@bogyie/opencode-kiro-plugin 0.3.19 → 0.3.21

package/README.md

@@ -79,7 +79,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options so they are passed to `kiro-cli login --license pro --use-device-flow`.
+For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options so they are passed to `kiro-cli login --use-device-flow --license pro --identity-provider <start-url> --region <region>`.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory and stored model cache. Secrets are redacted in diagnostics.
 
@@ -204,6 +204,21 @@ For a real Kiro smoke test that uses your local `kiro-cli` login, runs runtime m
 npm run smoke:kiro
 ```
 
+For the same real checks under the test runner, including actual `kiro-cli chat --list-models --format json` and real local plugin API calls:
+
+```sh
+npm run test:real
+```
+
+To also run the real IAM Identity Center device login flow and wait for completion, set the explicit opt-in variables:
+
+```sh
+OPENCODE_KIRO_REAL_LOGIN=1 \
+KIRO_REAL_IDENTITY_PROVIDER=https://example.awsapps.com/start \
+KIRO_REAL_IDENTITY_REGION=ap-northeast-2 \
+npm run test:real
+```
+
 For real Kiro/OpenCode validation, use [docs/e2e-validation.md](docs/e2e-validation.md).
 
 ## Release

package/dist/auth.d.ts

@@ -35,6 +35,9 @@ export interface KiroLoginSession {
     readonly url: string;
     readonly code: string | undefined;
     readonly instructions: string;
+    readonly output: string;
+    readonly exitCode: number | null;
+    readonly args: ReadonlyArray<string>;
     waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
@@ -77,6 +80,7 @@ export interface KiroLoginFlowOptions {
     readonly login?: KiroCliLoginOptions;
 }
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
+export declare const KIRO_LOCAL_TRANSPORT_KEY = "kiro-plugin-local-transport";
 export declare const DEFAULT_KIRO_CLI_DB_PATH: string;
 export declare const DEFAULT_KIRO_CLI_TOKEN_KEYS: readonly ["kirocli:odic:token", "codewhisperer:odic:token"];
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;

package/dist/auth.js

@@ -6,6 +6,7 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
+export const KIRO_LOCAL_TRANSPORT_KEY = "kiro-plugin-local-transport";
 export const DEFAULT_KIRO_CLI_DB_PATH = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
 export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer:odic:token"];
 const KIRO_DEVICE_AUTH_KEY_PREFIX = "kiro-device:";
@@ -424,15 +425,20 @@ function loginOptionsAndSpawner(optionsOrSpawner, spawner) {
 }
 export function kiroCliLoginArgs(options = {}) {
     const args = ["login"];
-    const license = options.license ?? (options.method === "organization" ? "pro" : options.method ? "free" : undefined);
+    const license = options.license ??
+        (options.method === "organization" || options.identityProvider || options.region
+            ? "pro"
+            : options.method
+                ? "free"
+                : undefined);
+    if (options.useDeviceFlow)
+        args.push("--use-device-flow");
     if (license)
         args.push("--license", license);
     if (options.identityProvider)
         args.push("--identity-provider", options.identityProvider);
     if (options.region)
         args.push("--region", options.region);
-    if (options.useDeviceFlow)
-        args.push("--use-device-flow");
     args.push(...(options.extraArgs ?? []));
     return args;
 }
@@ -458,13 +464,28 @@ function loginMethodPromptSeen(output) {
 function loginPromptReady(output) {
     return Boolean(extractKiroLoginCode(output) || firstLoginUrl(output));
 }
+function identityPromptSeen(output) {
+    return /enter start url/i.test(output);
+}
+function regionPromptSeen(output) {
+    return /enter region/i.test(output);
+}
+function loginUrl(output, options) {
+    const code = extractKiroLoginCode(output);
+    if (code && options.identityProvider)
+        return kiroDeviceVerificationUrl(options.identityProvider, code);
+    return extractKiroLoginUrl(output);
+}
 export function startKiroCliLogin(optionsOrSpawner, spawner) {
     const resolved = loginOptionsAndSpawner(optionsOrSpawner, spawner);
-    const child = resolved.spawner("kiro-cli", kiroCliLoginArgs(resolved.options));
+    const args = kiroCliLoginArgs(resolved.options);
+    const child = resolved.spawner("kiro-cli", args);
     let output = "";
     let exited = false;
     let exitCode = null;
     let selectedLoginMethod = false;
+    let wroteIdentityProvider = false;
+    let wroteRegion = false;
     const maybeSelectLoginMethod = () => {
         if (!resolved.options.method ||
             resolved.options.method === "organization" ||
@@ -475,13 +496,25 @@ export function startKiroCliLogin(optionsOrSpawner, spawner) {
