@magpie-community/opencode-kiro-auth 0.1.5 → 0.1.7

package/README.md

@@ -39,8 +39,23 @@ Power) and makes its requests, in OpenCode and in magpie. Provider id:
 A browser sign-in is kept where OpenCode keeps sign-ins (`auth.json`; in
 magpie, `plugin-auth.json`) as an `oauth` entry. The entry holds the
 tokens, the profile ARN, the region and, for AWS, the registered client.
-Tokens are refreshed 2 minutes before they expire, and also when Kiro
-turns one down (a 403, after which the request is tried once more):
+Refreshing such a sign-in:
+
+- magpie renews the token 10 minutes before it expires, through the
+  plugin's `auth.refresh`, once for the account and before its requests,
+  models and usage need it. magpie saves the new token. A failed renewal,
+  even one Kiro refused, doesn't mark the account: it is tried again.
+- OpenCode doesn't call that hook: there the token is refreshed 2 minutes
+  before it expires, before a request, and saved.
+- Either way, a token Kiro turns down (a 403) is refreshed and the request
+  tried once more.
+- Only one refresh runs at a time, magpie's renewal included, and a token
+  refreshed but not yet saved is used rather than spending the old refresh
+  token again.
+- kiro-cli's and the IDE's sign-ins aren't renewed by magpie: they are
+  refreshed before a request, as above, and written back.
+
+Tokens are refreshed through:
 
 - Google/GitHub: through `prod.<region>.auth.desktop.kiro.dev/refreshToken`.
 - Builder ID/Identity Center: through AWS's `oidc.<region>.amazonaws.com/token`.

package/index.mjs

@@ -43,6 +43,13 @@ const SCOPES = ["codewhisperer:completions", "codewhisperer:analysis", "codewhis
 const IDE_UA = "KiroIDE-1.1.70-" + createHash("sha256").update("magpie:" + hostname()).digest("hex")
 const DESKTOP_UA = "Kiro-Desktop/0.2.13 (darwin; arm64)"
 const SIGN_IN_TIMEOUT = 10 * 60 * 1000
+// A Builder ID sign-in has no profile of its own, and Kiro won't list one
+// for it (List-Available-Profiles is a 403, "AWS Builder ID is not supported
+// for this operation"); the Kiro IDE and kiro-cli name this service profile
+// for it instead, so its models, usage and chat are asked with it too.
+const BUILDER_ID_START = "https://view.awsapps.com/start"
+const BUILDER_ID_PROFILE = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX"
+const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "builderid"
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -118,6 +125,8 @@ async function readCLI() {
       if (kind === "social") c.method = "social"
       else if (kind === "odic") {
         c.method = "idc"
+        // as kiro-cli tells them apart: Builder ID's start URL, or none
+        c.builderID = !m.start_url || m.start_url === BUILDER_ID_START
         const reg = get("kirocli:odic:device-registration")
         if (reg) [c.clientId, c.clientSecret] = [reg.client_id ?? "", reg.client_secret ?? ""]
       } else {
@@ -145,7 +154,7 @@ async function readIDE() {
   }
   if (!t?.accessToken) return null
   const c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: time(t.expiresAt), region: t.region || "us-east-1",
-    profile: t.profileArn ?? "", method: "idc", idePath: path }
+    profile: t.profileArn ?? "", method: "idc", idePath: path, builderID: isBuilderID(t.provider) }
   if (t.clientIdHash) {
     try {
       const reg = JSON.parse(await readFile(join(ideDir(), t.clientIdHash + ".json"), "utf8"))
@@ -197,7 +206,9 @@ const EXPIRED_CLI = EXPIRED + " with `kiro-cli login` or the Kiro IDE"
 // there. The built-in marked no Kiro account lapsed, not even then, nor
 // cleared one: every answer and usage read says the account is kept.
 const gone = (msg) => Object.assign(new Error(msg), { gone: true })
-const fresh = (c) => c.method === "apikey" || !c.expires || c.expires - Date.now() > 2 * 60 * 1000
+const EARLY_MS = 2 * 60 * 1000 // a token this close to its end is refreshed before a request
+const LEAD_MS = 10 * 60 * 1000 // and this close, magpie renews it ahead of time (auth.refresh)
+const fresh = (c, early = EARLY_MS) => c.method === "apikey" || !c.expires || c.expires - Date.now() > early
 
