@sunerpy/opencode-kiro-auth 0.13.1 → 0.13.2

package/dist/core/account/account-selector.d.ts

@@ -15,7 +15,8 @@ export declare class AccountSelector {
     private circuitBreakerTrips;
     private lastCircuitBreakerReset;
     constructor(accountManager: AccountManager, config: AccountSelectorConfig, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
-    selectHealthyAccount(showToast: ToastFunction): Promise<ManagedAccount | null>;
+    selectHealthyAccount(showToast: ToastFunction, signal?: AbortSignal): Promise<ManagedAccount | null>;
+    selectAlternativeAccount(excludedIds: ReadonlySet<string>): Promise<ManagedAccount | null>;
     private handleEmptyAccounts;
     private formatUsageMessage;
     private checkCircuitBreaker;

package/dist/core/account/account-selector.js

@@ -12,7 +12,7 @@ export class AccountSelector {
         this.syncFromKiroCli = syncFromKiroCli;
         this.repository = repository;
     }
-    async selectHealthyAccount(showToast) {
+    async selectHealthyAccount(showToast, signal) {
         this.checkCircuitBreaker();
         let count = this.accountManager.getAccountCount();
         if (count === 0 && this.config.auto_sync_kiro_cli && !this.triedEmptySync) {
@@ -34,7 +34,7 @@ export class AccountSelector {
                 if (this.accountManager.shouldShowToast()) {
                     showToast(`All accounts rate-limited. Waiting ${Math.ceil(wait / 1000)}s...`, 'warning');
                 }
-                await this.sleep(wait);
+                await this.sleep(wait, signal);
                 return null;
             }
             throw new Error('All accounts are unhealthy or rate-limited: reauth required');
@@ -47,6 +47,9 @@ export class AccountSelector {
         }
         return acc;
     }
+    async selectAlternativeAccount(excludedIds) {
+        return this.accountManager.getCurrentOrNext({ excludedIds, recoverUnhealthy: false });
+    }
     async handleEmptyAccounts() {
         await this.syncFromKiroCli();
         this.repository.invalidateCache();
@@ -77,7 +80,20 @@ export class AccountSelector {
             this.lastCircuitBreakerReset = Date.now();
         }
     }
-    sleep(ms) {
-        return new Promise((r) => setTimeout(r, ms));
+    sleep(ms, signal) {
+        if (signal?.aborted)
+            return Promise.reject(signal.reason);
+        let onAbort;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(resolve, ms);
+            onAbort = () => {
+                clearTimeout(timer);
+                reject(signal?.reason);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+        }).finally(() => {
+            if (onAbort)
+                signal?.removeEventListener('abort', onAbort);
+        });
     }
 }

package/dist/core/account/usage-tracker.d.ts

@@ -13,7 +13,7 @@ export declare class UsageTracker {
     private lastSyncTime;
     private readonly cooldownMs;
     constructor(config: UsageTrackerConfig, accountManager: AccountManager, repository: AccountRepository);
-    syncUsage(account: ManagedAccount, auth: KiroAuthDetails): Promise<void>;
+    syncUsage(account: ManagedAccount, auth: KiroAuthDetails, isValid?: () => boolean): Promise<void>;
     private syncWithRetry;
     private sleep;
 }

package/dist/core/account/usage-tracker.js

@@ -12,30 +12,40 @@ export class UsageTracker {
         this.repository = repository;
         this.cooldownMs = config.usage_sync_cooldown_ms ?? 60000;
     }
-    async syncUsage(account, auth) {
+    async syncUsage(account, auth, isValid = () => true) {
         if (!this.config.usage_tracking_enabled)
             return;
+        if (!isValid())
+            return;
         const last = this.lastSyncTime.get(account.id) ?? 0;
         if (Date.now() - last < this.cooldownMs)
             return;
         this.lastSyncTime.set(account.id, Date.now());
-        this.syncWithRetry(account, auth, 0).catch((e) => {
+        this.syncWithRetry(account, auth, 0, isValid).catch((e) => {
             logger.warn('Usage sync failed after all retries', {
                 accountId: account.id,
                 error: e instanceof Error ? e.message : String(e)
             });
         });
     }
-    async syncWithRetry(account, auth, attempt) {
+    async syncWithRetry(account, auth, attempt, isValid) {
         try {
             const u = await fetchUsageLimits(auth);
+            if (!isValid())
+                return;
             updateAccountQuota(account, u, this.accountManager);
+            if (!isValid())
+                return;
             await this.repository.batchSave(this.accountManager.getAccounts());
         }
         catch (e) {
+            if (!isValid())
+                return;
             if (attempt < this.config.usage_sync_max_retries) {
                 await this.sleep(1000 * Math.pow(2, attempt));
-                return this.syncWithRetry(account, auth, attempt + 1);
+                if (!isValid())
+                    return;
+                return this.syncWithRetry(account, auth, attempt + 1, isValid);
             }
             if (e.message?.includes('FEATURE_NOT_SUPPORTED')) {
                 // Some IDC profiles don't support getUsageLimits; don't penalize the account.
@@ -44,7 +54,11 @@ export class UsageTracker {
             if (e.message?.includes('403') ||
                 e.message?.includes('invalid') ||
                 e.message?.includes('bearer token')) {
+                if (!isValid())
+                    return;
                 this.accountManager.markUnhealthy(account, e.message);
+                if (!isValid())
+                    return;
                 this.repository.save(account).catch(() => { });
             }
             throw e;

