@sunerpy/opencode-kiro-auth 0.15.1 → 0.15.3

package/README.md

@@ -109,6 +109,14 @@ multi-account or long-idle setups, enable
 (`token_keepalive_enabled: true`) to keep idle accounts' tokens fresh while
 OpenCode is running.
 
+For long-running agent tasks that are frequently interrupted by upstream
+`ECONNRESET` event-stream failures, enable
+`"stream_buffer_until_complete": true`. The plugin then withholds a failed
+attempt from OpenCode and safely retries it instead of exposing a partial
+assistant response or partial tool call. See
+[stream recovery configuration](docs/CONFIGURATION.md#options) for the latency
+and quota tradeoffs.
+
 Paid-overage protection is on by default; see
 [Overage protection](docs/CONFIGURATION.md#overage-protection) before disabling
 `stop_on_overage`.
@@ -231,6 +239,12 @@ accounts", `/connect` vs `opencode auth login`, and Kiro CLI OAuth users whose
 sync doesn't start — are covered in
 [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md).
 
+`Kiro upstream event stream failed unexpectedly` means the upstream HTTP 200
+event stream ended before completion metadata. Live-stream mode cannot safely
+replay after output because that could duplicate text or execute a tool twice.
+Enable `stream_buffer_until_complete` when task continuity is more important
+than seeing tokens arrive live.
+
 ## Migration
 
 If you're upgrading from a version that used the provider id `kiro` instead of

package/dist/core/auth/token-refresher.d.ts

@@ -1,5 +1,6 @@
 import type { AccountRepository } from '../../infrastructure/database/account-repository.js';
 import type { AccountManager } from '../../plugin/accounts.js';
+import { refreshAccessToken } from '../../plugin/token.js';
 import type { KiroAuthDetails, ManagedAccount } from '../../plugin/types.js';
 type ToastFunction = (message: string, variant: 'info' | 'warning' | 'success' | 'error') => void;
 interface TokenRefresherConfig {
@@ -7,6 +8,11 @@ interface TokenRefresherConfig {
     auto_sync_kiro_cli: boolean;
     account_selection_strategy: 'sticky' | 'round-robin' | 'lowest-usage';
 }
+interface TokenRefresherDependencies {
+    refreshAccessToken: typeof refreshAccessToken;
+    sleep: (delayMs: number) => Promise<void>;
+    random: () => number;
+}
 /** Outcome of a forced refresh; `dead` distinguishes refresh-token-dead
  *  (needs re-login) from a transient failure (network/5xx). */
 export interface ForceRefreshResult {
@@ -27,8 +33,12 @@ export declare class TokenRefresher {
     private syncFromKiroCli;
     private repository;
     private readonly inFlight;
+    private readonly pendingPersistence;
     private readonly lastDeadToastAt;
-    constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository);
+    private readonly refreshAccessToken;
+    private readonly sleep;
+    private readonly random;
+    constructor(config: TokenRefresherConfig, accountManager: AccountManager, syncFromKiroCli: () => Promise<void>, repository: AccountRepository, dependencies?: Partial<TokenRefresherDependencies>);
     refreshIfNeeded(account: ManagedAccount, auth: KiroAuthDetails, showToast: ToastFunction): Promise<{
         account: ManagedAccount;
         shouldContinue: boolean;
@@ -36,7 +46,9 @@ export declare class TokenRefresher {
     forceRefresh(account: ManagedAccount, showToast: ToastFunction): Promise<ForceRefreshResult>;
     private startOrJoinRefresh;
     private runLockedRefresh;
+    private persistRefreshedAccount;
     private readLatestAuth;
+    private syncPersistedAccountReference;
     private handleRefreshError;
 }
 export {};

