@sunerpy/opencode-kiro-auth 0.15.0 → 0.15.2

package/dist/core/auth/token-refresher.d.ts

@@ -1,5 +1,6 @@
 import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
 import type { AccountManager } from '../../plugin/accounts.js';
+import { refreshAccessToken } from '../../plugin/token.js';
 import type { KiroAuthDetails, ManagedAccount } from '../../plugin/types.js';
 type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
 interface TokenRefresherConfig {
@@ -7,6 +8,11 @@ interface TokenRefresherConfig {
     auto_sync_kiro_cli: boolean;
     account_selection_strategy: 'sticky' | 'round-robin' | 'lowest-usage';
 }
+interface TokenRefresherDependencies {
+    refreshAccessToken: typeof refreshAccessToken;
+    sleep: (delayMs: number) => Promise<void>;
+    random: () => number;
+}
 /** Outcome of a forced refresh; `dead` distinguishes refresh-token-dead
  *  (needs re-login) from a transient failure (network/5xx). */
 export interface ForceRefreshResult {
@@ -27,8 +33,12 @@ export declare class TokenRefresher {
     private syncFromKiroCli;
     private repository;
     private readonly inFlight;
+    private readonly pendingPersistence;
     private readonly lastDeadToastAt;
-    constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
+    private readonly refreshAccessToken;
+    private readonly sleep;
+    private readonly random;
+    constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository, dependencies?: Partial<TokenRefresherDependencies>);
     refreshIfNeeded(account: ManagedAccount, auth: KiroAuthDetails, showToast: ToastFunction): Promise<{
         account: ManagedAccount;
         shouldContinue: boolean;
@@ -36,7 +46,9 @@ export declare class TokenRefresher {
     forceRefresh(account: ManagedAccount, showToast: ToastFunction): Promise<ForceRefreshResult>;
     private startOrJoinRefresh;
     private runLockedRefresh;
+    private persistRefreshedAccount;
     private readLatestAuth;
+    private syncPersistedAccountReference;
     private handleRefreshError;
 }
 export {};

