@gajae-code/coding-agent 0.18.7 → 0.18.8

package/src/session/task-artifact-owner-codec.ts

@@ -39,6 +39,10 @@ const RETIREMENT_CONTINUATION_KEYS = new Set([
 const U64_MAX = 18_446_744_073_709_551_615n;
 
 type NativeDirectoryTreeEntry = NativeDirectoryTreeSnapshot["entries"][number];
+type ExpectedTreeChildren = {
+	readonly direct: Map<string, NativeDirectoryTreeEntry>;
+	readonly quarantined: Map<string, NativeDirectoryTreeEntry | null>;
+};
 
 export interface TaskArtifactOwnerLocator {
 	readonly schemaVersion: typeof OWNER_SCHEMA_VERSION;
@@ -231,16 +235,66 @@ export function freezeTreeSnapshot(snapshot: NativeDirectoryTreeSnapshot): Nativ
 	return Object.freeze(canonical);
 }
 
-export function retainedTreeDoesNotExpandAuthority(
+/** Windows native tree removal hashes original path and inode identity for child quarantine names. */
+function treeQuarantineName(entry: NativeDirectoryTreeEntry): string {
+	const material = `${entry.relativePath}\0${entry.dev}\0${entry.ino}`;
+	return `.pi-tree-detached-${crypto.createHash("sha256").update(material, "utf8").digest("hex")}`;
+}
+
+/** Project only authenticated remaining entries; never restore an omitted entry's authority. */
+export function normalizeRetainedTreeSnapshot(
 	expected: NativeDirectoryTreeSnapshot,
 	retained: NativeDirectoryTreeSnapshot,
-): boolean {
-	if (expected.rootDev !== retained.rootDev || expected.rootIno !== retained.rootIno) return false;
+): NativeDirectoryTreeSnapshot | undefined {
+	if (expected.rootDev !== retained.rootDev || expected.rootIno !== retained.rootIno) return undefined;
 	const expectedEntries = new Map(expected.entries.map(entry => [entry.relativePath, entry]));
-	if (retained.entries.length > expected.entries.length) return false;
-	return retained.entries.every(entry => {
-		if (entry.relativePath === "") return entry.kind === "directory";
-		const authorized = expectedEntries.get(entry.relativePath);
+	if (retained.entries.length > expected.entries.length) return undefined;
+
+	const childrenByParent = new Map<string, ExpectedTreeChildren>();
+	for (const entry of expected.entries) {
+		if (entry.relativePath === "") continue;
+		const separator = entry.relativePath.lastIndexOf("/");
+		const parent = separator < 0 ? "" : entry.relativePath.slice(0, separator);
+		const name = separator < 0 ? entry.relativePath : entry.relativePath.slice(separator + 1);
+		let children = childrenByParent.get(parent);
+		if (!children) {
+			children = { direct: new Map(), quarantined: new Map() };
+			childrenByParent.set(parent, children);
+		}
+		children.direct.set(name, entry);
+		const quarantineName = treeQuarantineName(entry);
+		children.quarantined.set(quarantineName, children.quarantined.has(quarantineName) ? null : entry);
+	}
+
+	const originalPathFor = (retainedPath: string): string | undefined => {
+		if (retainedPath === "") return "";
+		const components = retainedPath.split("/");
+		if (components.some(component => component.length === 0 || component === "." || component === ".."))
+			return undefined;
+		let parent = "";
+		for (const component of components) {
+			const children = childrenByParent.get(parent);
+			if (!children) return undefined;
+			const direct = children.direct.get(component);
+			const hasQuarantine = children.quarantined.has(component);
+			const quarantined = children.quarantined.get(component);
+			if ((direct && hasQuarantine) || quarantined === null) return undefined;
+			const matched = direct ?? quarantined;
+			if (!matched) return undefined;
+			parent = matched.relativePath;
+		}
+		return parent;
+	};
+
+	const seenOriginalPaths = new Set<string>();
+	const entries: NativeDirectoryTreeEntry[] = [];
+	const valid = retained.entries.every(entry => {
+		const originalPath = originalPathFor(entry.relativePath);
+		if (originalPath === undefined || seenOriginalPaths.has(originalPath)) return false;
+		seenOriginalPaths.add(originalPath);
+		entries.push({ ...entry, relativePath: originalPath });
+		if (originalPath === "") return entry.kind === "directory";
+		const authorized = expectedEntries.get(originalPath);
 		if (
 			authorized === undefined ||
 			authorized.kind !== entry.kind ||
@@ -257,6 +311,14 @@ export function retainedTreeDoesNotExpandAuthority(
 			entry.sha256 !== undefined || (entry.mtimeNs === authorized.mtimeNs && entry.ctimeNs === authorized.ctimeNs)
 		);
 	});
+	return valid ? { rootDev: retained.rootDev, rootIno: retained.rootIno, entries } : undefined;
+}
+
+export function retainedTreeDoesNotExpandAuthority(
+	expected: NativeDirectoryTreeSnapshot,
+	retained: NativeDirectoryTreeSnapshot,
+): boolean {
+	return normalizeRetainedTreeSnapshot(expected, retained) !== undefined;
 }
 
