@kervnet/opencode-kiro-auth 1.5.1

package/dist/plugin/streaming/stream-transformer.js

@@ -0,0 +1,248 @@
+import { parseBracketToolCalls } from '../../infrastructure/transformers/tool-call-parser.js';
+import { estimateTokens } from '../response.js';
+import { convertToOpenAI } from './openai-converter.js';
+import { findRealTag, parseStreamBuffer } from './stream-parser.js';
+import { createTextDeltaEvents, createThinkingDeltaEvents, stopBlock } from './stream-state.js';
+import { THINKING_END_TAG, THINKING_START_TAG } from './types.js';
+export async function* transformKiroStream(response, model, conversationId) {
+    const thinkingRequested = true;
+    const streamState = {
+        thinkingRequested,
+        buffer: '',
+        inThinking: false,
+        thinkingExtracted: false,
+        thinkingBlockIndex: null,
+        textBlockIndex: null,
+        nextBlockIndex: 0,
+        stoppedBlocks: new Set()
+    };
+    if (!response.body) {
+        throw new Error('Response body is null');
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let rawBuffer = '';
+    let totalContent = '';
+    let outputTokens = 0;
+    let inputTokens = 0;
+    let contextUsagePercentage = null;
+    const toolCalls = [];
+    let currentToolCall = null;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const chunk = decoder.decode(value, { stream: true });
+            rawBuffer += chunk;
+            const events = parseStreamBuffer(rawBuffer);
+            rawBuffer = events.remaining;
+            for (const event of events.events) {
+                if (event.type === 'contextUsage' && event.data.contextUsagePercentage) {
+                    contextUsagePercentage = event.data.contextUsagePercentage;
+                }
+                else if (event.type === 'content' && event.data) {
+                    totalContent += event.data;
+                    if (!thinkingRequested) {
+                        for (const ev of createTextDeltaEvents(event.data, streamState)) {
+                            yield convertToOpenAI(ev, conversationId, model);
+                        }
+                        continue;
+                    }
+                    streamState.buffer += event.data;
+                    const deltaEvents = [];
+                    while (streamState.buffer.length > 0) {
+                        if (!streamState.inThinking && !streamState.thinkingExtracted) {
+                            const startPos = findRealTag(streamState.buffer, THINKING_START_TAG);
+                            if (startPos !== -1) {
+                                const before = streamState.buffer.slice(0, startPos);
+                                if (before) {
+                                    deltaEvents.push(...createTextDeltaEvents(before, streamState));
+                                }
+                                streamState.buffer = streamState.buffer.slice(startPos + THINKING_START_TAG.length);
+                                streamState.inThinking = true;
+                                continue;
+                            }
+                            const safeLen = Math.max(0, streamState.buffer.length - THINKING_START_TAG.length);
+                            if (safeLen > 0) {
+                                const safeText = streamState.buffer.slice(0, safeLen);
+                                if (safeText) {
+                                    deltaEvents.push(...createTextDeltaEvents(safeText, streamState));
+                                }
+                                streamState.buffer = streamState.buffer.slice(safeLen);
+                            }
+                            break;
+                        }
+                        if (streamState.inThinking) {
+                            const endPos = findRealTag(streamState.buffer, THINKING_END_TAG);
+                            if (endPos !== -1) {
+                                const thinkingPart = streamState.buffer.slice(0, endPos);
+                                if (thinkingPart) {
+                                    deltaEvents.push(...createThinkingDeltaEvents(thinkingPart, streamState));
+                                }
+                                streamState.buffer = streamState.buffer.slice(endPos + THINKING_END_TAG.length);
+                                streamState.inThinking = false;
+                                streamState.thinkingExtracted = true;
+                                deltaEvents.push(...createThinkingDeltaEvents('', streamState));
+                                deltaEvents.push(...stopBlock(streamState.thinkingBlockIndex, streamState));
+                                if (streamState.buffer.startsWith('\n\n')) {
+                                    streamState.buffer = streamState.buffer.slice(2);
+                                }
+                                continue;
+                            }
+                            const safeLen = Math.max(0, streamState.buffer.length - THINKING_END_TAG.length);
+                            if (safeLen > 0) {
+                                const safeThinking = streamState.buffer.slice(0, safeLen);
+                                if (safeThinking) {
+                                    deltaEvents.push(...createThinkingDeltaEvents(safeThinking, streamState));
+                                }
+                                streamState.buffer = streamState.buffer.slice(safeLen);
+                            }
+                            break;
+                        }
+                        if (streamState.thinkingExtracted) {
+                            const rest = streamState.buffer;
+                            streamState.buffer = '';
+                            if (rest) {
+                                deltaEvents.push(...createTextDeltaEvents(rest, streamState));
+                            }
+                            break;
+                        }
