@bogyie/opencode-kiro-plugin 0.3.7 → 0.3.9

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-When no usable Kiro CLI session is available, OpenCode's startup model discovery does not start browser login. If startup discovery cannot list models, the plugin keeps Kiro visible with an `auto` placeholder model.
+OpenCode startup does not start Kiro login, model discovery, or provider injection. Kiro is added through OpenCode's provider connector, or by explicitly defining `provider.kiro` yourself. Model discovery runs only when you explicitly call the `kiro_refresh_models` plugin tool; if discovery succeeds, later model-list requests use the latest in-memory cache. If discovery fails, the previous cache remains in use.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. When `login.identityProvider` and `login.region` are configured, use `Kiro device login (configured)` to start login without re-entering those values. Use `Kiro device login (custom)` only when you need to override the Start URL, OIDC region, or profile ARN for that login. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow from the configured `login` options and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
@@ -62,9 +62,9 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-The connector can also prompt for the Start URL, OIDC region, and optional profile ARN. For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
+For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
 
-Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
+Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory model cache. Secrets are redacted in diagnostics.
 
 ## Backend Modes
 
@@ -105,7 +105,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. By default, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker; if discovery cannot return any models, the plugin exposes an `auto` placeholder so OpenCode keeps the Kiro provider visible for connection.
+The resolver intentionally avoids a hard whitelist. Startup does not add a fallback `auto` model. When you run `kiro_refresh_models`, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
 
 Useful options:
 
@@ -151,11 +151,11 @@ Resolution order:
 6. Hidden/manual model mapping
 7. Optimistic pass-through unless disabled
 
-This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
+This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker after discovery has succeeded. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
 