package/dist/core/auth/token-refresher.js

@@ -1,10 +1,24 @@
 import { accessTokenExpired } from '../../kiro/auth.js';
-import { KiroTokenRefreshError } from '../../plugin/errors.js';
+import { KiroTokenRefreshError, TokenPersistenceError } from '../../plugin/errors.js';
 import { isRefreshTokenDead, toDeadReason } from '../../plugin/health.js';
 import * as logger from '../../plugin/logger.js';
 import { withRefreshLock } from '../../plugin/storage/locked-operations.js';
 import { refreshAccessToken } from '../../plugin/token.js';
 const DEAD_TOAST_DEBOUNCE_MS = 60000;
+const TOKEN_PERSISTENCE_MAX_ATTEMPTS = 3;
+const TOKEN_PERSISTENCE_RETRY_DELAY_MS = 250;
+function isTransientPersistenceError(error) {
+    const code = typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code).toUpperCase()
+        : '';
+    const message = error instanceof Error ? error.message : String(error);
+    return (code === 'SQLITE_BUSY' ||
+        code === 'SQLITE_LOCKED' ||
+        /SQLITE_(?:BUSY|LOCKED)|database is locked|lock file is already being held/i.test(message));
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 /**
  * Decide whether a refresh failure means the refresh token / OIDC client is
  * dead (permanent, needs re-login) or is merely transient (network/5xx).
@@ -13,6 +27,9 @@ const DEAD_TOAST_DEBOUNCE_MS = 60000;
  * the stored credentials are unusable, so the account needs a re-login.
  */
 export function isRefreshErrorDead(error) {
+    if (error instanceof TokenPersistenceError) {
+        return false;
+    }
     if (error instanceof KiroTokenRefreshError) {
         if (error.code === 'MISSING_CREDENTIALS' || error.code === 'INVALID_RESPONSE') {
             return true;
@@ -39,12 +56,19 @@ export class TokenRefresher {
     syncFromKiroCli;
     repository;
     inFlight = new Map();
+    pendingPersistence = new Map();
     lastDeadToastAt = new Map();
-    constructor(config, accountManager, syncFromKiroCli, repository) {
+    refreshAccessToken;
+    sleep;
+    random;
+    constructor(config, accountManager, syncFromKiroCli, repository, dependencies = {}) {
         this.config = config;
         this.accountManager = accountManager;
         this.syncFromKiroCli = syncFromKiroCli;
         this.repository = repository;
+        this.refreshAccessToken = dependencies.refreshAccessToken ?? refreshAccessToken;
+        this.sleep = dependencies.sleep ?? defaultSleep;
+        this.random = dependencies.random ?? Math.random;
     }
     async refreshIfNeeded(account, auth, showToast) {
         if (!accessTokenExpired(auth, this.config.token_expiry_buffer_ms)) {
@@ -64,6 +88,10 @@ export class TokenRefresher {
             return { ok: true, dead: false };
         }
         catch (e) {
+            if (e instanceof TokenPersistenceError) {
+                logger.error('Forced token refresh persistence failed', { email: account.email });
+                return { ok: false, dead: false };
+            }
             const dead = isRefreshErrorDead(e);
             logger.error('Forced token refresh failed', {
                 email: account.email,
@@ -94,16 +122,50 @@ export class TokenRefresher {
     }
     async runLockedRefresh(account, getAuthFallback) {
         await withRefreshLock(account.id, async () => {
-            const { latestAuth } = await this.readLatestAuth(account);
-            if (latestAuth && !accessTokenExpired(latestAuth, this.config.token_expiry_buffer_ms)) {
-                this.accountManager.updateFromAuth(account, latestAuth);
+            const { latestAccount, latestAuth } = await this.readLatestAuth(account);
+            if (latestAccount &&
+                latestAuth &&
+                !accessTokenExpired(latestAuth, this.config.token_expiry_buffer_ms)) {
+                this.pendingPersistence.delete(account.id);
+                this.accountManager.publishAuthCandidate(latestAccount, false);
                 return;
             }
-            const newAuth = await refreshAccessToken(latestAuth ?? getAuthFallback());
-            this.accountManager.updateFromAuth(account, newAuth);
-            await this.repository.batchSave(this.accountManager.getAccounts());
+            const pendingCandidate = this.pendingPersistence.get(account.id);
+            if (pendingCandidate) {
+                await this.persistRefreshedAccount(pendingCandidate);
+                this.pendingPersistence.delete(account.id);
+                this.accountManager.publishAuthCandidate(pendingCandidate);
+                return;
+            }
+            const newAuth = await this.refreshAccessToken(latestAuth ?? getAuthFallback());
+            const candidate = this.accountManager.createAuthCandidate(latestAccount ?? account, newAuth);
+            this.pendingPersistence.set(account.id, candidate);
+            await this.persistRefreshedAccount(candidate);
+            this.pendingPersistence.delete(account.id);
+            this.accountManager.publishAuthCandidate(candidate);
         });
     }
+    async persistRefreshedAccount(candidate) {
+        for (let attempt = 1; attempt <= TOKEN_PERSISTENCE_MAX_ATTEMPTS; attempt++) {
+            try {
+                await this.repository.save(candidate);
+                return;
+            }
+            catch (error) {
+                const retryable = isTransientPersistenceError(error);
+                if (!retryable || attempt === TOKEN_PERSISTENCE_MAX_ATTEMPTS) {
+                    throw new TokenPersistenceError();
+                }
+                logger.warn('Token persistence failed; retrying', {
+                    email: candidate.email,
+                    attempt,
+                    maxAttempts: TOKEN_PERSISTENCE_MAX_ATTEMPTS
+                });
+                const jitter = Math.floor(TOKEN_PERSISTENCE_RETRY_DELAY_MS * 0.25 * this.random());
+                await this.sleep(TOKEN_PERSISTENCE_RETRY_DELAY_MS * attempt + jitter);
+            }
+        }
+    }
     async readLatestAuth(account) {
         this.repository.invalidateCache();
         const accounts = await this.repository.findAll();
@@ -111,42 +173,41 @@ export class TokenRefresher {
         if (!latestAccount) {
             return { latestAccount: null, latestAuth: null };
         }
+        this.syncPersistedAccountReference(account, latestAccount);
+        return {
+            latestAccount,
+            latestAuth: this.accountManager.toAuthDetails(account)
+        };
+    }
+    syncPersistedAccountReference(account, latestAccount) {
         account.email = latestAccount.email;
         account.authMethod = latestAccount.authMethod;
         account.region = latestAccount.region;
-        if (latestAccount.oidcRegion !== undefined) {
-            account.oidcRegion = latestAccount.oidcRegion;
-        }
-        else {
+        if (latestAccount.oidcRegion === undefined)
             delete account.oidcRegion;
-        }
-        if (latestAccount.clientId !== undefined) {
-            account.clientId = latestAccount.clientId;
-        }
-        else {
+        else
+            account.oidcRegion = latestAccount.oidcRegion;
+        if (latestAccount.clientId === undefined)
             delete account.clientId;
-        }
-        if (latestAccount.clientSecret !== undefined) {
-            account.clientSecret = latestAccount.clientSecret;
-        }
-        else {
+        else
+            account.clientId = latestAccount.clientId;
+        if (latestAccount.clientSecret === undefined)
             delete account.clientSecret;
-        }
-        if (latestAccount.profileArn !== undefined) {
-            account.profileArn = latestAccount.profileArn;
-        }
-        else {
+        else
+            account.clientSecret = latestAccount.clientSecret;
+        if (latestAccount.profileArn === undefined)
             delete account.profileArn;
-        }
+        else
+            account.profileArn = latestAccount.profileArn;
         account.refreshToken = latestAccount.refreshToken;
         account.accessToken = latestAccount.accessToken;
         account.expiresAt = latestAccount.expiresAt;
-        return {
-            latestAccount,
-            latestAuth: this.accountManager.toAuthDetails(account)
-        };
     }
     async handleRefreshError(error, account, showToast) {
+        if (error instanceof TokenPersistenceError) {
+            logger.error('Token refresh persistence failed', { email: account.email });
+            return { account, shouldContinue: true };
+        }
         const message = error instanceof Error ? error.message : String(error);
         logger.error('Token refresh failed', {
             email: account.email,

