@magpie-community/opencode-kiro-auth 0.1.20 → 0.1.22

package/README.md

@@ -6,6 +6,23 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
 
 ## Signing in
 
+Choose a sign-in method before opening the browser:
+
+- **AWS Builder ID** opens AWS directly for a personal account.
+- **IAM Identity Center (organization Start URL)** asks for the organization's
+  HTTPS Start URL and AWS region (blank defaults to `us-east-1`), then opens
+  that organization's AWS sign-in directly. Use the region of the directory.
+- **Kiro sign-in page** retains the portal for Google, GitHub and other Kiro
+  sign-in methods. Callers without prompt inputs retain this behavior.
+
+The two direct AWS options skip the portal's first loopback callback. When
+Magpie runs remotely or in Docker, sign in and authorize, then paste the
+complete final `http://127.0.0.1:<port>/oauth/callback?...` address into Magpie's
+Callback URL field. The page need not load on the browser's computer. Local
+browsers that can reach the plugin's listener finish automatically. Direct
+AWS sign-in still uses authorization code + PKCE, not device authorization.
+
+
 - **Kiro (Google, GitHub, AWS Builder ID, IAM Identity Center)**: the Kiro
   IDE's own sign-in.
   - Kiro's page (`app.kiro.dev/signin`) sends the browser back to one of
@@ -91,6 +108,10 @@ request:
   profile ARN names.
 - It turns the request into a Kiro conversation:
   - The system prompt goes at the head of the first message.
+  - System messages that end the conversation (Claude Code's environment
+    context) are sent as a turn before the question, answered by Kiro IDE's
+    "Understood.", so the question is the message answered (#538). After
+    tool results they stay with them.
   - Tool calls and results are paired: an unanswered call gets an error
     result, and a result longer than 250,000 characters is cut.
   - Tool ids Kiro wouldn't take are rewritten. A tool name over 64
@@ -119,6 +140,11 @@ request:
   the prompt, with a budget: low 10k, medium 20k, high 30k, xhigh and max
   50k (as magpie's built-in Kiro: #120). The
   `<thinking>` block of the reply comes back as thinking.
+  A model whose Kiro catalog lists effort levels with adaptive thinking
+  (`additionalModelRequestFieldsSchema`) is sent the level instead, as Kiro
+  IDE sends it: `additionalModelRequestFields` with `thinking.type:
+  "adaptive"` and `output_config.effort` (or `reasoning.effort`), and no
+  budget. So xhigh and max stay apart there (#538).
 - Anthropic's hosted web search is answered with Kiro's own web search
   (see [Web search](#web-search)).
 - Kiro's failures keep their meaning:

package/index.mjs

@@ -574,6 +574,24 @@ function account(client) {
 // ---- models ----------------------------------------------------------------------
 
 const windows = new Map() // a model's context, as Kiro last listed it
+const natives = new Map() // a model's effort levels sent as fields, as Kiro last listed them (nativeOf)
+
+// nativeOf is what a model's additionalModelRequestFieldsSchema in Kiro's
+// list offers, read as Kiro IDE reads it: the effort levels in the enum of
+// output_config's (or reasoning's) effort, and whether thinking.type may be
+// "adaptive". A model offering both is sent the caller's effort in
+// additionalModelRequestFields, as the IDE sends it; any other keeps the
+// <max_thinking_length> budget (#538).
+function nativeOf(s) {
+  if (!s || typeof s !== "object" || Array.isArray(s)) return undefined
+  const types = s.properties?.thinking?.properties?.type?.enum
+  if (!Array.isArray(types) || !types.includes("adaptive")) return undefined
+  for (const path of ["output_config", "reasoning"]) {
+    const levels = s.properties?.[path]?.properties?.effort?.enum
+    if (Array.isArray(levels) && levels.length) return { path, levels }
+  }
+  return undefined
+}
 
 const thinks = (id) => /claude/i.test(id) || id === "auto"
 // the levels a thinking model offers, as the built-in thinks them (xhigh as
@@ -653,6 +671,7 @@ async function listModels(a) {
   }
   if (!list.length) throw new Error("Kiro listed no models")
   for (const m of list) windows.set(m.id, m.context)
+  for (const m of out?.models ?? []) if (m?.modelId) natives.set(m.modelId, nativeOf(m.additionalModelRequestFieldsSchema))
   return list
 }
 
