@sunerpy/opencode-kiro-auth 0.2.2 → 0.4.0

package/README.md

@@ -136,6 +136,13 @@ avoid a hot loop.
 choose "Remove a Kiro account (N stored)", then pick the account from the
 dropdown (or cancel).
 
+> **Note:** removal is persistent. Once you remove an account it stays
+> removed across restarts and Kiro CLI auto-sync — it won't come back on its
+> own. To re-add it, just log in with that account again via
+> `opencode auth login`. See
+> [Removing accounts & the removal tombstone](docs/CONFIGURATION.md#removing-accounts--the-removal-tombstone)
+> for how this works.
+
 Full config key reference: [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
 
 ## Usage display
@@ -179,6 +186,12 @@ Thinking budgets map to Kiro's native `effort` field automatically:
 
 Details and the full JSON example: [docs/MODELS.md](docs/MODELS.md).
 
+> **Note:** OpenCode's per-agent thinking level (`--variant` / an agent's
+> `variant` in `oh-my-openagent.json`) isn't honored per agent by this
+> plugin — OpenCode consumes it upstream. Use the global `effort` key in
+> `kiro.json` instead. See
+> [Reasoning effort](docs/CONFIGURATION.md#reasoning-effort) for details.
+
 ## Troubleshooting
 
 Common issues — 403/AccessDeniedException with IAM Identity Center, "No

package/dist/core/auth/idc-auth-method.js

@@ -3,6 +3,7 @@ import { extractRegionFromArn, normalizeRegion } from '../../constants.js';
 import { authorizeKiroIDC, pollKiroIDCToken } from '../../kiro/oauth-idc.js';
 import { createDeterministicAccountId } from '../../plugin/accounts.js';
 import * as logger from '../../plugin/logger.js';
+import { kiroDb } from '../../plugin/storage/sqlite.js';
 import { makePlaceholderEmail } from '../../plugin/sync/kiro-cli-parser.js';
 import { readActiveProfileArnFromKiroCli } from '../../plugin/sync/kiro-cli-profile.js';
 import { fetchUsageLimits } from '../../plugin/usage.js';
@@ -156,6 +157,8 @@ export class IdcAuthMethod {
                     };
                     await this.repository.save(acc);
                     this.accountManager?.addAccount?.(acc);
+                    // clear tombstone ONLY on deliberate user login; never in auto-sync (would revive removed accounts)
+                    await kiroDb.clearRemovedAccount(id);
                     return { type: 'success', key: token.accessToken };
                 }
                 catch (e) {

package/dist/core/request/request-handler.js

@@ -106,6 +106,28 @@ export class RequestHandler {
                 continue;
             }
             const sdkPrep = this.prepareSdkRequest(init?.body, model, auth, think, budget, showToast);
+            if (this.config.enable_log_effort_debug) {
+                try {
+                    logger.log('[effort-debug] request effort resolution', {
+                        model,
+                        effectiveModel: sdkPrep.effectiveModel,
+                        think,
+                        budget,
+                        resolvedEffort: sdkPrep.effort ?? 'undefined (not effort-capable or not thinking)',
+                        inboundBodyKeys: Object.keys(body),
+                        messagesCount: body.messages?.length,
+                        reasoningSubtree: {
+                            reasoningEffort: body.reasoningEffort,
+                            reasoning_effort: body.reasoning_effort,
+                            reasoning: body.reasoning,
+                            providerOptions: body.providerOptions,
+                            thinkingConfig: body.thinkingConfig,
+                            providerOptionsThinkingConfig: body.providerOptions?.thinkingConfig
+                        }
+                    });
+                }
+                catch (e) { }
+            }
             const apiTimestamp = this.config.enable_log_api_request ? logger.getTimestamp() : null;
             if (apiTimestamp) {
                 this.logSdkRequest(sdkPrep, acc, apiTimestamp);

package/dist/plugin/accounts.js

@@ -160,6 +160,11 @@ export class AccountManager {
             email: a.email,
             error: e instanceof Error ? e.message : String(e)
         }));
+        kiroDb.addRemovedAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount:tombstone',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)

package/dist/plugin/config/schema.d.ts

@@ -31,6 +31,13 @@ export declare const KiroConfigSchema: z.ZodObject<{
     usage_tracking_enabled: z.ZodDefault<z.ZodBoolean>;
     auto_sync_kiro_cli: z.ZodDefault<z.ZodBoolean>;
     enable_log_api_request: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Enable config-gated debug logging that records the inbound
+     * OpenAI-compatible request body shape (top-level keys, reasoning-related
+     * fields only — no message content) and the resolved Kiro effort for each
+     * request. Independent from `enable_log_api_request`; off by default.
+     */
+    enable_log_effort_debug: z.ZodDefault<z.ZodBoolean>;
     /**
      * Default effort level for thinking models. Controls reasoning depth.
      * When set, this overrides the automatic budget-based mapping.
@@ -57,6 +64,7 @@ export declare const KiroConfigSchema: z.ZodObject<{
     usage_tracking_enabled: boolean;
     auto_sync_kiro_cli: boolean;
     enable_log_api_request: boolean;
+    enable_log_effort_debug: boolean;
     auto_effort_mapping: boolean;
     $schema?: string | undefined;
     idc_start_url?: string | undefined;
@@ -81,6 +89,7 @@ export declare const KiroConfigSchema: z.ZodObject<{
     usage_tracking_enabled?: boolean | undefined;
     auto_sync_kiro_cli?: boolean | undefined;
     enable_log_api_request?: boolean | undefined;
+    enable_log_effort_debug?: boolean | undefined;
     effort?: "low" | "medium" | "high" | "xhigh" | "max" | undefined;
     auto_effort_mapping?: boolean | undefined;
 }>;

