@f5-sales-demo/pi-ai 23.9.4 → 23.10.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "23.9.4",
+	"version": "23.10.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "0.124.0",
 		"@aws-sdk/client-bedrock-runtime": "3.1127.0",
 		"@bufbuild/protobuf": "2.14.1",
-		"@f5-sales-demo/pi-utils": "23.9.4",
+		"@f5-sales-demo/pi-utils": "23.10.1",
 		"@google/genai": "2.21.0",
 		"@sinclair/typebox": "0.34.52",
 		"@smithy/node-http-handler": "4.12.1",

package/src/auth-storage.ts

@@ -12,7 +12,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { $envExact, getAgentDbPath, logger } from "@f5-sales-demo/pi-utils";
 import { getEnvApiKey } from "./stream";
-import type { Provider } from "./types";
+import type { Model, Provider } from "./types";
 import type {
 	CredentialRankingStrategy,
 	UsageCredential,
@@ -44,6 +44,7 @@ import { loginHuggingface } from "./utils/oauth/huggingface";
 import { loginKagi } from "./utils/oauth/kagi";
 import { loginKilo } from "./utils/oauth/kilo";
 import { loginKimi } from "./utils/oauth/kimi";
+import type { KiroCredentials } from "./utils/oauth/kiro-credentials";
 import { loginLiteLLM } from "./utils/oauth/litellm";
 import { loginLmStudio } from "./utils/oauth/lm-studio";
 import { loginMiniMaxCode, loginMiniMaxCodeCn } from "./utils/oauth/minimax-code";
@@ -267,6 +268,7 @@ type UsageRequestDescriptor = {
 };
 
 type AuthApiKeyOptions = {
+	kiroConnection?: Model["kiroConnection"];
 	baseUrl?: string;
 	modelId?: string;
 };
@@ -1284,7 +1286,19 @@ export class AuthStorage {
 				break;
 			}
 		}
-		const newCredential: OAuthCredential = { type: "oauth", ...credentials };
+		const newCredential: OAuthCredential = {
+			type: "oauth",
+			...credentials,
+			...(provider === "kiro"
+				? {
+						selectedAt: Math.max(
+							Date.now(),
+							((this.#store.getLatestKiroSelection()?.credential as Partial<KiroCredentials> | undefined)
+								?.selectedAt ?? 0) + 1,
+						),
+					}
+				: {}),
+		};
 		await this.#upsertOAuthCredential(credentialProvider, newCredential);
 	}
 
@@ -1971,13 +1985,29 @@ export class AuthStorage {
 		sessionId?: string,
 		options?: AuthApiKeyOptions,
 	): Promise<string | undefined> {
-		const credentials = this.#getStoredCredentials(provider)
+		let credentials = this.#getStoredCredentials(provider)
 			.map((entry, index) => ({ credential: entry.credential, index, credentialId: entry.id }))
 			.filter(
 				(entry): entry is { credential: OAuthCredential; index: number; credentialId: number } =>
 					entry.credential.type === "oauth",
 			);
 
+		if (provider === "kiro") {
+			const binding = options?.kiroConnection;
+			const latest = binding ? undefined : this.#store.getLatestKiroSelection();
+			credentials = binding
+				? credentials.filter(entry => {
+						const c = entry.credential as OAuthCredential & Partial<KiroCredentials>;
+						return (
+							c.accountId === binding.accountId &&
+							c.profileArn === binding.profileArn &&
+							c.serviceRegion === binding.serviceRegion
+						);
+					})
+				: credentials.filter(entry => {
+						return latest && !latest.disabledCause && entry.credentialId === latest.id;
+					});
+		}
 		if (credentials.length === 0) return undefined;
 
 		const providerKey = this.#getProviderTypeKey(provider, "oauth");
@@ -2172,6 +2202,8 @@ export class AuthStorage {
 			}
 			if (!result) return undefined;
 			const updated: OAuthCredential = {
+				...selection.credential,
+				...result.newCredentials,
 				type: "oauth",
 				access: result.newCredentials.access,
 				refresh: result.newCredentials.refresh,
@@ -2425,6 +2457,12 @@ function resolveProviderCredentialIdentityKey(provider: string, identifiers: str
 
 function resolveCredentialIdentityKey(provider: string, credential: AuthCredential): string | null {
 	if (credential.type === "api_key") return null;
+	if (provider === "kiro") {
+		const c = credential as OAuthCredential & Partial<KiroCredentials>;
+		return c.accountId && c.profileArn && c.serviceRegion
+			? JSON.stringify([c.accountId, c.profileArn, c.serviceRegion])
+			: null;
+	}
 	return resolveProviderCredentialIdentityKey(provider, extractOAuthCredentialIdentifiers(credential));
 }
 
