@bogyie/opencode-kiro-plugin 0.3.8 → 0.3.10

package/README.md

@@ -38,9 +38,9 @@ The plugin resolves credentials in this order:
 3. Local Kiro CLI session token from the Kiro CLI SQLite store
 4. `kiro-cli whoami` diagnostics for CLI session visibility
 
-OpenCode startup does not start Kiro login. The provider is registered immediately with an `auto` placeholder model, then model discovery warms the in-memory cache in the background. If discovery succeeds, later model-list requests use the latest cached list; if discovery fails, the previous cache remains in use and Kiro stays visible with `auto`.
+OpenCode startup does not start Kiro login or model discovery. The plugin injects a minimal `provider.kiro` shell so Kiro appears in OpenCode's provider connector, but it does not add a default model. Model discovery runs only when you explicitly call the `kiro_refresh_models` plugin tool; if discovery succeeds, later model-list requests use the latest in-memory cache. If discovery fails, the previous cache remains in use.
 
-You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
+You can open OpenCode's provider connector, choose Kiro, and select `Kiro device login`. When `login.identityProvider` and `login.region` are configured, use `Kiro device login (configured)` to start login without re-entering those values. Use `Kiro device login (custom)` only when you need to override the Start URL, OIDC region, or profile ARN for that login. The connector uses AWS OIDC device authorization directly, so it does not rely on a localhost callback URL. After login succeeds, the plugin stores the access token, refresh token, OIDC client credentials, region, and optional profile ARN in OpenCode auth. Direct fetch mode reuses that stored credential and refreshes the access token before expiry; it does not ask you to log in again while the refresh token remains valid. If no OpenCode device credential or API key is configured, direct fetch reads the active Kiro CLI session token and calls Kiro's REST/EventStream endpoint directly. If an API/model call fails with an auth error, the selected transport starts the Kiro login flow from the configured `login` options and retries the request once. `cli-chat` mode uses the official `kiro-cli chat --no-interactive` surface and depends on the local Kiro CLI login state. `acp` mode uses the official `kiro-cli acp` surface, but is still treated as an explicit backend while its real-world protocol behavior is validated across Kiro CLI versions.
 
 For AWS IAM Identity Center login, configure the default device-flow Start URL separately from the API region:
 