package/dist/core/request/error-handler.js

@@ -118,6 +118,11 @@ export class ErrorHandler {
                     if (result.dead) {
                         return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, nextForced, showToast);
                     }
+                    // Record this account as already force-refreshed even on a transient
+                    // failure: the at-most-once-per-request force-refresh invariant bounds
+                    // the retry loop. A candidate that was refreshed but not yet persisted
+                    // is retried by TokenRefresher's pendingPersistence path, which does
+                    // not re-call AWS, so dropping nextForced here is unnecessary.
                     return this.transientForbidden(errorReason, response.status, { ...context, forcedRefreshAccountIds: nextForced }, showToast, signal);
                 }
                 return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, forced, showToast);

package/dist/core/request/request-handler.js

@@ -14,6 +14,7 @@ import { RetryStrategy } from './retry-strategy.js';
 import { SdkEventStreamIterationError, UpstreamUnexpectedError } from './stream-error.js';
 const KIRO_API_PATTERN = /^(https?:\/\/)?q\.[a-z0-9-]+\.amazonaws\.com/;
 const REAUTH_FAILURE_COOLDOWN_MS = 60000;
+const MAX_STREAM_ATTEMPTS = 3;
 function describeError(error, depth = 0) {
     if (!(error instanceof Error))
         return String(error);
@@ -182,6 +183,18 @@ export class RequestHandler {
                     continue;
                 }
                 const sdkPrep = this.prepareSdkRequest(init?.body, model, auth, think, budget, showToast);
+                const streamAttempt = streamFailureCount + 1;
+                const streamLogDetails = (details = {}) => ({
+                    conversationId: sdkPrep.conversationId,
+                    model,
+                    effectiveModel: sdkPrep.effectiveModel,
+                    region: sdkPrep.region,
+                    account: acc.email,
+                    accountId: acc.id,
+                    streamAttempt,
+                    maxStreamAttempts: MAX_STREAM_ATTEMPTS,
+                    ...details
+                });
                 if (this.config.enable_log_effort_debug) {
                     try {
                         logger.log('[effort-debug] request effort resolution', {
@@ -231,6 +244,7 @@ export class RequestHandler {
                     if (this.config.sdk_response_timeout_enabled) {
                         const messageContext = sdkPrep.conversationState.currentMessage?.userInputMessage?.userInputMessageContext;
                         beginUpstreamWait('SDK response', this.config.sdk_response_timeout_ms, {
+                            conversationId: sdkPrep.conversationId,
                             model,
                             effectiveModel: sdkPrep.effectiveModel,
                             effort: sdkPrep.effort,
@@ -261,6 +275,7 @@ export class RequestHandler {
                             if (!this.config.stream_event_timeout_enabled)
                                 return;
                             beginUpstreamWait('stream event', this.config.request_timeout_ms, {
+                                conversationId: sdkPrep.conversationId,
                                 model,
                                 effectiveModel: sdkPrep.effectiveModel,
                                 region: sdkPrep.region,
@@ -268,20 +283,32 @@ export class RequestHandler {
                             });
                         },
                         onUpstreamWaitEnd: endUpstreamWait,
-                        onIterationError: (error, afterCompletionMetadata) => logger.warn('Kiro SDK event stream iteration failed', {
-                            model,
-                            effectiveModel: sdkPrep.effectiveModel,
-                            region: sdkPrep.region,
-                            platform: process.platform,
-                            afterCompletionMetadata,
-                            recovered: afterCompletionMetadata,
-                            error: describeError(error)
-                        }),
+                        onIterationError: (error, afterCompletionMetadata) => {
+                            if (!afterCompletionMetadata)
+                                return;
+                            logger.log('Kiro SDK event stream closed after completion metadata', streamLogDetails({
+                                outcome: 'ignored_after_completion_metadata',
+                                platform: process.platform,
+                                afterCompletionMetadata,
+                                error: describeError(error)
+                            }));
+                        },
                         onComplete: completeRequest,
                         onTerminal: cleanupRequest,
                         onCancel: (reason) => requestController.abort(reason),
-                        mapError: (error) => new UpstreamUnexpectedError(error, true)
+                        mapError: (error) => {
+                            logger.error('Kiro SDK event stream iteration failed', streamLogDetails({
+                                outcome: 'terminated_after_output',
+                                platform: process.platform,
+                                emittedOutput: true,
+                                error: describeError(error)
+                            }));
+                            return new UpstreamUnexpectedError(error, true);
+                        }
                     });
+                    if (streamFailureCount > 0) {
+                        logger.log('Kiro SDK event stream retry recovered', streamLogDetails({ outcome: 'recovered', attempts: streamAttempt }));
+                    }
                     if (sdkPrep.streaming) {
                         responseOwnsLifecycle = true;
                     }
@@ -296,9 +323,17 @@ export class RequestHandler {
                     if (e instanceof SdkEventStreamIterationError) {
                         streamFailureCount++;
                         const streamError = new UpstreamUnexpectedError(e, false);
-                        if (streamFailureCount >= 3)
+                        if (streamFailureCount >= MAX_STREAM_ATTEMPTS) {
+                            logger.error('Kiro SDK event stream iteration failed', streamLogDetails({
+                                outcome: 'exhausted',
+                                platform: process.platform,
+                                attempts: streamFailureCount,
+                                error: describeError(e)
+                            }));
                             return streamError.toResponse();
-                        await this.sleep(this.getStreamRetryDelay(streamFailureCount), signal);
+                        }
+                        const delayMs = this.getStreamRetryDelay(streamFailureCount);
+                        await this.sleep(delayMs, signal);
                         if (streamFailureCount === 1) {
                             forcedStreamAccount = acc;
                         }
@@ -306,6 +341,14 @@ export class RequestHandler {
                             forcedStreamAccount =
                                 (await this.accountSelector.selectAlternativeAccount(new Set([acc.id]))) ?? acc;
                         }
+                        logger.warn('Kiro SDK event stream iteration failed', streamLogDetails({
+                            outcome: 'retrying',
+                            platform: process.platform,
+                            nextAttempt: streamFailureCount + 1,
+                            delayMs,
+                            nextAccount: forcedStreamAccount.email,
+                            error: describeError(e)
+                        }));
                         continue;
                     }
                     if (sendResolved)