@@ -2836,6 +2874,17 @@ export class AuthCredentialStore {
 
 	// ─── AuthCredentialStore interface ──────────────────────────────────────
 
+	/** Keep the most recent explicit native connection selected even after it is disabled. */
+	getLatestKiroSelection(): StoredAuthCredential | undefined {
+		const row = this.#db
+			.prepare(
+				"SELECT id, provider, credential_type, data, disabled_cause, identity_key FROM auth_credentials WHERE provider = 'kiro' AND credential_type = 'oauth' ORDER BY CASE WHEN json_valid(data) THEN COALESCE(json_extract(data, '$.selectedAt'), 0) ELSE 0 END DESC, id DESC LIMIT 1",
+			)
+			.get() as AuthRow | undefined;
+		if (!row) return undefined;
+		const credential = deserializeCredential(row);
+		return credential ? toStoredAuthCredential(row, credential) : undefined;
+	}
 	listAuthCredentials(provider?: string): StoredAuthCredential[] {
 		const rows =
 			(provider

package/src/index.ts

@@ -20,6 +20,8 @@ export * from "./providers/google";
 export * from "./providers/google-gemini-cli";
 export * from "./providers/google-vertex";
 export * from "./providers/kimi";
+export * from "./providers/kiro";
+export * from "./providers/kiro-service";
 export type { OpenAICodexResponsesOptions } from "./providers/openai-codex-responses";
 export * from "./providers/openai-completions";
 export * from "./providers/openai-responses";

package/src/model-manager.ts

@@ -28,6 +28,8 @@ export interface ModelsDevFallback<TApi extends Api = Api, TPayload = unknown> {
 export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload = unknown> {
 	/** Provider id used for static lookup and cache namespacing. */
 	providerId: Provider;
+	/** Credential/profile-specific namespace; model routing still uses providerId. */
+	cacheNamespace?: string;
 	/** Optional static list override. When omitted, bundled models.json is used. */
 	staticModels?: readonly Model<TApi>[];
 	/** Optional override for the cache database path. Default: <agent-dir>/models.db. */
@@ -98,7 +100,7 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	const staticModels = normalizeModelList<TApi>(
 		options.staticModels ?? getBundledModels(options.providerId as GeneratedProvider),
 	);
-	const cache = readModelCache<TApi>(options.providerId, ttlMs, now, dbPath);
+	const cache = readModelCache<TApi>(options.cacheNamespace ?? options.providerId, ttlMs, now, dbPath);
 	const dynamicFetcher = options.fetchDynamicModels;
 	const hasDynamicFetcher = typeof dynamicFetcher === "function";
 	const hasAuthoritativeCache = (cache?.authoritative ?? false) || !hasDynamicFetcher;
@@ -129,13 +131,13 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	if (shouldFetchFromNetwork) {
 		if (dynamicFetchSucceeded) {
 			const snapshotModels = mergeDynamicModels(mergeModelSources(staticModels, modelsDevModels), dynamicModels);
-			writeModelCache(options.providerId, now(), snapshotModels, true, dbPath);
+			writeModelCache(options.cacheNamespace ?? options.providerId, now(), snapshotModels, true, dbPath);
 		} else {
 			// Dynamic fetch failed — update cache with a non-authoritative snapshot so
 			// stale state remains visible while retry backoff still applies.
-			const latestCache = readModelCache<TApi>(options.providerId, ttlMs, now, dbPath);
+			const latestCache = readModelCache<TApi>(options.cacheNamespace ?? options.providerId, ttlMs, now, dbPath);
 			writeModelCache(
-				options.providerId,
+				options.cacheNamespace ?? options.providerId,
 				now(),
 				mergeDynamicModels(
 					mergeModelSources(staticModels, modelsDevModels),

package/src/provider-models/descriptors.ts

@@ -284,4 +284,5 @@ export const DEFAULT_MODEL_PER_PROVIDER: Record<KnownProvider, string> = {
 	"minimax-code-cn": "MiniMax-M2.5",
 	"openai-codex": "gpt-6.1-sol",
 	"gitlab-duo": "duo-chat-sonnet-4-5",
+	kiro: "auto",
 } as Record<KnownProvider, string>;

package/src/provider-models/special.ts

@@ -1,6 +1,8 @@
 import type { ModelManagerOptions } from "../model-manager";
+import { discoverKiroModels, kiroCacheNamespace } from "../providers/kiro-service";
 import { fetchCodexModels } from "../utils/discovery/codex";
 import { fetchCursorUsableModels } from "../utils/discovery/cursor";
+import type { KiroCredentials } from "../utils/oauth/kiro-credentials";
 
