@magpie-community/opencode-kiro-auth 0.1.6 → 0.1.8

package/README.md

@@ -73,7 +73,9 @@ request:
   - The system prompt goes at the head of the first message.
   - Tool calls and results are paired: an unanswered call gets an error
     result, and a result longer than 250,000 characters is cut.
-  - Tool ids Kiro wouldn't take are rewritten.
+  - Tool ids Kiro wouldn't take are rewritten. A tool name over 64
+    characters (an MCP plugin's, in Claude Code) is sent shortened with a
+    hash and its calls come back under the full name.
   - Only the latest images are sent.
   - Tools the history used but the request doesn't offer are declared.
 - It turns the AWS event stream Kiro answers with back into Messages'

package/index.mjs

@@ -43,6 +43,13 @@ const SCOPES = ["codewhisperer:completions", "codewhisperer:analysis", "codewhis
 const IDE_UA = "KiroIDE-1.1.70-" + createHash("sha256").update("magpie:" + hostname()).digest("hex")
 const DESKTOP_UA = "Kiro-Desktop/0.2.13 (darwin; arm64)"
 const SIGN_IN_TIMEOUT = 10 * 60 * 1000
+// A Builder ID sign-in has no profile of its own, and Kiro won't list one
+// for it (List-Available-Profiles is a 403, "AWS Builder ID is not supported
+// for this operation"); the Kiro IDE and kiro-cli name this service profile
+// for it instead, so its models, usage and chat are asked with it too.
+const BUILDER_ID_START = "https://view.awsapps.com/start"
+const BUILDER_ID_PROFILE = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX"
+const isBuilderID = (provider) => String(provider ?? "").toLowerCase() === "builderid"
 
 const env = (k) => process.env[k] ?? ""
 const home = () => env("HOME") || homedir()
@@ -118,6 +125,8 @@ async function readCLI() {
       if (kind === "social") c.method = "social"
       else if (kind === "odic") {
         c.method = "idc"
+        // as kiro-cli tells them apart: Builder ID's start URL, or none
+        c.builderID = !m.start_url || m.start_url === BUILDER_ID_START
         const reg = get("kirocli:odic:device-registration")
         if (reg) [c.clientId, c.clientSecret] = [reg.client_id ?? "", reg.client_secret ?? ""]
       } else {
@@ -145,7 +154,7 @@ async function readIDE() {
   }
   if (!t?.accessToken) return null
   const c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: time(t.expiresAt), region: t.region || "us-east-1",
-    profile: t.profileArn ?? "", method: "idc", idePath: path }
+    profile: t.profileArn ?? "", method: "idc", idePath: path, builderID: isBuilderID(t.provider) }
   if (t.clientIdHash) {
     try {
       const reg = JSON.parse(await readFile(join(ideDir(), t.clientIdHash + ".json"), "utf8"))
@@ -289,6 +298,7 @@ class KiroError extends Error {
     } catch {}
     super(msg ? `Kiro: ${msg} (${status})` : `Kiro: ${STATUS_TEXT[status] ?? ""}`)
     this.status = status
+    this.body = String(body ?? "")
   }
 }
 
@@ -309,7 +319,7 @@ async function managementCall(region, a, method, query, body) {
 }
 