package/dist/core/auth/token-refresher.js

@@ -1,10 +1,24 @@
 import { accessTokenExpired } from '../../kiro/auth.js';
-import { KiroTokenRefreshError } from '../../plugin/errors.js';
+import { KiroTokenRefreshError, TokenPersistenceError } from '../../plugin/errors.js';
 import { isRefreshTokenDead, toDeadReason } from '../../plugin/health.js';
 import * as logger from '../../plugin/logger.js';
 import { withRefreshLock } from '../../plugin/storage/locked-operations.js';
 import { refreshAccessToken } from '../../plugin/token.js';
 const DEAD_TOAST_DEBOUNCE_MS = 60000;
+const TOKEN_PERSISTENCE_MAX_ATTEMPTS = 3;
+const TOKEN_PERSISTENCE_RETRY_DELAY_MS = 250;
+function isTransientPersistenceError(error) {
+    const code = typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code).toUpperCase()
+        : '';
+    const message = error instanceof Error ? error.message : String(error);
+    return (code === 'SQLITE_BUSY' ||
+        code === 'SQLITE_LOCKED' ||
+        /SQLITE_(?:BUSY|LOCKED)|database is locked|lock file is already being held/i.test(message));
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 /**
  * Decide whether a refresh failure means the refresh token / OIDC client is
  * dead (permanent, needs re-login) or is merely transient (network/5xx).
@@ -13,6 +27,9 @@ const DEAD_TOAST_DEBOUNCE_MS = 60000;
  * the stored credentials are unusable, so the account needs a re-login.
  */
 export function isRefreshErrorDead(error) {
+    if (error instanceof TokenPersistenceError) {
+        return false;
+    }
     if (error instanceof KiroTokenRefreshError) {
         if (error.code === 'MISSING_CREDENTIALS' || error.code === 'INVALID_RESPONSE') {
             return true;
@@ -39,12 +56,19 @@ export class TokenRefresher {
     syncFromKiroCli;
     repository;
     inFlight = new Map();
+    pendingPersistence = new Map();
     lastDeadToastAt = new Map();
-    constructor(config, accountManager, syncFromKiroCli, repository) {
+    refreshAccessToken;
+    sleep;
+    random;
+    constructor(config, accountManager, syncFromKiroCli, repository, dependencies = {}) {
         this.config = config;
         this.accountManager = accountManager;
         this.syncFromKiroCli = syncFromKiroCli;
         this.repository = repository;
+        this.refreshAccessToken = dependencies.refreshAccessToken ?? refreshAccessToken;
+        this.sleep = dependencies.sleep ?? defaultSleep;
+        this.random = dependencies.random ?? Math.random;
     }
     async refreshIfNeeded(account, auth, showToast) {
         if (!accessTokenExpired(auth, this.config.token_expiry_buffer_ms)) {
@@ -64,6 +88,10 @@ export class TokenRefresher {
             return { ok: true, dead: false };
         }
         catch (e) {
+            if (e instanceof TokenPersistenceError) {
+                logger.error('Forced token refresh persistence failed', { email: account.email });
+                return { ok: false, dead: false };
+            }
             const dead = isRefreshErrorDead(e);
             logger.error('Forced token refresh failed', {
                 email: account.email,
@@ -94,16 +122,50 @@ export class TokenRefresher {
     }
     async runLockedRefresh(account, getAuthFallback) {
         await withRefreshLock(account.id, async () => {
-            const { latestAuth } = await this.readLatestAuth(account);
-            if (latestAuth && !accessTokenExpired(latestAuth, this.config.token_expiry_buffer_ms)) {
-                this.accountManager.updateFromAuth(account, latestAuth);
+            const { latestAccount, latestAuth } = await this.readLatestAuth(account);
+            if (latestAccount &&
+                latestAuth &&
+                !accessTokenExpired(latestAuth, this.config.token_expiry_buffer_ms)) {
+                this.pendingPersistence.delete(account.id);
+                this.accountManager.publishAuthCandidate(latestAccount, false);
                 return;
             }
-            const newAuth = await refreshAccessToken(latestAuth ?? getAuthFallback());
-            this.accountManager.updateFromAuth(account, newAuth);
-            await this.repository.batchSave(this.accountManager.getAccounts());
+            const pendingCandidate = this.pendingPersistence.get(account.id);
+            if (pendingCandidate) {
+                await this.persistRefreshedAccount(pendingCandidate);
+                this.pendingPersistence.delete(account.id);
+                this.accountManager.publishAuthCandidate(pendingCandidate);
+                return;
+            }
+            const newAuth = await this.refreshAccessToken(latestAuth ?? getAuthFallback());
+            const candidate = this.accountManager.createAuthCandidate(latestAccount ?? account, newAuth);
+            this.pendingPersistence.set(account.id, candidate);
+            await this.persistRefreshedAccount(candidate);
+            this.pendingPersistence.delete(account.id);
+            this.accountManager.publishAuthCandidate(candidate);
         });
     }
+    async persistRefreshedAccount(candidate) {
+        for (let attempt = 1; attempt <= TOKEN_PERSISTENCE_MAX_ATTEMPTS; attempt++) {
+            try {
+                await this.repository.save(candidate);
+                return;
+            }
+            catch (error) {
+                const retryable = isTransientPersistenceError(error);
+                if (!retryable || attempt === TOKEN_PERSISTENCE_MAX_ATTEMPTS) {
+                    throw new TokenPersistenceError();
+                }
+                logger.warn('Token persistence failed; retrying', {
+                    email: candidate.email,
+                    attempt,
+                    maxAttempts: TOKEN_PERSISTENCE_MAX_ATTEMPTS
+                });
+                const jitter = Math.floor(TOKEN_PERSISTENCE_RETRY_DELAY_MS * 0.25 * this.random());
+                await this.sleep(TOKEN_PERSISTENCE_RETRY_DELAY_MS * attempt + jitter);
+            }
+        }
+    }
     async readLatestAuth(account) {
         this.repository.invalidateCache();
         const accounts = await this.repository.findAll();
@@ -111,42 +173,41 @@ export class TokenRefresher {
         if (!latestAccount) {
             return { latestAccount: null, latestAuth: null };
         }
+        this.syncPersistedAccountReference(account, latestAccount);
+        return {
+            latestAccount,
+            latestAuth: this.accountManager.toAuthDetails(account)
+        };
+    }
+    syncPersistedAccountReference(account, latestAccount) {
         account.email = latestAccount.email;
         account.authMethod = latestAccount.authMethod;
         account.region = latestAccount.region;
-        if (latestAccount.oidcRegion !== undefined) {
-            account.oidcRegion = latestAccount.oidcRegion;
-        }
-        else {
+        if (latestAccount.oidcRegion === undefined)
             delete account.oidcRegion;
-        }
-        if (latestAccount.clientId !== undefined) {
-            account.clientId = latestAccount.clientId;
-        }
-        else {
+        else
+            account.oidcRegion = latestAccount.oidcRegion;
+        if (latestAccount.clientId === undefined)
             delete account.clientId;
-        }
-        if (latestAccount.clientSecret !== undefined) {
-            account.clientSecret = latestAccount.clientSecret;
-        }
-        else {
+        else
+            account.clientId = latestAccount.clientId;
+        if (latestAccount.clientSecret === undefined)
             delete account.clientSecret;
-        }
-        if (latestAccount.profileArn !== undefined) {
-            account.profileArn = latestAccount.profileArn;
-        }
-        else {
+        else
+            account.clientSecret = latestAccount.clientSecret;
+        if (latestAccount.profileArn === undefined)
             delete account.profileArn;
-        }
+        else
+            account.profileArn = latestAccount.profileArn;
         account.refreshToken = latestAccount.refreshToken;
         account.accessToken = latestAccount.accessToken;
         account.expiresAt = latestAccount.expiresAt;
-        return {
-            latestAccount,
-            latestAuth: this.accountManager.toAuthDetails(account)
-        };
     }
     async handleRefreshError(error, account, showToast) {
+        if (error instanceof TokenPersistenceError) {
+            logger.error('Token refresh persistence failed', { email: account.email });
+            return { account, shouldContinue: true };
+        }
         const message = error instanceof Error ? error.message : String(error);
         logger.error('Token refresh failed', {
             email: account.email,