@@ -834,6 +853,17 @@ function thinking(req, model) {
   return 20000
 }
 
+// nativeFields is the additionalModelRequestFields a thinking request is
+// sent with when Kiro's list says the model takes its effort as a field:
+// adaptive thinking at the caller's level, so xhigh and max reach the model
+// as two levels rather than one 50000 budget (#538). undefined otherwise.
+function nativeFields(req, model) {
+  const n = natives.get(model)
+  const effort = req.output_config?.effort
+  if (!n || typeof effort !== "string" || !n.levels.includes(effort) || !thinking(req, model)) return undefined
+  return { thinking: { type: "adaptive" }, [n.path]: { effort } }
+}
+
 // formatText is the structured output a request asks for, said in words:
 // Anthropic's output_config.format (or the AI SDK's output_format) with a
 // JSON schema, "" when it asks for none. A JSON object with no schema
@@ -872,6 +902,34 @@ async function kiroBody(req, model, profile, budget) {
   return JSON.stringify(await fitImages(kiroRequest(req, model, profile, budget)))
 }
 
+// UNDERSTOOD is the reply Kiro IDE puts in its history where a turn has
+// none of its own, before the message being answered
+const UNDERSTOOD = "Understood."
+
+// contextFirst is a conversation that ends in system messages (Claude
+// Code's environment context, sent after the user's question) with that
+// context said first: a turn of its own, answered by Kiro IDE's
+// placeholder, before the question, which stays the message being
+// answered rather than the head of "question, then context" (#538). The
+// instructions' own field isn't used: Kiro refuses it ("systemPrompt field
+// is not enabled for this user"). A question carrying tool results, or
+// following tool calls, keeps the context in it as before, so no call is
+// parted from its result.
+function contextFirst(messages) {
+  let end = messages.length
+  while (end > 0 && messages[end - 1]?.role === "system") end--
+  if (end === messages.length) return messages
+  let start = end
+  while (start > 0 && messages[start - 1]?.role === "user") start--
+  const parts = (m) => (typeof m?.content === "string" ? [{ type: "text", text: m.content }] : Array.isArray(m?.content) ? m.content : [])
+  const context = messages.slice(end)
+  if (start === end || !context.some((m) => parts(m).some((p) => p?.type !== "text" || p.text))) return messages
+  const turn = messages.slice(start, end)
+  if (turn.some((m) => parts(m).some((p) => p?.type === "tool_result"))) return messages
+  if (parts(messages[start - 1]).some((p) => p?.type === "tool_use" || p?.type === "server_tool_use" || p?.type === "web_search_tool_result")) return messages
+  return [...messages.slice(0, start), ...context.map((m) => ({ ...m, role: "user" })), { role: "assistant", content: UNDERSTOOD }, ...turn]
+}
+
 function kiroRequest(req, model, profile, budget) {
   const entries = []
   // the messages the caller marked for its prompt cache (cache_control),
@@ -882,7 +940,7 @@ function kiroRequest(req, model, profile, budget) {
   }
   const user = () => ({ content: "", modelId: model, origin: "KIRO_CLI" })
   const resultsOnly = new WeakSet() // the messages made to carry a reply's web search results
-  for (const m of req.messages ?? []) {
+  for (const m of contextFirst(req.messages ?? [])) {
     const parts = typeof m.content === "string" ? [{ type: "text", text: m.content }] : m.content ?? []
     const texts = []
     if (m.role === "assistant") {
@@ -1013,7 +1071,9 @@ function kiroRequest(req, model, profile, budget) {
   // end of the instructions, as magpie's built-in tells it (inSystem)
   const format = formatText(req)
   if (format) system = system ? system + "\n\n" + format : format
-  if (budget) system = `<thinking_mode>enabled</thinking_mode><max_thinking_length>${budget}</max_thinking_length>` + (system ? "\n" + system : "")
+  // a level Kiro takes as a field is sent as one, not also as a budget
+  const native = budget ? nativeFields(req, model) : undefined
+  if (budget && !native) system = `<thinking_mode>enabled</thinking_mode><max_thinking_length>${budget}</max_thinking_length>` + (system ? "\n" + system : "")
   if (system) entries[0].userInputMessage.content = system + "\n\n" + entries[0].userInputMessage.content
   if (Array.isArray(req.system)) mark(entries[0].userInputMessage, req.system)
 
