@bogyie/opencode-kiro-plugin 0.3.22 → 0.3.24

package/README.md

@@ -59,7 +59,7 @@ For personal Kiro login with GitHub:
 }
 ```
 
-For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
+For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the Kiro LLM API region:
 
 ```jsonc
 {
@@ -67,7 +67,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
     [
       "@bogyie/opencode-kiro-plugin",
       {
-        "region": "ap-northeast-2",
+        "region": "us-east-1",
         "login": {
           "method": "organization",
           "identityProvider": "https://example.awsapps.com/start",
@@ -79,7 +79,7 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options. The connector opens the Identity Center device URL for that Start URL and region, then waits until the device authorization completes.
+For IAM Identity Center, configure `login.method: "organization"`, `login.identityProvider`, and `login.region` in plugin options. The top-level `region` controls the Kiro LLM/API endpoint and should usually remain `us-east-1`; `login.region` controls the IAM Identity Center OIDC/device authorization endpoint, for example `ap-northeast-2`. The connector opens the Identity Center device URL for that Start URL and login region, then waits until the device authorization completes.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory and stored model cache. Secrets are redacted in diagnostics.
 
@@ -183,6 +183,8 @@ The plugin injects `provider.kiro` with the `auto` placeholder needed for OpenCo
 - `KIRO_ACP_TIMEOUT`: ACP did not send a `TurnEnd` notification before the prompt timeout.
 - `KIRO_ACP_PROCESS_ERROR` or `KIRO_ACP_PROCESS_EXITED`: `kiro-cli acp` could not start or exited while a request was pending.
 
+If IAM Identity Center login succeeds but chat requests cannot connect or fail against the LLM endpoint, check that top-level `region` is the Kiro LLM/API region, not necessarily the IAM Identity Center region. A common organization setup is `"region": "us-east-1"` with `"login.region": "ap-northeast-2"`.
+
 Direct fetch mode calls Kiro's `generateAssistantResponse` endpoint and can fall back from the `q` endpoint to the CodeWhisperer endpoint on quota or upstream failures. Tune `maxAttempts` and `requestTimeoutMs` if you need stricter failure boundaries in automation. Fetch mode also accepts `endpoint`, `profileArn`, `userAgent`, and `agentMode` for controlled environments. `cli-chat` uses `requestTimeoutMs` for the `kiro-cli chat --no-interactive` child process, and ACP uses it while waiting for `session/prompt` completion and `TurnEnd`.
 
 OpenAI-compatible `temperature`, `max_tokens`, and `max_completion_tokens` are preserved for direct fetch mode through Kiro's `inferenceConfig` fields on a best-effort basis.

package/dist/plugin.d.ts

@@ -4,6 +4,7 @@ import type { KiroPluginOptions } from "./config.js";
 import type { KiroRestTransportOptions } from "./kiro-rest-transport.js";
 type EffectiveBackend = "fetch" | "cli-chat" | "acp" | "none";
 export declare function effectiveBackend(options: Pick<KiroPluginOptions, "backend">, accessToken?: string): EffectiveBackend;
+export declare function __resetKiroPluginSharedStateForTest(): void;
 export declare function acpTransportOptions(options: Pick<KiroPluginOptions, "requestTimeoutMs" | "trustAllTools">): KiroAcpTransportOptions;
 export declare function fetchTransportOptions(options: Pick<KiroPluginOptions, "region" | "endpoint" | "profileArn" | "userAgent" | "agentMode" | "maxAttempts" | "requestTimeoutMs">, accessToken?: string): KiroRestTransportOptions;
 export declare function createKiroPlugin(): Plugin;

