@sunerpy/opencode-kiro-auth 0.1.0

package/dist/plugin/sync/stale-accounts.js

@@ -0,0 +1,31 @@
+import { isPermanentError } from '../health.js';
+export const STALE_CLI_ACCOUNT_REASON = 'InvalidTokenException: Replaced by active Kiro CLI account during sync';
+export function getStaleKiroCliAccountIds(accounts, syncedAccounts) {
+    if (syncedAccounts.length === 0)
+        return [];
+    const syncedIds = new Set(syncedAccounts.map((acc) => acc.id));
+    return accounts
+        .filter((account) => {
+        if (!account?.id || syncedIds.has(account.id))
+            return false;
+        const authMethod = account.auth_method || account.authMethod;
+        const email = account.email;
+        const clientId = account.client_id || account.clientId;
+        const profileArn = account.profile_arn || account.profileArn;
+        const lastSync = account.last_sync || account.lastSync || 0;
+        const unhealthyReason = account.unhealthy_reason || account.unhealthyReason;
+        return syncedAccounts.some((synced) => {
+            const sameAuthMethod = authMethod === synced.authMethod;
+            const sameEmail = !!email && email === synced.email;
+            const sameClient = !!clientId && clientId === synced.clientId;
+            const sameProfile = !!profileArn && profileArn === synced.profileArn;
+            const sameIdentity = sameEmail || sameClient || sameProfile;
+            if (sameAuthMethod && sameIdentity)
+                return true;
+            if (sameAuthMethod && lastSync > 0)
+                return true;
+            return isPermanentError(unhealthyReason) && sameIdentity;
+        });
+    })
+        .map((account) => account.id);
+}

package/dist/plugin/token.d.ts

@@ -0,0 +1,2 @@
+import type { KiroAuthDetails } from './types.js';
+export declare function refreshAccessToken(auth: KiroAuthDetails): Promise<KiroAuthDetails>;

package/dist/plugin/token.js

@@ -0,0 +1,78 @@
+import { decodeRefreshToken, encodeRefreshToken } from '../kiro/auth.js';
+import { KiroTokenRefreshError } from './errors.js';
+export async function refreshAccessToken(auth) {
+    const p = decodeRefreshToken(auth.refresh);
+    const isIdc = auth.authMethod === 'idc';
+    const oidcRegion = auth.oidcRegion || auth.region;
+    const url = isIdc
+        ? `https://oidc.${oidcRegion}.amazonaws.com/token`
+        : `https://prod.${auth.region}.auth.desktop.kiro.dev/refreshToken`;
+    if (isIdc && (!p.clientId || !p.clientSecret)) {
+        throw new KiroTokenRefreshError('Missing creds', 'MISSING_CREDENTIALS');
+    }
+    const requestBody = isIdc
+        ? {
+            refreshToken: p.refreshToken,
+            clientId: p.clientId,
+            clientSecret: p.clientSecret,
+            grantType: 'refresh_token'
+        }
+        : {
+            refreshToken: p.refreshToken
+        };
+    const ua = isIdc
+        ? 'aws-sdk-js/3.738.0 ua/2.1 os/other lang/js md/browser#unknown_unknown api/sso-oidc#3.738.0 m/E KiroIDE'
+        : 'aws-sdk-js/3.0.0 KiroIDE-0.1.0 os/macos lang/js md/nodejs/18.0.0';
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                'amz-sdk-request': 'attempt=1; max=1',
+                'x-amzn-kiro-agent-mode': 'vibe',
+                'user-agent': ua,
+                Connection: 'close'
+            },
+            body: JSON.stringify(requestBody)
+        });
+        if (!res.ok) {
+            const txt = await res.text();
+            let data = {};
+            try {
+                data = JSON.parse(txt);
+            }
+            catch {
+                data = { message: txt };
+            }
+            throw new KiroTokenRefreshError(`Refresh failed: ${data.message || data.error_description || txt}`, data.__type || data.error || `HTTP_${res.status}`);
+        }
+        const d = await res.json();
+        const acc = d.access_token || d.accessToken;
+        if (!acc)
+            throw new KiroTokenRefreshError('No access token', 'INVALID_RESPONSE');
+        const upP = {
+            refreshToken: d.refresh_token || d.refreshToken || p.refreshToken,
+            clientId: p.clientId,
+            clientSecret: p.clientSecret,
+            authMethod: auth.authMethod
+        };
+        return {
+            refresh: encodeRefreshToken(upP),
+            access: acc,
+            expires: Date.now() + (d.expires_in || d.expiresIn || 3600) * 1000,
+            authMethod: auth.authMethod,
+            region: auth.region,
+            oidcRegion: auth.oidcRegion,
+            profileArn: auth.profileArn,
+            clientId: auth.clientId,
+            clientSecret: auth.clientSecret,
+            email: auth.email || d.userInfo?.email
+        };
+    }
+    catch (error) {
+        if (error instanceof KiroTokenRefreshError)
+            throw error;
+        throw new KiroTokenRefreshError(`Token refresh failed: ${error instanceof Error ? error.message : 'Unknown error'}`, 'NETWORK_ERROR', error instanceof Error ? error : undefined);
+    }
+}

