@gajae-code/coding-agent 0.18.6 → 0.18.8

package/src/session/task-artifact-owner.ts

@@ -0,0 +1,289 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ArtifactManager } from "./artifacts";
+import { acquireManagedLock, type ManagedSessionDescendantStore } from "./internal/managed-session-storage";
+import {
+	locatorFromManifest,
+	newSessionRootStore,
+	type OwnerManifest,
+	openOwnerStore,
+	readOwnerManifest,
+} from "./internal/task-artifact-owner-access";
+import type { NativeDirectoryTreeSnapshot } from "./session-storage";
+import {
+	assertSafeRelativePath,
+	assertSessionRoot,
+	OWNER_DIRECTORY,
+	OWNER_LOCK_DIRECTORY,
+	OWNER_MANIFEST,
+	OWNER_SCHEMA_VERSION,
+	ownerIdForSession,
+	ownerRelativePath,
+	parseTaskArtifactOwnerLocator,
+	sameTreeContents,
+	type TaskArtifactOwnerLocator,
+	type TaskArtifactOwnerStorageContext,
+} from "./task-artifact-owner-codec";
+
+export interface ManagedTaskArtifactOwner {
+	readonly locator: TaskArtifactOwnerLocator;
+	readonly manager: ArtifactManager;
+}
+
+function makeOwnerManager(ownerStore: ManagedSessionDescendantStore): ArtifactManager {
+	return new ArtifactManager(ownerStore);
+}
+
+function legacyPathOverlapsOwner(
+	sessionsRoot: string,
+	sourceRelativePath: string,
+	destinationRelativePath: string,
+): boolean {
+	const source = path.resolve(sessionsRoot, sourceRelativePath);
+	const destination = path.resolve(sessionsRoot, destinationRelativePath);
+	const sourceToDestination = path.relative(source, destination);
+	const destinationToSource = path.relative(destination, source);
+	return (
+		source !== destination &&
+		((!path.isAbsolute(sourceToDestination) &&
+			sourceToDestination !== ".." &&
+			!sourceToDestination.startsWith(`..${path.sep}`)) ||
+			(!path.isAbsolute(destinationToSource) &&
+				destinationToSource !== ".." &&
+				!destinationToSource.startsWith(`..${path.sep}`)))
+	);
+}
+
+async function copyLegacyArtifactTree(
+	store: ManagedSessionDescendantStore,
+	sourceRelativePath: string,
+	destinationRelativePath: string,
+	sourceSnapshot: NativeDirectoryTreeSnapshot,
+): Promise<void> {
+	for (const entry of sourceSnapshot.entries) {
+		if (entry.relativePath === "") continue;
+		const destination = path.posix.join(destinationRelativePath, entry.relativePath);
+		if (entry.kind === "directory") {
+			store.ensureDirectory(destination);
+			continue;
+		}
+		const sourceName = path.posix.join(sourceRelativePath, entry.relativePath);
+		const captured = store.readExpected(sourceName);
+		if (
+			!captured ||
+			captured.identity.dev.toString() !== entry.dev ||
+			captured.identity.ino.toString() !== entry.ino ||
+			String(captured.identity.size) !== entry.size ||
+			captured.identity.mtimeNs.toString() !== entry.mtimeNs ||
+			captured.identity.ctimeNs.toString() !== entry.ctimeNs ||
+			crypto.createHash("sha256").update(captured.bytes).digest("hex") !== entry.sha256
+		)
+			throw new Error("task_artifact_owner_source_changed");
+		await store.publishNoReplace(destination, captured.bytes);
+	}
+	const sourceAfter = store.captureTree(sourceRelativePath);
+	const destinationAfter = store.captureTree(destinationRelativePath);
+	if (
+		JSON.stringify(sourceAfter) !== JSON.stringify(sourceSnapshot) ||
+		!sameTreeContents(sourceSnapshot, destinationAfter)
+	)
+		throw new Error("task_artifact_owner_copy_mismatch");
+}
+
+function taskArtifactOwnerFromStore(
+	locator: TaskArtifactOwnerLocator,
+	ownerStore: ManagedSessionDescendantStore,
+): ManagedTaskArtifactOwner {
+	return Object.freeze({ locator: Object.freeze({ ...locator }), manager: makeOwnerManager(ownerStore) });
+}
+
+interface FailureState {
+	failed: boolean;
+	value: unknown;
+}
+
+function recordFailure(state: FailureState, error: unknown, message: string): void {
+	state.value = state.failed ? new AggregateError([state.value, error], message) : error;
+	state.failed = true;
+}
+
+function closeManagedStore(
+	store: ManagedSessionDescendantStore | undefined,
+	state: FailureState,
+	message: string,
+): void {
+	if (!store) return;
+	try {
+		store.close();
+	} catch (error) {
+		recordFailure(state, error, message);
+	}
+}
+
+function closeReturnedOwner(result: ManagedTaskArtifactOwner | undefined, state: FailureState): void {
+	closeManagedStore(result?.manager.getManagedStore(), state, "Closing the task artifact owner also failed.");
+}
+
+/** Reopen an owner only beneath the captured managed sessions-root authority. */
+export function restoreManagedTaskArtifactOwner(
+	context: TaskArtifactOwnerStorageContext,
+	sessionId: string,
+	locatorValue: unknown,
+): ManagedTaskArtifactOwner {
+	const locator = parseTaskArtifactOwnerLocator(locatorValue);
+	if (!locator) throw new Error("task_artifact_owner_locator_missing");
+	const rootStore = newSessionRootStore(context);
+	const state: FailureState = { failed: false, value: undefined };
+	let result: ManagedTaskArtifactOwner | undefined;
+	try {
+		const ownerStore = openOwnerStore(context, rootStore, locator, sessionId);
+		result = taskArtifactOwnerFromStore(locator, ownerStore);
+	} catch (error) {
+		recordFailure(state, error, "Restoring the task artifact owner failed.");
+	}
+	closeManagedStore(rootStore, state, "Restoring the task artifact owner and closing its root store failed.");
+	if (state.failed) {
+		closeReturnedOwner(result, state);