package/dist/plugin/accounts.d.ts

@@ -50,6 +50,9 @@ export declare class AccountManager {
     addAccount(a: ManagedAccount): void;
     removeAccount(a: ManagedAccount): void;
     updateFromAuth(a: ManagedAccount, auth: KiroAuthDetails): void;
+    createAuthCandidate(a: ManagedAccount, auth: KiroAuthDetails): ManagedAccount;
+    publishAuthCandidate(candidate: ManagedAccount, syncKiroCli?: boolean): void;
+    private writeAuthCandidateToKiroCli;
     markRateLimited(a: ManagedAccount, ms: number): void;
     markUnhealthy(a: ManagedAccount, reason: string, recovery?: number): void;
     saveToDisk(): Promise<void>;

package/dist/plugin/accounts.js

@@ -287,34 +287,56 @@ export class AccountManager {
             this.cursor--;
     }
     updateFromAuth(a, auth) {
-        const acc = this.accounts.find((x) => x.id === a.id);
-        if (acc) {
-            acc.accessToken = auth.access;
-            acc.expiresAt = auth.expires;
-            acc.lastUsed = Date.now();
-            if (auth.email)
-                acc.email = auth.email;
-            const p = decodeRefreshToken(auth.refresh);
-            acc.refreshToken = p.refreshToken;
-            if (p.profileArn)
-                acc.profileArn = p.profileArn;
-            if (p.clientId)
-                acc.clientId = p.clientId;
-            acc.failCount = 0;
-            acc.isHealthy = true;
-            delete acc.unhealthyReason;
-            delete acc.recoveryTime;
-            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
-                method: 'updateFromAuth',
-                email: acc.email,
-                error: e instanceof Error ? e.message : String(e)
-            }));
-            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
-                method: 'updateFromAuth',
-                email: acc.email,
-                error: e instanceof Error ? e.message : String(e)
-            }));
-        }
+        const account = this.accounts.find((item) => item.id === a.id);
+        if (!account)
+            return;
+        const candidate = this.createAuthCandidate(account, auth);
+        this.publishAuthCandidate(candidate, false);
+        kiroDb.upsertAccount(candidate).catch((e) => logger.warn('DB write failed', {
+            method: 'updateFromAuth',
+            email: candidate.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
+        this.writeAuthCandidateToKiroCli(candidate);
+    }
+    createAuthCandidate(a, auth) {
+        const candidate = { ...a };
+        candidate.accessToken = auth.access;
+        candidate.expiresAt = auth.expires;
+        candidate.lastUsed = Date.now();
+        if (auth.email)
+            candidate.email = auth.email;
+        const p = decodeRefreshToken(auth.refresh);
+        candidate.refreshToken = p.refreshToken;
+        if (p.profileArn)
+            candidate.profileArn = p.profileArn;
+        if (p.clientId)
+            candidate.clientId = p.clientId;
+        candidate.failCount = 0;
+        candidate.isHealthy = true;
+        delete candidate.unhealthyReason;
+        delete candidate.recoveryTime;
+        return candidate;
+    }
+    publishAuthCandidate(candidate, syncKiroCli = true) {
+        const account = this.accounts.find((item) => item.id === candidate.id);
+        if (!account)
+            return;
+        Object.assign(account, candidate);
+        if (candidate.unhealthyReason === undefined)
+            delete account.unhealthyReason;
+        if (candidate.recoveryTime === undefined)
+            delete account.recoveryTime;
+        if (!syncKiroCli)
+            return;
+        this.writeAuthCandidateToKiroCli(account);
+    }
+    writeAuthCandidateToKiroCli(account) {
+        writeToKiroCli(account).catch((e) => logger.warn('CLI write failed', {
+            method: 'updateFromAuth',
+            email: account.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     markRateLimited(a, ms) {
         const acc = this.accounts.find((x) => x.id === a.id);

package/dist/plugin/errors.d.ts

@@ -3,6 +3,9 @@ export declare class KiroTokenRefreshError extends Error {
     originalError?: Error;
     constructor(message: string, code?: string, originalError?: Error);
 }
+export declare class TokenPersistenceError extends Error {
+    constructor();
+}
 export declare class KiroQuotaExhaustedError extends Error {
     recoveryTime?: number;
     constructor(message: string, recoveryTime?: number);

