@bogyie/opencode-kiro-plugin 0.3.16 → 0.3.18

package/README.md

@@ -38,9 +38,26 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-OpenCode startup does not start Kiro login. It does run best-effort model discovery with `kiro-cli chat --list-models --format json` so the model picker can track the current Kiro CLI list. If startup discovery succeeds, the result is stored in a local cache and used immediately. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
+During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. It then runs best-effort model discovery with `kiro-cli chat --list-models --format json` so the model picker can track the current Kiro CLI list. If startup discovery succeeds, the result is stored in a local cache and used immediately. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. Configure `login.method` as `builder-id`, `google`, `github`, or `organization` to preselect the Kiro CLI login method. The plugin maps `builder-id`, `google`, and `github` to `--license free`; it maps `organization` to `--license pro`. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are also passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+
+For personal Kiro login with GitHub:
+
+```jsonc
+{
+  "plugin": [
+    [
+      "@bogyie/opencode-kiro-plugin",
+      {
+        "login": {
+          "method": "github"
+        }
+      }
+    ]
+  ]
+}
+```
 
 For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
@@ -52,7 +69,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
       {
         "region": "ap-northeast-2",
         "login": {
-          "license": "pro",
+          "method": "organization",
           "identityProvider": "https://example.awsapps.com/start",
           "region": "ap-northeast-2"
         }
@@ -62,7 +79,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, configure `login.identityProvider` and `login.region` in plugin options so they are passed to `kiro-cli login --use-device-flow`.
+For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options so they are passed to `kiro-cli login --license pro --use-device-flow`.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory and stored model cache. Secrets are redacted in diagnostics.
 
@@ -80,7 +97,7 @@ Configure the backend through plugin options:
         "region": "us-east-1",
         // Optional Kiro device login defaults:
         // "login": {
-        //   "license": "pro",
+        //   "method": "organization",
         //   "identityProvider": "https://example.awsapps.com/start",
         //   "region": "ap-northeast-2"
         // },
@@ -155,7 +172,7 @@ This keeps new Kiro model ids usable before the package is updated without adver
 
 The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. Discovery is best-effort and does not start login during OpenCode startup. `/v1/models` also uses only this discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a Kiro login window. Authenticate manually through the connector or let a real chat completion request handle auth failure. A successful connector login also triggers a forced model refresh. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. `/v1/models` still uses only the discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a second Kiro login window. A successful connector login also triggers a forced model refresh. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/auth.d.ts

@@ -38,7 +38,9 @@ export interface KiroLoginSession {
     waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
+export type KiroCliLoginMethod = "builder-id" | "google" | "github" | "organization";
 export interface KiroCliLoginOptions {
+    readonly method?: KiroCliLoginMethod;
     readonly license?: "free" | "pro";
     readonly identityProvider?: string;
     readonly region?: string;

package/dist/auth.js

@@ -412,7 +412,7 @@ export function extractKiroLoginCode(output) {
     return /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
 }
 function defaultSpawner(command, args) {
-    return spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] });
+    return spawn(command, [...args], { stdio: ["pipe", "pipe", "pipe"] });
 }
 function loginKey(options = {}) {
     return JSON.stringify(kiroCliLoginArgs(options));
@@ -424,8 +424,9 @@ function loginOptionsAndSpawner(optionsOrSpawner, spawner) {
 }
 export function kiroCliLoginArgs(options = {}) {
     const args = ["login"];
-    if (options.license)
-        args.push("--license", options.license);
+    const license = options.license ?? (options.method === "organization" ? "pro" : options.method ? "free" : undefined);
+    if (license)
+        args.push("--license", license);
     if (options.identityProvider)
         args.push("--identity-provider", options.identityProvider);
     if (options.region)
@@ -435,17 +436,45 @@ export function kiroCliLoginArgs(options = {}) {
     args.push(...(options.extraArgs ?? []));
     return args;
 }
+function loginMethodSelection(method) {
+    switch (method) {
+        case "builder-id":
+            return "\r";
+        case "google":
+            return "\x1B[B\r";
+        case "github":
+            return "\x1B[B\x1B[B\r";
+        case "organization":
+            return "\x1B[B\x1B[B\x1B[B\r";
+    }
+}
+function loginMethodPromptSeen(output) {
+    return (output.includes("Select login method") ||
+        output.includes("Use with Builder ID") ||
+        output.includes("Use with Google") ||
+        output.includes("Use with GitHub") ||
+        output.includes("Use with Your Organization"));
+}
 export function startKiroCliLogin(optionsOrSpawner, spawner) {
     const resolved = loginOptionsAndSpawner(optionsOrSpawner, spawner);
     const child = resolved.spawner("kiro-cli", kiroCliLoginArgs(resolved.options));
     let output = "";
     let exited = false;
     let exitCode = null;
+    let selectedLoginMethod = false;
+    const maybeSelectLoginMethod = () => {
+        if (!resolved.options.method || selectedLoginMethod || !loginMethodPromptSeen(output))
+            return;
+        child.stdin?.write(loginMethodSelection(resolved.options.method));
+        selectedLoginMethod = true;
+    };
     child.stdout?.on("data", (chunk) => {
         output += chunk.toString("utf8");
+        maybeSelectLoginMethod();
     });
     child.stderr?.on("data", (chunk) => {
         output += chunk.toString("utf8");
+        maybeSelectLoginMethod();
     });
     child.on("exit", (code) => {
         exited = true;

