@javargasm/opencode-kiro-auth 0.3.1 → 0.5.0

package/dist/index.js

@@ -16,8 +16,125 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// src/debug.ts
+// src/file-logger.ts
 import { appendFileSync, mkdirSync } from "node:fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+function isFileLoggingEnabled() {
+  const v = process.env.KIRO_FILE_LOG;
+  if (!v)
+    return false;
+  const s = v.trim().toLowerCase();
+  return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+function ensureLogDir() {
+  if (dirEnsured)
+    return;
+  try {
+    mkdirSync(LOG_DIR, { recursive: true });
+    dirEnsured = true;
+  } catch {}
+}
+function sanitizeSessionId(id) {
+  const slug = id.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
+  return slug.length > 0 ? slug : "default";
+}
+function currentSessionLogFile() {
+  return sessionLogStore.getStore()?.file ?? null;
+}
+function enterSessionLog(sessionId) {
+  const id = sanitizeSessionId(sessionId ?? "default");
+  sessionLogStore.enterWith({ file: `${LOG_DIR}/session-${id}.log`, sessionId: id });
+  return id;
+}
+function writeLine(file, data) {
+  if (!isFileLoggingEnabled())
+    return;
+  ensureLogDir();
+  const entry = {
+    ts: new Date().toISOString(),
+    ...data
+  };
+  try {
+    appendFileSync(file, JSON.stringify(entry) + `
+`);
+  } catch {}
+}
+function createSessionLogger(sessionId) {
+  const id = sanitizeSessionId(sessionId ?? "default");
+  const file = `${LOG_DIR}/session-${id}.log`;
+  const emit = (data) => writeLine(file, { sessionId: id, ...data });
+  return {
+    file,
+    sessionId: id,
+    logRequest(meta, requestBody) {
+      emit({
+        type: "request",
+        ...meta,
+        body: safeParseJson(requestBody)
+      });
+    },
+    logResponseEvent(event) {
+      emit({
+        type: "response_event",
+        eventType: event.type,
+        seq: event.eventSeq,
+        data: event.data
+      });
+    },
+    logResponseDone(meta) {
+      emit({ type: "response_done", ...meta });
+    },
+    logHttpError(meta) {
+      emit({ type: "http_error", ...meta });
+    },
+    logStreamError(meta) {
+      emit({ type: "stream_error", ...meta });
+    },
+    logCaughtError(meta, error) {
+      emit({
+        type: "caught_error",
+        ...meta,
+        error: error === undefined ? undefined : serializeError(error)
+      });
+    }
+  };
+}
+function safeParseJson(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
+}
+function serializeError(error, depth = 0) {
+  if (depth > 5)
+    return "[cause chain truncated]";
+  if (error instanceof Error) {
+    const out = {
+      name: error.name,
+      message: error.message,
+      stack: error.stack
+    };
+    if (error.cause !== undefined) {
+      out.cause = serializeError(error.cause, depth + 1);
+    }
+    for (const key of Object.keys(error)) {
+      if (!(key in out))
+        out[key] = error[key];
+    }
+    return out;
+  }
+  if (error && typeof error === "object")
+    return error;
+  return String(error);
+}
+var LOG_DIR = "/tmp/kiro-logs", dirEnsured = false, sessionLogStore;
+var init_file_logger = __esm(() => {
+  sessionLogStore = new AsyncLocalStorage;
+});
+
+// src/debug.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 function currentLevel() {
   const raw = (globalThis.process?.env?.KIRO_LOG ?? "").toLowerCase();
@@ -29,6 +146,9 @@ function enabled(level) {
   return LEVEL_ORDER[level] <= LEVEL_ORDER[currentLevel()];
 }
 function currentFilePath() {
+  const sessionFile = currentSessionLogFile();
+  if (sessionFile)
+    return sessionFile;
   const raw = globalThis.process?.env?.KIRO_LOG_FILE;
   if (!raw)
     return null;
@@ -38,10 +158,10 @@ function writeToFile(filePath, line) {
   try {
     const dir = dirname(filePath);
     if (!ensuredDirs.has(dir)) {
-      mkdirSync(dir, { recursive: true });
+      mkdirSync2(dir, { recursive: true });
       ensuredDirs.add(dir);
     }
-    appendFileSync(filePath, line + `
+    appendFileSync2(filePath, line + `
 `);
   } catch (err) {
     if (!fileFallbackWarned) {
@@ -101,6 +221,7 @@ function previewChunk(s) {
 }
 var LEVEL_ORDER, ensuredDirs, fileFallbackWarned = false, log, CHUNK_PREVIEW_LIMIT = 2048;
 var init_debug = __esm(() => {
+  init_file_logger();
   LEVEL_ORDER = {
     error: 0,
     warn: 1,
@@ -167,7 +288,7 @@ async function resolveProfileArn(accessToken, apiRegion) {
       Authorization: `Bearer ${accessToken}`,
       "Content-Type": "application/x-amz-json-1.0",
       "X-Amz-Target": "AmazonCodeWhispererService.ListAvailableProfiles",
-      "user-agent": "aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererruntime/0.1.16551 os/macos lang/rust/1.92.0 md/appVersion-2.7.1 app/AmazonQ-For-CLI"
+      "user-agent": "aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererruntime/0.1.16551 os/macos lang/rust/1.92.0 md/appVersion-2.8.1 app/AmazonQ-For-CLI"
     },
