@bogyie/opencode-kiro-plugin 0.3.6 → 0.3.8

package/README.md

@@ -34,15 +34,15 @@ Then add the plugin to your OpenCode config. See [examples/opencode.jsonc](examp
 The plugin resolves credentials in this order:
 
 1. `KIRO_API_KEY`
-2. OpenCode auth input for provider `kiro`
+2. OpenCode auth input for provider `kiro`, including stored Kiro device-flow credentials
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, OpenCode's startup model discovery may start the same Kiro CLI login flow automatically. The plugin runs `kiro-cli login`, waits for login to complete through `kiro-cli whoami`, and then runs the model discovery command one more time. If that login fails or times out, discovery fails for that startup attempt; it does not loop.
+OpenCode startup does not start Kiro login. The provider is registered immediately with an `auto` placeholder model, then model discovery warms the in-memory cache in the background. If discovery succeeds, later model-list requests use the latest cached list; if discovery fails, the previous cache remains in use and Kiro stays visible with `auto`.
 
-You can also open OpenCode's provider connector, choose Kiro, and select `Kiro CLI login`. The connector flow starts `kiro-cli login`, waits until the login URL/device code is visible, returns it to the connector, and then waits until `kiro-cli whoami` succeeds. Direct fetch mode uses a usable API key/token when one is configured; otherwise it reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If credentials expire during use, direct fetch and `cli-chat` start the shared Kiro login flow, wait for it to complete, and retry the failed request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
-For AWS IAM Identity Center login, configure the CLI login arguments separately from the API region:
+For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
 ```jsonc
 {
@@ -62,7 +62,7 @@ For AWS IAM Identity Center login, configure the CLI login arguments separately
 }
 ```
 
-This runs `kiro-cli login --license pro --identity-provider https://example.awsapps.com/start --region ap-northeast-2`. Do not enable `login.useDeviceFlow` for the normal browser callback flow; Kiro CLI needs to keep its localhost callback listener alive while the browser redirects back.
+The connector can also prompt for the Start URL, OIDC region, and optional profile ARN. For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
 
 Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
 
@@ -78,7 +78,7 @@ Configure the backend through plugin options:
       {
         "backend": "auto",
         "region": "us-east-1",
-        // Optional Kiro CLI login overrides:
+        // Optional Kiro device login defaults:
         // "login": {
         //   "license": "pro",
         //   "identityProvider": "https://example.awsapps.com/start",
@@ -105,7 +105,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. By default, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker; if discovery cannot return any models, the plugin exposes an `auto` placeholder so OpenCode keeps the Kiro provider visible for connection.
+The resolver intentionally avoids a hard whitelist. Startup always begins with the `auto` placeholder so OpenCode can show Kiro without waiting for Kiro auth or model discovery. By default, the plugin then reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` in the background. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
 
 Useful options:
 
@@ -151,11 +151,11 @@ Resolution order:
 6. Hidden/manual model mapping
 7. Optimistic pass-through unless disabled
 
-This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
+This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker after discovery has succeeded. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
 
 The plugin injects `provider.kiro` automatically. You only need to add `provider.kiro.models` yourself when overriding OpenCode model-picker metadata, such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. If this command fails with an auth error, the plugin starts Kiro CLI login, waits for it to finish, and retries the command once. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. Discovery is best-effort and never starts login during OpenCode startup; authenticate manually through the connector or let an API/model request handle auth failure. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/auth.d.ts

