@sunerpy/opencode-kiro-auth 0.6.2 → 0.8.0

package/dist/infrastructure/transformers/event-stream-parser.js

@@ -109,7 +109,7 @@ export function parseEventLine(line) {
     try {
         return JSON.parse(line);
     }
-    catch (e) {
+    catch {
         return null;
     }
 }

package/dist/infrastructure/transformers/tool-call-parser.js

@@ -15,7 +15,7 @@ export function parseBracketToolCalls(text) {
                 input: args
             });
         }
-        catch (e) {
+        catch {
             continue;
         }
     }

package/dist/kiro/oauth-idc.js

@@ -3,70 +3,65 @@ export async function authorizeKiroIDC(region, startUrl) {
     const effectiveRegion = normalizeRegion(region);
     const ssoOIDCEndpoint = buildUrl(KIRO_AUTH_SERVICE.SSO_OIDC_ENDPOINT, effectiveRegion);
     const effectiveStartUrl = startUrl || KIRO_AUTH_SERVICE.BUILDER_ID_START_URL;
-    try {
-        const registerResponse = await fetch(`${ssoOIDCEndpoint}/client/register`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'User-Agent': KIRO_CONSTANTS.USER_AGENT
-            },
-            body: JSON.stringify({
-                clientName: 'Kiro IDE',
-                clientType: 'public',
-                scopes: KIRO_AUTH_SERVICE.SCOPES,
-                grantTypes: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token']
-            })
-        });
-        if (!registerResponse.ok) {
-            const errorText = await registerResponse.text().catch(() => '');
-            const error = new Error(`Client registration failed: ${registerResponse.status} ${errorText}`);
-            throw error;
-        }
-        const registerData = await registerResponse.json();
-        const { clientId, clientSecret } = registerData;
-        if (!clientId || !clientSecret) {
-            const error = new Error('Client registration response missing clientId or clientSecret');
-            throw error;
-        }
-        const deviceAuthResponse = await fetch(`${ssoOIDCEndpoint}/device_authorization`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'User-Agent': KIRO_CONSTANTS.USER_AGENT
-            },
-            body: JSON.stringify({
-                clientId,
-                clientSecret,
-                startUrl: effectiveStartUrl
-            })
-        });
-        if (!deviceAuthResponse.ok) {
-            const errorText = await deviceAuthResponse.text().catch(() => '');
-            const error = new Error(`Device authorization failed: ${deviceAuthResponse.status} ${errorText}`);
-            throw error;
-        }
-        const deviceAuthData = await deviceAuthResponse.json();
-        const { verificationUri, verificationUriComplete, userCode, deviceCode, interval = 5, expiresIn = 600 } = deviceAuthData;
-        if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete) {
-            const error = new Error('Device authorization response missing required fields');
-            throw error;
-        }
-        return {
-            verificationUrl: verificationUri,
-            verificationUriComplete,
-            userCode,
-            deviceCode,
+    const registerResponse = await fetch(`${ssoOIDCEndpoint}/client/register`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'User-Agent': KIRO_CONSTANTS.USER_AGENT
+        },
+        body: JSON.stringify({
+            clientName: 'Kiro IDE',
+            clientType: 'public',
+            scopes: KIRO_AUTH_SERVICE.SCOPES,
+            grantTypes: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token']
+        })
+    });
+    if (!registerResponse.ok) {
+        const errorText = await registerResponse.text().catch(() => '');
+        const error = new Error(`Client registration failed: ${registerResponse.status} ${errorText}`);
+        throw error;
+    }
+    const registerData = await registerResponse.json();
+    const { clientId, clientSecret } = registerData;
+    if (!clientId || !clientSecret) {
+        const error = new Error('Client registration response missing clientId or clientSecret');
+        throw error;
+    }
+    const deviceAuthResponse = await fetch(`${ssoOIDCEndpoint}/device_authorization`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'User-Agent': KIRO_CONSTANTS.USER_AGENT
+        },
+        body: JSON.stringify({
             clientId,
             clientSecret,
-            interval,
-            expiresIn,
-            region: effectiveRegion,
             startUrl: effectiveStartUrl
-        };
+        })
+    });
+    if (!deviceAuthResponse.ok) {
+        const errorText = await deviceAuthResponse.text().catch(() => '');
+        const error = new Error(`Device authorization failed: ${deviceAuthResponse.status} ${errorText}`);
+        throw error;
     }
-    catch (error) {
+    const deviceAuthData = await deviceAuthResponse.json();
+    const { verificationUri, verificationUriComplete, userCode, deviceCode, interval = 5, expiresIn = 600 } = deviceAuthData;
+    if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete) {
+        const error = new Error('Device authorization response missing required fields');
         throw error;
     }
+    return {
+        verificationUrl: verificationUri,
+        verificationUriComplete,
+        userCode,
+        deviceCode,
+        clientId,
+        clientSecret,
+        interval,
+        expiresIn,
+        region: effectiveRegion,
+        startUrl: effectiveStartUrl
+    };
 }
 export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, interval, expiresIn, region) {
     if (!clientId || !clientSecret || !deviceCode) {
@@ -101,7 +96,7 @@ export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, inter
                 try {
                     tokenData = JSON.parse(responseText);
                 }
-                catch (parseError) {
+                catch {
                     throw new Error(`Token polling failed: invalid JSON response (HTTP ${tokenResponse.status}): ${responseText.slice(0, 300)}`);
                 }
             }

