@bogyie/opencode-kiro-plugin 0.3.6 → 0.3.7

package/README.md

@@ -34,15 +34,15 @@ Then add the plugin to your OpenCode config. See [examples/opencode.jsonc](examp
 The plugin resolves credentials in this order:
 
 1. `KIRO_API_KEY`
-2. OpenCode auth input for provider `kiro`
+2. OpenCode auth input for provider `kiro`, including stored Kiro device-flow credentials
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, OpenCode's startup model discovery may start the same Kiro CLI login flow automatically. The plugin runs `kiro-cli login`, waits for login to complete through `kiro-cli whoami`, and then runs the model discovery command one more time. If that login fails or times out, discovery fails for that startup attempt; it does not loop.
+When no usable Kiro CLI session is available, OpenCode's startup model discovery does not start browser login. If startup discovery cannot list models, the plugin keeps Kiro visible with an `auto` placeholder model.
 
-You can also open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The connector flow starts `kiro-cli login`, waits until the login URL/device code is visible, returns it to the connector, and then waits until `kiro-cli whoami` succeeds. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If credentials expire during use, direct fetch and `cli-chat` start the shared Kiro login flow, wait for it to complete, and retry the failed request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
-For AWS IAM Identity Center login, configure the CLI login arguments separately from the API region:
+For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
 ```jsonc
 {
@@ -62,7 +62,7 @@ For AWS IAM Identity Center login, configure the CLI login arguments separately
 }
 ```
 
-This runs `kiro-cli login --license pro --identity-provider https://example.awsapps.com/start --region ap-northeast-2`. Do not enable `login.useDeviceFlow` for the normal browser callback flow; Kiro CLI needs to keep its localhost callback listener alive while the browser redirects back.
+The connector can also prompt for the Start URL, OIDC region, and optional profile ARN. For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -78,7 +78,7 @@ Configure the backend through plugin options:
       {
         "backend": "auto",
         "region": "us-east-1",
-        // Optional Kiro CLI login overrides:
+        // Optional Kiro device login defaults:
         // "login": {
         //   "license": "pro",
         //   "identityProvider": "https://example.awsapps.com/start",
@@ -155,7 +155,7 @@ This keeps new Kiro model ids usable before the package is updated without adver
 
 The plugin injects `provider.kiro` automatically. You only need to add `provider.kiro.models` yourself when overriding OpenCode model-picker metadata, such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. If this command fails with an auth error, the plugin starts Kiro CLI login, waits for it to finish, and retries the command once. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. If this command fails during startup, the provider remains visible with the `auto` placeholder and you can connect Kiro through OpenCode's provider connector. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/auth.d.ts

@@ -30,6 +30,7 @@ export interface KiroCliSessionCredentialOptions {
     readonly dbPath?: string;
     readonly tokenKeys?: ReadonlyArray<string>;
 }
+export type KiroAuthFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 export interface KiroLoginSession {
     readonly url: string;
     readonly code: string | undefined;
@@ -44,6 +45,29 @@ export interface KiroCliLoginOptions {
     readonly useDeviceFlow?: boolean;
     readonly extraArgs?: ReadonlyArray<string>;
 }
+export interface KiroDeviceAuthorization {
+    readonly verificationUrl: string;
+    readonly verificationUrlComplete: string;
+    readonly userCode: string;
+    readonly deviceCode: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly intervalSeconds: number;
+    readonly expiresInSeconds: number;
+    readonly oidcRegion: string;
+    readonly startUrl: string;
+}
+export interface KiroDeviceAuthCredential {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresAt: number;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly oidcRegion: string;
+    readonly region: string;
+    readonly startUrl: string;
+    readonly profileArn?: string;
+}
 export interface KiroLoginFlowOptions {
     readonly spawner?: ProcessSpawner;
     readonly runner?: CommandRunner;
@@ -56,6 +80,14 @@ export declare const DEFAULT_KIRO_CLI_TOKEN_KEYS: readonly ["kirocli:odic:token"
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;
 export declare function regionFromProfileArn(profileArn: string | undefined): string | undefined;
 export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
+export declare function kiroDeviceVerificationUrl(startUrl: string, userCode: string): string;
+export declare function authorizeKiroDevice(options?: KiroCliLoginOptions, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthorization>;
+export declare function pollKiroDeviceToken(authorization: KiroDeviceAuthorization, options: Pick<KiroDeviceAuthCredential, "region" | "profileArn">, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthCredential>;
+export declare function refreshKiroDeviceAuthCredential(credential: KiroDeviceAuthCredential, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthCredential>;
+export declare function encodeKiroDeviceAuthKey(credential: KiroDeviceAuthCredential): string;
+export declare function decodeKiroDeviceAuthKey(key: string | undefined): KiroDeviceAuthCredential | undefined;
+export declare function isKiroDeviceAuthKey(key: string | undefined): boolean;
+export declare function credentialFromKiroDeviceAuthKey(key: string, fetcher?: KiroAuthFetch): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
 export declare function extractKiroLoginCode(output: string): string | undefined;
 export declare function kiroCliLoginArgs(options?: KiroCliLoginOptions): string[];
@@ -67,4 +99,5 @@ export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunn
 export declare function resolveApiKey(auth: () => Promise<{
     type: string;
     key?: string;
+    access?: string;
 }>, env?: NodeJS.ProcessEnv): Promise<string>;

