@sunerpy/opencode-kiro-auth 0.10.0 → 0.11.0

package/README.md

@@ -112,6 +112,11 @@ Paid-overage protection is on by default; see
 [Overage protection](docs/CONFIGURATION.md#overage-protection) before disabling
 `stop_on_overage`.
 
+Running multiple OpenCode processes at once? `distribute_across_processes`
+(default `true`) and `per_request_spread` (default `false`) control how load
+spreads across accounts — see
+[Account distribution across processes](docs/CONFIGURATION.md#account-distribution-across-processes).
+
 ## Multiple accounts & rotation
 
 You can register more than one Kiro account and let the plugin spread

package/dist/plugin/accounts.d.ts

@@ -8,6 +8,8 @@ export declare class AccountManager {
     private lastUsageToastTime;
     private rrCursor;
     private stickyId?;
+    private startIndex;
+    private perRequestSpread;
     private quotaAvoidanceEnabled;
     private quotaReserveThreshold;
     private stopOnOverage;
@@ -17,12 +19,16 @@ export declare class AccountManager {
         quotaReserveThreshold?: number;
         stopOnOverage?: boolean;
         overageThreshold?: number;
+        startIndex?: number;
+        perRequestSpread?: boolean;
     });
     static loadFromDisk(strategy?: AccountSelectionStrategy, opts?: {
         quotaAvoidanceEnabled?: boolean;
         quotaReserveThreshold?: number;
         stopOnOverage?: boolean;
         overageThreshold?: number;
+        distributeAcrossProcesses?: boolean;
+        perRequestSpread?: boolean;
     }): Promise<AccountManager>;
     getAccountCount(): number;
     getAccounts(): ManagedAccount[];

package/dist/plugin/accounts.js

@@ -15,8 +15,10 @@ export class AccountManager {
     strategy;
     lastToastTime = 0;
     lastUsageToastTime = 0;
-    rrCursor = 0;
+    rrCursor;
     stickyId;
+    startIndex;
+    perRequestSpread;
     quotaAvoidanceEnabled;
     quotaReserveThreshold;
     stopOnOverage;
@@ -29,6 +31,9 @@ export class AccountManager {
         this.quotaReserveThreshold = opts?.quotaReserveThreshold ?? 0.95;
         this.stopOnOverage = opts?.stopOnOverage ?? true;
         this.overageThreshold = opts?.overageThreshold ?? 0;
+        this.startIndex = opts?.startIndex ?? 0;
+        this.perRequestSpread = opts?.perRequestSpread ?? false;
+        this.rrCursor = this.startIndex;
     }
     static async loadFromDisk(strategy, opts) {
         const rows = kiroDb.getAccounts();
@@ -56,7 +61,23 @@ export class AccountManager {
             overageCount: r.overage_count || 0,
             lastSync: r.last_sync
         }));
-        return new AccountManager(accounts, strategy || 'sticky', opts);
+        let startIndex = 0;
+        if (opts?.distributeAcrossProcesses !== false) {
+            try {
+                startIndex = await kiroDb.nextAssignmentIndex();
+            }
+            catch (error) {
+                logger.warn('assignment index failed, using 0', {
+                    error: error instanceof Error ? error.message : String(error)
+                });
+                startIndex = 0;
+            }
+        }
+        return new AccountManager(accounts, strategy || 'sticky', {
+            ...opts,
+            startIndex,
+            perRequestSpread: opts?.perRequestSpread
+        });
     }
     getAccountCount() {
         return this.accounts.length;
@@ -140,10 +161,26 @@ export class AccountManager {
             const nearFull = available.filter((a) => ratio(a) >= this.quotaReserveThreshold);
             candidatePool = ample.length > 0 ? ample : nearFull;
         }
+        const sorted = [...this.accounts].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        const N = sorted.length;
         let selected;
         if (candidatePool.length > 0) {
-            if (this.strategy === 'sticky') {
-                selected = candidatePool.find((a) => a.id === this.stickyId) || candidatePool[0];
+            if (this.perRequestSpread) {
+                selected = [...candidatePool].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            }
+            else if (this.strategy === 'sticky') {
+                if (this.stickyId) {
+                    selected = candidatePool.find((a) => a.id === this.stickyId);
+                }
+                if (!selected) {
+                    for (let k = 0; k < N; k++) {
+                        const candidate = sorted[(this.startIndex + k) % N];
+                        if (candidate && candidatePool.some((account) => account.id === candidate.id)) {
+                            selected = candidate;
+                            break;
+                        }
+                    }
+                }
                 if (selected)
                     this.stickyId = selected.id;
             }
@@ -151,8 +188,21 @@ export class AccountManager {
                 selected = candidatePool[this.rrCursor % candidatePool.length];
                 this.rrCursor++;
             }
-            else if (this.strategy === 'lowest-usage') {
-                selected = [...candidatePool].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            else {
+                const sortedIndexById = new Map(sorted.map((account, index) => [account.id, index]));
+                selected = [...candidatePool].sort((a, b) => {
+                    const usageDifference = (a.usedCount || 0) - (b.usedCount || 0);
+                    if (usageDifference !== 0)
+                        return usageDifference;
+                    const lastUsedDifference = (a.lastUsed || 0) - (b.lastUsed || 0);
+                    if (lastUsedDifference !== 0)
+                        return lastUsedDifference;
+                    const aIndex = sortedIndexById.get(a.id) ?? 0;
+                    const bIndex = sortedIndexById.get(b.id) ?? 0;
+                    const aOffset = (((aIndex - this.startIndex) % N) + N) % N;
+                    const bOffset = (((bIndex - this.startIndex) % N) + N) % N;
+                    return aOffset - bOffset;
+                })[0];
             }
         }
         if (!selected) {

