@bogyie/opencode-kiro-plugin 0.3.20 → 0.3.22

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. It then runs best-effort model discovery with `kiro-cli chat --list-models --format json` so the model picker can track the current Kiro CLI list. If startup discovery succeeds, the result is stored in a local cache and used immediately. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
+During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured login flow once and waits for completion before provider registration continues. Personal login methods use `kiro-cli login --use-device-flow`. IAM Identity Center login uses direct OIDC device authorization for the configured Start URL and region, so it opens the Identity Center device URL and avoids localhost callback failures. After auth succeeds, startup runs best-effort model discovery with `kiro-cli chat --list-models --format json` when the Kiro CLI session is available. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. Configure `login.method` as `builder-id`, `google`, `github`, or `organization` to preselect the Kiro CLI login method. The plugin maps `builder-id`, `google`, and `github` to `--license free`; it maps `organization` to `--license pro`. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are also passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. Personal login methods use `kiro-cli login --use-device-flow`, wait for the local Kiro CLI session to become authenticated, then store a local transport marker in OpenCode auth. IAM Identity Center login uses the OIDC device authorization flow directly, waits for token completion, and stores a `kiro-device:` credential in OpenCode auth. Configure `login.method` as `builder-id`, `google`, `github`, or `organization` to preselect the login method. The plugin maps `builder-id`, `google`, and `github` to `--license free`; it maps `organization` to the IAM Identity Center device flow. If no OpenCode connector credential or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call using a CLI-backed local transport fails with an auth error, the selected transport starts the configured Kiro CLI login flow and retries the request once. Requests using stored `kiro-device:` credentials refresh tokens directly and do not fall back to opening Kiro CLI login pages. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For personal Kiro login with GitHub:
 
@@ -79,7 +79,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options so they are passed to `kiro-cli login --license pro --use-device-flow`.
+For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options. The connector opens the Identity Center device URL for that Start URL and region, then waits until the device authorization completes.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory and stored model cache. Secrets are redacted in diagnostics.
 
@@ -122,7 +122,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. At startup, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` and stores successful results in a local cache. Failed refreshes do not clear the last successful cache. If there is no successful cache yet, startup falls back to the `auto` placeholder so the provider can still be connected before discovery succeeds.
+The resolver intentionally avoids a hard whitelist. At startup, after auth succeeds, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` when `kiro-cli whoami` succeeds, then stores successful results in a local cache. Direct IAM Identity Center device auth is available immediately for chat requests, but it does not write a Kiro CLI session, so CLI-based model discovery may keep using the previous cache until the Kiro CLI is also logged in. Failed or skipped refreshes do not clear the last successful cache. If there is no successful cache yet, startup falls back to the `auto` placeholder so the provider can still be connected before discovery succeeds.
 
 Useful options:
 
@@ -172,7 +172,7 @@ This keeps new Kiro model ids usable before the package is updated without adver
 
 The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. `/v1/models` still uses only the discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a second Kiro login window. A successful connector login also triggers a forced model refresh. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. `/v1/models` uses only the discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. For the default Kiro CLI discovery command, startup and forced refresh first check `kiro-cli whoami`; if the CLI is not authenticated, discovery is skipped instead of prompting for another login. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a second Kiro login window. A successful connector login also triggers a forced model refresh only when that refresh can run without prompting. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 
@@ -204,6 +204,21 @@ For a real Kiro smoke test that uses your local `kiro-cli` login, runs runtime m
 npm run smoke:kiro
 ```
 
+For the same real checks under the test runner, including actual `kiro-cli chat --list-models --format json` and real local plugin API calls:
+
+```sh
+npm run test:real
+```
+
+To also run the real IAM Identity Center device login flow and wait for completion, set the explicit opt-in variables:
+
+```sh
+OPENCODE_KIRO_REAL_LOGIN=1 \
+KIRO_REAL_IDENTITY_PROVIDER=https://example.awsapps.com/start \
+KIRO_REAL_IDENTITY_REGION=ap-northeast-2 \
+npm run test:real
+```
+
 For real Kiro/OpenCode validation, use [docs/e2e-validation.md](docs/e2e-validation.md).