 // ---------------------------------------------------------------------------
 // OpenAI Codex
@@ -105,3 +107,14 @@ export interface ZaiModelManagerConfig {}
 export function zaiModelManagerOptions(_config: ZaiModelManagerConfig = {}): ModelManagerOptions<"anthropic-messages"> {
 	return { providerId: "zai" };
 }
+
+/** Kiro catalogs are private to the selected native account and profile. */
+export function kiroModelManagerOptions(config: { apiKey: string }): ModelManagerOptions<"kiro-api"> {
+	const credentials = JSON.parse(config.apiKey) as KiroCredentials;
+	return {
+		providerId: "kiro",
+		cacheNamespace: kiroCacheNamespace(credentials),
+		staticModels: [],
+		fetchDynamicModels: async signal => (await discoverKiroModels(credentials, { signal })).models,
+	};
+}

package/src/providers/anthropic.ts

@@ -192,7 +192,7 @@ function getCacheControl(
 }
 
 // Stealth mode: Mimic Claude Code headers and tool prefixing.
-export const claudeCodeVersion = "2.1.303";
+export const claudeCodeVersion = "2.1.311";
 export const claudeToolPrefix: string = "proxy_";
 export const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
 

package/src/providers/google-gemini-cli.ts

@@ -79,7 +79,7 @@ export function resolveAntigravityServingModelId(requestedModelId: string): stri
  * GeminiCLI/VERSION/MODEL (PLATFORM; ARCH; SURFACE)
  */
 export function getGeminiCliUserAgent(modelId = "gemini-3.1-pro-preview"): string {
-	const version = process.env.PI_AI_GEMINI_CLI_VERSION || "0.64.0";
+	const version = process.env.PI_AI_GEMINI_CLI_VERSION || "0.65.0";
 	const platform = process.platform === "win32" ? "win32" : process.platform;
 	const arch = process.arch === "x64" ? "x64" : process.arch;
 	return `GeminiCLI/${version}/${modelId} (${platform}; ${arch}; terminal)`;

package/src/providers/kiro-LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hongyi Lyu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/providers/kiro-service.ts