+                    }
+                    for (const ev of deltaEvents) {
+                        yield convertToOpenAI(ev, conversationId, model);
+                    }
+                }
+                else if (event.type === 'toolUse') {
+                    const tc = event.data;
+                    if (tc.name) {
+                        totalContent += tc.name;
+                    }
+                    if (tc.input) {
+                        totalContent += tc.input;
+                    }
+                    if (tc.name && tc.toolUseId) {
+                        if (currentToolCall && currentToolCall.toolUseId === tc.toolUseId) {
+                            currentToolCall.input += tc.input || '';
+                        }
+                        else {
+                            if (currentToolCall) {
+                                toolCalls.push(currentToolCall);
+                            }
+                            currentToolCall = {
+                                toolUseId: tc.toolUseId,
+                                name: tc.name,
+                                input: tc.input || ''
+                            };
+                        }
+                        if (tc.stop && currentToolCall) {
+                            toolCalls.push(currentToolCall);
+                            currentToolCall = null;
+                        }
+                    }
+                }
+                else if (event.type === 'toolUseInput') {
+                    if (event.data.input) {
+                        totalContent += event.data.input;
+                    }
+                    if (currentToolCall) {
+                        currentToolCall.input += event.data.input || '';
+                    }
+                }
+                else if (event.type === 'toolUseStop') {
+                    if (currentToolCall && event.data.stop) {
+                        toolCalls.push(currentToolCall);
+                        currentToolCall = null;
+                    }
+                }
+            }
+        }
+        if (currentToolCall) {
+            toolCalls.push(currentToolCall);
+            currentToolCall = null;
+        }
+        if (thinkingRequested && streamState.buffer) {
+            if (streamState.inThinking) {
+                for (const ev of createThinkingDeltaEvents(streamState.buffer, streamState))
+                    yield convertToOpenAI(ev, conversationId, model);
+                streamState.buffer = '';
+                for (const ev of createThinkingDeltaEvents('', streamState))
+                    yield convertToOpenAI(ev, conversationId, model);
+                for (const ev of stopBlock(streamState.thinkingBlockIndex, streamState))
+                    yield convertToOpenAI(ev, conversationId, model);
+            }
+            else {
+                for (const ev of createTextDeltaEvents(streamState.buffer, streamState))
+                    yield convertToOpenAI(ev, conversationId, model);
+                streamState.buffer = '';
+            }
+        }
+        for (const ev of stopBlock(streamState.textBlockIndex, streamState))
+            yield convertToOpenAI(ev, conversationId, model);
+        const bracketToolCalls = parseBracketToolCalls(totalContent);
+        if (bracketToolCalls.length > 0) {
+            for (const btc of bracketToolCalls) {
+                toolCalls.push({
+                    toolUseId: btc.toolUseId,
+                    name: btc.name,
+                    input: typeof btc.input === 'string' ? btc.input : JSON.stringify(btc.input)
+                });
+            }
+        }
+        if (toolCalls.length > 0) {
+            const baseIndex = streamState.nextBlockIndex;
+            for (let i = 0; i < toolCalls.length; i++) {
+                const tc = toolCalls[i];
+                if (!tc)
+                    continue;
+                const blockIndex = baseIndex + i;
+                yield convertToOpenAI({
+                    type: 'content_block_start',
+                    index: blockIndex,
+                    content_block: {
+                        type: 'tool_use',
+                        id: tc.toolUseId,
+                        name: tc.name,
+                        input: {}
+                    }
+                }, conversationId, model);
+                let inputJson;
+                try {
+                    const parsed = JSON.parse(tc.input);
+                    inputJson = JSON.stringify(parsed);
+                }
+                catch (e) {
+                    inputJson = tc.input;
+                }
+                yield convertToOpenAI({
+                    type: 'content_block_delta',
+                    index: blockIndex,
+                    delta: {
+                        type: 'input_json_delta',
+                        partial_json: inputJson
+                    }
+                }, conversationId, model);
+                yield convertToOpenAI({ type: 'content_block_stop', index: blockIndex }, conversationId, model);
+            }
+        }
+        outputTokens = estimateTokens(totalContent);
+        if (contextUsagePercentage !== null && contextUsagePercentage > 0) {
+            const totalTokens = Math.round((200000 * contextUsagePercentage) / 100);
+            inputTokens = Math.max(0, totalTokens - outputTokens);
+        }
+        yield convertToOpenAI({
+            type: 'message_delta',
+            delta: { stop_reason: toolCalls.length > 0 ? 'tool_use' : 'end_turn' },
+            usage: {
+                input_tokens: inputTokens,
+                output_tokens: outputTokens,
+                cache_creation_input_tokens: 0,
+                cache_read_input_tokens: 0
+            }
+        }, conversationId, model);
+        yield convertToOpenAI({ type: 'message_stop' }, conversationId, model);
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/dist/plugin/streaming/types.d.ts

