@sunerpy/opencode-kiro-auth 0.1.0

package/README.md

@@ -0,0 +1,270 @@
+# opencode-kiro-auth
+
+[简体中文](docs/readme/README.zh.md) · English
+
+[![npm version](https://img.shields.io/npm/v/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
+[![npm downloads](https://img.shields.io/npm/dm/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
+[![license](https://img.shields.io/npm/l/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
+
+> OpenCode plugin that lets OpenCode use AWS Kiro (CodeWhisperer) as a model
+> provider — Claude Sonnet, Opus, and Haiku, plus the open-weight models Kiro
+> proxies (DeepSeek, GLM, MiniMax, Qwen3) — with substantial trial quotas.
+
+## Table of Contents
+
+- [Features](#features)
+- [Installation](#installation)
+- [Setup / Auth](#setup--auth)
+- [Configuration](#configuration)
+- [Multiple accounts & rotation](#multiple-accounts--rotation)
+- [Usage display](#usage-display)
+- [Models](#models)
+- [Troubleshooting](#troubleshooting)
+- [Migration](#migration)
+- [Local plugin development](#local-plugin-development)
+- [Development](#development)
+- [Storage](#storage)
+- [Acknowledgements](#acknowledgements)
+- [Upstream sync](#upstream-sync)
+- [Disclaimer](#disclaimer)
+- [License](#license)
+
+## Features
+
+- **Multiple auth methods**: AWS Builder ID (IDC), IAM Identity Center (custom
+  Start URL), and Kiro Desktop (CLI-based) authentication.
+- **Auto-sync Kiro CLI**: automatically imports and synchronizes active
+  sessions from your local `kiro-cli` SQLite database.
+- **Gradual context truncation**: intelligently prevents error 400 by reducing
+  context size dynamically during retries.
+- **Intelligent account rotation**: prioritizes multi-account usage based on
+  lowest available quota.
+- **High-performance storage**: efficient account and usage management using
+  native Bun SQLite.
+- **Native thinking mode**: full support for Claude reasoning capabilities via
+  virtual model mappings.
+- **Kiro effort mapping**: maps OpenCode thinking budgets to Kiro's native
+  effort levels automatically.
+- **Automated recovery**: exponential backoff for rate limits and automated
+  token refresh.
+
+## Installation
+
+Add the plugin to your `opencode.json` or `opencode.jsonc`:
+
+```json
+{
+  "plugin": ["@sunerpy/opencode-kiro-auth"]
+}
+```
+
+That alone registers the `kiro-auth` provider with a default model set. To
+customize which models are exposed (including thinking variants), see
+[Models](#models) and the full catalog in
+[docs/MODELS.md](docs/MODELS.md).
+
+## Setup / Auth
+
+1. **Authentication via Kiro CLI (recommended)**:
+   - Log in directly in your terminal with `kiro-cli login`.
+   - The plugin automatically bootstraps a minimal `kiro-auth` placeholder in
+     OpenCode's `auth.json` when it detects the Kiro CLI database, then
+     imports and synchronizes your active session on startup.
+   - For AWS IAM Identity Center (SSO/IDC), the plugin imports both the token
+     and device registration (OIDC client credentials) from the `kiro-cli`
+     database.
+2. **Direct authentication**:
+   - Run `opencode auth login`.
+   - Select `Other`, type `kiro-auth`, and press enter.
+   - You'll be prompted for your **IAM Identity Center Start URL** and
+     **region** (`sso_region`). Leave it blank for **AWS Builder ID**, or
+     enter your company's Start URL (e.g.
+     `https://your-company.awsapps.com/start`) for **IAM Identity Center
+     (SSO)**.
+   - Note: the TUI `/connect` flow does **not** currently run plugin OAuth
+     prompts (Start URL / region), so Identity Center logins may fall back to
+     Builder ID unless you use `opencode auth login` (or preconfigure
+     defaults in `~/.config/opencode/kiro.json`).
+   - For **IAM Identity Center**, you may also need a **profile ARN**
+     (`profileArn`) — auto-detected from `kiro-cli profile` if available, or
+     set `idc_profile_arn` manually.
+   - A browser window opens directly to AWS's verification URL (no local auth
+     server). If it doesn't, copy/paste the URL and enter the code OpenCode
+     prints.
+3. Configuration is automatically managed at `~/.config/opencode/kiro.db`.
+
+## Configuration
+
+Plugin-wide behavior (auth sync, account selection, retry limits, effort
+mapping) lives in `~/.config/opencode/kiro.json`. See
+[docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every
+option.
+
+## Multiple accounts & rotation
+
+You can register more than one Kiro account and let the plugin spread
+requests across them for combined quota and automatic failover.
+
+**Adding accounts**, two ways:
+
+1. Run `opencode auth login`, select `kiro-auth`, and complete a Builder ID
+   or IAM Identity Center login. Run this once per account — each distinct
+   AWS identity is stored separately in `kiro.db`. Re-running login for the
+   same identity updates it in place; logging in with a different identity
+   adds a new account.
+2. Auto-sync from Kiro CLI: with `auto_sync_kiro_cli: true` (the default),
+   the plugin imports credentials from your local `kiro-cli` database.
+   Switching or adding accounts via `kiro-cli login` flows into the plugin
+   automatically, no extra step needed.
+
+**Rotation strategy** — set `account_selection_strategy` in
+`~/.config/opencode/kiro.json`:
+
+| Strategy       | Behavior                                                            | Default |
+| -------------- | -------------------------------------------------------------------- | ------- |
+| `lowest-usage` | Each request picks the healthy account with the lowest used quota    | ✅      |