@@ -62,9 +62,9 @@ For AWS IAM Identity Center login, configure the default device-flow Start URL s
 }
 ```
 
-The connector can also prompt for the Start URL, OIDC region, and optional profile ARN. For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
+For IAM Identity Center, the plugin opens the AWS portal device URL, such as `https://example.awsapps.com/start/#/device?user_code=...`, instead of a `localhost` callback URL.
 
-Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Secrets are redacted in diagnostics.
+Use the `kiro_status` plugin tool to inspect provider id, backend, region, auth method, and discovered model count. Use `kiro_refresh_models` when you explicitly want to run the configured model discovery command and update the in-memory model cache. Secrets are redacted in diagnostics.
 
 ## Backend Modes
 
@@ -105,7 +105,7 @@ Supported values:
 
 ## Model Churn Handling
 
-The resolver intentionally avoids a hard whitelist. Startup always begins with the `auto` placeholder so OpenCode can show Kiro without waiting for Kiro auth or model discovery. By default, the plugin then reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json` in the background. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
+The resolver intentionally avoids a hard whitelist. Startup does not add a fallback `auto` model. When you run `kiro_refresh_models`, the plugin reads the current Kiro CLI model list with `kiro-cli chat --list-models --format json`. Runtime discovery is the source of truth for the model picker once it has succeeded; failed refreshes do not clear the last successful cache.
 
 Useful options:
 
@@ -153,9 +153,9 @@ Resolution order:
 
 This keeps new Kiro model ids usable before the package is updated without advertising unavailable models in OpenCode's picker after discovery has succeeded. Use `extraModels` only when you explicitly want a model to appear even though it is not listed by your installed Kiro CLI. Set `disableModelPassThrough: true` only when you need strict model governance.
 
-The plugin injects `provider.kiro` automatically. You only need to add `provider.kiro.models` yourself when overriding OpenCode model-picker metadata, such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
+The plugin injects only the minimal `provider.kiro` shell needed for OpenCode's provider connector. Define `provider.kiro.models` yourself only when you need explicit model-picker metadata such as a display name or context limit. Use plugin `modelAliases` for aliases that should resolve one requested model id to another.
 
-`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to skip runtime discovery. Discovery is best-effort and never starts login during OpenCode startup; authenticate manually through the connector or let an API/model request handle auth failure. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
+`modelDiscoveryCommand` defaults to `["kiro-cli", "chat", "--list-models", "--format", "json"]`. Set `modelDiscovery` to `"off"` to disable `kiro_refresh_models`. Discovery is best-effort and never runs during OpenCode startup; authenticate manually through the connector or let an API/model request handle auth failure. Discovery stdout can be a JSON array, `{ "models": [...] }`, `{ "data": [...] }`, Kiro CLI list-models JSON, Kiro CLI plain list output, or one model id per line.
 
 ## Troubleshooting
 

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { KiroAcpTransport } from "./acp-transport.js";
-import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
+import { authorizeKiroDevice, credentialFromKiroDeviceAuthKey, detectAuth, encodeKiroDeviceAuthKey, isKiroDeviceAuthKey, kiroDeviceVerificationUrl, pollKiroDeviceToken, readKiroCliSessionCredential, resolveApiKey, runKiroLoginFlowOnce, } from "./auth.js";
 import { KiroCliChatTransport } from "./cli-transport.js";
 import { loadOptions } from "./config.js";
 import { createKiroFetch } from "./fetch-adapter.js";
@@ -9,8 +9,6 @@ import { ModelCache } from "./model-cache.js";
 import { refreshModelCacheFromCommand } from "./model-discovery.js";
 import { ModelResolver, normalizeModelName } from "./model-resolver.js";
 import { KiroRestTransport } from "./kiro-rest-transport.js";
-const PLACEHOLDER_MODEL_ID = "auto";
-const PLACEHOLDER_MODEL = { name: "Auto" };
 function discoveredProviderModels(cache) {
     return Object.fromEntries(cache.all().map((model) => [
         model.id,
@@ -44,9 +42,7 @@ function visibleProviderModels(cache, configuredModels, hiddenModels, disabledMo
             ...(configuredModels[id] ?? {}),
         },
     ]));
-    if (Object.keys(models).length > 0 || disabledModels.has(PLACEHOLDER_MODEL_ID))
-        return models;
-    return { [PLACEHOLDER_MODEL_ID]: PLACEHOLDER_MODEL };
+    return models;
 }
 function bearerToken(init) {
     const header = new Headers(init?.headers).get("authorization");
@@ -84,8 +80,8 @@ function localTransport(options, accessToken) {
         const apiKey = accessToken || process.env.KIRO_API_KEY;
         if (isKiroDeviceAuthKey(apiKey)) {
             return new KiroRestTransport(fetchTransportOptions(options), {
-                credentialProvider: () => credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined),
-                login: async () => false,
+                credentialProvider: async () => (await credentialFromKiroDeviceAuthKey(apiKey).catch(() => undefined)) ?? readKiroCliSessionCredential(),
+                login: () => runKiroLoginFlowOnce({ login: options.login }),
             });
         }
         return new KiroRestTransport(fetchTransportOptions(options, apiKey === "kiro-plugin-local-transport" ? undefined : apiKey), {
@@ -125,24 +121,24 @@ export function createKiroPlugin() {
         }
         let discovery;
         let lastModelDiscoveryAt = 0;
-        const refreshModelsIfStale = () => {
+        const refreshModels = async (force = false) => {
             const discoveryIsStale = lastModelDiscoveryAt === 0 || Date.now() - lastModelDiscoveryAt > options.modelCacheTtlSeconds * 1000;
-            if (options.modelDiscovery === "off" || options.modelDiscoveryCommand.length === 0 || !discoveryIsStale || discovery) {
-                return discovery;
+            if (options.modelDiscovery === "off" || options.modelDiscoveryCommand.length === 0 || (!force && !discoveryIsStale)) {
+                return [];
             }
-            discovery = refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
-                .then((models) => {
-                if (models.length > 0)
-                    lastModelDiscoveryAt = Date.now();
-            })
-                .catch(() => undefined)
-                .then(() => {
-                discovery = undefined;
-            });
-            return discovery;
-        };
-        const refreshModelsInBackground = () => {
-            void refreshModelsIfStale();
+            if (!discovery) {
+                discovery = refreshModelCacheFromCommand(modelCache, options.modelDiscoveryCommand[0], options.modelDiscoveryCommand.slice(1))
+                    .then((models) => {
+                    if (models.length > 0)
+                        lastModelDiscoveryAt = Date.now();
+                    return models;
+                })
+                    .catch(() => [])
+                    .finally(() => {
+                    discovery = undefined;
+                });
+            }
+            return (await discovery);
         };
         const resolver = new ModelResolver({
             cache: modelCache,
@@ -164,13 +160,47 @@ export function createKiroPlugin() {
             localServer = await startLocalKiroServer(localFetch);
             return localServer;
         };
+        const authorizeDeviceLogin = async (inputs) => {
+            const startUrl = inputString(inputs, "startUrl") ?? options.login.identityProvider;