package/dist/plugin/types.d.ts

@@ -0,0 +1,125 @@
+import z from 'zod';
+import { EffortSchema, RegionSchema } from './config/schema.js';
+export type KiroAuthMethod = 'idc' | 'desktop';
+export type KiroRegion = z.infer<typeof RegionSchema>;
+export type Effort = z.infer<typeof EffortSchema>;
+export interface KiroAuthDetails {
+    refresh: string;
+    access: string;
+    expires: number;
+    authMethod: KiroAuthMethod;
+    region: KiroRegion;
+    oidcRegion?: KiroRegion;
+    clientId?: string;
+    clientSecret?: string;
+    email?: string;
+    profileArn?: string;
+}
+export interface RefreshParts {
+    refreshToken: string;
+    clientId?: string;
+    clientSecret?: string;
+    profileArn?: string;
+    authMethod?: KiroAuthMethod;
+}
+export interface ManagedAccount {
+    id: string;
+    email: string;
+    authMethod: KiroAuthMethod;
+    region: KiroRegion;
+    oidcRegion?: KiroRegion;
+    clientId?: string;
+    clientSecret?: string;
+    profileArn?: string;
+    startUrl?: string;
+    refreshToken: string;
+    accessToken: string;
+    expiresAt: number;
+    rateLimitResetTime: number;
+    isHealthy: boolean;
+    unhealthyReason?: string;
+    recoveryTime?: number;
+    failCount: number;
+    usedCount?: number;
+    limitCount?: number;
+    lastSync?: number;
+    lastUsed?: number;
+}
+export interface CodeWhispererMessage {
+    userInputMessage?: {
+        content: string;
+        modelId: string;
+        origin: string;
+        images?: Array<{
+            format: string;
+            source: {
+                bytes: Uint8Array;
+            };
+        }>;
+        userInputMessageContext?: {
+            toolResults?: Array<{
+                toolUseId: string;
+                content: Array<{
+                    text?: string;
+                }>;
+                status?: string;
+            }>;
+            tools?: Array<{
+                toolSpecification: {
+                    name: string;
+                    description: string;
+                    inputSchema: {
+                        json: Record<string, unknown>;
+                    };
+                };
+            }>;
+        };
+    };
+    assistantResponseMessage?: {
+        content: string;
+        toolUses?: Array<{
+            input: any;
+            name: string;
+            toolUseId: string;
+        }>;
+    };
+}
+export interface CodeWhispererRequest {
+    conversationState: {
+        chatTriggerType: string;
+        conversationId: string;
+        history?: CodeWhispererMessage[];
+        currentMessage: CodeWhispererMessage;
+    };
+    profileArn?: string;
+}
+export interface ToolCall {
+    toolUseId: string;
+    name: string;
+    input: string | Record<string, unknown>;
+}
+export interface ParsedResponse {
+    content: string;
+    toolCalls: ToolCall[];
+    stopReason?: string;
+    inputTokens?: number;
+    outputTokens?: number;
+}
+export interface PreparedRequest {
+    url: string;
+    init: RequestInit;
+    streaming: boolean;
+    effectiveModel: string;
+    conversationId: string;
+}
+export interface SdkPreparedRequest {
+    conversationState: CodeWhispererRequest['conversationState'];
+    profileArn?: string;
+    streaming: boolean;
+    effectiveModel: string;
+    conversationId: string;
+    region: string;
+    /** Resolved effort level for thinking models */
+    effort?: Effort;
+}
+export type AccountSelectionStrategy = 'sticky' | 'round-robin' | 'lowest-usage';