package/dist/core/request/error-handler.js

@@ -118,6 +118,11 @@ export class ErrorHandler {
                     if (result.dead) {
                         return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, nextForced, showToast);
                     }
+                    // Record this account as already force-refreshed even on a transient
+                    // failure: the at-most-once-per-request force-refresh invariant bounds
+                    // the retry loop. A candidate that was refreshed but not yet persisted
+                    // is retried by TokenRefresher's pendingPersistence path, which does
+                    // not re-call AWS, so dropping nextForced here is unnecessary.
                     return this.transientForbidden(errorReason, response.status, { ...context, forcedRefreshAccountIds: nextForced }, showToast, signal);
                 }
                 return this.markDeadAndSwitchOrFail(account, errorReason, response.status, context, forced, showToast);

package/dist/core/request/request-handler.js

@@ -14,7 +14,6 @@ import { RetryStrategy } from './retry-strategy.js';
 import { SdkEventStreamIterationError, UpstreamUnexpectedError } from './stream-error.js';
 const KIRO_API_PATTERN = /^(https?:\/\/)?q\.[a-z0-9-]+\.amazonaws\.com/;
 const REAUTH_FAILURE_COOLDOWN_MS = 60000;
-const MAX_STREAM_ATTEMPTS = 3;
 function describeError(error, depth = 0) {
     if (!(error instanceof Error))
         return String(error);
@@ -192,7 +191,8 @@ export class RequestHandler {
                     account: acc.email,
                     accountId: acc.id,
                     streamAttempt,
-                    maxStreamAttempts: MAX_STREAM_ATTEMPTS,
+                    maxStreamAttempts: this.config.stream_max_attempts,
+                    streamDeliveryMode: this.config.stream_buffer_until_complete ? 'buffered' : 'live',
                     ...details
                 });
                 if (this.config.enable_log_effort_debug) {
@@ -296,6 +296,7 @@ export class RequestHandler {
                         onComplete: completeRequest,
                         onTerminal: cleanupRequest,
                         onCancel: (reason) => requestController.abort(reason),
+                        bufferUntilComplete: this.config.stream_buffer_until_complete,
                         mapError: (error) => {
                             logger.error('Kiro SDK event stream iteration failed', streamLogDetails({
                                 outcome: 'terminated_after_output',
@@ -323,7 +324,7 @@ export class RequestHandler {
                     if (e instanceof SdkEventStreamIterationError) {
                         streamFailureCount++;
                         const streamError = new UpstreamUnexpectedError(e, false);
-                        if (streamFailureCount >= MAX_STREAM_ATTEMPTS) {
+                        if (streamFailureCount >= this.config.stream_max_attempts) {
                             logger.error('Kiro SDK event stream iteration failed', streamLogDetails({
                                 outcome: 'exhausted',
                                 platform: process.platform,

package/dist/core/request/response-handler.d.ts

@@ -10,6 +10,7 @@ export interface SdkResponseLifecycle {
     onTerminal?: () => void;
     onCancel?: (reason: unknown) => void;
     mapError?: (error: SdkEventStreamIterationError, emittedOutput: true) => unknown;
+    bufferUntilComplete?: boolean;
 }
 export declare class ResponseHandler {
     handleSuccess(response: Response, model: string, conversationId: string, streaming: boolean): Promise<Response>;

package/dist/core/request/response-handler.js

@@ -115,6 +115,18 @@ function isSemanticChunk(chunk) {
 function encodeSseChunk(chunk) {
     return new TextEncoder().encode(`data: ${JSON.stringify(chunk)}\n\n`);
 }
+function bufferedSseResponse(chunks) {
+    let index = 0;
+    return new Response(new ReadableStream({
+        pull(controller) {
+            const chunk = chunks[index++];
+            if (chunk)
+                controller.enqueue(chunk);
+            if (index >= chunks.length)
+                controller.close();
+        }
+    }, { highWaterMark: 0 }), { headers: { 'Content-Type': 'text/event-stream' } });
+}
 export class ResponseHandler {
     async handleSuccess(response, model, conversationId, streaming) {
         if (streaming) {
@@ -148,22 +160,34 @@ export class ResponseHandler {
         const wrapped = wrapSdkEventStream(sdkResponse, lifecycle.signal, lifecycle.onUpstreamWaitStart, lifecycle.onUpstreamWaitEnd, lifecycle.onIterationError);
         const transformed = transformSdkStream(wrapped.response, model, conversationId);
         const buffered = [];
+        if (lifecycle.bufferUntilComplete) {
+            try {
+                while (true) {
+                    const item = await transformed.next();
+                    if (item.done) {
+                        await lifecycle.onComplete?.();
+                        lifecycle.onTerminal?.();
+                        return bufferedSseResponse(buffered);
+                    }
+                    buffered.push(encodeSseChunk(item.value));
+                }
+            }
+            catch (error) {
+                try {
+                    await transformed.return(undefined);
+                }
+                catch { }
+                await wrapped.closeRaw();
+                throw error;
+            }
+        }
         let firstSemantic;
         while (true) {
             const item = await transformed.next();
             if (item.done) {
                 await lifecycle.onComplete?.();
                 lifecycle.onTerminal?.();
-                let index = 0;
-                return new Response(new ReadableStream({
-                    pull(controller) {
-                        const chunk = buffered[index++];
-                        if (chunk)
-                            controller.enqueue(chunk);
-                        if (index >= buffered.length)
-                            controller.close();
-                    }
-                }, { highWaterMark: 0 }), { headers: { 'Content-Type': 'text/event-stream' } });
+                return bufferedSseResponse(buffered);
             }
             const encoded = encodeSseChunk(item.value);
             if (isSemanticChunk(item.value)) {

