@magpie-community/opencode-kiro-auth 0.1.19 → 0.1.20

package/README.md

@@ -105,6 +105,12 @@ request:
     that can't be read or brought under is replaced by a short note, so the
     conversation goes on (#428). Smaller images are sent as they are.
   - Tools the history used but the request doesn't offer are declared.
+  - A tool's input schema says `type: "object"` at its root, as Kiro
+    wants: one that says no type (or object-or-null) is sent saying so, and
+    an empty one as an object with no properties. Kiro answers 400
+    `REQUEST_BODY_INVALID` to either. Everything under the root (a union
+    there, properties, `$ref`s, `nullable`) is sent as given, and a root
+    that names another type is left alone.
 - It turns the AWS event stream Kiro answers with back into Messages'
   events (streamed) or one message. The reply includes text, thinking,
   tool calls and usage. When Kiro reports only how full the context is,
@@ -113,12 +119,86 @@ request:
   the prompt, with a budget: low 10k, medium 20k, high 30k, xhigh and max
   50k (as magpie's built-in Kiro: #120). The
   `<thinking>` block of the reply comes back as thinking.
+- Anthropic's hosted web search is answered with Kiro's own web search
+  (see [Web search](#web-search)).
 - Kiro's failures keep their meaning:
   - input too long → 400
   - no capacity → 503
   - usage limit → 429
   - throttling → "rate limited"
 
+## Web search
+
+A request offering Anthropic's hosted web search,
+`{"type": "web_search_20250305", "name": "web_search", "max_uses": n}`, is
+searched with Kiro's own web search, sent as kiro-cli (2.35) sends it:
+
+- The model is offered kiro-cli's `web_search` tool as kiro-cli's agent
+  offers it: its description, a `query` (200 characters at most) and the
+  `__tool_use_purpose` kiro-cli adds to each tool. A call the model makes to
+  it is searched here, never passed to the caller as a `tool_use`. Its
+  `__tool_use_purpose` is kiro-cli's alone: it isn't searched for, and the
+  caller's `server_tool_use` has the `query` only.
+- The search is Kiro's runtime's `InvokeMCP` operation:
+  `POST runtime.<region>.kiro.dev/`, `Content-Type:
+  application/x-amz-json-1.0`, `x-amz-target:
+  AmazonCodeWhispererStreamingService.InvokeMCP`, in the account's region
+  with its token. Its body is a JSON-RPC `tools/call` of `web_search` with
+  `{query}` and nothing else, and the profile as `profileArn` beside it:
+  over AWS JSON 1.0 that member is sent in the body, and without it there
+  Kiro answers 400 `profileArn is required for this request`. It goes in
+  `x-amzn-kiro-profile-arn` too, as kiro-cli 2.35 sends it. An API key,
+  sent as `tokentype: API_KEY`, names no profile in either, as kiro-cli
+  names none for one. The answer is
+  `{jsonrpc, id, result, error}`, the result being the `tools/call`'s.
+- The pages found go back to the model as the call's result (title, URL,
+  date, snippet), and it is asked again. The caller is answered as
+  Anthropic answers: `server_tool_use` and `web_search_tool_result` blocks
+  (streamed or not), then the answer, and `usage.server_tool_use.web_search_requests`.
+- Each result has the page's `title`, `url` and `page_age`. `encrypted_content`
+  is `""`: Kiro has no sealed copy of the page, and none is made up (as
+  magpie's own search answers). The answer cites its pages by URL in its
+  text; it has no `citations`, which need Anthropic's encrypted index.
+- `max_uses` is kept, and no request searches more than 10 times. A search
+  past it is a `max_uses_exceeded` error; a model still searching after
+  `max_uses` + 2 turns is stopped with `pause_turn`. A `max_uses` that isn't
+  a whole number of at least 1 is a 400.
+- `allowed_domains` or `blocked_domains` filter the pages Kiro's search
+  returns; the search itself isn't told them, so fewer pages may come back.
+  A domain takes in its subdomains; with a path (`example.com/Docs`), only
+  pages under it, the host matched in any case and the path as written.
+  Both at once, or `user_location`, which Kiro's search has no place for,
+  is a 400.
+- A search that fails (Kiro unreachable, an error, an answer it can't
+  read, a query over 200 characters) is a `web_search_tool_result_error`,
+  and the model is told why. A token Kiro's search turns down (403) is
+  refreshed once, as a request's is. A cancelled request stops searching.
+- Kiro failing on a turn after a search is an error: streamed, an `error`
+  event after the blocks said; not streamed, the failure's status, not a
+  200 holding only the searches.