package/dist/core/request/error-handler.d.ts

@@ -19,14 +19,14 @@ export declare class ErrorHandler {
     private repository;
     private forceRefresh?;
     constructor(config: ErrorHandlerConfig, accountManager: AccountManager, repository: AccountRepository, forceRefresh?: ForceRefreshFn | undefined);
-    handle(error: any, response: Response, account: ManagedAccount, context: RequestContext, showToast: ToastFunction): Promise<{
+    handle(error: any, response: Response, account: ManagedAccount, context: RequestContext, showToast: ToastFunction, signal?: AbortSignal): Promise<{
         shouldRetry: boolean;
         newContext?: RequestContext;
         switchAccount?: boolean;
     }>;
     private markDeadAndSwitchOrFail;
     private transientForbidden;
-    handleNetworkError(error: any, context: RequestContext, showToast: ToastFunction): Promise<{
+    handleNetworkError(error: any, context: RequestContext, showToast: ToastFunction, signal?: AbortSignal): Promise<{
         shouldRetry: boolean;
         newContext?: RequestContext;
     }>;

package/dist/core/request/error-handler.js

@@ -17,7 +17,7 @@ export class ErrorHandler {
         this.repository = repository;
         this.forceRefresh = forceRefresh;
     }
-    async handle(error, response, account, context, showToast) {
+    async handle(error, response, account, context, showToast, signal) {
         const readBody = async () => {
             try {
                 const body = JSON.parse(await response.clone().text());
@@ -57,7 +57,7 @@ export class ErrorHandler {
             if (account.failCount < 5) {
                 const delay = 1000 * Math.pow(2, account.failCount - 1);
                 showToast(`500: ${errorMessage}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
-                await this.sleep(delay);
+                await this.sleep(delay, signal);
                 return { shouldRetry: true };
             }
             else {
@@ -76,7 +76,7 @@ export class ErrorHandler {
                 return { shouldRetry: true, switchAccount: true };
             }
             showToast(`429: Rate limited. Waiting ${Math.ceil(w / 1000)}s...`, 'warning');
-            await this.sleep(w);
+            await this.sleep(w, signal);
             return { shouldRetry: true };
         }
         if (response.status === 402 || response.status === 403) {
@@ -118,7 +118,7 @@ export class ErrorHandler {
                     if (result.dead) {
                         return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, nextForced, showToast);
                     }
-                    return this.transientForbidden(errorReason, response.status, { ...context, forcedRefreshAccountIds: nextForced }, showToast);
+                    return this.transientForbidden(errorReason, response.status, { ...context, forcedRefreshAccountIds: nextForced }, showToast, signal);
                 }
                 return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, forced, showToast);
             }
@@ -134,7 +134,7 @@ export class ErrorHandler {
             if (response.status === 403 &&
                 !isPermanent &&
                 context.retry < this.config.rate_limit_max_retries) {
-                return this.transientForbidden(errorReason, response.status, context, showToast);
+                return this.transientForbidden(errorReason, response.status, context, showToast, signal);
             }
             showToast(`${response.status}: ${errorReason}`, 'error');
             return { shouldRetry: false };
@@ -158,24 +158,24 @@ export class ErrorHandler {
         showToast(`${status}: ${errorReason}. Re-login required.`, 'error');
         return { shouldRetry: false };
     }
-    async transientForbidden(errorReason, status, context, showToast) {
+    async transientForbidden(errorReason, status, context, showToast, signal) {
         if (context.retry >= this.config.rate_limit_max_retries) {
             showToast(`${status}: ${errorReason}`, 'error');
             return { shouldRetry: false };
         }
         const delay = this.config.rate_limit_retry_delay_ms * Math.pow(2, context.retry);
         showToast(`${status}: ${errorReason}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
-        await this.sleep(delay);
+        await this.sleep(delay, signal);
         return {
             shouldRetry: true,
             newContext: { ...context, retry: context.retry + 1 }
         };
     }
-    async handleNetworkError(error, context, showToast) {
+    async handleNetworkError(error, context, showToast, signal) {
         if (this.isNetworkError(error) && context.retry < this.config.rate_limit_max_retries) {
             const d = this.config.rate_limit_retry_delay_ms * Math.pow(2, context.retry);
             showToast(`Network error. Retrying in ${Math.ceil(d / 1000)}s...`, 'warning');
-            await this.sleep(d);
+            await this.sleep(d, signal);
             return {
                 shouldRetry: true,
                 newContext: { ...context, retry: context.retry + 1 }
@@ -186,7 +186,20 @@ export class ErrorHandler {
     isNetworkError(e) {
         return (e instanceof Error && /econnreset|etimedout|enotfound|network|fetch failed/i.test(e.message));
     }
-    sleep(ms) {
-        return new Promise((r) => setTimeout(r, ms));
+    sleep(ms, signal) {
+        if (signal?.aborted)
+            return Promise.reject(signal.reason);
+        let onAbort;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(resolve, ms);
+            onAbort = () => {
+                clearTimeout(timer);
+                reject(signal?.reason);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+        }).finally(() => {
+            if (onAbort)
+                signal?.removeEventListener('abort', onAbort);
+        });
     }
 }

package/dist/core/request/request-handler.d.ts

@@ -16,6 +16,8 @@ export declare class RequestHandler {
     private retryStrategy;
     private reauthInFlight;
     private lastFailedReauthAt;
+    private accountAttemptEpochs;
+    private streamRetryRandom;
     private static kiroRequestQueue;
     constructor(accountManager: AccountManager, config: KiroConfig, repository: AccountRepository, client?: any | undefined);
     get sharedTokenRefresher(): TokenRefresher;
@@ -38,6 +40,8 @@ export declare class RequestHandler {
     private performReauth;
     private hasUsableAccount;
     private allAccountsPermanentlyUnhealthy;
+    private nextAccountAttemptEpoch;
+    private getStreamRetryDelay;
     private sleep;
 }
 export {};