@@ -30,6 +30,7 @@ export interface KiroCliSessionCredentialOptions {
     readonly dbPath?: string;
     readonly tokenKeys?: ReadonlyArray<string>;
 }
+export type KiroAuthFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 export interface KiroLoginSession {
     readonly url: string;
     readonly code: string | undefined;
@@ -44,6 +45,29 @@ export interface KiroCliLoginOptions {
     readonly useDeviceFlow?: boolean;
     readonly extraArgs?: ReadonlyArray<string>;
 }
+export interface KiroDeviceAuthorization {
+    readonly verificationUrl: string;
+    readonly verificationUrlComplete: string;
+    readonly userCode: string;
+    readonly deviceCode: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly intervalSeconds: number;
+    readonly expiresInSeconds: number;
+    readonly oidcRegion: string;
+    readonly startUrl: string;
+}
+export interface KiroDeviceAuthCredential {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresAt: number;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly oidcRegion: string;
+    readonly region: string;
+    readonly startUrl: string;
+    readonly profileArn?: string;
+}
 export interface KiroLoginFlowOptions {
     readonly spawner?: ProcessSpawner;
     readonly runner?: CommandRunner;
@@ -56,6 +80,14 @@ export declare const DEFAULT_KIRO_CLI_TOKEN_KEYS: readonly ["kirocli:odic:token"
 export declare function runCommand(command: string, args: ReadonlyArray<string>, options?: CommandRunOptions): Promise<CommandResult>;
 export declare function regionFromProfileArn(profileArn: string | undefined): string | undefined;
 export declare function readKiroCliSessionCredential(options?: KiroCliSessionCredentialOptions, runner?: CommandRunner): Promise<KiroCliSessionCredential | undefined>;
+export declare function kiroDeviceVerificationUrl(startUrl: string, userCode: string): string;
+export declare function authorizeKiroDevice(options?: KiroCliLoginOptions, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthorization>;
+export declare function pollKiroDeviceToken(authorization: KiroDeviceAuthorization, options: Pick<KiroDeviceAuthCredential, "region" | "profileArn">, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthCredential>;
+export declare function refreshKiroDeviceAuthCredential(credential: KiroDeviceAuthCredential, fetcher?: KiroAuthFetch): Promise<KiroDeviceAuthCredential>;
+export declare function encodeKiroDeviceAuthKey(credential: KiroDeviceAuthCredential): string;
+export declare function decodeKiroDeviceAuthKey(key: string | undefined): KiroDeviceAuthCredential | undefined;
+export declare function isKiroDeviceAuthKey(key: string | undefined): boolean;
+export declare function credentialFromKiroDeviceAuthKey(key: string, fetcher?: KiroAuthFetch): Promise<KiroCliSessionCredential | undefined>;
 export declare function extractKiroLoginUrl(output: string): string;
 export declare function extractKiroLoginCode(output: string): string | undefined;
 export declare function kiroCliLoginArgs(options?: KiroCliLoginOptions): string[];
@@ -67,4 +99,5 @@ export declare function detectAuth(env?: NodeJS.ProcessEnv, runner?: CommandRunn
 export declare function resolveApiKey(auth: () => Promise<{
     type: string;
     key?: string;
+    access?: string;
 }>, env?: NodeJS.ProcessEnv): Promise<string>;