 export function sameTreeContents(left: NativeDirectoryTreeSnapshot, right: NativeDirectoryTreeSnapshot): boolean {
@@ -501,6 +563,7 @@ export function parseTaskArtifactOwnerRetirementOutcome(
 			"windowsErrorCode",
 		];
 		if (Object.keys(record).some(key => !allowed.includes(key)) || typeof record.ok !== "boolean") return invalid();
+		if (record.ok && Object.keys(record).length !== 1) return invalid();
 		for (const [key, paths] of [
 			["detachedPath", continuation?.detachedPaths],
 			["retainedSuccessorPath", continuation?.retainedSuccessorPaths],
@@ -547,7 +610,7 @@ export function parseTaskArtifactOwnerRetirementOutcome(
 		if (!nativeOutcome?.ok) return invalid();
 		return Object.freeze({ kind, evidence: original, nativeOutcome });
 	}
-	if (!continuation || nativeOutcome?.ok) return invalid();
+	if (!continuation || (kind !== "uncertain" && nativeOutcome?.ok)) return invalid();
 	if (kind === "payload_retired") {
 		if (
 			value.namespace !== "retained" ||

package/src/session/task-artifact-owner-retirement.ts

@@ -5,6 +5,7 @@ import type { ManagedSessionDescendantStore } from "./internal/managed-session-s
 import {
 	captureOwnerTreeIfPresent,
 	captureValidatedOwnerTree,
+	newSessionRootReaderStore,
 	newSessionRootStore,
 	ownerTreeHasPendingManagedPublication,
 } from "./internal/task-artifact-owner-access";
@@ -12,6 +13,7 @@ import {
 	EMPTY_PAYLOAD_SHA256,
 	isKnownNativeSidePath,
 	isOwnerRetainedRoot,
+	normalizeRetainedTreeSnapshot,
 	OWNER_DIRECTORY,
 	OWNER_RETIREMENT_SCHEMA_VERSION,
 	ownerAbsolutePath,
@@ -181,7 +183,7 @@ export function verifyTaskArtifactOwnerPhysicalRetirement(
 ): void {
 	const outcome = parseTaskArtifactOwnerRetirementOutcome(context, evidence, value);
 	if (outcome.kind !== "completed") throw new Error("task_artifact_owner_physical_retirement_unverified");
-	const store = newSessionRootStore(context);
+	const store = newSessionRootReaderStore(context);
 	try {
 		if (!sameOwnerParentIdentity(store.captureDirectoryIdentity(OWNER_DIRECTORY), evidence.parentIdentity))
 			throw new Error("task_artifact_owner_parent_identity_mismatch");
@@ -204,7 +206,7 @@ export function verifyTaskArtifactOwnerRetirementContinuation(
 ): TaskArtifactOwnerRetirementContinuation {
 	const evidence = parseTaskArtifactOwnerDeletionEvidence(evidenceValue);
 	const continuation = parseTaskArtifactOwnerRetirementContinuation(context, evidence, value);
-	const store = newSessionRootStore(context);
+	const store = newSessionRootReaderStore(context);
 	try {
 		if (!sameOwnerParentIdentity(store.captureDirectoryIdentity(OWNER_DIRECTORY), evidence.parentIdentity))
 			throw new Error("task_artifact_owner_parent_identity_mismatch");
@@ -214,7 +216,9 @@ export function verifyTaskArtifactOwnerRetirementContinuation(
 			evidence.locator.ownerId,
 			continuation.retainedRootPath,
 		);
-		if (!snapshot || !retainedTreeDoesNotExpandAuthority(continuation.retainedTreeSnapshot, snapshot))
+		const prior = normalizeRetainedTreeSnapshot(evidence.treeSnapshot, continuation.retainedTreeSnapshot);
+		const current = snapshot && normalizeRetainedTreeSnapshot(evidence.treeSnapshot, snapshot);
+		if (!prior || !current || !retainedTreeDoesNotExpandAuthority(prior, current))