@@ -1063,6 +1123,7 @@ function kiroRequest(req, model, profile, budget) {
   if (entries.length > 1) state.history = entries.slice(0, -1)
   const out = { conversationState: state, agentMode: "vibe" }
   if (profile) out.profileArn = profile
+  if (native) out.additionalModelRequestFields = native
   return out
 }
 
@@ -1936,6 +1997,20 @@ async function signInPost(url, body) {
 
 const expiry = (s) => Date.now() + (s > 0 ? s : 3600) * 1000
 
+// what Kiro's page says of where to sign in at AWS, taken only in its shape:
+// the region goes into AWS's host names
+const AWS_REGION = /^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/
+// the ways Kiro's page comes back with a choice of
+const KIRO_WAYS = ["google", "github", "builderid", "awsidc", "internal", "external_idp"]
+function httpsURL(s) {
+  try {
+    const u = new URL(s)
+    return u.protocol === "https:" && !u.username && !u.password
+  } catch {
+    return false
+  }
+}
+
 // whoIs names a new sign-in with the email Kiro has for it, and its plan.
 async function whoIs(c) {
   try {
@@ -1960,8 +2035,21 @@ async function listen() {
   throw new Error("the ports Kiro's sign-in comes back to are all busy; close the Kiro IDE's sign-in and try again")
 }
 
+// signingIn ends the browser sign-in under way, if any, and frees its
+// port: magpie keeps one sign-in of a provider at a time, and one left
+// behind (a tab closed, a paste never made) kept its port till it timed
+// out, so a few of them left no port for the next
+let signingIn = null
+
 // browserSignIn is the IDE's: Kiro's sign-in page, back to a port here.
-async function browserSignIn() {
+async function browserSignIn(inputs = {}) {
+  const choice = inputs.loginMethod || "portal"
+  if (!["portal", "builderid", "enterprise"].includes(choice)) throw new Error("unknown Kiro sign-in method")
+  const issuer = choice === "enterprise" ? String(inputs.startUrl || "").trim() : BUILDER_ID_START
+  const region = String(inputs.region || "us-east-1").trim()
+  if (choice === "enterprise" && !httpsURL(issuer)) throw new Error("Enter the organization's HTTPS Start URL")
+  if (choice !== "portal" && !AWS_REGION.test(region)) throw new Error("Enter a valid AWS region")
+  signingIn?.()
   const { server, port } = await listen()
   const state = randomBytes(24).toString("base64url")
   const verifier = randomBytes(48).toString("base64url")
@@ -1977,7 +2065,39 @@ async function browserSignIn() {
     settle(result)
   }
 