package/dist/auth.js

@@ -8,12 +8,23 @@ const execFileAsync = promisify(execFile);
 export const KIRO_LOGIN_URL = "https://view.awsapps.com/start";
 export const DEFAULT_KIRO_CLI_DB_PATH = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
 export const DEFAULT_KIRO_CLI_TOKEN_KEYS = ["kirocli:odic:token", "codewhisperer:odic:token"];
+const KIRO_DEVICE_AUTH_KEY_PREFIX = "kiro-device:";
+const KIRO_OIDC_SCOPES = [
+    "codewhisperer:completions",
+    "codewhisperer:analysis",
+    "codewhisperer:conversations",
+    "codewhisperer:transformations",
+    "codewhisperer:taskassist",
+];
 const LOGIN_REUSE_WINDOW_MS = 2 * 60 * 1000;
+const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
 let sharedLoginSession;
 let sharedLoginStartedAt = 0;
 let sharedLoginSessionKey = "";
 let sharedLoginFlow;
 let sharedLoginFlowKey = "";
+const refreshedDeviceCredentials = new Map();
+const deviceRefreshes = new Map();
 export async function runCommand(command, args, options = {}) {
     try {
         const result = await execFileAsync(command, [...args], { timeout: options.timeoutMs ?? 5000 });
@@ -41,6 +52,14 @@ function jsonObject(value) {
         return undefined;
     }
 }
+function numberField(input, ...keys) {
+    for (const key of keys) {
+        const value = input?.[key];
+        if (typeof value === "number" && Number.isFinite(value))
+            return value;
+    }
+    return undefined;
+}
 function stringField(input, ...keys) {
     for (const key of keys) {
         const value = input?.[key];
@@ -98,6 +117,243 @@ export async function readKiroCliSessionCredential(options = {}, runner = runCom
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function normalizeStartUrl(raw) {
+    const value = raw?.trim() || KIRO_LOGIN_URL;
+    const url = new URL(value);
+    url.hash = "";
+    url.search = "";
+    if (url.pathname.endsWith("/start/"))
+        url.pathname = url.pathname.replace(/\/start\/$/, "/start");
+    if (!url.pathname.endsWith("/start"))
+        url.pathname = `${url.pathname.replace(/\/+$/, "")}/start`;
+    return url.toString();
+}
+export function kiroDeviceVerificationUrl(startUrl, userCode) {
+    const url = new URL(startUrl);
+    url.search = "";
+    if (url.pathname.endsWith("/start"))
+        url.pathname = `${url.pathname}/`;
+    url.pathname = url.pathname.replace(/\/start\/?$/, "/start/");
+    url.hash = `#/device?user_code=${encodeURIComponent(userCode)}`;
+    return url.toString();
+}
+function oidcEndpoint(region) {
+    return `https://oidc.${region || "us-east-1"}.amazonaws.com`;
+}
+function deviceAuthUserAgent() {
+    return "KiroIDE";
+}
+async function jsonResponse(response) {
+    const text = await response.text();
+    const parsed = jsonObject(text);
+    if (!parsed)
+        throw new Error(`Kiro auth returned invalid JSON: ${text.slice(0, 200)}`);
+    if (!response.ok) {
+        const message = stringField(parsed, "message", "error_description", "error") ?? text.slice(0, 200);
+        throw new Error(`Kiro auth request failed: HTTP ${response.status} ${message}`);
+    }
+    return parsed;
+}
+export async function authorizeKiroDevice(options = {}, fetcher = fetch) {
+    const oidcRegion = options.region || "us-east-1";
+    const startUrl = normalizeStartUrl(options.identityProvider);
+    const endpoint = oidcEndpoint(oidcRegion);
+    const register = await jsonResponse(await fetcher(`${endpoint}/client/register`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            clientName: "Kiro IDE",
+            clientType: "public",
+            scopes: KIRO_OIDC_SCOPES,
+            grantTypes: ["urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+        }),
+    }));
+    const clientId = stringField(register, "clientId", "client_id");
+    const clientSecret = stringField(register, "clientSecret", "client_secret");
+    if (!clientId || !clientSecret)
+        throw new Error("Kiro auth client registration did not return client credentials.");
+    const authorization = await jsonResponse(await fetcher(`${endpoint}/device_authorization`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            clientId,
+            clientSecret,
+            startUrl,
+        }),
+    }));
+    const verificationUrl = stringField(authorization, "verificationUri", "verification_uri");
+    const verificationUrlComplete = stringField(authorization, "verificationUriComplete", "verification_uri_complete");
+    const userCode = stringField(authorization, "userCode", "user_code");
+    const deviceCode = stringField(authorization, "deviceCode", "device_code");
+    if (!verificationUrl || !verificationUrlComplete || !userCode || !deviceCode) {
+        throw new Error("Kiro device authorization response did not return required fields.");
+    }
+    return {
+        verificationUrl,
+        verificationUrlComplete,
+        userCode,
+        deviceCode,
+        clientId,
+        clientSecret,
+        intervalSeconds: numberField(authorization, "interval") ?? 5,
+        expiresInSeconds: numberField(authorization, "expiresIn", "expires_in") ?? 600,
+        oidcRegion,
+        startUrl,
+    };
+}
+export async function pollKiroDeviceToken(authorization, options, fetcher = fetch) {
+    const maxAttempts = Math.max(1, Math.floor(authorization.expiresInSeconds / authorization.intervalSeconds));
+    let intervalMs = authorization.intervalSeconds * 1000;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+        await delay(intervalMs);
+        const response = await fetcher(`${oidcEndpoint(authorization.oidcRegion)}/token`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": deviceAuthUserAgent(),
+            },
+            body: JSON.stringify({
+                clientId: authorization.clientId,
+                clientSecret: authorization.clientSecret,
+                deviceCode: authorization.deviceCode,