+- A turn that also calls the caller's own tools ends there (`tool_use`),
+  with its searches. The conversation sent back, with its
+  `server_tool_use` and `web_search_tool_result` blocks, gives the model
+  each search's call and result again. A tool of the caller's named
+  `web_search` (no hosted `type`) stays the caller's.
+- Other hosted tools are not sent, as before.
+
+### Supported scope
+
+Only `web_search_20250305` named `web_search` is searched (Claude Code sends
+it). Any other tool whose type begins `web_search` (a newer version such as
+`web_search_20260209`, another name, the same tool twice) is a 400 before
+Kiro is asked: with `searches: true` magpie hands every such tool to the
+plugin rather than searching for it, so dropping it would leave the search
+asked for undone. A client that sends a newer version needs
+`provider.kiro.searches: false`, so magpie's own search serves it as it did
+before; the 400 says so.
+
+The `config` hook says `searches: true` on the provider, so magpie passes a
+client's web search (Claude Code's WebSearch) on to Kiro as sent rather than
+searching for it. Set `provider.kiro.searches` to `false` to have magpie's
+own search used instead.
+
 ## Models
 
 The `config` hook declares `auto` (Kiro picks the model). Once signed in,
@@ -134,4 +214,3 @@ and Auto have the thinking variants.
   provider.
 - Signing in with a company's own identity provider in the browser (use
   kiro-cli's sign-in).
-- magpie's web-search stand-in for Kiro.

package/index.mjs

@@ -845,6 +845,21 @@ function formatText(req) {
   return "Respond with a single JSON value and nothing else, matching this JSON schema:\n" + JSON.stringify(f.schema) + "."
 }
 
+// inputSchema is a tool's input schema as Kiro takes it: one whose root
+// says type "object". Kiro answers 400 REQUEST_BODY_INVALID to a root with
+// properties and no type (Haiku 5.5: the same schema with the type added
+// is called), and to {}. A tool's input is always an object, so a root
+// that says no type, or object-or-null, is said to be one; the rest of it
+// (a union at its root, its properties, $refs, nullable) is sent as given,
+// and a root that says another type is left as the caller said it. The
+// caller's schema isn't changed: the root is copied.
+function inputSchema(s) {
+  if (!s || typeof s !== "object" || Array.isArray(s) || !Object.keys(s).length) return { type: "object", properties: {} }
+  if (s.type === undefined) return { type: "object", ...s }
+  if (Array.isArray(s.type) && s.type.includes("object") && s.type.every((t) => t === "object" || t === "null")) return { ...s, type: "object" }
+  return s
+}
+
 // buildKiro is the body of a generateAssistantResponse call, as it is
 // before its images are fitted (kiroBody).
 function buildKiro(req, model, profile, budget) {
@@ -866,26 +881,53 @@ function kiroRequest(req, model, profile, budget) {
     if (parts.some((p) => p?.cache_control)) marked.add(msg)
   }
   const user = () => ({ content: "", modelId: model, origin: "KIRO_CLI" })
+  const resultsOnly = new WeakSet() // the messages made to carry a reply's web search results
   for (const m of req.messages ?? []) {
     const parts = typeof m.content === "string" ? [{ type: "text", text: m.content }] : m.content ?? []
     const texts = []
     if (m.role === "assistant") {
-      const a = { content: "", toolUses: [] }
+      // a web search's result is in the reply itself (server_tool_use, then
+      // web_search_tool_result): to Kiro the reply up to it is a turn of its
+      // own, answered by a message carrying the result
+      let a = { content: "", toolUses: [] }
+      let last = null
+      const flush = () => {
+        a.content = texts.splice(0).join("\n\n")
+        if (!a.content && !a.toolUses.length) return // what only thought
+        const prev = entries.at(-1)?.assistantResponseMessage
+        if (prev) {
+          prev.content = joinNonEmpty(prev.content, a.content)
+          prev.toolUses.push(...a.toolUses)
+        } else entries.push({ assistantResponseMessage: a })
+        last = prev ?? a
+        a = { content: "", toolUses: [] }
+      }
       for (const p of parts) {
         if (p?.type === "text" && p.text) texts.push(p.text)
         else if (p?.type === "tool_use") {
           const input = p.input && typeof p.input === "object" && !Array.isArray(p.input) ? p.input : {}
