@sunerpy/opencode-kiro-auth 0.5.2 → 0.6.1

package/dist/plugin/accounts.d.ts

@@ -6,8 +6,18 @@ export declare class AccountManager {
     private strategy;
     private lastToastTime;
     private lastUsageToastTime;
-    constructor(accounts: ManagedAccount[], strategy?: AccountSelectionStrategy);
-    static loadFromDisk(strategy?: AccountSelectionStrategy): Promise<AccountManager>;
+    private rrCursor;
+    private stickyId?;
+    private quotaAvoidanceEnabled;
+    private quotaReserveThreshold;
+    constructor(accounts: ManagedAccount[], strategy?: AccountSelectionStrategy, opts?: {
+        quotaAvoidanceEnabled?: boolean;
+        quotaReserveThreshold?: number;
+    });
+    static loadFromDisk(strategy?: AccountSelectionStrategy, opts?: {
+        quotaAvoidanceEnabled?: boolean;
+        quotaReserveThreshold?: number;
+    }): Promise<AccountManager>;
     getAccountCount(): number;
     getAccounts(): ManagedAccount[];
     shouldShowToast(debounce?: number): boolean;

package/dist/plugin/accounts.js

@@ -15,12 +15,18 @@ export class AccountManager {
     strategy;
     lastToastTime = 0;
     lastUsageToastTime = 0;
-    constructor(accounts, strategy = 'sticky') {
+    rrCursor = 0;
+    stickyId;
+    quotaAvoidanceEnabled;
+    quotaReserveThreshold;
+    constructor(accounts, strategy = 'sticky', opts) {
         this.accounts = accounts;
         this.cursor = 0;
         this.strategy = strategy;
+        this.quotaAvoidanceEnabled = opts?.quotaAvoidanceEnabled ?? true;
+        this.quotaReserveThreshold = opts?.quotaReserveThreshold ?? 0.95;
     }
-    static async loadFromDisk(strategy) {
+    static async loadFromDisk(strategy, opts) {
         const rows = kiroDb.getAccounts();
         const accounts = rows.map((r) => ({
             id: r.id,
@@ -44,7 +50,7 @@ export class AccountManager {
             usedCount: r.used_count,
             limitCount: r.limit_count
         }));
-        return new AccountManager(accounts, strategy || 'sticky');
+        return new AccountManager(accounts, strategy || 'sticky', opts);
     }
     getAccountCount() {
         return this.accounts.length;
@@ -86,17 +92,29 @@ export class AccountManager {
             }
             return !(a.rateLimitResetTime && now < a.rateLimitResetTime);
         });
+        let candidatePool = available;
+        if (this.accounts.length > 1 && this.quotaAvoidanceEnabled) {
+            const ratio = (a) => a.limitCount && a.limitCount > 0 ? (a.usedCount || 0) / a.limitCount : 0;
+            const ample = available.filter((a) => ratio(a) < this.quotaReserveThreshold);
+            // used>=limit stays in nearFull (soft/drainable, NOT hard-excluded): the
+            // real 402 is the authoritative exhaustion signal and already
+            // hard-switches accounts in error-handler.
+            const nearFull = available.filter((a) => ratio(a) >= this.quotaReserveThreshold);
+            candidatePool = ample.length > 0 ? ample : nearFull;
+        }
         let selected;
-        if (available.length > 0) {
+        if (candidatePool.length > 0) {
             if (this.strategy === 'sticky') {
-                selected = available.find((_, i) => i === this.cursor) || available[0];
+                selected = candidatePool.find((a) => a.id === this.stickyId) || candidatePool[0];
+                if (selected)
+                    this.stickyId = selected.id;
             }
             else if (this.strategy === 'round-robin') {
-                selected = available[this.cursor % available.length];
-                this.cursor = (this.cursor + 1) % available.length;
+                selected = candidatePool[this.rrCursor % candidatePool.length];
+                this.rrCursor++;
             }
             else if (this.strategy === 'lowest-usage') {
-                selected = [...available].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+                selected = [...candidatePool].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
             }
         }
         if (!selected) {
@@ -113,7 +131,6 @@ export class AccountManager {
         if (selected) {
             selected.lastUsed = now;
             selected.usedCount = (selected.usedCount || 0) + 1;
-            this.cursor = this.accounts.indexOf(selected);
             return selected;
         }
         return null;