package/dist/plugin/config/schema.d.ts

@@ -19,6 +19,16 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region: z.ZodOptional<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     idc_profile_arn: z.ZodOptional<z.ZodString>;
     account_selection_strategy: z.ZodDefault<z.ZodEnum<["sticky", "round-robin", "lowest-usage"]>>;
+    /**
+     * Give each process a distinct start index so simultaneous starts spread
+     * across accounts.
+     */
+    distribute_across_processes: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Re-pick the lowest-usage account for every request instead of pinning one.
+     * Overrides sticky selection.
+     */
+    per_request_spread: z.ZodDefault<z.ZodBoolean>;
     /**
      * Softly avoid accounts whose usage ratio is at/above
      * `quota_reserve_threshold` when other accounts still have room. When ALL
@@ -84,6 +94,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     auto_effort_mapping: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     account_selection_strategy: "sticky" | "round-robin" | "lowest-usage";
+    distribute_across_processes: boolean;
+    per_request_spread: boolean;
     quota_avoidance_enabled: boolean;
     quota_reserve_threshold: number;
     stop_on_overage: boolean;
@@ -115,6 +127,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     idc_profile_arn?: string | undefined;
     account_selection_strategy?: "sticky" | "round-robin" | "lowest-usage" | undefined;
+    distribute_across_processes?: boolean | undefined;
+    per_request_spread?: boolean | undefined;
     quota_avoidance_enabled?: boolean | undefined;
     quota_reserve_threshold?: number | undefined;
     stop_on_overage?: boolean | undefined;

package/dist/plugin/config/schema.js

@@ -51,6 +51,16 @@ export const KiroConfigSchema = z.object({
     idc_region: RegionSchema.optional(),
     idc_profile_arn: z.string().optional(),
     account_selection_strategy: AccountSelectionStrategySchema.default('lowest-usage'),
+    /**
+     * Give each process a distinct start index so simultaneous starts spread
+     * across accounts.
+     */
+    distribute_across_processes: z.boolean().default(true),
+    /**
+     * Re-pick the lowest-usage account for every request instead of pinning one.
+     * Overrides sticky selection.
+     */
+    per_request_spread: z.boolean().default(false),
     /**
      * Softly avoid accounts whose usage ratio is at/above
      * `quota_reserve_threshold` when other accounts still have room. When ALL
@@ -117,6 +127,8 @@ export const KiroConfigSchema = z.object({
 });
 export const DEFAULT_CONFIG = {
     account_selection_strategy: 'lowest-usage',
+    distribute_across_processes: true,
+    per_request_spread: false,
     quota_avoidance_enabled: true,
     quota_reserve_threshold: 0.95,
     stop_on_overage: true,

package/dist/plugin/storage/locked-operations.d.ts

@@ -1,6 +1,7 @@
 import type { ManagedAccount } from '../types.js';
 export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
+export declare function withDatabaseLockSync<T>(dbPath: string, fn: () => T): T;
 export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;