package/dist/plugin/accounts.d.ts

@@ -50,6 +50,9 @@ export declare class AccountManager {
     addAccount(a: ManagedAccount): void;
     removeAccount(a: ManagedAccount): void;
     updateFromAuth(a: ManagedAccount, auth: KiroAuthDetails): void;
+    createAuthCandidate(a: ManagedAccount, auth: KiroAuthDetails): ManagedAccount;
+    publishAuthCandidate(candidate: ManagedAccount, syncKiroCli?: boolean): void;
+    private writeAuthCandidateToKiroCli;
     markRateLimited(a: ManagedAccount, ms: number): void;
     markUnhealthy(a: ManagedAccount, reason: string, recovery?: number): void;
     saveToDisk(): Promise<void>;

package/dist/plugin/accounts.js

@@ -287,34 +287,56 @@ export class AccountManager {
             this.cursor--;
     }
     updateFromAuth(a, auth) {
-        const acc = this.accounts.find((x) => x.id === a.id);
-        if (acc) {
-            acc.accessToken = auth.access;
-            acc.expiresAt = auth.expires;
-            acc.lastUsed = Date.now();
-            if (auth.email)
-                acc.email = auth.email;
-            const p = decodeRefreshToken(auth.refresh);
-            acc.refreshToken = p.refreshToken;
-            if (p.profileArn)
-                acc.profileArn = p.profileArn;
-            if (p.clientId)
-                acc.clientId = p.clientId;
-            acc.failCount = 0;
-            acc.isHealthy = true;
-            delete acc.unhealthyReason;
-            delete acc.recoveryTime;
-            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
-                method: 'updateFromAuth',
-                email: acc.email,
-                error: e instanceof Error ? e.message : String(e)
-            }));
-            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
-                method: 'updateFromAuth',
-                email: acc.email,
-                error: e instanceof Error ? e.message : String(e)
-            }));
-        }
+        const account = this.accounts.find((item) => item.id === a.id);
+        if (!account)
+            return;
+        const candidate = this.createAuthCandidate(account, auth);
+        this.publishAuthCandidate(candidate, false);
+        kiroDb.upsertAccount(candidate).catch((e) => logger.warn('DB write failed', {
+            method: 'updateFromAuth',
+            email: candidate.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
+        this.writeAuthCandidateToKiroCli(candidate);
+    }
+    createAuthCandidate(a, auth) {
+        const candidate = { ...a };
+        candidate.accessToken = auth.access;
+        candidate.expiresAt = auth.expires;
+        candidate.lastUsed = Date.now();
+        if (auth.email)
+            candidate.email = auth.email;
+        const p = decodeRefreshToken(auth.refresh);
+        candidate.refreshToken = p.refreshToken;
+        if (p.profileArn)
+            candidate.profileArn = p.profileArn;
+        if (p.clientId)
+            candidate.clientId = p.clientId;
+        candidate.failCount = 0;
+        candidate.isHealthy = true;
+        delete candidate.unhealthyReason;
+        delete candidate.recoveryTime;
+        return candidate;
+    }
+    publishAuthCandidate(candidate, syncKiroCli = true) {
+        const account = this.accounts.find((item) => item.id === candidate.id);
+        if (!account)
+            return;
+        Object.assign(account, candidate);
+        if (candidate.unhealthyReason === undefined)
+            delete account.unhealthyReason;
+        if (candidate.recoveryTime === undefined)
+            delete account.recoveryTime;
+        if (!syncKiroCli)
+            return;
+        this.writeAuthCandidateToKiroCli(account);
+    }
+    writeAuthCandidateToKiroCli(account) {
+        writeToKiroCli(account).catch((e) => logger.warn('CLI write failed', {
+            method: 'updateFromAuth',
+            email: account.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     markRateLimited(a, ms) {
         const acc = this.accounts.find((x) => x.id === a.id);

package/dist/plugin/config/loader.js

@@ -139,6 +139,8 @@ function applyEnvOverrides(config) {
         sdk_response_timeout_ms: parseNumberEnv(env.KIRO_SDK_RESPONSE_TIMEOUT_MS, config.sdk_response_timeout_ms),
         stream_event_timeout_enabled: parseBooleanEnv(env.KIRO_STREAM_EVENT_TIMEOUT_ENABLED, config.stream_event_timeout_enabled),
         request_timeout_ms: parseNumberEnv(env.KIRO_REQUEST_TIMEOUT_MS, config.request_timeout_ms),
+        stream_buffer_until_complete: parseBooleanEnv(env.KIRO_STREAM_BUFFER_UNTIL_COMPLETE, config.stream_buffer_until_complete),
+        stream_max_attempts: parseNumberEnv(env.KIRO_STREAM_MAX_ATTEMPTS, config.stream_max_attempts),
         token_expiry_buffer_ms: parseNumberEnv(env.KIRO_TOKEN_EXPIRY_BUFFER_MS, config.token_expiry_buffer_ms),
         usage_sync_max_retries: parseNumberEnv(env.KIRO_USAGE_SYNC_MAX_RETRIES, config.usage_sync_max_retries),
         auth_server_port_start: parseNumberEnv(env.KIRO_AUTH_SERVER_PORT_START, config.auth_server_port_start),