     body: "{}"
   });
@@ -190,7 +311,7 @@ async function fetchAvailableModels(accessToken, apiRegion, profileArn) {
       Authorization: `Bearer ${accessToken}`,
       "Content-Type": "application/x-amz-json-1.0",
       "X-Amz-Target": "AmazonCodeWhispererService.ListAvailableModels",
-      "user-agent": "aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererruntime/0.1.16551 os/macos lang/rust/1.92.0 md/appVersion-2.7.1 app/AmazonQ-For-CLI"
+      "user-agent": "aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererruntime/0.1.16551 os/macos lang/rust/1.92.0 md/appVersion-2.8.1 app/AmazonQ-For-CLI"
     },
     body: "{}"
   });
@@ -293,7 +414,7 @@ var init_models = __esm(() => {
     {
       ...KIRO_DEFAULTS,
       id: "claude-fable-5",
-      name: "Claude Fable 5",
+      name: "Claude Fable 5 (disabled)",
       reasoning: true,
       input: MULTIMODAL,
       contextWindow: 1e6,
@@ -364,7 +485,7 @@ var init_models = __esm(() => {
       reasoning: true,
       input: MULTIMODAL,
       contextWindow: 200000,
-      maxTokens: 65536
+      maxTokens: 64000
     },
     {
       ...KIRO_DEFAULTS,
@@ -373,7 +494,7 @@ var init_models = __esm(() => {
       reasoning: true,
       input: MULTIMODAL,
       contextWindow: 200000,
-      maxTokens: 65536
+      maxTokens: 64000
     },
     {
       ...KIRO_DEFAULTS,
@@ -382,7 +503,7 @@ var init_models = __esm(() => {
       reasoning: false,
       input: MULTIMODAL,
       contextWindow: 200000,
-      maxTokens: 65536
+      maxTokens: 64000
     },
     {
       ...KIRO_DEFAULTS,
@@ -417,8 +538,8 @@ var init_models = __esm(() => {
       name: "Auto",
       reasoning: true,
       input: MULTIMODAL,
-      contextWindow: 200000,
-      maxTokens: 65536
+      contextWindow: 1e6,
+      maxTokens: 64000
     }
   ];
   REASONING_FAMILIES = new Set([
@@ -863,6 +984,9 @@ var init_kiro_cli_sync = __esm(() => {
   init_debug();
 });
 
+// src/server.ts
+import { createHash as createHash4 } from "node:crypto";
+
 // src/types.ts
 class EventStream {
   queue = [];
@@ -870,20 +994,25 @@ class EventStream {
   done = false;
   finalResultPromise;
   resolveFinalResult;
+  rejectFinalResult;
+  resultSettled = false;
   isComplete;
   extractResult;
   constructor(isComplete, extractResult) {
     this.isComplete = isComplete;
     this.extractResult = extractResult;
-    this.finalResultPromise = new Promise((resolve) => {
+    this.finalResultPromise = new Promise((resolve, reject) => {
       this.resolveFinalResult = resolve;
+      this.rejectFinalResult = reject;
     });
+    this.finalResultPromise.catch(() => {});
   }
   push(event) {
     if (this.done)
       return;
     if (this.isComplete(event)) {
       this.done = true;
+      this.resultSettled = true;
       this.resolveFinalResult(this.extractResult(event));
     }
     const waiter = this.waiting.shift();
@@ -896,7 +1025,11 @@ class EventStream {
   end(result) {
     this.done = true;
     if (result !== undefined) {
+      this.resultSettled = true;
       this.resolveFinalResult(result);
+    } else if (!this.resultSettled) {
+      this.resultSettled = true;
+      this.rejectFinalResult(new Error("Stream ended before producing a final result"));
     }
     while (this.waiting.length > 0) {
       const waiter = this.waiting.shift();
@@ -1086,6 +1219,9 @@ function parseKiroEventMulti(parsed) {
   if (parsed.unit === "credit" && parsed.usage !== undefined && typeof parsed.usage === "number") {
     events.push({ type: "metering", data: { usage: parsed.usage } });
   }
+  if (typeof parsed.stopReason === "string") {
+    events.push({ type: "metadata", data: { stopReason: parsed.stopReason } });
+  }
   return events;
 }
 var EVENT_PATTERNS = [
@@ -1100,6 +1236,7 @@ var EVENT_PATTERNS = [
   '{"input":',
   '{"stop":',
   '{"contextUsagePercentage":',
+  '{"stopReason":',
   '{"followupPrompt":',
   '{"usage":',
   '{"Usage":',
@@ -1118,9 +1255,31 @@ function findNextEventStart(buffer, from) {
   }
   return earliest;
 }
+var EXCEPTION_TYPE_RE = /:exception-type[\s\S]{0,4}?([A-Za-z][A-Za-z0-9]*(?:Exception|Error|Fault))/;
+var MESSAGE_TYPE_EXCEPTION_RE = /:message-type[\s\S]{0,4}?exception\b/;
+function detectEventStreamException(buffer) {
+  const typeMatch = buffer.match(EXCEPTION_TYPE_RE);
+  if (!typeMatch && !MESSAGE_TYPE_EXCEPTION_RE.test(buffer))
+    return null;
+  const type = typeMatch?.[1] ?? "ServiceException";
+  let message;
+  const msgIdx = buffer.lastIndexOf('{"message":');
+  if (msgIdx >= 0) {
+    const end = findJsonEnd(buffer, msgIdx);
+    if (end >= 0) {
+      try {
+        const parsed = JSON.parse(buffer.substring(msgIdx, end + 1));
+        if (typeof parsed.message === "string")
+          message = parsed.message;
+      } catch {}
+    }
+  }
+  return { type, message };
+}
 function parseKiroEvents(buffer) {
   const events = [];
   let pos = 0;
+  let remaining = "";
