommand, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
+export { discoverModelsFromCommand, isModelDiscoveryAuthFailure, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
 export { ModelResolutionError, ModelResolver, normalizeModelName } from "./model-resolver.js";
 export { FALLBACK_MODELS } from "./models.js";
 export { toKiroGenerateRequest } from "./request-adapter.js";

package/dist/index.js

@@ -2,7 +2,7 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";
@@ -10,7 +10,7 @@ export { getKiroCliStatus, getKiroCliVersion } from "./kiro-cli.js";
 export { additionalModelRequestFields, CodeWhispererKiroTransport, collectAssistantText, createCodeWhispererClient, streamAssistantText, toGenerateAssistantResponseInput, usageFromMetadataEvent, } from "./kiro-transport.js";
 export { KiroRestTransport, toKiroRestPayload } from "./kiro-rest-transport.js";
 export { ModelCache } from "./model-cache.js";
-export { discoverModelsFromCommand, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
+export { discoverModelsFromCommand, isModelDiscoveryAuthFailure, parseDiscoveredModels, refreshModelCacheFromCommand } from "./model-discovery.js";
 export { ModelResolutionError, ModelResolver, normalizeModelName } from "./model-resolver.js";
 export { FALLBACK_MODELS } from "./models.js";
 export { toKiroGenerateRequest } from "./request-adapter.js";

package/dist/kiro-rest-transport.d.ts

@@ -17,7 +17,7 @@ export type KiroRestFetch = (input: RequestInfo | URL, init?: RequestInit) => Pr
 export interface KiroRestTransportDependencies {
     readonly fetcher?: KiroRestFetch;
     readonly credentialProvider?: KiroCredentialProvider;
-    readonly loginStarter?: () => void;
+    readonly login?: () => Promise<boolean>;
 }
 export declare function toKiroRestPayload(request: KiroGenerateRequest, profileArn?: string): Record<string, unknown>;
 export declare class KiroRestTransport implements KiroTransport {

package/dist/kiro-rest-transport.js

@@ -1,5 +1,5 @@
 import { KiroPluginError } from "./errors.js";
-import { readKiroCliSessionCredential, regionFromProfileArn, startKiroCliLoginOnce, } from "./auth.js";
+import { readKiroCliSessionCredential, regionFromProfileArn, runKiroLoginFlowOnce, } from "./auth.js";
 const DEFAULT_USER_AGENT = "KiroIDE";
 const DEFAULT_AGENT_MODE = "vibe";
 const STREAMING_SDK_VERSION = "1.0.34";
@@ -313,28 +313,17 @@ export class KiroRestTransport {
     #options;
     #fetcher;
     #credentialProvider;
-    #loginStarter;
+    #login;
     constructor(options, dependencies = {}) {
         this.#options = options;
         this.#fetcher = dependencies.fetcher ?? fetch;
         this.#credentialProvider = dependencies.credentialProvider ?? (() => readKiroCliSessionCredential());
-        this.#loginStarter = dependencies.loginStarter ?? (() => {
-            startKiroCliLoginOnce();
-        });
-    }
-    #startLoginAfterAuthFailure() {
-        try {
-            this.#loginStarter();
-        }
-        catch {
-            // Keep the original model-call auth error visible to OpenCode.
-        }
+        this.#login = dependencies.login ?? runKiroLoginFlowOnce;
     }
     async #credentials() {
         const session = this.#options.accessToken ? undefined : await this.#credentialProvider();
         const accessToken = this.#options.accessToken ?? session?.accessToken;
         if (!accessToken) {
-            this.#startLoginAfterAuthFailure();
             throw new KiroPluginError("No Kiro API token or Kiro CLI session token found. Connect Kiro from OpenCode's provider connector or run `kiro-cli login`.", "KIRO_AUTH_ERROR", 401);
         }
         const profileArn = this.#options.profileArn ?? session?.profileArn;
@@ -347,7 +336,7 @@ export class KiroRestTransport {
     async generate(request) {
         return collectChunks(this.stream(request), request.modelId);
     }
-    async *stream(request) {
+    async *#streamOnce(request) {
         const credentials = await this.#credentials();
         const payload = toKiroRestPayload(request, credentials.profileArn);
         let lastError;
@@ -368,8 +357,6 @@ export class KiroRestTransport {
                 lastError = new KiroPluginError(message, code, response.status);
                 if (response.status === 429 || response.status >= 500)
                     continue;
-                if (code === "KIRO_AUTH_ERROR")
-                    this.#startLoginAfterAuthFailure();
                 throw lastError;
             }
             if (!response.body)
@@ -424,4 +411,17 @@ export class KiroRestTransport {
         if (lastError)
             throw lastError;
     }
+    async *stream(request) {
+        try {
+            yield* this.#streamOnce(request);
+        }
+        catch (error) {
+            if (!(error instanceof KiroPluginError) || error.code !== "KIRO_AUTH_ERROR")
+                throw error;
+            const authenticated = await this.#login();
+            if (!authenticated)
+                throw error;
+            yield* this.#streamOnce(request);
+        }
+    }
 }