+| `round-robin`  | Cycles through accounts in order                                     |         |
+| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |       |
+
+**Automatic failover** requires no configuration: a rate-limited or 403
+account is marked unhealthy and the next healthy account takes over. If every
+account is rate-limited, the plugin waits out the minimum reset time and
+retries. A circuit breaker trips after 10 consecutive selection failures to
+avoid a hot loop.
+
+**Removing an account**: run `opencode auth login`, select `kiro-auth`,
+choose "Remove a Kiro account (N stored)", then pick the account from the
+dropdown (or cancel).
+
+Full config key reference: [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
+
+## Usage display
+
+The plugin reads real quota from Kiro's usage API (`usedCount`/`limitCount`
+per account, e.g. `929/10000`) and surfaces it in three places:
+
+1. **Auth menu label** — running `opencode auth login` and selecting
+   `kiro-auth` shows `[current: <email> <used>/<limit> (<pct>%)]` on the
+   first login method; with multiple accounts they're joined with ` · `,
+   capped at 3 with a `+N more` suffix.
+2. **Startup toast** — once per plugin init, a toast shows
+   `Kiro usage (<email>): <used>/<limit> (<pct>%)` a few seconds after
+   OpenCode starts, turning yellow (`warning`) at ≥90% usage.
+3. **Runtime warning** — a warning toast fires whenever a selected account
+   is at ≥90% usage.
+
+There is **no persistent usage widget** in the TUI status bar — usage only
+shows up via the label and toasts above. To check usage at any time, either
+restart OpenCode (triggers the startup toast) or query `kiro.db` directly:
+
+```bash
+python3 -c "import sqlite3;r=sqlite3.connect('$HOME/.config/opencode/kiro.db').execute('SELECT email,used_count,limit_count FROM accounts').fetchall();[print(f'{e}: {u}/{l} (left {l-u})') for e,u,l in r]"
+```
+
+## Models
+
+The default install exposes Claude Sonnet/Opus/Haiku plus the open-weight
+models Kiro proxies. To pin an exact model list or configure thinking-budget
+variants, paste the full catalog from [docs/MODELS.md](docs/MODELS.md) into
+your `provider.kiro-auth.models` block.
+
+Thinking budgets map to Kiro's native `effort` field automatically:
+
+| OpenCode budget | Kiro effort |
+| ---------------- | ----------- |
+| `<= 10000`        | `low`       |
+| `<= 20000`        | `medium`    |
+| `<= 28000`        | `high`      |
+| `> 28000`         | `max`       |
+
+Details and the full JSON example: [docs/MODELS.md](docs/MODELS.md).
+
+## Troubleshooting
+
+Common issues — 403/AccessDeniedException with IAM Identity Center, "No
+accounts", `/connect` vs `opencode auth login`, and Kiro CLI OAuth users whose
+sync doesn't start — are covered in
+[docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md).
+
+## Migration
+
+If you're upgrading from a version that used the provider id `kiro` instead of
+`kiro-auth`:
+
+- A stale `kiro` key in OpenCode's `auth.json` will be claimed by OpenCode's
+  **built-in** `kiro` provider (models.dev provider #91), not this plugin.
+  Remove or ignore that key — this plugin now bootstraps and uses `kiro-auth`.
+- Any config or session string of the form `kiro/<model>` must become
+  `kiro-auth/<model>` (e.g. `kiro/claude-sonnet-4-5` →
+  `kiro-auth/claude-sonnet-4-5`).
+
+## Local plugin development
+
+Point OpenCode directly at your local repo path in `opencode.json` or
+`opencode.jsonc`:
+
+```json
+{
+  "plugin": ["/path/to/opencode-kiro-auth"]
+}
+```
+
+Then build and restart OpenCode to pick up changes: `bun run build`.
+
+## Development
+
+This project uses Bun. The [Makefile](Makefile) is the single source of truth
+for local checks and mirrors CI:
+
+```bash
+make install    # bun install
+make ci         # typecheck + fmt-check + test (what CI runs)
+make build      # tsc + fix-esm-imports -> dist/
+```
+
+Agent contributors: see [AGENTS.md](AGENTS.md) for the codebase architecture
+map, invariants that must not break, and the CodeGraph-assisted workflow.
+
+## Storage
+
+**Linux/macOS:**
+
+- SQLite database: `~/.config/opencode/kiro.db`
+- Plugin config: `~/.config/opencode/kiro.json`
+
+**Windows:**
+
+- SQLite database: `%APPDATA%\opencode\kiro.db`
+- Plugin config: `%APPDATA%\opencode\kiro.json`
+
+## Acknowledgements
+
+Special thanks to [AIClient-2-API](https://github.com/justlovemaki/AIClient-2-API)
+for providing the foundational Kiro authentication logic and request patterns.
+
+## Upstream sync
+
+This package is a fork of
+[tickernelz/opencode-kiro-auth](https://github.com/tickernelz/opencode-kiro-auth).
+Upstream fixes and improvements are tracked via the `upstream` git remote
+(`https://github.com/tickernelz/opencode-kiro-auth.git`) and cherry-picked into
+this fork as needed.
+
+Note: [AIClient-2-API](https://github.com/justlovemaki/AIClient-2-API) (credited
+above) is licensed under **GPLv3**, a strong copyleft license. Because this
+project's Kiro authentication logic and request patterns are derived from it,
+this project is now licensed under **GPLv3** as well, to comply with
+AIClient-2-API's copyleft requirements.
+
+## Disclaimer
+
+This plugin is provided strictly for learning and educational purposes.
+It is an independent implementation and is not affiliated with, endorsed by,
+or supported by Amazon Web Services (AWS) or Anthropic.
+Use of this plugin is at your own risk.
+
+Feel free to open a PR to optimize this plugin further.
+
+## License
+
+GPL-3.0-or-later, see [LICENSE](LICENSE)