+                grantType: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const data = await response.text().then((text) => jsonObject(text) ?? {});
+        const error = stringField(data, "error");
+        if (error === "authorization_pending")
+            continue;
+        if (error === "slow_down") {
+            intervalMs += 5000;
+            continue;
+        }
+        if (error) {
+            const description = stringField(data, "error_description") ?? "";
+            throw new Error(`Kiro device authorization failed: ${error}${description ? ` - ${description}` : ""}`);
+        }
+        if (!response.ok) {
+            throw new Error(`Kiro device token request failed: HTTP ${response.status}`);
+        }
+        const accessToken = stringField(data, "access_token", "accessToken");
+        const refreshToken = stringField(data, "refresh_token", "refreshToken");
+        if (!accessToken || !refreshToken)
+            throw new Error("Kiro device token response did not return access and refresh tokens.");
+        const expiresIn = numberField(data, "expires_in", "expiresIn") ?? 3600;
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt: Date.now() + expiresIn * 1000,
+            clientId: authorization.clientId,
+            clientSecret: authorization.clientSecret,
+            oidcRegion: authorization.oidcRegion,
+            region: options.profileArn ? (regionFromProfileArn(options.profileArn) ?? options.region) : options.region,
+            startUrl: authorization.startUrl,
+            ...(options.profileArn ? { profileArn: options.profileArn } : {}),
+        };
+    }
+    throw new Error("Kiro device authorization timed out.");
+}
+export async function refreshKiroDeviceAuthCredential(credential, fetcher = fetch) {
+    const data = await jsonResponse(await fetcher(`${oidcEndpoint(credential.oidcRegion)}/token`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": deviceAuthUserAgent(),
+        },
+        body: JSON.stringify({
+            refreshToken: credential.refreshToken,
+            clientId: credential.clientId,
+            clientSecret: credential.clientSecret,
+            grantType: "refresh_token",
+        }),
+    }));
+    const accessToken = stringField(data, "access_token", "accessToken");
+    if (!accessToken)
+        throw new Error("Kiro refresh token response did not return an access token.");
+    const refreshToken = stringField(data, "refresh_token", "refreshToken") ?? credential.refreshToken;
+    const expiresIn = numberField(data, "expires_in", "expiresIn") ?? 3600;
+    return {
+        ...credential,
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + expiresIn * 1000,
+    };
+}
+function base64UrlEncode(value) {
+    return Buffer.from(value, "utf8").toString("base64url");
+}
+function base64UrlDecode(value) {
+    return Buffer.from(value, "base64url").toString("utf8");
+}
+export function encodeKiroDeviceAuthKey(credential) {
+    return `${KIRO_DEVICE_AUTH_KEY_PREFIX}${base64UrlEncode(JSON.stringify(credential))}`;
+}
+export function decodeKiroDeviceAuthKey(key) {
+    try {
+        if (!key?.startsWith(KIRO_DEVICE_AUTH_KEY_PREFIX))
+            return undefined;
+        const parsed = jsonObject(base64UrlDecode(key.slice(KIRO_DEVICE_AUTH_KEY_PREFIX.length)));
+        const accessToken = stringField(parsed, "accessToken");
+        const refreshToken = stringField(parsed, "refreshToken");
+        const expiresAt = numberField(parsed, "expiresAt");
+        const clientId = stringField(parsed, "clientId");
+        const clientSecret = stringField(parsed, "clientSecret");
+        const oidcRegion = stringField(parsed, "oidcRegion");
+        const region = stringField(parsed, "region");
+        const startUrl = stringField(parsed, "startUrl");
+        if (!accessToken || !refreshToken || !expiresAt || !clientId || !clientSecret || !oidcRegion || !region || !startUrl)
+            return undefined;
+        const profileArn = stringField(parsed, "profileArn");
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt,
+            clientId,
+            clientSecret,
+            oidcRegion,
+            region,
+            startUrl,
+            ...(profileArn ? { profileArn } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isKiroDeviceAuthKey(key) {
+    return Boolean(decodeKiroDeviceAuthKey(key));
+}
+export async function credentialFromKiroDeviceAuthKey(key, fetcher = fetch) {
+    const cached = refreshedDeviceCredentials.get(key);
+    let credential = cached ?? decodeKiroDeviceAuthKey(key);
+    if (!credential)
+        return undefined;
+    if (credential.expiresAt <= Date.now() + TOKEN_REFRESH_BUFFER_MS) {
+        let refresh = deviceRefreshes.get(key);
+        if (!refresh) {
+            refresh = refreshKiroDeviceAuthCredential(credential, fetcher).finally(() => {
+                deviceRefreshes.delete(key);
+            });
+            deviceRefreshes.set(key, refresh);
+        }
+        credential = await refresh;
+        refreshedDeviceCredentials.set(key, credential);
+    }
+    return {
+        accessToken: credential.accessToken,
+        refreshToken: credential.refreshToken,
+        expiresAt: new Date(credential.expiresAt).toISOString(),
+        ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+        region: regionFromProfileArn(credential.profileArn) ?? credential.region,
+        source: "opencode-device-auth",
+    };
+}
 function urls(text) {
     return text.match(/https?:\/\/[^\s"'<>]+/g) ?? [];
 }
@@ -340,7 +596,7 @@ export async function resolveApiKey(auth, env = process.env) {
         return env.KIRO_API_KEY;
     try {
         const credential = await auth();
-        return credential.type === "api" && credential.key ? credential.key : "";
+        return credential.key || credential.access || "";
     }
     catch {
         return "";