package/dist/plugin.js

@@ -16,6 +16,7 @@ const PLACEHOLDER_MODEL = { name: "Auto" };
 const OPENCODE_AGENT_HEADER = "x-opencode-kiro-agent";
 const LOGIN_SUPPRESSED_AGENTS = new Set(["title"]);
 const LOGIN_METHODS = new Set(["builder-id", "google", "github", "organization"]);
+let sharedDeviceAuthKey;
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -64,6 +65,20 @@ function bearerToken(init) {
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
+function isLikelyKiroApiKey(value) {
+    return Boolean(value?.startsWith("ksk_"));
+}
+function localAccessToken(incoming, fallback) {
+    if (!incoming || incoming === KIRO_LOCAL_TRANSPORT_KEY)
+        return fallback ?? incoming;
+    if (isKiroDeviceAuthKey(incoming))
+        return incoming;
+    if (process.env.KIRO_API_KEY && incoming === process.env.KIRO_API_KEY)
+        return incoming;
+    if (isLikelyKiroApiKey(incoming))
+        return incoming;
+    return fallback;
+}
 export function effectiveBackend(options, accessToken) {
     const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
@@ -113,6 +128,13 @@ function openExternalUrl(url) {
     child.on("error", () => undefined);
     child.unref();
 }
+function rememberDeviceAuthKey(key) {
+    sharedDeviceAuthKey = key;
+    return key;
+}
+export function __resetKiroPluginSharedStateForTest() {
+    sharedDeviceAuthKey = undefined;
+}
 function loginPrompts(options) {
     const prompts = [];
     const login = options.login;
@@ -223,7 +245,7 @@ export function createKiroPlugin() {
         }
         let discovery;
         let lastModelDiscoveryAt = 0;
-        let startupDeviceAuthKey;
+        let startupDeviceAuthKey = sharedDeviceAuthKey;
         let startupLogin;
         let startupLoginAttempted = false;
         const refreshModels = async (force = false) => {
@@ -256,6 +278,7 @@ export function createKiroPlugin() {
             return discovery;
         };
         const ensureStartupAuthenticated = async () => {
+            startupDeviceAuthKey ??= sharedDeviceAuthKey;
             if (startupDeviceAuthKey)
                 return true;
             const current = await detectAuth().catch(() => undefined);
@@ -276,7 +299,7 @@ export function createKiroPlugin() {
                             region: options.region,
                             ...(options.profileArn ? { profileArn: options.profileArn } : {}),
                         });
-                        startupDeviceAuthKey = encodeKiroDeviceAuthKey(credential);
+                        startupDeviceAuthKey = rememberDeviceAuthKey(encodeKiroDeviceAuthKey(credential));
                         return true;
                     }
                     catch {
@@ -300,22 +323,24 @@ export function createKiroPlugin() {
             disabledModels: options.disabledModels,
             disablePassThrough: options.disableModelPassThrough,
         });
+        const localFetch = async (input, init) => {
+            startupDeviceAuthKey ??= sharedDeviceAuthKey;
+            const accessToken = localAccessToken(bearerToken(init), startupDeviceAuthKey || sharedDeviceAuthKey);
+            const transport = localTransport(options, accessToken, {
+                loginOnAuthFailure: shouldLoginOnAuthFailure(init),
+            });
+            return createKiroFetch({
+                resolver,
+                models: async () => {
+                    await refreshModels(true).catch(() => []);
+                    return Object.keys(visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels));
+                },
+                ...(transport ? { transport } : {}),
+            })(input, init);
+        };
         const ensureLocalServer = async () => {
             if (localServer)
                 return localServer;
-            const localFetch = async (input, init) => {
-                const transport = localTransport(options, bearerToken(init) || startupDeviceAuthKey, {
-                    loginOnAuthFailure: shouldLoginOnAuthFailure(init),
-                });
-                return createKiroFetch({
-                    resolver,
-                    models: async () => {
-                        await refreshModels(true).catch(() => []);
-                        return Object.keys(visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels));
-                    },
-                    ...(transport ? { transport } : {}),
-                })(input, init);
-            };
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
@@ -334,7 +359,7 @@ export function createKiroPlugin() {
                                 region: options.region,
                                 ...(options.profileArn ? { profileArn: options.profileArn } : {}),
                             });
-                            const key = encodeKiroDeviceAuthKey(credential);
+                            const key = rememberDeviceAuthKey(encodeKiroDeviceAuthKey(credential));
                             startupDeviceAuthKey = key;
                             await refreshModels(true).catch(() => []);
                             return {
@@ -394,6 +419,8 @@ export function createKiroPlugin() {
                 provider.npm = "@ai-sdk/openai-compatible";
                 provider.api = server.baseURL;
                 provider.options ??= {};
+                provider.options.baseURL = server.baseURL;
+                provider.options.apiKey ??= KIRO_LOCAL_TRANSPORT_KEY;
                 provider.models = visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels);
             },
             auth: {
@@ -426,10 +453,12 @@ export function createKiroPlugin() {
                 ],
                 loader: async (auth) => {
                     const apiKey = await resolveApiKey(auth);
+                    startupDeviceAuthKey ??= sharedDeviceAuthKey;
                     const server = await ensureLocalServer();
                     return {
-                        apiKey: apiKey || startupDeviceAuthKey || KIRO_LOCAL_TRANSPORT_KEY,
+                        apiKey: apiKey || startupDeviceAuthKey || sharedDeviceAuthKey || KIRO_LOCAL_TRANSPORT_KEY,
                         baseURL: server.baseURL,
+                        fetch: localFetch,
                     };
                 },
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",