@sunerpy/opencode-kiro-auth 0.6.0 → 0.6.2

package/README.md

@@ -4,6 +4,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
 [![npm downloads](https://img.shields.io/npm/dm/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
+[![codecov](https://codecov.io/gh/sunerpy/opencode-kiro-auth/branch/main/graph/badge.svg)](https://codecov.io/gh/sunerpy/opencode-kiro-auth)
 [![license](https://img.shields.io/npm/l/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)
 
 > OpenCode plugin that lets OpenCode use AWS Kiro (CodeWhisperer) as a model

package/dist/core/request/request-handler.d.ts

@@ -21,6 +21,12 @@ export declare class RequestHandler {
     private enqueueKiroRequest;
     private handleKiroRequest;
     private extractModel;
+    /**
+     * Seam over the module-level SDK client factory so tests can inject a fake
+     * client without a real network call or a leaky module mock. Behavior is
+     * identical to calling createSdkClient directly.
+     */
+    private makeSdkClient;
     private prepareSdkRequest;
     private handleSuccessfulRequest;
     private logSdkRequest;

package/dist/core/request/request-handler.js

@@ -133,7 +133,7 @@ export class RequestHandler {
                 this.logSdkRequest(sdkPrep, acc, apiTimestamp);
             }
             try {
-                const client = createSdkClient(auth, sdkPrep.region, sdkPrep.effort);
+                const client = this.makeSdkClient(auth, sdkPrep.region, sdkPrep.effort);
                 const command = new GenerateAssistantResponseCommand({
                     conversationState: sdkPrep.conversationState,
                     profileArn: sdkPrep.profileArn
@@ -183,6 +183,14 @@ export class RequestHandler {
     extractModel(url) {
         return url.match(/models\/([^/:]+)/)?.[1] || null;
     }
+    /**
+     * Seam over the module-level SDK client factory so tests can inject a fake
+     * client without a real network call or a leaky module mock. Behavior is
+     * identical to calling createSdkClient directly.
+     */
+    makeSdkClient(auth, region, effort) {
+        return createSdkClient(auth, region, effort);
+    }
     prepareSdkRequest(body, model, auth, think, budget, showToast) {
         return transformToSdkRequest(body, model, auth, think, budget, showToast, {
             effort: this.config.effort,

package/dist/plugin/sync/kiro-cli-parser.d.ts

@@ -6,3 +6,4 @@ export declare function findClientCredsRecursive(input: unknown): {
     clientSecret?: string;
 };
 export declare function makePlaceholderEmail(authMethod: string, region: string, clientId?: string, profileArn?: string): string;
+export declare function isPlaceholderEmail(email: unknown): boolean;

package/dist/plugin/sync/kiro-cli-parser.js

@@ -70,3 +70,9 @@ export function makePlaceholderEmail(authMethod, region, clientId, profileArn) {
     const h = createHash('sha256').update(seed).digest('hex').slice(0, 16);
     return `${authMethod}-placeholder+${h}@awsapps.local`;
 }
+// Loose pre-filter ONLY. NOT authoritative: before deleting, callers must also
+// require row.email === exact makePlaceholderEmail(...) AND row.id === recomputed
+// placeholderId for the SAME identity, so a real account is never deleted.
+export function isPlaceholderEmail(email) {
+    return (typeof email === 'string' && email.includes('-placeholder+') && email.endsWith('@awsapps.local'));
+}

