@magpie-community/opencode-kiro-auth 0.1.4 → 0.1.6

package/README.md

@@ -39,8 +39,23 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
 A browser sign-in is kept where OpenCode keeps sign-ins (`auth.json`; in
 magpie, `plugin-auth.json`) as an `oauth` entry. The entry holds the
 tokens, the profile ARN, the region and, for AWS, the registered client.
-Tokens are refreshed 2 minutes before they expire, and also when Kiro
-turns one down (a 403, after which the request is tried once more):
+Refreshing such a sign-in:
+
+- magpie renews the token 10 minutes before it expires, through the
+  plugin's `auth.refresh`, once for the account and before its requests,
+  models and usage need it. magpie saves the new token. A failed renewal,
+  even one Kiro refused, doesn't mark the account: it is tried again.
+- OpenCode doesn't call that hook: there the token is refreshed 2 minutes
+  before it expires, before a request, and saved.
+- Either way, a token Kiro turns down (a 403) is refreshed and the request
+  tried once more.
+- Only one refresh runs at a time, magpie's renewal included, and a token
+  refreshed but not yet saved is used rather than spending the old refresh
+  token again.
+- kiro-cli's and the IDE's sign-ins aren't renewed by magpie: they are
+  refreshed before a request, as above, and written back.
+
+Tokens are refreshed through:
 
 - Google/GitHub: through `prod.<region>.auth.desktop.kiro.dev/refreshToken`.
 - Builder ID/Identity Center: through AWS's `oidc.<region>.amazonaws.com/token`.

package/index.mjs

@@ -188,13 +188,18 @@ async function saveBack(c) {
 
 // ---- tokens --------------------------------------------------------------------
 
+// EXPIRED is the built-in's words for a sign-in Kiro refused, or one with
+// nothing to refresh it.
 const EXPIRED = "Kiro's sign-in has expired; sign in again"
+const EXPIRED_CLI = EXPIRED + " with `kiro-cli login` or the Kiro IDE"
 
 // gone is an error saying the sign-in itself is gone — refused, or never
-// there — which alone answers a request with the 401 magpie marks the
-// account lapsed on; a refresh that timed out or met a 5xx may pass.
+// there. The built-in marked no Kiro account lapsed, not even then, nor
+// cleared one: every answer and usage read says the account is kept.
 const gone = (msg) => Object.assign(new Error(msg), { gone: true })
-const fresh = (c) => c.method === "apikey" || !c.expires || c.expires - Date.now() > 2 * 60 * 1000
+const EARLY_MS = 2 * 60 * 1000 // a token this close to its end is refreshed before a request
+const LEAD_MS = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
+const fresh = (c, early = EARLY_MS) => c.method === "apikey" || !c.expires || c.expires - Date.now() > early
 