   while (pos < buffer.length) {
     const jsonStart = findNextEventStart(buffer, pos);
     if (jsonStart < 0) {
@@ -1148,7 +1307,8 @@ function parseKiroEvents(buffer) {
     }
     const jsonEnd = findJsonEnd(buffer, jsonStart);
     if (jsonEnd < 0) {
-      return { events, remaining: buffer.substring(jsonStart) };
+      remaining = buffer.substring(jsonStart);
+      break;
     }
     try {
       const parsed = JSON.parse(buffer.substring(jsonStart, jsonEnd + 1));
@@ -1168,7 +1328,12 @@ function parseKiroEvents(buffer) {
     }
     pos = jsonEnd + 1;
   }
-  return { events, remaining: "" };
+  const exception = detectEventStreamException(buffer);
+  if (exception && !events.some((e) => e.type === "error")) {
+    events.push({ type: "error", data: { error: exception.type, message: exception.message } });
+    remaining = "";
+  }
+  return { events, remaining };
 }
 
 // src/health.ts
@@ -1191,6 +1356,7 @@ function isPermanentError(reason) {
 
 // src/stream.ts
 init_models();
+import { createHash as createHash3 } from "node:crypto";
 
 // src/thinking-parser.ts
 init_debug();
@@ -1391,14 +1557,8 @@ class ThinkingTagParser {
     if (!thinking)
       return;
     if (this.thinkingBlockIndex === null) {
-      if (this.textBlockIndex !== null) {
-        this.thinkingBlockIndex = this.textBlockIndex;
-        this.output.content.splice(this.thinkingBlockIndex, 0, { type: "thinking", thinking: "" });
-        this.textBlockIndex = this.textBlockIndex + 1;
-      } else {
-        this.thinkingBlockIndex = this.output.content.length;
-        this.output.content.push({ type: "thinking", thinking: "" });
-      }
+      this.thinkingBlockIndex = this.output.content.length;
+      this.output.content.push({ type: "thinking", thinking: "" });
       this.stream.push({
         type: "thinking_start",
         contentIndex: this.thinkingBlockIndex,
@@ -2002,83 +2162,8 @@ async function startSocialLogin() {
   return { signInUrl, waitForCredentials };
 }
 
-// src/file-logger.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
-var LOG_DIR = "/tmp/kiro-logs";
-var REQUESTS_FILE = `${LOG_DIR}/requests.log`;
-var RESPONSES_FILE = `${LOG_DIR}/responses.log`;
-var ERRORS_FILE = `${LOG_DIR}/errors.log`;
-var dirEnsured = false;
-function isEnabled() {
-  return true;
-}
-function ensureDir() {
-  if (dirEnsured)
-    return;
-  try {
-    mkdirSync2(LOG_DIR, { recursive: true });
-    dirEnsured = true;
-  } catch {}
-}
-function writeLine(file, data) {
-  if (!isEnabled())
-    return;
-  ensureDir();
-  const entry = {
-    ts: new Date().toISOString(),
-    ...data
-  };
-  try {
-    appendFileSync2(file, JSON.stringify(entry) + `
-`);
-  } catch {}
-}
-function logRequest(meta, requestBody) {
-  writeLine(REQUESTS_FILE, {
-    type: "request",
-    ...meta,
-    body: safeParseJson(requestBody)
-  });
-}
-function logResponseEvent(event) {
-  writeLine(RESPONSES_FILE, {
-    type: "response_event",
-    eventType: event.type,
-    seq: event.eventSeq,
-    data: event.data
-  });
-}
-function logResponseDone(meta) {
-  writeLine(RESPONSES_FILE, {
-    type: "response_done",
-    ...meta
-  });
-}
-function logHttpError(meta) {
-  writeLine(ERRORS_FILE, {
-    type: "http_error",
-    ...meta
-  });
-}
-function logStreamError(meta) {
-  writeLine(ERRORS_FILE, {
-    type: "stream_error",
-    ...meta
-  });
-}
-function logCaughtError(meta) {
-  writeLine(ERRORS_FILE, {
-    type: "caught_error",
-    ...meta
-  });
-}
-function safeParseJson(s) {
-  try {
-    return JSON.parse(s);
-  } catch {
-    return s;
-  }
-}
+// src/stream.ts
+init_file_logger();
 
 // src/transform.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -2256,6 +2341,13 @@ function convertToolsToKiro(tools) {
     };
   });
 }
+var KIRO_IMAGE_FORMATS = new Set(["png", "jpeg", "gif", "webp"]);
+function normalizeImageFormat(mimeType) {
+  const sub = (mimeType.split("/")[1] || "").toLowerCase().split(";")[0].trim();
+  const base = sub.replace(/\+.*$/, "").replace(/^vnd\./, "");
+  const canonical = base === "jpg" ? "jpeg" : base;
+  return KIRO_IMAGE_FORMATS.has(canonical) ? canonical : null;
+}
 function convertImagesToKiro(images) {
   let omitted = 0;
   const valid = [];
@@ -2269,8 +2361,13 @@ function convertImagesToKiro(images) {
       omitted++;
       continue;
     }
+    const format = normalizeImageFormat(img.mimeType);
+    if (!format) {
+      omitted++;
+      continue;
+    }
     valid.push({
-      format: img.mimeType.split("/")[1] || "png",
+      format,
       source: { bytes: img.data }
     });
   }
@@ -2529,9 +2626,28 @@ function isTransientError(status) {
   return status === 429 || status >= 500;
 }
 function firstTokenTimeoutForModel(modelId) {
-  const m = kiroModels.find((x) => x.id === modelId);
+  const m = kiroModels.find((x) => x.id === modelId) ?? getCachedDynamicModels()?.find((x) => x.id === modelId);