package/dist/core/request/request-handler.js

@@ -1,4 +1,5 @@
 import { GenerateAssistantResponseCommand } from '@aws/codewhisperer-streaming-client';
+import { clearTimeout as clearDeadlineTimeout, setTimeout as setDeadlineTimeout } from 'node:timers';
 import { isPermanentError } from '../../plugin/health.js';
 import * as logger from '../../plugin/logger.js';
 import { transformToSdkRequest } from '../../plugin/request.js';
@@ -10,6 +11,7 @@ import { TokenRefresher } from '../auth/token-refresher.js';
 import { ErrorHandler, isKiroContextOverflowBody } from './error-handler.js';
 import { ResponseHandler } from './response-handler.js';
 import { RetryStrategy } from './retry-strategy.js';
+import { SdkEventStreamIterationError, UpstreamUnexpectedError } from './stream-error.js';
 const KIRO_API_PATTERN = /^(https?:\/\/)?q\.[a-z0-9-]+\.amazonaws\.com/;
 const REAUTH_FAILURE_COOLDOWN_MS = 60000;
 export class RequestHandler {
@@ -25,6 +27,8 @@ export class RequestHandler {
     retryStrategy;
     reauthInFlight = null;
     lastFailedReauthAt = 0;
+    accountAttemptEpochs = new Map();
+    streamRetryRandom = Math.random;
     static kiroRequestQueue = Promise.resolve();
     constructor(accountManager, config, repository, client) {
         this.accountManager = accountManager;
@@ -63,6 +67,24 @@ export class RequestHandler {
         }
     }
     async handleKiroRequest(url, init, showToast) {
+        const requestController = new AbortController();
+        const inboundSignal = init?.signal;
+        const abortFromInbound = () => requestController.abort(inboundSignal?.reason);
+        if (inboundSignal?.aborted)
+            abortFromInbound();
+        else
+            inboundSignal?.addEventListener('abort', abortFromInbound, { once: true });
+        const timeout = setDeadlineTimeout(() => requestController.abort(new DOMException('Kiro request timed out', 'TimeoutError')), this.config.request_timeout_ms);
+        let requestCleanupDone = false;
+        let responseOwnsLifecycle = false;
+        const cleanupRequest = () => {
+            if (requestCleanupDone)
+                return;
+            requestCleanupDone = true;
+            clearDeadlineTimeout(timeout);
+            inboundSignal?.removeEventListener('abort', abortFromInbound);
+        };
+        const signal = requestController.signal;
         const body = init?.body ? JSON.parse(init.body) : {};
         const model = this.extractModel(url) || body.model || 'claude-sonnet-4-5';
         const think = model.endsWith('-thinking') || !!body.providerOptions?.thinkingConfig || !!body.thinkingConfig;
@@ -72,128 +94,185 @@ export class RequestHandler {
             20000;
         let handlerContext = { retry: 0, forcedRefreshAccountIds: new Set() };
         let consecutiveNullAccounts = 0;
+        let streamFailureCount = 0;
+        let forcedStreamAccount = null;
         const retryContext = this.retryStrategy.createContext();
-        while (true) {
-            const check = this.retryStrategy.shouldContinue(retryContext);
-            if (!check.canContinue) {
-                throw new Error(check.error);
-            }
-            if (this.allAccountsPermanentlyUnhealthy()) {
-                const reauthed = await this.triggerReauth(showToast);
-                if (!reauthed) {
-                    throw new Error('All accounts are permanently unhealthy. Please re-authenticate.');
+        try {
+            while (true) {
+                if (signal.aborted)
+                    throw signal.reason;
+                const check = this.retryStrategy.shouldContinue(retryContext);
+                if (!check.canContinue) {
+                    throw new Error(check.error);
                 }
-                continue;
-            }
-            let acc = await this.accountSelector.selectHealthyAccount(showToast).catch(async (e) => {
-                if (e instanceof Error && e.message.includes('reauth required')) {
+                if (this.allAccountsPermanentlyUnhealthy()) {
                     const reauthed = await this.triggerReauth(showToast);
-                    if (!reauthed)
-                        throw new Error('All accounts are unhealthy or rate-limited. Please re-authenticate.');
-                    return null;
+                    if (!reauthed) {
+                        throw new Error('All accounts are permanently unhealthy. Please re-authenticate.');
+                    }
+                    continue;
                 }
-                throw e;
-            });
-            if (!acc) {
-                consecutiveNullAccounts++;
-                const backoffDelay = Math.min(1000 * Math.pow(2, consecutiveNullAccounts - 1), 10000);
-                await this.sleep(backoffDelay);
-                continue;
-            }
-            consecutiveNullAccounts = 0;
-            const auth = this.accountManager.toAuthDetails(acc);
-            const tokenResult = await this.tokenRefresher.refreshIfNeeded(acc, auth, showToast);
-            if (tokenResult.shouldContinue) {
-                acc = tokenResult.account;
-                await this.sleep(500);
-                continue;
-            }
-            const sdkPrep = this.prepareSdkRequest(init?.body, model, auth, think, budget, showToast);
-            if (this.config.enable_log_effort_debug) {
-                try {
-                    logger.log('[effort-debug] request effort resolution', {
-                        model,
-                        effectiveModel: sdkPrep.effectiveModel,
-                        think,
-                        budget,
-                        resolvedEffort: sdkPrep.effort ?? 'undefined (not effort-capable or not thinking)',
-                        inboundBodyKeys: Object.keys(body),
-                        messagesCount: body.messages?.length,
-                        reasoningSubtree: {
-                            reasoningEffort: body.reasoningEffort,
-                            reasoning_effort: body.reasoning_effort,
-                            reasoning: body.reasoning,
-                            providerOptions: body.providerOptions,
-                            thinkingConfig: body.thinkingConfig,
-                            providerOptionsThinkingConfig: body.providerOptions?.thinkingConfig
+                let acc = forcedStreamAccount;
+                forcedStreamAccount = null;
+                if (!acc) {
+                    acc = await this.accountSelector
