@bogyie/opencode-kiro-plugin 0.3.4 → 0.3.6

package/README.md

@@ -38,9 +38,31 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, OpenCode's startup model discovery may start the same Kiro CLI login flow automatically. The plugin runs `kiro-cli login --use-device-flow`, waits for login to complete through `kiro-cli whoami`, and then runs the model discovery command one more time. If that login fails or times out, discovery fails for that startup attempt; it does not loop.
+When no usable Kiro CLI session is available, OpenCode's startup model discovery may start the same Kiro CLI login flow automatically. The plugin runs `kiro-cli login`, waits for login to complete through `kiro-cli whoami`, and then runs the model discovery command one more time. If that login fails or times out, discovery fails for that startup attempt; it does not loop.
 
-You can also open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The connector flow starts `kiro-cli login --use-device-flow`, waits until the verification URL/device code is visible, returns them to the connector, and then waits until `kiro-cli whoami` succeeds. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If credentials expire during use, direct fetch and `cli-chat` start the shared Kiro login flow, wait for it to complete, and retry the failed request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can also open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The connector flow starts `kiro-cli login`, waits until the login URL/device code is visible, returns it to the connector, and then waits until `kiro-cli whoami` succeeds. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If credentials expire during use, direct fetch and `cli-chat` start the shared Kiro login flow, wait for it to complete, and retry the failed request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+
+For AWS IAM Identity Center login, configure the CLI login arguments separately from the API region:
+
+```jsonc
+{
+  "plugin": [
+    [
+      "@bogyie/opencode-kiro-plugin",
+      {
+        "region": "ap-northeast-2",
+        "login": {
+          "license": "pro",
+          "identityProvider": "https://example.awsapps.com/start",
+          "region": "ap-northeast-2"
+        }
+      }
+    ]
+  ]
+}
+```
+
+This runs `kiro-cli login --license pro --identity-provider https://example.awsapps.com/start --region ap-northeast-2`. Do not enable `login.useDeviceFlow` for the normal browser callback flow; Kiro CLI needs to keep its localhost callback listener alive while the browser redirects back.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -56,6 +78,12 @@ Configure the backend through plugin options:
       {
         "backend": "auto",
         "region": "us-east-1",
+        // Optional Kiro CLI login overrides:
+        // "login": {
+        //   "license": "pro",
+        //   "identityProvider": "https://example.awsapps.com/start",
+        //   "region": "ap-northeast-2"
+        // },
         "endpoint": "https://q.us-east-1.amazonaws.com",
         "maxAttempts": 3,
         "requestTimeoutMs": 120000,

package/dist/auth.d.ts

@@ -37,10 +37,18 @@ export interface KiroLoginSession {
     waitForPrompt(timeoutMs?: number): Promise<boolean>;
     waitForAuth(runner?: CommandRunner): Promise<boolean>;
 }
+export interface KiroCliLoginOptions {
+    readonly license?: "free" | "pro";
+    readonly identityProvider?: string;
+    readonly region?: string;
+    readonly useDeviceFlow?: boolean;
+    readonly extraArgs?: ReadonlyArray<string>;
+}
 export interface KiroLoginFlowOptions {
     readonly spawner?: ProcessSpawner;
     readonly runner?: CommandRunner;
     readonly promptTimeoutMs?: number;
+    readonly login?: KiroCliLoginOptions;
 }
 export declare const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export declare const DEFAULT_KIRO_CLI_DB_PATH: string;
@@ -50,8 +58,9 @@ export declare function regionFromProfileArn(profileArn: string | undefined): st
 export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
 export declare function extractKiroLoginCode(output: string): string | undefined;
-export declare function startKiroCliLogin(spawner?: ProcessSpawner): KiroLoginSession;
-export declare function startKiroCliLoginOnce(spawner?: ProcessSpawner): KiroLoginSession;
+export declare function kiroCliLoginArgs(options?: KiroCliLoginOptions): string[];
+export declare function startKiroCliLogin(optionsOrSpawner?: KiroCliLoginOptions | ProcessSpawner, spawner?: ProcessSpawner): KiroLoginSession;
+export declare function startKiroCliLoginOnce(optionsOrSpawner?: KiroCliLoginOptions | ProcessSpawner, spawner?: ProcessSpawner): KiroLoginSession;
 export declare function runKiroLoginFlowOnce(options?: KiroLoginFlowOptions): Promise<boolean>;
 export declare function redacted(value: string | undefined): string | undefined;
 export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunner): Promise<AuthDiagnostics>;