package/dist/plugin/errors.js

@@ -8,6 +8,12 @@ export class KiroTokenRefreshError extends Error {
         this.originalError = originalError;
     }
 }
+export class TokenPersistenceError extends Error {
+    constructor() {
+        super('Failed to persist refreshed credentials');
+        this.name = 'TokenPersistenceError';
+    }
+}
 export class KiroQuotaExhaustedError extends Error {
     recoveryTime;
     constructor(message, recoveryTime) {

package/dist/plugin/storage/locked-operations.d.ts

@@ -2,7 +2,6 @@ import type { ManagedAccount } from '../types.js';
 export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
 export declare function withDatabaseLockSync<T>(dbPath: string, fn: () => T): T;
-export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
 export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T | null>;

package/dist/plugin/storage/locked-operations.js

@@ -5,24 +5,14 @@ import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
 import { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
-const DATABASE_LOCK_OPTIONS = {
-    stale: 10000,
-    retries: 0,
-    realpath: false
-};
-const DATABASE_LOCK_DEADLINE_MS = 10000;
-const DATABASE_LOCK_MIN_BACKOFF_MS = 25;
-const DATABASE_LOCK_MAX_BACKOFF_MS = 250;
 const REFRESH_LOCK_OPTIONS = {
     stale: 15000,
-    retries: {
-        retries: 10,
-        minTimeout: 100,
-        maxTimeout: 1000,
-        factor: 2
-    },
+    retries: 0,
     realpath: false
 };
+const REFRESH_LOCK_DEADLINE_MS = 15000;
+const REFRESH_LOCK_MIN_BACKOFF_MS = 25;
+const REFRESH_LOCK_MAX_BACKOFF_MS = 250;
 const KEEP_ALIVE_LOCK_OPTIONS = {
     stale: 120000,
     retries: 0,
@@ -33,29 +23,35 @@ const SYNC_LOCK_DEADLINE_MS = 10000;
 function blockingBackoff(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function isLockContention(e) {
-    return typeof e === 'object' && e !== null && 'code' in e && e.code === 'ELOCKED';
+function isRetryableLockAcquisitionError(e) {
+    if (typeof e !== 'object' || e === null || !('code' in e))
+        return false;
+    // proper-lockfile may surface ENOENT from mtimePrecision.probe() when another
+    // process removes the newly-created lock directory during stale takeover.
+    // Keep this scoped to the bounded lock-acquisition loops below so unrelated
+    // filesystem ENOENT errors still propagate immediately.
+    return e.code === 'ELOCKED' || e.code === 'ENOENT';
 }
-function asyncBackoff(attempt, remainingMs) {
-    const ceiling = Math.min(DATABASE_LOCK_MIN_BACKOFF_MS * 2 ** Math.min(attempt, 4), DATABASE_LOCK_MAX_BACKOFF_MS, remainingMs);
+function asyncBackoff(attempt, remainingMs, minBackoffMs, maxBackoffMs) {
+    const ceiling = Math.min(minBackoffMs * 2 ** Math.min(attempt, 4), maxBackoffMs, remainingMs);
     const floor = Math.max(1, Math.floor(ceiling / 2));
     const delay = floor + Math.floor(Math.random() * (ceiling - floor + 1));
     return new Promise((resolve) => setTimeout(resolve, delay));
 }
-async function acquireDatabaseLock(dbPath) {
+async function acquireRefreshLock(lockPath) {
     // A deadline avoids fixed retry-count starvation; jitter keeps contenders
     // from repeatedly attempting the atomic mkdir in lockstep.
-    const deadline = Date.now() + DATABASE_LOCK_DEADLINE_MS;
+    const deadline = Date.now() + REFRESH_LOCK_DEADLINE_MS;
     let attempt = 0;
     for (;;) {
         try {
-            return await lockfile.lock(dbPath, DATABASE_LOCK_OPTIONS);
+            return await lockfile.lock(lockPath, REFRESH_LOCK_OPTIONS);
         }
         catch (e) {
             const remainingMs = deadline - Date.now();
-            if (!isLockContention(e) || remainingMs <= 0)
+            if (!isRetryableLockAcquisitionError(e) || remainingMs <= 0)
                 throw e;
-            await asyncBackoff(attempt++, remainingMs);
+            await asyncBackoff(attempt++, remainingMs, REFRESH_LOCK_MIN_BACKOFF_MS, REFRESH_LOCK_MAX_BACKOFF_MS);
         }
     }
 }
@@ -75,7 +71,7 @@ export function withDatabaseLockSync(dbPath, fn) {
             break;
         }
         catch (e) {
-            if (!isLockContention(e) || Date.now() >= deadline)
+            if (!isRetryableLockAcquisitionError(e) || Date.now() >= deadline)
                 throw e;
             blockingBackoff(Math.min(100 * 2 ** attempt++, 500));
         }
@@ -92,27 +88,6 @@ export function withDatabaseLockSync(dbPath, fn) {
         }
     }
 }
-export async function withDatabaseLock(dbPath, fn) {
-    if (!existsSync(dbPath)) {
-        await fs.mkdir(dirname(dbPath), { recursive: true });
-        await fs.writeFile(dbPath, '');
-    }
-    let release = null;
-    try {
-        release = await acquireDatabaseLock(dbPath);
-        return await fn();
-    }
-    finally {
-        if (release) {
-            try {
-                await release();
-            }
-            catch (e) {
-                console.warn('Failed to release lock:', e);
-            }
-        }
-    }
-}
 export async function withRefreshLock(accountId, fn) {
     const lockPath = getRefreshLockPath(accountId);
     if (!existsSync(lockPath)) {
@@ -121,7 +96,7 @@ export async function withRefreshLock(accountId, fn) {
     }
     let release = null;
     try {
-        release = await lockfile.lock(lockPath, REFRESH_LOCK_OPTIONS);
+        release = await acquireRefreshLock(lockPath);
         return await fn();
     }
     finally {