 async function post(url, contentType, body, headers = {}) {
   let res
@@ -206,8 +211,8 @@ async function post(url, contentType, body, headers = {}) {
   }
   const text = await res.text()
   if (!res.ok) {
-    if ([400, 401, 403].includes(res.status)) throw gone(EXPIRED)
-    throw new Error(`refreshing Kiro's sign-in: ${res.status}`)
+    if ([400, 401, 403].includes(res.status)) throw gone(EXPIRED_CLI)
+    throw new Error(`refreshing Kiro's sign-in: ${res.status} ${STATUS_TEXT[res.status] ?? ""}`.trimEnd()) // Go's res.Status
   }
   return JSON.parse(text)
 }
@@ -223,7 +228,7 @@ async function refresh(c) {
       if (n && n.dbKey === c.dbKey && n.access !== c.access && fresh(n)) return n
     }
   }
-  if (!c.refresh) throw gone(EXPIRED)
+  if (!c.refresh) throw gone(EXPIRED_CLI)
   let out
   switch (c.method) {
     case "social": {
@@ -246,9 +251,9 @@ async function refresh(c) {
       break
     }
     default:
-      throw gone(EXPIRED)
+      throw gone("Kiro's sign-in has expired")
   }
-  if (!out.access) throw gone(EXPIRED)
+  if (!out.access) throw gone(EXPIRED_CLI)
   const n = { ...c, access: out.access, expires: Date.now() + (out.expiresIn > 0 ? out.expiresIn : 3600) * 1000 }
   if (out.refresh) n.refresh = out.refresh
   await saveBack(n)
@@ -315,7 +320,7 @@ async function profileOf(c) {
       signal: AbortSignal.timeout(20_000),
     })
     if (!res.ok) {
-      const msg = `Kiro didn't take the API key: ${res.status}`
+      const msg = `Kiro didn't take the API key: ${res.status} ${STATUS_TEXT[res.status] ?? ""}`.trimEnd()
       throw res.status === 401 || res.status === 403 ? gone(msg) : new Error(msg)
     }
     const arn = (await res.json().catch(() => null))?.profile?.arn
@@ -397,8 +402,23 @@ async function credOf(auth) {
 // Account holds the credentials in use, refreshing them when near their
 // end or when Kiro turned one down; one refresh at a time, as a refresh
 // may replace the refresh token.
+//
+// after is what each refresh gave, by the access token it replaced: a
+// sign-in read with that token (its save failed, or magpie hasn't yet
+// saved what auth.refresh gave) goes on with the newer one rather than
+// spending the replaced refresh token again.
 function account(client) {
   let held = null // { id, c }
+  const after = new Map()
+  const newest = (c) => {
+    for (let i = 0; i < 16 && after.has(c.access); i++) c = { ...after.get(c.access) }
+    return c
+  }
+  const renewed = (c, n) => {
+    after.set(c.access, n)
+    if (after.size > 16) after.delete(after.keys().next().value)
+    return n
+  }
   let lock = Promise.resolve()
   const locked = (fn) => {
     const run = lock.then(fn, fn)
@@ -411,12 +431,12 @@ function account(client) {
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
       profileArn: c.profile, region: c.region } }).catch(() => {})
   }
-  return (auth, stale = false) =>
+  const creds = (auth, stale = false) =>
     locked(async () => {
       const id = auth?.type === "api" ? "key:" + auth.key : "oauth:" + (auth?.source ?? "own")
       // what its owner holds now: it may have refreshed it, signed out, or
       // signed in to another account since
-      const read = await credOf(auth)
+      let read = await credOf(auth)
       if (!read) {
         held = null
         throw gone(
@@ -425,14 +445,15 @@ function account(client) {
             : "this Kiro account's sign-in is gone; add it again in magpie",
         )
       }
+      read = newest(read)
       let c = held?.id === id ? held.c : null
       if (!c || read.access !== c.access || !fresh(c) || stale) {
         if (!read.profile && c && read.access === c.access) read.profile = c.profile
         if (stale && c && read.access !== c.access && fresh(read)) stale = false // the owner refreshed it already
         c = read
         if (!fresh(c) || stale) {
-          if (c.method === "apikey") throw gone("Kiro turned down the API key")
-          c = await refresh(c)
+          if (c.method === "apikey") throw gone("Kiro turned down the API key saved on the provider")
+          c = renewed(c, await refresh(c))
           await save(auth, c)
         }
       }
@@ -443,6 +464,25 @@ function account(client) {
       held = { id, c }
       return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
     })
+  // renew is auth.refresh's: a sign-in kept here (not kiro-cli's or the
+  // IDE's, which their owners keep) renewed under the same lock as the
+  // requests' refresh, so the two never spend one refresh token. It saves
+  // nothing — magpie saves what it gives — and gives only what changed.
+  creds.renew = (auth) =>
+    locked(async () => {
+      const read = await credOf(auth)
+      if (!read?.own || !read.refresh) return undefined
+      let c = newest(read)
+      // renewed here already (a request's refresh, or this hook's whose
+      // result magpie hasn't saved yet), the store not yet saying so
+      if (c.access === read.access || !fresh(c, LEAD_MS)) c = renewed(c, await refresh(c))
+      held = { id: "oauth:own", c }
+      const out = { access: c.access, expires: c.expires }
+      if (c.refresh !== auth.refresh) out.refresh = c.refresh
+      if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
+      return out
+    })
+  return creds
 }
 
 // ---- models ----------------------------------------------------------------------
@@ -712,7 +752,7 @@ function failure(status, body) {
     const e = JSON.parse(body)
     if (e?.message) msg = e.message + (e.reason ? ` (${e.reason})` : "")
   } catch {}
-  msg ||= `HTTP ${status}`
+  msg ||= STATUS_TEXT[status] ?? ""
   if (msg.includes("CONTENT_LENGTH_EXCEEDS_THRESHOLD") || msg.toLowerCase().includes("input is too long"))
     return { status: 400, message: "input is too long for the model's context: " + msg }
   if (msg.includes("INSUFFICIENT_MODEL_CAPACITY")) return { status: 503, message: msg }
@@ -723,12 +763,23 @@ function failure(status, body) {
 const ERROR_TYPES = { 400: "invalid_request_error", 401: "authentication_error", 402: "billing_error", 403: "permission_error",
   404: "not_found_error", 413: "request_too_large", 429: "rate_limit_error", 503: "overloaded_error", 529: "overloaded_error" }
 const errorType = (status) => ERROR_TYPES[status] ?? "api_error"
+// Each failure says X-Magpie-Sign-In: kept, as the built-in never marked
+// an account lapsed (see gone).
 const errorResponse = (status, message) =>
   new Response(JSON.stringify({ type: "error", error: { type: errorType(status), message } }), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", "X-Magpie-Sign-In": "kept" },
   })
 