           a.toolUses.push({ name: toolName(p.name), toolUseId: toolID(p.id), input })
+        } else if (p?.type === "server_tool_use" && p.name === SEARCH_NAME) {
+          const input = p.input && typeof p.input === "object" && !Array.isArray(p.input) ? p.input : {}
+          a.toolUses.push({ name: SEARCH_NAME, toolUseId: toolID(p.id), input })
+        } else if (p?.type === "web_search_tool_result") {
+          flush()
+          const text = searchedText(p)
+          const result = { toolUseId: toolID(p.tool_use_id), status: text === null ? "error" : "success",
+            content: [{ text: text ?? searched.get(p.tool_use_id) ?? searchFailedText(p.content?.error_code) }] }
+          // parallel searches (both calls, then both results, as
+          // Anthropic answers them) are answered in one message
+          const prev = entries.at(-1)?.userInputMessage
+          if (prev && resultsOnly.has(prev)) prev.userInputMessageContext.toolResults.push(result)
+          else {
+            const u = { ...user(), images: [], userInputMessageContext: { toolResults: [result] } }
+            resultsOnly.add(u)
+            entries.push({ userInputMessage: u })
+          }
         }
       }
-      a.content = texts.join("\n\n")
-      if (!a.content && !a.toolUses.length) continue // a turn that only thought
-      const prev = entries.at(-1)?.assistantResponseMessage
-      if (prev) {
-        prev.content = joinNonEmpty(prev.content, a.content)
-        prev.toolUses.push(...a.toolUses)
-      } else entries.push({ assistantResponseMessage: a })
-      mark(prev ?? a, parts)
+      flush()
+      if (last) mark(last, parts)
       continue
     }
     const u = user()
@@ -981,11 +1023,19 @@ function kiroRequest(req, model, profile, budget) {
   const tools = []
   const offered = new Set()
   const EMPTY = { type: "object", properties: {} }
+  const hosted = hostedSearch(req)
   for (const t of req.tools ?? []) {
+    if (hosted && t === hosted.tool) {
+      // Kiro's own web search, run here when the model calls it (searching)
+      offered.add(SEARCH_NAME)
+      tools.push({ toolSpecification: SEARCH_SPEC })
+      if (t.cache_control) tools.push({ cachePoint: { type: "default" } })
+      continue
+    }
     if (!t?.name || (t.type && t.type !== "custom" && !t.input_schema)) continue // server tools Kiro hasn't
     const name = toolName(t.name)
     offered.add(name)
-    tools.push({ toolSpecification: { name, description: t.description || t.name, inputSchema: { json: t.input_schema ?? EMPTY } } })
+    tools.push({ toolSpecification: { name, description: t.description || t.name, inputSchema: { json: inputSchema(t.input_schema) } } })
     if (t.cache_control) tools.push({ cachePoint: { type: "default" } })
   }
   for (const e of entries)
@@ -1016,21 +1066,24 @@ function kiroRequest(req, model, profile, budget) {
   return out
 }
 
-function sendKiro(a, body, signal) {
+// sdkHeaders are the AWS SDK's headers on a call to Kiro's runtime, as
+// kiro-cli's client sends them: who is calling, and as which client.
+function sdkHeaders(a) {
   const ua = `aws-sdk-rust/1.0.0 ua/2.1 os/other lang/rust api/codewhispererstreaming#1.28.3 m/E app/AmazonQ-For-CLI md/appVersion-1.28.3-${randomUUID().replaceAll("-", "")}`
+  return {
+    ...authHeaders(a),
+    "amz-sdk-invocation-id": randomUUID(),
+    "amz-sdk-request": "attempt=1; max=1",
+    "x-amz-user-agent": ua,
+    "User-Agent": ua,
+  }
+}
+
+function sendKiro(a, body, signal) {
   return fetch(runtime(a.region) + "/generateAssistantResponse", {
     method: "POST",
-    headers: {
-      ...authHeaders(a),
-      "Content-Type": "application/json",
-      Accept: "application/vnd.amazon.eventstream",
-      "x-amzn-codewhisperer-optout": "true",
-      "amz-sdk-invocation-id": randomUUID(),
-      "amz-sdk-request": "attempt=1; max=1",
-      "x-amzn-kiro-agent-mode": "vibe",
-      "x-amz-user-agent": ua,
-      "User-Agent": ua,
-    },
+    headers: { ...sdkHeaders(a), "x-amzn-codewhisperer-optout": "true", "x-amzn-kiro-agent-mode": "vibe",
+      "Content-Type": "application/json", Accept: "application/vnd.amazon.eventstream" },
     body,
     signal,
   })
@@ -1319,10 +1372,13 @@ function finished(content) {
 // Kiro read from its cache is unknown, not 0: the cache fields are left
 // out and magpie is told so (magpie_cache_unknown), so it shows no hit
 // rate rather than 0%.