+                        .selectHealthyAccount(showToast, signal)
+                        .catch(async (e) => {
+                        if (e instanceof Error && e.message.includes('reauth required')) {
+                            const reauthed = await this.triggerReauth(showToast);
+                            if (!reauthed)
+                                throw new Error('All accounts are unhealthy or rate-limited. Please re-authenticate.');
+                            return null;
                         }
+                        throw e;
                     });
                 }
-                catch { }
-            }
-            const apiTimestamp = this.config.enable_log_api_request ? logger.getTimestamp() : null;
-            if (apiTimestamp) {
-                this.logSdkRequest(sdkPrep, acc, apiTimestamp);
-            }
-            try {
-                const client = this.makeSdkClient(auth, sdkPrep.region, sdkPrep.effort);
-                const command = new GenerateAssistantResponseCommand({
-                    conversationState: sdkPrep.conversationState,
-                    profileArn: sdkPrep.profileArn
-                });
-                const sdkResponse = await client.send(command);
+                if (!acc) {
+                    consecutiveNullAccounts++;
+                    const backoffDelay = Math.min(1000 * Math.pow(2, consecutiveNullAccounts - 1), 10000);
+                    await this.sleep(backoffDelay, signal);
+                    continue;
+                }
+                consecutiveNullAccounts = 0;
+                const auth = this.accountManager.toAuthDetails(acc);
+                const tokenResult = await this.tokenRefresher.refreshIfNeeded(acc, auth, showToast);
+                if (tokenResult.shouldContinue) {
+                    acc = tokenResult.account;
+                    await this.sleep(500, signal);
+                    continue;
+                }
+                const sdkPrep = this.prepareSdkRequest(init?.body, model, auth, think, budget, showToast);
+                if (this.config.enable_log_effort_debug) {
+                    try {
+                        logger.log('[effort-debug] request effort resolution', {
+                            model,
+                            effectiveModel: sdkPrep.effectiveModel,
+                            think,
+                            budget,
+                            resolvedEffort: sdkPrep.effort ?? 'undefined (not effort-capable or not thinking)',
+                            inboundBodyKeys: Object.keys(body),
+                            messagesCount: body.messages?.length,
+                            reasoningSubtree: {
+                                reasoningEffort: body.reasoningEffort,
+                                reasoning_effort: body.reasoning_effort,
+                                reasoning: body.reasoning,
+                                providerOptions: body.providerOptions,
+                                thinkingConfig: body.thinkingConfig,
+                                providerOptionsThinkingConfig: body.providerOptions?.thinkingConfig
+                            }
+                        });
+                    }
+                    catch { }
+                }
+                const apiTimestamp = this.config.enable_log_api_request ? logger.getTimestamp() : null;
                 if (apiTimestamp) {
-                    this.logSdkResponse(sdkPrep, apiTimestamp);
+                    this.logSdkRequest(sdkPrep, acc, apiTimestamp);
                 }
-                this.handleSuccessfulRequest(acc);
-                this.usageTracker.syncUsage(acc, auth);
-                return await this.responseHandler.handleSdkSuccess(sdkResponse, model, sdkPrep.conversationId, sdkPrep.streaming);
-            }
-            catch (e) {
-                const httpStatus = e?.$metadata?.httpStatusCode;
-                if (httpStatus) {
+                let sendResolved = false;
+                try {
+                    const client = this.makeSdkClient(auth, sdkPrep.region, sdkPrep.effort);
+                    const command = new GenerateAssistantResponseCommand({
+                        conversationState: sdkPrep.conversationState,
+                        profileArn: sdkPrep.profileArn
+                    });
+                    const attemptEpoch = this.nextAccountAttemptEpoch(acc.id);
+                    const isCurrentAttempt = () => this.accountAttemptEpochs.get(acc.id) === attemptEpoch;
+                    let completionDone = false;
+                    const completeRequest = async () => {
+                        if (completionDone)
+                            return;
+                        completionDone = true;
+                        if (!isCurrentAttempt())
+                            return;
+                        this.handleSuccessfulRequest(acc);
+                        await this.usageTracker.syncUsage(acc, auth, isCurrentAttempt);
+                    };
+                    const sdkResponse = await client.send(command, { abortSignal: signal });
+                    sendResolved = true;
                     if (apiTimestamp) {
-                        this.logSdkError(sdkPrep, e, acc, apiTimestamp);
+                        this.logSdkResponse(sdkPrep, apiTimestamp);
+                    }
+                    const response = await this.responseHandler.handleSdkSuccess(sdkResponse, model, sdkPrep.conversationId, sdkPrep.streaming, {
+                        signal,
+                        onComplete: completeRequest,
+                        onTerminal: cleanupRequest,
+                        onCancel: (reason) => requestController.abort(reason),
+                        mapError: (error) => new UpstreamUnexpectedError(error, true)
+                    });
+                    if (sdkPrep.streaming) {
+                        responseOwnsLifecycle = true;
                     }
-                    const errorBody = JSON.stringify({ message: e.message, __type: e.name });
-                    const errorStatusText = e.name || 'Error';
-                    const jsonHeaders = { 'Content-Type': 'application/json' };
-                    const errorResult = await this.errorHandler.handle(e, new Response(errorBody, {
-                        status: httpStatus,
-                        statusText: errorStatusText,
-                        headers: jsonHeaders
