@sunerpy/opencode-kiro-auth 0.1.0

package/dist/infrastructure/transformers/message-transformer.js

@@ -0,0 +1,99 @@
+export function sanitizeHistory(history) {
+    const result = [];
+    for (let i = 0; i < history.length; i++) {
+        const m = history[i];
+        if (!m)
+            continue;
+        if (m.assistantResponseMessage?.toolUses) {
+            const next = history[i + 1];
+            if (next?.userInputMessage?.userInputMessageContext?.toolResults) {
+                result.push(m);
+            }
+        }
+        else if (m.userInputMessage?.userInputMessageContext?.toolResults) {
+            const prev = result[result.length - 1];
+            if (prev?.assistantResponseMessage?.toolUses) {
+                result.push(m);
+            }
+        }
+        else {
+            result.push(m);
+        }
+    }
+    while (result.length > 0) {
+        const first = result[0];
+        if (first?.userInputMessage && !first.userInputMessage.userInputMessageContext?.toolResults)
+            break;
+        result.shift();
+    }
+    if (result.length === 0)
+        return [];
+    while (result.length > 0 && result[result.length - 1]?.assistantResponseMessage) {
+        result.pop();
+    }
+    return result;
+}
+export function findOriginalToolCall(msgs, toolUseId) {
+    for (const m of msgs) {
+        if (m.role === 'assistant') {
+            if (m.tool_calls) {
+                for (const tc of m.tool_calls)
+                    if (tc.id === toolUseId)
+                        return tc;
+            }
+            if (Array.isArray(m.content)) {
+                for (const p of m.content)
+                    if (p.type === 'tool_use' && p.id === toolUseId)
+                        return p;
+            }
+        }
+    }
+    return null;
+}
+export function mergeAdjacentMessages(msgs) {
+    const merged = [];
+    for (const m of msgs) {
+        if (!merged.length)
+            merged.push({ ...m });
+        else {
+            const last = merged[merged.length - 1];
+            if (last && m.role === last.role) {
+                if (Array.isArray(last.content) && Array.isArray(m.content))
+                    last.content.push(...m.content);
+                else if (typeof last.content === 'string' && typeof m.content === 'string')
+                    last.content += '\n' + m.content;
+                else if (Array.isArray(last.content) && typeof m.content === 'string')
+                    last.content.push({ type: 'text', text: m.content });
+                else if (typeof last.content === 'string' && Array.isArray(m.content))
+                    last.content = [{ type: 'text', text: last.content }, ...m.content];
+                if (m.tool_calls) {
+                    if (!last.tool_calls)
+                        last.tool_calls = [];
+                    last.tool_calls.push(...m.tool_calls);
+                }
+                if (m.role === 'tool') {
+                    if (!last.tool_results)
+                        last.tool_results = [{ content: last.content, tool_call_id: last.tool_call_id }];
+                    last.tool_results.push({ content: m.content, tool_call_id: m.tool_call_id });
+                }
+            }
+            else
+                merged.push({ ...m });
+        }
+    }
+    return merged;
+}
+export function getContentText(m) {
+    if (!m)
+        return '';
+    if (typeof m === 'string')
+        return m;
+    if (typeof m.content === 'string')
+        return m.content;
+    if (Array.isArray(m.content))
+        return m.content
+            .filter((p) => p.type === 'text')
+            .map((p) => p.text || '')
+            .join('');
+    return m.text || '';
+}

package/dist/infrastructure/transformers/tool-call-parser.d.ts

@@ -0,0 +1,4 @@
+import type { ToolCall } from '../../plugin/types.js';
+export declare function parseBracketToolCalls(text: string): ToolCall[];
+export declare function deduplicateToolCalls(toolCalls: ToolCall[]): ToolCall[];
+export declare function cleanToolCallsFromText(text: string, toolCalls: ToolCall[]): string;