         child.stdin?.write(loginMethodSelection(resolved.options.method));
         selectedLoginMethod = true;
     };
+    const maybeAnswerIdentityPrompts = () => {
+        if (resolved.options.identityProvider && !wroteIdentityProvider && identityPromptSeen(output)) {
+            child.stdin?.write(`${resolved.options.identityProvider}\n`);
+            wroteIdentityProvider = true;
+        }
+        if (resolved.options.region && !wroteRegion && regionPromptSeen(output)) {
+            child.stdin?.write(`${resolved.options.region}\n`);
+            wroteRegion = true;
+        }
+    };
     child.stdout?.on("data", (chunk) => {
         output += chunk.toString("utf8");
         maybeSelectLoginMethod();
+        maybeAnswerIdentityPrompts();
     });
     child.stderr?.on("data", (chunk) => {
         output += chunk.toString("utf8");
         maybeSelectLoginMethod();
+        maybeAnswerIdentityPrompts();
     });
     child.on("exit", (code) => {
         exited = true;
@@ -489,15 +522,27 @@ export function startKiroCliLogin(optionsOrSpawner, spawner) {
     });
     return {
         get url() {
-            return extractKiroLoginUrl(output);
+            return loginUrl(output, resolved.options);
         },
         get code() {
             return extractKiroLoginCode(output);
         },
         get instructions() {
             const code = extractKiroLoginCode(output);
+            if (code && resolved.options.identityProvider) {
+                return `Open ${kiroDeviceVerificationUrl(resolved.options.identityProvider, code)} and confirm code: ${code}`;
+            }
             return code ? `Enter code: ${code}` : "Complete Kiro CLI login in your browser. This window will close automatically.";
         },
+        get output() {
+            return output;
+        },
+        get exitCode() {
+            return exitCode;
+        },
+        get args() {
+            return args;
+        },
         async waitForPrompt(timeoutMs = 15_000) {
             const deadline = Date.now() + timeoutMs;
             while (Date.now() < deadline) {
@@ -513,7 +558,7 @@ export function startKiroCliLogin(optionsOrSpawner, spawner) {
             const deadline = Date.now() + 10 * 60 * 1000;
             while (Date.now() < deadline) {
                 const auth = await detectAuth(process.env, runner);
-                if (auth.authenticated)
+                if (auth.authenticated && (!loginPromptReady(output) || exited))
                     return true;
                 if (exited && exitCode !== 0 && !loginPromptReady(output))
                     return false;
@@ -541,6 +586,15 @@ export function startKiroCliLoginOnce(optionsOrSpawner, spawner) {
         get instructions() {
             return session.instructions;
         },
+        get output() {
+            return session.output;
+        },
+        get exitCode() {
+            return session.exitCode;
+        },
+        get args() {
+            return session.args;
+        },
         waitForPrompt(timeoutMs) {
             return session.waitForPrompt(timeoutMs);
         },
@@ -630,7 +684,10 @@ export async function resolveApiKey(auth, env = process.env) {
         return env.KIRO_API_KEY;
     try {
         const credential = await auth();
-        return credential.key || credential.access || "";
+        if (credential.type === "api")
+            return credential.key || credential.access || "";
+        const key = credential.key || credential.access || "";
+        return key === KIRO_LOCAL_TRANSPORT_KEY || isKiroDeviceAuthKey(key) ? key : "";
     }
     catch {
         return "";

package/dist/model-discovery.js

@@ -61,18 +61,33 @@ function fromLines(raw) {
         .map(fromItem)
         .filter((item) => item !== undefined);
 }
+function jsonCandidates(raw) {
+    const trimmed = raw.trim();
+    const candidates = [trimmed];
+    const objectStart = trimmed.indexOf("{");
+    const objectEnd = trimmed.lastIndexOf("}");
+    if (objectStart >= 0 && objectEnd > objectStart)
+        candidates.push(trimmed.slice(objectStart, objectEnd + 1));
+    const arrayStart = trimmed.indexOf("[");
+    const arrayEnd = trimmed.lastIndexOf("]");
+    if (arrayStart >= 0 && arrayEnd > arrayStart)
+        candidates.push(trimmed.slice(arrayStart, arrayEnd + 1));
+    return [...new Set(candidates)];
+}
 export function parseDiscoveredModels(raw) {
     const trimmed = raw.trim();
     if (!trimmed)
         return [];
-    try {
-        const parsed = JSON.parse(trimmed);
-        const models = fromJson(parsed);
-        if (models.length > 0)
-            return dedupe(models);
-    }
-    catch {
-        // Fall back to line parsing below.