-const anthropicUsage = (u) =>
-  u.reported
+const anthropicUsage = (u) => ({
+  ...(u.reported
     ? { input_tokens: u.input, output_tokens: u.output, cache_read_input_tokens: u.cacheRead, cache_creation_input_tokens: u.cacheWrite }
-    : { input_tokens: u.input, output_tokens: u.output, magpie_cache_unknown: true }
+    : { input_tokens: u.input, output_tokens: u.output, magpie_cache_unknown: true }),
+  // the hosted web searches made (searching)
+  ...(u.searches ? { server_tool_use: { web_search_requests: u.searches } } : {}),
+})
 
 // quotaWords are magpie's (internal/gateway/fallback.go): how a vendor says
 // "out of quota" or "slow down".
@@ -1355,11 +1411,16 @@ async function reply(it, model, stream, names = new Map()) {
         else add({ type: "thinking", thinking: e.text, signature: "" })
       } else if (e.kind === "sig") {
         if (last?.type === "thinking") last.signature += e.text
-      } else if (e.kind === "toolStart") add({ type: "tool_use", id: e.id, name: names.get(e.name) ?? e.name, input: "" })
+      } else if (e.kind === "serverTool") add({ type: "server_tool_use", id: e.id, name: e.name, input: e.input })
+      else if (e.kind === "searched") add({ type: "web_search_tool_result", tool_use_id: e.id, content: e.content })
+      else if (e.kind === "toolStart") add({ type: "tool_use", id: e.id, name: names.get(e.name) ?? e.name, input: "" })
       else if (e.kind === "toolArgs") {
         if (last?.type === "tool_use") last.input += e.text
       } else if (e.kind === "error") {
-        // with none of the answer said, a status; else what was said
+        // with none of the answer said, a status; else what was said. A
+        // turn after a web search that failed is a status even so: what
+        // was said is the searches, without the answer they were for
+        if (e.status) return errorResponse(e.status, e.text)
         if (!content.length) return failedBefore(e.text)
         return Response.json({ id, type: "message", role: "assistant", model, content: finished(content), stop_reason: "end_turn",
           stop_sequence: null, usage: anthropicUsage({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }) })
@@ -1421,6 +1482,15 @@ async function reply(it, model, stream, names = new Map()) {
         case "toolArgs":
           if (open === "tool") ctl.enqueue(sse("content_block_delta", { index, delta: { type: "input_json_delta", partial_json: e.text } }))
           break
+        case "serverTool":
+          begin("server", { type: "server_tool_use", id: e.id, name: e.name, input: {} })
+          ctl.enqueue(sse("content_block_delta", { index, delta: { type: "input_json_delta", partial_json: JSON.stringify(e.input) } }))
+          close()
+          break
+        case "searched":
+          begin("searched", { type: "web_search_tool_result", tool_use_id: e.id, content: e.content })
+          close()
+          break
         case "error":
           close()
           ctl.enqueue(sse("error", { error: { type: "api_error", message: e.text } }))
@@ -1439,6 +1509,222 @@ async function reply(it, model, stream, names = new Map()) {
   return new Response(body, { status: 200, headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache" } })
 }
 
+// ---- web search: Kiro's own, for Anthropic's hosted tool ----------------------------
+//
+// A request offering Anthropic's hosted web search ({type:
+// "web_search_20250305", name: "web_search"}) has it searched by Kiro's own
+// web search, as kiro-cli (2.35) searches: its runtime's InvokeMCP
+// operation (AWS JSON 1.0, x-amz-target
+// AmazonCodeWhispererStreamingService.InvokeMCP, POSTed to the runtime's
+// root) carrying a JSON-RPC tools/call of web_search, with the account's
+// token and profile. The model is offered kiro-cli's web_search tool; a call
+// it makes to it is searched here, the pages found go back to it as the
+// call's result and it is asked again, and the caller is answered with
+// server_tool_use and web_search_tool_result blocks and the answer, as
+// Anthropic answers. The caller's own tools are never run here.
+
+const SEARCH_TYPE = "web_search_20250305"
+const SEARCH_NAME = "web_search"
+const MCP_TARGET = "AmazonCodeWhispererStreamingService.InvokeMCP"
+const SEARCH_USES = 10 // searches one request may make at most, max_uses or not
+const SEARCH_QUERY = 200 // characters: what kiro-cli's web_search says its query takes
+const SEARCH_TIMEOUT = 30_000
+const SEARCH_BODY = 1 << 20 // bytes of a search's answer read at most
+const SEARCH_RESULTS = 20
+// PURPOSE is what kiro-cli's agent adds to every tool it offers: the model
+// says why it calls it. It isn't searched for, nor shown to the caller.
