@sunerpy/opencode-kiro-auth 0.3.0 → 0.4.0

package/README.md

@@ -136,6 +136,13 @@ avoid a hot loop.
 choose "Remove a Kiro account (N stored)", then pick the account from the
 dropdown (or cancel).
 
+> **Note:** removal is persistent. Once you remove an account it stays
+> removed across restarts and Kiro CLI auto-sync — it won't come back on its
+> own. To re-add it, just log in with that account again via
+> `opencode auth login`. See
+> [Removing accounts & the removal tombstone](docs/CONFIGURATION.md#removing-accounts--the-removal-tombstone)
+> for how this works.
+
 Full config key reference: [docs/CONFIGURATION.md](docs/CONFIGURATION.md).
 
 ## Usage display

package/dist/core/auth/idc-auth-method.js

@@ -3,6 +3,7 @@ import { extractRegionFromArn, normalizeRegion } from '../../constants.js';
 import { authorizeKiroIDC, pollKiroIDCToken } from '../../kiro/oauth-idc.js';
 import { createDeterministicAccountId } from '../../plugin/accounts.js';
 import * as logger from '../../plugin/logger.js';
+import { kiroDb } from '../../plugin/storage/sqlite.js';
 import { makePlaceholderEmail } from '../../plugin/sync/kiro-cli-parser.js';
 import { readActiveProfileArnFromKiroCli } from '../../plugin/sync/kiro-cli-profile.js';
 import { fetchUsageLimits } from '../../plugin/usage.js';
@@ -156,6 +157,8 @@ export class IdcAuthMethod {
                     };
                     await this.repository.save(acc);
                     this.accountManager?.addAccount?.(acc);
+                    // clear tombstone ONLY on deliberate user login; never in auto-sync (would revive removed accounts)
+                    await kiroDb.clearRemovedAccount(id);
                     return { type: 'success', key: token.accessToken };
                 }
                 catch (e) {

package/dist/plugin/accounts.js

@@ -160,6 +160,11 @@ export class AccountManager {
             email: a.email,
             error: e instanceof Error ? e.message : String(e)
         }));
+        kiroDb.addRemovedAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount:tombstone',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)

package/dist/plugin/storage/migrations.js

@@ -5,6 +5,7 @@ export function runMigrations(db) {
     migrateStartUrlColumn(db);
     migrateOidcRegionColumn(db);
     migrateDropRefreshTokenUniqueIndex(db);
+    migrateRemovedAccountsTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -153,3 +154,8 @@ function migrateDropRefreshTokenUniqueIndex(db) {
         }
     }
 }
+function migrateRemovedAccountsTable(db) {
+    // Tombstone table: records account ids the user explicitly removed via the auth menu,
+    // so kiro-cli auto-sync does not silently re-import them. Cleared only on deliberate login.
+    db.exec('CREATE TABLE IF NOT EXISTS removed_accounts (id TEXT PRIMARY KEY, removed_at INTEGER NOT NULL)');
+}

package/dist/plugin/storage/sqlite.d.ts

@@ -10,6 +10,10 @@ export declare class KiroDatabase {
     upsertAccount(acc: ManagedAccount): Promise<void>;
     batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
     deleteAccount(id: string): Promise<void>;
+    addRemovedAccount(id: string): Promise<void>;
+    isAccountRemoved(id: string): Promise<boolean>;
+    clearRemovedAccount(id: string): Promise<void>;
+    listRemovedAccounts(): Promise<string[]>;
     markAccountsUnhealthy(ids: string[], reason: string): Promise<void>;
     private rowToAccount;
     close(): void;

package/dist/plugin/storage/sqlite.js

@@ -103,6 +103,24 @@ export class KiroDatabase {
             this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
         });
     }
+    async addRemovedAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db
+                .prepare('INSERT OR REPLACE INTO removed_accounts (id, removed_at) VALUES (?, ?)')
+                .run(id, Date.now());
+        });
+    }
+    async isAccountRemoved(id) {
+        return !!this.db.prepare('SELECT id FROM removed_accounts WHERE id = ?').get(id);
+    }
+    async clearRemovedAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db.prepare('DELETE FROM removed_accounts WHERE id = ?').run(id);
+        });
+    }
+    async listRemovedAccounts() {
+        return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
+    }
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;

package/dist/plugin/sync/kiro-cli.js

@@ -33,6 +33,7 @@ export async function syncFromKiroCli() {
         const deviceReg = safeJsonParse(deviceRegRow?.value);
         const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
         const syncedAccounts = [];
+        let skippedRemoved = 0;
         for (const row of rows) {
             if (row.key.includes(':token')) {
                 const data = safeJsonParse(row.value);
@@ -122,7 +123,10 @@ export async function syncFromKiroCli() {
                     const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
                     if (placeholderId !== id) {
                         const placeholderRow = all.find((a) => a.id === placeholderId);
-                        if (placeholderRow) {
+                        if (placeholderRow && (await kiroDb.isAccountRemoved(placeholderId))) {
+                            skippedRemoved++;
+                        }
+                        else if (placeholderRow) {
                             await kiroDb.upsertAccount({
                                 id: placeholderId,
                                 email: placeholderRow.email,
@@ -147,6 +151,10 @@ export async function syncFromKiroCli() {
                         }
                     }
                 }
+                if (await kiroDb.isAccountRemoved(id)) {
+                    skippedRemoved++;
+                    continue;
+                }
                 await kiroDb.upsertAccount({
                     id,
                     email: resolvedEmail,
@@ -181,6 +189,7 @@ export async function syncFromKiroCli() {
             await kiroDb.markAccountsUnhealthy(staleIds, STALE_CLI_ACCOUNT_REASON);
             logger.warn('Kiro CLI sync: deactivated stale cached accounts', { count: staleIds.length });
         }
+        logger.log('Kiro CLI sync: done', { synced: syncedAccounts.length, skippedRemoved });
         cliDb.close();
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",