package/dist/plugin/usage.d.ts

@@ -0,0 +1,3 @@
+import { KiroAuthDetails, ManagedAccount } from './types.js';
+export declare function fetchUsageLimits(auth: KiroAuthDetails): Promise<any>;
+export declare function updateAccountQuota(account: ManagedAccount, usage: any, accountManager?: any): void;

package/dist/plugin/usage.js

@@ -0,0 +1,79 @@
+export async function fetchUsageLimits(auth) {
+    // Try different parameter combinations
+    const attempts = [
+        { resourceType: 'AGENTIC_REQUEST', origin: 'AI_EDITOR' },
+        { origin: 'AI_EDITOR' },
+        { resourceType: 'CONVERSATION', origin: 'AI_EDITOR' },
+        {}
+    ];
+    let lastError = null;
+    for (const [index, params] of attempts.entries()) {
+        const url = new URL(`https://q.${auth.region}.amazonaws.com/getUsageLimits`);
+        url.searchParams.set('isEmailRequired', 'true');
+        if (params.origin)
+            url.searchParams.set('origin', params.origin);
+        if (params.resourceType)
+            url.searchParams.set('resourceType', params.resourceType);
+        if (auth.profileArn)
+            url.searchParams.set('profileArn', auth.profileArn);
+        try {
+            const res = await fetch(url.toString(), {
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${auth.access}`,
+                    'Content-Type': 'application/json',
+                    'x-amzn-kiro-agent-mode': 'vibe',
+                    'amz-sdk-request': 'attempt=1; max=1'
+                }
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                const requestId = res.headers.get('x-amzn-requestid') ||
+                    res.headers.get('x-amzn-request-id') ||
+                    res.headers.get('x-amz-request-id') ||
+                    '';
+                const errType = res.headers.get('x-amzn-errortype') || res.headers.get('x-amzn-error-type') || '';
+                if (body.includes('FEATURE_NOT_SUPPORTED') && index < attempts.length - 1) {
+                    continue;
+                }
+                const msg = body && body.length > 0
+                    ? `${body.slice(0, 2000)}${body.length > 2000 ? '…' : ''}`
+                    : `HTTP ${res.status}`;
+                lastError = new Error(`Status: ${res.status}${errType ? ` (${errType})` : ''}${requestId ? ` [${requestId}]` : ''}: ${msg}`);
+                continue;
+            }
+            const data = await res.json();
+            let usedCount = 0, limitCount = 0;
+            if (Array.isArray(data.usageBreakdownList)) {
+                for (const s of data.usageBreakdownList) {
+                    if (s.freeTrialInfo) {
+                        usedCount += s.freeTrialInfo.currentUsage || 0;
+                        limitCount += s.freeTrialInfo.usageLimit || 0;
+                    }
+                    usedCount += s.currentUsage || 0;
+                    limitCount += s.usageLimit || 0;
+                }
+            }
+            return { usedCount, limitCount, email: data.userInfo?.email };
+        }
+        catch (e) {
+            lastError = e instanceof Error ? e : new Error(String(e));
+            if (index < attempts.length - 1)
+                continue;
+        }
+    }
+    throw lastError || new Error('All getUsageLimits attempts failed');
+}
+export function updateAccountQuota(account, usage, accountManager) {
+    const meta = {
+        usedCount: usage.usedCount || 0,
+        limitCount: usage.limitCount || 0,
+        email: usage.email
+    };
+    account.usedCount = meta.usedCount;
+    account.limitCount = meta.limitCount;
+    if (usage.email)
+        account.email = usage.email;
+    if (accountManager)
+        accountManager.updateUsage(account.id, meta);
+}