+const PURPOSE = "__tool_use_purpose"
+// kiro-cli's web_search, as its agent offers it (2.35's own strings)
+const SEARCH_SPEC = {
+  name: SEARCH_NAME,
+  description: "WebSearch looks up information that is outside the model's training data or cannot be reliably inferred from the current codebase/context.",
+  inputSchema: { json: { type: "object", properties: {
+    query: { type: "string", maxLength: SEARCH_QUERY, description: "Search query (max 200 chars) - use concise keywords, not full sentences" },
+    [PURPOSE]: { type: "string", description: "A brief explanation why you are making this tool use." },
+  }, required: ["query"] } },
+}
+
+// hostedSearch is the request's hosted web search, as it asks for it: the
+// tool, how many searches it allows, and the domains it keeps or drops.
+// null when it offers none; { error } when it asks for what can't be done.
+function hostedSearch(req) {
+  // magpie takes any tool whose type begins web_search for a web search and,
+  // as this provider searches (config: searches), passes it here rather
+  // than searching for it: one this can't search with is refused, not
+  // dropped, so a search asked for isn't silently gone
+  const searches = (req.tools ?? []).filter((t) => typeof t?.type === "string" && t.type.startsWith("web_search"))
+  const odd = searches.find((t) => t.type !== SEARCH_TYPE || t.name !== SEARCH_NAME)
+  if (odd) return { error: `the hosted web search on Kiro is {type: "${SEARCH_TYPE}", name: "${SEARCH_NAME}"}, not {type: ${JSON.stringify(odd.type)}, name: ${JSON.stringify(odd.name ?? null)}}; ` +
+    "set provider.kiro.searches to false to have magpie search for it" }
+  if (searches.length > 1) return { error: "web_search is offered more than once" }
+  const tool = searches[0]
+  if (!tool) return null
+  if ((req.tools ?? []).some((t) => t !== tool && toolName(t?.name ?? "") === SEARCH_NAME))
+    return { error: "two tools are named web_search: the hosted web search and another" }
+  // Kiro's search has no place for where the user is
+  if (tool.user_location) return { error: "web_search's user_location isn't supported on Kiro" }
+  const list = (v) => (Array.isArray(v) ? v.filter((d) => typeof d === "string" && d.trim()).map((d) => d.trim()) : [])
+  const allowed = list(tool.allowed_domains)
+  const blocked = list(tool.blocked_domains)
+  if (allowed.length && blocked.length) return { error: "web_search takes allowed_domains or blocked_domains, not both" }
+  // a max_uses given is a whole number of at least 1, as Anthropic's API
+  // takes it; none given is SEARCH_USES, and none is more
+  if (tool.max_uses != null && !(Number.isInteger(tool.max_uses) && tool.max_uses > 0))
+    return { error: "web_search's max_uses must be a whole number of at least 1" }
+  return { tool, uses: Math.min(tool.max_uses ?? SEARCH_USES, SEARCH_USES), allowed, blocked }
+}
+
+// a domain as Anthropic's allowed_domains and blocked_domains name one:
+// the host and its subdomains, and under a path when it gives one (a
+// host's case doesn't matter, a path's does)
+function inDomain(url, domain) {
+  const slash = domain.indexOf("/")
+  const host = (slash < 0 ? domain : domain.slice(0, slash)).replace(/^\*\./, "").toLowerCase()
+  const path = slash < 0 ? "" : domain.slice(slash)
+  const h = url.hostname.toLowerCase()
+  return (h === host || h.endsWith("." + host)) && (!path || url.pathname.startsWith(path))
+}
+
+// searched is what each search found, by its server_tool_use id, as the
+// model was given it: a conversation sent again with the result has its
+// snippets told the model again. Bounded; one not kept is told from the
+// result's titles and URLs.
+const searched = new Map()
+const SEARCHED_KEEP = 64
+const keepSearched = (id, text) => {
+  searched.set(id, text)
+  if (searched.size > SEARCHED_KEEP) searched.delete(searched.keys().next().value)
+}
+
+const SEARCH_ERRORS = {
+  invalid_tool_input: "the search query was missing or not text",
+  query_too_long: `the search query was longer than ${SEARCH_QUERY} characters`,
+  max_uses_exceeded: "no more searches are allowed for this request; answer with what was found",
+  too_many_requests: "the search service is rate limited",
+  unavailable: "the search service is unavailable",
+}
+const searchFailedText = (code) => "Web search failed: " + (SEARCH_ERRORS[code] ?? String(code ?? "unavailable"))
+
+// searchedText is a web_search_tool_result told as text, for the model;
+// null when it is an error.
+function searchedText(p) {
+  if (!Array.isArray(p?.content)) return null
+  const kept = searched.get(p.tool_use_id)
+  if (kept) return kept
+  if (!p.content.length) return "No results."
+  return p.content.filter((r) => r?.url).map((r, i) => `[${i + 1}] ${r.title || r.url}\nURL: ${r.url}` +
+    (r.page_age ? `\nPublished: ${r.page_age}` : "")).join("\n\n")
+}
+
+// secretless is a message with anything like a token taken out, and short.