@@ -0,0 +1,25 @@
+export interface StreamEvent {
+    type: string;
+    message?: any;
+    content_block?: any;
+    delta?: any;
+    index?: number;
+    usage?: any;
+}
+export interface StreamState {
+    thinkingRequested: boolean;
+    buffer: string;
+    inThinking: boolean;
+    thinkingExtracted: boolean;
+    thinkingBlockIndex: number | null;
+    textBlockIndex: number | null;
+    nextBlockIndex: number;
+    stoppedBlocks: Set<number>;
+}
+export interface ToolCallState {
+    toolUseId: string;
+    name: string;
+    input: string;
+}
+export declare const THINKING_START_TAG = "<thinking>";
+export declare const THINKING_END_TAG = "</thinking>";

package/dist/plugin/streaming/types.js

@@ -0,0 +1,2 @@
+export const THINKING_START_TAG = '<thinking>';
+export const THINKING_END_TAG = '</thinking>';

package/dist/plugin/sync/aws-sso.d.ts

@@ -0,0 +1,2 @@
+import type { ManagedAccount } from '../types';
+export declare function syncFromAwsSso(): Promise<ManagedAccount[]>;

package/dist/plugin/sync/aws-sso.js

@@ -0,0 +1,50 @@
+import { readFile, readdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createDeterministicAccountId } from '../accounts';
+import * as logger from '../logger';
+export async function syncFromAwsSso() {
+    const accounts = [];
+    const ssoDir = join(homedir(), '.aws', 'sso', 'cache');
+    try {
+        const files = await readdir(ssoDir);
+        const jsonFiles = files.filter((f) => f.endsWith('.json') && !f.includes('.tmp'));
+        for (const file of jsonFiles) {
+            try {
+                const content = await readFile(join(ssoDir, file), 'utf-8');
+                const entry = JSON.parse(content);
+                if (!entry.accessToken || !entry.refreshToken)
+                    continue;
+                const expiresAt = new Date(entry.expiresAt).getTime();
+                if (expiresAt < Date.now())
+                    continue;
+                const id = createDeterministicAccountId(entry.startUrl, 'aws-sso', entry.clientId, undefined);
+                accounts.push({
+                    id,
+                    email: entry.startUrl,
+                    authMethod: 'aws-sso',
+                    region: (entry.region || 'us-east-1'),
+                    clientId: entry.clientId,
+                    clientSecret: entry.clientSecret,
+                    refreshToken: entry.refreshToken,
+                    accessToken: entry.accessToken,
+                    expiresAt,
+                    rateLimitResetTime: 0,
+                    isHealthy: true,
+                    failCount: 0,
+                    lastUsed: Date.now(),
+                    usedCount: 0,
+                    limitCount: 0
+                });
+            }
+            catch (err) {
+                logger.debug('Failed to parse SSO cache file', { file, error: err });
+            }
+        }
+        logger.log(`Synced ${accounts.length} AWS SSO accounts`);
+    }
+    catch (err) {
+        logger.debug('Failed to read AWS SSO cache', { error: err });
+    }
+    return accounts;
+}