 			throw new Error("task_artifact_owner_retained_tree_mismatch");
 		if (
 			continuation.payloadDurable === true &&
@@ -283,7 +287,9 @@ export function retireTaskArtifactOwner(
 
 		const ownerPath = ownerAbsolutePath(context, evidence.locator.ownerId);
 		const removingPath = `${ownerPath}.removing`;
-		const baseline = previous?.retainedTreeSnapshot ?? evidence.treeSnapshot;
+		const baseline = previous
+			? normalizeRetainedTreeSnapshot(evidence.treeSnapshot, previous.retainedTreeSnapshot)
+			: evidence.treeSnapshot;
 		const candidates = [
 			...new Set(
 				[previous?.retainedRootPath, removingPath, ownerPath].filter(
@@ -293,6 +299,7 @@ export function retireTaskArtifactOwner(
 		];
 		let retainedRootPath: string | undefined;
 		let retainedTreeSnapshot: NativeDirectoryTreeSnapshot | undefined;
+		let nativeTreeSnapshot: NativeDirectoryTreeSnapshot | undefined;
 		for (const candidate of candidates) {
 			let snapshot: NativeDirectoryTreeSnapshot | undefined;
 			try {
@@ -312,12 +319,8 @@ export function retireTaskArtifactOwner(
 					continuation: fallback,
 					reason: "task_artifact_owner_writer_not_quiescent",
 				};
-			if (
-				!snapshot ||
-				snapshot.rootDev !== evidence.locator.directoryDev ||
-				snapshot.rootIno !== evidence.locator.directoryIno ||
-				!retainedTreeDoesNotExpandAuthority(baseline, snapshot)
-			)
+			const normalized = snapshot && normalizeRetainedTreeSnapshot(evidence.treeSnapshot, snapshot);
+			if (!snapshot || !normalized || !baseline || !retainedTreeDoesNotExpandAuthority(baseline, normalized))
 				continue;
 			if (candidate === ownerPath && JSON.stringify(snapshot) === JSON.stringify(evidence.treeSnapshot)) {
 				try {
@@ -340,9 +343,10 @@ export function retireTaskArtifactOwner(
 			}
 			retainedRootPath = candidate;
 			retainedTreeSnapshot = snapshot;
+			nativeTreeSnapshot = normalized;
 			break;
 		}
-		if (!retainedRootPath || !retainedTreeSnapshot)
+		if (!retainedRootPath || !retainedTreeSnapshot || !nativeTreeSnapshot)
 			return {
 				kind: "uncertain",
 				evidence,
@@ -354,7 +358,7 @@ export function retireTaskArtifactOwner(
 		try {
 			nativeOutcome = rootStore.removeTreeExpectedWithParentIdentity(
 				path.relative(context.sessionsRoot, retainedRootPath).split(path.sep).join("/"),
-				retainedTreeSnapshot,
+				nativeTreeSnapshot,
 				{ dev: BigInt(evidence.parentIdentity.dev), ino: BigInt(evidence.parentIdentity.ino) },
 			);
 		} catch {
@@ -391,13 +395,11 @@ export function retireTaskArtifactOwner(
 		let residualValid = reportedRootKnown;
 		try {
 			residualTree = captureOwnerTreeIfPresent(context, rootStore, evidence.locator.ownerId, nextRoot);
-			if (
-				residualTree &&
-				(residualTree.rootDev !== evidence.locator.directoryDev ||
-					residualTree.rootIno !== evidence.locator.directoryIno ||
-					!retainedTreeDoesNotExpandAuthority(retainedTreeSnapshot, residualTree))
-			)
-				residualValid = false;
+			if (residualTree) {
+				const normalizedResidual = normalizeRetainedTreeSnapshot(evidence.treeSnapshot, residualTree);
+				if (!normalizedResidual || !retainedTreeDoesNotExpandAuthority(nativeTreeSnapshot, normalizedResidual))
+					residualValid = false;
+			}
 		} catch {
 			residualValid = false;
 		}