package/dist/plugin/config/schema.d.ts

@@ -77,6 +77,17 @@ export declare const KiroConfigSchema: z.ZodObject<{
      * Only used when stream_event_timeout_enabled is true.
      */
     request_timeout_ms: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Consume the complete Kiro event stream before exposing any semantic output
+     * downstream. This trades live token display for safe retries after a
+     * mid-stream transport failure without duplicating content or tool calls.
+     */
+    stream_buffer_until_complete: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Maximum number of complete event-stream attempts. Buffered mode can safely
+     * use every attempt even when the failed upstream stream produced output.
+     */
+    stream_max_attempts: z.ZodDefault<z.ZodNumber>;
     token_expiry_buffer_ms: z.ZodDefault<z.ZodNumber>;
     /**
      * Opt-in leader-elected keep-alive that proactively rotates idle-account
@@ -129,6 +140,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     sdk_response_timeout_ms: number;
     stream_event_timeout_enabled: boolean;
     request_timeout_ms: number;
+    stream_buffer_until_complete: boolean;
+    stream_max_attempts: number;
     token_expiry_buffer_ms: number;
     token_keepalive_enabled: boolean;
     token_keepalive_interval_ms: number;
@@ -165,6 +178,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     sdk_response_timeout_ms?: number | undefined;
     stream_event_timeout_enabled?: boolean | undefined;
     request_timeout_ms?: number | undefined;
+    stream_buffer_until_complete?: boolean | undefined;
+    stream_max_attempts?: number | undefined;
     token_expiry_buffer_ms?: number | undefined;
     token_keepalive_enabled?: boolean | undefined;
     token_keepalive_interval_ms?: number | undefined;

package/dist/plugin/config/schema.js

@@ -109,6 +109,17 @@ export const KiroConfigSchema = z.object({
      * Only used when stream_event_timeout_enabled is true.
      */
     request_timeout_ms: z.number().min(30000).max(600000).default(120000),
+    /**
+     * Consume the complete Kiro event stream before exposing any semantic output
+     * downstream. This trades live token display for safe retries after a
+     * mid-stream transport failure without duplicating content or tool calls.
+     */
+    stream_buffer_until_complete: z.boolean().default(false),
+    /**
+     * Maximum number of complete event-stream attempts. Buffered mode can safely
+     * use every attempt even when the failed upstream stream produced output.
+     */
+    stream_max_attempts: z.number().int().min(1).max(10).default(3),
     token_expiry_buffer_ms: z.number().min(30000).max(300000).default(300000),
     /**
      * Opt-in leader-elected keep-alive that proactively rotates idle-account
@@ -162,6 +173,8 @@ export const DEFAULT_CONFIG = {
     sdk_response_timeout_ms: 300000,
     stream_event_timeout_enabled: false,
     request_timeout_ms: 120000,
+    stream_buffer_until_complete: false,
+    stream_max_attempts: 3,
     token_expiry_buffer_ms: 300000,
     token_keepalive_enabled: false,
     token_keepalive_interval_ms: 600000,

package/dist/plugin/errors.d.ts

@@ -3,6 +3,9 @@ export declare class KiroTokenRefreshError extends Error {
     originalError?: Error;
     constructor(message: string, code?: string, originalError?: Error);
 }
+export declare class TokenPersistenceError extends Error {
+    constructor();
+}
 export declare class KiroQuotaExhaustedError extends Error {
     recoveryTime?: number;
     constructor(message: string, recoveryTime?: number);

package/dist/plugin/errors.js

@@ -8,6 +8,12 @@ export class KiroTokenRefreshError extends Error {
         this.originalError = originalError;
     }
 }
+export class TokenPersistenceError extends Error {
+    constructor() {
+        super('Failed to persist refreshed credentials');
+        this.name = 'TokenPersistenceError';
+    }
+}
 export class KiroQuotaExhaustedError extends Error {
     recoveryTime;
     constructor(message, recoveryTime) {

package/dist/plugin/storage/locked-operations.d.ts

@@ -2,7 +2,6 @@ import type { ManagedAccount } from '../types.js';
 export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
 export declare function withDatabaseLockSync<T>(dbPath: string, fn: () => T): T;
-export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
 export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T | null>;