 // profileOf finds the profile a sign-in that doesn't name one uses: an API
-// key's own, or the first Kiro lists in either of its regions.
+// key's own, Builder ID's, or the first Kiro lists in either of its regions.
 async function profileOf(c) {
   if (c.method === "apikey") {
     const res = await fetch(management("us-east-1") + "/", {
@@ -327,6 +337,7 @@ async function profileOf(c) {
     if (!arn) throw new Error("Kiro didn't say which profile the API key is for")
     return arn
   }
+  if (c.builderID) return BUILDER_ID_PROFILE
   let last
   for (const region of ["us-east-1", "eu-central-1"]) {
     try {
@@ -334,6 +345,8 @@ async function profileOf(c) {
       const arn = (out?.profiles ?? []).find((p) => p?.arn)?.arn
       if (arn) return arn
     } catch (e) {
+      // a Builder ID sign-in the token didn't say was one
+      if (c.method === "idc" && e?.status === 403 && e.body.includes("Builder ID")) return BUILDER_ID_PROFILE
       last = e
     }
   }
@@ -396,7 +409,7 @@ async function credOf(auth) {
   if (!auth.access) return null
   return { access: auth.access, refresh: auth.refresh ?? "", expires: auth.expires ?? 0, method: auth.method || "social",
     region: auth.region || "us-east-1", profile: auth.profileArn ?? "", clientId: auth.clientId ?? "", clientSecret: auth.clientSecret ?? "",
-    own: true }
+    builderID: isBuilderID(auth.loginProvider), own: true }
 }
 
 // Account holds the credentials in use, refreshing them when near their
@@ -563,6 +576,36 @@ const TOOL_ID = /^[a-zA-Z0-9_.:-]{1,64}$/
 // one of Kiro's own, the same each time.
 const toolID = (id) => (TOOL_ID.test(id ?? "") ? id : "t_" + createHash("sha256").update(String(id ?? "")).digest("base64url").slice(0, 32))
 
+// Kiro answers a tool named past 64 characters, or outside these, "Invalid
+// tool use format." and won't raise the limit (kirodotdev/Kiro#7684), while
+// MCP tools in Claude Code are named mcp__plugin_<plugin>_<server>__<tool>
+// (yetone/magpie#1393).
+const TOOL_NAME = /^[a-zA-Z0-9_-]{1,64}$/
+
+// toolName is a tool's name as Kiro takes one: another is its head with a
+// hash of the whole name, the same each time, so the conversation's later
+// turns name it the same way. toolNames maps each such name back.
+const toolName = (name) => {
+  const n = String(name ?? "")
+  if (TOOL_NAME.test(n)) return n
+  const hash = createHash("sha256").update(n).digest("hex").slice(0, 12)
+  return n.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64 - 1 - hash.length) + "_" + hash
+}
+
+// toolNames is the name the caller knows for each tool a request names
+// that Kiro is sent under another name.
+function toolNames(req) {
+  const names = new Map()
+  const add = (n) => {
+    if (typeof n !== "string" || !n) return
+    const k = toolName(n)
+    if (k !== n) names.set(k, n)
+  }
+  for (const t of req.tools ?? []) add(t?.name)
+  for (const m of req.messages ?? []) if (Array.isArray(m.content)) for (const p of m.content) if (p?.type === "tool_use") add(p.name)
+  return names
+}
+
 function imageFormat(mediaType) {
   const t = String(mediaType ?? "").toLowerCase()
   const f = t.replace(/^image\//, "")
@@ -607,7 +650,7 @@ function buildKiro(req, model, profile, budget) {
         if (p?.type === "text" && p.text) texts.push(p.text)
         else if (p?.type === "tool_use") {
           const input = p.input && typeof p.input === "object" && !Array.isArray(p.input) ? p.input : {}
-          a.toolUses.push({ name: p.name, toolUseId: toolID(p.id), input })
+          a.toolUses.push({ name: toolName(p.name), toolUseId: toolID(p.id), input })
         }
       }
       a.content = texts.join("\n\n")
@@ -706,8 +749,9 @@ function buildKiro(req, model, profile, budget) {
   const EMPTY = { type: "object", properties: {} }
   for (const t of req.tools ?? []) {
     if (!t?.name || (t.type && t.type !== "custom" && !t.input_schema)) continue // server tools Kiro hasn't
-    offered.add(t.name)
-    tools.push({ toolSpecification: { name: t.name, description: t.description || t.name, inputSchema: { json: t.input_schema ?? EMPTY } } })
+    const name = toolName(t.name)
+    offered.add(name)
+    tools.push({ toolSpecification: { name, description: t.description || t.name, inputSchema: { json: t.input_schema ?? EMPTY } } })
   }
   for (const e of entries)
     for (const c of e.assistantResponseMessage?.toolUses ?? [])
@@ -1034,8 +1078,9 @@ const QUOTA_WORDS = /quota|insufficient|balance|credit|billing|exceeded|rate.?li
 const failedBefore = (text) => errorResponse(QUOTA_WORDS.test(text) ? 429 : 502, text)
 