package/dist/auth.js

@@ -11,7 +11,9 @@ export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer
 const LOGIN_REUSE_WINDOW_MS = 2 * 60 * 1000;
 let sharedLoginSession;
 let sharedLoginStartedAt = 0;
+let sharedLoginSessionKey = "";
 let sharedLoginFlow;
+let sharedLoginFlowKey = "";
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -96,17 +98,90 @@ export async function readKiroCliSessionCredential(options = {}, runner = runCom
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function firstUrl(text) {
-    return /https?:\/\/[^\s"'<>]+/.exec(text)?.[0];
+function urls(text) {
+    return text.match(/https?:\/\/[^\s"'<>]+/g) ?? [];
+}
+function isLocalCallbackUrl(value) {
+    try {
+        const url = new URL(value);
+        const hostname = url.hostname.toLowerCase();
+        return ((hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]") &&
+            url.pathname.includes("/callback"));
+    }
+    catch {
+        return false;
+    }
+}
+function loginUrlFromLocalCallbackUrl(value) {
+    if (!isLocalCallbackUrl(value))
+        return undefined;
+    try {
+        const issuerUrl = new URL(value).searchParams.get("issuer_url");
+        if (!issuerUrl || isLocalCallbackUrl(issuerUrl))
+            return undefined;
+        const parsed = new URL(issuerUrl);
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isKiroSigninUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.hostname.toLowerCase() === "app.kiro.dev" && url.pathname === "/signin";
+    }
+    catch {
+        return false;
+    }
+}
+function firstLoginUrl(text) {
+    const candidates = urls(text);
+    const kiroSigninUrl = candidates.find(isKiroSigninUrl);
+    if (kiroSigninUrl)
+        return kiroSigninUrl;
+    for (const url of candidates) {
+        const callbackLoginUrl = loginUrlFromLocalCallbackUrl(url);
+        if (callbackLoginUrl)
+            return callbackLoginUrl;
+        if (!isLocalCallbackUrl(url))
+            return url;
+    }
+    return undefined;
 }
 export function extractKiroLoginUrl(output) {
-    return firstUrl(output) ?? KIRO_LOGIN_URL;
+    return firstLoginUrl(output) ?? KIRO_LOGIN_URL;
 }
 export function extractKiroLoginCode(output) {
     return /\b[A-Z0-9]{4}-[A-Z0-9]{4}\b/.exec(output)?.[0] ?? /\b[A-Z0-9]{8,}\b/.exec(output)?.[0];
 }
-export function startKiroCliLogin(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
-    const child = spawner("kiro-cli", ["login", "--use-device-flow"]);
+function defaultSpawner(command, args) {
+    return spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] });
+}
+function loginKey(options = {}) {
+    return JSON.stringify(kiroCliLoginArgs(options));
+}
+function loginOptionsAndSpawner(optionsOrSpawner, spawner) {
+    if (typeof optionsOrSpawner === "function")
+        return { options: {}, spawner: optionsOrSpawner };
+    return { options: optionsOrSpawner ?? {}, spawner: spawner ?? defaultSpawner };
+}
+export function kiroCliLoginArgs(options = {}) {
+    const args = ["login"];
+    if (options.license)
+        args.push("--license", options.license);
+    if (options.identityProvider)
+        args.push("--identity-provider", options.identityProvider);
+    if (options.region)
+        args.push("--region", options.region);
+    if (options.useDeviceFlow)
+        args.push("--use-device-flow");
+    args.push(...(options.extraArgs ?? []));
+    return args;
+}
+export function startKiroCliLogin(optionsOrSpawner, spawner) {
+    const resolved = loginOptionsAndSpawner(optionsOrSpawner, spawner);
+    const child = resolved.spawner("kiro-cli", kiroCliLoginArgs(resolved.options));
     let output = "";
     let exited = false;
     let exitCode = null;
@@ -136,13 +211,13 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
             while (Date.now() < deadline) {
                 if (extractKiroLoginCode(output))
                     return true;
-                if (firstUrl(output))
+                if (firstLoginUrl(output))
                     return true;
                 if (exited && exitCode !== 0)
                     return false;
                 await delay(100);
             }
-            return Boolean(extractKiroLoginCode(output) || firstUrl(output));
+            return Boolean(extractKiroLoginCode(output) || firstLoginUrl(output));
         },
         async waitForAuth(runner = runCommand) {
             const deadline = Date.now() + 10 * 60 * 1000;
@@ -158,11 +233,14 @@ export function startKiroCliLogin(spawner = (command, args) => spawn(command, [.
         },
     };
 }
-export function startKiroCliLoginOnce(spawner = (command, args) => spawn(command, [...args], { stdio: ["ignore", "pipe", "pipe"] })) {
+export function startKiroCliLoginOnce(optionsOrSpawner, spawner) {
+    const resolved = loginOptionsAndSpawner(optionsOrSpawner, spawner);
+    const key = loginKey(resolved.options);
     const now = Date.now();
-    if (sharedLoginSession && now - sharedLoginStartedAt < LOGIN_REUSE_WINDOW_MS)
+    if (sharedLoginSession && sharedLoginSessionKey === key && now - sharedLoginStartedAt < LOGIN_REUSE_WINDOW_MS) {
         return sharedLoginSession;
-    const session = startKiroCliLogin(spawner);
+    }
+    const session = startKiroCliLogin(resolved.options, resolved.spawner);
     const wrapped = {
         get url() {
             return session.url;
@@ -184,22 +262,29 @@ export function startKiroCliLoginOnce(spawner = (command, args) => spawn(command
                 if (sharedLoginSession === wrapped) {
                     sharedLoginSession = undefined;
                     sharedLoginStartedAt = 0;
+                    sharedLoginSessionKey = "";
                 }
             }
         },
     };
     sharedLoginSession = wrapped;
     sharedLoginStartedAt = now;
+    sharedLoginSessionKey = key;
     return wrapped;
 }
 export async function runKiroLoginFlowOnce(options = {}) {
-    sharedLoginFlow ??= (async () => {
-        const session = startKiroCliLoginOnce(options.spawner);
-        await session.waitForPrompt(options.promptTimeoutMs);
-        return session.waitForAuth(options.runner);
-    })().finally(() => {
-        sharedLoginFlow = undefined;
-    });
+    const key = loginKey(options.login);
+    if (!sharedLoginFlow || sharedLoginFlowKey !== key) {
+        sharedLoginFlowKey = key;
+        sharedLoginFlow = (async () => {
+            const session = startKiroCliLoginOnce(options.login, options.spawner);
+            await session.waitForPrompt(options.promptTimeoutMs);
+            return session.waitForAuth(options.runner);
+        })().finally(() => {
+            sharedLoginFlow = undefined;
+            sharedLoginFlowKey = "";
+        });
+    }
     return sharedLoginFlow;
 }
 export function redacted(value) {