package/dist/plugin/storage/locked-operations.js

@@ -5,14 +5,6 @@ import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
 import { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
-const DATABASE_LOCK_OPTIONS = {
-    stale: 10000,
-    retries: 0,
-    realpath: false
-};
-const DATABASE_LOCK_DEADLINE_MS = 10000;
-const DATABASE_LOCK_MIN_BACKOFF_MS = 25;
-const DATABASE_LOCK_MAX_BACKOFF_MS = 250;
 const REFRESH_LOCK_OPTIONS = {
     stale: 15000,
     retries: 0,
@@ -31,8 +23,14 @@ const SYNC_LOCK_DEADLINE_MS = 10000;
 function blockingBackoff(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function isLockContention(e) {
-    return typeof e === 'object' && e !== null && 'code' in e && e.code === 'ELOCKED';
+function isRetryableLockAcquisitionError(e) {
+    if (typeof e !== 'object' || e === null || !('code' in e))
+        return false;
+    // proper-lockfile may surface ENOENT from mtimePrecision.probe() when another
+    // process removes the newly-created lock directory during stale takeover.
+    // Keep this scoped to the bounded lock-acquisition loops below so unrelated
+    // filesystem ENOENT errors still propagate immediately.
+    return e.code === 'ELOCKED' || e.code === 'ENOENT';
 }
 function asyncBackoff(attempt, remainingMs, minBackoffMs, maxBackoffMs) {
     const ceiling = Math.min(minBackoffMs * 2 ** Math.min(attempt, 4), maxBackoffMs, remainingMs);
@@ -40,23 +38,6 @@ function asyncBackoff(attempt, remainingMs, minBackoffMs, maxBackoffMs) {
     const delay = floor + Math.floor(Math.random() * (ceiling - floor + 1));
     return new Promise((resolve) => setTimeout(resolve, delay));
 }
-async function acquireDatabaseLock(dbPath) {
-    // A deadline avoids fixed retry-count starvation; jitter keeps contenders
-    // from repeatedly attempting the atomic mkdir in lockstep.
-    const deadline = Date.now() + DATABASE_LOCK_DEADLINE_MS;
-    let attempt = 0;
-    for (;;) {
-        try {
-            return await lockfile.lock(dbPath, DATABASE_LOCK_OPTIONS);
-        }
-        catch (e) {
-            const remainingMs = deadline - Date.now();
-            if (!isLockContention(e) || remainingMs <= 0)
-                throw e;
-            await asyncBackoff(attempt++, remainingMs, DATABASE_LOCK_MIN_BACKOFF_MS, DATABASE_LOCK_MAX_BACKOFF_MS);
-        }
-    }
-}
 async function acquireRefreshLock(lockPath) {
     // A deadline avoids fixed retry-count starvation; jitter keeps contenders
     // from repeatedly attempting the atomic mkdir in lockstep.
@@ -68,7 +49,7 @@ async function acquireRefreshLock(lockPath) {
         }
         catch (e) {
             const remainingMs = deadline - Date.now();
-            if (!isLockContention(e) || remainingMs <= 0)
+            if (!isRetryableLockAcquisitionError(e) || remainingMs <= 0)
                 throw e;
             await asyncBackoff(attempt++, remainingMs, REFRESH_LOCK_MIN_BACKOFF_MS, REFRESH_LOCK_MAX_BACKOFF_MS);
         }
@@ -90,7 +71,7 @@ export function withDatabaseLockSync(dbPath, fn) {
             break;
         }
         catch (e) {
-            if (!isLockContention(e) || Date.now() >= deadline)
+            if (!isRetryableLockAcquisitionError(e) || Date.now() >= deadline)
                 throw e;
             blockingBackoff(Math.min(100 * 2 ** attempt++, 500));
         }
@@ -107,27 +88,6 @@ export function withDatabaseLockSync(dbPath, fn) {
         }
     }
 }
-export async function withDatabaseLock(dbPath, fn) {
-    if (!existsSync(dbPath)) {
-        await fs.mkdir(dirname(dbPath), { recursive: true });
-        await fs.writeFile(dbPath, '');
-    }
-    let release = null;
-    try {
-        release = await acquireDatabaseLock(dbPath);
-        return await fn();
-    }
-    finally {
-        if (release) {
-            try {
-                await release();
-            }
-            catch (e) {
-                console.warn('Failed to release lock:', e);
-            }
-        }
-    }
-}
 export async function withRefreshLock(accountId, fn) {
     const lockPath = getRefreshLockPath(accountId);
     if (!existsSync(lockPath)) {

package/dist/plugin/storage/migrations.js

@@ -1,4 +1,56 @@
+const REFRESH_TOKEN_DEDUP_MARKER = 'refresh_token_dedup_migration_version';
+const REFRESH_TOKEN_DEDUP_VERSION = 1;
+const MIGRATION_LOCK_DEADLINE_MS = 30_000;
+const MIGRATION_LOCK_MIN_BACKOFF_MS = 25;
+const MIGRATION_LOCK_MAX_BACKOFF_MS = 500;
+class MigrationLockTimeoutError extends Error {
+    name = 'MigrationLockTimeoutError';
+    code = 'KIRO_DB_MIGRATION_LOCK_TIMEOUT';
+    constructor(cause) {
+        super(`Timed out after ${MIGRATION_LOCK_DEADLINE_MS}ms waiting for the migration write lock`, {
+            cause
+        });
+    }
+}
+function isSqliteBusy(error) {
+    if (typeof error !== 'object' || error === null || !('code' in error))
+        return false;
+    return typeof error.code === 'string' && error.code.startsWith('SQLITE_BUSY');
+}