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AcpConnection, AcpNotificationHandler, AcpStdioClientOptions, Json
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export type { AcpSessionClient, KiroAcpTransportOptions } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, decodeKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, extractKiroLoginUrl, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, refreshKiroDeviceAuthCredential, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/index.js

@@ -2,7 +2,7 @@ import { KiroPlugin } from "./plugin.js";
 export { AcpJsonRpcClient, createAcpStdioClient, decodeJsonRpc, encodeJsonRpc } from "./acp-client.js";
 export { acpPermissionResponse, KiroAcpTransport } from "./acp-transport.js";
 export { createKiroPlugin, effectiveBackend, KiroPlugin } from "./plugin.js";
-export { detectAuth, extractKiroLoginUrl, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
+export { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, decodeKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, extractKiroLoginUrl, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, KIRO_LOGIN_URL, readKiroCliSessionCredential, redacted, regionFromProfileArn, refreshKiroDeviceAuthCredential, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLogin, startKiroCliLoginOnce, } from "./auth.js";
 export { cliChatArgs, KiroCliChatTransport, promptForCli } from "./cli-transport.js";
 export { createKiroFetch } from "./fetch-adapter.js";
 export { loadOptions } from "./config.js";

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { detectAuth, resolveApiKey, runKiroLoginFlowOnce, startKiroCliLoginOnce } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -53,6 +53,10 @@ function bearerToken(init) {
     const match = header?.match(/^Bearer\s+(.+)$/i);
     return match?.[1] || undefined;
 }
+function inputString(inputs, key) {
+    const value = inputs?.[key];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
 export function effectiveBackend(options, accessToken) {
     const apiKey = accessToken || process.env.KIRO_API_KEY;
     if (options.backend === "acp")
@@ -78,6 +82,12 @@ function localTransport(options, accessToken) {
     }
     if (backend === "fetch") {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
+        if (isKiroDeviceAuthKey(apiKey)) {
+            return new KiroRestTransport(fetchTransportOptions(options), {
+                credentialProvider: () => credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined),
+                login: async () => false,
+            });
+        }
         return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
             login: () => runKiroLoginFlowOnce({ login: options.login }),
         });
@@ -114,20 +124,25 @@ export function createKiroPlugin() {
             modelCache.update(Object.keys(options.extraModels).map((id) => ({ id: normalizeModelName(id) })));
         }
         let discovery;
-        let discoveryAttempted = false;
-        const discoverIfStale = async () => {
-            if (options.modelDiscovery === "off" ||
-                options.modelDiscoveryCommand.length === 0 ||
-                discoveryAttempted) {
-                return;
+        let lastModelDiscoveryAt = 0;
+        const refreshModelsIfStale = () => {
+            const discoveryIsStale = lastModelDiscoveryAt === 0 || Date.now() - lastModelDiscoveryAt > options.modelCacheTtlSeconds * 1000;
+            if (options.modelDiscovery === "off" || options.modelDiscoveryCommand.length === 0 || !discoveryIsStale || discovery) {
+                return discovery;
             }
-            discoveryAttempted = true;
-            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1), { loginOnAuthFailure: true, login: () => runKiroLoginFlowOnce({ login: options.login }) })
+            discovery = refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+                .then((models) => {
+                if (models.length > 0)
+                    lastModelDiscoveryAt = Date.now();
+            })
                 .catch(() => undefined)
                 .then(() => {
                 discovery = undefined;
             });
-            await discovery;
+            return discovery;
+        };
+        const refreshModelsInBackground = () => {
+            void refreshModelsIfStale();
         };
         const resolver = new ModelResolver({
             cache: modelCache,
@@ -155,7 +170,7 @@ export function createKiroPlugin() {
                 localServer = undefined;
             },
             config: async (config) => {
-                await discoverIfStale();
+                refreshModelsInBackground();
                 config.provider ??= {};
                 config.provider[options.providerID] ??= {};
                 const provider = config.provider[options.providerID];
@@ -176,26 +191,66 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: "Kiro CLI login",
-                        authorize: async () => {
-                            const session = startKiroCliLoginOnce(options.login);
-                            await session.waitForPrompt();
+                        label: "Kiro device login",
+                        prompts: [
+                            {
+                                type: "text",
+                                key: "startUrl",
+                                message: options.login.identityProvider
+                                    ? `IAM Identity Center Start URL (current: ${options.login.identityProvider}, leave blank to keep)`
+                                    : "IAM Identity Center Start URL (leave blank for AWS Builder ID)",
+                                placeholder: "https://your-company.awsapps.com/start",