+    for (const candidate of jsonCandidates(trimmed)) {
+        try {
+            const parsed = JSON.parse(candidate);
+            const models = fromJson(parsed);
+            if (models.length > 0)
+                return dedupe(models);
+        }
+        catch {
+            // Try the next JSON candidate, then fall back to line parsing below.
+        }
     }
     return dedupe(fromLines(trimmed));
 }

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { credentialFromKiroDeviceAuthKey, detectAuth, isKiroDeviceAuthKey, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, KIRO_LOCAL_TRANSPORT_KEY, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -14,6 +14,7 @@ const PLACEHOLDER_MODEL_ID = "auto";
 const PLACEHOLDER_MODEL = { name: "Auto" };
 const OPENCODE_AGENT_HEADER = "x-opencode-kiro-agent";
 const LOGIN_SUPPRESSED_AGENTS = new Set(["title"]);
+const LOGIN_METHODS = new Set(["builder-id", "google", "github", "organization"]);
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -70,7 +71,7 @@ export function effectiveBackend(options, accessToken) {
         return "cli-chat";
     if (options.backend === "fetch")
         return "fetch";
-    if (apiKey && apiKey !== "kiro-plugin-local-transport")
+    if (apiKey && apiKey !== KIRO_LOCAL_TRANSPORT_KEY)
         return "fetch";
     return "fetch";
 }
@@ -78,16 +79,74 @@ function shouldLoginOnAuthFailure(init) {
     const agent = new Headers(init?.headers).get(OPENCODE_AGENT_HEADER);
     return !agent || !LOGIN_SUPPRESSED_AGENTS.has(agent);
 }
+function inputString(inputs, key) {
+    const value = inputs?.[key]?.trim();
+    return value || undefined;
+}
+function loginOptions(base, inputs) {
+    const inputMethod = inputString(inputs, "method");
+    const method = inputMethod && LOGIN_METHODS.has(inputMethod) ? inputMethod : undefined;
+    const identityProvider = inputString(inputs, "identityProvider");
+    const region = inputString(inputs, "region");
+    return {
+        ...base,
+        ...(method ? { method } : {}),
+        ...(identityProvider ? { identityProvider } : {}),
+        ...(region ? { region } : {}),
+        useDeviceFlow: true,
+    };
+}
+function isOrganizationLogin(login) {
+    return login.method === "organization" || login.license === "pro" || Boolean(login.identityProvider || login.region);
+}
+function loginPrompts(options) {
+    const prompts = [];
+    const login = options.login;
+    const hasLoginRoute = Boolean(login.method || login.license || login.identityProvider || login.region);
+    if (!hasLoginRoute) {
+        prompts.push({
+            type: "select",
+            key: "method",
+            message: "Select Kiro login method",
+            options: [
+                { label: "Use with Builder ID", value: "builder-id" },
+                { label: "Use with Google", value: "google" },
+                { label: "Use with GitHub", value: "github" },
+                { label: "Use with Your Organization", value: "organization" },
+            ],
+        });
+    }
+    const organizationIsConfigured = login.method === "organization" || login.license === "pro" || Boolean(login.identityProvider || login.region);
+    const organizationWhen = hasLoginRoute ? undefined : { key: "method", op: "eq", value: "organization" };
+    if (organizationIsConfigured || !hasLoginRoute) {
+        if (!login.identityProvider) {
+            prompts.push({
+                type: "text",
+                key: "identityProvider",
+                message: "IAM Identity Center Start URL",
+                placeholder: "https://example.awsapps.com/start",
+                ...(organizationWhen ? { when: organizationWhen } : {}),
+            });
+        }
+        if (!login.region) {
+            prompts.push({
+                type: "text",
+                key: "region",
+                message: "IAM Identity Center region",
+                placeholder: "ap-northeast-2",
+                ...(organizationWhen ? { when: organizationWhen } : {}),
+            });
+        }
+    }
+    return prompts.length > 0 ? prompts : undefined;
+}
 function localTransport(options, accessToken, behavior = {}) {
     const backend = effectiveBackend(options, accessToken);
     const login = () => {
         if (behavior.loginOnAuthFailure === false)
             return Promise.resolve(false);
         return runKiroLoginFlowOnce({
-            login: {
-                ...options.login,
-                useDeviceFlow: true,
-            },
+            login: loginOptions(options.login),
         });
     };
     if (backend === "acp")
@@ -107,7 +166,7 @@ function localTransport(options, accessToken, behavior = {}) {
                 login,
             });
         }