package/dist/infrastructure/transformers/tool-call-parser.js

@@ -0,0 +1,45 @@
+export function parseBracketToolCalls(text) {
+    const toolCalls = [];
+    const pattern = /\[Called\s+(\w+)\s+with\s+args:\s*(\{[^}]*(?:\{[^}]*\}[^}]*)*\})\]/gs;
+    let match;
+    while ((match = pattern.exec(text)) !== null) {
+        const funcName = match[1];
+        const argsStr = match[2];
+        if (!funcName || !argsStr)
+            continue;
+        try {
+            const args = JSON.parse(argsStr);
+            toolCalls.push({
+                toolUseId: `tool_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`,
+                name: funcName,
+                input: args
+            });
+        }
+        catch (e) {
+            continue;
+        }
+    }
+    return toolCalls;
+}
+export function deduplicateToolCalls(toolCalls) {
+    const seen = new Set();
+    const unique = [];
+    for (const tc of toolCalls) {
+        if (!seen.has(tc.toolUseId)) {
+            seen.add(tc.toolUseId);
+            unique.push(tc);
+        }
+    }
+    return unique;
+}
+export function cleanToolCallsFromText(text, toolCalls) {
+    let cleaned = text;
+    for (const tc of toolCalls) {
+        const funcName = tc.name;
+        const escapedName = funcName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const pattern = new RegExp(`\\[Called\\s+${escapedName}\\s+with\\s+args:\\s*\\{[^}]*(?:\\{[^}]*\\}[^}]*)*\\}\\]`, 'gs');
+        cleaned = cleaned.replace(pattern, '');
+    }
+    cleaned = cleaned.replace(/\s+/g, ' ').trim();
+    return cleaned;
+}

package/dist/infrastructure/transformers/tool-transformer.d.ts

@@ -0,0 +1,2 @@
+export declare function convertToolsToCodeWhisperer(tools: any[]): any[];
+export declare function deduplicateToolResults(trs: any[]): any[];

package/dist/infrastructure/transformers/tool-transformer.js

@@ -0,0 +1,19 @@
+export function convertToolsToCodeWhisperer(tools) {
+    return tools.map((t) => ({
+        toolSpecification: {
+            name: t.name || t.function?.name,
+            description: (t.description || t.function?.description || '').substring(0, 9216),
+            inputSchema: { json: t.input_schema || t.function?.parameters || {} }
+        }
+    }));
+}
+export function deduplicateToolResults(trs) {
+    const u = [], s = new Set();
+    for (const t of trs) {
+        if (!s.has(t.toolUseId)) {
+            s.add(t.toolUseId);
+            u.push(t);
+        }
+    }
+    return u;
+}

package/dist/kiro/auth.d.ts

@@ -0,0 +1,4 @@
+import type { KiroAuthDetails, RefreshParts } from '../plugin/types.js';
+export declare function decodeRefreshToken(refresh: string): RefreshParts;
+export declare function accessTokenExpired(auth: KiroAuthDetails, bufferMs?: number): boolean;
+export declare function encodeRefreshToken(parts: RefreshParts): string;

package/dist/kiro/auth.js

@@ -0,0 +1,25 @@
+export function decodeRefreshToken(refresh) {
+    const parts = refresh.split('|');
+    if (parts.length < 2)
+        return { refreshToken: parts[0], authMethod: 'desktop' };
+    const refreshToken = parts[0];
+    const authMethod = parts[parts.length - 1];
+    if (authMethod === 'idc')
+        return { refreshToken, clientId: parts[1], clientSecret: parts[2], authMethod: 'idc' };
+    if (authMethod === 'desktop')
+        return { refreshToken, authMethod: 'desktop' };
+    return { refreshToken, authMethod: 'desktop' };
+}
+export function accessTokenExpired(auth, bufferMs = 120000) {
+    if (!auth.access || !auth.expires)
+        return true;
+    return Date.now() >= auth.expires - bufferMs;
+}
+export function encodeRefreshToken(parts) {
+    if (parts.authMethod === 'idc') {
+        if (!parts.clientId || !parts.clientSecret)
+            throw new Error('Missing credentials');
+        return `${parts.refreshToken}|${parts.clientId}|${parts.clientSecret}|idc`;
+    }
+    return `${parts.refreshToken}|desktop`;
+}