+const secretless = (s) => String(s ?? "").replace(/Bearer\s+\S+/gi, "Bearer …").replace(/\b(ksk_|aoa|aor)[A-Za-z0-9._\-]{8,}/g, "…").slice(0, 200)
+
+// bounded reads at most limit bytes of a body: null past it.
+async function bounded(res, limit) {
+  if (!res.body) return ""
+  const reader = res.body.getReader()
+  const parts = []
+  let n = 0
+  for (;;) {
+    const { done, value } = await reader.read()
+    if (done) break
+    n += value.length
+    if (n > limit) {
+      await reader.cancel().catch(() => {})
+      return null
+    }
+    parts.push(value)
+  }
+  return new TextDecoder().decode(Buffer.concat(parts))
+}
+
+// webSearch searches with Kiro's web_search through InvokeMCP: { results }
+// (Anthropic's web_search_result blocks) and the text the model is given,
+// or { code } (a web_search_tool_result_error's error_code) and why, or
+// { status: 403 } for a token Kiro turned down. An abort is thrown. The
+// profile is InvokeMCPRequest's profileArn, which AWS JSON 1.0 sends in the
+// body: without it there Kiro answers 400 "profileArn is required for this
+// request", the x-amzn-kiro-profile-arn header (its httpHeader binding in
+// Kiro's REST model, sent too, as kiro-cli 2.35 sends it) notwithstanding.
+// An API key names no profile, as kiro-cli names none for one. The tool's
+// arguments are its query alone.
+async function webSearch(a, query, hosted, signal) {
+  const timeout = AbortSignal.timeout(SEARCH_TIMEOUT)
+  const both = signal ? AbortSignal.any([signal, timeout]) : timeout
+  const body = { jsonrpc: "2.0", id: "1", method: "tools/call", ...(a.profile ? { profileArn: a.profile } : {}),
+    params: { name: SEARCH_NAME, arguments: { query } } }
+  let res, text
+  try {
+    res = await fetch(runtime(a.region) + "/", { method: "POST", body: JSON.stringify(body), signal: both,
+      headers: { ...sdkHeaders(a), "amz-sdk-request": "attempt=1; max=3", "Content-Type": "application/x-amz-json-1.0",
+        "x-amz-target": MCP_TARGET, ...(a.profile ? { "x-amzn-kiro-profile-arn": a.profile } : {}) } })
+    if (res.status === 403) {
+      await res.body?.cancel().catch(() => {})
+      return { status: 403 }
+    }
+    text = await bounded(res, SEARCH_BODY)
+  } catch (e) {
+    if (signal?.aborted) throw e
+    return { code: "unavailable", why: timeout.aborted ? "the search timed out" : "the search service couldn't be reached: " + secretless(e?.message) }
+  }
+  if (!res.ok) return { code: res.status === 429 ? "too_many_requests" : "unavailable", why: `the search service answered ${res.status}` }
+  if (text === null) return { code: "unavailable", why: "the search's answer was too long" }
+  return searchAnswer(text, hosted)
+}
+
+// searchAnswer reads InvokeMCP's answer, { jsonrpc, id, result, error }: the
+// result is the tools/call's, its content a text block of the search's JSON.