package/dist/plugin/storage/migrations.js

@@ -1,4 +1,56 @@
+const REFRESH_TOKEN_DEDUP_MARKER = 'refresh_token_dedup_migration_version';
+const REFRESH_TOKEN_DEDUP_VERSION = 1;
+const MIGRATION_LOCK_DEADLINE_MS = 30_000;
+const MIGRATION_LOCK_MIN_BACKOFF_MS = 25;
+const MIGRATION_LOCK_MAX_BACKOFF_MS = 500;
+class MigrationLockTimeoutError extends Error {
+    name = 'MigrationLockTimeoutError';
+    code = 'KIRO_DB_MIGRATION_LOCK_TIMEOUT';
+    constructor(cause) {
+        super(`Timed out after ${MIGRATION_LOCK_DEADLINE_MS}ms waiting for the migration write lock`, {
+            cause
+        });
+    }
+}
+function isSqliteBusy(error) {
+    if (typeof error !== 'object' || error === null || !('code' in error))
+        return false;
+    return typeof error.code === 'string' && error.code.startsWith('SQLITE_BUSY');
+}
+function blockingBackoff(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function beginImmediateWithRetry(db) {
+    const deadline = Date.now() + MIGRATION_LOCK_DEADLINE_MS;
+    let backoffMs = MIGRATION_LOCK_MIN_BACKOFF_MS;
+    for (;;) {
+        try {
+            db.exec('BEGIN IMMEDIATE');
+            return;
+        }
+        catch (error) {
+            if (!isSqliteBusy(error))
+                throw error;
+            const remainingMs = deadline - Date.now();
+            if (remainingMs <= 0)
+                throw new MigrationLockTimeoutError(error);
+            const jitterMs = Math.floor(Math.random() * Math.max(1, backoffMs / 4));
+            blockingBackoff(Math.min(backoffMs + jitterMs, remainingMs));
+            backoffMs = Math.min(backoffMs * 2, MIGRATION_LOCK_MAX_BACKOFF_MS);
+        }
+    }
+}
+function hasRefreshTokenDedupMarker(db) {
+    const marker = db
+        .prepare('SELECT value FROM plugin_meta WHERE key = ?')
+        .get(REFRESH_TOKEN_DEDUP_MARKER);
+    if (typeof marker !== 'object' || marker === null)
+        return false;
+    const value = 'value' in marker ? marker.value : undefined;
+    return typeof value === 'number' && value >= REFRESH_TOKEN_DEDUP_VERSION;
+}
 export function runMigrations(db) {
+    migratePluginMetaTable(db);
     migrateToUniqueRefreshToken(db);
     migrateRealEmailColumn(db);
     migrateUsageTable(db);
@@ -7,19 +59,18 @@ export function runMigrations(db) {
     migrateDropRefreshTokenUniqueIndex(db);
     migrateRemovedAccountsTable(db);
     migrateOverageColumn(db);
-    migratePluginMetaTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
-    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
-    if (indexProbe.get())
+    if (hasRefreshTokenDedupMarker(db))
         return;
+    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
     // BEGIN IMMEDIATE (not deferred BEGIN): a deferred read-then-write txn raises unrecoverable
     // SQLITE_BUSY_SNAPSHOT (busy_timeout cannot retry it) if another connection writes after the
     // read snapshot. Taking the write lock at BEGIN makes concurrent processes serialize via
     // busy_timeout instead of racing into a snapshot conflict.
-    db.exec('BEGIN IMMEDIATE');
+    beginImmediateWithRetry(db);
     try {
-        if (indexProbe.get()) {
+        if (hasRefreshTokenDedupMarker(db)) {
             db.exec('COMMIT');
             return;
         }
@@ -55,7 +106,11 @@ function migrateToUniqueRefreshToken(db) {
                 }
             }
         }
-        db.exec('CREATE UNIQUE INDEX idx_refresh_token_unique ON accounts(refresh_token)');
+        if (!indexProbe.get()) {
+            db.exec('CREATE UNIQUE INDEX idx_refresh_token_unique ON accounts(refresh_token)');
+        }
+        db.prepare(`INSERT INTO plugin_meta(key, value) VALUES(?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(REFRESH_TOKEN_DEDUP_MARKER, REFRESH_TOKEN_DEDUP_VERSION);
         db.exec('COMMIT');
     }
     catch (e) {
@@ -134,14 +189,23 @@ function migrateOidcRegionColumn(db) {
         db.exec('ALTER TABLE accounts ADD COLUMN oidc_region TEXT');
     }
     // Backfill: historically `region` was used for both service + OIDC.
-    db.exec("UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = ''");
+    const needsBackfill = db
+        .prepare("SELECT 1 FROM accounts WHERE oidc_region IS NULL OR oidc_region = '' LIMIT 1")
+        .get();
+    if (needsBackfill) {
+        db.exec("UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = ''");
+    }
 }
 function migrateDropRefreshTokenUniqueIndex(db) {
     // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
     // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
     // harmful: duplicate rows (same account, different legacy vs hash id) share the same
     // refresh_token, causing UNIQUE constraint violations on every upsert.
-    db.exec('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    const hasUniqueIndex = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'")
+        .get();
+    if (hasUniqueIndex)
+        db.exec('DROP INDEX IF EXISTS idx_refresh_token_unique');
     // Clean up duplicate rows: same email + same refresh_token but different ids.
     // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
     const duplicates = db
@@ -175,5 +239,18 @@ function migrateOverageColumn(db) {
     }
 }
 function migratePluginMetaTable(db) {
-    db.exec('CREATE TABLE IF NOT EXISTS plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+    const tableProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='plugin_meta'");
+    if (tableProbe.get())
+        return;
+    beginImmediateWithRetry(db);
+    try {
+        if (!tableProbe.get()) {
+            db.exec('CREATE TABLE plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+        }
+        db.exec('COMMIT');
+    }
+    catch (error) {
+        db.exec('ROLLBACK');
+        throw error;
+    }
 }