package/src/setup/credential-auto-import.ts

@@ -36,7 +36,11 @@ export const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING =
 export const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING =
 	"Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
 
-export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportSourceLabel =
+	| "claude-code-file"
+	| "claude-code-keychain"
+	| "codex-file"
+	| "kiro-cli-social";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
 export type InitialImportResolution = "accepted" | "declined";
 export type CredentialAutoImportStateProblem =
@@ -259,16 +263,18 @@ export interface CredentialAutoImportResult {
 	globalDiscoveryFailure?: CredentialAutoImportFailure;
 }
 
-const CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS: readonly ExternalProvider[] = ["anthropic", "openai-codex"];
+const CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS: readonly ExternalProvider[] = ["anthropic", "openai-codex", "kiro"];
 const CREDENTIAL_AUTO_IMPORT_PROMPT_ORIGINS: readonly CredentialOrigin[] = [
 	"claude-code-file",
 	"claude-code-keychain",
 	"codex-file",
+	"kiro-cli-social",
 ];
 const CREDENTIAL_AUTO_IMPORT_ORIGIN_LABELS: Record<CredentialOrigin, string> = {
 	"claude-code-file": "Claude Code file",
 	"claude-code-keychain": "Claude Code Keychain",
 	"codex-file": "Codex CLI file",
+	"kiro-cli-social": "Kiro CLI social login",
 };
 const CREDENTIAL_AUTO_IMPORT_FAILURE_CLASSES = new Set(Object.values(CredentialAutoImportFailureClass));
 
@@ -413,7 +419,10 @@ export function buildCredentialAutoImportNotice(
 		...new Set(result.imported.map(c => EXTERNAL_PROVIDER_LABELS[c.provider as ExternalProvider] ?? c.provider)),
 	];
 	const success = `Imported ${result.imported.length} external OAuth credential(s) into gjc: ${providers.join(", ")}.`;
-	return `${success}\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}`;
+	const mayRotateExternalRefreshToken = result.imported.some(
+		credential => credential.provider === "anthropic" || credential.provider === "openai-codex",
+	);
+	return mayRotateExternalRefreshToken ? `${success}\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}` : success;
 }
 
 export function formatCredentialAutoImportResult(result: CredentialAutoImportResult): string[] {