   return m?.firstTokenTimeout ?? FIRST_TOKEN_TIMEOUT_DEFAULT_MS;
 }
+function regionFromEndpoint(endpoint) {
+  const m = endpoint.match(/(?:runtime|management)\.([a-z0-9-]+)\.kiro\.dev/i);
+  return m?.[1] ?? "us-east-1";
+}
+function mapKiroStopReason(raw) {
+  switch (raw?.toUpperCase()) {
+    case "TOOL_USE":
+      return "toolUse";
+    case "MAX_TOKENS":
+      return "length";
+    case "END_TURN":
+    case "STOP_SEQUENCE":
+    case "COMPLETE":
+    case "FINISHED":
+      return "stop";
+    default:
+      return null;
+  }
+}
 var HIDDEN_REASONING_PLACEHOLDER = "Reasoning hidden by provider";
 var HIDDEN_REASONING_COUNTDOWN_MS = 2000;
 function emitHiddenReasoningLate(output, stream) {
@@ -2577,8 +2693,23 @@ function emitToolCall(state, output, stream) {
   stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
   return true;
 }
+var CONVERSATION_ID_NAMESPACE = "opencode-kiro/conversation";
+function deterministicConversationId(key) {
+  const digest = createHash3("sha1").update(`${CONVERSATION_ID_NAMESPACE}\x00${key}`).digest();
+  const b = Buffer.from(digest.subarray(0, 16));
+  b[6] = b[6] & 15 | 80;
+  b[8] = b[8] & 63 | 128;
+  const hex = b.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function resolveConversationId(sessionId) {
+  if (!sessionId)
+    return crypto.randomUUID();
+  return deterministicConversationId(sessionId);
+}
 function streamKiro(model, context, options) {
   const stream = new AssistantMessageEventStream;
+  const fileLog = createSessionLogger(options?.logSessionId ?? options?.sessionId);
   (async () => {
     const output = {
       role: "assistant",
@@ -2604,7 +2735,7 @@ function streamKiro(model, context, options) {
         throw new Error("Kiro credentials not set. Run /login kiro.");
       }
       const endpoint = model.baseUrl || "https://runtime.us-east-1.kiro.dev";
-      const profileArn = await resolveProfileArn(accessToken, endpoint);
+      const profileArn = await resolveProfileArn(accessToken, regionFromEndpoint(endpoint));
       const kiroModelId = resolveKiroModel(model.id);
       const thinkingEnabled = !!options?.reasoning || model.reasoning;
       const reasoningHidden = !!model.reasoningHidden;
@@ -2633,7 +2764,7 @@ ${systemPrompt}` : ""}`;
         operatingSystem: resolveOS(),
         currentWorkingDirectory: process.cwd()
       };
-      const conversationId = options?.sessionId ?? crypto.randomUUID();
+      const conversationId = resolveConversationId(options?.sessionId);
       let retryCount = 0;
       while (retryCount <= MAX_RETRIES) {
         if (options?.signal?.aborted)
@@ -2828,6 +2959,12 @@ ${currentContent}`;
             log.debug("effort.set", { effort: options.reasoning, model: model.id });
           }
         }
+        if (supportsThinkingConfig && typeof options?.maxTokens === "number" && options.maxTokens > 0) {
+          const capped = Math.min(Math.max(Math.floor(options.maxTokens), 1024), model.maxTokens || 64000);
+          request.additionalModelRequestFields = request.additionalModelRequestFields || {};
+          request.additionalModelRequestFields.max_tokens = capped;
+          log.debug("maxTokens.set", { maxTokens: capped, model: model.id });
+        }
         stream.push({ type: "start", partial: output });
         if (reasoningHidden && thinkingEnabled && hiddenShimTimer === null) {
           hiddenShimTimer = setTimeout(() => {
@@ -2841,7 +2978,7 @@ ${currentContent}`;
         let contextTruncationAttempt = 0;
         while (true) {
           const osName = resolveOS();
-          const ua = `aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererstreaming/0.1.16551 os/${osName} lang/rust/1.92.0 md/appVersion-2.7.1 app/AmazonQ-For-CLI`;
+          const ua = `aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererstreaming/0.1.16551 os/${osName} lang/rust/1.92.0 md/appVersion-2.8.1 app/AmazonQ-For-CLI`;
           const xAmzUa = `aws-sdk-rust/1.3.15 ua/2.1 api/codewhispererstreaming/0.1.16551 os/${osName} lang/rust/1.92.0 m/F app/AmazonQ-For-CLI`;
           const requestBody = JSON.stringify(request);
           log.debug("request.send", {
@@ -2854,12 +2991,13 @@ ${currentContent}`;
             requestJsonChars: requestBody.length
           });
           log.debug(`[stream] req=${requestBody.length}c hist=${history.length} content=${currentContent.length}c profileArn=${!!profileArn}`);
-          if (log.isDebug()) {
+          if (isFileLoggingEnabled()) {
             try {
-              __require("fs").writeFileSync("/tmp/kiro-last-request.json", requestBody);
+              ensureLogDir();
+              __require("fs").writeFileSync(`${LOG_DIR}/session-${fileLog.sessionId}.last-request.json`, requestBody);
             } catch {}
           }
-          logRequest({
+          fileLog.logRequest({
             endpoint,
             model: model.id,
             historyLength: history.length,