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import type { Model } from "../types";
+import { type KiroCredentials, validKiroRegion } from "../utils/oauth/kiro-credentials";
+
+export interface KiroServiceOptions {
+	fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+	signal?: AbortSignal;
+	regions?: string[];
+}
+export interface KiroProfile {
+	arn: string;
+	name: string;
+	region: string;
+}
+export function kiroEndpoint(region: string): string {
+	if (!validKiroRegion(region)) throw new Error("Invalid Kiro service region");
+	return `https://q.${region}.amazonaws.com`;
+}
+export function kiroCacheNamespace(c: KiroCredentials): string {
+	if (!c.accountId || !c.profileArn || !c.serviceRegion)
+		throw new Error("Kiro account/profile selection required. Run /login kiro.");
+	return `kiro:${createHash("sha256")
+		.update(JSON.stringify([c.accountId, c.profileArn, c.serviceRegion]))
+		.digest("hex")}`;
+}
+export async function kiroRequest(url: string, init: RequestInit, options: KiroServiceOptions = {}): Promise<Response> {
+	const signal = options.signal
+		? AbortSignal.any([options.signal, AbortSignal.timeout(30000)])
+		: AbortSignal.timeout(30000);
+	signal.throwIfAborted();
+	return (options.fetch ?? globalThis.fetch)(url, { ...init, signal });
+}
+function headers(c: KiroCredentials): Record<string, string> {
+	return { Authorization: `Bearer ${c.access}`, "Content-Type": "application/json", "User-Agent": "xcsh-kiro" };
+}
+async function jsonResponse(response: Response): Promise<Record<string, any>> {
+	if (!response.ok)
+		throw new Error(
+			`Kiro service HTTP ${response.status}${response.status === 401 || response.status === 403 ? ". Reconnect with /login kiro." : ". Retry when the service is available."}`,
+		);
+	const body = await response.json();
+	if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Malformed Kiro response");
+	return body;
+}
+async function pages<T>(
+	request: (token?: string) => Promise<Record<string, any>>,
+	field: string,
+): Promise<{ items: T[]; defaultModel?: unknown }> {
+	const items: T[] = [];
+	const seen = new Set<string>();
+	let token: string | undefined;
+	let defaultModel: unknown;
+	for (let page = 0; page < 100; page++) {
+		const body = await request(token);
+		if (!Array.isArray(body[field])) throw new Error(`Malformed Kiro ${field} response`);
+		items.push(...body[field]);
+		defaultModel = body.defaultModel ?? defaultModel;
+		if (!body.nextToken) return { items, defaultModel };
+		if (typeof body.nextToken !== "string" || seen.has(body.nextToken)) throw new Error("Invalid Kiro pagination");
+		token = body.nextToken;
+		seen.add(token);
+	}
+	throw new Error("Kiro pagination exceeded limit");
+}
+export async function discoverKiroProfiles(
+	c: KiroCredentials,
+	options: KiroServiceOptions = {},
+): Promise<KiroProfile[]> {
+	const profiles = new Map<string, KiroProfile>();
+	// Desktop 1.4.26 maps BuilderId to this service-owned profile; the API
+	// explicitly rejects ListAvailableProfiles for Builder ID.
+	if (c.authMethod === "builder-id")
+		return [
+			{
+				arn: "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX",
+				name: "AWS Builder ID",
+				region: "us-east-1",
+			},
+		];
+	const regions = options.regions ?? ["us-east-1", "eu-central-1"];
+	for (const region of regions) {
+		const result = await pages<{ arn: string; name?: string }>(
+			async nextToken =>
+				jsonResponse(
+					await kiroRequest(
+						`${kiroEndpoint(region)}/ListAvailableProfiles`,
+						{
+							method: "POST",
+							headers: headers(c),
+							body: JSON.stringify({ ...(nextToken ? { nextToken } : {}) }),
+						},
+						options,
+					),
+				),
+			"profiles",
+		);
+		for (const p of result.items) {
+			if (typeof p.arn !== "string") throw new Error("Malformed Kiro profile");
+			const serviceRegion = p.arn.split(":")[3];
+			if (!serviceRegion || !validKiroRegion(serviceRegion)) throw new Error("Invalid Kiro profile region");
+			profiles.set(p.arn, { arn: p.arn, name: p.name ?? "Kiro profile", region: serviceRegion });
+		}
+	}
+	if (!profiles.size)
+		throw new Error("No Kiro profiles available for this account. Check entitlement or choose another account.");
+	return [...profiles.values()];
+}
+export async function discoverKiroModels(
+	c: KiroCredentials,
+	options: KiroServiceOptions = {},
+): Promise<{ models: Model<"kiro-api">[]; defaultModel?: string }> {
+	if (!c.profileArn || !c.serviceRegion) throw new Error("Select a Kiro profile with /login kiro");
+	const result = await pages<Record<string, any>>(async nextToken => {
+		const url = new URL(`${kiroEndpoint(c.serviceRegion!)}/ListAvailableModels`);
+		url.searchParams.set("origin", "KIRO_CLI");
+		url.searchParams.set("profileArn", c.profileArn!);
+		if (nextToken) url.searchParams.set("nextToken", nextToken);
+		return jsonResponse(await kiroRequest(url.toString(), { headers: headers(c) }, options));
+	}, "models");
+	const models = result.items.map(m => {
+		const input = m.tokenLimits?.maxInputTokens;
+		const output = m.tokenLimits?.maxOutputTokens;
+		if (
+			typeof m.modelId !== "string" ||
+			!m.modelId ||
+			!Number.isFinite(input) ||
+			input <= 0 ||
+			!Number.isFinite(output) ||
+			output <= 0
+		)
+			throw new Error("Kiro model is missing service limits or ID");
+		const model: Model<"kiro-api"> = {
+			id: m.modelId,
+			name: m.modelName ?? m.modelId,
+			provider: "kiro",
+			kiroConnection: { accountId: c.accountId!, profileArn: c.profileArn!, serviceRegion: c.serviceRegion! },
+			api: "kiro-api",
+			baseUrl: `${kiroEndpoint(c.serviceRegion!)}/generateAssistantResponse`,
+			reasoning: false,
+			input: m.supportedInputTypes?.includes("IMAGE") ? ["text", "image"] : ["text"],
+			contextWindow: input,
+			maxTokens: output,
+			cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, pricingKnown: false },
+		};
+		return model;
+	});
+	if (!models.length) throw new Error("No Kiro models available for the selected profile");
+	const d = result.defaultModel;
+	const defaultModel =
+		typeof d === "string" ? d : d && typeof d === "object" ? (d as { modelId?: string }).modelId : undefined;
+	for (const model of models) model.providerDefault = model.id === defaultModel;
+	return { models, defaultModel: models.some(m => m.id === defaultModel) ? defaultModel : undefined };
+}