package/dist/auth.js

@@ -8,12 +8,23 @@ const execFileAsync = promisify(execFile);
 export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export const DEFAULT_KIRO_CLI_DB_PATH = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
 export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer:odic:token"];
+const KIRO_DEVICE_AUTH_KEY_PREFIX = "kiro-device:";
+const KIRO_OIDC_SCOPES = [
+    "codewhisperer:completions",
+    "codewhisperer:analysis",
+    "codewhisperer:conversations",
+    "codewhisperer:transformations",
+    "codewhisperer:taskassist",
+];
 const LOGIN_REUSE_WINDOW_MS = 2 * 60 * 1000;
+const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
 let sharedLoginSession;
 let sharedLoginStartedAt = 0;
 let sharedLoginSessionKey = "";
 let sharedLoginFlow;
 let sharedLoginFlowKey = "";
+const refreshedDeviceCredentials = new Map();
+const deviceRefreshes = new Map();
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -41,6 +52,14 @@ function jsonObject(value) {
         return undefined;
     }
 }
+function numberField(input, ...keys) {
+    for (const key of keys) {
+        const value = input?.[key];
+        if (typeof value === "number" && Number.isFinite(value))
+            return value;
+    }
+    return undefined;
+}
 function stringField(input, ...keys) {
     for (const key of keys) {
         const value = input?.[key];
@@ -98,6 +117,243 @@ export async function readKiroCliSessionCredential(options = {}, runner = runCom
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function normalizeStartUrl(raw) {
+    const value = raw?.trim() || KIRO_LOGIN_URL;
+    const url = new URL(value);
+    url.hash = "";
+    url.search = "";
+    if (url.pathname.endsWith("/start/"))
+        url.pathname = url.pathname.replace(/\/start\/$/, "/start");
+    if (!url.pathname.endsWith("/start"))
+        url.pathname = `${url.pathname.replace(/\/+$/, "")}/start`;
+    return url.toString();
+}
+export function kiroDeviceVerificationUrl(startUrl, userCode) {
+    const url = new URL(startUrl);
+    url.search = "";
+    if (url.pathname.endsWith("/start"))
+        url.pathname = `${url.pathname}/`;
+    url.pathname = url.pathname.replace(/\/start\/?$/, "/start/");
+    url.hash = `#/device?user_code=${encodeURIComponent(userCode)}`;
+    return url.toString();
+}
+function oidcEndpoint(region) {
+    return `https://oidc.${region || "us-east-1"}.amazonaws.com`;
+}
+function deviceAuthUserAgent() {
+    return "KiroIDE";
+}
+async function jsonResponse(response) {
+    const text = await response.text();
+    const parsed = jsonObject(text);
+    if (!parsed)
+        throw new Error(`Kiro auth returned invalid JSON: ${text.slice(0, 200)}`);
+    if (!response.ok) {
+        const message = stringField(parsed, "message", "error_description", "error") ?? text.slice(0, 200);
+        throw new Error(`Kiro auth request failed: HTTP ${response.status} ${message}`);
+    }
+    return parsed;
+}
+export async function authorizeKiroDevice(options = {}, fetcher = fetch) {
+    const oidcRegion = options.region || "us-east-1";
+    const startUrl = normalizeStartUrl(options.identityProvider);
+    const endpoint = oidcEndpoint(oidcRegion);
+    const register = await jsonResponse(await fetcher(`${endpoint}/client/register`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            clientName: "Kiro IDE",
+            clientType: "public",
+            scopes: KIRO_OIDC_SCOPES,
+            grantTypes: ["urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+        }),
+    }));
+    const clientId = stringField(register, "clientId", "client_id");
+    const clientSecret = stringField(register, "clientSecret", "client_secret");
+    if (!clientId || !clientSecret)
+        throw new Error("Kiro auth client registration did not return client credentials.");