 async function post(url, contentType, body, headers = {}) {
   let res
@@ -287,6 +298,7 @@ class KiroError extends Error {
     } catch {}
     super(msg ? `Kiro: ${msg} (${status})` : `Kiro: ${STATUS_TEXT[status] ?? ""}`)
     this.status = status
+    this.body = String(body ?? "")
   }
 }
 
@@ -307,7 +319,7 @@ async function managementCall(region, a, method, query, body) {
 }
 
 // profileOf finds the profile a sign-in that doesn't name one uses: an API
-// key's own, or the first Kiro lists in either of its regions.
+// key's own, Builder ID's, or the first Kiro lists in either of its regions.
 async function profileOf(c) {
   if (c.method === "apikey") {
     const res = await fetch(management("us-east-1") + "/", {
@@ -325,6 +337,7 @@ async function profileOf(c) {
     if (!arn) throw new Error("Kiro didn't say which profile the API key is for")
     return arn
   }
+  if (c.builderID) return BUILDER_ID_PROFILE
   let last
   for (const region of ["us-east-1", "eu-central-1"]) {
     try {
@@ -332,6 +345,8 @@ async function profileOf(c) {
       const arn = (out?.profiles ?? []).find((p) => p?.arn)?.arn
       if (arn) return arn
     } catch (e) {
+      // a Builder ID sign-in the token didn't say was one
+      if (c.method === "idc" && e?.status === 403 && e.body.includes("Builder ID")) return BUILDER_ID_PROFILE
       last = e
     }
   }
@@ -394,14 +409,29 @@ async function credOf(auth) {
   if (!auth.access) return null
   return { access: auth.access, refresh: auth.refresh ?? "", expires: auth.expires ?? 0, method: auth.method || "social",
     region: auth.region || "us-east-1", profile: auth.profileArn ?? "", clientId: auth.clientId ?? "", clientSecret: auth.clientSecret ?? "",
-    own: true }
+    builderID: isBuilderID(auth.loginProvider), own: true }
 }
 