+		throw state.value;
+	}
+	if (!result) throw new Error("task_artifact_owner_unavailable");
+	return result;
+}
+
+/** Establish or restore the logical-session owner under the captured managed sessions authority. */
+export async function ensureManagedTaskArtifactOwner(
+	context: TaskArtifactOwnerStorageContext,
+	sessionId: string,
+	locatorValue: unknown,
+	legacyArtifactRelativePath?: string,
+): Promise<ManagedTaskArtifactOwner> {
+	assertSessionRoot(context);
+	const locator = parseTaskArtifactOwnerLocator(locatorValue);
+	const ownerId = locator?.ownerId ?? ownerIdForSession(sessionId);
+	if (ownerId !== ownerIdForSession(sessionId)) throw new Error("task_artifact_owner_session_mismatch");
+	const lock = await acquireManagedLock(
+		path.join(context.sessionsRoot, OWNER_LOCK_DIRECTORY),
+		`owner-${ownerId}`,
+		context.rootAuthority,
+		context.securityPolicy,
+	);
+
+	let result: ManagedTaskArtifactOwner | undefined;
+	const state: FailureState = { failed: false, value: undefined };
+	try {
+		lock.assertOwned();
+		if (locator) {
+			result = restoreManagedTaskArtifactOwner(context, sessionId, locator);
+		} else {
+			const rootStore = newSessionRootStore(context);
+			let ownerStore: ManagedSessionDescendantStore | undefined;
+			try {
+				rootStore.verifyRootSecurity();
+				const ownerRelative = ownerRelativePath(ownerId);
+				const ownerPath = path.join(context.sessionsRoot, ownerRelative);
+				let existingDirectory = false;
+				try {
+					const stat = fs.lstatSync(ownerPath, { bigint: true });
+					if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("task_artifact_owner_replaced");
+					existingDirectory = true;
+				} catch (error) {
+					if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+				}
+
+				if (existingDirectory) {
+					const identity = rootStore.captureDirectoryIdentity(ownerRelative);
+					const existingLocator: TaskArtifactOwnerLocator = {
+						schemaVersion: OWNER_SCHEMA_VERSION,
+						ownerId,
+						directoryDev: identity.dev,
+						directoryIno: identity.ino,
+					};
+					const manifest: OwnerManifest = readOwnerManifest(rootStore, existingLocator);
+					if (manifest.sessionId !== sessionId) throw new Error("task_artifact_owner_session_mismatch");
+					const restoredLocator = locatorFromManifest(manifest);
+					const restoredStore = openOwnerStore(context, rootStore, restoredLocator, sessionId);
+					result = taskArtifactOwnerFromStore(restoredLocator, restoredStore);
+				} else {
+					let legacySource: { relativePath: string; snapshot: NativeDirectoryTreeSnapshot } | undefined;
+					if (legacyArtifactRelativePath !== undefined) {
+						assertSafeRelativePath(legacyArtifactRelativePath);
+						if (legacyPathOverlapsOwner(context.sessionsRoot, legacyArtifactRelativePath, ownerRelative))
+							throw new Error("task_artifact_owner_legacy_path_overlaps_owner");
+						try {
+							fs.lstatSync(path.join(context.sessionsRoot, legacyArtifactRelativePath), { bigint: true });
+							legacySource = {
+								relativePath: legacyArtifactRelativePath,
+								snapshot: rootStore.captureTree(legacyArtifactRelativePath),
+							};
+						} catch (error) {
+							if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+						}
+					}
+
+					rootStore.ensureDirectory(OWNER_DIRECTORY);
+					const identity = rootStore.ensureDirectory(ownerRelative);
+					const createdLocator: TaskArtifactOwnerLocator = {
+						schemaVersion: OWNER_SCHEMA_VERSION,
+						ownerId,
+						directoryDev: identity.dev.toString(),
+						directoryIno: identity.ino.toString(),
+					};
+					ownerStore = rootStore.deriveSubtree(ownerRelative);
+					if (legacySource) {
+						await copyLegacyArtifactTree(
+							rootStore,
+							legacySource.relativePath,
+							ownerRelative,
+							legacySource.snapshot,
+						);
+					}
+					ownerStore.fsyncTree();
+					lock.assertOwned();
+					await ownerStore.publishNoReplace(
+						OWNER_MANIFEST,
+						Buffer.from(`${JSON.stringify({ ...createdLocator, sessionId })}\n`, "utf8"),
+					);
+					const verifiedStore = openOwnerStore(context, rootStore, createdLocator, sessionId);
+					try {
+						ownerStore.close();
+					} catch (error) {
+						try {
+							verifiedStore.close();
+						} catch (closeError) {
+							throw new AggregateError(
+								[error, closeError],
+								"Opening the owner and closing its writer store failed.",
+							);
+						}
+						throw error;
+					}
+					ownerStore = undefined;
+					result = taskArtifactOwnerFromStore(createdLocator, verifiedStore);
+				}
+			} catch (error) {
+				recordFailure(state, error, "Provisioning the task artifact owner failed.");
+			}
+			closeManagedStore(
+				ownerStore,
+				state,
+				"Provisioning the task artifact owner and closing its writer store failed.",
+			);
+			closeManagedStore(rootStore, state, "Provisioning the task artifact owner and closing its root store failed.");
+		}
+	} catch (error) {
+		recordFailure(state, error, "Task artifact owner setup failed.");
+	}
+
+	try {
+		await lock.release();
+	} catch (releaseError) {
+		recordFailure(state, releaseError, "Task artifact owner setup and lock release failed.");
+	}
+	if (state.failed) {
+		closeReturnedOwner(result, state);
+		throw state.value;
+	}
+	if (!result) throw new Error("task_artifact_owner_unavailable");
+	return result;
+}

