@bogyie/opencode-kiro-plugin 0.3.10 → 0.3.12

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-OpenCode startup does not start Kiro login or model discovery. The plugin injects a minimal `provider.kiro` shell so Kiro appears in OpenCode's provider connector, but it does not add a default model. Model discovery runs only when you explicitly call the `kiro_refresh_models` plugin tool; if discovery succeeds, later model-list requests use the latest in-memory cache. If discovery fails, the previous cache remains in use.
+OpenCode startup does not start Kiro login or model discovery. The plugin injects `provider.kiro` with an `auto` placeholder model so Kiro appears in OpenCode's provider connector. Model discovery runs only when you explicitly call the `kiro_refresh_models` plugin tool; if discovery succeeds, later model-list requests use the latest in-memory cache. If discovery fails, the previous cache remains in use.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. When `login.identityProvider` and `login.region` are configured, use `Kiro device login (configured)` to start login without re-entering those values. Use `Kiro device login (custom)` only when you need to override the Start URL, OIDC region, or profile ARN for that login. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow from the configured `login` options and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
@@ -62,7 +62,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
+For IAM Identity Center, configure `login.identityProvider` and `login.region` in plugin options so they are passed to `kiro-cli login --use-device-flow`.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory model cache. Secrets are redacted in diagnostics.
 
@@ -105,7 +105,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. Startup does not add a fallback `auto` model. When you run `kiro_refresh_models`, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
+The resolver intentionally avoids a hard whitelist. Startup adds a fallback `auto` model so the provider can be connected before discovery succeeds. When you run `kiro_refresh_models`, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
 
 Useful options:
 
@@ -153,7 +153,7 @@ Resolution order:
 
 This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker after discovery has succeeded. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
 
-The plugin injects only the minimal `provider.kiro` shell needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
+The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
 `modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable `kiro_refresh_models`. Discovery is best-effort and never runs during OpenCode startup; authenticate manually through the connector or let an API/model request handle auth failure. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
+import { credentialFromKiroDeviceAuthKey, detectAuth, isKiroDeviceAuthKey, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -9,6 +9,8 @@ import { ModelCache } from "./model-cache.js";
 import { refreshModelCacheFromCommand } from "./model-discovery.js";
 import { ModelResolver, normalizeModelName } from "./model-resolver.js";
 import { KiroRestTransport } from "./kiro-rest-transport.js";
+const PLACEHOLDER_MODEL_ID = "auto";
+const PLACEHOLDER_MODEL = { name: "Auto" };
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -42,17 +44,15 @@ function visibleProviderModels(cache, configuredModels, hiddenModels, disabledMo
             ...(configuredModels[id] ?? {}),
         },
     ]));
-    return models;
+    if (Object.keys(models).length > 0 || disabledModels.has(PLACEHOLDER_MODEL_ID))
+        return models;
+    return { [PLACEHOLDER_MODEL_ID]: PLACEHOLDER_MODEL };
 }
 function bearerToken(init) {
     const header = new Headers(init?.headers).get("authorization");
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
-function inputString(inputs, key) {
-    const value = inputs?.[key];
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
 export function effectiveBackend(options, accessToken) {
     const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
@@ -160,36 +160,26 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
-        const authorizeDeviceLogin = async (inputs) => {
-            const startUrl = inputString(inputs, "startUrl") ?? options.login.identityProvider;
-            const idcRegion = inputString(inputs, "idcRegion") ?? options.login.region ?? "us-east-1";
-            const profileArn = inputString(inputs, "profileArn") ?? options.profileArn;
-            const authorization = await authorizeKiroDevice({
-                region: idcRegion,
-                ...(startUrl ? { identityProvider: startUrl } : {}),
+        const authorizeCliDeviceLogin = async () => {
+            const session = startKiroCliLoginOnce({
+                ...options.login,
+                useDeviceFlow: true,
             });
-            const url = startUrl ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode) : authorization.verificationUrlComplete;
+            await session.waitForPrompt(options.requestTimeoutMs);
             return {
-                url,
-                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
+                url: session.url,
+                instructions: session.instructions,
                 method: "auto",
                 callback: async () => {
-                    const credential = await pollKiroDeviceToken(authorization, {
-                        region: options.region,
-                        ...(profileArn ? { profileArn } : {}),
-                    });
-                    const key = encodeKiroDeviceAuthKey(credential);
+                    const authenticated = await session.waitForAuth();
+                    if (!authenticated)
+                        return { type: "failed" };
+                    await refreshModels(true).catch(() => []);
                     return {
                         type: "success",
-                        key,
-                        access: key,
-                        refresh: credential.refreshToken,
-                        expires: credential.expiresAt,
+                        key: "kiro-plugin-local-transport",
                         metadata: {
-                            source: "kiro-device-auth",
-                            region: credential.region,
-                            oidcRegion: credential.oidcRegion,
-                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+                            source: "kiro-cli-device-flow",
                         },
                     };
                 },
@@ -221,39 +211,8 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: options.login.identityProvider ? "Kiro device login (configured)" : "Kiro device login",
-                        authorize: async () => authorizeDeviceLogin(),
-                    },
-                    {
-                        type: "oauth",
-                        label: "Kiro device login (custom)",
-                        prompts: [
-                            {
-                                type: "text",
-                                key: "startUrl",
-                                message: options.login.identityProvider
-                                    ? `IAM Identity Center Start URL (current: ${options.login.identityProvider}, leave blank to keep)`
-                                    : "IAM Identity Center Start URL (leave blank for AWS Builder ID)",
-                                placeholder: "https://your-company.awsapps.com/start",
-                            },
-                            {
-                                type: "text",
-                                key: "idcRegion",
-                                message: options.login.region && options.login.region !== "us-east-1"
-                                    ? `IAM Identity Center region (current: ${options.login.region}, leave blank to keep)`
-                                    : "IAM Identity Center region (leave blank for us-east-1)",
-                                placeholder: "us-east-1",
-                            },
-                            {
-                                type: "text",
-                                key: "profileArn",
-                                message: options.profileArn
-                                    ? `Profile ARN (current: ${options.profileArn}, leave blank to keep)`
-                                    : "Profile ARN (optional, improves region/profile routing for IAM Identity Center)",
-                                placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
-                            },
-                        ],
-                        authorize: async (inputs) => authorizeDeviceLogin(inputs),
+                        label: "Kiro device login",
+                        authorize: async () => authorizeCliDeviceLogin(),
                     },
                     {
                         type: "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",