package/dist/config.d.ts

@@ -1,8 +1,10 @@
+import type { KiroCliLoginOptions } from "./auth.js";
 export type BackendMode = "auto" | "fetch" | "cli-chat" | "acp";
 export type ModelDiscoveryMode = "auto" | "off";
 export interface KiroPluginOptions {
     readonly providerID: string;
     readonly region: string;
+    readonly login: KiroCliLoginOptions;
     readonly endpoint?: string;
     readonly backend: BackendMode;
     readonly modelDiscovery: ModelDiscoveryMode;

package/dist/config.js

@@ -43,6 +43,20 @@ function optionalString(value) {
     const trimmed = value.trim();
     return trimmed || undefined;
 }
+function loginOptions(value) {
+    const input = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    const license = input.license === "free" || input.license === "pro" ? input.license : undefined;
+    const identityProvider = optionalString(input.identityProvider);
+    const region = optionalString(input.region);
+    const extraArgs = stringArray(input.extraArgs);
+    return {
+        ...(license ? { license } : {}),
+        ...(identityProvider ? { identityProvider } : {}),
+        ...(region ? { region } : {}),
+        useDeviceFlow: input.useDeviceFlow === true,
+        ...(extraArgs.length > 0 ? { extraArgs } : {}),
+    };
+}
 export function loadOptions(raw = {}) {
     const input = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
     const backend = typeof input.backend === "string" && BACKENDS.has(input.backend) ? input.backend : "auto";
@@ -58,6 +72,7 @@ export function loadOptions(raw = {}) {
     return {
         providerID: typeof input.providerID === "string" && input.providerID ? input.providerID : DEFAULT_PROVIDER_ID,
         region: typeof input.region === "string" && input.region ? input.region : DEFAULT_REGION,
+        login: loginOptions(input.login),
         ...(endpoint ? { endpoint } : {}),
         backend,
         modelDiscovery,

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey, startKiroCliLoginOnce } from "./auth.js";
+import { detectAuth, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLoginOnce } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -73,11 +73,14 @@ function localTransport(options, accessToken) {
         return new KiroCliChatTransport({
             trustAllTools: options.trustAllTools,
             ...(options.requestTimeoutMs ? { requestTimeoutMs: options.requestTimeoutMs } : {}),
+            login: () => runKiroLoginFlowOnce({ login: options.login }),
         });
     }
     if (backend === "fetch") {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
-        return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey));
+        return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
+            login: () => runKiroLoginFlowOnce({ login: options.login }),
+        });
     }
     return undefined;
 }
@@ -119,7 +122,7 @@ export function createKiroPlugin() {
                 return;
             }
             discoveryAttempted = true;
-            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1), { loginOnAuthFailure: true })
+            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1), { loginOnAuthFailure: true, login: () => runKiroLoginFlowOnce({ login: options.login }) })
                 .catch(() => undefined)
                 .then(() => {
                 discovery = undefined;
@@ -175,7 +178,7 @@ export function createKiroPlugin() {
                         type: "oauth",
                         label: "Kiro CLI login",
                         authorize: async () => {
-                            const session = startKiroCliLoginOnce();
+                            const session = startKiroCliLoginOnce(options.login);
                             await session.waitForPrompt();
                             return {
                                 url: session.url,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",