 
 ## Release

package/dist/auth.d.ts

@@ -35,6 +35,9 @@ export interface KiroLoginSession {
     readonly url: string;
     readonly code: string | undefined;
     readonly instructions: string;
+    readonly output: string;
+    readonly exitCode: number | null;
+    readonly args: ReadonlyArray<string>;
     waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }

package/dist/auth.js

@@ -425,15 +425,20 @@ function loginOptionsAndSpawner(optionsOrSpawner, spawner) {
 }
 export function kiroCliLoginArgs(options = {}) {
     const args = ["login"];
-    const license = options.license ?? (options.method === "organization" ? "pro" : options.method ? "free" : undefined);
+    const license = options.license ??
+        (options.method === "organization" || options.identityProvider || options.region
+            ? "pro"
+            : options.method
+                ? "free"
+                : undefined);
+    if (options.useDeviceFlow)
+        args.push("--use-device-flow");
     if (license)
         args.push("--license", license);
     if (options.identityProvider)
         args.push("--identity-provider", options.identityProvider);
     if (options.region)
         args.push("--region", options.region);
-    if (options.useDeviceFlow)
-        args.push("--use-device-flow");
     args.push(...(options.extraArgs ?? []));
     return args;
 }
@@ -459,13 +464,28 @@ function loginMethodPromptSeen(output) {
 function loginPromptReady(output) {
     return Boolean(extractKiroLoginCode(output) || firstLoginUrl(output));
 }
+function identityPromptSeen(output) {
+    return /enter start url/i.test(output);
+}
+function regionPromptSeen(output) {
+    return /enter region/i.test(output);
+}
+function loginUrl(output, options) {
+    const code = extractKiroLoginCode(output);
+    if (code && options.identityProvider)
+        return kiroDeviceVerificationUrl(options.identityProvider, code);
+    return extractKiroLoginUrl(output);
+}
 export function startKiroCliLogin(optionsOrSpawner, spawner) {
     const resolved = loginOptionsAndSpawner(optionsOrSpawner, spawner);
-    const child = resolved.spawner("kiro-cli", kiroCliLoginArgs(resolved.options));
+    const args = kiroCliLoginArgs(resolved.options);
+    const child = resolved.spawner("kiro-cli", args);
     let output = "";
     let exited = false;
     let exitCode = null;
     let selectedLoginMethod = false;
+    let wroteIdentityProvider = false;
+    let wroteRegion = false;
     const maybeSelectLoginMethod = () => {
         if (!resolved.options.method ||
             resolved.options.method === "organization" ||
@@ -476,13 +496,25 @@ export function startKiroCliLogin(optionsOrSpawner, spawner) {
         child.stdin?.write(loginMethodSelection(resolved.options.method));
         selectedLoginMethod = true;
     };
+    const maybeAnswerIdentityPrompts = () => {
+        if (resolved.options.identityProvider && !wroteIdentityProvider && identityPromptSeen(output)) {
+            child.stdin?.write(`${resolved.options.identityProvider}\n`);
+            wroteIdentityProvider = true;
+        }
+        if (resolved.options.region && !wroteRegion && regionPromptSeen(output)) {
+            child.stdin?.write(`${resolved.options.region}\n`);
+            wroteRegion = true;
+        }
+    };
     child.stdout?.on("data", (chunk) => {
         output += chunk.toString("utf8");
         maybeSelectLoginMethod();
+        maybeAnswerIdentityPrompts();
     });
     child.stderr?.on("data", (chunk) => {
         output += chunk.toString("utf8");
         maybeSelectLoginMethod();
+        maybeAnswerIdentityPrompts();
     });
     child.on("exit", (code) => {
         exited = true;
@@ -490,15 +522,27 @@ export function startKiroCliLogin(optionsOrSpawner, spawner) {
     });
     return {
         get url() {
-            return extractKiroLoginUrl(output);
+            return loginUrl(output, resolved.options);
         },
         get code() {
             return extractKiroLoginCode(output);
         },
         get instructions() {
             const code = extractKiroLoginCode(output);
+            if (code && resolved.options.identityProvider) {
+                return `Open ${kiroDeviceVerificationUrl(resolved.options.identityProvider, code)} and confirm code: ${code}`;
+            }
             return code ? `Enter code: ${code}` : "Complete Kiro CLI login in your browser. This window will close automatically.";
         },
+        get output() {
+            return output;
+        },
+        get exitCode() {
+            return exitCode;