package/src/setup/credential-auto-import.ts

@@ -36,7 +36,11 @@ export const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING =
 export const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING =
 	"Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
 
-export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportSourceLabel =
+	| "claude-code-file"
+	| "claude-code-keychain"
+	| "codex-file"
+	| "kiro-cli-social";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
 export type InitialImportResolution = "accepted" | "declined";
 export type CredentialAutoImportStateProblem =
@@ -259,16 +263,18 @@ export interface CredentialAutoImportResult {
 	globalDiscoveryFailure?: CredentialAutoImportFailure;
 }
 
-const CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS: readonly ExternalProvider[] = ["anthropic", "openai-codex"];
+const CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS: readonly ExternalProvider[] = ["anthropic", "openai-codex", "kiro"];
 const CREDENTIAL_AUTO_IMPORT_PROMPT_ORIGINS: readonly CredentialOrigin[] = [
 	"claude-code-file",
 	"claude-code-keychain",
 	"codex-file",
+	"kiro-cli-social",
 ];
 const CREDENTIAL_AUTO_IMPORT_ORIGIN_LABELS: Record<CredentialOrigin, string> = {
 	"claude-code-file": "Claude Code file",
 	"claude-code-keychain": "Claude Code Keychain",
 	"codex-file": "Codex CLI file",
+	"kiro-cli-social": "Kiro CLI social login",
 };
 const CREDENTIAL_AUTO_IMPORT_FAILURE_CLASSES = new Set(Object.values(CredentialAutoImportFailureClass));
 