package/dist/plugin/config/loader.js

@@ -90,6 +90,8 @@ function applyEnvOverrides(config) {
         account_selection_strategy: env.KIRO_ACCOUNT_SELECTION_STRATEGY
             ? AccountSelectionStrategySchema.catch('lowest-usage').parse(env.KIRO_ACCOUNT_SELECTION_STRATEGY)
             : config.account_selection_strategy,
+        quota_avoidance_enabled: parseBooleanEnv(env.KIRO_QUOTA_AVOIDANCE_ENABLED, config.quota_avoidance_enabled),
+        quota_reserve_threshold: parseNumberEnv(env.KIRO_QUOTA_RESERVE_THRESHOLD, config.quota_reserve_threshold),
         default_region: env.KIRO_DEFAULT_REGION
             ? RegionSchema.catch('us-east-1').parse(env.KIRO_DEFAULT_REGION)
             : config.default_region,

package/dist/plugin/config/schema.d.ts

@@ -19,6 +19,19 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region: z.ZodOptional<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     idc_profile_arn: z.ZodOptional<z.ZodString>;
     account_selection_strategy: z.ZodDefault<z.ZodEnum<["sticky", "round-robin", "lowest-usage"]>>;
+    /**
+     * Softly avoid accounts whose usage ratio is at/above
+     * `quota_reserve_threshold` when other accounts still have room. When ALL
+     * healthy accounts are near-full they are drained anyway (the real 402 in
+     * error-handler is the authoritative hard-switch). Only affects
+     * multi-account selection; single-account behavior is unchanged.
+     */
+    quota_avoidance_enabled: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Usage ratio (used/limit) at/above which an account is considered
+     * near-full and softly avoided. Default 0.95 (95%).
+     */
+    quota_reserve_threshold: z.ZodDefault<z.ZodNumber>;
     default_region: z.ZodDefault<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     rate_limit_retry_delay_ms: z.ZodDefault<z.ZodNumber>;
     rate_limit_max_retries: z.ZodDefault<z.ZodNumber>;
@@ -52,6 +65,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     auto_effort_mapping: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     account_selection_strategy: "sticky" | "round-robin" | "lowest-usage";
+    quota_avoidance_enabled: boolean;
+    quota_reserve_threshold: number;
     default_region: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1";
     rate_limit_retry_delay_ms: number;
     rate_limit_max_retries: number;
@@ -77,6 +92,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     idc_profile_arn?: string | undefined;
     account_selection_strategy?: "sticky" | "round-robin" | "lowest-usage" | undefined;
+    quota_avoidance_enabled?: boolean | undefined;
+    quota_reserve_threshold?: number | undefined;
     default_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     rate_limit_retry_delay_ms?: number | undefined;
     rate_limit_max_retries?: number | undefined;

package/dist/plugin/config/schema.js

@@ -51,6 +51,19 @@ export const KiroConfigSchema = z.object({
     idc_region: RegionSchema.optional(),
     idc_profile_arn: z.string().optional(),
     account_selection_strategy: AccountSelectionStrategySchema.default('lowest-usage'),
+    /**
+     * Softly avoid accounts whose usage ratio is at/above
+     * `quota_reserve_threshold` when other accounts still have room. When ALL
+     * healthy accounts are near-full they are drained anyway (the real 402 in
+     * error-handler is the authoritative hard-switch). Only affects
+     * multi-account selection; single-account behavior is unchanged.
+     */
+    quota_avoidance_enabled: z.boolean().default(true),
+    /**
+     * Usage ratio (used/limit) at/above which an account is considered
+     * near-full and softly avoided. Default 0.95 (95%).
+     */
+    quota_reserve_threshold: z.number().min(0).max(1).default(0.95),
     default_region: RegionSchema.default('us-east-1'),
     rate_limit_retry_delay_ms: z.number().min(1000).max(60000).default(5000),
     rate_limit_max_retries: z.number().min(0).max(10).default(3),
@@ -85,6 +98,8 @@ export const KiroConfigSchema = z.object({
 });
 export const DEFAULT_CONFIG = {
     account_selection_strategy: 'lowest-usage',
+    quota_avoidance_enabled: true,
+    quota_reserve_threshold: 0.95,
     default_region: 'us-east-1',
     rate_limit_retry_delay_ms: 5000,
     rate_limit_max_retries: 3,

