@sunerpy/opencode-kiro-auth 0.2.0 → 0.2.2

package/dist/core/auth/auth-handler.d.ts

@@ -14,5 +14,23 @@ export declare class AuthHandler {
     /** Format a single account as a select-option label for the remove flow. */
     private formatAccountOption;
     getMethods(): AuthHook['methods'];
+    /** Ends the auth flow cleanly with no key prompt and no credential written. */
+    private endWithoutCredential;
+    /**
+     * Ends the flow after a successful deletion. If a healthy account (or any
+     * account with a usable access token) remains, returns a SUCCESS callback
+     * keyed on that account's token so OpenCode shows success and persists a
+     * still-valid credential. If nothing usable remains, falls back to a failed
+     * callback (nothing left to authorize with).
+     */
+    private endWithRemainingCredentialOrFailed;
+    /**
+     * Self-drawn account-removal flow. No-op paths (cancel / no accounts /
+     * not-confirmed / non-TTY) end with method:'auto' + a failed callback so no
+     * key prompt appears and no bogus success is shown. The actual-deletion path
+     * ends with a remaining-account success (or failed if none remain), so a
+     * successful removal is not misreported as "Failed to authorize".
+     */
+    private authorizeRemoveAccounts;
 }
 export {};

package/dist/core/auth/auth-handler.js

@@ -1,6 +1,7 @@
 import { RegionSchema } from '../../plugin/config/schema.js';
 import * as logger from '../../plugin/logger.js';
 import { IdcAuthMethod } from './idc-auth-method.js';
+import { isInteractiveTty, ttyConfirm, ttySelect } from './tty-menu.js';
 export class AuthHandler {
     config;
     repository;
@@ -195,42 +196,84 @@ export class AuthHandler {
                 authorize: (inputs) => idcMethod.authorize(inputs)
             }
         ];
-        const count = currentAccounts.length;
-        const removeLabel = count > 0 ? `Remove account · ${count} stored` : 'Remove account · none stored';
-        const removeOptions = currentAccounts.map((acc) => ({
-            label: this.formatAccountOption(acc),
-            value: String(acc.id)
-        }));
-        removeOptions.push({ label: 'Cancel', value: '__cancel__' });
+        // Removal must be `type:'oauth'`, not `type:'api'`: OpenCode forces an
+        // "Enter your API key" prompt on `api` methods, breaking a removal flow.
         methods.push({
-            label: removeLabel,
-            type: 'api',
-            prompts: [
-                {
-                    type: 'select',
-                    key: 'account_id',
-                    message: 'Select the account to remove',
-                    options: removeOptions
-                }
-            ],
-            authorize: async (inputs) => {
-                const accountId = inputs?.account_id;
-                if (!accountId || accountId === '__cancel__') {
-                    logger.log('Remove Kiro account: cancelled (no-op)');
-                    return { type: 'failed' };
-                }
-                const target = currentAccounts.find((acc) => String(acc.id) === accountId);
-                if (!target) {
-                    logger.warn('Remove Kiro account: id not found', { accountId });
-                    return { type: 'failed' };
-                }
-                this.accountManager.removeAccount(target);
-                logger.log('Removed Kiro account', { email: target.email, accountId });
-                // Return 'failed' after the deletion side-effect: 'success' would make
-                // OpenCode persist a bogus auth.json credential for a removal action.
-                return { type: 'failed' };
-            }
+            label: 'Manage / remove accounts',
+            type: 'oauth',
+            authorize: async () => this.authorizeRemoveAccounts()
         });
         return methods;
     }
+    /** Ends the auth flow cleanly with no key prompt and no credential written. */
+    endWithoutCredential(instructions) {
+        return {
+            url: '',
+            instructions,
+            method: 'auto',
+            callback: async () => ({ type: 'failed' })
+        };
+    }
+    /**
+     * Ends the flow after a successful deletion. If a healthy account (or any
+     * account with a usable access token) remains, returns a SUCCESS callback
+     * keyed on that account's token so OpenCode shows success and persists a
+     * still-valid credential. If nothing usable remains, falls back to a failed
+     * callback (nothing left to authorize with).
+     */
+    endWithRemainingCredentialOrFailed(instructions) {
+        const remaining = this.accountManager?.getAccounts?.() ?? [];
+        const hasToken = (acc) => typeof acc?.accessToken === 'string' && acc.accessToken.length > 0;
+        const fallback = remaining.find((acc) => acc?.isHealthy && hasToken(acc)) ??
+            remaining.find((acc) => hasToken(acc));
+        if (fallback) {
+            const key = fallback.accessToken;
+            return {
+                url: '',
+                instructions: `${instructions} Using ${fallback.email || 'a remaining account'} for future requests.`,
+                method: 'auto',
+                callback: async () => ({ type: 'success', key })
+            };
+        }
+        return this.endWithoutCredential(`${instructions} No accounts remain — run \`opencode auth login\` to reauthenticate.`);
+    }
+    /**
+     * Self-drawn account-removal flow. No-op paths (cancel / no accounts /
+     * not-confirmed / non-TTY) end with method:'auto' + a failed callback so no
+     * key prompt appears and no bogus success is shown. The actual-deletion path
+     * ends with a remaining-account success (or failed if none remain), so a
+     * successful removal is not misreported as "Failed to authorize".
+     */
+    async authorizeRemoveAccounts() {
+        const accounts = this.accountManager?.getAccounts?.() ?? [];
+        if (accounts.length === 0) {
+            logger.log('Remove Kiro account: no accounts to remove');
+            return this.endWithoutCredential('No accounts to remove.');
+        }
+        if (!isInteractiveTty()) {
+            logger.log('Remove Kiro account: non-TTY, skipping interactive menu');
+            const sqliteHint = 'sqlite3 ~/.config/opencode/kiro.db "DELETE FROM accounts WHERE email=\'<email>\';"';
+            return this.endWithoutCredential('Account removal requires an interactive terminal. Run `opencode auth login` ' +
+                `in a TTY, or remove via: ${sqliteHint}`);
+        }
+        const items = accounts.map((acc) => ({
+            label: this.formatAccountOption(acc),
+            value: acc
+        }));
+        items.push({ label: 'Cancel', value: null });
+        const target = await ttySelect(items, { message: 'Select an account to remove' });
+        if (!target) {
+            logger.log('Remove Kiro account: cancelled (no-op)');
+            return this.endWithoutCredential('Cancelled. No account removed.');
+        }
+        const confirmed = await ttyConfirm(`Delete ${target.email || 'this account'}?`);
+        if (!confirmed) {
+            logger.log('Remove Kiro account: delete not confirmed (no-op)');
+            return this.endWithoutCredential('Cancelled. No account removed.');
+        }
+        this.accountManager.removeAccount(target);
+        logger.log('Removed Kiro account', { email: target.email, accountId: String(target.id) });
+        process.stdout.write('Account deleted.\n');
+        return this.endWithRemainingCredentialOrFailed(`Account deleted: ${target.email || 'unknown'}.`);
+    }
 }

