@magpie-community/opencode-kiro-auth 0.1.11 → 0.1.13

package/README.md

@@ -19,6 +19,12 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
     the browser to AWS, and trades the code AWS returns.
   - The account is named by the email Kiro has for it (`Get-Usage-Limits`),
     and its plan is read from the same call.
+  - Kiro keeps a Google, a GitHub, a Builder ID and an Identity Center
+    sign-in of one email as different accounts. The sign-in carries a `uid`
+    (`google`, `github`, `builderid`, `enterprise`), so magpie keeps each one
+    beside the others, and a sign-in again the same way replaces only its
+    own account. An account signed in before 0.1.13 is given its `uid` on
+    its first request, model listing, usage read or renewal.
   - A company's own identity provider (`external_idp`) is not supported
     here. Sign in with `kiro-cli login` and use the next method instead.
 - **Kiro CLI's or Kiro IDE's sign-in**: uses the account kiro-cli is signed

package/index.mjs

@@ -50,6 +50,12 @@ const SIGN_IN_TIMEOUT = 10 * 60 * 1000
 const BUILDER_ID_START = "https://view.awsapps.com/start"
 const BUILDER_ID_PROFILE = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX"
 const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "builderid"
+// uidOf is what tells two Kiro accounts of one email apart: the way it was
+// signed in to. Kiro keeps a Google and a GitHub sign-in of one email (or
+// Builder ID's, or Identity Center's) as different accounts, and magpie
+// keeps a sign-in of an email already signed in as that account unless
+// both have a uid and the two differ (#309). "" when it isn't known.
+const uidOf = (loginProvider) => String(loginProvider ?? "").trim().toLowerCase()
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -438,11 +444,15 @@ function account(client) {
     lock = run.catch(() => {})
     return run
   }
+  // an account signed in here before its uid was kept is given it, so a
+  // sign-in with another way to the same email no longer replaces it
+  const uidSaved = new Set()
+  const uidField = (auth) => (!auth?.uid && uidOf(auth?.loginProvider) ? { uid: uidOf(auth.loginProvider) } : {})
   const save = async (auth, c) => {
     if (!c.own || !client?.auth?.set) return
     const { type: _t, ...rest } = auth
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
-      profileArn: c.profile, region: c.region } }).catch(() => {})
+      profileArn: c.profile, region: c.region, ...uidField(auth) } }).catch(() => {})
   }
   const creds = (auth, stale = false) =>
     locked(async () => {
@@ -460,6 +470,7 @@ function account(client) {
       }
       read = newest(read)
       let c = held?.id === id ? held.c : null
+      let saved = false
       if (!c || read.access !== c.access || !fresh(c) || stale) {
         if (!read.profile && c && read.access === c.access) read.profile = c.profile
         if (stale && c && read.access !== c.access && fresh(read)) stale = false // the owner refreshed it already
@@ -468,11 +479,20 @@ function account(client) {
           if (c.method === "apikey") throw gone("Kiro turned down the API key saved on the provider")
           c = renewed(c, await refresh(c))
           await save(auth, c)
+          saved = true
         }
       }
       if (!c.profile) {
         c.profile = await profileOf(c)
-        if (!auth?.profileArn) await save(auth, c)
+        if (!auth?.profileArn && !saved) {
+          await save(auth, c)
+          saved = true
+        }
+      }
+      // once per token: a save that didn't take isn't tried on every request
+      if (!saved && c.own && uidField(auth).uid && !uidSaved.has(c.access)) {
+        uidSaved.add(c.access)
+        await save(auth, c)
       }
       held = { id, c }
       return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
@@ -493,7 +513,7 @@ function account(client) {
       const out = { access: c.access, expires: c.expires }
       if (c.refresh !== auth.refresh) out.refresh = c.refresh
       if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
-      return out
+      return { ...out, ...uidField(auth) }
     })
   return creds
 }
@@ -645,6 +665,17 @@ function thinking(req, model) {
   return 20000
 }
 
+// formatText is the structured output a request asks for, said in words:
+// Anthropic's output_config.format (or the AI SDK's output_format) with a
+// JSON schema, "" when it asks for none. A JSON object with no schema
+// reaches the plugin already told in the system prompt, as Messages has no
+// field for it.
+function formatText(req) {
+  const f = req.output_config?.format ?? req.output_format
+  if (f?.type !== "json_schema" || !f.schema || typeof f.schema !== "object") return ""
+  return "Respond with a single JSON value and nothing else, matching this JSON schema:\n" + JSON.stringify(f.schema) + "."
+}
+
 // buildKiro is the body of a generateAssistantResponse call.
 function buildKiro(req, model, profile, budget) {
   const entries = []
@@ -756,6 +787,10 @@ function buildKiro(req, model, profile, budget) {
   for (const e of entries) if (e.assistantResponseMessage && !e.assistantResponseMessage.toolUses.length) delete e.assistantResponseMessage.toolUses
   // the instructions go at the head of the first message
   let system = typeof req.system === "string" ? req.system : textOf(req.system)
+  // Kiro has no field for the answer's format: it is told in words, at the
+  // end of the instructions, as magpie's built-in tells it (inSystem)
+  const format = formatText(req)
+  if (format) system = system ? system + "\n\n" + format : format
   if (budget) system = `<thinking_mode>enabled</thinking_mode><max_thinking_length>${budget}</max_thinking_length>` + (system ? "\n" + system : "")
   if (system) entries[0].userInputMessage.content = system + "\n\n" + entries[0].userInputMessage.content
   if (Array.isArray(req.system)) mark(entries[0].userInputMessage, req.system)
@@ -1390,6 +1425,7 @@ async function browserSignIn() {
     const who = await whoIs(c)
     const user = who.email || "Kiro account"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
+      ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
       ...(c.clientId ? { clientId: c.clientId, clientSecret: c.clientSecret } : {}), ...(who.plan ? { plan: who.plan } : {}) })
     html(200, page(true, "You're signed in", `${user} is signed in. You can close this tab.`))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",