package/dist/plugin/sync/kiro-cli-parser.d.ts

@@ -6,3 +6,4 @@ export declare function findClientCredsRecursive(input: unknown): {
     clientSecret?: string;
 };
 export declare function makePlaceholderEmail(authMethod: string, region: string, clientId?: string, profileArn?: string): string;
+export declare function isPlaceholderEmail(email: unknown): boolean;

package/dist/plugin/sync/kiro-cli-parser.js

@@ -70,3 +70,9 @@ export function makePlaceholderEmail(authMethod, region, clientId, profileArn) {
     const h = createHash('sha256').update(seed).digest('hex').slice(0, 16);
     return `${authMethod}-placeholder+${h}@awsapps.local`;
 }
+// Loose pre-filter ONLY. NOT authoritative: before deleting, callers must also
+// require row.email === exact makePlaceholderEmail(...) AND row.id === recomputed
+// placeholderId for the SAME identity, so a real account is never deleted.
+export function isPlaceholderEmail(email) {
+    return (typeof email === 'string' && email.includes('-placeholder+') && email.endsWith('@awsapps.local'));
+}

package/dist/plugin/sync/kiro-cli.js

@@ -5,7 +5,7 @@ import { createDeterministicAccountId } from '../accounts.js';
 import * as logger from '../logger.js';
 import { kiroDb } from '../storage/sqlite.js';
 import { fetchUsageLimits } from '../usage.js';
-import { findClientCredsRecursive, getCliDbPath, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser.js';
+import { findClientCredsRecursive, getCliDbPath, isPlaceholderEmail, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser.js';
 import { readActiveProfileArnFromKiroCli } from './kiro-cli-profile.js';
 import { getStaleKiroCliAccountIds, STALE_CLI_ACCOUNT_REASON } from './stale-accounts.js';
 export async function syncFromKiroCli() {
@@ -96,61 +96,66 @@ export async function syncFromKiroCli() {
                 }
                 const all = kiroDb.getAccounts();
                 if (!email) {
-                    let existing;
-                    if (profileArn) {
-                        existing = all.find((a) => a.auth_method === authMethod && a.profile_arn === profileArn);
-                    }
-                    if (!existing && authMethod === 'idc' && clientId) {
-                        existing = all.find((a) => a.auth_method === 'idc' && a.client_id === clientId);
-                    }
-                    if (existing && typeof existing.email === 'string' && existing.email) {
-                        email = existing.email;
+                    const sameIdentity = all.filter((a) => {
+                        if (profileArn && a.auth_method === authMethod && a.profile_arn === profileArn)
+                            return true;
+                        if (authMethod === 'idc' &&
+                            clientId &&
+                            a.auth_method === 'idc' &&
+                            a.client_id === clientId)
+                            return true;
+                        return false;
+                    });
+                    const realAccount = sameIdentity.find((a) => typeof a.email === 'string' && a.email && !isPlaceholderEmail(a.email));
+                    if (realAccount) {
+                        email = realAccount.email;
                     }
                     else {
+                        const placeholderId = createDeterministicAccountId(makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn), authMethod, clientId, profileArn);
+                        if (await kiroDb.isAccountRemoved(placeholderId)) {
+                            await kiroDb.clearRemovedAccount(placeholderId);
+                        }
                         email = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
                     }
                 }
                 const resolvedEmail = email || makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
+                const hasRealEmail = !!resolvedEmail && !isPlaceholderEmail(resolvedEmail);
                 const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, profileArn);
+                // Cleanup runs BEFORE the fresh-enough early-continue: a lingering
+                // same-identity placeholder must be removed even when the real account
+                // is already up to date and would otherwise skip the rest of the round.
+                if (hasRealEmail) {
+                    for (const row of all) {
+                        if (row.id === id)
+                            continue;
+                        const sameIdentity = (!!profileArn && row.auth_method === authMethod && row.profile_arn === profileArn) ||
+                            (authMethod === 'idc' &&
+                                !!clientId &&