+  // A sign-in comes back here once (Google, GitHub), or twice (Builder ID,
+  // Identity Center: Kiro's page, then AWS's). The browser may be on
+  // another computer (magpie on a server or in Docker): the address its
+  // tab ended on is pasted there, and magpie opens it here, on this port
+  // (magpie's pluginsignin_paste.go), following a 302 to AWS as the next
+  // page. So each stage answers only its own state, once, and a request
+  // that isn't this sign-in's is a 404, which magpie says is the wrong
+  // address at once instead of waiting.
+  let stage = "portal" // then "aws", then "over"
+  let busy = false // a code being traded: a second paste of it waits for the first
+  let onToAWS = "" // the page the portal stage sent the browser on to, said again to a repeat
+  let portalAsked = "" // what that stage was asked, so a repeat asking otherwise isn't taken
+  async function startAWS(opt, issuer, region) {
+    const reg = await signInPost(oidc(region) + "/client/register", { clientName: "Kiro IDE", clientType: "public", scopes: SCOPES,
+      grantTypes: ["authorization_code", "refresh_token"], redirectUris: ["http://127.0.0.1/oauth/callback"], issuerUrl: issuer })
+    if (stage === "over") throw new Error("this sign-in was cancelled")
+    if (!reg.clientId) throw new Error("AWS registered no client")
+    Object.assign(aws, { region, clientId: reg.clientId, clientSecret: reg.clientSecret,
+      provider: { builderid: "BuilderId", awsidc: "Enterprise", internal: "Internal" }[opt],
+      state: randomBytes(24).toString("base64url"), verifier: randomBytes(48).toString("base64url") })
+    const a = new URLSearchParams({ response_type: "code", client_id: aws.clientId, redirect_uri: awsRedirect, scopes: SCOPES.join(","),
+      state: aws.state, code_challenge: createHash("sha256").update(aws.verifier).digest("base64url"), code_challenge_method: "S256" })
+    onToAWS = `${oidc(region)}/authorize?${a}`
+    portalAsked = JSON.stringify([opt, issuer, region])
+    stage = "aws"
+    busy = false
+    return onToAWS
+  }
+
   server.on("request", async (req, res) => {
+    // each answer its own connection: none held open keeps the port once
+    // the sign-in is over
+    res.setHeader("Connection", "close")
     const url = new URL(req.url ?? "/", redirect)
     const html = (code, body) => {
       res.writeHead(code, { "Content-Type": "text/html; charset=utf-8" })
@@ -1985,57 +2105,88 @@ async function browserSignIn() {
     }
     if (url.pathname !== "/oauth/callback" && url.pathname !== "/signin/callback") return res.writeHead(404).end()
     const q = url.searchParams
-    if (!waiting) return html(200, page(false, "This sign-in is over", "Start it again."))
+    const over = () => html(404, page(false, "This sign-in is over", "Start it again."))
+    const notOurs = () => html(404, page(false, "This link isn't from this sign-in", "Paste the address of the tab this sign-in opened, or start it again."))
+    if (stage === "over") return over()
     const fail = (msg) => {
+      stage = "over"
       finish({ type: "failed", error: msg })
       html(200, page(false, "Sign-in didn't finish", msg))
     }
+    const got = q.get("state") ?? ""
+    const portal = got === state
+    const fromAWS = stage === "aws" && !!aws.state && got === aws.state
+    // a stale tab, another sign-in's, or a page that just sends a request
+    // here: it says nothing about this one, and can't end it
+    if (!portal && !fromAWS) return notOurs()
+    if (busy) return html(409, page(false, "Already finishing", "This sign-in is finishing with this address already."))
     if (q.get("error")) return fail(q.get("error_description") || q.get("error"))
     let c
     try {
-      if (aws.state && q.get("state") === aws.state) {
-        // back from AWS
+      if (fromAWS) {
+        // back from AWS, to the address it was sent with
+        if (url.pathname !== "/oauth/callback") return notOurs()
         if (!q.get("code")) return fail("AWS sent back no code")
+        busy = true
         const t = await signInPost(oidc(aws.region) + "/token", { clientId: aws.clientId, clientSecret: aws.clientSecret,
           grantType: "authorization_code", redirectUri: awsRedirect, code: q.get("code"), codeVerifier: aws.verifier })
         if (!t.accessToken) throw new Error("AWS sent back no token")
         c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: expiry(t.expiresIn), method: "idc", loginProvider: aws.provider,
           region: aws.region, clientId: aws.clientId, clientSecret: aws.clientSecret, profile: "", builderID: isBuilderID(aws.provider) }
-      } else if (q.get("state") !== state) {
-        // not ours: someone else's page, or a stale tab