+function searchAnswer(text, hosted) {
+  let m
+  try {
+    m = JSON.parse(text)
+  } catch {}
+  const bad = (why) => ({ code: "unavailable", why })
+  if (!m || typeof m !== "object") return bad("the search's answer wasn't JSON")
+  if (m.error) return bad("the search failed: " + secretless(m.error.message ?? m.error.code))
+  // a document, which may come as its JSON text
+  let result = m.result
+  if (typeof result === "string")
+    try {
+      result = JSON.parse(result)
+    } catch {}
+  const content = Array.isArray(result?.content) ? result.content : []
+  const out = content.find((c) => c?.type === "text" && typeof c.text === "string")
+  if (result?.isError) return bad("the search failed: " + secretless(out?.text))
+  let r
+  try {
+    r = JSON.parse(out?.text ?? "")
+  } catch {
+    return bad("the search's answer wasn't one it reads")
+  }
+  if (!r || typeof r !== "object" || !Array.isArray(r.results)) return bad("the search's answer had no results list")
+  if (r.error) return bad("the search failed: " + secretless(typeof r.error === "string" ? r.error : r.error.message))
+  const results = []
+  const lines = []
+  for (const h of r.results) {
+    let url
+    try {
+      url = new URL(String(h?.url ?? ""))
+    } catch {
+      continue
+    }
+    if (!/^https?:$/.test(url.protocol)) continue
+    // Kiro's search has no domain filter: what it found outside the domains
+    // asked for is left out
+    if (hosted.allowed.length && !hosted.allowed.some((d) => inDomain(url, d))) continue
+    if (hosted.blocked.some((d) => inDomain(url, d))) continue
+    const title = typeof h.title === "string" && h.title.trim() ? h.title.trim() : url.href
+    const age = typeof h.publishedDate === "string" && h.publishedDate ? h.publishedDate.slice(0, 64) : null
+    // encrypted_content is the searcher's sealed copy of the page: Kiro
+    // has none, and none is made up (as magpie's searchResultBlock)
+    results.push({ type: "web_search_result", title, url: url.href, encrypted_content: "", page_age: age })
+    const snippet = typeof h.snippet === "string" ? h.snippet.trim().slice(0, 2000) : ""
+    lines.push(`[${results.length}] ${title}\nURL: ${url.href}` + (age ? `\nPublished: ${age}` : "") + (snippet ? `\n${snippet}` : ""))
+    if (results.length >= SEARCH_RESULTS) break
+  }
+  return { results, text: lines.length ? lines.join("\n\n") : "No results." }
+}
+
 // generate answers a Messages request through Kiro's API: once more,
 // refreshed, when Kiro turns the token down (403). As the built-in: no
 // credentials is a 401, a failed refresh after the 403 a 502; none marks
@@ -1446,39 +1732,176 @@ async function reply(it, model, stream, names = new Map()) {
 async function generate(creds, auth, req, signal) {
   const model = String(req.model ?? "auto")
   const budget = thinking(req, model)
+  const hosted = hostedSearch(req)
+  if (hosted?.error) return errorResponse(400, hosted.error)
+  const first = await ask(creds, auth, req, model, budget, signal)
+  if (!first.res) return errorResponse(first.status, first.message)
+  const it = hosted ? searching(creds, auth, req, model, budget, signal, hosted, first) : events(first.res.body, model, budget)
+  return kept(await reply(it, model, req.stream === true, toolNames(req)))
+}
+
+// ask sends one turn to Kiro: { res, a }, a 200, or the { status, message }
+// of a failure.
+async function ask(creds, auth, req, model, budget, signal) {
   let a
   try {
     a = await creds(auth)
   } catch (e) {
-    return errorResponse(401, e.message)
+    return { status: 401, message: e.message }
   }
   let res
   try {
     res = await sendKiro(a, await kiroBody(req, model, a.profile, budget), signal)
   } catch (e) {
     if (e?.name === "AbortError") throw e
-    return errorResponse(502, e.message)
+    return { status: 502, message: e.message }
   }
   if (res.status === 403) {
     await res.body?.cancel()
     try {
       a = await creds(auth, true)
     } catch (e) {
-      return errorResponse(502, e.message)
+      return { status: 502, message: e.message }
     }
     try {
       res = await sendKiro(a, await kiroBody(req, model, a.profile, budget), signal)
     } catch (e) {
       if (e?.name === "AbortError") throw e
-      return errorResponse(502, e.message)
+      return { status: 502, message: e.message }
     }
   }
   if (!res.ok) {
     // Kiro's own 401 is passed on, as the built-in did, the sign-in kept
-    const f = failure(res.status, (await res.text()).slice(0, 1 << 20))
-    return errorResponse(f.status, f.message)
+    return failure(res.status, (await res.text()).slice(0, 1 << 20))
+  }
+  return { res, a }
+}
+
+const aborted = () => Object.assign(new Error("the request was cancelled"), { name: "AbortError" })
+
+// searching is events for a request offering the hosted web search, over
+// as many turns as its searches take: a call the model makes to it is
+// searched rather than passed on (serverTool, searched), and Kiro is asked
+// again with what was found, until it answers, calls a tool of the
+// caller's (passed on as ever, the searches of its turn with it), or has
+// taken hosted.uses + 2 turns (pause_turn, which the caller may send back
+// to go on). Searches past hosted.uses are max_uses_exceeded.