+    const authorization = await jsonResponse(await fetcher(`${endpoint}/device_authorization`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            clientId,
+            clientSecret,
+            startUrl,
+        }),
+    }));
+    const verificationUrl = stringField(authorization, "verificationUri", "verification_uri");
+    const verificationUrlComplete = stringField(authorization, "verificationUriComplete", "verification_uri_complete");
+    const userCode = stringField(authorization, "userCode", "user_code");
+    const deviceCode = stringField(authorization, "deviceCode", "device_code");
+    if (!verificationUrl || !verificationUrlComplete || !userCode || !deviceCode) {
+        throw new Error("Kiro device authorization response did not return required fields.");
+    }
+    return {
+        verificationUrl,
+        verificationUrlComplete,
+        userCode,
+        deviceCode,
+        clientId,
+        clientSecret,
+        intervalSeconds: numberField(authorization, "interval") ?? 5,
+        expiresInSeconds: numberField(authorization, "expiresIn", "expires_in") ?? 600,
+        oidcRegion,
+        startUrl,
+    };
+}
+export async function pollKiroDeviceToken(authorization, options, fetcher = fetch) {
+    const maxAttempts = Math.max(1, Math.floor(authorization.expiresInSeconds / authorization.intervalSeconds));
+    let intervalMs = authorization.intervalSeconds * 1000;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+        await delay(intervalMs);
+        const response = await fetcher(`${oidcEndpoint(authorization.oidcRegion)}/token`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": deviceAuthUserAgent(),
+            },
+            body: JSON.stringify({
+                clientId: authorization.clientId,
+                clientSecret: authorization.clientSecret,
+                deviceCode: authorization.deviceCode,
+                grantType: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const data = await response.text().then((text) => jsonObject(text) ?? {});
+        const error = stringField(data, "error");
+        if (error === "authorization_pending")
+            continue;
+        if (error === "slow_down") {
+            intervalMs += 5000;
+            continue;
+        }
+        if (error) {
+            const description = stringField(data, "error_description") ?? "";
+            throw new Error(`Kiro device authorization failed: ${error}${description ? ` - ${description}` : ""}`);
+        }
+        if (!response.ok) {
+            throw new Error(`Kiro device token request failed: HTTP ${response.status}`);
+        }
+        const accessToken = stringField(data, "access_token", "accessToken");
+        const refreshToken = stringField(data, "refresh_token", "refreshToken");
+        if (!accessToken || !refreshToken)
+            throw new Error("Kiro device token response did not return access and refresh tokens.");
+        const expiresIn = numberField(data, "expires_in", "expiresIn") ?? 3600;
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt: Date.now() + expiresIn * 1000,
+            clientId: authorization.clientId,
+            clientSecret: authorization.clientSecret,
+            oidcRegion: authorization.oidcRegion,
+            region: options.profileArn ? (regionFromProfileArn(options.profileArn) ?? options.region) : options.region,
+            startUrl: authorization.startUrl,
+            ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+        };
+    }
+    throw new Error("Kiro device authorization timed out.");
+}
+export async function refreshKiroDeviceAuthCredential(credential, fetcher = fetch) {
+    const data = await jsonResponse(await fetcher(`${oidcEndpoint(credential.oidcRegion)}/token`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            refreshToken: credential.refreshToken,