package/dist/plugin.d.ts

@@ -0,0 +1,174 @@
+export declare const createKiroPlugin: (id: string) => ({ client, directory }: any) => Promise<{
+    config: (input: any) => Promise<void>;
+    auth: {
+        provider: string;
+        loader: (getAuth: any) => Promise<{
+            apiKey: string;
+            baseURL: string;
+            fetch: (input: any, init?: any) => Promise<Response>;
+        }>;
+        methods: ({
+            type: "oauth";
+            label: string;
+            prompts?: Array<{
+                type: "text";
+                key: string;
+                message: string;
+                placeholder?: string;
+                validate?: (value: string) => string | undefined;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            } | {
+                type: "select";
+                key: string;
+                message: string;
+                options: Array<{
+                    label: string;
+                    value: string;
+                    hint?: string;
+                }>;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            }>;
+            authorize(inputs?: Record<string, string>): Promise<import("@opencode-ai/plugin").AuthOAuthResult>;
+        } | {
+            type: "api";
+            label: string;
+            prompts?: Array<{
+                type: "text";
+                key: string;
+                message: string;
+                placeholder?: string;
+                validate?: (value: string) => string | undefined;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            } | {
+                type: "select";
+                key: string;
+                message: string;
+                options: Array<{
+                    label: string;
+                    value: string;
+                    hint?: string;
+                }>;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            }>;
+            authorize?(inputs?: Record<string, string>): Promise<{
+                type: "success";
+                key: string;
+                provider?: string;
+                metadata?: Record<string, string>;
+            } | {
+                type: "failed";
+            }>;
+        })[];
+    };
+    provider: {
+        id: string;
+        models: (provider: any) => Promise<Record<string, any>>;
+    };
+}>;
+export declare const KiroOAuthPlugin: ({ client, directory }: any) => Promise<{
+    config: (input: any) => Promise<void>;
+    auth: {
+        provider: string;
+        loader: (getAuth: any) => Promise<{
+            apiKey: string;
+            baseURL: string;
+            fetch: (input: any, init?: any) => Promise<Response>;
+        }>;
+        methods: ({
+            type: "oauth";
+            label: string;
+            prompts?: Array<{
+                type: "text";
+                key: string;
+                message: string;
+                placeholder?: string;
+                validate?: (value: string) => string | undefined;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            } | {
+                type: "select";
+                key: string;
+                message: string;
+                options: Array<{
+                    label: string;
+                    value: string;
+                    hint?: string;
+                }>;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            }>;
+            authorize(inputs?: Record<string, string>): Promise<import("@opencode-ai/plugin").AuthOAuthResult>;
+        } | {
+            type: "api";
+            label: string;
+            prompts?: Array<{
+                type: "text";
+                key: string;
+                message: string;
+                placeholder?: string;
+                validate?: (value: string) => string | undefined;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            } | {
+                type: "select";
+                key: string;
+                message: string;
+                options: Array<{
+                    label: string;
+                    value: string;
+                    hint?: string;
+                }>;
+                condition?: (inputs: Record<string, string>) => boolean;
+                when?: {
+                    key: string;
+                    op: "eq" | "neq";
+                    value: string;
+                };
+            }>;
+            authorize?(inputs?: Record<string, string>): Promise<{
+                type: "success";
+                key: string;
+                provider?: string;
+                metadata?: Record<string, string>;
+            } | {
+                type: "failed";
+            }>;
+        })[];
+    };
+    provider: {
+        id: string;
+        models: (provider: any) => Promise<Record<string, any>>;
+    };
+}>;