 // Account holds the credentials in use, refreshing them when near their
 // end or when Kiro turned one down; one refresh at a time, as a refresh
 // may replace the refresh token.
+//
+// after is what each refresh gave, by the access token it replaced: a
+// sign-in read with that token (its save failed, or magpie hasn't yet
+// saved what auth.refresh gave) goes on with the newer one rather than
+// spending the replaced refresh token again.
 function account(client) {
   let held = null // { id, c }
+  const after = new Map()
+  const newest = (c) => {
+    for (let i = 0; i < 16 && after.has(c.access); i++) c = { ...after.get(c.access) }
+    return c
+  }
+  const renewed = (c, n) => {
+    after.set(c.access, n)
+    if (after.size > 16) after.delete(after.keys().next().value)
+    return n
+  }
   let lock = Promise.resolve()
   const locked = (fn) => {
     const run = lock.then(fn, fn)
@@ -414,12 +444,12 @@ function account(client) {
     await client.auth.set({ path: { id: ID }, body: { ...rest, type: "oauth", access: c.access, refresh: c.refresh, expires: c.expires,
       profileArn: c.profile, region: c.region } }).catch(() => {})
   }
-  return (auth, stale = false) =>
+  const creds = (auth, stale = false) =>
     locked(async () => {
       const id = auth?.type === "api" ? "key:" + auth.key : "oauth:" + (auth?.source ?? "own")
       // what its owner holds now: it may have refreshed it, signed out, or
       // signed in to another account since
-      const read = await credOf(auth)
+      let read = await credOf(auth)
       if (!read) {
         held = null
         throw gone(
@@ -428,6 +458,7 @@ function account(client) {
             : "this Kiro account's sign-in is gone; add it again in magpie",
         )
       }
+      read = newest(read)
       let c = held?.id === id ? held.c : null
       if (!c || read.access !== c.access || !fresh(c) || stale) {
         if (!read.profile && c && read.access === c.access) read.profile = c.profile
@@ -435,7 +466,7 @@ function account(client) {
         c = read
         if (!fresh(c) || stale) {
           if (c.method === "apikey") throw gone("Kiro turned down the API key saved on the provider")
-          c = await refresh(c)
+          c = renewed(c, await refresh(c))
           await save(auth, c)
         }
       }
@@ -446,6 +477,25 @@ function account(client) {
       held = { id, c }
       return { token: c.access, tokenType: tokenType(c), profile: c.profile, region: regionOf(c.profile, c.region) }
     })
+  // renew is auth.refresh's: a sign-in kept here (not kiro-cli's or the
+  // IDE's, which their owners keep) renewed under the same lock as the
+  // requests' refresh, so the two never spend one refresh token. It saves
+  // nothing — magpie saves what it gives — and gives only what changed.
+  creds.renew = (auth) =>
+    locked(async () => {
+      const read = await credOf(auth)
+      if (!read?.own || !read.refresh) return undefined
+      let c = newest(read)
+      // renewed here already (a request's refresh, or this hook's whose
+      // result magpie hasn't saved yet), the store not yet saying so
+      if (c.access === read.access || !fresh(c, LEAD_MS)) c = renewed(c, await refresh(c))
+      held = { id: "oauth:own", c }
+      const out = { access: c.access, expires: c.expires }
+      if (c.refresh !== auth.refresh) out.refresh = c.refresh
+      if (c.profile && c.profile !== auth.profileArn) out.profileArn = c.profile
+      return out
+    })
+  return creds
 }
 
 // ---- models ----------------------------------------------------------------------
@@ -1238,7 +1288,7 @@ async function browserSignIn() {
           grantType: "authorization_code", redirectUri: awsRedirect, code: q.get("code"), codeVerifier: aws.verifier })
         if (!t.accessToken) throw new Error("AWS sent back no token")
         c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: expiry(t.expiresIn), method: "idc", loginProvider: aws.provider,
-          region: aws.region, clientId: aws.clientId, clientSecret: aws.clientSecret, profile: "" }
+          region: aws.region, clientId: aws.clientId, clientSecret: aws.clientSecret, profile: "", builderID: isBuilderID(aws.provider) }
       } else if (q.get("state") !== state) {
         // not ours: someone else's page, or a stale tab
         return html(200, page(false, "This link isn't from this sign-in", "Start it again."))
@@ -1325,6 +1375,18 @@ export async function KiroAuthPlugin({ client } = {}) {
   return {
     auth: {
       provider: ID,
+      // magpie renews a sign-in kept here LEAD_MS before its end, once for
+      // the account, before its requests, models and usage ask for it; the
+      // check before each request stays for OpenCode, which doesn't call
+      // this. kiro-cli's and the IDE's sign-ins have no end magpie knows
+      // (expires 0) and are never asked for.
+      refreshLead: LEAD_MS,
+      // A failure is thrown as it is, a refusal too: the built-in marked
+      // no Kiro account lapsed (see gone).
+      async refresh(auth) {
+        if (auth?.type !== "oauth" || auth.source || !auth.access || !auth.refresh) return undefined
+        return creds.renew(auth)
+      },
       async loader(getAuth) {
         const auth = await getAuth()
         if (!(auth?.type === "api" && auth.key) && auth?.type !== "oauth") return {}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",
   "exports": "./index.mjs",
   "files": ["index.mjs", "README.md"],
   "keywords": ["opencode", "opencode-plugin", "magpie", "kiro"],
-  "license": "MIT"
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/magpie-community/plugins.git", "directory": "packages/kiro" }
 }