-        return html(200, page(false, "This link isn't from this sign-in", "Start it again."))
       } else {
         const opt = q.get("login_option") ?? ""
+        const asked = JSON.stringify([opt, q.get("issuer_url"), q.get("idc_region")])
+        if (stage === "aws") {
+          // Kiro's page's address again (pasted twice, or reloaded): the
+          // same AWS page, not a second client and state, which would
+          // leave the first AWS tab's code refused
+          if (onToAWS && asked === portalAsked) {
+            res.writeHead(302, { Location: onToAWS })
+            return res.end()
+          }
+          // chosen again on Kiro's page (Back, then another way): that
+          // choice now, the AWS sign-in left behind dropped. Anything else
+          // with Kiro's page's state isn't a choice, and leaves AWS's going
+          if (!KIRO_WAYS.includes(opt)) return notOurs()
+          stage = "portal"
+          onToAWS = portalAsked = ""
+          for (const k of Object.keys(aws)) delete aws[k]
+        }
         if (opt === "google" || opt === "github") {
+          if (!q.get("code")) return fail("Kiro's page sent back no code")
+          busy = true
           const t = await signInPost(AUTH_SERVICE + "/oauth/token", { code: q.get("code"), code_verifier: verifier,
             redirect_uri: redirect + url.pathname + "?login_option=" + opt })
           if (!t.accessToken) throw new Error("Kiro sent back no token")
           c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: expiry(t.expiresIn), method: "social",
             loginProvider: opt === "google" ? "Google" : "Github", region: "us-east-1", profile: t.profileArn ?? "" }
         } else if (opt === "builderid" || opt === "awsidc" || opt === "internal") {
-          // on to AWS, with a client registered for this sign-in
+          // on to AWS, with a client registered for this sign-in. The region
+          // goes into AWS's host name, so it is only a region's shape
           const issuer = q.get("issuer_url")
           const region = q.get("idc_region")
           if (!issuer || !region) return fail("Kiro's page didn't say where to sign in at AWS")
-          const reg = await signInPost(oidc(region) + "/client/register", { clientName: "Kiro IDE", clientType: "public", scopes: SCOPES,
-            grantTypes: ["authorization_code", "refresh_token"], redirectUris: ["http://127.0.0.1/oauth/callback"], issuerUrl: issuer })
-          if (!reg.clientId) throw new Error("AWS registered no client")
-          Object.assign(aws, { region, clientId: reg.clientId, clientSecret: reg.clientSecret,
-            provider: { builderid: "BuilderId", awsidc: "Enterprise", internal: "Internal" }[opt],
-            state: randomBytes(24).toString("base64url"), verifier: randomBytes(48).toString("base64url") })
-          const a = new URLSearchParams({ response_type: "code", client_id: aws.clientId, redirect_uri: awsRedirect, scopes: SCOPES.join(","),
-            state: aws.state, code_challenge: createHash("sha256").update(aws.verifier).digest("base64url"), code_challenge_method: "S256" })
-          res.writeHead(302, { Location: `${oidc(region)}/authorize?${a}` })
+          if (!AWS_REGION.test(region)) return fail("Kiro's page named a region AWS doesn't have")
+          if (!httpsURL(issuer)) return fail("Kiro's page named an AWS sign-in that isn't an https address")
+          busy = true
+          await startAWS(opt, issuer, region)
+          res.writeHead(302, { Location: onToAWS })
           return res.end()
         } else if (opt === "external_idp") {
           return fail("A company's own identity provider can't be signed in to here yet; sign in with `kiro-cli login`, and use Kiro CLI's sign-in")
         } else return fail(`Kiro's page came back with a sign-in this plugin doesn't know (${JSON.stringify(opt)})`)
       }
     } catch (e) {
+      if (stage === "over") return over()
+      busy = false
       return fail(e.message)
     }
+    if (stage === "over") return over() // ended (a new sign-in, the time) while the code was traded
+    // still busy while it is named: a second paste is told it is finishing
     const who = await whoIs(c)
+    if (stage === "over") return over()
     const user = who.email ? nameOf(who.email, c.loginProvider) : "Kiro account"
+    stage = "over"
     finish({ type: "success", provider: ID, refresh: c.refresh, access: c.access, expires: c.expires, accountId: user,
       ...(uidOf(c.loginProvider) ? { uid: uidOf(c.loginProvider) } : {}),
       method: c.method, loginProvider: c.loginProvider, region: c.region, profileArn: who.profile,
@@ -2043,11 +2194,43 @@ async function browserSignIn() {
     html(200, page(true, "You're signed in", `${user} is signed in. You can close this tab.`))
   })
 