-                    }), acc, handlerContext, showToast);
-                    if (errorResult.shouldRetry) {
-                        if (errorResult.newContext) {
-                            handlerContext = errorResult.newContext;
+                    else {
+                        await completeRequest();
+                    }
+                    return response;
+                }
+                catch (e) {
+                    if (signal.aborted)
+                        throw signal.reason;
+                    if (e instanceof SdkEventStreamIterationError) {
+                        streamFailureCount++;
+                        const streamError = new UpstreamUnexpectedError(e, false);
+                        if (streamFailureCount >= 3)
+                            return streamError.toResponse();
+                        await this.sleep(this.getStreamRetryDelay(streamFailureCount), signal);
+                        if (streamFailureCount === 1) {
+                            forcedStreamAccount = acc;
                         }
-                        if (errorResult.switchAccount) {
-                            continue;
+                        else {
+                            forcedStreamAccount =
+                                (await this.accountSelector.selectAlternativeAccount(new Set([acc.id]))) ?? acc;
                         }
                         continue;
                     }
-                    // Terminal, non-retryable HTTP error. Return a fresh Response carrying
-                    // the real Kiro body so @ai-sdk/openai-compatible produces an
-                    // APICallError with status+body (not a bare Error that OpenCode
-                    // degrades to UnknownError). Remap size-overflow 400s to 413 so
-                    // OpenCode classifies context_overflow and auto-compacts.
-                    const terminalStatus = httpStatus === 400 && isKiroContextOverflowBody(e.message ?? '') ? 413 : httpStatus;
-                    return new Response(errorBody, {
-                        status: terminalStatus,
-                        statusText: errorStatusText,
-                        headers: jsonHeaders
-                    });
-                }
-                const networkResult = await this.errorHandler.handleNetworkError(e, handlerContext, showToast);
-                if (networkResult.shouldRetry) {
-                    if (networkResult.newContext) {
-                        handlerContext = { ...handlerContext, ...networkResult.newContext };
+                    if (sendResolved)
+                        throw e;
+                    const httpStatus = e?.$metadata?.httpStatusCode;
+                    if (httpStatus) {
+                        if (apiTimestamp) {
+                            this.logSdkError(sdkPrep, e, acc, apiTimestamp);
+                        }
+                        const errorBody = JSON.stringify({ message: e.message, __type: e.name });
+                        const errorStatusText = e.name || 'Error';
+                        const jsonHeaders = { 'Content-Type': 'application/json' };
+                        const errorResult = await this.errorHandler.handle(e, new Response(errorBody, {
+                            status: httpStatus,
+                            statusText: errorStatusText,
+                            headers: jsonHeaders
+                        }), acc, handlerContext, showToast, signal);
+                        if (errorResult.shouldRetry) {
+                            if (errorResult.newContext) {
+                                handlerContext = errorResult.newContext;
+                            }
+                            continue;
+                        }
+                        // Terminal, non-retryable HTTP error. Return a fresh Response carrying
+                        // the real Kiro body so @ai-sdk/openai-compatible produces an
+                        // APICallError with status+body (not a bare Error that OpenCode
+                        // degrades to UnknownError). Remap size-overflow 400s to 413 so
+                        // OpenCode classifies context_overflow and auto-compacts.
+                        const terminalStatus = httpStatus === 400 && isKiroContextOverflowBody(e.message ?? '') ? 413 : httpStatus;
+                        return new Response(errorBody, {
+                            status: terminalStatus,
+                            statusText: errorStatusText,
+                            headers: jsonHeaders
+                        });
                     }
-                    continue;
+                    const networkResult = await this.errorHandler.handleNetworkError(e, handlerContext, showToast, signal);
+                    if (networkResult.shouldRetry) {
+                        if (networkResult.newContext) {
+                            handlerContext = { ...handlerContext, ...networkResult.newContext };
+                        }
+                        continue;
+                    }
+                    throw e;
                 }
-                throw e;
             }
         }
+        finally {
+            if (!responseOwnsLifecycle)
+                cleanupRequest();
+        }
     }
     extractModel(url) {
         return url.match(/models\/([^/:]+)/)?.[1] || null;
@@ -335,7 +414,29 @@ export class RequestHandler {
         }
         return accounts.every((acc) => !acc.isHealthy && isPermanentError(acc.unhealthyReason));
     }
-    sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
+    nextAccountAttemptEpoch(accountId) {
+        const next = (this.accountAttemptEpochs.get(accountId) ?? 0) + 1;
+        this.accountAttemptEpochs.set(accountId, next);
+        return next;
+    }
+    getStreamRetryDelay(failureCount) {
+        const base = 250 * Math.pow(2, failureCount - 1);
+        return base + base * 0.25 * this.streamRetryRandom();
+    }
+    sleep(ms, signal) {
+        if (signal?.aborted)
+            return Promise.reject(signal.reason);
+        let onAbort;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(resolve, ms);
+            onAbort = () => {
+                clearTimeout(timer);
+                reject(signal?.reason);
+            };
+            signal?.addEventListener('abort', onAbort, { once: true });
+        }).finally(() => {
+            if (onAbort)
+                signal?.removeEventListener('abort', onAbort);
+        });
     }
 }