+function blockingBackoff(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function beginImmediateWithRetry(db) {
+    const deadline = Date.now() + MIGRATION_LOCK_DEADLINE_MS;
+    let backoffMs = MIGRATION_LOCK_MIN_BACKOFF_MS;
+    for (;;) {
+        try {
+            db.exec('BEGIN IMMEDIATE');
+            return;
+        }
+        catch (error) {
+            if (!isSqliteBusy(error))
+                throw error;
+            const remainingMs = deadline - Date.now();
+            if (remainingMs <= 0)
+                throw new MigrationLockTimeoutError(error);
+            const jitterMs = Math.floor(Math.random() * Math.max(1, backoffMs / 4));
+            blockingBackoff(Math.min(backoffMs + jitterMs, remainingMs));
+            backoffMs = Math.min(backoffMs * 2, MIGRATION_LOCK_MAX_BACKOFF_MS);
+        }
+    }
+}
+function hasRefreshTokenDedupMarker(db) {
+    const marker = db
+        .prepare('SELECT value FROM plugin_meta WHERE key = ?')
+        .get(REFRESH_TOKEN_DEDUP_MARKER);
+    if (typeof marker !== 'object' || marker === null)
+        return false;
+    const value = 'value' in marker ? marker.value : undefined;
+    return typeof value === 'number' && value >= REFRESH_TOKEN_DEDUP_VERSION;
+}
 export function runMigrations(db) {
+    migratePluginMetaTable(db);
     migrateToUniqueRefreshToken(db);
     migrateRealEmailColumn(db);
     migrateUsageTable(db);
@@ -7,19 +59,18 @@ export function runMigrations(db) {
     migrateDropRefreshTokenUniqueIndex(db);
     migrateRemovedAccountsTable(db);
     migrateOverageColumn(db);
-    migratePluginMetaTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
-    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
-    if (indexProbe.get())
+    if (hasRefreshTokenDedupMarker(db))
         return;
+    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
     // BEGIN IMMEDIATE (not deferred BEGIN): a deferred read-then-write txn raises unrecoverable
     // SQLITE_BUSY_SNAPSHOT (busy_timeout cannot retry it) if another connection writes after the
     // read snapshot. Taking the write lock at BEGIN makes concurrent processes serialize via
     // busy_timeout instead of racing into a snapshot conflict.
-    db.exec('BEGIN IMMEDIATE');
+    beginImmediateWithRetry(db);
     try {
-        if (indexProbe.get()) {
+        if (hasRefreshTokenDedupMarker(db)) {
             db.exec('COMMIT');
             return;
         }
@@ -55,7 +106,11 @@ function migrateToUniqueRefreshToken(db) {
                 }
             }
         }
-        db.exec('CREATE UNIQUE INDEX idx_refresh_token_unique ON accounts(refresh_token)');
+        if (!indexProbe.get()) {
+            db.exec('CREATE UNIQUE INDEX idx_refresh_token_unique ON accounts(refresh_token)');
+        }
+        db.prepare(`INSERT INTO plugin_meta(key, value) VALUES(?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(REFRESH_TOKEN_DEDUP_MARKER, REFRESH_TOKEN_DEDUP_VERSION);
         db.exec('COMMIT');
     }
     catch (e) {
@@ -134,14 +189,23 @@ function migrateOidcRegionColumn(db) {
         db.exec('ALTER TABLE accounts ADD COLUMN oidc_region TEXT');
     }
     // Backfill: historically `region` was used for both service + OIDC.
-    db.exec("UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = ''");
+    const needsBackfill = db
+        .prepare("SELECT 1 FROM accounts WHERE oidc_region IS NULL OR oidc_region = '' LIMIT 1")
+        .get();
+    if (needsBackfill) {
+        db.exec("UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = ''");
+    }
 }
 function migrateDropRefreshTokenUniqueIndex(db) {
     // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
     // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
     // harmful: duplicate rows (same account, different legacy vs hash id) share the same
     // refresh_token, causing UNIQUE constraint violations on every upsert.
-    db.exec('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    const hasUniqueIndex = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'")
+        .get();
+    if (hasUniqueIndex)
+        db.exec('DROP INDEX IF EXISTS idx_refresh_token_unique');
     // Clean up duplicate rows: same email + same refresh_token but different ids.
     // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
     const duplicates = db
@@ -175,5 +239,18 @@ function migrateOverageColumn(db) {
     }
 }
 function migratePluginMetaTable(db) {
-    db.exec('CREATE TABLE IF NOT EXISTS plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+    const tableProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='plugin_meta'");
+    if (tableProbe.get())
+        return;
+    beginImmediateWithRetry(db);
+    try {
+        if (!tableProbe.get()) {
+            db.exec('CREATE TABLE plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+        }
+        db.exec('COMMIT');
+    }
+    catch (error) {
+        db.exec('ROLLBACK');
+        throw error;
+    }
 }