+                            },
+                            {
+                                type: "text",
+                                key: "idcRegion",
+                                message: options.login.region && options.login.region !== "us-east-1"
+                                    ? `IAM Identity Center region (current: ${options.login.region}, leave blank to keep)`
+                                    : "IAM Identity Center region (leave blank for us-east-1)",
+                                placeholder: "us-east-1",
+                            },
+                            {
+                                type: "text",
+                                key: "profileArn",
+                                message: options.profileArn
+                                    ? `Profile ARN (current: ${options.profileArn}, leave blank to keep)`
+                                    : "Profile ARN (optional, improves region/profile routing for IAM Identity Center)",
+                                placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
+                            },
+                        ],
+                        authorize: async (inputs) => {
+                            const promptInputs = inputs;
+                            const startUrl = inputString(promptInputs, "startUrl") ?? options.login.identityProvider;
+                            const idcRegion = inputString(promptInputs, "idcRegion") ?? options.login.region ?? "us-east-1";
+                            const profileArn = inputString(promptInputs, "profileArn") ?? options.profileArn;
+                            const authorization = await authorizeKiroDevice({
+                                region: idcRegion,
+                                ...(startUrl ? { identityProvider: startUrl } : {}),
+                            });
+                            const url = startUrl
+                                ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode)
+                                : authorization.verificationUrlComplete;
                             return {
-                                url: session.url,
-                                instructions: session.instructions,
+                                url,
+                                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
                                 method: "auto",
                                 callback: async () => {
-                                    const authenticated = await session.waitForAuth();
-                                    if (!authenticated)
-                                        return { type: "failed" };
-                                    const diagnostics = await detectAuth().catch(() => undefined);
+                                    const credential = await pollKiroDeviceToken(authorization, {
+                                        region: options.region,
+                                        ...(profileArn ? { profileArn } : {}),
+                                    });
+                                    const key = encodeKiroDeviceAuthKey(credential);
                                     return {
                                         type: "success",
-                                        key: "kiro-plugin-local-transport",
+                                        key,
+                                        access: key,
+                                        refresh: credential.refreshToken,
+                                        expires: credential.expiresAt,
                                         metadata: {
-                                            source: "kiro-cli",
-                                            ...(diagnostics?.account ? { account: diagnostics.account } : {}),
-                                            ...(diagnostics?.region ? { region: diagnostics.region } : {}),
+                                            source: "kiro-device-auth",
+                                            region: credential.region,
+                                            oidcRegion: credential.oidcRegion,
+                                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
                                         },
                                     };
                                 },
@@ -222,7 +277,6 @@ export function createKiroPlugin() {
                     },
                 ],
                 loader: async (auth) => {
-                    await discoverIfStale();
                     const apiKey = await resolveApiKey(auth);
                     const server = await ensureLocalServer();
                     return {
@@ -236,7 +290,7 @@ export function createKiroPlugin() {
                     description: "Show Kiro plugin backend, auth, region, and discovered model status.",
                     args: {},
                     execute: async () => {
-                        await discoverIfStale();
+                        refreshModelsInBackground();
                         const auth = await detectAuth();
                         return {
                             title: "Kiro status",
@@ -265,7 +319,7 @@ export function createKiroPlugin() {
             provider: {
                 id: options.providerID,
                 models: async (provider) => {
-                    await discoverIfStale();
+                    refreshModelsInBackground();
                     const existing = modelRecord(provider.models);
                     const visibleModels = visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels);
                     const server = await ensureLocalServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",