+        },
+        get args() {
+            return args;
+        },
         async waitForPrompt(timeoutMs = 15_000) {
             const deadline = Date.now() + timeoutMs;
             while (Date.now() < deadline) {
@@ -542,6 +586,15 @@ export function startKiroCliLoginOnce(optionsOrSpawner, spawner) {
         get instructions() {
             return session.instructions;
         },
+        get output() {
+            return session.output;
+        },
+        get exitCode() {
+            return session.exitCode;
+        },
+        get args() {
+            return session.args;
+        },
         waitForPrompt(timeoutMs) {
             return session.waitForPrompt(timeoutMs);
         },

package/dist/model-discovery.js

@@ -61,18 +61,33 @@ function fromLines(raw) {
         .map(fromItem)
         .filter((item) => item !== undefined);
 }
+function jsonCandidates(raw) {
+    const trimmed = raw.trim();
+    const candidates = [trimmed];
+    const objectStart = trimmed.indexOf("{");
+    const objectEnd = trimmed.lastIndexOf("}");
+    if (objectStart >= 0 && objectEnd > objectStart)
+        candidates.push(trimmed.slice(objectStart, objectEnd + 1));
+    const arrayStart = trimmed.indexOf("[");
+    const arrayEnd = trimmed.lastIndexOf("]");
+    if (arrayStart >= 0 && arrayEnd > arrayStart)
+        candidates.push(trimmed.slice(arrayStart, arrayEnd + 1));
+    return [...new Set(candidates)];
+}
 export function parseDiscoveredModels(raw) {
     const trimmed = raw.trim();
     if (!trimmed)
         return [];
-    try {
-        const parsed = JSON.parse(trimmed);
-        const models = fromJson(parsed);
-        if (models.length > 0)
-            return dedupe(models);
-    }
-    catch {
-        // Fall back to line parsing below.
+    for (const candidate of jsonCandidates(trimmed)) {
+        try {
+            const parsed = JSON.parse(candidate);
+            const models = fromJson(parsed);
+            if (models.length > 0)
+                return dedupe(models);
+        }
+        catch {
+            // Try the next JSON candidate, then fall back to line parsing below.
+        }
     }
     return dedupe(fromLines(trimmed));
 }

package/dist/plugin.js

@@ -1,6 +1,7 @@
 import { tool } from "@opencode-ai/plugin";
+import { spawn } from "node:child_process";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { credentialFromKiroDeviceAuthKey, detectAuth, isKiroDeviceAuthKey, KIRO_LOCAL_TRANSPORT_KEY, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, KIRO_LOCAL_TRANSPORT_KEY, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -14,6 +15,7 @@ const PLACEHOLDER_MODEL_ID = "auto";
 const PLACEHOLDER_MODEL = { name: "Auto" };
 const OPENCODE_AGENT_HEADER = "x-opencode-kiro-agent";
 const LOGIN_SUPPRESSED_AGENTS = new Set(["title"]);
+const LOGIN_METHODS = new Set(["builder-id", "google", "github", "organization"]);
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -78,16 +80,89 @@ function shouldLoginOnAuthFailure(init) {
     const agent = new Headers(init?.headers).get(OPENCODE_AGENT_HEADER);
     return !agent || !LOGIN_SUPPRESSED_AGENTS.has(agent);
 }
+function inputString(inputs, key) {
+    const value = inputs?.[key]?.trim();
+    return value || undefined;
+}
+function loginOptions(base, inputs) {
+    const inputMethod = inputString(inputs, "method");
+    const method = inputMethod && LOGIN_METHODS.has(inputMethod) ? inputMethod : undefined;
+    const identityProvider = inputString(inputs, "identityProvider");
+    const region = inputString(inputs, "region");
+    return {
+        ...base,
+        ...(method ? { method } : {}),
+        ...(identityProvider ? { identityProvider } : {}),
+        ...(region ? { region } : {}),
+        useDeviceFlow: true,
+    };
+}
+function isOrganizationLogin(login) {
+    return login.method === "organization" || login.license === "pro" || Boolean(login.identityProvider || login.region);
+}
+function isKiroCliModelDiscoveryCommand(command) {
+    const executable = command[0]?.split(/[\\/]/).pop();
+    return executable === "kiro-cli" && command.includes("chat") && command.includes("--list-models");
+}
+function openExternalUrl(url) {
+    if (process.env.OPENCODE_KIRO_BROWSER_OPEN === "0")
+        return;
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => undefined);
+    child.unref();
+}
+function loginPrompts(options) {
+    const prompts = [];
+    const login = options.login;
+    const hasLoginRoute = Boolean(login.method || login.license || login.identityProvider || login.region);