package/dist/kiro/oauth-idc.d.ts

@@ -0,0 +1,25 @@
+import type { KiroRegion } from '../plugin/types.js';
+export interface KiroIDCAuthorization {
+    verificationUrl: string;
+    verificationUriComplete: string;
+    userCode: string;
+    deviceCode: string;
+    clientId: string;
+    clientSecret: string;
+    interval: number;
+    expiresIn: number;
+    region: KiroRegion;
+    startUrl: string;
+}
+export interface KiroIDCTokenResult {
+    refreshToken: string;
+    accessToken: string;
+    expiresAt: number;
+    email: string;
+    clientId: string;
+    clientSecret: string;
+    region: KiroRegion;
+    authMethod: 'idc';
+}
+export declare function authorizeKiroIDC(region?: KiroRegion, startUrl?: string): Promise<KiroIDCAuthorization>;
+export declare function pollKiroIDCToken(clientId: string, clientSecret: string, deviceCode: string, interval: number, expiresIn: number, region: KiroRegion): Promise<KiroIDCTokenResult>;

package/dist/kiro/oauth-idc.js

@@ -0,0 +1,167 @@
+import { KIRO_AUTH_SERVICE, KIRO_CONSTANTS, buildUrl, normalizeRegion } from '../constants.js';
+export async function authorizeKiroIDC(region, startUrl) {
+    const effectiveRegion = normalizeRegion(region);
+    const ssoOIDCEndpoint = buildUrl(KIRO_AUTH_SERVICE.SSO_OIDC_ENDPOINT, effectiveRegion);
+    const effectiveStartUrl = startUrl || KIRO_AUTH_SERVICE.BUILDER_ID_START_URL;
+    try {
+        const registerResponse = await fetch(`${ssoOIDCEndpoint}/client/register`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': KIRO_CONSTANTS.USER_AGENT
+            },
+            body: JSON.stringify({
+                clientName: 'Kiro IDE',
+                clientType: 'public',
+                scopes: KIRO_AUTH_SERVICE.SCOPES,
+                grantTypes: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token']
+            })
+        });
+        if (!registerResponse.ok) {
+            const errorText = await registerResponse.text().catch(() => '');
+            const error = new Error(`Client registration failed: ${registerResponse.status} ${errorText}`);
+            throw error;
+        }
+        const registerData = await registerResponse.json();
+        const { clientId, clientSecret } = registerData;
+        if (!clientId || !clientSecret) {
+            const error = new Error('Client registration response missing clientId or clientSecret');
+            throw error;
+        }
+        const deviceAuthResponse = await fetch(`${ssoOIDCEndpoint}/device_authorization`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': KIRO_CONSTANTS.USER_AGENT
+            },
+            body: JSON.stringify({
+                clientId,
+                clientSecret,
+                startUrl: effectiveStartUrl
+            })
+        });
+        if (!deviceAuthResponse.ok) {
+            const errorText = await deviceAuthResponse.text().catch(() => '');
+            const error = new Error(`Device authorization failed: ${deviceAuthResponse.status} ${errorText}`);
+            throw error;
+        }
+        const deviceAuthData = await deviceAuthResponse.json();
+        const { verificationUri, verificationUriComplete, userCode, deviceCode, interval = 5, expiresIn = 600 } = deviceAuthData;
+        if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete) {
+            const error = new Error('Device authorization response missing required fields');
+            throw error;
+        }
+        return {
+            verificationUrl: verificationUri,
+            verificationUriComplete,
+            userCode,
+            deviceCode,
+            clientId,
+            clientSecret,
+            interval,
+            expiresIn,
+            region: effectiveRegion,
+            startUrl: effectiveStartUrl
+        };
+    }
+    catch (error) {
+        throw error;
+    }
+}
+export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, interval, expiresIn, region) {
+    if (!clientId || !clientSecret || !deviceCode) {
+        const error = new Error('Missing required parameters for token polling');
+        throw error;
+    }
+    const effectiveRegion = normalizeRegion(region);
+    const ssoOIDCEndpoint = buildUrl(KIRO_AUTH_SERVICE.SSO_OIDC_ENDPOINT, effectiveRegion);
+    const maxAttempts = Math.floor(expiresIn / interval);
+    let currentInterval = interval * 1000;
+    let attempts = 0;
+    while (attempts < maxAttempts) {
+        attempts++;
+        await new Promise((resolve) => setTimeout(resolve, currentInterval));
+        try {
+            const tokenResponse = await fetch(`${ssoOIDCEndpoint}/token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'User-Agent': KIRO_CONSTANTS.USER_AGENT
+                },
+                body: JSON.stringify({
+                    clientId,
+                    clientSecret,
+                    deviceCode,
+                    grantType: 'urn:ietf:params:oauth:grant-type:device_code'
+                })
+            });
+            const responseText = await tokenResponse.text().catch(() => '');
+            let tokenData = {};
+            if (responseText) {
+                try {
+                    tokenData = JSON.parse(responseText);
+                }
+                catch (parseError) {
+                    throw new Error(`Token polling failed: invalid JSON response (HTTP ${tokenResponse.status}): ${responseText.slice(0, 300)}`);
+                }
+            }
+            if (tokenData.error) {
+                const errorType = tokenData.error;
+                if (errorType === 'authorization_pending') {
+                    continue;
+                }
+                if (errorType === 'slow_down') {
+                    currentInterval += 5000;
+                    continue;
+                }
+                if (errorType === 'expired_token') {
+                    const error = new Error('Device code has expired. Please restart the authorization process.');
+                    throw error;
+                }
+                if (errorType === 'access_denied') {
+                    const error = new Error('Authorization was denied by the user.');
+                    throw error;
+                }
+                const error = new Error(`Token polling failed: ${errorType} - ${tokenData.error_description || ''}`);
+                throw error;
+            }
+            const accessToken = tokenData.access_token || tokenData.accessToken;
+            const refreshToken = tokenData.refresh_token || tokenData.refreshToken;
+            const tokenExpiresIn = tokenData.expires_in || tokenData.expiresIn;
+            if (accessToken && refreshToken) {
+                const expiresInSeconds = tokenExpiresIn || 3600;
+                const expiresAt = Date.now() + expiresInSeconds * 1000;
+                return {
+                    refreshToken,
+                    accessToken,
+                    expiresAt,
+                    email: 'builder-id@aws.amazon.com',
+                    clientId,
+                    clientSecret,
+                    region: effectiveRegion,
+                    authMethod: 'idc'
+                };
+            }
+            if (!tokenResponse.ok) {
+                const error = new Error(`Token request failed with status: ${tokenResponse.status} ${responseText ? `(${responseText.slice(0, 200)})` : ''}`);
+                throw error;
+            }
+            // If the service returned HTTP 200 but no tokens and no error, treat as invalid response.
+            throw new Error(`Token polling failed: missing tokens in response: ${responseText ? responseText.slice(0, 300) : '[empty]'}`);
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                (error.message.includes('expired') ||
+                    error.message.includes('denied') ||
+                    error.message.includes('failed'))) {
+                throw error;
+            }
+            if (attempts >= maxAttempts) {
+                const finalError = new Error(`Token polling failed after ${attempts} attempts: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                throw finalError;
+            }
+        }
+    }
+    const timeoutError = new Error('Token polling timed out. Authorization may have expired.');
+    throw timeoutError;
+}