package/dist/constants.d.ts

@@ -0,0 +1,28 @@
+import type { KiroRegion } from './plugin/types.js';
+export declare function isValidRegion(region: string): region is KiroRegion;
+export declare function normalizeRegion(region: string | undefined): KiroRegion;
+export declare function buildUrl(template: string, region: KiroRegion): string;
+export declare function extractRegionFromArn(arn: string | undefined): KiroRegion | undefined;
+export declare const KIRO_CONSTANTS: {
+    REFRESH_URL: string;
+    REFRESH_IDC_URL: string;
+    BASE_URL: string;
+    USAGE_LIMITS_URL: string;
+    DEFAULT_REGION: KiroRegion;
+    AXIOS_TIMEOUT: number;
+    USER_AGENT: string;
+    SDK_VERSION: string;
+    SDK_VERSION_USAGE: string;
+    CHAT_TRIGGER_TYPE_MANUAL: string;
+    ORIGIN_AI_EDITOR: string;
+};
+export declare const MODEL_MAPPING: Record<string, string>;
+export declare const SUPPORTED_MODELS: string[];
+export declare function isLongContextModel(model: string): boolean;
+export declare const KIRO_AUTH_SERVICE: {
+    ENDPOINT: string;
+    SSO_OIDC_ENDPOINT: string;
+    BUILDER_ID_START_URL: string;
+    USER_INFO_URL: string;
+    SCOPES: string[];
+};