package/src/setup/credential-import.ts

@@ -1,5 +1,5 @@
 /**
- * Discover and import existing Claude Code / Codex CLI credentials.
+ * Discover and import existing Claude Code, Codex CLI, and Kiro CLI credentials.
  *
  * This is the testable core behind `gjc setup credentials` (CLI, primary entry)
  * and the TUI provider-onboarding "import existing credentials" action. It never
@@ -12,7 +12,10 @@
  *     Keychain (`Claude Code-credentials`), and env vars.
  *   - Codex CLI: `$CODEX_HOME/auth.json` (defaults to `~/.codex/auth.json`;
  *     OAuth `tokens` block or stored `OPENAI_API_KEY`), and env vars.
+ *   - Kiro CLI social OAuth: `data.sqlite3` in the platform's app-data directory,
+ *     read-only from `auth_kv` key `kirocli:social:token`.
  */
+import { Database } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -21,20 +24,22 @@ import { $credentialEnv, isEnoent } from "@gajae-code/utils";
 import { redactSecret } from "./provider-onboarding";
 
 /** gjc provider ids that external credentials map onto. */
-export type ExternalProvider = "anthropic" | "openai-codex";
+export type ExternalProvider = "anthropic" | "openai-codex" | "kiro";
 
 /** Where a discovered credential came from. */
-export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 
 export const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>> = {
 	anthropic: new Set<CredentialOrigin>(["claude-code-file", "claude-code-keychain"]),
 	"openai-codex": new Set<CredentialOrigin>(["codex-file"]),
+	kiro: new Set<CredentialOrigin>(["kiro-cli-social"]),
 };
 
 /** Human labels for providers, used in redacted summaries. */
 export const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string> = {
 	anthropic: "Claude (Anthropic)",
 	"openai-codex": "Codex (ChatGPT)",
+	kiro: "Kiro",
 };
 
 /** A credential that can be safely imported into gjc's store. */
@@ -98,6 +103,8 @@ export interface DiscoveryOptions {
 	 * or `null` when no entry exists.
 	 */
 	readClaudeKeychain?: () => Promise<string | null>;
+	/** Absolute Kiro CLI data.sqlite3 override, primarily for tests and embedders. */
+	kiroCliDatabasePath?: string;
 }
 
 export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
@@ -131,6 +138,7 @@ interface CodexAuthFile {
 
 const ANTHROPIC_ENV_KEYS = ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"] as const;
 const OPENAI_ENV_KEYS = ["OPENAI_API_KEY"] as const;
+const KIRO_CLI_SOCIAL_TOKEN_KEY = "kirocli:social:token";
 
 // ─── JWT helpers (best-effort identity/expiry extraction) ────────────────────
 
@@ -368,6 +376,154 @@ async function discoverCodex(home: ResolvedExternalDir, result: CredentialDiscov
 	pushOutcome(result, parseCodexAuth(raw, `Codex CLI (${displayPath})`));
 }
 