@@ -2898,7 +3036,7 @@ ${currentContent}`;
             status: response.status,
             body: errText
           });
-          logHttpError({
+          fileLog.logHttpError({
             status: response.status,
             statusText: response.statusText,
             body: errText,
@@ -2965,10 +3103,10 @@ ${currentContent}`;
         const decoder = new TextDecoder;
         let buffer = "";
         let totalContent = "";
-        let lastContentData = "";
         let usageEvent = null;
         let meteringCredits;
         let receivedContextUsage = false;
+        let serverStopReason = null;
         let chunkSeq = 0;
         let eventSeq = 0;
         const thinkingParser = thinkingEnabled ? new ThinkingTagParser(output, stream) : null;
@@ -3051,7 +3189,7 @@ ${currentContent}`;
             }
           }
           for (const ev of events) {
-            logResponseEvent({ type: ev.type, data: ev.data, eventSeq });
+            fileLog.logResponseEvent({ type: ev.type, data: ev.data, eventSeq });
           }
           for (const event of events) {
             switch (event.type) {
@@ -3064,7 +3202,10 @@ ${currentContent}`;
               }
               case "reasoning": {
                 cancelHiddenShim();
-                if (output.content.length === 0 || output.content[output.content.length - 1]?.type !== "thinking") {
+                const lastIsThinking = output.content.length > 0 && output.content[output.content.length - 1]?.type === "thinking";
+                if (!event.data.text && !lastIsThinking)
+                  break;
+                if (!lastIsThinking) {
                   output.content.push({ type: "thinking", thinking: "" });
                   stream.push({ type: "thinking_start", contentIndex: output.content.length - 1, partial: output });
                 }
@@ -3081,9 +3222,6 @@ ${currentContent}`;
                 break;
               }
               case "content": {
-                if (event.data === lastContentData)
-                  continue;
-                lastContentData = event.data;
                 totalContent += event.data;
                 cancelHiddenShim();
                 if (thinkingParser) {
@@ -3142,9 +3280,14 @@ ${currentContent}`;
                 meteringCredits = event.data.usage;
                 break;
               }
+              case "metadata": {
+                if (event.data.stopReason)
+                  serverStopReason = event.data.stopReason;
+                break;
+              }
               case "error": {
                 streamError = event.data.message ? `${event.data.error}: ${event.data.message}` : event.data.error;
-                logStreamError({
+                fileLog.logStreamError({
                   error: streamError,
                   context: "stream_event",
                   model: model.id,
@@ -3161,11 +3304,12 @@ ${currentContent}`;
         if (idleTimer)
           clearTimeout(idleTimer);
         if (firstTokenTimedOut || idleCancelled || streamError) {
-          if (retryCount < MAX_RETRIES) {
+          const alreadyStreamed = totalContent.length > 0 || emittedToolCalls > 0;
+          if (!alreadyStreamed && retryCount < MAX_RETRIES) {
             retryCount++;
             const delayMs = exponentialBackoff(retryCount - 1, 1000, MAX_RETRY_DELAY_MS);
             const streamErrDesc = firstTokenTimedOut ? "first-token timed out" : idleCancelled ? "idle timed out" : `error: ${streamError}`;
-            logStreamError({
+            fileLog.logStreamError({
               error: streamErrDesc,
               context: "retry",
               model: model.id,
@@ -3178,9 +3322,13 @@ ${currentContent}`;
             textBlockIndex = null;
             continue;
           }
-          if (streamError)
-            throw new Error(`Kiro API stream error after max retries: ${streamError}`);
-          throw new Error(`Kiro API error: ${firstTokenTimedOut ? "first token" : "idle"} timeout after max retries`);
+          if (streamError) {
+            throw new Error(`Kiro API stream error${alreadyStreamed ? " after partial output" : " after max retries"}: ${streamError}`);
+          }
+          if (!alreadyStreamed) {
+            throw new Error(`Kiro API error: ${firstTokenTimedOut ? "first token" : "idle"} timeout after max retries`);
+          }
+          log.info(`stream ${firstTokenTimedOut ? "first-token" : "idle"} timeout after partial output — finalizing with partial content`);
         }
         cancelHiddenShim();
         if (currentToolCall && emitToolCall(currentToolCall, output, stream))
@@ -3230,7 +3378,10 @@ ${currentContent}`;
           log.info(`empty response persisted after ${MAX_RETRIES} retries`);
           cancelHiddenShim();
         }
-        if (!receivedContextUsage && emittedToolCalls === 0) {
+        const mappedServerStop = mapKiroStopReason(serverStopReason);