+            const idcRegion = inputString(inputs, "idcRegion") ?? options.login.region ?? "us-east-1";
+            const profileArn = inputString(inputs, "profileArn") ?? options.profileArn;
+            const authorization = await authorizeKiroDevice({
+                region: idcRegion,
+                ...(startUrl ? { identityProvider: startUrl } : {}),
+            });
+            const url = startUrl ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode) : authorization.verificationUrlComplete;
+            return {
+                url,
+                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
+                method: "auto",
+                callback: async () => {
+                    const credential = await pollKiroDeviceToken(authorization, {
+                        region: options.region,
+                        ...(profileArn ? { profileArn } : {}),
+                    });
+                    const key = encodeKiroDeviceAuthKey(credential);
+                    return {
+                        type: "success",
+                        key,
+                        access: key,
+                        refresh: credential.refreshToken,
+                        expires: credential.expiresAt,
+                        metadata: {
+                            source: "kiro-device-auth",
+                            region: credential.region,
+                            oidcRegion: credential.oidcRegion,
+                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
+                        },
+                    };
+                },
+            };
+        };
         return {
             dispose: async () => {
                 await localServer?.close();
                 localServer = undefined;
             },
             config: async (config) => {
-                refreshModelsInBackground();
                 config.provider ??= {};
                 config.provider[options.providerID] ??= {};
                 const provider = config.provider[options.providerID];
@@ -191,7 +221,12 @@ export function createKiroPlugin() {
                 methods: [
                     {
                         type: "oauth",
-                        label: "Kiro device login",
+                        label: options.login.identityProvider ? "Kiro device login (configured)" : "Kiro device login",
+                        authorize: async () => authorizeDeviceLogin(),
+                    },
+                    {
+                        type: "oauth",
+                        label: "Kiro device login (custom)",
                         prompts: [
                             {
                                 type: "text",
@@ -218,44 +253,7 @@ export function createKiroPlugin() {
                                 placeholder: "arn:aws:codewhisperer:us-east-1:123456789012:profile/XXXXXXXXXX",
                             },
                         ],
-                        authorize: async (inputs) => {
-                            const promptInputs = inputs;
-                            const startUrl = inputString(promptInputs, "startUrl") ?? options.login.identityProvider;
-                            const idcRegion = inputString(promptInputs, "idcRegion") ?? options.login.region ?? "us-east-1";
-                            const profileArn = inputString(promptInputs, "profileArn") ?? options.profileArn;
-                            const authorization = await authorizeKiroDevice({
-                                region: idcRegion,
-                                ...(startUrl ? { identityProvider: startUrl } : {}),
-                            });
-                            const url = startUrl
-                                ? kiroDeviceVerificationUrl(authorization.startUrl, authorization.userCode)
-                                : authorization.verificationUrlComplete;
-                            return {
-                                url,
-                                instructions: `Open the verification URL and complete Kiro sign-in.\nCode: ${authorization.userCode}`,
-                                method: "auto",
-                                callback: async () => {
-                                    const credential = await pollKiroDeviceToken(authorization, {
-                                        region: options.region,
-                                        ...(profileArn ? { profileArn } : {}),
-                                    });
-                                    const key = encodeKiroDeviceAuthKey(credential);
-                                    return {
-                                        type: "success",
-                                        key,
-                                        access: key,
-                                        refresh: credential.refreshToken,
-                                        expires: credential.expiresAt,
-                                        metadata: {
-                                            source: "kiro-device-auth",
-                                            region: credential.region,
-                                            oidcRegion: credential.oidcRegion,
-                                            ...(credential.profileArn ? { profileArn: credential.profileArn } : {}),
-                                        },
-                                    };
-                                },
-                            };
-                        },
+                        authorize: async (inputs) => authorizeDeviceLogin(inputs),
                     },
                     {
                         type: "api",
@@ -290,7 +288,6 @@ export function createKiroPlugin() {
                     description: "Show Kiro plugin backend, auth, region, and discovered model status.",
                     args: {},
                     execute: async () => {
-                        refreshModelsInBackground();
                         const auth = await detectAuth();
                         return {
                             title: "Kiro status",
@@ -315,11 +312,29 @@ export function createKiroPlugin() {
                         };
                     },
                 }),
+                kiro_refresh_models: tool({
+                    description: "Refresh the cached Kiro model list on demand.",
+                    args: {},
+                    execute: async () => {
+                        const models = await refreshModels(true);
+                        const cached = modelCache.ids();
+                        return {
+                            title: models.length > 0 ? "Kiro models refreshed" : "Kiro model refresh skipped",
+                            output: models.length > 0
+                                ? `refreshed: ${models.length}\ncached: ${cached.length}`
+                                : `No models were discovered. Keeping cached models: ${cached.length}`,
+                            metadata: {
+                                refreshed: models.length > 0,
+                                discovered: models.length,
+                                cached: cached.length,
+                            },
+                        };
+                    },
+                }),
             },
             provider: {
                 id: options.providerID,
                 models: async (provider) => {
-                    refreshModelsInBackground();
                     const existing = modelRecord(provider.models);
                     const visibleModels = visibleProviderModels(modelCache, configuredModels, options.hiddenModels, disabledModels);
                     const server = await ensureLocalServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bogyie/opencode-kiro-plugin",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "OpenCode plugin for using Kiro as a provider adapter",
   "type": "module",
   "main": "dist/index.js",