+                                row.auth_method === 'idc' &&
+                                row.client_id === clientId);
+                        if (!sameIdentity)
+                            continue;
+                        if (!isPlaceholderEmail(row.email))
+                            continue;
+                        // Prove the row is a genuine placeholder by self-consistency against
+                        // its OWN fields (clientId rotates across device re-registration, so
+                        // recomputing with the current token's clientId would miss it). A
+                        // real email can never equal its own makePlaceholderEmail recompute,
+                        // so this never deletes a real account.
+                        const rowPlaceholderEmail = makePlaceholderEmail(row.auth_method, row.region, row.client_id, row.profile_arn);
+                        const rowPlaceholderId = createDeterministicAccountId(rowPlaceholderEmail, row.auth_method, row.client_id, row.profile_arn);
+                        if (row.email === rowPlaceholderEmail && row.id === rowPlaceholderId) {
+                            await kiroDb.deleteAccount(row.id);
+                            await kiroDb.addRemovedAccount(row.id);
+                        }
+                    }
+                }
                 const existingById = all.find((a) => a.id === id);
                 if (existingById &&
                     existingById.is_healthy === 1 &&
                     existingById.expires_at >= cliExpiresAt &&
                     existingById.expires_at > Date.now())
                     continue;
-                if (usageOk) {
-                    const placeholderEmail = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
-                    const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
-                    if (placeholderId !== id) {
-                        const placeholderRow = all.find((a) => a.id === placeholderId);
-                        if (placeholderRow && (await kiroDb.isAccountRemoved(placeholderId))) {
-                            skippedRemoved++;
-                        }
-                        else if (placeholderRow) {
-                            await kiroDb.upsertAccount({
-                                id: placeholderId,
-                                email: placeholderRow.email,
-                                authMethod,
-                                region: placeholderRow.region || serviceRegion,
-                                oidcRegion: placeholderRow.oidc_region || oidcRegion,
-                                clientId,
-                                clientSecret,
-                                profileArn,
-                                refreshToken: placeholderRow.refresh_token || refreshToken,
-                                accessToken: placeholderRow.access_token || accessToken,
-                                expiresAt: placeholderRow.expires_at || cliExpiresAt,
-                                rateLimitResetTime: 0,
-                                isHealthy: false,
-                                failCount: 10,
-                                unhealthyReason: 'Replaced by real email',
-                                recoveryTime: Date.now() + 31536000000,
-                                usedCount: placeholderRow.used_count || 0,
-                                limitCount: placeholderRow.limit_count || 0,
-                                lastSync: Date.now()
-                            });
-                        }
-                    }
-                }
                 if (await kiroDb.isAccountRemoved(id)) {
                     skippedRemoved++;
                     continue;

package/dist/plugin.js

@@ -15,7 +15,10 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
     const cache = new AccountCache(60000);
     const repository = new AccountRepository(cache);
     const authHandler = new AuthHandler(config, repository);
-    const accountManager = await AccountManager.loadFromDisk(config.account_selection_strategy);
+    const accountManager = await AccountManager.loadFromDisk(config.account_selection_strategy, {
+        quotaAvoidanceEnabled: config.quota_avoidance_enabled,
+        quotaReserveThreshold: config.quota_reserve_threshold
+    });
     authHandler.setAccountManager(accountManager);
     const requestHandler = new RequestHandler(accountManager, config, repository, client);
     // Compute the base URL once so both the config hook and auth loader use the same value

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.5.2",
+  "version": "0.6.1",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",