package/dist/plugin/accounts.d.ts

@@ -0,0 +1,29 @@
+import type { AccountSelectionStrategy, KiroAuthDetails, ManagedAccount } from './types.js';
+export declare function createDeterministicAccountId(email: string, method: string, clientId?: string, profileArn?: string): string;
+export declare class AccountManager {
+    private accounts;
+    private cursor;
+    private strategy;
+    private lastToastTime;
+    private lastUsageToastTime;
+    constructor(accounts: ManagedAccount[], strategy?: AccountSelectionStrategy);
+    static loadFromDisk(strategy?: AccountSelectionStrategy): Promise<AccountManager>;
+    getAccountCount(): number;
+    getAccounts(): ManagedAccount[];
+    shouldShowToast(debounce?: number): boolean;
+    shouldShowUsageToast(debounce?: number): boolean;
+    getMinWaitTime(): number;
+    getCurrentOrNext(): ManagedAccount | null;
+    updateUsage(id: string, meta: {
+        usedCount: number;
+        limitCount: number;
+        email?: string;
+    }): void;
+    addAccount(a: ManagedAccount): void;
+    removeAccount(a: ManagedAccount): void;
+    updateFromAuth(a: ManagedAccount, auth: KiroAuthDetails): void;
+    markRateLimited(a: ManagedAccount, ms: number): void;
+    markUnhealthy(a: ManagedAccount, reason: string, recovery?: number): void;
+    saveToDisk(): Promise<void>;
+    toAuthDetails(a: ManagedAccount): KiroAuthDetails;
+}