package/dist/core/request/response-handler.d.ts

@@ -1,8 +1,16 @@
+import { SdkEventStreamIterationError } from './stream-error.js';
+export interface SdkResponseLifecycle {
+    signal?: AbortSignal;
+    onComplete?: () => void | Promise<void>;
+    onTerminal?: () => void;
+    onCancel?: (reason: unknown) => void;
+    mapError?: (error: SdkEventStreamIterationError, emittedOutput: true) => unknown;
+}
 export declare class ResponseHandler {
     handleSuccess(response: Response, model: string, conversationId: string, streaming: boolean): Promise<Response>;
-    handleSdkSuccess(sdkResponse: any, model: string, conversationId: string, streaming: boolean): Promise<Response>;
+    handleSdkSuccess(sdkResponse: any, model: string, conversationId: string, streaming: boolean, lifecycle?: SdkResponseLifecycle): Promise<Response>;
     private handleStreaming;
     private handleSdkStreaming;
-    private handleNonStreaming;
     private handleSdkNonStreaming;
+    private handleNonStreaming;
 }

package/dist/core/request/response-handler.js

@@ -1,6 +1,88 @@
 import { parseEventStream } from '../../plugin/response.js';
 import { transformKiroStream } from '../../plugin/streaming/index.js';
 import { transformSdkStream } from '../../plugin/streaming/sdk-stream-transformer.js';
+import { SdkEventStreamIterationError } from './stream-error.js';
+function abortReason(signal) {
+    return signal.reason ?? new DOMException('The request was aborted', 'AbortError');
+}
+async function closeIterator(iterator) {
+    try {
+        await iterator.return?.();
+    }
+    catch { }
+}
+function wrapSdkEventStream(sdkResponse, signal) {
+    const eventStream = sdkResponse.generateAssistantResponseResponse;
+    if (!eventStream || typeof eventStream[Symbol.asyncIterator] !== 'function') {
+        return { response: sdkResponse, closeRaw: async () => { } };
+    }
+    const rawIterator = eventStream[Symbol.asyncIterator]();
+    let closed = false;
+    const closeRaw = async () => {
+        if (closed)
+            return;
+        closed = true;
+        await closeIterator(rawIterator);
+    };
+    const nextRaw = async () => {
+        if (!signal)
+            return rawIterator.next();
+        if (signal.aborted) {
+            await closeRaw();
+            throw abortReason(signal);
+        }
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (callback) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener('abort', onAbort);
+                callback();
+            };
+            const onAbort = () => {
+                void closeRaw();
+                settle(() => reject(abortReason(signal)));
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            Promise.resolve(rawIterator.next()).then((result) => settle(() => resolve(result)), (error) => settle(() => reject(error)));
+        });
+    };
+    const wrappedIterator = {
+        async next() {
+            try {
+                return await nextRaw();
+            }
+            catch (error) {
+                if (signal?.aborted)
+                    throw abortReason(signal);
+                throw new SdkEventStreamIterationError(error);
+            }
+        },
+        async return() {
+            await closeRaw();
+            return { done: true, value: undefined };
+        }
+    };
+    const wrappedStream = {
+        [Symbol.asyncIterator]() {
+            return wrappedIterator;
+        }
+    };
+    return {
+        response: { ...sdkResponse, generateAssistantResponseResponse: wrappedStream },
+        closeRaw
+    };
+}
+function isSemanticChunk(chunk) {
+    const delta = chunk?.choices?.[0]?.delta;
+    return (delta?.content !== undefined ||
+        delta?.reasoning_content !== undefined ||
+        delta?.tool_calls !== undefined);
+}
+function encodeSseChunk(chunk) {
+    return new TextEncoder().encode(`data: ${JSON.stringify(chunk)}\n\n`);
+}
 export class ResponseHandler {
     async handleSuccess(response, model, conversationId, streaming) {
         if (streaming) {
@@ -8,11 +90,11 @@ export class ResponseHandler {
         }
         return this.handleNonStreaming(response, model, conversationId);
     }
-    async handleSdkSuccess(sdkResponse, model, conversationId, streaming) {
+    async handleSdkSuccess(sdkResponse, model, conversationId, streaming, lifecycle = {}) {
         if (streaming) {
-            return this.handleSdkStreaming(sdkResponse, model, conversationId);
+            return this.handleSdkStreaming(sdkResponse, model, conversationId, lifecycle);
         }
-        return this.handleSdkNonStreaming(sdkResponse, model, conversationId);
+        return this.handleSdkNonStreaming(sdkResponse, model, conversationId, lifecycle.signal);
     }
     async handleStreaming(response, model, conversationId) {
         const s = transformKiroStream(response, model, conversationId);
@@ -30,25 +112,145 @@ export class ResponseHandler {
             }
         }), { headers: { 'Content-Type': 'text/event-stream' } });
     }
-    async handleSdkStreaming(sdkResponse, model, conversationId) {
-        const s = transformSdkStream(sdkResponse, model, conversationId);
+    async handleSdkStreaming(sdkResponse, model, conversationId, lifecycle) {
+        const wrapped = wrapSdkEventStream(sdkResponse, lifecycle.signal);
+        const transformed = transformSdkStream(wrapped.response, model, conversationId);
+        const buffered = [];
+        let firstSemantic;
+        while (true) {
+            const item = await transformed.next();
+            if (item.done) {
+                await lifecycle.onComplete?.();
+                lifecycle.onTerminal?.();
+                let index = 0;
+                return new Response(new ReadableStream({
+                    pull(controller) {
+                        const chunk = buffered[index++];
+                        if (chunk)
+                            controller.enqueue(chunk);
+                        if (index >= buffered.length)
+                            controller.close();
+                    }
+                }, { highWaterMark: 0 }), { headers: { 'Content-Type': 'text/event-stream' } });
+            }
+            const encoded = encodeSseChunk(item.value);
+            if (isSemanticChunk(item.value)) {
+                firstSemantic = encoded;
+                break;
+            }
+            buffered.push(encoded);
+        }
+        let terminal = false;
+        let firstPull = true;
+        let abortListener;
+        const finish = () => {
+            if (terminal)
+                return;
+            terminal = true;
+            if (abortListener && lifecycle.signal) {
+                lifecycle.signal.removeEventListener('abort', abortListener);
+            }
+            lifecycle.onTerminal?.();
+        };
+        const cleanupIterators = async () => {
+            try {
+                await transformed.return(undefined);
+            }
+            catch { }
+            await wrapped.closeRaw();
+        };
         return new Response(new ReadableStream({
-            async start(c) {
+            start(controller) {
+                if (!lifecycle.signal)
+                    return;
+                abortListener = () => {
+                    if (terminal)
+                        return;
+                    const reason = abortReason(lifecycle.signal);
+                    void cleanupIterators();
+                    finish();
+                    controller.error(reason);
+                };
+                if (lifecycle.signal.aborted)
+                    abortListener();
+                else
+                    lifecycle.signal.addEventListener('abort', abortListener, { once: true });