package/dist/plugin/storage/sqlite.d.ts

@@ -4,6 +4,7 @@ export declare class KiroDatabase {
     private db;
     private path;
     constructor(path?: string);
+    private withImmediateTransaction;
     private init;
     getAccounts(): any[];
     private upsertAccountInternal;

package/dist/plugin/storage/sqlite.js

@@ -2,8 +2,32 @@ import Database from 'libsql';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { deduplicateAccounts, mergeAccounts, withDatabaseLock, withDatabaseLockSync } from './locked-operations.js';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLockSync } from './locked-operations.js';
 import { runMigrations } from './migrations.js';
+const DATABASE_BUSY_TIMEOUT_MS = 5_000;
+const WRITE_LOCK_DEADLINE_MS = 30_000;
+const WRITE_LOCK_MIN_BACKOFF_MS = 25;
+const WRITE_LOCK_MAX_BACKOFF_MS = 500;
+class DatabaseWriteLockTimeoutError extends Error {
+    name = 'DatabaseWriteLockTimeoutError';
+    code = 'KIRO_DB_WRITE_LOCK_TIMEOUT';
+    constructor(cause) {
+        super(`Timed out after ${WRITE_LOCK_DEADLINE_MS}ms waiting for the database write lock`, {
+            cause
+        });
+    }
+}
+function isSqliteBusy(error) {
+    if (typeof error !== 'object' || error === null || !('code' in error))
+        return false;
+    return typeof error.code === 'string' && error.code.startsWith('SQLITE_BUSY');
+}
+function asyncBackoff(attempt, remainingMs) {
+    const ceiling = Math.min(WRITE_LOCK_MIN_BACKOFF_MS * 2 ** Math.min(attempt, 5), WRITE_LOCK_MAX_BACKOFF_MS, remainingMs);
+    const floor = Math.max(1, Math.floor(ceiling / 2));
+    const delay = floor + Math.floor(Math.random() * (ceiling - floor + 1));
+    return new Promise((resolve) => setTimeout(resolve, delay));
+}
 function getBaseDir() {
     const p = process.platform;
     if (p === 'win32')
@@ -20,9 +44,55 @@ export class KiroDatabase {
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
         this.db = new Database(path);
-        this.db.pragma('busy_timeout = 5000');
+        this.db.pragma(`busy_timeout = ${DATABASE_BUSY_TIMEOUT_MS}`);
         withDatabaseLockSync(this.path, () => this.init());
     }
+    async withImmediateTransaction(fn) {
+        const deadline = Date.now() + WRITE_LOCK_DEADLINE_MS;
+        let attempt = 0;
+        for (;;) {
+            const busyTimeoutResult = this.db.pragma('busy_timeout', { simple: true });
+            const busyTimeout = typeof busyTimeoutResult === 'number'
+                ? busyTimeoutResult
+                : typeof busyTimeoutResult === 'object' && busyTimeoutResult !== null
+                    ? Reflect.get(busyTimeoutResult, 'timeout')
+                    : undefined;
+            if (typeof busyTimeout !== 'number') {
+                throw new TypeError('Expected numeric busy_timeout from libsql');
+            }
+            let begun = false;
+            let beginError;
+            try {
+                this.db.pragma('busy_timeout = 0');
+                this.db.exec('BEGIN IMMEDIATE');
+                begun = true;
+            }
+            catch (error) {
+                beginError = error;
+            }
+            finally {
+                this.db.pragma(`busy_timeout = ${busyTimeout}`);
+            }
+            if (!begun) {
+                if (!isSqliteBusy(beginError))
+                    throw beginError;
+                const remainingMs = deadline - Date.now();
+                if (remainingMs <= 0)
+                    throw new DatabaseWriteLockTimeoutError(beginError);
+                await asyncBackoff(attempt++, remainingMs);
+                continue;
+            }
+            try {
+                const result = fn();
+                this.db.exec('COMMIT');
+                return result;
+            }
+            catch (error) {
+                this.db.exec('ROLLBACK');
+                throw error;
+            }
+        }
+    }
     init() {
         this.db.pragma('journal_mode = WAL');
         this.db.exec(`
@@ -79,96 +149,64 @@ export class KiroDatabase {
         this.db.prepare('DELETE FROM accounts WHERE id IN (SELECT id FROM removed_accounts)').run();
     }
     async upsertAccount(acc) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const existing = this.getAccounts().map(this.rowToAccount);
             const merged = mergeAccounts(existing, [acc]);
             const deduplicated = deduplicateAccounts(merged);
             const writable = deduplicated.filter((a) => !this.isRemovedSync(a.id));
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.purgeRemovedAccountsSync();
-                for (const account of writable) {
-                    this.upsertAccountInternal(account);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            this.purgeRemovedAccountsSync();
+            for (const account of writable) {
+                this.upsertAccountInternal(account);
             }
         });
     }
     async batchUpsertAccounts(accounts) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const existing = this.getAccounts().map(this.rowToAccount);
             const merged = mergeAccounts(existing, accounts);
             const deduplicated = deduplicateAccounts(merged);