package/dist/plugin/sync/kiro-cli-parser.d.ts

@@ -0,0 +1,8 @@
+export declare function getCliDbPath(): string;
+export declare function safeJsonParse(value: unknown): any | null;
+export declare function normalizeExpiresAt(input: unknown): number;
+export declare function findClientCredsRecursive(input: unknown): {
+    clientId?: string;
+    clientSecret?: string;
+};
+export declare function makePlaceholderEmail(authMethod: string, region: string, clientId?: string, profileArn?: string): string;

package/dist/plugin/sync/kiro-cli-parser.js

@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+export function getCliDbPath() {
+    const override = process.env.KIROCLI_DB_PATH;
+    if (override)
+        return override;
+    const p = platform();
+    if (p === 'win32')
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'kiro-cli', 'data.sqlite3');
+    if (p === 'darwin')
+        return join(homedir(), 'Library', 'Application Support', 'kiro-cli', 'data.sqlite3');
+    return join(homedir(), '.local', 'share', 'kiro-cli', 'data.sqlite3');
+}
+export function safeJsonParse(value) {
+    if (typeof value !== 'string')
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+export function normalizeExpiresAt(input) {
+    if (typeof input === 'number') {
+        return input < 10_000_000_000 ? input * 1000 : input;
+    }
+    if (typeof input === 'string' && input.trim()) {
+        const t = new Date(input).getTime();
+        if (!Number.isNaN(t) && t > 0)
+            return t;
+        const n = Number(input);
+        if (Number.isFinite(n) && n > 0)
+            return normalizeExpiresAt(n);
+    }
+    return 0;
+}
+export function findClientCredsRecursive(input) {
+    const root = input;
+    if (!root || typeof root !== 'object')
+        return {};
+    const stack = [root];
+    const visited = new Set();
+    while (stack.length) {
+        const cur = stack.pop();
+        if (!cur || typeof cur !== 'object')
+            continue;
+        if (visited.has(cur))
+            continue;
+        visited.add(cur);
+        const clientId = cur.client_id || cur.clientId;
+        const clientSecret = cur.client_secret || cur.clientSecret;
+        if (typeof clientId === 'string' && typeof clientSecret === 'string') {
+            if (clientId && clientSecret)
+                return { clientId, clientSecret };
+        }
+        if (Array.isArray(cur)) {
+            for (const v of cur)
+                stack.push(v);
+            continue;
+        }
+        for (const v of Object.values(cur))
+            stack.push(v);
+    }
+    return {};
+}
+export function makePlaceholderEmail(authMethod, region, clientId, profileArn) {
+    const seed = `${authMethod}:${region}:${clientId || ''}:${profileArn || ''}`;
+    const h = createHash('sha256').update(seed).digest('hex').slice(0, 16);
+    return `${authMethod}-placeholder+${h}@awsapps.local`;
+}

package/dist/plugin/sync/kiro-cli.d.ts

@@ -0,0 +1,2 @@
+export declare function syncFromKiroCli(): Promise<void>;
+export declare function writeToKiroCli(acc: any): Promise<void>;