+        if (mappedServerStop) {
+          output.stopReason = mappedServerStop;
+        } else if (!receivedContextUsage && emittedToolCalls === 0) {
           output.stopReason = "length";
         } else {
           output.stopReason = emittedToolCalls > 0 ? "toolUse" : "stop";
@@ -3246,7 +3397,7 @@ ${currentContent}`;
           sawAnyToolCalls,
           usage: output.usage
         });
-        logResponseDone({
+        fileLog.logResponseDone({
           stopReason: output.stopReason,
           emittedToolCalls,
           usage: output.usage,
@@ -3260,11 +3411,11 @@ ${currentContent}`;
       output.stopReason = options?.signal?.aborted ? "aborted" : "error";
       output.errorMessage = error instanceof Error ? error.message : String(error);
       log.debug("response.caught", { stopReason: output.stopReason, error: output.errorMessage });
-      logCaughtError({
+      fileLog.logCaughtError({
         stopReason: output.stopReason,
         errorMessage: output.errorMessage,
         model: model.id
-      });
+      }, error);
       if (hiddenShimTimer) {
         clearTimeout(hiddenShimTimer);
         hiddenShimTimer = null;
@@ -3282,6 +3433,7 @@ ${currentContent}`;
 
 // src/server.ts
 init_debug();
+init_file_logger();
 init_models();
 init_models();
 
@@ -3715,6 +3867,7 @@ function getDashboardHtml() {
 
 // src/server.ts
 var _creds = null;
+var _refreshInFlight = null;
 async function initGatewayAuth() {
   try {
     const { importFromKiroCli: importFromKiroCli2 } = await Promise.resolve().then(() => (init_kiro_cli_sync(), exports_kiro_cli_sync));
@@ -3727,7 +3880,9 @@ async function initGatewayAuth() {
       imported.refreshToken,
       imported.clientId || "",
       imported.clientSecret || "",
-      imported.authMethod
+      imported.authMethod,
+      imported.source || "",
+      imported.tokenKey || ""
     ];
     _creds = {
       accessToken: imported.accessToken,
@@ -3772,15 +3927,37 @@ async function getAccessToken() {
   if (!_creds)
     throw new Error("Kiro credentials not initialized — run /login kiro");
   if (Date.now() >= _creds.expiresAt) {
-    log.info("[gateway-auth] Token expired, refreshing...");
-    const refreshed = await refreshKiroToken(_creds.refreshPacked, _creds.region, _creds.authMethod);
-    _creds.accessToken = refreshed.access;
-    _creds.refreshPacked = refreshed.refresh;
-    _creds.expiresAt = refreshed.expires;
-    log.info("[gateway-auth] Token refreshed successfully");
+    if (!_refreshInFlight) {
+      const creds = _creds;
+      _refreshInFlight = (async () => {
+        log.info("[gateway-auth] Token expired, refreshing...");
+        const refreshed = await refreshKiroToken(creds.refreshPacked, creds.region, creds.authMethod);
+        creds.accessToken = refreshed.access;
+        creds.refreshPacked = refreshed.refresh;
+        creds.expiresAt = refreshed.expires;
+        log.info("[gateway-auth] Token refreshed successfully");
+      })().finally(() => {
+        _refreshInFlight = null;
+      });
+    }
+    await _refreshInFlight;
   }
   return _creds.accessToken;
 }
+function isLocalhostOrigin(origin) {
+  try {
+    const host = new URL(origin).hostname;
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function isDisallowedBrowserRequest(req) {
+  const origin = req.headers.get("origin");
+  if (!origin)
+    return false;
+  return !isLocalhostOrigin(origin);
+}
 function anthropicError(status, type, message) {
   return new Response(JSON.stringify({ type: "error", error: { type, message } }), {
     status,
@@ -3800,6 +3977,56 @@ function isTitleGenerationRequest(messages) {
   }
   return false;
 }
+function shortHash(input) {
+  return createHash4("sha256").update(input).digest("hex").slice(0, 12);
+}
+function firstUserMessageText(messages) {
+  for (const m of messages) {
+    if (m?.role !== "user")
+      continue;
+    if (typeof m.content === "string")
+      return m.content;
+    if (Array.isArray(m.content)) {
+      const text = m.content.map((b) => typeof b === "string" ? b : b?.text || "").join(" ").trim();
+      if (text)
+        return text;
+    }
+  }
+  return "";
+}
+function conversationSeed(messages) {
+  const text = firstUserMessageText(messages);
+  if (text)
+    return text;
+  if (messages.length > 0) {
+    try {
+      return "msg0:" + JSON.stringify(messages[0]);
+    } catch {}
+  }
+  return "";
+}
+function deriveLogSessionId(body, messages, headers) {
+  const headerId = headers?.get("x-session-id") || headers?.get("x-kiro-session-id") || headers?.get("anthropic-session-id");
+  if (headerId && headerId.trim().length > 0) {
+    return `s-${shortHash(headerId.trim())}`;
+  }
+  const userId = body?.metadata?.user_id;
+  if (typeof userId === "string" && userId.trim().length > 0) {
+    return `u-${shortHash(userId.trim())}`;
+  }
+  const seed = conversationSeed(messages);