-The plugin injects `provider.kiro` automatically. You only need to add `provider.kiro.models` yourself when overriding OpenCode model-picker metadata, such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
+The plugin does not inject `provider.kiro` during startup. Add Kiro through OpenCode's provider connector, or define `provider.kiro` yourself when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. If this command fails during startup, the provider remains visible with the `auto` placeholder and you can connect Kiro through OpenCode's provider connector. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable `kiro_refresh_models`. Discovery is best-effort and never runs during OpenCode startup; authenticate manually through the connector or let an API/model request handle auth failure. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -9,8 +9,6 @@ import { ModelCache } from "./model-cache.js";
 import { refreshModelCacheFromCommand } from "./model-discovery.js";
 import { ModelResolver, normalizeModelName } from "./model-resolver.js";
 import { KiroRestTransport } from "./kiro-rest-transport.js";
-const PLACEHOLDER_MODEL_ID = "auto";
-const PLACEHOLDER_MODEL = { name: "Auto" };
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -44,9 +42,7 @@ function visibleProviderModels(cache, configuredModels, hiddenModels, disabledMo
             ...(configuredModels[id] ?? {}),
         },
     ]));
-    if (Object.keys(models).length > 0 || disabledModels.has(PLACEHOLDER_MODEL_ID))
-        return models;
-    return { [PLACEHOLDER_MODEL_ID]: PLACEHOLDER_MODEL };
+    return models;
 }
 function bearerToken(init) {
     const header = new Headers(init?.headers).get("authorization");
@@ -84,8 +80,8 @@ function localTransport(options, accessToken) {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
         if (isKiroDeviceAuthKey(apiKey)) {
             return new KiroRestTransport(fetchTransportOptions(options), {
-                credentialProvider: () => credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined),
-                login: async () => false,
+                credentialProvider: async () => (await credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined)) ?? readKiroCliSessionCredential(),
+                login: () => runKiroLoginFlowOnce({ login: options.login }),
             });
         }
         return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
@@ -124,20 +120,25 @@ export function createKiroPlugin() {
             modelCache.update(Object.keys(options.extraModels).map((id) => ({ id: normalizeModelName(id) })));
         }
         let discovery;
-        let discoveryAttempted = false;
-        const discoverIfStale = async () => {
-            if (options.modelDiscovery === "off" ||
-                options.modelDiscoveryCommand.length === 0 ||
-                discoveryAttempted) {
-                return;
+        let lastModelDiscoveryAt = 0;
+        const refreshModels = async (force = false) => {
+            const discoveryIsStale = lastModelDiscoveryAt === 0 || Date.now() - lastModelDiscoveryAt > options.modelCacheTtlSeconds * 1000;
+            if (options.modelDiscovery === "off" || options.modelDiscoveryCommand.length === 0 || (!force && !discoveryIsStale)) {
+                return [];
             }
-            discoveryAttempted = true;
-            discovery ??= refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
-                .catch(() => undefined)
-                .then(() => {
-                discovery = undefined;
-            });
-            await discovery;
+            if (!discovery) {
+                discovery = refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+                    .then((models) => {
+                    if (models.length > 0)
+                        lastModelDiscoveryAt = Date.now();
+                    return models;
+                })
+                    .catch(() => [])
+                    .finally(() => {
+                    discovery = undefined;
+                });
+            }
+            return (await discovery);
         };
         const resolver = new ModelResolver({
             cache: modelCache,
@@ -159,16 +160,50 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
+        const authorizeDeviceLogin = async (inputs) => {
+            const startUrl = inputString(inputs, "startUrl") ?? options.login.identityProvider;
+            const idcRegion = inputString(inputs, "idcRegion") ?? options.login.region ?? "us-east-1";
+            const profileArn = inputString(inputs, "profileArn") ?? options.profileArn;
+            const authorization = await authorizeKiroDevice({
+                region: idcRegion,
+                ...(startUrl ? { identityProvider: startUrl } : {}),
+            });
+            const url = startUrl ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode) : authorization.verificationUrlComplete;
+            return {
+                url,
+                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
+                method: "auto",
+                callback: async () => {
+                    const credential = await pollKiroDeviceToken(authorization, {
+                        region: options.region,
+                        ...(profileArn ? { profileArn } : {}),
+                    });
+                    const key = encodeKiroDeviceAuthKey(credential);
+                    return {
+                        type: "success",
+                        key,
+                        access: key,
+                        refresh: credential.refreshToken,
+                        expires: credential.expiresAt,
+                        metadata: {
+                            source: "kiro-device-auth",
+                            region: credential.region,
+                            oidcRegion: credential.oidcRegion,
+                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+                        },
+                    };
+                },
+            };
+        };
         return {
             dispose: async () => {
                 await localServer?.close();
                 localServer = undefined;
             },
             config: async (config) => {
-                await discoverIfStale();
-                config.provider ??= {};
-                config.provider[options.providerID] ??= {};
-                const provider = config.provider[options.providerID];
+                const provider = config.provider?.[options.providerID];
+                if (!provider)
+                    return;
                 const server = await ensureLocalServer();
                 userModelOverrides ??= modelRecord(provider.models);
                 configuredModels = {
@@ -186,7 +221,12 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: "Kiro device login",
+                        label: options.login.identityProvider ? "Kiro device login (configured)" : "Kiro device login",
+                        authorize: async () => authorizeDeviceLogin(),
+                    },
+                    {
+                        type: "oauth",
+                        label: "Kiro device login (custom)",
                         prompts: [
                             {
                                 type: "text",
@@ -213,44 +253,7 @@ export function createKiroPlugin() {
                                 placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
                             },
                         ],
-                        authorize: async (inputs) => {
-                            const promptInputs = inputs;
-                            const startUrl = inputString(promptInputs, "startUrl") ?? options.login.identityProvider;
-                            const idcRegion = inputString(promptInputs, "idcRegion") ?? options.login.region ?? "us-east-1";
-                            const profileArn = inputString(promptInputs, "profileArn") ?? options.profileArn;
-                            const authorization = await authorizeKiroDevice({
-                                region: idcRegion,
-                                ...(startUrl ? { identityProvider: startUrl } : {}),
-                            });
-                            const url = startUrl
-                                ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode)
-                                : authorization.verificationUrlComplete;
-                            return {
-                                url,
-                                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
-                                method: "auto",
-                                callback: async () => {
-                                    const credential = await pollKiroDeviceToken(authorization, {
-                                        region: options.region,
-                                        ...(profileArn ? { profileArn } : {}),
-                                    });
-                                    const key = encodeKiroDeviceAuthKey(credential);
-                                    return {
-                                        type: "success",
-                                        key,
-                                        access: key,
-                                        refresh: credential.refreshToken,
-                                        expires: credential.expiresAt,
-                                        metadata: {
-                                            source: "kiro-device-auth",
-                                            region: credential.region,
-                                            oidcRegion: credential.oidcRegion,
-                                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
-                                        },
-                                    };
-                                },
-                            };
-                        },
+                        authorize: async (inputs) => authorizeDeviceLogin(inputs),
                     },
                     {
                         type: "api",
@@ -272,7 +275,6 @@ export function createKiroPlugin() {
                     },
                 ],
                 loader: async (auth) => {
-                    await discoverIfStale();
                     const apiKey = await resolveApiKey(auth);
                     const server = await ensureLocalServer();
                     return {
@@ -286,7 +288,6 @@ export function createKiroPlugin() {
                     description: "Show Kiro plugin backend, auth, region, and discovered model status.",
                     args: {},
                     execute: async () => {
-                        await discoverIfStale();
                         const auth = await detectAuth();
                         return {
                             title: "Kiro status",
@@ -311,11 +312,29 @@ export function createKiroPlugin() {
                         };
                     },
                 }),
+                kiro_refresh_models: tool({
+                    description: "Refresh the cached Kiro model list on demand.",
+                    args: {},
+                    execute: async () => {
+                        const models = await refreshModels(true);
+                        const cached = modelCache.ids();
+                        return {
+                            title: models.length > 0 ? "Kiro models refreshed" : "Kiro model refresh skipped",
+                            output: models.length > 0
+                                ? `refreshed: ${models.length}\ncached: ${cached.length}`
+                                : `No models were discovered. Keeping cached models: ${cached.length}`,
+                            metadata: {
+                                refreshed: models.length > 0,
+                                discovered: models.length,
+                                cached: cached.length,
+                            },
+                        };
+                    },
+                }),
             },
             provider: {
                 id: options.providerID,
                 models: async (provider) => {
-                    await discoverIfStale();
                     const existing = modelRecord(provider.models);
                     const visibleModels = visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels);
                     const server = await ensureLocalServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",