 // reply answers the Messages request from Kiro's events: a stream of
-// Messages' events, or one message.
-async function reply(it, model, stream) {
+// Messages' events, or one message. names gives back the caller's name of
+// a tool Kiro was sent under another (toolNames).
+async function reply(it, model, stream, names = new Map()) {
   const id = "msg_" + randomBytes(12).toString("hex")
   if (!stream) {
     const content = []
@@ -1053,7 +1098,7 @@ async function reply(it, model, stream) {
         else add({ type: "thinking", thinking: e.text, signature: "" })
       } else if (e.kind === "sig") {
         if (last?.type === "thinking") last.signature += e.text
-      } else if (e.kind === "toolStart") add({ type: "tool_use", id: e.id, name: e.name, input: "" })
+      } else if (e.kind === "toolStart") add({ type: "tool_use", id: e.id, name: names.get(e.name) ?? e.name, input: "" })
       else if (e.kind === "toolArgs") {
         if (last?.type === "tool_use") last.input += e.text
       } else if (e.kind === "error") {
@@ -1114,7 +1159,7 @@ async function reply(it, model, stream) {
           if (open === "thinking") ctl.enqueue(sse("content_block_delta", { index, delta: { type: "signature_delta", signature: e.text } }))
           break
         case "toolStart":
-          begin("tool", { type: "tool_use", id: e.id, name: e.name, input: {} })
+          begin("tool", { type: "tool_use", id: e.id, name: names.get(e.name) ?? e.name, input: {} })
           break
         case "toolArgs":
           if (open === "tool") ctl.enqueue(sse("content_block_delta", { index, delta: { type: "input_json_delta", partial_json: e.text } }))
@@ -1176,7 +1221,7 @@ async function generate(creds, auth, req, signal) {
     const f = failure(res.status, (await res.text()).slice(0, 1 << 20))
     return errorResponse(f.status, f.message)
   }
-  return kept(await reply(events(res.body, model, budget), model, req.stream === true))
+  return kept(await reply(events(res.body, model, budget), model, req.stream === true, toolNames(req)))
 }
 
 // ---- signing in ----------------------------------------------------------------------
@@ -1275,7 +1320,7 @@ async function browserSignIn() {
           grantType: "authorization_code", redirectUri: awsRedirect, code: q.get("code"), codeVerifier: aws.verifier })
         if (!t.accessToken) throw new Error("AWS sent back no token")
         c = { access: t.accessToken, refresh: t.refreshToken ?? "", expires: expiry(t.expiresIn), method: "idc", loginProvider: aws.provider,
-          region: aws.region, clientId: aws.clientId, clientSecret: aws.clientSecret, profile: "" }
+          region: aws.region, clientId: aws.clientId, clientSecret: aws.clientSecret, profile: "", builderID: isBuilderID(aws.provider) }
       } else if (q.get("state") !== state) {
         // not ours: someone else's page, or a stale tab
         return html(200, page(false, "This link isn't from this sign-in", "Start it again."))
@@ -1440,4 +1485,4 @@ export async function KiroAuthPlugin({ client } = {}) {
 }
 
 // for tests
-export const _internal = { generate, refresh, usageOf, buildKiro, events, reply, failure, toolID, thinking, readCLI, readIDE, regionOf, planName, frames }
+export const _internal = { generate, refresh, usageOf, buildKiro, events, reply, failure, toolID, toolName, toolNames, thinking, readCLI, readIDE, regionOf, planName, frames }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-kiro-auth",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Kiro subscriptions (Free, Pro, Pro+, Power) in OpenCode and magpie",
   "type": "module",
   "main": "./index.mjs",