package/dist/plugin.js

@@ -0,0 +1,170 @@
+import { KIRO_CONSTANTS } from './constants.js';
+import { AuthHandler } from './core/auth/auth-handler.js';
+import { RequestHandler } from './core/request/request-handler.js';
+import { AccountCache } from './infrastructure/database/account-cache.js';
+import { AccountRepository } from './infrastructure/database/account-repository.js';
+import { AccountManager } from './plugin/accounts.js';
+import { bootstrapAuthIfNeeded } from './plugin/auth-bootstrap.js';
+import { loadConfig } from './plugin/config/index.js';
+const KIRO_PROVIDER_ID = 'kiro-auth';
+export const createKiroPlugin = (id) => async ({ client, directory }) => {
+    const config = loadConfig(directory);
+    const showToast = (message, variant) => {
+        client.tui.showToast({ body: { message, variant } }).catch(() => { });
+    };
+    const cache = new AccountCache(60000);
+    const repository = new AccountRepository(cache);
+    const authHandler = new AuthHandler(config, repository);
+    const accountManager = await AccountManager.loadFromDisk(config.account_selection_strategy);
+    authHandler.setAccountManager(accountManager);
+    const requestHandler = new RequestHandler(accountManager, config, repository, client);
+    // Compute the base URL once so both the config hook and auth loader use the same value
+    const baseURL = KIRO_CONSTANTS.BASE_URL.replace('/generateAssistantResponse', '').replace('{{region}}', config.default_region || 'us-east-1');
+    return {
+        config: async (input) => {
+            // Ensure there's an auth entry so OpenCode calls the loader on startup.
+            // This is a no-op if the entry already exists.
+            bootstrapAuthIfNeeded(id);
+            if (!input.provider)
+                input.provider = {};
+            if (!input.provider[id])
+                input.provider[id] = {};
+            // Always set npm and api — these must be present regardless of whether
+            // the user has already defined the provider in their opencode.json.
+            input.provider[id].npm = '@ai-sdk/openai-compatible';
+            // Set the base URL at the provider level. OpenCode reads provider.api as
+            // model.api.url, which resolveSDK() uses to construct the endpoint URL.
+            // Only set if not already overridden by the user.
+            if (!input.provider[id].api) {
+                input.provider[id].api = baseURL;
+            }
+            if (!input.provider[id].models) {
+                input.provider[id].models = {
+                    auto: {
+                        name: 'Auto (1.0x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    // Claude Sonnet
+                    'claude-sonnet-4': {
+                        name: 'Claude Sonnet 4.0 (1.3x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-sonnet-4-5': {
+                        name: 'Claude Sonnet 4.5 (1.3x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-sonnet-4-6': {
+                        name: 'Claude Sonnet 4.6 (1.3x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-sonnet-5': {
+                        name: 'Claude Sonnet 5 (1.3x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    // Claude Haiku
+                    'claude-haiku-4-5': {
+                        name: 'Claude Haiku 4.5 (0.4x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text', 'image'], output: ['text'] }
+                    },
+                    // Claude Opus
+                    'claude-opus-4-5': {
+                        name: 'Claude Opus 4.5 (2.2x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-opus-4-6': {
+                        name: 'Claude Opus 4.6 (2.2x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-opus-4-7': {
+                        name: 'Claude Opus 4.7 (2.2x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-opus-4-8': {
+                        name: 'Claude Opus 4.8 (2.2x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    'claude-opus-4-8-thinking': {
+                        name: 'Claude Opus 4.8 Thinking (2.2x)',
+                        limit: { context: 1000000, output: 64000 },
+                        modalities: { input: ['text', 'image', 'pdf'], output: ['text'] }
+                    },
+                    // Open weight models
+                    'deepseek-3.2': {
+                        name: 'DeepSeek 3.2 (0.25x)',
+                        limit: { context: 128000, output: 64000 },
+                        modalities: { input: ['text'], output: ['text'] }
+                    },
+                    'glm-5': {
+                        name: 'GLM-5 (0.5x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text'], output: ['text'] }
+                    },
+                    'minimax-m2.5': {
+                        name: 'MiniMax M2.5 (0.25x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text'], output: ['text'] }
+                    },
+                    'minimax-m2.1': {
+                        name: 'MiniMax M2.1 (0.15x)',
+                        limit: { context: 200000, output: 64000 },
+                        modalities: { input: ['text'], output: ['text'] }
+                    },
+                    'qwen3-coder-next': {
+                        name: 'Qwen3 Coder Next (0.05x)',
+                        limit: { context: 256000, output: 64000 },
+                        modalities: { input: ['text'], output: ['text'] }
+                    }
+                };
+            }
+        },
+        auth: {
+            provider: id,
+            loader: async (getAuth) => {
+                await getAuth();
+                await authHandler.initialize(showToast);
+                return {
+                    apiKey: '',
+                    // Provide baseURL explicitly so the @ai-sdk/openai-compatible provider
+                    // always has a valid URL. The custom fetch below intercepts all Kiro
+                    // API calls, so this value is only used for URL construction.
+                    baseURL,
+                    fetch: (input, init) => requestHandler.handle(input, init, showToast)
+                };
+            },
+            methods: authHandler.getMethods()
+        },
+        provider: {
+            id,
+            models: async (provider) => {
+                const models = provider?.models || {};
+                const normalized = {};
+                for (const [modelID, model] of Object.entries(models)) {
+                    const modelInfo = model;
+                    normalized[modelID] = {
+                        ...modelInfo,
+                        api: {
+                            ...(modelInfo.api || {}),
+                            npm: '@ai-sdk/openai-compatible',
+                            // Ensure url is always set. modelInfo.api.url should already be
+                            // populated from the config hook's provider.api field, but we
+                            // set it explicitly as a fallback for any edge cases.
+                            url: modelInfo.api?.url || baseURL
+                        }
+                    };
+                }
+                return normalized;
+            }
+        }
+    };
+};
+export const KiroOAuthPlugin = createKiroPlugin(KIRO_PROVIDER_ID);