-        return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
+        return new KiroRestTransport(fetchTransportOptions(options, apiKey === KIRO_LOCAL_TRANSPORT_KEY ? undefined : apiKey), {
             login,
         });
     }
@@ -182,10 +241,7 @@ export function createKiroPlugin() {
                 return false;
             startupLoginAttempted = true;
             startupLogin = (async () => {
-                const session = startKiroCliLoginOnce({
-                    ...options.login,
-                    useDeviceFlow: true,
-                });
+                const session = startKiroCliLoginOnce(loginOptions(options.login));
                 const prompted = await session.waitForPrompt(options.requestTimeoutMs);
                 if (!prompted)
                     return false;
@@ -221,11 +277,37 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
-        const authorizeCliDeviceLogin = async () => {
-            const session = startKiroCliLoginOnce({
-                ...options.login,
-                useDeviceFlow: true,
-            });
+        const authorizeCliDeviceLogin = async (inputs) => {
+            const login = loginOptions(options.login, inputs);
+            if (isOrganizationLogin(login) && login.identityProvider) {
+                const authorization = await authorizeKiroDevice(login);
+                const url = kiroDeviceVerificationUrl(login.identityProvider, authorization.userCode);
+                return {
+                    url,
+                    instructions: `Open ${url} and confirm code: ${authorization.userCode}`,
+                    method: "auto",
+                    callback: async () => {
+                        try {
+                            const credential = await pollKiroDeviceToken(authorization, {
+                                region: options.region,
+                                ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+                            });
+                            await refreshModels(true).catch(() => []);
+                            return {
+                                type: "success",
+                                key: encodeKiroDeviceAuthKey(credential),
+                                metadata: {
+                                    source: "kiro-device-auth",
+                                },
+                            };
+                        }
+                        catch {
+                            return { type: "failed" };
+                        }
+                    },
+                };
+            }
+            const session = startKiroCliLoginOnce(login);
             await session.waitForPrompt(options.requestTimeoutMs);
             return {
                 url: session.url,
@@ -238,7 +320,7 @@ export function createKiroPlugin() {
                     await refreshModels(true).catch(() => []);
                     return {
                         type: "success",
-                        key: "kiro-plugin-local-transport",
+                        key: KIRO_LOCAL_TRANSPORT_KEY,
                         metadata: {
                             source: "kiro-cli-device-flow",
                         },
@@ -246,6 +328,7 @@ export function createKiroPlugin() {
                 },
             };
         };
+        const authPrompts = loginPrompts(options);
         return {
             dispose: async () => {
                 await localServer?.close();
@@ -275,7 +358,8 @@ export function createKiroPlugin() {
                     {
                         type: "oauth",
                         label: "Kiro device login",
-                        authorize: async () => authorizeCliDeviceLogin(),
+                        ...(authPrompts ? { prompts: authPrompts } : {}),
+                        authorize: async (inputs) => authorizeCliDeviceLogin(inputs),
                     },
                     {
                         type: "api",
@@ -300,7 +384,7 @@ export function createKiroPlugin() {
                     const apiKey = await resolveApiKey(auth);
                     const server = await ensureLocalServer();
                     return {
-                        apiKey: apiKey || "kiro-plugin-local-transport",
+                        apiKey: apiKey || KIRO_LOCAL_TRANSPORT_KEY,
                         baseURL: server.baseURL,
                     };
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",
@@ -26,6 +26,7 @@
     "smoke:package": "npm run build && node scripts/smoke-package.mjs",
     "smoke:kiro": "npm run build && node scripts/real-kiro-smoke.mjs",
     "test": "bun test test/*.test.ts",
+    "test:real": "OPENCODE_KIRO_REAL=1 bun test test/real-kiro-cli.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "keywords": [