package/dist/plugin/sync/kiro-cli.js

@@ -0,0 +1,197 @@
+import { Database } from 'bun:sqlite';
+import { existsSync } from 'node:fs';
+import { createDeterministicAccountId } from '../accounts';
+import * as logger from '../logger';
+import { kiroDb } from '../storage/sqlite';
+import { fetchUsageLimits } from '../usage';
+import { findClientCredsRecursive, getCliDbPath, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser';
+export async function syncFromKiroCli() {
+    const dbPath = getCliDbPath();
+    if (!existsSync(dbPath))
+        return;
+    try {
+        const cliDb = new Database(dbPath, { readonly: true });
+        cliDb.run('PRAGMA busy_timeout = 5000');
+        const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
+        // Get profile ARN from state table
+        let profileArn;
+        let profileRegion;
+        try {
+            const stateRow = cliDb
+                .prepare("SELECT value FROM state WHERE key = 'api.codewhisperer.profile'")
+                .get();
+            if (stateRow?.value) {
+                const profileData = safeJsonParse(stateRow.value);
+                profileArn = profileData?.arn;
+                // Extract region from ARN: arn:aws:codewhisperer:REGION:...
+                if (profileArn) {
+                    const arnParts = profileArn.split(':');
+                    if (arnParts.length >= 4) {
+                        profileRegion = arnParts[3];
+                    }
+                }
+            }
+        }
+        catch (e) {
+            logger.debug('Could not read profile from state table', e);
+        }
+        const deviceRegRow = rows.find((r) => typeof r?.key === 'string' && r.key.includes('device-registration'));
+        const deviceReg = safeJsonParse(deviceRegRow?.value);
+        const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
+        for (const row of rows) {
+            if (row.key.includes(':token')) {
+                const data = safeJsonParse(row.value);
+                if (!data)
+                    continue;
+                const tokenExpiresAt = normalizeExpiresAt(data.expires_at ?? data.expiresAt) || Date.now() + 3600000;
+                // Skip expired tokens
+                if (tokenExpiresAt < Date.now()) {
+                    logger.debug('Kiro CLI sync: skipping expired token', { key: row.key });
+                    continue;
+                }
+                const isIdc = row.key.includes('odic');
+                const authMethod = isIdc ? 'idc' : 'desktop';
+                const region = profileRegion || data.region || 'us-east-1';
+                const tokenProfileArn = data.profile_arn || data.profileArn || profileArn;
+                const accessToken = data.access_token || data.accessToken || '';
+                const refreshToken = data.refresh_token || data.refreshToken;
+                if (!refreshToken)
+                    continue;
+                const clientId = data.client_id || data.clientId || (isIdc ? regCreds.clientId : undefined);
+                const clientSecret = data.client_secret || data.clientSecret || (isIdc ? regCreds.clientSecret : undefined);
+                if (authMethod === 'idc' && (!clientId || !clientSecret)) {
+                    logger.warn('Kiro CLI sync: missing IDC device credentials; skipping token import');
+                    continue;
+                }
+                let usedCount = 0;
+                let limitCount = 0;
+                let email;
+                let usageOk = false;
+                try {
+                    const authForUsage = {
+                        refresh: '',
+                        access: accessToken,
+                        expires: tokenExpiresAt,
+                        authMethod,
+                        region,
+                        profileArn: tokenProfileArn,
+                        clientId,
+                        clientSecret,
+                        email: ''
+                    };
+                    const u = await fetchUsageLimits(authForUsage);
+                    usedCount = u.usedCount || 0;
+                    limitCount = u.limitCount || 0;
+                    if (typeof u.email === 'string' && u.email) {
+                        email = u.email;
+                        usageOk = true;
+                    }
+                }
+                catch (e) {
+                    logger.warn('Kiro CLI sync: failed to fetch usage/email; falling back', {
+                        authMethod,
+                        region
+                    });
+                    logger.debug('Kiro CLI sync: usage fetch error', e);
+                }
+                const all = kiroDb.getAccounts();
+                if (!email) {
+                    let existing;
+                    if (tokenProfileArn) {