+            },
+            async pull(controller) {
+                if (terminal)
+                    return;
+                if (firstPull) {
+                    firstPull = false;
+                    for (const chunk of buffered)
+                        controller.enqueue(chunk);
+                    controller.enqueue(firstSemantic);
+                    return;
+                }
                 try {
-                    for await (const e of s) {
-                        c.enqueue(new TextEncoder().encode(`data: ${JSON.stringify(e)}\n\n`));
+                    const item = await transformed.next();
+                    if (item.done) {
+                        await lifecycle.onComplete?.();
+                        finish();
+                        controller.close();
+                        return;
                     }
-                    c.close();
+                    controller.enqueue(encodeSseChunk(item.value));
                 }
-                catch (err) {
-                    c.error(err);
+                catch (error) {
+                    if (terminal)
+                        return;
+                    const mapped = error instanceof SdkEventStreamIterationError
+                        ? (lifecycle.mapError?.(error, true) ?? error)
+                        : error;
+                    finish();
+                    controller.error(mapped);
                 }
+            },
+            async cancel(reason) {
+                if (terminal)
+                    return;
+                finish();
+                lifecycle.onCancel?.(reason);
+                await cleanupIterators();
             }
-        }), { headers: { 'Content-Type': 'text/event-stream' } });
+        }, { highWaterMark: 0 }), { headers: { 'Content-Type': 'text/event-stream' } });
     }
-    async handleNonStreaming(response, model, conversationId) {
-        const text = await response.text();
-        const p = parseEventStream(text, model);
+    async handleSdkNonStreaming(sdkResponse, model, conversationId, signal) {
+        // For non-streaming SDK responses, collect all events
+        let content = '';
+        let reasoningContent = '';
+        const toolCalls = [];
+        let inputTokens = 0;
+        let outputTokens = 0;
+        const wrapped = wrapSdkEventStream(sdkResponse, signal);
+        const eventStream = wrapped.response.generateAssistantResponseResponse;
+        if (eventStream) {
+            try {
+                for await (const event of eventStream) {
+                    if (event.reasoningContentEvent?.text) {
+                        reasoningContent += event.reasoningContentEvent.text;
+                    }
+                    if (event.assistantResponseEvent?.content) {
+                        content += event.assistantResponseEvent.content;
+                    }
+                    if (event.toolUseEvent) {
+                        toolCalls.push(event.toolUseEvent);
+                    }
+                    if (event.metadataEvent?.tokenUsage) {
+                        inputTokens = event.metadataEvent.tokenUsage.inputTokens || 0;
+                        outputTokens = event.metadataEvent.tokenUsage.outputTokens || 0;
+                    }
+                }
+            }
+            finally {
+                if (signal?.aborted)
+                    await wrapped.closeRaw();
+            }
+        }
+        const message = { role: 'assistant', content };
+        if (reasoningContent) {
+            message.reasoning_content = reasoningContent;
+        }
         const oai = {
             id: conversationId,
             object: 'chat.completion',
@@ -57,18 +259,18 @@ export class ResponseHandler {
             choices: [
                 {
                     index: 0,
-                    message: { role: 'assistant', content: p.content },
-                    finish_reason: p.stopReason === 'tool_use' ? 'tool_calls' : 'stop'
+                    message,
+                    finish_reason: toolCalls.length > 0 ? 'tool_calls' : 'stop'
                 }
             ],
             usage: {
-                prompt_tokens: p.inputTokens || 0,
-                completion_tokens: p.outputTokens || 0,
-                total_tokens: (p.inputTokens || 0) + (p.outputTokens || 0)
+                prompt_tokens: inputTokens,
+                completion_tokens: outputTokens,
+                total_tokens: inputTokens + outputTokens
             }
         };
-        if (p.toolCalls.length > 0) {
-            oai.choices[0].message.tool_calls = p.toolCalls.map((tc) => ({
+        if (toolCalls.length > 0) {
+            oai.choices[0].message.tool_calls = toolCalls.map((tc) => ({
                 id: tc.toolUseId,
                 type: 'function',
                 function: {
@@ -81,35 +283,9 @@ export class ResponseHandler {
             headers: { 'Content-Type': 'application/json' }
         });
     }
-    async handleSdkNonStreaming(sdkResponse, model, conversationId) {
-        // For non-streaming SDK responses, collect all events
-        let content = '';
-        let reasoningContent = '';
-        const toolCalls = [];
-        let inputTokens = 0;
-        let outputTokens = 0;
-        const eventStream = sdkResponse.generateAssistantResponseResponse;
-        if (eventStream) {
-            for await (const event of eventStream) {
-                if (event.reasoningContentEvent?.text) {
-                    reasoningContent += event.reasoningContentEvent.text;
-                }
-                if (event.assistantResponseEvent?.content) {
-                    content += event.assistantResponseEvent.content;
-                }
-                if (event.toolUseEvent) {
-                    toolCalls.push(event.toolUseEvent);
-                }
-                if (event.metadataEvent?.tokenUsage) {
-                    inputTokens = event.metadataEvent.tokenUsage.inputTokens || 0;
-                    outputTokens = event.metadataEvent.tokenUsage.outputTokens || 0;
-                }
-            }
-        }
-        const message = { role: 'assistant', content };
-        if (reasoningContent) {
-            message.reasoning_content = reasoningContent;
-        }
+    async handleNonStreaming(response, model, conversationId) {
+        const text = await response.text();
+        const p = parseEventStream(text, model);
         const oai = {
             id: conversationId,
             object: 'chat.completion',
@@ -118,18 +294,18 @@ export class ResponseHandler {
             choices: [
                 {
                     index: 0,
-                    message,
-                    finish_reason: toolCalls.length > 0 ? 'tool_calls' : 'stop'
+                    message: { role: 'assistant', content: p.content },
+                    finish_reason: p.stopReason === 'tool_use' ? 'tool_calls' : 'stop'
                 }
             ],
             usage: {
-                prompt_tokens: inputTokens,
-                completion_tokens: outputTokens,
-                total_tokens: inputTokens + outputTokens
+                prompt_tokens: p.inputTokens || 0,
+                completion_tokens: p.outputTokens || 0,
+                total_tokens: (p.inputTokens || 0) + (p.outputTokens || 0)
             }
         };
-        if (toolCalls.length > 0) {
-            oai.choices[0].message.tool_calls = toolCalls.map((tc) => ({
+        if (p.toolCalls.length > 0) {
+            oai.choices[0].message.tool_calls = p.toolCalls.map((tc) => ({
                 id: tc.toolUseId,
                 type: 'function',
                 function: {

