@bogyie/opencode-kiro-plugin 0.3.21 → 0.3.23

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. It then runs best-effort model discovery with `kiro-cli chat --list-models --format json` so the model picker can track the current Kiro CLI list. If startup discovery succeeds, the result is stored in a local cache and used immediately. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
+During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured login flow once and waits for completion before provider registration continues. Personal login methods use `kiro-cli login --use-device-flow`. IAM Identity Center login uses direct OIDC device authorization for the configured Start URL and region, so it opens the Identity Center device URL and avoids localhost callback failures. After auth succeeds, startup runs best-effort model discovery with `kiro-cli chat --list-models --format json` when the Kiro CLI session is available. If startup discovery fails, the plugin keeps the last stored model list. If no stored list exists yet, it injects an `auto` placeholder model so Kiro still appears in OpenCode's provider connector.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector runs `kiro-cli login --use-device-flow`, waits for the local Kiro CLI session to become authenticated, then stores a local transport marker in OpenCode auth. Configure `login.method` as `builder-id`, `google`, `github`, or `organization` to preselect the Kiro CLI login method. The plugin maps `builder-id`, `google`, and `github` to `--license free`; it maps `organization` to `--license pro`. If `login.identityProvider`, `login.region`, `login.license`, or `login.extraArgs` are configured, those options are also passed to `kiro-cli login` along with `--use-device-flow`. After login succeeds, the plugin also tries to refresh the runtime model cache. If no OpenCode connector marker or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the same configured Kiro CLI login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. Personal login methods use `kiro-cli login --use-device-flow`, wait for the local Kiro CLI session to become authenticated, then store a local transport marker in OpenCode auth. IAM Identity Center login uses the OIDC device authorization flow directly, waits for token completion, and stores a `kiro-device:` credential in OpenCode auth. Configure `login.method` as `builder-id`, `google`, `github`, or `organization` to preselect the login method. The plugin maps `builder-id`, `google`, and `github` to `--license free`; it maps `organization` to the IAM Identity Center device flow. If no OpenCode connector credential or API key is configured, direct fetch still reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call using a CLI-backed local transport fails with an auth error, the selected transport starts the configured Kiro CLI login flow and retries the request once. Requests using stored `kiro-device:` credentials refresh tokens directly and do not fall back to opening Kiro CLI login pages. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For personal Kiro login with GitHub:
 
@@ -59,7 +59,7 @@ For personal Kiro login with GitHub:
 }
 ```
 
-For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
+For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the Kiro LLM API region:
 
 ```jsonc
 {
@@ -67,7 +67,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
     [
       "@bogyie/opencode-kiro-plugin",
       {
-        "region": "ap-northeast-2",
+        "region": "us-east-1",
         "login": {
           "method": "organization",
           "identityProvider": "https://example.awsapps.com/start",
@@ -79,7 +79,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options so they are passed to `kiro-cli login --use-device-flow --license pro --identity-provider <start-url> --region <region>`.
+For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options. The top-level `region` controls the Kiro LLM/API endpoint and should usually remain `us-east-1`; `login.region` controls the IAM Identity Center OIDC/device authorization endpoint, for example `ap-northeast-2`. The connector opens the Identity Center device URL for that Start URL and login region, then waits until the device authorization completes.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory and stored model cache. Secrets are redacted in diagnostics.
 
@@ -122,7 +122,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. At startup, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` and stores successful results in a local cache. Failed refreshes do not clear the last successful cache. If there is no successful cache yet, startup falls back to the `auto` placeholder so the provider can still be connected before discovery succeeds.
+The resolver intentionally avoids a hard whitelist. At startup, after auth succeeds, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` when `kiro-cli whoami` succeeds, then stores successful results in a local cache. Direct IAM Identity Center device auth is available immediately for chat requests, but it does not write a Kiro CLI session, so CLI-based model discovery may keep using the previous cache until the Kiro CLI is also logged in. Failed or skipped refreshes do not clear the last successful cache. If there is no successful cache yet, startup falls back to the `auto` placeholder so the provider can still be connected before discovery succeeds.
 
 Useful options:
 
@@ -172,7 +172,7 @@ This keeps new Kiro model ids usable before the package is updated without adver
 
 The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. During OpenCode startup, the plugin checks Kiro auth in the blocking `config` hook. If no `KIRO_API_KEY` or active `kiro-cli` session exists, it starts the configured `kiro-cli login --use-device-flow` flow once and waits for login to finish before model discovery and provider registration continue. `/v1/models` still uses only the discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a second Kiro login window. A successful connector login also triggers a forced model refresh. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable startup discovery and `kiro_refresh_models`; in that mode the plugin uses any stored cache and then the `auto` fallback. `/v1/models` uses only the discovery/cache path: it never invokes the chat transport or login fallback, and returns the cached list or `auto` if discovery fails. For the default Kiro CLI discovery command, startup and forced refresh first check `kiro-cli whoami`; if the CLI is not authenticated, discovery is skipped instead of prompting for another login. OpenCode title-generation requests also suppress login fallback so startup helper traffic cannot open a second Kiro login window. A successful connector login also triggers a forced model refresh only when that refresh can run without prompting. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 
@@ -183,6 +183,8 @@ The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCo
 - `KIRO_ACP_TIMEOUT`: ACP did not send a `TurnEnd` notification before the prompt timeout.
 - `KIRO_ACP_PROCESS_ERROR` or `KIRO_ACP_PROCESS_EXITED`: `kiro-cli acp` could not start or exited while a request was pending.
 