package/dist/core/auth/tty-menu.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Minimal, dependency-free interactive TTY helpers for auth account management.
+ *
+ * Ported (in spirit) from opencode-antigravity-auth's ui/{select,confirm,ansi}.js.
+ * Kept small on purpose: raw-mode stdin, ANSI cursor control, arrow/enter/esc,
+ * ctrl-c to cancel. No external deps. All rendering is self-drawn so it never
+ * routes through OpenCode's prompt system (which would force a key prompt).
+ */
+/** True only when both stdin and stdout are interactive terminals. */
+export declare function isInteractiveTty(): boolean;
+/** Wrap an index into [0, length) — exported for pure unit testing. */
+export declare function wrapIndex(index: number, length: number): number;
+export interface TtySelectItem<T> {
+    label: string;
+    value: T;
+}
+export interface TtySelectOptions {
+    message: string;
+}
+/**
+ * Render an interactive single-select menu on the TTY.
+ * Resolves with the chosen item's value, or `null` if the user cancels
+ * (esc / ctrl-c) or raw mode cannot be enabled.
+ *
+ * Requires an interactive TTY; callers must gate with {@link isInteractiveTty}.
+ */
+export declare function ttySelect<T>(items: ReadonlyArray<TtySelectItem<T>>, options: TtySelectOptions): Promise<T | null>;
+/**
+ * Interactive yes/no confirmation built on {@link ttySelect}.
+ * Defaults the cursor to "No" for safety. Cancel (esc/ctrl-c) resolves false.
+ */
+export declare function ttyConfirm(message: string): Promise<boolean>;