@@ -413,7 +419,10 @@ export function buildCredentialAutoImportNotice(
 		...new Set(result.imported.map(c => EXTERNAL_PROVIDER_LABELS[c.provider as ExternalProvider] ?? c.provider)),
 	];
 	const success = `Imported ${result.imported.length} external OAuth credential(s) into gjc: ${providers.join(", ")}.`;
-	return `${success}\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}`;
+	const mayRotateExternalRefreshToken = result.imported.some(
+		credential => credential.provider === "anthropic" || credential.provider === "openai-codex",
+	);
+	return mayRotateExternalRefreshToken ? `${success}\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}` : success;
 }
 
 export function formatCredentialAutoImportResult(result: CredentialAutoImportResult): string[] {

package/src/setup/credential-import.ts

@@ -1,5 +1,5 @@
 /**
- * Discover and import existing Claude Code / Codex CLI credentials.
+ * Discover and import existing Claude Code, Codex CLI, and Kiro CLI credentials.
  *
  * This is the testable core behind `gjc setup credentials` (CLI, primary entry)
  * and the TUI provider-onboarding "import existing credentials" action. It never
@@ -12,7 +12,10 @@
  *     Keychain (`Claude Code-credentials`), and env vars.
  *   - Codex CLI: `$CODEX_HOME/auth.json` (defaults to `~/.codex/auth.json`;
  *     OAuth `tokens` block or stored `OPENAI_API_KEY`), and env vars.
+ *   - Kiro CLI social OAuth: `data.sqlite3` in the platform's app-data directory,
+ *     read-only from `auth_kv` key `kirocli:social:token`.
  */
+import { Database } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -21,20 +24,22 @@ import { $credentialEnv, isEnoent } from "@gajae-code/utils";
 import { redactSecret } from "./provider-onboarding";
 
 /** gjc provider ids that external credentials map onto. */
-export type ExternalProvider = "anthropic" | "openai-codex";
+export type ExternalProvider = "anthropic" | "openai-codex" | "kiro";
 
 /** Where a discovered credential came from. */
-export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 
 export const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>> = {
 	anthropic: new Set<CredentialOrigin>(["claude-code-file", "claude-code-keychain"]),
 	"openai-codex": new Set<CredentialOrigin>(["codex-file"]),
+	kiro: new Set<CredentialOrigin>(["kiro-cli-social"]),
 };
 
 /** Human labels for providers, used in redacted summaries. */
 export const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string> = {
 	anthropic: "Claude (Anthropic)",
 	"openai-codex": "Codex (ChatGPT)",
+	kiro: "Kiro",
 };
 
 /** A credential that can be safely imported into gjc's store. */
@@ -98,6 +103,8 @@ export interface DiscoveryOptions {
 	 * or `null` when no entry exists.
 	 */
 	readClaudeKeychain?: () => Promise<string | null>;
+	/** Absolute Kiro CLI data.sqlite3 override, primarily for tests and embedders. */
+	kiroCliDatabasePath?: string;
 }
 
 export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
@@ -131,6 +138,7 @@ interface CodexAuthFile {
 
 const ANTHROPIC_ENV_KEYS = ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"] as const;
 const OPENAI_ENV_KEYS = ["OPENAI_API_KEY"] as const;
+const KIRO_CLI_SOCIAL_TOKEN_KEY = "kirocli:social:token";
 
 // ─── JWT helpers (best-effort identity/expiry extraction) ────────────────────
 
@@ -368,6 +376,154 @@ async function discoverCodex(home: ResolvedExternalDir, result: CredentialDiscov
 	pushOutcome(result, parseCodexAuth(raw, `Codex CLI (${displayPath})`));
 }
 