+If IAM Identity Center login succeeds but chat requests cannot connect or fail against the LLM endpoint, check that top-level `region` is the Kiro LLM/API region, not necessarily the IAM Identity Center region. A common organization setup is `"region": "us-east-1"` with `"login.region": "ap-northeast-2"`.
+
 Direct fetch mode calls Kiro's `generateAssistantResponse` endpoint and can fall back from the `q` endpoint to the CodeWhisperer endpoint on quota or upstream failures. Tune `maxAttempts` and `requestTimeoutMs` if you need stricter failure boundaries in automation. Fetch mode also accepts `endpoint`, `profileArn`, `userAgent`, and `agentMode` for controlled environments. `cli-chat` uses `requestTimeoutMs` for the `kiro-cli chat --no-interactive` child process, and ACP uses it while waiting for `session/prompt` completion and `TurnEnd`.
 
 OpenAI-compatible `temperature`, `max_tokens`, and `max_completion_tokens` are preserved for direct fetch mode through Kiro's `inferenceConfig` fields on a best-effort basis.

package/dist/plugin.d.ts

@@ -4,6 +4,7 @@ import type { KiroPluginOptions } from "./config.js";
 import type { KiroRestTransportOptions } from "./kiro-rest-transport.js";
 type EffectiveBackend = "fetch" | "cli-chat" | "acp" | "none";
 export declare function effectiveBackend(options: Pick<KiroPluginOptions, "backend">, accessToken?: string): EffectiveBackend;
+export declare function __resetKiroPluginSharedStateForTest(): void;
 export declare function acpTransportOptions(options: Pick<KiroPluginOptions, "requestTimeoutMs" | "trustAllTools">): KiroAcpTransportOptions;
 export declare function fetchTransportOptions(options: Pick<KiroPluginOptions, "region" | "endpoint" | "profileArn" | "userAgent" | "agentMode" | "maxAttempts" | "requestTimeoutMs">, accessToken?: string): KiroRestTransportOptions;
 export declare function createKiroPlugin(): Plugin;