package/dist/core/request/stream-error.d.ts

@@ -0,0 +1,20 @@
+export interface UpstreamUnexpectedPayload {
+    retryable: true;
+    phase: 'stream';
+    emittedOutput: boolean;
+    code: 'UPSTREAM_UNEXPECTED';
+}
+export declare class SdkEventStreamIterationError extends Error {
+    readonly name = "SdkEventStreamIterationError";
+    constructor(cause: unknown);
+}
+export declare class UpstreamUnexpectedError extends Error {
+    readonly emittedOutput: boolean;
+    readonly name = "UpstreamUnexpectedError";
+    readonly retryable = true;
+    readonly phase = "stream";
+    readonly code = "UPSTREAM_UNEXPECTED";
+    constructor(cause: unknown, emittedOutput: boolean);
+    toPayload(): UpstreamUnexpectedPayload;
+    toResponse(): Response;
+}

package/dist/core/request/stream-error.js

@@ -0,0 +1,31 @@
+export class SdkEventStreamIterationError extends Error {
+    name = 'SdkEventStreamIterationError';
+    constructor(cause) {
+        super('Kiro SDK event stream iteration failed', { cause });
+    }
+}
+export class UpstreamUnexpectedError extends Error {
+    emittedOutput;
+    name = 'UpstreamUnexpectedError';
+    retryable = true;
+    phase = 'stream';
+    code = 'UPSTREAM_UNEXPECTED';
+    constructor(cause, emittedOutput) {
+        super('Kiro upstream event stream failed unexpectedly', { cause });
+        this.emittedOutput = emittedOutput;
+    }
+    toPayload() {
+        return {
+            retryable: true,
+            phase: 'stream',
+            emittedOutput: this.emittedOutput,
+            code: 'UPSTREAM_UNEXPECTED'
+        };
+    }
+    toResponse() {
+        return new Response(JSON.stringify(this.toPayload()), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' }
+        });
+    }
+}

package/dist/plugin/accounts.d.ts

@@ -36,7 +36,10 @@ export declare class AccountManager {
     shouldShowUsageToast(debounce?: number): boolean;
     getMinWaitTime(): number;
     allSelectableBlockedByOverage(): boolean;
-    getCurrentOrNext(): ManagedAccount | null;
+    getCurrentOrNext(options?: {
+        excludedIds?: ReadonlySet<string>;
+        recoverUnhealthy?: boolean;
+    }): ManagedAccount | null;
     updateUsage(id: string, meta: {
         usedCount: number;
         limitCount: number;

package/dist/plugin/accounts.js

@@ -121,13 +121,19 @@ export class AccountManager {
         const hasHealthySelectable = this.accounts.some((a) => a.isHealthy && !rateLimited(a) && !this.isOverageBlocked(a));
         return hasOverageBlockedEligible && !hasCleanRateLimited && !hasHealthySelectable;
     }
-    getCurrentOrNext() {
+    getCurrentOrNext(options = {}) {
         const now = Date.now();
+        const excludedIds = options.excludedIds ?? new Set();
+        const recoverUnhealthy = options.recoverUnhealthy ?? true;
         const overageBlocked = (a) => this.isOverageBlocked(a);
         const available = this.accounts.filter((a) => {
+            if (excludedIds.has(a.id))
+                return false;
             if (overageBlocked(a))
                 return false;
             if (!a.isHealthy) {
+                if (!recoverUnhealthy)
+                    return false;
                 if (isPermanentError(a.unhealthyReason)) {
                     return false;
                 }
@@ -205,9 +211,10 @@ export class AccountManager {
                 })[0];
             }
         }
-        if (!selected) {
+        if (!selected && recoverUnhealthy) {
             const fallback = this.accounts
-                .filter((a) => !a.isHealthy &&
+                .filter((a) => !excludedIds.has(a.id) &&
+                !a.isHealthy &&
                 a.failCount < 10 &&
                 !isPermanentError(a.unhealthyReason) &&
                 !overageBlocked(a))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",