package/dist/plugin/storage/sqlite.d.ts

@@ -4,6 +4,7 @@ export declare class KiroDatabase {
     private db;
     private path;
     constructor(path?: string);
+    private withImmediateTransaction;
     private init;
     getAccounts(): any[];
     private upsertAccountInternal;

package/dist/plugin/storage/sqlite.js

@@ -2,8 +2,32 @@ import Database from 'libsql';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { deduplicateAccounts, mergeAccounts, withDatabaseLock, withDatabaseLockSync } from './locked-operations.js';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLockSync } from './locked-operations.js';
 import { runMigrations } from './migrations.js';
+const DATABASE_BUSY_TIMEOUT_MS = 5_000;
+const WRITE_LOCK_DEADLINE_MS = 30_000;
+const WRITE_LOCK_MIN_BACKOFF_MS = 25;
+const WRITE_LOCK_MAX_BACKOFF_MS = 500;
+class DatabaseWriteLockTimeoutError extends Error {
+    name = 'DatabaseWriteLockTimeoutError';
+    code = 'KIRO_DB_WRITE_LOCK_TIMEOUT';
+    constructor(cause) {
+        super(`Timed out after ${WRITE_LOCK_DEADLINE_MS}ms waiting for the database write lock`, {
+            cause
+        });
+    }
+}
+function isSqliteBusy(error) {
+    if (typeof error !== 'object' || error === null || !('code' in error))
+        return false;
+    return typeof error.code === 'string' && error.code.startsWith('SQLITE_BUSY');
+}
+function asyncBackoff(attempt, remainingMs) {
+    const ceiling = Math.min(WRITE_LOCK_MIN_BACKOFF_MS * 2 ** Math.min(attempt, 5), WRITE_LOCK_MAX_BACKOFF_MS, remainingMs);
+    const floor = Math.max(1, Math.floor(ceiling / 2));
+    const delay = floor + Math.floor(Math.random() * (ceiling - floor + 1));
+    return new Promise((resolve) => setTimeout(resolve, delay));
+}
 function getBaseDir() {
     const p = process.platform;
     if (p === 'win32')
@@ -20,9 +44,55 @@ export class KiroDatabase {
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
         this.db = new Database(path);
-        this.db.pragma('busy_timeout = 5000');
+        this.db.pragma(`busy_timeout = ${DATABASE_BUSY_TIMEOUT_MS}`);
         withDatabaseLockSync(this.path, () => this.init());
     }
+    async withImmediateTransaction(fn) {
+        const deadline = Date.now() + WRITE_LOCK_DEADLINE_MS;
+        let attempt = 0;
+        for (;;) {
+            const busyTimeoutResult = this.db.pragma('busy_timeout', { simple: true });
+            const busyTimeout = typeof busyTimeoutResult === 'number'
+                ? busyTimeoutResult
+                : typeof busyTimeoutResult === 'object' && busyTimeoutResult !== null
+                    ? Reflect.get(busyTimeoutResult, 'timeout')
+                    : undefined;
+            if (typeof busyTimeout !== 'number') {
+                throw new TypeError('Expected numeric busy_timeout from libsql');
+            }
+            let begun = false;
+            let beginError;
+            try {
+                this.db.pragma('busy_timeout = 0');
+                this.db.exec('BEGIN IMMEDIATE');
+                begun = true;
+            }
+            catch (error) {
+                beginError = error;
+            }
+            finally {
+                this.db.pragma(`busy_timeout = ${busyTimeout}`);
+            }
+            if (!begun) {
+                if (!isSqliteBusy(beginError))
+                    throw beginError;
+                const remainingMs = deadline - Date.now();
+                if (remainingMs <= 0)
+                    throw new DatabaseWriteLockTimeoutError(beginError);
+                await asyncBackoff(attempt++, remainingMs);
+                continue;
+            }
+            try {
+                const result = fn();
+                this.db.exec('COMMIT');
+                return result;
+            }
+            catch (error) {
+                this.db.exec('ROLLBACK');
+                throw error;
+            }
+        }
+    }
     init() {
         this.db.pragma('journal_mode = WAL');
         this.db.exec(`
@@ -79,96 +149,64 @@ export class KiroDatabase {
         this.db.prepare('DELETE FROM accounts WHERE id IN (SELECT id FROM removed_accounts)').run();
     }
     async upsertAccount(acc) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const existing = this.getAccounts().map(this.rowToAccount);
             const merged = mergeAccounts(existing, [acc]);
             const deduplicated = deduplicateAccounts(merged);
             const writable = deduplicated.filter((a) => !this.isRemovedSync(a.id));
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.purgeRemovedAccountsSync();
-                for (const account of writable) {
-                    this.upsertAccountInternal(account);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            this.purgeRemovedAccountsSync();
+            for (const account of writable) {
+                this.upsertAccountInternal(account);
             }
         });
     }
     async batchUpsertAccounts(accounts) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const existing = this.getAccounts().map(this.rowToAccount);
             const merged = mergeAccounts(existing, accounts);
             const deduplicated = deduplicateAccounts(merged);
             const writable = deduplicated.filter((a) => !this.isRemovedSync(a.id));
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.purgeRemovedAccountsSync();
-                for (const account of writable) {
-                    this.upsertAccountInternal(account);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            this.purgeRemovedAccountsSync();
+            for (const account of writable) {
+                this.upsertAccountInternal(account);
             }
         });
     }
     async deleteAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
         });
     }
     async removeAccountWithTombstone(id) {
-        await withDatabaseLock(this.path, async () => {
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
-                this.db
-                    .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
-                    .run(id, Date.now());
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
-            }
+        await this.withImmediateTransaction(() => {
+            this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+            this.db
+                .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
+                .run(id, Date.now());
         });
     }
     async cleanupSupersededIdentities(keepId, email, authMethod, profileArn) {
-        const supersededIds = [];
-        await withDatabaseLock(this.path, async () => {
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                const rows = this.db
-                    .prepare('SELECT id FROM accounts WHERE email = ? AND auth_method = ? AND profile_arn IS ? AND id != ?')
-                    .all(email, authMethod, profileArn ?? null, keepId);
-                for (const row of rows) {
-                    if (typeof row === 'object' && row !== null && 'id' in row && typeof row.id === 'string')
-                        supersededIds.push(row.id);
-                }
-                const deleteStmt = this.db.prepare('DELETE FROM accounts WHERE id = ?');
-                const tombstoneStmt = this.db.prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)');
-                const removedAt = Date.now();
-                for (const id of supersededIds) {
-                    deleteStmt.run(id);
-                    tombstoneStmt.run(id, removedAt);
-                }
-                this.db.exec('COMMIT');
+        return this.withImmediateTransaction(() => {
+            const supersededIds = [];
+            const rows = this.db
+                .prepare('SELECT id FROM accounts WHERE email = ? AND auth_method = ? AND profile_arn IS ? AND id != ?')
+                .all(email, authMethod, profileArn ?? null, keepId);
+            for (const row of rows) {
+                if (typeof row === 'object' && row !== null && 'id' in row && typeof row.id === 'string')
+                    supersededIds.push(row.id);
             }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            const deleteStmt = this.db.prepare('DELETE FROM accounts WHERE id = ?');
+            const tombstoneStmt = this.db.prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)');
+            const removedAt = Date.now();
+            for (const id of supersededIds) {
+                deleteStmt.run(id);
+                tombstoneStmt.run(id, removedAt);
             }
+            return supersededIds;
         });
-        return supersededIds;
     }
     async addRemovedAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db
                 .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
                 .run(id, Date.now());
@@ -178,7 +216,7 @@ export class KiroDatabase {
         return !!this.db.prepare('SELECT id FROM removed_accounts WHERE id = ?').get(id);
     }
     async clearRemovedAccount(id) {
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             this.db.prepare('DELETE FROM removed_accounts WHERE id = ?').run(id);
         });
     }
@@ -186,7 +224,7 @@ export class KiroDatabase {
         return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
     }
     async nextAssignmentIndex() {
-        return withDatabaseLock(this.path, async () => {
+        return this.withImmediateTransaction(() => {
             const row = this.db
                 .prepare("INSERT INTO plugin_meta(key,value) VALUES('assignment_cursor',0) ON CONFLICT(key) DO UPDATE SET value=value+1 RETURNING value")
                 .get();
@@ -196,11 +234,9 @@ export class KiroDatabase {
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;
-        await withDatabaseLock(this.path, async () => {
+        await this.withImmediateTransaction(() => {
             const now = Date.now();
-            this.db.exec('BEGIN TRANSACTION');
-            try {
-                const stmt = this.db.prepare(`
+            const stmt = this.db.prepare(`
             UPDATE accounts
             SET is_healthy = 0,
                 unhealthy_reason = ?,
@@ -210,14 +246,8 @@ export class KiroDatabase {
                 last_sync = ?
             WHERE id = ?
           `);
-                for (const id of ids) {
-                    stmt.run(reason, now, id);
-                }
-                this.db.exec('COMMIT');
-            }
-            catch (e) {
-                this.db.exec('ROLLBACK');
-                throw e;
+            for (const id of ids) {
+                stmt.run(reason, now, id);
             }
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",