package/dist/plugin/config/schema.js

@@ -63,6 +63,13 @@ export const KiroConfigSchema = z.object({
     usage_tracking_enabled: z.boolean().default(true),
     auto_sync_kiro_cli: z.boolean().default(true),
     enable_log_api_request: z.boolean().default(false),
+    /**
+     * Enable config-gated debug logging that records the inbound
+     * OpenAI-compatible request body shape (top-level keys, reasoning-related
+     * fields only — no message content) and the resolved Kiro effort for each
+     * request. Independent from `enable_log_api_request`; off by default.
+     */
+    enable_log_effort_debug: z.boolean().default(false),
     /**
      * Default effort level for thinking models. Controls reasoning depth.
      * When set, this overrides the automatic budget-based mapping.
@@ -90,5 +97,6 @@ export const DEFAULT_CONFIG = {
     usage_tracking_enabled: true,
     auto_sync_kiro_cli: true,
     enable_log_api_request: false,
+    enable_log_effort_debug: false,
     auto_effort_mapping: true
 };

package/dist/plugin/storage/migrations.js

@@ -5,6 +5,7 @@ export function runMigrations(db) {
     migrateStartUrlColumn(db);
     migrateOidcRegionColumn(db);
     migrateDropRefreshTokenUniqueIndex(db);
+    migrateRemovedAccountsTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -153,3 +154,8 @@ function migrateDropRefreshTokenUniqueIndex(db) {
         }
     }
 }
+function migrateRemovedAccountsTable(db) {
+    // Tombstone table: records account ids the user explicitly removed via the auth menu,
+    // so kiro-cli auto-sync does not silently re-import them. Cleared only on deliberate login.
+    db.exec('CREATE TABLE IF NOT EXISTS removed_accounts (id TEXT PRIMARY KEY, removed_at INTEGER NOT NULL)');
+}

package/dist/plugin/storage/sqlite.d.ts

@@ -10,6 +10,10 @@ export declare class KiroDatabase {
     upsertAccount(acc: ManagedAccount): Promise<void>;
     batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
     deleteAccount(id: string): Promise<void>;
+    addRemovedAccount(id: string): Promise<void>;
+    isAccountRemoved(id: string): Promise<boolean>;
+    clearRemovedAccount(id: string): Promise<void>;
+    listRemovedAccounts(): Promise<string[]>;
     markAccountsUnhealthy(ids: string[], reason: string): Promise<void>;
     private rowToAccount;
     close(): void;

package/dist/plugin/storage/sqlite.js

@@ -103,6 +103,24 @@ export class KiroDatabase {
             this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
         });
     }
+    async addRemovedAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db
+                .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
+                .run(id, Date.now());
+        });
+    }
+    async isAccountRemoved(id) {
+        return !!this.db.prepare('SELECT id FROM removed_accounts WHERE id = ?').get(id);
+    }
+    async clearRemovedAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db.prepare('DELETE FROM removed_accounts WHERE id = ?').run(id);
+        });
+    }
+    async listRemovedAccounts() {
+        return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
+    }
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;

package/dist/plugin/sync/kiro-cli.js

@@ -33,6 +33,7 @@ export async function syncFromKiroCli() {
         const deviceReg = safeJsonParse(deviceRegRow?.value);
         const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
         const syncedAccounts = [];
+        let skippedRemoved = 0;
         for (const row of rows) {
             if (row.key.includes(':token')) {
                 const data = safeJsonParse(row.value);
@@ -122,7 +123,10 @@ export async function syncFromKiroCli() {
                     const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
                     if (placeholderId !== id) {
                         const placeholderRow = all.find((a) => a.id === placeholderId);
-                        if (placeholderRow) {
+                        if (placeholderRow && (await kiroDb.isAccountRemoved(placeholderId))) {
+                            skippedRemoved++;
+                        }
+                        else if (placeholderRow) {
                             await kiroDb.upsertAccount({
                                 id: placeholderId,
                                 email: placeholderRow.email,
@@ -147,6 +151,10 @@ export async function syncFromKiroCli() {
                         }
                     }
                 }
+                if (await kiroDb.isAccountRemoved(id)) {
+                    skippedRemoved++;
+                    continue;
+                }
                 await kiroDb.upsertAccount({
                     id,
                     email: resolvedEmail,
@@ -181,6 +189,7 @@ export async function syncFromKiroCli() {
             await kiroDb.markAccountsUnhealthy(staleIds, STALE_CLI_ACCOUNT_REASON);
             logger.warn('Kiro CLI sync: deactivated stale cached accounts', { count: staleIds.length });
         }
+        logger.log('Kiro CLI sync: done', { synced: syncedAccounts.length, skippedRemoved });
         cliDb.close();
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",