+interface KiroCliSocialToken {
+	access_token?: unknown;
+	refresh_token?: unknown;
+	expires_at?: unknown;
+	profile_arn?: unknown;
+	provider?: unknown;
+}
+
+function parseKiroCliExpiry(value: unknown): number | undefined {
+	if (typeof value === "number" && Number.isFinite(value)) {
+		if (value > 1_000_000_000_000) return value;
+		if (value > 1_000_000_000) return value * 1000;
+		return undefined;
+	}
+	if (typeof value !== "string" || value.trim().length === 0) return undefined;
+	const numericValue = Number(value);
+	if (Number.isFinite(numericValue)) return parseKiroCliExpiry(numericValue);
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function parseKiroCliSocialToken(raw: string, source: string): ImportableCredential | SkippedCredential {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw) as KiroCliSocialToken;
+	} catch (err) {
+		return { origin: "kiro-cli-social", source, reason: sanitizedFailureReason("malformed credential file", err) };
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+		return { origin: "kiro-cli-social", source, reason: "unsupported token shape (root is not an object)" };
+	}
+	const token = parsed as KiroCliSocialToken;
+	const access = nonEmptyString(token.access_token);
+	const refresh = nonEmptyString(token.refresh_token);
+	const profileArn = nonEmptyString(token.profile_arn);
+	const provider = nonEmptyString(token.provider);
+	if (!access || !refresh || !profileArn || !provider) {
+		return { origin: "kiro-cli-social", source, reason: "incomplete Kiro social OAuth token metadata" };
+	}
+	const expiresAt = parseKiroCliExpiry(token.expires_at);
+	const credential: OAuthCredential = {
+		type: "oauth",
+		access,
+		refresh,
+		expires: expiresAt ?? Date.now(),
+		profileArn,
+	};
+	return {
+		provider: "kiro",
+		origin: "kiro-cli-social",
+		source,
+		kind: "oauth",
+		...(expiresAt === undefined ? {} : { expiresAt }),
+		redactedToken: redactSecret(access),
+		credential,
+	};
+}
+
+function resolveKiroCliDatabasePath(
+	homeDir: string,
+	platform: NodeJS.Platform,
+	env: Record<string, string | undefined>,
+): string {
+	if (platform === "darwin") {
+		return path.join(homeDir, "Library", "Application Support", "kiro-cli", "data.sqlite3");
+	}
+	if (platform === "win32") {
+		const localAppData = nonEmptyString(env.LOCALAPPDATA);
+		const dataDir =
+			localAppData && path.isAbsolute(localAppData) ? localAppData : path.join(homeDir, "AppData", "Local");
+		return path.join(dataDir, "kiro-cli", "data.sqlite3");
+	}
+	const xdgDataHome = nonEmptyString(env.XDG_DATA_HOME);
+	const dataDir = xdgDataHome && path.isAbsolute(xdgDataHome) ? xdgDataHome : path.join(homeDir, ".local", "share");
+	return path.join(dataDir, "kiro-cli", "data.sqlite3");
+}
+
+async function discoverKiroCliSocialCredential(
+	homeDir: string,
+	platform: NodeJS.Platform,
+	pathEnv: Record<string, string | undefined>,
+	databasePathOverride: string | undefined,
+	result: CredentialDiscoveryResult,
+): Promise<void> {
+	const source = "Kiro CLI (social login)";
+	if (databasePathOverride && !path.isAbsolute(databasePathOverride)) {
+		result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database path must be absolute" });
+		return;
+	}
+	const databasePath = databasePathOverride ?? resolveKiroCliDatabasePath(homeDir, platform, pathEnv);
+	let database: Database | undefined;
+	try {
+		const stat = await fs.stat(databasePath);
+		if (!stat.isFile()) {
+			result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database is not a regular file" });
+			return;
+		}
+	} catch (err) {
+		if (!isEnoent(err)) {
+			result.skipped.push({
+				origin: "kiro-cli-social",
+				source,
+				reason: sanitizedFailureReason("unreadable credential file", err),
+			});
+		}
+		return;
+	}
+
+	try {
+		database = new Database(databasePath, { readonly: true, create: false, strict: true });
+		database.run("PRAGMA busy_timeout = 1000");
+		const authTable = database
+			.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?")
+			.get("auth_kv");
+		if (!authTable) {
+			result.skipped.push({ origin: "kiro-cli-social", source, reason: "Kiro CLI database is missing auth_kv" });
+			return;
+		}
+		const row = database.prepare("SELECT value FROM auth_kv WHERE key = ?").get(KIRO_CLI_SOCIAL_TOKEN_KEY) as {
+			value?: unknown;
+		} | null;
+		if (!row) return;
+		const value =
+			typeof row.value === "string"
+				? row.value
+				: row.value instanceof Uint8Array
+					? new TextDecoder().decode(row.value)
+					: undefined;
+		if (value === undefined) {
+			result.skipped.push({
+				origin: "kiro-cli-social",
+				source,
+				reason: "Kiro CLI token value has an unsupported type",
+			});
+			return;
+		}
+		pushOutcome(result, parseKiroCliSocialToken(value, source));
+	} catch (err) {
+		result.skipped.push({
+			origin: "kiro-cli-social",
+			source,
+			reason: sanitizedFailureReason("unreadable credential file", err),
+		});
+	} finally {
+		database?.close();
+	}
+}
+
 // ─── Environment hints ───────────────────────────────────────────────────────
 