+  if (isTitleGenerationRequest(messages)) {
+    return `title-${shortHash(seed || "untitled")}`;
+  }
+  if (seed) {
+    return `c-${shortHash(seed)}`;
+  }
+  try {
+    return `c-${shortHash(JSON.stringify(body))}`;
+  } catch {
+    return `c-${shortHash(String(Date.now()))}`;
+  }
+}
 function stripTitleMarkdown(text) {
   let t = text.trim();
   let prev;
@@ -3823,13 +4050,16 @@ function startGatewayServer(port = 0) {
       idleTimeout: 255,
       async fetch(req) {
         if (req.method === "OPTIONS") {
-          return new Response(null, {
-            headers: {
-              "Access-Control-Allow-Origin": "*",
-              "Access-Control-Allow-Methods": "POST, GET, OPTIONS",
-              "Access-Control-Allow-Headers": "Content-Type, Authorization"
-            }
-          });
+          const origin = req.headers.get("origin");
+          const headers = {
+            "Access-Control-Allow-Methods": "POST, GET, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, Authorization"
+          };
+          if (origin && isLocalhostOrigin(origin)) {
+            headers["Access-Control-Allow-Origin"] = origin;
+            headers["Vary"] = "Origin";
+          }
+          return new Response(null, { headers });
         }
         const url = new URL(req.url);
         if (url.pathname === "/dashboard") {
@@ -3878,6 +4108,9 @@ function startGatewayServer(port = 0) {
           }
         }
         if ((url.pathname === "/v1/messages" || url.pathname === "/messages") && req.method === "POST") {
+          if (isDisallowedBrowserRequest(req)) {
+            return anthropicError(403, "invalid_request_error", "Cross-origin requests are not allowed");
+          }
           let accessToken;
           try {
             accessToken = await getAccessToken();
@@ -3902,6 +4135,9 @@ function startGatewayServer(port = 0) {
           }
           const streamRequested = !!body.stream;
           const temperature = body.temperature ?? 0.5;
+          const maxTokens = typeof body.max_tokens === "number" ? body.max_tokens : undefined;
+          const logSessionId = deriveLogSessionId(body, anthropicMessages, req.headers);
+          enterSessionLog(logSessionId);
           log.debug(`[gateway] sys=${systemPrompt.length}c msgs=${anthropicMessages.length} tools=${body.tools?.length ?? 0}`);
           try {
             const piMessages = translateAnthropicToPi(anthropicMessages);
@@ -3934,7 +4170,10 @@ function startGatewayServer(port = 0) {
             const kiroStream = streamKiro(piModel, context, {
               apiKey: accessToken,
               reasoning: reasoningEffort,
-              temperature
+              temperature,
+              maxTokens,
+              sessionId: logSessionId,
+              logSessionId
             });
             if (streamRequested) {
               const iter = kiroStream[Symbol.asyncIterator]();
@@ -3970,6 +4209,29 @@ function startGatewayServer(port = 0) {
               }
               const streamResponse = new ReadableStream({
                 async start(controller) {
+                  const PING_INTERVAL_MS = 15000;
+                  let lastActivity = Date.now();
+                  let pingTimer = null;
+                  const stopHeartbeat = () => {
+                    if (pingTimer) {
+                      clearInterval(pingTimer);
+                      pingTimer = null;
+                    }
+                  };
+                  const startHeartbeat = () => {
+                    pingTimer = setInterval(() => {
+                      if (Date.now() - lastActivity < PING_INTERVAL_MS)
+                        return;
+                      try {
+                        controller.enqueue(`event: ping
+data: {"type":"ping"}
+
+`);
+                      } catch {
+                        stopHeartbeat();
+                      }
+                    }, PING_INTERVAL_MS);
+                  };
                   try {
                     const msgId = `msg_${crypto.randomUUID()}`;
                     controller.enqueue(`event: message_start
@@ -3988,6 +4250,7 @@ data: ` + JSON.stringify({
                     }) + `
 
 `);
+                    startHeartbeat();
                     let contentBlockIndex = 0;
                     let activeBlockType = null;
                     let titleTextBuffer = "";
@@ -4021,6 +4284,7 @@ data: ` + JSON.stringify({
 `);
                     };
                     const processEvent = (event) => {
+                      lastActivity = Date.now();
                       if (event.type === "thinking_delta") {
                         ensureBlockStarted("thinking");
                         controller.enqueue(`event: content_block_delta
@@ -4102,8 +4366,22 @@ data: ` + JSON.stringify({
 `);
                     }
                     closeActiveBlock();
-                    let finishReason = "end_turn";