package/dist/plugin.js

@@ -1,4 +1,5 @@
 import { tool } from "@opencode-ai/plugin";
+import { spawn } from "node:child_process";
 import { KiroAcpTransport } from "./acp-transport.js";
 import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, KIRO_LOCAL_TRANSPORT_KEY, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, startKiroCliLoginOnce, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
@@ -15,6 +16,7 @@ const PLACEHOLDER_MODEL = { name: "Auto" };
 const OPENCODE_AGENT_HEADER = "x-opencode-kiro-agent";
 const LOGIN_SUPPRESSED_AGENTS = new Set(["title"]);
 const LOGIN_METHODS = new Set(["builder-id", "google", "github", "organization"]);
+let sharedDeviceAuthKey;
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -99,6 +101,26 @@ function loginOptions(base, inputs) {
 function isOrganizationLogin(login) {
     return login.method === "organization" || login.license === "pro" || Boolean(login.identityProvider || login.region);
 }
+function isKiroCliModelDiscoveryCommand(command) {
+    const executable = command[0]?.split(/[\\/]/).pop();
+    return executable === "kiro-cli" && command.includes("chat") && command.includes("--list-models");
+}
+function openExternalUrl(url) {
+    if (process.env.OPENCODE_KIRO_BROWSER_OPEN === "0")
+        return;
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => undefined);
+    child.unref();
+}
+function rememberDeviceAuthKey(key) {
+    sharedDeviceAuthKey = key;
+    return key;
+}
+export function __resetKiroPluginSharedStateForTest() {
+    sharedDeviceAuthKey = undefined;
+}
 function loginPrompts(options) {
     const prompts = [];
     const login = options.login;
@@ -145,6 +167,8 @@ function localTransport(options, accessToken, behavior = {}) {
     const login = () => {
         if (behavior.loginOnAuthFailure === false)
             return Promise.resolve(false);
+        if (isKiroDeviceAuthKey(accessToken))
+            return Promise.resolve(false);
         return runKiroLoginFlowOnce({
             login: loginOptions(options.login),
         });
@@ -207,6 +231,7 @@ export function createKiroPlugin() {
         }
         let discovery;
         let lastModelDiscoveryAt = 0;
+        let startupDeviceAuthKey = sharedDeviceAuthKey;
         let startupLogin;
         let startupLoginAttempted = false;
         const refreshModels = async (force = false) => {
@@ -215,7 +240,14 @@ export function createKiroPlugin() {
                 return [];
             }
             if (!discovery) {
-                discovery = discoverModelsFromCommand(options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+                discovery = (async () => {
+                    if (isKiroCliModelDiscoveryCommand(options.modelDiscoveryCommand)) {
+                        const auth = await detectAuth().catch(() => undefined);
+                        if (!auth?.authenticated)
+                            return [];
+                    }
+                    return discoverModelsFromCommand(options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1));
+                })()
                     .then((models) => {
                     if (models.length > 0) {
                         lastModelDiscoveryAt = Date.now();
@@ -232,6 +264,9 @@ export function createKiroPlugin() {
             return discovery;
         };
         const ensureStartupAuthenticated = async () => {
+            startupDeviceAuthKey ??= sharedDeviceAuthKey;
+            if (startupDeviceAuthKey)
+                return true;
             const current = await detectAuth().catch(() => undefined);
             if (current?.authenticated)
                 return true;
@@ -241,7 +276,23 @@ export function createKiroPlugin() {
                 return false;
             startupLoginAttempted = true;
             startupLogin = (async () => {
-                const session = startKiroCliLoginOnce(loginOptions(options.login));
+                const login = loginOptions(options.login);
+                if (isOrganizationLogin(login) && login.identityProvider) {
+                    try {
+                        const authorization = await authorizeKiroDevice(login);
+                        openExternalUrl(kiroDeviceVerificationUrl(login.identityProvider, authorization.userCode));
+                        const credential = await pollKiroDeviceToken(authorization, {
+                            region: options.region,
+                            ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+                        });
+                        startupDeviceAuthKey = rememberDeviceAuthKey(encodeKiroDeviceAuthKey(credential));
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                const session = startKiroCliLoginOnce(login);
                 const prompted = await session.waitForPrompt(options.requestTimeoutMs);
                 if (!prompted)
                     return false;
@@ -258,22 +309,23 @@ export function createKiroPlugin() {
             disabledModels: options.disabledModels,
             disablePassThrough: options.disableModelPassThrough,
         });
+        const localFetch = async (input, init) => {
+            startupDeviceAuthKey ??= sharedDeviceAuthKey;
+            const transport = localTransport(options, bearerToken(init) || startupDeviceAuthKey || sharedDeviceAuthKey, {
+                loginOnAuthFailure: shouldLoginOnAuthFailure(init),
+            });
+            return createKiroFetch({
+                resolver,
+                models: async () => {
+                    await refreshModels(true).catch(() => []);
+                    return Object.keys(visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels));
+                },
+                ...(transport ? { transport } : {}),
+            })(input, init);
+        };
         const ensureLocalServer = async () => {
             if (localServer)
                 return localServer;
-            const localFetch = async (input, init) => {
-                const transport = localTransport(options, bearerToken(init), {
-                    loginOnAuthFailure: shouldLoginOnAuthFailure(init),
-                });
-                return createKiroFetch({
-                    resolver,
-                    models: async () => {
-                        await refreshModels(true).catch(() => []);
-                        return Object.keys(visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels));
-                    },
-                    ...(transport ? { transport } : {}),
-                })(input, init);
-            };
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
@@ -292,10 +344,12 @@ export function createKiroPlugin() {
                                 region: options.region,
                                 ...(options.profileArn ? { profileArn: options.profileArn } : {}),
                             });
+                            const key = rememberDeviceAuthKey(encodeKiroDeviceAuthKey(credential));
+                            startupDeviceAuthKey = key;
                             await refreshModels(true).catch(() => []);
                             return {
                                 type: "success",
-                                key: encodeKiroDeviceAuthKey(credential),
+                                key,
                                 metadata: {
                                     source: "kiro-device-auth",
                                 },
@@ -350,6 +404,8 @@ export function createKiroPlugin() {
                 provider.npm = "@ai-sdk/openai-compatible";
                 provider.api = server.baseURL;
                 provider.options ??= {};
+                provider.options.baseURL = server.baseURL;
+                provider.options.apiKey ??= KIRO_LOCAL_TRANSPORT_KEY;
                 provider.models = visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels);
             },
             auth: {
@@ -382,10 +438,12 @@ export function createKiroPlugin() {
                 ],
                 loader: async (auth) => {
                     const apiKey = await resolveApiKey(auth);
+                    startupDeviceAuthKey ??= sharedDeviceAuthKey;
                     const server = await ensureLocalServer();
                     return {
-                        apiKey: apiKey || KIRO_LOCAL_TRANSPORT_KEY,
+                        apiKey: apiKey || startupDeviceAuthKey || sharedDeviceAuthKey || KIRO_LOCAL_TRANSPORT_KEY,
                         baseURL: server.baseURL,
+                        fetch: localFetch,
                     };
                 },
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",