package/dist/plugin/storage/locked-operations.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { existsSync, promises as fs } from 'node:fs';
+import { existsSync, promises as fs, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
@@ -30,6 +30,47 @@ const KEEP_ALIVE_LOCK_OPTIONS = {
     retries: 0,
     realpath: false
 };
+const SYNC_LOCK_OPTIONS = { stale: 10000, retries: 0, realpath: false };
+const SYNC_LOCK_DEADLINE_MS = 10000;
+function blockingBackoff(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function isLockContention(e) {
+    return typeof e === 'object' && e !== null && 'code' in e && e.code === 'ELOCKED';
+}
+export function withDatabaseLockSync(dbPath, fn) {
+    if (!existsSync(dbPath)) {
+        mkdirSync(dirname(dbPath), { recursive: true });
+        writeFileSync(dbPath, '');
+    }
+    // proper-lockfile's sync API rejects a retries object, so bounded lock-acquisition backoff is
+    // done here to serialize the synchronous constructor/init (schema + migrations) across processes.
+    const deadline = Date.now() + SYNC_LOCK_DEADLINE_MS;
+    let release = null;
+    let attempt = 0;
+    for (;;) {
+        try {
+            release = lockfile.lockSync(dbPath, SYNC_LOCK_OPTIONS);
+            break;
+        }
+        catch (e) {
+            if (!isLockContention(e) || Date.now() >= deadline)
+                throw e;
+            blockingBackoff(Math.min(100 * 2 ** attempt++, 500));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        try {
+            release();
+        }
+        catch (e) {
+            console.warn('Failed to release lock:', e);
+        }
+    }
+}
 export async function withDatabaseLock(dbPath, fn) {
     if (!existsSync(dbPath)) {
         const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));

package/dist/plugin/storage/migrations.js

@@ -7,15 +7,22 @@ export function runMigrations(db) {
     migrateDropRefreshTokenUniqueIndex(db);
     migrateRemovedAccountsTable(db);
     migrateOverageColumn(db);
+    migratePluginMetaTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
-    const hasIndex = db
-        .prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'")
-        .get();
-    if (hasIndex)
+    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
+    if (indexProbe.get())
         return;
-    db.exec('BEGIN TRANSACTION');
+    // BEGIN IMMEDIATE (not deferred BEGIN): a deferred read-then-write txn raises unrecoverable
+    // SQLITE_BUSY_SNAPSHOT (busy_timeout cannot retry it) if another connection writes after the
+    // read snapshot. Taking the write lock at BEGIN makes concurrent processes serialize via
+    // busy_timeout instead of racing into a snapshot conflict.
+    db.exec('BEGIN IMMEDIATE');
     try {
+        if (indexProbe.get()) {
+            db.exec('COMMIT');
+            return;
+        }
         const duplicates = db
             .prepare(`
         SELECT refresh_token, COUNT(*) as count 
@@ -167,3 +174,6 @@ function migrateOverageColumn(db) {
         db.exec('ALTER TABLE accounts ADD COLUMN overage_count INTEGER DEFAULT 0');
     }
 }
+function migratePluginMetaTable(db) {
+    db.exec('CREATE TABLE IF NOT EXISTS plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+}

package/dist/plugin/storage/sqlite.d.ts

@@ -18,6 +18,7 @@ export declare class KiroDatabase {
     isAccountRemoved(id: string): Promise<boolean>;
     clearRemovedAccount(id: string): Promise<void>;
     listRemovedAccounts(): Promise<string[]>;
+    nextAssignmentIndex(): Promise<number>;
     markAccountsUnhealthy(ids: string[], reason: string): Promise<void>;
     private rowToAccount;
     close(): void;

package/dist/plugin/storage/sqlite.js

@@ -2,7 +2,7 @@ import Database from 'libsql';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { deduplicateAccounts, mergeAccounts, withDatabaseLock } from './locked-operations.js';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLock, withDatabaseLockSync } from './locked-operations.js';
 import { runMigrations } from './migrations.js';
 function getBaseDir() {
     const p = process.platform;
@@ -21,7 +21,7 @@ export class KiroDatabase {
             mkdirSync(dir, { recursive: true });
         this.db = new Database(path);
         this.db.pragma('busy_timeout = 5000');
-        this.init();
+        withDatabaseLockSync(this.path, () => this.init());
     }
     init() {
         this.db.pragma('journal_mode = WAL');
@@ -185,6 +185,14 @@ export class KiroDatabase {
     async listRemovedAccounts() {
         return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
     }
+    async nextAssignmentIndex() {
+        return withDatabaseLock(this.path, async () => {
+            const row = this.db
+                .prepare("INSERT INTO plugin_meta(key,value) VALUES('assignment_cursor',0) ON CONFLICT(key) DO UPDATE SET value=value+1 RETURNING value")
+                .get();
+            return row?.value ?? 0;
+        });
+    }
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;

package/dist/plugin.js

@@ -52,7 +52,9 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
         quotaAvoidanceEnabled: config.quota_avoidance_enabled,
         quotaReserveThreshold: config.quota_reserve_threshold,
         stopOnOverage: config.stop_on_overage,
-        overageThreshold: config.overage_threshold
+        overageThreshold: config.overage_threshold,
+        distributeAcrossProcesses: config.distribute_across_processes,
+        perRequestSpread: config.per_request_spread
     });
     authHandler.setAccountManager(accountManager);
     const requestHandler = new RequestHandler(accountManager, config, repository, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",