+async function* searching(creds, auth, req, model, budget, signal, hosted, first) {
+  let { res, a } = first
+  const messages = [...(req.messages ?? [])]
+  const usage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reported: false, searches: 0 }
+  let refreshed = false
+  for (let turn = 1; ; turn++) {
+    const said = [] // this turn's blocks, for the next turn's history
+    const calls = [] // its searches
+    let client = false
+    let current = null
+    let stop = null
+    for await (const e of events(res.body, model, budget)) {
+      if (e.kind === "toolStart") {
+        current = e.name === SEARCH_NAME ? { args: "" } : null
+        if (current) calls.push(current)
+        else {
+          client = true
+          said.push({ type: "tool_use", id: e.id, name: e.name, input: "" })
+          yield e
+        }
+      } else if (e.kind === "toolArgs") {
+        if (current) current.args += e.text
+        else {
+          const b = said.at(-1)
+          if (b?.type === "tool_use") b.input += e.text
+          yield e
+        }
+      } else if (e.kind === "stop") stop = e
+      else {
+        if (e.kind === "text") {
+          const b = said.at(-1)
+          if (b?.type === "text") b.text += e.text
+          else said.push({ type: "text", text: e.text })
+        }
+        if (e.kind === "error") {
+          // in a turn after a search, a status, not a finished answer (reply)
+          yield turn > 1 ? { ...e, status: 502 } : e
+          return
+        }
+        yield e
+      }
+    }
+    if (signal?.aborted) throw aborted()
+    if (!stop) return
+    usage.input += stop.usage.input
+    usage.output += stop.usage.output
+    usage.cacheRead += stop.usage.cacheRead
+    usage.cacheWrite += stop.usage.cacheWrite
+    usage.reported ||= stop.usage.reported
+    for (const b of said)
+      if (b.type === "tool_use")
+        try {
+          b.input = b.input ? JSON.parse(b.input) : {}
+        } catch {
+          b.input = {}
+        }
+    if (!calls.length) {
+      yield { ...stop, usage }
+      return
+    }
+    for (const c of calls) {
+      const id = "srvtoolu_" + randomBytes(12).toString("hex")
+      let input = {}
+      try {
+        const v = c.args ? JSON.parse(c.args) : {}
+        if (v && typeof v === "object" && !Array.isArray(v)) input = v
+      } catch {}
+      // why the model searched (PURPOSE) is kiro-cli's, not Anthropic's: the
+      // caller sees the query alone, and only it is searched for
+      const { [PURPOSE]: _why, ...shown } = input
+      input = shown
+      yield { kind: "serverTool", id, name: SEARCH_NAME, input }
+      const query = typeof input.query === "string" ? input.query.trim() : ""
+      let found
+      if (!query) found = { code: "invalid_tool_input" }
+      else if (query.length > SEARCH_QUERY) found = { code: "query_too_long" }
+      else if (usage.searches >= hosted.uses) found = { code: "max_uses_exceeded" }
+      else {
+        usage.searches++
+        found = await webSearch(a, query, hosted, signal)
+        // a token Kiro turned down is refreshed once for the request, as a
+        // turn's is
+        if (found.status === 403 && !refreshed) {
+          refreshed = true
+          try {
+            a = await creds(auth, true)
+            found = await webSearch(a, query, hosted, signal)
+          } catch (e) {
+            if (e?.name === "AbortError" || signal?.aborted) throw e
+            found = { code: "unavailable", why: secretless(e?.message) }
+          }
+        }
+        if (found.status === 403) found = { code: "unavailable", why: "Kiro turned down the token for its web search (403)" }
+      }
+      const content = found.results ?? { type: "web_search_tool_result_error", error_code: found.code }
+      keepSearched(id, found.results ? found.text : searchFailedText(found.code) + (found.why ? ` (${found.why})` : ""))
+      yield { kind: "searched", id, content }
+      said.push({ type: "server_tool_use", id, name: SEARCH_NAME, input }, { type: "web_search_tool_result", tool_use_id: id, content })
+    }
+    if (signal?.aborted) throw aborted()
+    if (client) {
+      yield { kind: "stop", reason: "tool_use", usage }
+      return
+    }
+    if (turn >= hosted.uses + 2) {
+      yield { kind: "stop", reason: "pause_turn", usage }
+      return
+    }
+    messages.push({ role: "assistant", content: said })
+    const next = await ask(creds, auth, { ...req, messages }, model, budget, signal)
+    if (!next.res) {
+      yield { kind: "error", status: next.status, text: `Kiro, after its web search: ${next.message} (${next.status})` }
+      return
+    }
+    ;({ res, a } = next)
   }
-  return kept(await reply(events(res.body, model, budget), model, req.stream === true, toolNames(req)))
 }
 
 // ---- signing in ----------------------------------------------------------------------
@@ -1727,6 +2150,10 @@ export async function KiroAuthPlugin({ client } = {}) {
         name: "Kiro",
         npm: MESSAGES,
         api: BASE,
+        // magpie's own field (#2027): Kiro answers Anthropic's hosted web
+        // search itself (searching), so magpie passes a client's on as sent
+        // rather than searching for it. The user's own setting goes over it.
+        searches: true,
         ...was,
         models: { ...Object.fromEntries(MODELS.map((m) => [m.id, configModel(m)])), ...(was.models ?? {}) },
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",