-  const timer = setTimeout(() => finish({ type: "failed", error: "the sign-in timed out" }), SIGN_IN_TIMEOUT)
+  const timer = setTimeout(() => {
+    stage = "over"
+    finish({ type: "failed", error: "the sign-in timed out" })
+  }, SIGN_IN_TIMEOUT)
+  const end = () => {
+    if (signingIn === superseded) signingIn = null
+    server.close()
+  }
+  // a new sign-in ends this one, or, over, frees its port at once
+  const superseded = () => {
+    stage = "over"
+    finish({ type: "failed", error: "another sign-in to Kiro was started" })
+    end()
+  }
+  signingIn?.() // one started while this one found its port
+  signingIn = superseded
   done.then(() => {
     clearTimeout(timer)
-    setTimeout(() => server.close(), 10_000).unref?.()
+    // a late address (pasted again, a tab reloaded) is told it is over a while
+    setTimeout(end, 10_000).unref?.()
   })
+  if (choice === "builderid" || choice === "enterprise") {
+    try {
+      const url = await startAWS(choice === "enterprise" ? "awsidc" : "builderid", issuer, region)
+      return {
+        url,
+        instructions: "Complete AWS sign-in. If magpie runs on another computer, paste the complete address of the final localhost page back here.",
+        method: "auto",
+        callback: () => done,
+      }
+    } catch (error) {
+      stage = "over"
+      finish({ type: "failed", error: error.message })
+      end()
+      throw error
+    }
+  }
   const challenge = createHash("sha256").update(verifier).digest("base64url")
   const q = new URLSearchParams({ state, code_challenge: challenge, code_challenge_method: "S256", redirect_uri: redirect, redirect_from: "KiroIDE" })
   return {
@@ -2138,7 +2321,19 @@ export async function KiroAuthPlugin({ client } = {}) {
         }
       },
       methods: [
-        { type: "oauth", label: "Kiro (Google, GitHub, AWS Builder ID, IAM Identity Center)", authorize: browserSignIn },
+        { type: "oauth", label: "Kiro (Google, GitHub, AWS Builder ID, IAM Identity Center)",
+          prompts: [{ type: "select", key: "loginMethod", message: "Choose a sign-in method", options: [
+            { label: "IAM Identity Center (organization Start URL)", value: "enterprise", hint: "Sign in to your organization with its AWS Start URL" },
+            { label: "AWS Builder ID", value: "builderid", hint: "Open AWS sign-in directly; one callback to paste on a remote server" },
+            { label: "Kiro sign-in page", value: "portal", hint: "Google, GitHub, IAM Identity Center or other Kiro sign-in methods" },
+          ] },
+          { type: "text", key: "startUrl", message: "Organization Start URL", placeholder: "https://d-xxxxxxxxxx.awsapps.com/start",
+            condition: (inputs) => inputs.loginMethod === "enterprise",
+            validate: (value) => httpsURL(String(value || "").trim()) ? undefined : "Enter an HTTPS Start URL" },
+          { type: "text", key: "region", message: "AWS region (blank uses us-east-1)", placeholder: "us-east-1",
+            condition: (inputs) => inputs.loginMethod === "enterprise",
+            validate: (value) => !value || AWS_REGION.test(value.trim()) ? undefined : "Enter a valid AWS region" },
+          ], authorize: browserSignIn },
         { type: "oauth", label: "Kiro CLI's or Kiro IDE's sign-in", authorize: ownSignIn },
         { type: "api", label: "Kiro API key (ksk_…)" },
       ],
@@ -2175,4 +2370,4 @@ export async function KiroAuthPlugin({ client } = {}) {
 }
 
 // for tests
-export const _internal = { generate, refresh, usageOf, buildKiro, kiroBody, IMAGE_LIMIT, events, reply, failure, toolID, toolName, toolNames, thinking, configModel, runtimeModel, readCLI, readIDE, regionOf, planName, frames }
+export const _internal = { generate, refresh, usageOf, buildKiro, kiroBody, IMAGE_LIMIT, events, reply, failure, toolID, toolName, toolNames, thinking, nativeFields, listModels, contextFirst, configModel, runtimeModel, readCLI, readIDE, regionOf, planName, frames }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",