package/dist/config.js

@@ -5,6 +5,7 @@ export const DEFAULT_MODEL_CACHE_TTL_SECONDS = 6 * 60 * 60;
 export const DEFAULT_MAX_ATTEMPTS = 3;
 const BACKENDS = new Set(["auto", "fetch", "cli-chat", "acp"]);
 const DISCOVERY_MODES = new Set(["auto", "off"]);
+const LOGIN_METHODS = new Set(["builder-id", "google", "github", "organization"]);
 function stringRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return {};
@@ -45,11 +46,15 @@ function optionalString(value) {
 }
 function loginOptions(value) {
     const input = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    const method = typeof input.method === "string" && LOGIN_METHODS.has(input.method)
+        ? input.method
+        : undefined;
     const license = input.license === "free" || input.license === "pro" ? input.license : undefined;
     const identityProvider = optionalString(input.identityProvider);
     const region = optionalString(input.region);
     const extraArgs = stringArray(input.extraArgs);
     return {
+        ...(method ? { method } : {}),
         ...(license ? { license } : {}),
         ...(identityProvider ? { identityProvider } : {}),
         ...(region ? { region } : {}),

package/dist/plugin.js

@@ -148,6 +148,8 @@ export function createKiroPlugin() {
         }
         let discovery;
         let lastModelDiscoveryAt = 0;
+        let startupLogin;
+        let startupLoginAttempted = false;
         const refreshModels = async (force = false) => {
             const discoveryIsStale = lastModelDiscoveryAt === 0 || Date.now() - lastModelDiscoveryAt > options.modelCacheTtlSeconds * 1000;
             if (options.modelDiscovery === "off" || options.modelDiscoveryCommand.length === 0 || (!force && !discoveryIsStale)) {
@@ -170,6 +172,29 @@ export function createKiroPlugin() {
             }
             return discovery;
         };
+        const ensureStartupAuthenticated = async () => {
+            const current = await detectAuth().catch(() => undefined);
+            if (current?.authenticated)
+                return true;
+            if (startupLogin)
+                return startupLogin;
+            if (startupLoginAttempted)
+                return false;
+            startupLoginAttempted = true;
+            startupLogin = (async () => {
+                const session = startKiroCliLoginOnce({
+                    ...options.login,
+                    useDeviceFlow: true,
+                });
+                const prompted = await session.waitForPrompt(options.requestTimeoutMs);
+                if (!prompted)
+                    return false;
+                return session.waitForAuth();
+            })().finally(() => {
+                startupLogin = undefined;
+            });
+            return startupLogin;
+        };
         const resolver = new ModelResolver({
             cache: modelCache,
             aliases: options.modelAliases,
@@ -227,6 +252,7 @@ export function createKiroPlugin() {
                 localServer = undefined;
             },
             config: async (config) => {
+                await ensureStartupAuthenticated();
                 await refreshModels();
                 config.provider ??= {};
                 config.provider[options.providerID] ??= {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",
@@ -60,6 +60,7 @@
     "type": "plugin",
     "hooks": [
       "auth",
+      "chat.headers",
       "config",
       "provider",
       "tool"