package/dist/constants.js

@@ -0,0 +1,108 @@
+import { RegionSchema } from './plugin/config/schema.js';
+const VALID_REGIONS = RegionSchema.options;
+export function isValidRegion(region) {
+    return VALID_REGIONS.includes(region);
+}
+export function normalizeRegion(region) {
+    if (!region || !isValidRegion(region)) {
+        return 'us-east-1';
+    }
+    return region;
+}
+export function buildUrl(template, region) {
+    const url = template.replace('{{region}}', region);
+    try {
+        new URL(url);
+        return url;
+    }
+    catch {
+        throw new Error(`Invalid URL generated: ${url}`);
+    }
+}
+export function extractRegionFromArn(arn) {
+    if (!arn)
+        return undefined;
+    const parts = arn.split(':');
+    if (parts.length < 6)
+        return undefined;
+    if (parts[0] !== 'arn')
+        return undefined;
+    const region = parts[3];
+    if (typeof region !== 'string' || !region)
+        return undefined;
+    return isValidRegion(region) ? region : undefined;
+}
+export const KIRO_CONSTANTS = {
+    REFRESH_URL: 'https://prod.{{region}}.auth.desktop.kiro.dev/refreshToken',
+    REFRESH_IDC_URL: 'https://oidc.{{region}}.amazonaws.com/token',
+    BASE_URL: 'https://q.{{region}}.amazonaws.com/generateAssistantResponse',
+    USAGE_LIMITS_URL: 'https://q.{{region}}.amazonaws.com/getUsageLimits',
+    DEFAULT_REGION: 'us-east-1',
+    AXIOS_TIMEOUT: 120000,
+    USER_AGENT: 'KiroIDE',
+    SDK_VERSION: '3.738.0',
+    SDK_VERSION_USAGE: '3.0.0',
+    CHAT_TRIGGER_TYPE_MANUAL: 'MANUAL',
+    ORIGIN_AI_EDITOR: 'AI_EDITOR'
+};
+export const MODEL_MAPPING = {
+    // Claude Haiku
+    'claude-haiku-4-5': 'claude-haiku-4.5',
+    'claude-haiku-4-5-thinking': 'claude-haiku-4.5',
+    // Claude Sonnet
+    'claude-sonnet-4': 'claude-sonnet-4',
+    'claude-sonnet-4-5': 'claude-sonnet-4.5',
+    'claude-sonnet-4-5-thinking': 'claude-sonnet-4.5',
+    'claude-sonnet-4-5-1m': 'claude-sonnet-4.5-1m',
+    'claude-sonnet-4-5-1m-thinking': 'claude-sonnet-4.5-1m',
+    'claude-sonnet-4-6': 'claude-sonnet-4.6',
+    'claude-sonnet-4-6-thinking': 'claude-sonnet-4.6',
+    'claude-sonnet-4-6-1m': 'claude-sonnet-4.6-1m',
+    'claude-sonnet-4-6-1m-thinking': 'claude-sonnet-4.6-1m',
+    // Wire id has no dot suffix and no .0/-1m variants (probe-confirmed; those 400).
+    'claude-sonnet-5': 'claude-sonnet-5',
+    'claude-sonnet-5-thinking': 'claude-sonnet-5',
+    // Claude Opus
+    'claude-opus-4-5': 'claude-opus-4.5',
+    'claude-opus-4-5-thinking': 'claude-opus-4.5',
+    'claude-opus-4-6': 'claude-opus-4.6',
+    'claude-opus-4-6-thinking': 'claude-opus-4.6',
+    'claude-opus-4-6-1m': 'claude-opus-4.6-1m',
+    'claude-opus-4-6-1m-thinking': 'claude-opus-4.6-1m',
+    'claude-opus-4-7': 'claude-opus-4.7',
+    'claude-opus-4-7-thinking': 'claude-opus-4.7',
+    'claude-opus-4-8': 'claude-opus-4.8',
+    'claude-opus-4-8-thinking': 'claude-opus-4.8',
+    // Auto
+    auto: 'auto',
+    // Open weight models
+    'deepseek-3.2': 'deepseek-3.2',
+    'glm-5': 'glm-5',
+    'minimax-m2.5': 'minimax-m2.5',
+    'minimax-m2.1': 'minimax-m2.1',
+    'qwen3-coder-next': 'qwen3-coder-next',
+    // Legacy / internal mappings kept for backwards compatibility
+    'claude-3-7-sonnet': 'CLAUDE_3_7_SONNET_20250219_V1_0',
+    'nova-swe': 'AGI_NOVA_SWE_V1_5',
+    'gpt-oss-120b': 'OPENAI_GPT_OSS_120B_1_0',
+    'minimax-m2': 'MINIMAX_MINIMAX_M2',
+    'kimi-k2-thinking': 'MOONSHOT_KIMI_K2_THINKING'
+};
+export const SUPPORTED_MODELS = Object.keys(MODEL_MAPPING);
+const LONG_CONTEXT_MODELS = new Set(Object.keys(MODEL_MAPPING).filter((k) => k.includes('-1m')));
+export function isLongContextModel(model) {
+    return LONG_CONTEXT_MODELS.has(model);
+}
+export const KIRO_AUTH_SERVICE = {
+    ENDPOINT: 'https://prod.{{region}}.auth.desktop.kiro.dev',
+    SSO_OIDC_ENDPOINT: 'https://oidc.{{region}}.amazonaws.com',
+    BUILDER_ID_START_URL: 'https://view.awsapps.com/start',
+    USER_INFO_URL: 'https://view.awsapps.com/api/user/info',
+    SCOPES: [
+        'codewhisperer:completions',
+        'codewhisperer:analysis',
+        'codewhisperer:conversations',
+        'codewhisperer:transformations',
+        'codewhisperer:taskassist'
+    ]
+};