package/dist/core/auth/tty-menu.js

@@ -0,0 +1,172 @@
+/**
+ * Minimal, dependency-free interactive TTY helpers for auth account management.
+ *
+ * Ported (in spirit) from opencode-antigravity-auth's ui/{select,confirm,ansi}.js.
+ * Kept small on purpose: raw-mode stdin, ANSI cursor control, arrow/enter/esc,
+ * ctrl-c to cancel. No external deps. All rendering is self-drawn so it never
+ * routes through OpenCode's prompt system (which would force a key prompt).
+ */
+/** ANSI escape codes used by the interactive menu. */
+const ANSI = {
+    hide: '\x1b[?25l',
+    show: '\x1b[?25h',
+    up: (n = 1) => `\x1b[${n}A`,
+    clearLine: '\x1b[2K',
+    cyan: '\x1b[36m',
+    green: '\x1b[32m',
+    dim: '\x1b[2m',
+    reset: '\x1b[0m'
+};
+/**
+ * Parse a raw keyboard input buffer into a key action.
+ * Handles Windows/Mac/Linux differences in arrow-key sequences.
+ */
+function parseKey(data) {
+    const s = data.toString();
+    if (s === '\x1b[A' || s === '\x1bOA')
+        return 'up';
+    if (s === '\x1b[B' || s === '\x1bOB')
+        return 'down';
+    if (s === '\r' || s === '\n')
+        return 'enter';
+    if (s === '\x03')
+        return 'cancel'; // ctrl-c
+    if (s === '\x1b')
+        return 'escape-start'; // bare esc
+    return null;
+}
+/** True only when both stdin and stdout are interactive terminals. */
+export function isInteractiveTty() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+/** Wrap an index into [0, length) — exported for pure unit testing. */
+export function wrapIndex(index, length) {
+    if (length <= 0)
+        return 0;
+    return ((index % length) + length) % length;
+}
+const ESCAPE_TIMEOUT_MS = 50;
+/**
+ * Render an interactive single-select menu on the TTY.
+ * Resolves with the chosen item's value, or `null` if the user cancels
+ * (esc / ctrl-c) or raw mode cannot be enabled.
+ *
+ * Requires an interactive TTY; callers must gate with {@link isInteractiveTty}.
+ */
+export async function ttySelect(items, options) {
+    if (items.length === 0)
+        return null;
+    const { message } = options;
+    const { stdin, stdout } = process;
+    let cursor = 0;
+    let renderedLines = 0;
+    let escapeTimeout = null;
+    let isCleanedUp = false;
+    const render = () => {
+        if (renderedLines > 0) {
+            stdout.write(ANSI.up(renderedLines));
+        }
+        let linesWritten = 0;
+        const writeLine = (line) => {
+            stdout.write(`${ANSI.clearLine}${line}\n`);
+            linesWritten += 1;
+        };
+        writeLine(`${ANSI.dim}?${ANSI.reset} ${message}`);
+        for (let i = 0; i < items.length; i++) {
+            const item = items[i];
+            if (!item)
+                continue;
+            const isSelected = i === cursor;
+            if (isSelected) {
+                writeLine(`${ANSI.cyan}│${ANSI.reset}  ${ANSI.green}●${ANSI.reset} ${item.label}`);
+            }
+            else {
+                writeLine(`${ANSI.cyan}│${ANSI.reset}  ${ANSI.dim}○ ${item.label}${ANSI.reset}`);
+            }
+        }
+        writeLine(`${ANSI.cyan}└${ANSI.reset}  ${ANSI.dim}Up/Down: move | Enter: confirm | Esc: cancel${ANSI.reset}`);
+        renderedLines = linesWritten;
+    };
+    return new Promise((resolve) => {
+        const wasRaw = stdin.isRaw ?? false;
+        const cleanup = () => {
+            if (isCleanedUp)
+                return;
+            isCleanedUp = true;
+            if (escapeTimeout) {
+                clearTimeout(escapeTimeout);
+                escapeTimeout = null;
+            }
+            try {
+                stdin.removeListener('data', onKey);
+                stdin.setRawMode(wasRaw);
+                stdin.pause();
+                stdout.write(ANSI.show);
+            }
+            catch {
+                // best-effort cleanup
+            }
+            process.removeListener('SIGINT', onSignal);
+            process.removeListener('SIGTERM', onSignal);
+        };
+        const finish = (value) => {
+            cleanup();
+            resolve(value);
+        };
+        const onSignal = () => finish(null);
+        const onKey = (data) => {
+            if (escapeTimeout) {
+                clearTimeout(escapeTimeout);
+                escapeTimeout = null;
+            }
+            const action = parseKey(data);
+            switch (action) {
+                case 'up':
+                    cursor = wrapIndex(cursor - 1, items.length);
+                    render();
+                    return;
+                case 'down':
+                    cursor = wrapIndex(cursor + 1, items.length);
+                    render();
+                    return;
+                case 'enter':
+                    finish(items[cursor]?.value ?? null);
+                    return;
+                case 'cancel':
+                    finish(null);
+                    return;
+                case 'escape-start':
+                    // Bare escape byte — wait briefly to see if it's an arrow sequence.
+                    escapeTimeout = setTimeout(() => finish(null), ESCAPE_TIMEOUT_MS);
+                    return;
+                default:
+                    return;
+            }
+        };
+        process.once('SIGINT', onSignal);
+        process.once('SIGTERM', onSignal);
+        try {
+            stdin.setRawMode(true);
+        }
+        catch {
+            cleanup();
+            resolve(null);
+            return;
+        }
+        stdin.resume();
+        stdout.write(ANSI.hide);
+        render();
+        stdin.on('data', onKey);
+    });
+}
+/**
+ * Interactive yes/no confirmation built on {@link ttySelect}.
+ * Defaults the cursor to "No" for safety. Cancel (esc/ctrl-c) resolves false.
+ */
+export async function ttyConfirm(message) {
+    const result = await ttySelect([
+        { label: 'No', value: false },
+        { label: 'Yes', value: true }
+    ], { message });
+    return result ?? false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",