+                        existing = all.find((a) => a.auth_method === authMethod && a.profile_arn === tokenProfileArn);
+                    }
+                    if (!existing && authMethod === 'idc' && clientId) {
+                        existing = all.find((a) => a.auth_method === 'idc' && a.client_id === clientId);
+                    }
+                    if (existing && typeof existing.email === 'string' && existing.email) {
+                        email = existing.email;
+                    }
+                    else {
+                        email = makePlaceholderEmail(authMethod, region, clientId, tokenProfileArn);
+                    }
+                }
+                const resolvedEmail = email || makePlaceholderEmail(authMethod, region, clientId, tokenProfileArn);
+                const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, tokenProfileArn);
+                const existingById = all.find((a) => a.id === id);
+                if (existingById &&
+                    existingById.is_healthy === 1 &&
+                    existingById.expires_at >= tokenExpiresAt)
+                    continue;
+                if (usageOk) {
+                    const placeholderEmail = makePlaceholderEmail(authMethod, region, clientId, tokenProfileArn);
+                    const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, tokenProfileArn);
+                    if (placeholderId !== id) {
+                        const placeholderRow = all.find((a) => a.id === placeholderId);
+                        if (placeholderRow) {
+                            await kiroDb.upsertAccount({
+                                id: placeholderId,
+                                email: placeholderRow.email,
+                                authMethod,
+                                region: placeholderRow.region || region,
+                                clientId,
+                                clientSecret,
+                                profileArn: tokenProfileArn,
+                                refreshToken: placeholderRow.refresh_token || refreshToken,
+                                accessToken: placeholderRow.access_token || accessToken,
+                                expiresAt: placeholderRow.expires_at || tokenExpiresAt,
+                                rateLimitResetTime: 0,
+                                isHealthy: false,
+                                failCount: 10,
+                                unhealthyReason: 'Replaced by real email',
+                                recoveryTime: Date.now() + 31536000000,
+                                usedCount: placeholderRow.used_count || 0,
+                                limitCount: placeholderRow.limit_count || 0,
+                                lastSync: Date.now()
+                            });
+                        }
+                    }
+                }
+                await kiroDb.upsertAccount({
+                    id,
+                    email: resolvedEmail,
+                    authMethod,
+                    region,
+                    clientId,
+                    clientSecret,
+                    profileArn: tokenProfileArn,
+                    refreshToken,
+                    accessToken,
+                    expiresAt: tokenExpiresAt,
+                    rateLimitResetTime: 0,
+                    isHealthy: true,
+                    failCount: 0,
+                    usedCount,
+                    limitCount,
+                    lastSync: Date.now()
+                });
+            }
+        }
+        cliDb.close();
+    }
+    catch (e) {
+        logger.error('Sync failed', e);
+    }
+}
+export async function writeToKiroCli(acc) {
+    const dbPath = getCliDbPath();
+    if (!existsSync(dbPath))
+        return;
+    try {
+        const cliDb = new Database(dbPath);
+        cliDb.run('PRAGMA busy_timeout = 5000');
+        const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
+        const targetKey = acc.authMethod === 'idc' ? 'kirocli:odic:token' : 'kirocli:social:token';
+        const row = rows.find((r) => r.key === targetKey || r.key.endsWith(targetKey));
+        if (row) {
+            const data = JSON.parse(row.value);
+            data.access_token = acc.accessToken;
+            data.refresh_token = acc.refreshToken;
+            data.expires_at = new Date(acc.expiresAt).toISOString();
+            cliDb.prepare('UPDATE auth_kv SET value = ? WHERE key = ?').run(JSON.stringify(data), row.key);
+        }
+        cliDb.close();
+    }
+    catch (e) {
+        logger.warn('Write back failed', e);
+    }
+}

package/dist/plugin/token.d.ts

@@ -0,0 +1,2 @@
+import type { KiroAuthDetails } from './types';
+export declare function refreshAccessToken(auth: KiroAuthDetails): Promise<KiroAuthDetails>;