+interface KiroCliSocialToken {
+	access_token?: unknown;
+	refresh_token?: unknown;
+	expires_at?: unknown;
+	profile_arn?: unknown;
+	provider?: unknown;
+}
+
+function parseKiroCliExpiry(value: unknown): number | undefined {
+	if (typeof value === "number" && Number.isFinite(value)) {
+		if (value > 1_000_000_000_000) return value;
+		if (value > 1_000_000_000) return value * 1000;
+		return undefined;
+	}
+	if (typeof value !== "string" || value.trim().length === 0) return undefined;
+	const numericValue = Number(value);
+	if (Number.isFinite(numericValue)) return parseKiroCliExpiry(numericValue);
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function parseKiroCliSocialToken(raw: string, source: string): ImportableCredential | SkippedCredential {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw) as KiroCliSocialToken;
+	} catch (err) {
+		return { origin: "kiro-cli-social", source, reason: sanitizedFailureReason("malformed credential file", err) };
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+		return { origin: "kiro-cli-social", source, reason: "unsupported token shape (root is not an object)" };
+	}
+	const token = parsed as KiroCliSocialToken;
+	const access = nonEmptyString(token.access_token);
+	const refresh = nonEmptyString(token.refresh_token);
+	const profileArn = nonEmptyString(token.profile_arn);
+	const provider = nonEmptyString(token.provider);
+	if (!access || !refresh || !profileArn || !provider) {
+		return { origin: "kiro-cli-social", source, reason: "incomplete Kiro social OAuth token metadata" };
+	}
+	const expiresAt = parseKiroCliExpiry(token.expires_at);
+	const credential: OAuthCredential = {
+		type: "oauth",
+		access,
+		refresh,
+		expires: expiresAt ?? Date.now(),
+		profileArn,
+	};
+	return {
+		provider: "kiro",
+		origin: "kiro-cli-social",
+		source,
+		kind: "oauth",
+		...(expiresAt === undefined ? {} : { expiresAt }),
+		redactedToken: redactSecret(access),
+		credential,
+	};
+}
+
+function resolveKiroCliDatabasePath(
+	homeDir: string,
+	platform: NodeJS.Platform,
+	env: Record<string, string | undefined>,
+): string {
+	if (platform === "darwin") {
+		return path.join(homeDir, "Library", "Application Support", "kiro-cli", "data.sqlite3");
+	}
+	if (platform === "win32") {
+		const localAppData = nonEmptyString(env.LOCALAPPDATA);
+		const dataDir =
+			localAppData && path.isAbsolute(localAppData) ? localAppData : path.join(homeDir, "AppData", "Local");
+		return path.join(dataDir, "kiro-cli", "data.sqlite3");
+	}
+	const xdgDataHome = nonEmptyString(env.XDG_DATA_HOME);
+	const dataDir = xdgDataHome && path.isAbsolute(xdgDataHome) ? xdgDataHome : path.join(homeDir, ".local", "share");
+	return path.join(dataDir, "kiro-cli", "data.sqlite3");
+}
+
+async function discoverKiroCliSocialCredential(
+	homeDir: string,
+	platform: NodeJS.Platform,
+	pathEnv: Record<string, string | undefined>,
+	databasePathOverride: string | undefined,
+	result: CredentialDiscoveryResult,
+): Promise<void> {
+	const source = "Kiro CLI (social login)";
+	if (databasePathOverride && !path.isAbsolute(databasePathOverride)) {
+		result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database path must be absolute" });
+		return;
+	}
+	const databasePath = databasePathOverride ?? resolveKiroCliDatabasePath(homeDir, platform, pathEnv);
+	let database: Database | undefined;
+	try {
+		const stat = await fs.stat(databasePath);
+		if (!stat.isFile()) {
+			result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database is not a regular file" });
+			return;
+		}
+	} catch (err) {
+		if (!isEnoent(err)) {
+			result.skipped.push({
+				origin: "kiro-cli-social",
+				source,
+				reason: sanitizedFailureReason("unreadable credential file", err),
+			});
+		}
+		return;
+	}
+
+	try {
+		database = new Database(databasePath, { readonly: true, create: false, strict: true });
+		database.run("PRAGMA busy_timeout = 1000");
+		const authTable = database
+			.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?")
+			.get("auth_kv");
+		if (!authTable) {
+			result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database is missing auth_kv" });
+			return;
+		}
+		const row = database.prepare("SELECT value FROM auth_kv WHERE key = ?").get(KIRO_CLI_SOCIAL_TOKEN_KEY) as {
+			value?: unknown;
+		} | null;
+		if (!row) return;
+		const value =
+			typeof row.value === "string"
+				? row.value
+				: row.value instanceof Uint8Array
+					? new TextDecoder().decode(row.value)
+					: undefined;
+		if (value === undefined) {
+			result.skipped.push({
+				origin: "kiro-cli-social",
+				source,
+				reason: "Kiro CLI token value has an unsupported type",
+			});
+			return;
+		}
+		pushOutcome(result, parseKiroCliSocialToken(value, source));
+	} catch (err) {
+		result.skipped.push({
+			origin: "kiro-cli-social",
+			source,
+			reason: sanitizedFailureReason("unreadable credential file", err),
+		});
+	} finally {
+		database?.close();
+	}
+}
+
 // ─── Environment hints ───────────────────────────────────────────────────────
 
