@magpie-community/opencode-kiro-auth 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +92 -0
- package/index.mjs +1292 -0
- package/package.json +11 -0
package/README.md
ADDED
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
# @magpie-community/opencode-kiro-auth
|
|
2
|
+
|
|
3
|
+
Signs in to a [Kiro](https://kiro.dev) subscription (Free, Pro, Pro+,
|
|
4
|
+
Power) and makes its requests, in OpenCode and in magpie. Provider id:
|
|
5
|
+
`kiro`.
|
|
6
|
+
|
|
7
|
+
## Signing in
|
|
8
|
+
|
|
9
|
+
- **Kiro (Google, GitHub, AWS Builder ID, IAM Identity Center)**: the Kiro
|
|
10
|
+
IDE's own sign-in.
|
|
11
|
+
- Kiro's page (`app.kiro.dev/signin`) sends the browser back to one of
|
|
12
|
+
the ports the IDE listens on (3128, 4649, 6588, 8008, 9091, 49153,
|
|
13
|
+
50153–53153) on `127.0.0.1`. While the IDE is signing in, those ports
|
|
14
|
+
may be busy.
|
|
15
|
+
- Google and GitHub come back with a code. Kiro's auth service trades it
|
|
16
|
+
for tokens.
|
|
17
|
+
- Builder ID and Identity Center come back with an AWS sign-in URL and
|
|
18
|
+
region. The plugin registers a client with AWS's OIDC service, sends
|
|
19
|
+
the browser to AWS, and trades the code AWS returns.
|
|
20
|
+
- The account is named by the email Kiro has for it (`Get-Usage-Limits`),
|
|
21
|
+
and its plan is read from the same call.
|
|
22
|
+
- A company's own identity provider (`external_idp`) is not supported
|
|
23
|
+
here. Sign in with `kiro-cli login` and use the next method instead.
|
|
24
|
+
- **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed
|
|
25
|
+
in to, or else the Kiro IDE's. Nothing is copied. It is read each time
|
|
26
|
+
from where they keep it:
|
|
27
|
+
- kiro-cli: its SQLite database's `auth_kv` table.
|
|
28
|
+
- macOS: `~/Library/Application Support/kiro-cli/data.sqlite3`
|
|
29
|
+
- Linux: `~/.local/share/kiro-cli/data.sqlite3`
|
|
30
|
+
- Windows: `%APPDATA%\kiro-cli\data.sqlite3`
|
|
31
|
+
- The IDE: `~/.aws/sso/cache/kiro-auth-token.json`.
|
|
32
|
+
|
|
33
|
+
kiro-cli refreshes its own token first (`kiro-cli debug refresh-auth-token`).
|
|
34
|
+
A token the plugin refreshes itself is written back, so kiro-cli and the
|
|
35
|
+
IDE go on with it.
|
|
36
|
+
- **Kiro API key (`ksk_…`)**: sent with `tokentype: API_KEY`. Its profile is
|
|
37
|
+
found with `GetProfile`.
|
|
38
|
+
|
|
39
|
+
A browser sign-in is kept where OpenCode keeps sign-ins (`auth.json`; in
|
|
40
|
+
magpie, `plugin-auth.json`) as an `oauth` entry. The entry holds the
|
|
41
|
+
tokens, the profile ARN, the region and, for AWS, the registered client.
|
|
42
|
+
Tokens are refreshed 2 minutes before they expire, and also when Kiro
|
|
43
|
+
turns one down (a 403, after which the request is tried once more):
|
|
44
|
+
|
|
45
|
+
- Google/GitHub: through `prod.<region>.auth.desktop.kiro.dev/refreshToken`.
|
|
46
|
+
- Builder ID/Identity Center: through AWS's `oidc.<region>.amazonaws.com/token`.
|
|
47
|
+
|
|
48
|
+
## Requests
|
|
49
|
+
|
|
50
|
+
Kiro has no API OpenCode speaks. The models are declared on Anthropic's
|
|
51
|
+
Messages (`@ai-sdk/anthropic`), and the plugin's `fetch` handles each
|
|
52
|
+
request:
|
|
53
|
+
|
|
54
|
+
- It sends the request to `runtime.<region>.kiro.dev/generateAssistantResponse`,
|
|
55
|
+
the API kiro-cli uses, with kiro-cli's headers. The region is the one the
|
|
56
|
+
profile ARN names.
|
|
57
|
+
- It turns the request into a Kiro conversation:
|
|
58
|
+
- The system prompt goes at the head of the first message.
|
|
59
|
+
- Tool calls and results are paired: an unanswered call gets an error
|
|
60
|
+
result, and a result longer than 250,000 characters is cut.
|
|
61
|
+
- Tool ids Kiro wouldn't take are rewritten.
|
|
62
|
+
- Only the latest images are sent.
|
|
63
|
+
- Tools the history used but the request doesn't offer are declared.
|
|
64
|
+
- It turns the AWS event stream Kiro answers with back into Messages'
|
|
65
|
+
events (streamed) or one message. The reply includes text, thinking,
|
|
66
|
+
tool calls and usage. When Kiro reports only how full the context is,
|
|
67
|
+
input tokens are estimated from that.
|
|
68
|
+
- Thinking (Claude models and Auto) is asked for the way kiro-cli asks, in
|
|
69
|
+
the prompt, with a budget: low 10k, medium 20k, high 30k, max 50k. The
|
|
70
|
+
`<thinking>` block of the reply comes back as thinking.
|
|
71
|
+
- Kiro's failures keep their meaning:
|
|
72
|
+
- input too long → 400
|
|
73
|
+
- no capacity → 503
|
|
74
|
+
- usage limit → 429
|
|
75
|
+
- throttling → "rate limited"
|
|
76
|
+
|
|
77
|
+
## Models
|
|
78
|
+
|
|
79
|
+
The `config` hook declares `auto` (Kiro picks the model). Once signed in,
|
|
80
|
+
the `provider.models` hook replaces it with the account's own list from
|
|
81
|
+
`List-Available-Models`, with the default first. Each model carries its
|
|
82
|
+
context window, output limit and whether it takes images. Claude models
|
|
83
|
+
and Auto have the thinking variants.
|
|
84
|
+
|
|
85
|
+
## Not included
|
|
86
|
+
|
|
87
|
+
- Usage and quota (credits, the monthly window).
|
|
88
|
+
- Switching between several accounts. OpenCode keeps one sign-in per
|
|
89
|
+
provider.
|
|
90
|
+
- Signing in with a company's own identity provider in the browser (use
|
|
91
|
+
kiro-cli's sign-in).
|
|
92
|
+
- magpie's web-search stand-in for Kiro.
|