package/dist/core/account/account-selector.d.ts

@@ -0,0 +1,25 @@
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+import type { AccountManager } from '../../plugin/accounts.js';
+import type { ManagedAccount } from '../../plugin/types.js';
+type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
+interface AccountSelectorConfig {
+    auto_sync_kiro_cli: boolean;
+    account_selection_strategy: 'sticky' | 'round-robin' | 'lowest-usage';
+}
+export declare class AccountSelector {
+    private accountManager;
+    private config;
+    private syncFromKiroCli;
+    private repository;
+    private triedEmptySync;
+    private circuitBreakerTrips;
+    private lastCircuitBreakerReset;
+    constructor(accountManager: AccountManager, config: AccountSelectorConfig, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
+    selectHealthyAccount(showToast: ToastFunction): Promise<ManagedAccount | null>;
+    private handleEmptyAccounts;
+    private formatUsageMessage;
+    private checkCircuitBreaker;
+    private resetCircuitBreaker;
+    private sleep;
+}
+export {};

package/dist/core/account/account-selector.js

@@ -0,0 +1,80 @@
+export class AccountSelector {
+    accountManager;
+    config;
+    syncFromKiroCli;
+    repository;
+    triedEmptySync = false;
+    circuitBreakerTrips = 0;
+    lastCircuitBreakerReset = Date.now();
+    constructor(accountManager, config, syncFromKiroCli, repository) {
+        this.accountManager = accountManager;
+        this.config = config;
+        this.syncFromKiroCli = syncFromKiroCli;
+        this.repository = repository;
+    }
+    async selectHealthyAccount(showToast) {
+        this.checkCircuitBreaker();
+        let count = this.accountManager.getAccountCount();
+        if (count === 0 && this.config.auto_sync_kiro_cli && !this.triedEmptySync) {
+            this.triedEmptySync = true;
+            await this.handleEmptyAccounts();
+            count = this.accountManager.getAccountCount();
+        }
+        if (count === 0) {
+            throw new Error('No accounts');
+        }
+        let acc = this.accountManager.getCurrentOrNext();
+        if (!acc) {
+            this.circuitBreakerTrips++;
+            const wait = this.accountManager.getMinWaitTime();
+            if (wait > 0 && wait < 30000) {
+                if (this.accountManager.shouldShowToast()) {
+                    showToast(`All accounts rate-limited. Waiting ${Math.ceil(wait / 1000)}s...`, 'warning');
+                }
+                await this.sleep(wait);
+                return null;
+            }
+            throw new Error('All accounts are unhealthy or rate-limited: reauth required');
+        }
+        this.resetCircuitBreaker();
+        const used = acc.usedCount ?? 0;
+        const limit = acc.limitCount ?? 0;
+        if (limit > 0 && used / limit >= 0.9 && this.accountManager.shouldShowUsageToast()) {
+            showToast(this.formatUsageMessage(used, limit, acc.email || ''), 'warning');
+        }
+        return acc;
+    }
+    async handleEmptyAccounts() {
+        await this.syncFromKiroCli();
+        this.repository.invalidateCache();
+        const accounts = await this.repository.findAll();
+        for (const a of accounts) {
+            this.accountManager.addAccount(a);
+        }
+    }
+    formatUsageMessage(usedCount, limitCount, email) {
+        if (limitCount > 0) {
+            const percentage = Math.round((usedCount / limitCount) * 100);
+            return `Usage (${email}): ${usedCount}/${limitCount} (${percentage}%)`;
+        }
+        return `Usage (${email}): ${usedCount}`;
+    }
+    checkCircuitBreaker() {
+        if (Date.now() - this.lastCircuitBreakerReset > 60000) {
+            this.circuitBreakerTrips = 0;
+            this.lastCircuitBreakerReset = Date.now();
+        }
+        if (this.circuitBreakerTrips >= 10) {
+            throw new Error('Circuit breaker tripped: Too many consecutive failures selecting accounts');
+        }
+    }
+    resetCircuitBreaker() {
+        if (this.circuitBreakerTrips > 0) {
+            this.circuitBreakerTrips = 0;
+            this.lastCircuitBreakerReset = Date.now();
+        }
+    }
+    sleep(ms) {
+        return new Promise((r) => setTimeout(r, ms));
+    }
+}