             const writable = deduplicated.filter((a) => !this.isRemovedSync(a.id));
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.purgeRemovedAccountsSync();
-                for (const account of writable) {
-                    this.upsertAccountInternal(account);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            this.purgeRemovedAccountsSync();
+            for (const account of writable) {
+                this.upsertAccountInternal(account);
             }
         });
     }
     async deleteAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
         });
     }
     async removeAccountWithTombstone(id) {
-        await withDatabaseLock(this.path, async () => {
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
-                this.db
-                    .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
-                    .run(id, Date.now());
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
-            }
+        await this.withImmediateTransaction(() => {
+            this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+            this.db
+                .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
+                .run(id, Date.now());
         });
     }
     async cleanupSupersededIdentities(keepId, email, authMethod, profileArn) {
-        const supersededIds = [];
-        await withDatabaseLock(this.path, async () => {
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                const rows = this.db
-                    .prepare('SELECT id FROM accounts WHERE email = ? AND auth_method = ? AND profile_arn IS ? AND id != ?')
-                    .all(email, authMethod, profileArn ?? null, keepId);
-                for (const row of rows) {
-                    if (typeof row === 'object' && row !== null && 'id' in row && typeof row.id === 'string')
-                        supersededIds.push(row.id);
-                }
-                const deleteStmt = this.db.prepare('DELETE FROM accounts WHERE id = ?');
-                const tombstoneStmt = this.db.prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)');
-                const removedAt = Date.now();
-                for (const id of supersededIds) {
-                    deleteStmt.run(id);
-                    tombstoneStmt.run(id, removedAt);
-                }
-                this.db.exec('COMMIT');
+        return this.withImmediateTransaction(() => {
+            const supersededIds = [];
+            const rows = this.db
+                .prepare('SELECT id FROM accounts WHERE email = ? AND auth_method = ? AND profile_arn IS ? AND id != ?')
+                .all(email, authMethod, profileArn ?? null, keepId);
+            for (const row of rows) {
+                if (typeof row === 'object' && row !== null && 'id' in row && typeof row.id === 'string')
+                    supersededIds.push(row.id);
             }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            const deleteStmt = this.db.prepare('DELETE FROM accounts WHERE id = ?');
+            const tombstoneStmt = this.db.prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)');
+            const removedAt = Date.now();
+            for (const id of supersededIds) {
+                deleteStmt.run(id);
+                tombstoneStmt.run(id, removedAt);
             }
+            return supersededIds;
         });
-        return supersededIds;
     }
     async addRemovedAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db
                 .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
                 .run(id, Date.now());
@@ -178,7 +216,7 @@ export class KiroDatabase {
         return !!this.db.prepare('SELECT id FROM removed_accounts WHERE id = ?').get(id);
     }
     async clearRemovedAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db.prepare('DELETE FROM removed_accounts WHERE id = ?').run(id);
         });
     }
@@ -186,7 +224,7 @@ export class KiroDatabase {
         return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
     }
     async nextAssignmentIndex() {
-        return withDatabaseLock(this.path, async () => {
+        return this.withImmediateTransaction(() => {
             const row = this.db
                 .prepare("INSERT INTO plugin_meta(key,value) VALUES('assignment_cursor',0) ON CONFLICT(key) DO UPDATE SET value=value+1 RETURNING value")
                 .get();
@@ -196,11 +234,9 @@ export class KiroDatabase {
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const now = Date.now();
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                const stmt = this.db.prepare(`
+            const stmt = this.db.prepare(`
             UPDATE accounts
             SET is_healthy = 0,
                 unhealthy_reason = ?,
@@ -210,14 +246,8 @@ export class KiroDatabase {
                 last_sync = ?
             WHERE id = ?
           `);
-                for (const id of ids) {
-                    stmt.run(reason, now, id);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            for (const id of ids) {
+                stmt.run(reason, now, id);
             }
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",