                     const finalMsg = await kiroStream.result();
+                    if (finalMsg.stopReason === "error" || finalMsg.errorMessage) {
+                      controller.enqueue(`event: error
+data: ` + JSON.stringify({
+                        type: "error",
+                        error: {
+                          type: "api_error",
+                          message: finalMsg.errorMessage || "Kiro stream error"
+                        }
+                      }) + `
+
+`);
+                      controller.close();
+                      return;
+                    }
+                    let finishReason = "end_turn";
                     if (finalMsg.content.some((b) => b.type === "toolCall")) {
                       finishReason = "tool_use";
                     }
@@ -4151,6 +4429,8 @@ data: ` + JSON.stringify({
 
 `);
                     controller.close();
+                  } finally {
+                    stopHeartbeat();
                   }
                 }
               });
@@ -4164,6 +4444,9 @@ data: ` + JSON.stringify({
               });
             } else {
               const finalMsg = await kiroStream.result();
+              if (finalMsg.stopReason === "error" || finalMsg.errorMessage) {
+                return anthropicError(502, "api_error", `Kiro: ${finalMsg.errorMessage || "stream error"}`);
+              }
               const contentParts = finalMsg.content;
               const anthropicContent = [];
               for (const part of contentParts) {
@@ -4247,9 +4530,20 @@ function translateAnthropicToPi(messages) {
           timestamp: Date.now()
         });
       } else if (Array.isArray(msg.content)) {
-        const toolResultParts = msg.content.filter((part) => part.type === "tool_result");
-        if (toolResultParts.length > 0) {
-          for (const part of toolResultParts) {
+        let pendingUserParts = [];
+        const flushUserParts = () => {
+          if (pendingUserParts.length > 0) {
+            piMessages.push({
+              role: "user",
+              content: pendingUserParts,
+              timestamp: Date.now()
+            });
+            pendingUserParts = [];
+          }
+        };
+        for (const part of msg.content) {
+          if (part.type === "tool_result") {
+            flushUserParts();
             piMessages.push({
               role: "toolResult",
               toolCallId: part.tool_use_id,
@@ -4258,24 +4552,13 @@ function translateAnthropicToPi(messages) {
               isError: part.is_error || false,
               timestamp: Date.now()
             });
+          } else if (part.type === "text") {
+            pendingUserParts.push({ type: "text", text: part.text });
+          } else if (part.type === "image" && part.source?.type === "base64") {
+            pendingUserParts.push({ type: "image", mimeType: part.source.media_type, data: part.source.data });
           }
         }
-        const otherParts = msg.content.map((part) => {
-          if (part.type === "text") {
-            return { type: "text", text: part.text };
-          }
-          if (part.type === "image" && part.source?.type === "base64") {
-            return { type: "image", mimeType: part.source.media_type, data: part.source.data };
-          }
-          return null;
-        }).filter(Boolean);
-        if (otherParts.length > 0) {
-          piMessages.push({
-            role: "user",
-            content: otherParts,
-            timestamp: Date.now()
-          });
-        }
+        flushUserParts();
       }
     } else if (msg.role === "assistant") {
       const contentParts = [];
@@ -4321,8 +4604,11 @@ function translateAnthropicToolsToPi(tools) {
 init_debug();
 init_models();
 process.env.KIRO_LOG = process.env.KIRO_LOG || "debug";
-process.env.KIRO_LOG_FILE = process.env.KIRO_LOG_FILE || "/tmp/opencode-kiro.log";
+process.env.KIRO_LOG_FILE = process.env.KIRO_LOG_FILE || "/tmp/kiro-logs/session-gateway.log";
 var gatewayServer = null;
+function kiroSessionHeaders(sessionID) {
+  return typeof sessionID === "string" && sessionID.trim().length > 0 ? { "x-session-id": sessionID.trim() } : {};
+}
 var KiroPlugin = async (input) => {
   const client = input.client;
   const GATEWAY_PORT = 7438;
@@ -4339,6 +4625,12 @@ var KiroPlugin = async (input) => {
   await initGatewayAuth();
   const localPort = gatewayServer ? gatewayServer.port : GATEWAY_PORT;
   const hooks = {
+    "chat.headers": async (input2, output) => {
+      const headers = kiroSessionHeaders(input2?.sessionID);
+      if (output && output.headers) {
+        Object.assign(output.headers, headers);
+      }
+    },
     dispose: async () => {
       if (gatewayServer) {
         log.info("[opencode-kiro] Shutting down gateway server...");
@@ -4606,6 +4898,7 @@ var src_default = {
   server: KiroPlugin
 };
 export {
+  kiroSessionHeaders,
   src_default as default,
   KiroPlugin
 };