package/dist/core/account/usage-tracker.d.ts

@@ -0,0 +1,20 @@
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+import type { AccountManager } from '../../plugin/accounts.js';
+import type { KiroAuthDetails, ManagedAccount } from '../../plugin/types.js';
+interface UsageTrackerConfig {
+    usage_tracking_enabled: boolean;
+    usage_sync_max_retries: number;
+    usage_sync_cooldown_ms?: number;
+}
+export declare class UsageTracker {
+    private config;
+    private accountManager;
+    private repository;
+    private lastSyncTime;
+    private readonly cooldownMs;
+    constructor(config: UsageTrackerConfig, accountManager: AccountManager, repository: AccountRepository);
+    syncUsage(account: ManagedAccount, auth: KiroAuthDetails): Promise<void>;
+    private syncWithRetry;
+    private sleep;
+}
+export {};

package/dist/core/account/usage-tracker.js

@@ -0,0 +1,56 @@
+import * as logger from '../../plugin/logger.js';
+import { fetchUsageLimits, updateAccountQuota } from '../../plugin/usage.js';
+export class UsageTracker {
+    config;
+    accountManager;
+    repository;
+    lastSyncTime = new Map();
+    cooldownMs;
+    constructor(config, accountManager, repository) {
+        this.config = config;
+        this.accountManager = accountManager;
+        this.repository = repository;
+        this.cooldownMs = config.usage_sync_cooldown_ms ?? 60000;
+    }
+    async syncUsage(account, auth) {
+        if (!this.config.usage_tracking_enabled)
+            return;
+        const last = this.lastSyncTime.get(account.id) ?? 0;
+        if (Date.now() - last < this.cooldownMs)
+            return;
+        this.lastSyncTime.set(account.id, Date.now());
+        this.syncWithRetry(account, auth, 0).catch((e) => {
+            logger.warn('Usage sync failed after all retries', {
+                accountId: account.id,
+                error: e instanceof Error ? e.message : String(e)
+            });
+        });
+    }
+    async syncWithRetry(account, auth, attempt) {
+        try {
+            const u = await fetchUsageLimits(auth);
+            updateAccountQuota(account, u, this.accountManager);
+            await this.repository.batchSave(this.accountManager.getAccounts());
+        }
+        catch (e) {
+            if (attempt < this.config.usage_sync_max_retries) {
+                await this.sleep(1000 * Math.pow(2, attempt));
+                return this.syncWithRetry(account, auth, attempt + 1);
+            }
+            if (e.message?.includes('FEATURE_NOT_SUPPORTED')) {
+                // Some IDC profiles don't support getUsageLimits; don't penalize the account.
+                return;
+            }
+            if (e.message?.includes('403') ||
+                e.message?.includes('invalid') ||
+                e.message?.includes('bearer token')) {
+                this.accountManager.markUnhealthy(account, e.message);
+                this.repository.save(account).catch(() => { });
+            }
+            throw e;
+        }
+    }
+    sleep(ms) {
+        return new Promise((r) => setTimeout(r, ms));
+    }
+}

package/dist/core/auth/auth-handler.d.ts

@@ -0,0 +1,18 @@
+import type { AuthHook } from '@opencode-ai/plugin';
+import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
+type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
+export declare class AuthHandler {
+    private config;
+    private repository;
+    private accountManager?;
+    constructor(config: any, repository: AccountRepository);
+    initialize(showToast?: ToastFunction): Promise<void>;
+    private logUsageSummary;
+    setAccountManager(am: any): void;
+    /** Summarize stored accounts for a label; guards limit=0 divide-by-zero. */
+    private buildUsageSummary;
+    /** Format a single account as a select-option label for the remove flow. */
+    private formatAccountOption;
+    getMethods(): AuthHook['methods'];
+}
+export {};