+    if (!hasLoginRoute) {
+        prompts.push({
+            type: "select",
+            key: "method",
+            message: "Select Kiro login method",
+            options: [
+                { label: "Use with Builder ID", value: "builder-id" },
+                { label: "Use with Google", value: "google" },
+                { label: "Use with GitHub", value: "github" },
+                { label: "Use with Your Organization", value: "organization" },
+            ],
+        });
+    }
+    const organizationIsConfigured = login.method === "organization" || login.license === "pro" || Boolean(login.identityProvider || login.region);
+    const organizationWhen = hasLoginRoute ? undefined : { key: "method", op: "eq", value: "organization" };
+    if (organizationIsConfigured || !hasLoginRoute) {
+        if (!login.identityProvider) {
+            prompts.push({
+                type: "text",
+                key: "identityProvider",
+                message: "IAM Identity Center Start URL",
+                placeholder: "https://example.awsapps.com/start",
+                ...(organizationWhen ? { when: organizationWhen } : {}),
+            });
+        }
+        if (!login.region) {
+            prompts.push({
+                type: "text",
+                key: "region",
+                message: "IAM Identity Center region",
+                placeholder: "ap-northeast-2",
+                ...(organizationWhen ? { when: organizationWhen } : {}),
+            });
+        }
+    }
+    return prompts.length > 0 ? prompts : undefined;
+}
 function localTransport(options, accessToken, behavior = {}) {
     const backend = effectiveBackend(options, accessToken);
     const login = () => {
         if (behavior.loginOnAuthFailure === false)
             return Promise.resolve(false);
+        if (isKiroDeviceAuthKey(accessToken))
+            return Promise.resolve(false);
         return runKiroLoginFlowOnce({
-            login: {
-                ...options.login,
-                useDeviceFlow: true,
-            },
+            login: loginOptions(options.login),
         });
     };
     if (backend === "acp")
@@ -148,6 +223,7 @@ export function createKiroPlugin() {
         }
         let discovery;
         let lastModelDiscoveryAt = 0;
+        let startupDeviceAuthKey;
         let startupLogin;
         let startupLoginAttempted = false;
         const refreshModels = async (force = false) => {
@@ -156,7 +232,14 @@ export function createKiroPlugin() {
                 return [];
             }
             if (!discovery) {
-                discovery = discoverModelsFromCommand(options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+                discovery = (async () => {
+                    if (isKiroCliModelDiscoveryCommand(options.modelDiscoveryCommand)) {
+                        const auth = await detectAuth().catch(() => undefined);
+                        if (!auth?.authenticated)
+                            return [];
+                    }
+                    return discoverModelsFromCommand(options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1));
+                })()
                     .then((models) => {
                     if (models.length > 0) {
                         lastModelDiscoveryAt = Date.now();
@@ -173,6 +256,8 @@ export function createKiroPlugin() {
             return discovery;
         };
         const ensureStartupAuthenticated = async () => {
+            if (startupDeviceAuthKey)
+                return true;
             const current = await detectAuth().catch(() => undefined);
             if (current?.authenticated)
                 return true;
@@ -182,10 +267,23 @@ export function createKiroPlugin() {
                 return false;
             startupLoginAttempted = true;
             startupLogin = (async () => {
-                const session = startKiroCliLoginOnce({
-                    ...options.login,
-                    useDeviceFlow: true,
-                });
+                const login = loginOptions(options.login);
+                if (isOrganizationLogin(login) && login.identityProvider) {
+                    try {
+                        const authorization = await authorizeKiroDevice(login);
+                        openExternalUrl(kiroDeviceVerificationUrl(login.identityProvider, authorization.userCode));
+                        const credential = await pollKiroDeviceToken(authorization, {
+                            region: options.region,