 function discoverEnvironment(env: Record<string, string | undefined>, result: CredentialDiscoveryResult): void {
@@ -421,8 +577,8 @@ function resolveExternalDir(
 }
 
 /**
- * Discover Claude Code and Codex CLI credentials across files, the macOS
- * Keychain, and environment variables. Never throws for individual unreadable or
+ * Discover Claude Code, Codex CLI, and Kiro CLI credentials across their local
+ * stores and environment variables. Never throws for individual unreadable or
  * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
  */
 export async function discoverExternalCredentials(options: DiscoveryOptions = {}): Promise<CredentialDiscoveryResult> {
@@ -436,11 +592,16 @@ export async function discoverExternalCredentials(options: DiscoveryOptions = {}
 		? { dir: options.codexHome, display: "$CODEX_HOME" }
 		: resolveExternalDir("CODEX_HOME", options.env, path.join(homeDir, ".codex"), "~/.codex");
 	const result: CredentialDiscoveryResult = { importable: [], skipped: [], environment: [] };
+	const kiroPathEnv = options.env ?? {
+		LOCALAPPDATA: $credentialEnv("LOCALAPPDATA"),
+		XDG_DATA_HOME: $credentialEnv("XDG_DATA_HOME"),
+	};
 	await discoverClaudeCode(
 		{ configDir: claudeConfigDir, platform, readClaudeKeychain: options.readClaudeKeychain },
 		result,
 	);
 	await discoverCodex(codexHome, result);
+	await discoverKiroCliSocialCredential(homeDir, platform, kiroPathEnv, options.kiroCliDatabasePath, result);
 	discoverEnvironment(env, result);
 	return result;
 }
@@ -487,6 +648,16 @@ function hasAutoImportOAuthProviderOrigin(credential: ImportableCredential): boo
 }
 
 export function isAutoImportOAuthCredential(credential: ImportableCredential, now: number = Date.now()): boolean {
+	const refreshableKiroSocialCredential =
+		credential.provider === "kiro" &&
+		credential.origin === "kiro-cli-social" &&
+		credential.kind === "oauth" &&
+		credential.credential.type === "oauth" &&
+		credential.credential.access.length > 0 &&
+		credential.credential.refresh.length > 0 &&
+		typeof credential.credential.profileArn === "string" &&
+		credential.credential.profileArn.length > 0;
+	if (refreshableKiroSocialCredential) return true;
 	return (
 		hasAutoImportOAuthProviderOrigin(credential) &&
 		typeof credential.expiresAt === "number" &&

package/src/setup/paseo/announce.ts

@@ -152,7 +152,12 @@ export function parseDaemonListen(raw: string): PaseoDaemonTarget | undefined {
 	const withoutQuery = authority.split("?")[0] ?? "";
 	const separator = withoutQuery.lastIndexOf(":");
 	if (separator <= 0) return undefined;
-	const port = Number(withoutQuery.slice(separator + 1));
+	// Digits only, like the bare-port branch above: `Number()` also accepts hex
+	// (`0x1A0B`), exponents (`1e3`), decimals and padding, which would probe a
+	// different port than the raw spelling handed to `paseo import`.
+	const portText = withoutQuery.slice(separator + 1);
+	if (!/^\d+$/.test(portText)) return undefined;
+	const port = Number(portText);
 	if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) return undefined;
 	const host = withoutQuery.slice(0, separator).replace(/^\[|]$/g, "");
 	return host ? { kind: "tcp", host, port } : undefined;