+// kept is res saying the account is kept: a success too, which the
+// built-in never took for a sign-in come back.
+function kept(res) {
+  if (res.headers.has("X-Magpie-Sign-In")) return res
+  const headers = new Headers(res.headers)
+  headers.set("X-Magpie-Sign-In", "kept")
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
+}
+
 // ---- the reply: an AWS event stream → Messages ---------------------------------------
 
 // frames reads an AWS event stream: each message its length, its headers'
@@ -1087,7 +1138,9 @@ async function reply(it, model, stream) {
 }
 
 // generate answers a Messages request through Kiro's API: once more,
-// refreshed, when Kiro turns the token down (403).
+// refreshed, when Kiro turns the token down (403). As the built-in: no
+// credentials is a 401, a failed refresh after the 403 a 502; none marks
+// the account.
 async function generate(creds, auth, req, signal) {
   const model = String(req.model ?? "auto")
   const budget = thinking(req, model)
@@ -1095,7 +1148,7 @@ async function generate(creds, auth, req, signal) {
   try {
     a = await creds(auth)
   } catch (e) {
-    return errorResponse(e?.gone ? 401 : 502, e.message)
+    return errorResponse(401, e.message)
   }
   let res
   try {
@@ -1109,7 +1162,7 @@ async function generate(creds, auth, req, signal) {
     try {
       a = await creds(auth, true)
     } catch (e) {
-      return errorResponse(e?.gone ? 401 : 502, e.message)
+      return errorResponse(502, e.message)
     }
     try {
       res = await sendKiro(a, buildKiro(req, model, a.profile, budget), signal)
@@ -1119,10 +1172,11 @@ async function generate(creds, auth, req, signal) {
     }
   }
   if (!res.ok) {
+    // Kiro's own 401 is passed on, as the built-in did, the sign-in kept
     const f = failure(res.status, (await res.text()).slice(0, 1 << 20))
     return errorResponse(f.status, f.message)
   }
-  return reply(events(res.body, model, budget), model, req.stream === true)
+  return kept(await reply(events(res.body, model, budget), model, req.stream === true))
 }
 
 // ---- signing in ----------------------------------------------------------------------
@@ -1308,6 +1362,18 @@ export async function KiroAuthPlugin({ client } = {}) {
   return {
     auth: {
       provider: ID,
+      // magpie renews a sign-in kept here LEAD_MS before its end, once for
+      // the account, before its requests, models and usage ask for it; the
+      // check before each request stays for OpenCode, which doesn't call
+      // this. kiro-cli's and the IDE's sign-ins have no end magpie knows
+      // (expires 0) and are never asked for.
+      refreshLead: LEAD_MS,
+      // A failure is thrown as it is, a refusal too: the built-in marked
+      // no Kiro account lapsed (see gone).
+      async refresh(auth) {
+        if (auth?.type !== "oauth" || auth.source || !auth.access || !auth.refresh) return undefined
+        return creds.renew(auth)
+      },
       async loader(getAuth) {
         const auth = await getAuth()
         if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return {}
@@ -1329,14 +1395,15 @@ export async function KiroAuthPlugin({ client } = {}) {
           },
         }
       },
-      // the account's credits, as magpie's built-in showed them
+      // the account's credits, as magpie's built-in showed them; a read,
+      // clean or failed, marked the built-in's account nothing
       async usage(getAuth) {
         const auth = await getAuth()
-        if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return { error: "not signed in" }
+        if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return { error: "not signed in", signIn: "kept" }
         try {
-          return usageOf(await usageLimits(await creds(auth), true))
+          return { ...usageOf(await usageLimits(await creds(auth), true)), signIn: "kept" }
         } catch (e) {
-          return { error: e.message }
+          return { error: e.message, signIn: "kept" }
         }
       },
       methods: [
@@ -1373,4 +1440,4 @@ export async function KiroAuthPlugin({ client } = {}) {
 }
 
 // for tests
-export const _internal = { usageOf, buildKiro, events, reply, failure, toolID, thinking, readCLI, readIDE, regionOf, planName, frames }
+export const _internal = { generate, refresh, usageOf, buildKiro, events, reply, failure, toolID, thinking, readCLI, readIDE, regionOf, planName, frames }

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": ["index.mjs", "README.md"],
   "keywords": ["opencode", "opencode-plugin", "magpie", "kiro"],
-  "license": "MIT"
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/magpie-community/plugins.git", "directory": "packages/kiro" }
 }