+            clientId: credential.clientId,
+            clientSecret: credential.clientSecret,
+            grantType: "refresh_token",
+        }),
+    }));
+    const accessToken = stringField(data, "access_token", "accessToken");
+    if (!accessToken)
+        throw new Error("Kiro refresh token response did not return an access token.");
+    const refreshToken = stringField(data, "refresh_token", "refreshToken") ?? credential.refreshToken;
+    const expiresIn = numberField(data, "expires_in", "expiresIn") ?? 3600;
+    return {
+        ...credential,
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + expiresIn * 1000,
+    };
+}
+function base64UrlEncode(value) {
+    return Buffer.from(value, "utf8").toString("base64url");
+}
+function base64UrlDecode(value) {
+    return Buffer.from(value, "base64url").toString("utf8");
+}
+export function encodeKiroDeviceAuthKey(credential) {
+    return `${KIRO_DEVICE_AUTH_KEY_PREFIX}${base64UrlEncode(JSON.stringify(credential))}`;
+}
+export function decodeKiroDeviceAuthKey(key) {
+    try {
+        if (!key?.startsWith(KIRO_DEVICE_AUTH_KEY_PREFIX))
+            return undefined;
+        const parsed = jsonObject(base64UrlDecode(key.slice(KIRO_DEVICE_AUTH_KEY_PREFIX.length)));
+        const accessToken = stringField(parsed, "accessToken");
+        const refreshToken = stringField(parsed, "refreshToken");
+        const expiresAt = numberField(parsed, "expiresAt");
+        const clientId = stringField(parsed, "clientId");
+        const clientSecret = stringField(parsed, "clientSecret");
+        const oidcRegion = stringField(parsed, "oidcRegion");
+        const region = stringField(parsed, "region");
+        const startUrl = stringField(parsed, "startUrl");
+        if (!accessToken || !refreshToken || !expiresAt || !clientId || !clientSecret || !oidcRegion || !region || !startUrl)
+            return undefined;
+        const profileArn = stringField(parsed, "profileArn");
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt,
+            clientId,
+            clientSecret,
+            oidcRegion,
+            region,
+            startUrl,
+            ...(profileArn ? { profileArn } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isKiroDeviceAuthKey(key) {
+    return Boolean(decodeKiroDeviceAuthKey(key));
+}
+export async function credentialFromKiroDeviceAuthKey(key, fetcher = fetch) {
+    const cached = refreshedDeviceCredentials.get(key);
+    let credential = cached ?? decodeKiroDeviceAuthKey(key);
+    if (!credential)
+        return undefined;
+    if (credential.expiresAt <= Date.now() + TOKEN_REFRESH_BUFFER_MS) {
+        let refresh = deviceRefreshes.get(key);
+        if (!refresh) {
+            refresh = refreshKiroDeviceAuthCredential(credential, fetcher).finally(() => {
+                deviceRefreshes.delete(key);
+            });
+            deviceRefreshes.set(key, refresh);
+        }
+        credential = await refresh;
+        refreshedDeviceCredentials.set(key, credential);
+    }
+    return {
+        accessToken: credential.accessToken,
+        refreshToken: credential.refreshToken,
+        expiresAt: new Date(credential.expiresAt).toISOString(),
+        ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+        region: regionFromProfileArn(credential.profileArn) ?? credential.region,
+        source: "opencode-device-auth",
+    };
+}
 function urls(text) {
     return text.match(/https?:\/\/[^\s"'<>]+/g) ?? [];
 }
@@ -340,7 +596,7 @@ export async function resolveApiKey(auth, env = process.env) {
         return env.KIRO_API_KEY;
     try {
         const credential = await auth();
-        return credential.type === "api" && credential.key ? credential.key : "";
+        return credential.key || credential.access || "";
     }
     catch {
         return "";