 function discoverEnvironment(env: Record<string, string | undefined>, result: CredentialDiscoveryResult): void {
@@ -421,8 +577,8 @@ function resolveExternalDir(
 }
 
 /**
- * Discover Claude Code and Codex CLI credentials across files, the macOS
- * Keychain, and environment variables. Never throws for individual unreadable or
+ * Discover Claude Code, Codex CLI, and Kiro CLI credentials across their local
+ * stores and environment variables. Never throws for individual unreadable or
  * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
  */
 export async function discoverExternalCredentials(options: DiscoveryOptions = {}): Promise<CredentialDiscoveryResult> {
@@ -436,11 +592,16 @@ export async function discoverExternalCredentials(options: DiscoveryOptions = {}
 		? { dir: options.codexHome, display: "$CODEX_HOME" }
 		: resolveExternalDir("CODEX_HOME", options.env, path.join(homeDir, ".codex"), "~/.codex");
 	const result: CredentialDiscoveryResult = { importable: [], skipped: [], environment: [] };
+	const kiroPathEnv = options.env ?? {
+		LOCALAPPDATA: $credentialEnv("LOCALAPPDATA"),
+		XDG_DATA_HOME: $credentialEnv("XDG_DATA_HOME"),
+	};
 	await discoverClaudeCode(
 		{ configDir: claudeConfigDir, platform, readClaudeKeychain: options.readClaudeKeychain },
 		result,
 	);
 	await discoverCodex(codexHome, result);
+	await discoverKiroCliSocialCredential(homeDir, platform, kiroPathEnv, options.kiroCliDatabasePath, result);
 	discoverEnvironment(env, result);
 	return result;
 }
@@ -487,6 +648,16 @@ function hasAutoImportOAuthProviderOrigin(credential: ImportableCredential): boo
 }
 
 export function isAutoImportOAuthCredential(credential: ImportableCredential, now: number = Date.now()): boolean {
+	const refreshableKiroSocialCredential =
+		credential.provider === "kiro" &&
+		credential.origin === "kiro-cli-social" &&
+		credential.kind === "oauth" &&
+		credential.credential.type === "oauth" &&
+		credential.credential.access.length > 0 &&
+		credential.credential.refresh.length > 0 &&
+		typeof credential.credential.profileArn === "string" &&
+		credential.credential.profileArn.length > 0;
+	if (refreshableKiroSocialCredential) return true;
 	return (
 		hasAutoImportOAuthProviderOrigin(credential) &&
 		typeof credential.expiresAt === "number" &&

package/src/setup/paseo/announce.ts

@@ -152,7 +152,12 @@ export function parseDaemonListen(raw: string): PaseoDaemonTarget | undefined {
 	const withoutQuery = authority.split("?")[0] ?? "";
 	const separator = withoutQuery.lastIndexOf(":");
 	if (separator <= 0) return undefined;
-	const port = Number(withoutQuery.slice(separator + 1));
+	// Digits only, like the bare-port branch above: `Number()` also accepts hex
+	// (`0x1A0B`), exponents (`1e3`), decimals and padding, which would probe a
+	// different port than the raw spelling handed to `paseo import`.
+	const portText = withoutQuery.slice(separator + 1);
+	if (!/^\d+$/.test(portText)) return undefined;
+	const port = Number(portText);
 	if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) return undefined;
 	const host = withoutQuery.slice(0, separator).replace(/^\[|]$/g, "");
 	return host ? { kind: "tcp", host, port } : undefined;