package/dist/model-discovery.d.ts

@@ -1,5 +1,12 @@
 import type { CommandRunner } from "./auth.js";
 import type { CachedModelInfo, ModelCache } from "./model-cache.js";
+export type KiroLoginFlowRunner = () => Promise<boolean>;
+export interface ModelDiscoveryCommandOptions {
+    readonly runner?: CommandRunner;
+    readonly loginOnAuthFailure?: boolean;
+    readonly login?: KiroLoginFlowRunner;
+}
 export declare function parseDiscoveredModels(raw: string): CachedModelInfo[];
-export declare function discoverModelsFromCommand(command: string, args: ReadonlyArray<string>, runner?: CommandRunner): Promise<CachedModelInfo[]>;
-export declare function refreshModelCacheFromCommand(cache: ModelCache, command: string, args: ReadonlyArray<string>, runner?: CommandRunner): Promise<CachedModelInfo[]>;
+export declare function isModelDiscoveryAuthFailure(output: string): boolean;
+export declare function discoverModelsFromCommand(command: string, args: ReadonlyArray<string>, runnerOrOptions?: CommandRunner | ModelDiscoveryCommandOptions): Promise<CachedModelInfo[]>;
+export declare function refreshModelCacheFromCommand(cache: ModelCache, command: string, args: ReadonlyArray<string>, runnerOrOptions?: CommandRunner | ModelDiscoveryCommandOptions): Promise<CachedModelInfo[]>;

package/dist/model-discovery.js

@@ -1,4 +1,4 @@
-import { runCommand } from "./auth.js";
+import { runCommand, runKiroLoginFlowOnce } from "./auth.js";
 import { normalizeModelName } from "./model-resolver.js";
 function record(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
@@ -76,17 +76,39 @@ export function parseDiscoveredModels(raw) {
     }
     return dedupe(fromLines(trimmed));
 }
+export function isModelDiscoveryAuthFailure(output) {
+    const text = output.toLowerCase();
+    return (text.includes("not logged in") ||
+        text.includes("not authenticated") ||
+        text.includes("unauthorized") ||
+        text.includes("authorization") ||
+        text.includes("authentication") ||
+        text.includes("auth token") ||
+        text.includes("token expired") ||
+        text.includes("expired token"));
+}
 function dedupe(models) {
     return [...new Map(models.map((model) => [model.id, model])).values()].sort((a, b) => a.id.localeCompare(b.id));
 }
-export async function discoverModelsFromCommand(command, args, runner = runCommand) {
+export async function discoverModelsFromCommand(command, args, runnerOrOptions = runCommand) {
+    const options = typeof runnerOrOptions === "function" ? { runner: runnerOrOptions } : runnerOrOptions;
+    const runner = options.runner ?? runCommand;
     const result = await runner(command, [...args]);
-    if (!result.ok)
-        return [];
+    if (!result.ok) {
+        if (!options.loginOnAuthFailure || !isModelDiscoveryAuthFailure(`${result.stdout}\n${result.stderr}`))
+            return [];
+        const loggedIn = await (options.login ?? runKiroLoginFlowOnce)();
+        if (!loggedIn)
+            return [];
+        const retry = await runner(command, [...args]);
+        if (!retry.ok)
+            return [];
+        return parseDiscoveredModels(retry.stdout);
+    }
     return parseDiscoveredModels(result.stdout);
 }
-export async function refreshModelCacheFromCommand(cache, command, args, runner = runCommand) {
-    const models = await discoverModelsFromCommand(command, args, runner);
+export async function refreshModelCacheFromCommand(cache, command, args, runnerOrOptions = runCommand) {
+    const models = await discoverModelsFromCommand(command, args, runnerOrOptions);
     if (models.length > 0)
         cache.update(models);
     return models;

package/dist/plugin.js

@@ -9,6 +9,8 @@ import { ModelCache } from "./model-cache.js";
 import { refreshModelCacheFromCommand } from "./model-discovery.js";
 import { ModelResolver, normalizeModelName } from "./model-resolver.js";
 import { KiroRestTransport } from "./kiro-rest-transport.js";
+const PLACEHOLDER_MODEL_ID = "auto";
+const PLACEHOLDER_MODEL = { name: "Auto" };
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -33,7 +35,7 @@ function modelRecord(value) {
 function visibleProviderModels(cache, configuredModels, hiddenModels, disabledModels) {
     const discovered = discoveredProviderModels(cache);
     const modelIDs = new Set([...Object.keys(discovered), ...Object.keys(configuredModels), ...Object.keys(hiddenModels)]);
-    return Object.fromEntries([...modelIDs]
+    const models = Object.fromEntries([...modelIDs]
         .filter((id) => !disabledModels.has(normalizeModelName(id)))
         .map((id) => [
         id,
@@ -42,6 +44,9 @@ function visibleProviderModels(cache, configuredModels, hiddenModels, disabledMo
             ...(configuredModels[id] ?? {}),
         },
     ]));
+    if (Object.keys(models).length > 0 || disabledModels.has(PLACEHOLDER_MODEL_ID))
+        return models;
+    return { [PLACEHOLDER_MODEL_ID]: PLACEHOLDER_MODEL };
 }
 function bearerToken(init) {
     const header = new Headers(init?.headers).get("authorization");
@@ -110,11 +115,11 @@ export function createKiroPlugin() {
         const discoverIfStale = async () => {
             if (options.modelDiscovery === "off" ||
                 options.modelDiscoveryCommand.length === 0 ||
-                (discoveryAttempted && !modelCache.isStale())) {
+                discoveryAttempted) {
                 return;
             }
             discoveryAttempted = true;
-            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1), { loginOnAuthFailure: true })
                 .catch(() => undefined)
                 .then(() => {
                 discovery = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.0",
+  "version": "0.3.5",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",
@@ -36,12 +36,12 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bogyie/opencode-kiro-plugin.git"
+    "url": "git+https://github.com/Bogyie/opencode-kiro-plugin.git"
   },
   "bugs": {
-    "url": "https://github.com/bogyie/opencode-kiro-plugin/issues"
+    "url": "https://github.com/Bogyie/opencode-kiro-plugin/issues"
   },
-  "homepage": "https://github.com/bogyie/opencode-kiro-plugin#readme",
+  "homepage": "https://github.com/Bogyie/opencode-kiro-plugin#readme",
   "license": "MIT",
   "publishConfig": {
     "access": "public",