package/dist/plugin/accounts.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { decodeRefreshToken, encodeRefreshToken } from '../kiro/auth.js';
-import { isPermanentError } from './health.js';
+import { isAccessTokenError, isPermanentError } from './health.js';
 import * as logger from './logger.js';
 import { kiroDb } from './storage/sqlite.js';
 import { writeToKiroCli } from './sync/kiro-cli.js';
@@ -82,6 +82,16 @@ export class AccountManager {
                 if (isPermanentError(a.unhealthyReason)) {
                     return false;
                 }
+                // Heal-by-refresh: a legacy access-token-error row (persisted
+                // invalid-bearer, possibly failCount=10) is refreshable, so reset and
+                // reselect it. Refresh-dead rows are already excluded above.
+                if (isAccessTokenError(a.unhealthyReason)) {
+                    a.failCount = 0;
+                    a.isHealthy = true;
+                    delete a.unhealthyReason;
+                    delete a.recoveryTime;
+                    return true;
+                }
                 if (a.failCount < 10 && a.recoveryTime && now >= a.recoveryTime) {
                     a.isHealthy = true;
                     delete a.unhealthyReason;
@@ -172,13 +182,8 @@ export class AccountManager {
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id).catch((e) => logger.warn('DB write failed', {
-            method: 'removeAccount',
-            email: a.email,
-            error: e instanceof Error ? e.message : String(e)
-        }));
-        kiroDb.addRemovedAccount(a.id).catch((e) => logger.warn('DB write failed', {
-            method: 'removeAccount:tombstone',
+        kiroDb.removeAccountWithTombstone(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccountWithTombstone',
             email: a.email,
             error: e instanceof Error ? e.message : String(e)
         }));

package/dist/plugin/config/loader.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import * as logger from '../logger.js';
@@ -30,6 +30,53 @@ function ensureUserConfigTemplate() {
 export function getProjectConfigPath(directory) {
     return join(directory, '.opencode', 'kiro.json');
 }
+// Additively write any DEFAULT_CONFIG key missing from an existing user
+// kiro.json so new-version keys become visible/toggleable. Additive-only,
+// parse-safe, atomic, idempotent, user-config-only. See plan config-backfill.md.
+function backfillUserConfig(path) {
+    if (!existsSync(path)) {
+        return;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return;
+    }
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return;
+    }
+    const obj = raw;
+    const defaultKeys = Object.keys(DEFAULT_CONFIG);
+    const missing = defaultKeys.filter((key) => !(key in obj));
+    if (missing.length === 0) {
+        return;
+    }
+    const next = { ...obj };
+    for (const key of missing) {
+        next[key] = DEFAULT_CONFIG[key];
+    }
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, 'utf-8');
+        try {
+            renameSync(tmp, path);
+        }
+        catch (renameError) {
+            try {
+                if (existsSync(tmp))
+                    unlinkSync(tmp);
+            }
+            catch { }
+            throw renameError;
+        }
+        logger.log(`Backfilled ${missing.length} new config key(s) into ${path}: ${missing.join(', ')}`);
+    }
+    catch (error) {
+        logger.warn(`Config backfill failed for ${path}: ${String(error)}`);
+    }
+}
 function loadConfigFile(path) {
     try {
         if (!existsSync(path)) {
@@ -109,6 +156,7 @@ function applyEnvOverrides(config) {
 }
 export function loadConfig(directory) {
     ensureUserConfigTemplate();
+    backfillUserConfig(getUserConfigPath());
     let config = { ...DEFAULT_CONFIG };
     const userConfigPath = getUserConfigPath();
     const userConfig = loadConfigFile(userConfigPath);