+                            ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+                        });
+                        startupDeviceAuthKey = encodeKiroDeviceAuthKey(credential);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                const session = startKiroCliLoginOnce(login);
                 const prompted = await session.waitForPrompt(options.requestTimeoutMs);
                 if (!prompted)
                     return false;
@@ -206,7 +304,7 @@ export function createKiroPlugin() {
             if (localServer)
                 return localServer;
             const localFetch = async (input, init) => {
-                const transport = localTransport(options, bearerToken(init), {
+                const transport = localTransport(options, bearerToken(init) || startupDeviceAuthKey, {
                     loginOnAuthFailure: shouldLoginOnAuthFailure(init),
                 });
                 return createKiroFetch({
@@ -221,11 +319,39 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
-        const authorizeCliDeviceLogin = async () => {
-            const session = startKiroCliLoginOnce({
-                ...options.login,
-                useDeviceFlow: true,
-            });
+        const authorizeCliDeviceLogin = async (inputs) => {
+            const login = loginOptions(options.login, inputs);
+            if (isOrganizationLogin(login) && login.identityProvider) {
+                const authorization = await authorizeKiroDevice(login);
+                const url = kiroDeviceVerificationUrl(login.identityProvider, authorization.userCode);
+                return {
+                    url,
+                    instructions: `Open ${url} and confirm code: ${authorization.userCode}`,
+                    method: "auto",
+                    callback: async () => {
+                        try {
+                            const credential = await pollKiroDeviceToken(authorization, {
+                                region: options.region,
+                                ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+                            });
+                            const key = encodeKiroDeviceAuthKey(credential);
+                            startupDeviceAuthKey = key;
+                            await refreshModels(true).catch(() => []);
+                            return {
+                                type: "success",
+                                key,
+                                metadata: {
+                                    source: "kiro-device-auth",
+                                },
+                            };
+                        }
+                        catch {
+                            return { type: "failed" };
+                        }
+                    },
+                };
+            }
+            const session = startKiroCliLoginOnce(login);
             await session.waitForPrompt(options.requestTimeoutMs);
             return {
                 url: session.url,
@@ -246,6 +372,7 @@ export function createKiroPlugin() {
                 },
             };
         };
+        const authPrompts = loginPrompts(options);
         return {
             dispose: async () => {
                 await localServer?.close();
@@ -275,7 +402,8 @@ export function createKiroPlugin() {
                     {
                         type: "oauth",
                         label: "Kiro device login",
-                        authorize: async () => authorizeCliDeviceLogin(),
+                        ...(authPrompts ? { prompts: authPrompts } : {}),
+                        authorize: async (inputs) => authorizeCliDeviceLogin(inputs),
                     },
                     {
                         type: "api",
@@ -300,7 +428,7 @@ export function createKiroPlugin() {
                     const apiKey = await resolveApiKey(auth);
                     const server = await ensureLocalServer();
                     return {
-                        apiKey: apiKey || KIRO_LOCAL_TRANSPORT_KEY,
+                        apiKey: apiKey || startupDeviceAuthKey || KIRO_LOCAL_TRANSPORT_KEY,
                         baseURL: server.baseURL,
                     };
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",
@@ -26,6 +26,7 @@
     "smoke:package": "npm run build && node scripts/smoke-package.mjs",
     "smoke:kiro": "npm run build && node scripts/real-kiro-smoke.mjs",
     "test": "bun test test/*.test.ts",
+    "test:real": "OPENCODE_KIRO_REAL=1 bun test test/real-kiro-cli.test.ts",
     "typecheck": "tsc --noEmit"
   },
   "keywords": [