package/dist/plugin/sync/kiro-cli.js

@@ -5,7 +5,7 @@ import { createDeterministicAccountId } from '../accounts.js';
 import * as logger from '../logger.js';
 import { kiroDb } from '../storage/sqlite.js';
 import { fetchUsageLimits } from '../usage.js';
-import { findClientCredsRecursive, getCliDbPath, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser.js';
+import { findClientCredsRecursive, getCliDbPath, isPlaceholderEmail, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser.js';
 import { readActiveProfileArnFromKiroCli } from './kiro-cli-profile.js';
 import { getStaleKiroCliAccountIds, STALE_CLI_ACCOUNT_REASON } from './stale-accounts.js';
 export async function syncFromKiroCli() {
@@ -96,61 +96,66 @@ export async function syncFromKiroCli() {
                 }
                 const all = kiroDb.getAccounts();
                 if (!email) {
-                    let existing;
-                    if (profileArn) {
-                        existing = all.find((a) => a.auth_method === authMethod && a.profile_arn === profileArn);
-                    }
-                    if (!existing && authMethod === 'idc' && clientId) {
-                        existing = all.find((a) => a.auth_method === 'idc' && a.client_id === clientId);
-                    }
-                    if (existing && typeof existing.email === 'string' && existing.email) {
-                        email = existing.email;
+                    const sameIdentity = all.filter((a) => {
+                        if (profileArn && a.auth_method === authMethod && a.profile_arn === profileArn)
+                            return true;
+                        if (authMethod === 'idc' &&
+                            clientId &&
+                            a.auth_method === 'idc' &&
+                            a.client_id === clientId)
+                            return true;
+                        return false;
+                    });
+                    const realAccount = sameIdentity.find((a) => typeof a.email === 'string' && a.email && !isPlaceholderEmail(a.email));
+                    if (realAccount) {
+                        email = realAccount.email;
                     }
                     else {
+                        const placeholderId = createDeterministicAccountId(makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn), authMethod, clientId, profileArn);
+                        if (await kiroDb.isAccountRemoved(placeholderId)) {
+                            await kiroDb.clearRemovedAccount(placeholderId);
+                        }
                         email = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
                     }
                 }
                 const resolvedEmail = email || makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
+                const hasRealEmail = !!resolvedEmail && !isPlaceholderEmail(resolvedEmail);
                 const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, profileArn);
+                // Cleanup runs BEFORE the fresh-enough early-continue: a lingering
+                // same-identity placeholder must be removed even when the real account
+                // is already up to date and would otherwise skip the rest of the round.
+                if (hasRealEmail) {
+                    for (const row of all) {
+                        if (row.id === id)
+                            continue;
+                        const sameIdentity = (!!profileArn && row.auth_method === authMethod && row.profile_arn === profileArn) ||
+                            (authMethod === 'idc' &&
+                                !!clientId &&
+                                row.auth_method === 'idc' &&
+                                row.client_id === clientId);
+                        if (!sameIdentity)
+                            continue;
+                        if (!isPlaceholderEmail(row.email))
+                            continue;
+                        // Prove the row is a genuine placeholder by self-consistency against
+                        // its OWN fields (clientId rotates across device re-registration, so
+                        // recomputing with the current token's clientId would miss it). A
+                        // real email can never equal its own makePlaceholderEmail recompute,
+                        // so this never deletes a real account.
+                        const rowPlaceholderEmail = makePlaceholderEmail(row.auth_method, row.region, row.client_id, row.profile_arn);
+                        const rowPlaceholderId = createDeterministicAccountId(rowPlaceholderEmail, row.auth_method, row.client_id, row.profile_arn);
+                        if (row.email === rowPlaceholderEmail && row.id === rowPlaceholderId) {
+                            await kiroDb.deleteAccount(row.id);
+                            await kiroDb.addRemovedAccount(row.id);
+                        }
+                    }
+                }
                 const existingById = all.find((a) => a.id === id);
                 if (existingById &&
                     existingById.is_healthy === 1 &&
                     existingById.expires_at >= cliExpiresAt &&
                     existingById.expires_at > Date.now())
                     continue;
-                if (usageOk) {
-                    const placeholderEmail = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
-                    const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
-                    if (placeholderId !== id) {
-                        const placeholderRow = all.find((a) => a.id === placeholderId);
-                        if (placeholderRow && (await kiroDb.isAccountRemoved(placeholderId))) {
-                            skippedRemoved++;
-                        }
-                        else if (placeholderRow) {
-                            await kiroDb.upsertAccount({
-                                id: placeholderId,
-                                email: placeholderRow.email,
-                                authMethod,
-                                region: placeholderRow.region || serviceRegion,
-                                oidcRegion: placeholderRow.oidc_region || oidcRegion,
-                                clientId,
-                                clientSecret,
-                                profileArn,
-                                refreshToken: placeholderRow.refresh_token || refreshToken,
-                                accessToken: placeholderRow.access_token || accessToken,
-                                expiresAt: placeholderRow.expires_at || cliExpiresAt,
-                                rateLimitResetTime: 0,
-                                isHealthy: false,
-                                failCount: 10,
-                                unhealthyReason: 'Replaced by real email',
-                                recoveryTime: Date.now() + 31536000000,
-                                usedCount: placeholderRow.used_count || 0,
-                                limitCount: placeholderRow.limit_count || 0,
-                                lastSync: Date.now()
-                            });
-                        }
-                    }
-                }
                 if (await kiroDb.isAccountRemoved(id)) {
                     skippedRemoved++;
                     continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",