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, decodeKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, extractKiroLoginUrl, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, refreshKiroDeviceAuthCredential, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/index.js

@@ -2,7 +2,7 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, decodeKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, extractKiroLoginUrl, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, refreshKiroDeviceAuthCredential, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLoginOnce } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -53,6 +53,10 @@ function bearerToken(init) {
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
+function inputString(inputs, key) {
+    const value = inputs?.[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
 export function effectiveBackend(options, accessToken) {
     const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
@@ -78,6 +82,12 @@ function localTransport(options, accessToken) {
     }
     if (backend === "fetch") {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
+        if (isKiroDeviceAuthKey(apiKey)) {
+            return new KiroRestTransport(fetchTransportOptions(options), {
+                credentialProvider: () => credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined),
+                login: async () => false,
+            });
+        }
         return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
             login: () => runKiroLoginFlowOnce({ login: options.login }),
         });
@@ -122,7 +132,7 @@ export function createKiroPlugin() {
                 return;
             }
             discoveryAttempted = true;
-            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1), { loginOnAuthFailure: true, login: () => runKiroLoginFlowOnce({ login: options.login }) })
+            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
                 .catch(() => undefined)
                 .then(() => {
                 discovery = undefined;
@@ -176,26 +186,66 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: "Kiro CLI login",
-                        authorize: async () => {
-                            const session = startKiroCliLoginOnce(options.login);
-                            await session.waitForPrompt();
+                        label: "Kiro device login",
+                        prompts: [
+                            {
+                                type: "text",
+                                key: "startUrl",
+                                message: options.login.identityProvider
+                                    ? `IAM Identity Center Start URL (current: ${options.login.identityProvider}, leave blank to keep)`
+                                    : "IAM Identity Center Start URL (leave blank for AWS Builder ID)",
+                                placeholder: "https://your-company.awsapps.com/start",
+                            },
+                            {
+                                type: "text",
+                                key: "idcRegion",
+                                message: options.login.region && options.login.region !== "us-east-1"
+                                    ? `IAM Identity Center region (current: ${options.login.region}, leave blank to keep)`
+                                    : "IAM Identity Center region (leave blank for us-east-1)",
+                                placeholder: "us-east-1",
+                            },
+                            {
+                                type: "text",
+                                key: "profileArn",
+                                message: options.profileArn
+                                    ? `Profile ARN (current: ${options.profileArn}, leave blank to keep)`
+                                    : "Profile ARN (optional, improves region/profile routing for IAM Identity Center)",
+                                placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
+                            },
+                        ],
+                        authorize: async (inputs) => {
+                            const promptInputs = inputs;
+                            const startUrl = inputString(promptInputs, "startUrl") ?? options.login.identityProvider;
+                            const idcRegion = inputString(promptInputs, "idcRegion") ?? options.login.region ?? "us-east-1";
+                            const profileArn = inputString(promptInputs, "profileArn") ?? options.profileArn;
+                            const authorization = await authorizeKiroDevice({
+                                region: idcRegion,
+                                ...(startUrl ? { identityProvider: startUrl } : {}),
+                            });
+                            const url = startUrl
+                                ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode)
+                                : authorization.verificationUrlComplete;
                             return {
-                                url: session.url,
-                                instructions: session.instructions,
+                                url,
+                                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
                                 method: "auto",
                                 callback: async () => {
-                                    const authenticated = await session.waitForAuth();
-                                    if (!authenticated)
-                                        return { type: "failed" };
-                                    const diagnostics = await detectAuth().catch(() => undefined);
+                                    const credential = await pollKiroDeviceToken(authorization, {
+                                        region: options.region,
+                                        ...(profileArn ? { profileArn } : {}),
+                                    });
+                                    const key = encodeKiroDeviceAuthKey(credential);
                                     return {
                                         type: "success",
-                                        key: "kiro-plugin-local-transport",
+                                        key,
+                                        access: key,
+                                        refresh: credential.refreshToken,
+                                        expires: credential.expiresAt,
                                         metadata: {
-                                            source: "kiro-cli",
-                                            ...(diagnostics?.account ? { account: diagnostics.account } : {}),
-                                            ...(diagnostics?.region ? { region: diagnostics.region } : {}),
+                                            source: "kiro-device-auth",
+                                            region: credential.region,
+                                            oidcRegion: credential.oidcRegion,
+                                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
                                         },
                                     };
                                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",