package/dist/plugin/config/schema.d.ts

@@ -38,6 +38,16 @@ export declare const KiroConfigSchema: z.ZodObject<{
     max_request_iterations: z.ZodDefault<z.ZodNumber>;
     request_timeout_ms: z.ZodDefault<z.ZodNumber>;
     token_expiry_buffer_ms: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Opt-in leader-elected keep-alive that proactively rotates idle-account
+     * tokens near expiry. Disabled by default until proven in real sessions.
+     */
+    token_keepalive_enabled: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Interval for the leader-elected keep-alive scan that keeps idle-account
+     * refresh tokens rotating. Default 10 minutes; bounded to 1 minute-1 hour.
+     */
+    token_keepalive_interval_ms: z.ZodDefault<z.ZodNumber>;
     usage_sync_max_retries: z.ZodDefault<z.ZodNumber>;
     auth_server_port_start: z.ZodDefault<z.ZodNumber>;
     auth_server_port_range: z.ZodDefault<z.ZodNumber>;
@@ -73,6 +83,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     max_request_iterations: number;
     request_timeout_ms: number;
     token_expiry_buffer_ms: number;
+    token_keepalive_enabled: boolean;
+    token_keepalive_interval_ms: number;
     usage_sync_max_retries: number;
     auth_server_port_start: number;
     auth_server_port_range: number;
@@ -100,6 +112,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     max_request_iterations?: number | undefined;
     request_timeout_ms?: number | undefined;
     token_expiry_buffer_ms?: number | undefined;
+    token_keepalive_enabled?: boolean | undefined;
+    token_keepalive_interval_ms?: number | undefined;
     usage_sync_max_retries?: number | undefined;
     auth_server_port_start?: number | undefined;
     auth_server_port_range?: number | undefined;

package/dist/plugin/config/schema.js

@@ -70,11 +70,21 @@ export const KiroConfigSchema = z.object({
     max_request_iterations: z.number().min(5).max(1000).default(20),
     request_timeout_ms: z.number().min(30000).max(600000).default(120000),
     token_expiry_buffer_ms: z.number().min(30000).max(300000).default(300000),
+    /**
+     * Opt-in leader-elected keep-alive that proactively rotates idle-account
+     * tokens near expiry. Disabled by default until proven in real sessions.
+     */
+    token_keepalive_enabled: z.boolean().default(false),
+    /**
+     * Interval for the leader-elected keep-alive scan that keeps idle-account
+     * refresh tokens rotating. Default 10 minutes; bounded to 1 minute-1 hour.
+     */
+    token_keepalive_interval_ms: z.number().min(60000).max(3600000).default(600000),
     usage_sync_max_retries: z.number().min(0).max(5).default(3),
     auth_server_port_start: z.number().min(1024).max(65535).default(19847),
     auth_server_port_range: z.number().min(1).max(100).default(10),
     usage_tracking_enabled: z.boolean().default(true),
-    auto_sync_kiro_cli: z.boolean().default(true),
+    auto_sync_kiro_cli: z.boolean().default(false),
     enable_log_api_request: z.boolean().default(false),
     /**
      * Enable config-gated debug logging that records the inbound
@@ -106,11 +116,13 @@ export const DEFAULT_CONFIG = {
     max_request_iterations: 20,
     request_timeout_ms: 120000,
     token_expiry_buffer_ms: 300000,
+    token_keepalive_enabled: false,
+    token_keepalive_interval_ms: 600000,
     usage_sync_max_retries: 3,
     auth_server_port_start: 19847,
     auth_server_port_range: 10,
     usage_tracking_enabled: true,
-    auto_sync_kiro_cli: true,
+    auto_sync_kiro_cli: false,
     enable_log_api_request: false,
     enable_log_effort_debug: false,
     auto_effort_mapping: true

package/dist/plugin/health.d.ts

@@ -1 +1,23 @@
+/** REFRESH-token-dead signals (needs re-login). Historical permanent set. */
+export declare function isRefreshTokenDead(reason?: string): boolean;
+/**
+ * ACCESS-token-error signals (refreshable, transient). The canonical case is
+ * the CodeWhisperer invalid-bearer 403 whose message is "The bearer token
+ * included in the request is invalid". Matched case-insensitively so a
+ * capitalization drift on the wire does not misclassify it as dead.
+ */
+export declare function isAccessTokenError(reason?: string): boolean;
+/**
+ * Back-compat alias. Semantics == refresh-token-dead == permanent (needs
+ * re-auth). Preserved so callers that gate exclude/auto-heal/needs-reauth on
+ * "permanent" keep working unchanged.
+ */
 export declare function isPermanentError(reason?: string): boolean;
+/**
+ * Ensure a reason string classifies as refresh-token-dead when persisted via
+ * markUnhealthy (which decides permanence from the reason string). If the raw
+ * message already matches a dead keyword it is returned unchanged; otherwise a
+ * dead marker is prepended so the stored reason is recognized as permanent by
+ * isRefreshTokenDead / isPermanentError.
+ */
+export declare function toDeadReason(reason?: string): string;

package/dist/plugin/health.js

@@ -1,4 +1,25 @@
-export function isPermanentError(reason) {
+// Failure classification for Kiro accounts.
+//
+// Two orthogonal classes drive the auth/health/refresh logic:
+//
+//   isAccessTokenError  — the ACCESS token is stale/invalid but the REFRESH
+//                         token is (probably) still good. REFRESHABLE: force a
+//                         refresh and retry; never mark the account dead just
+//                         for this. "The bearer token included in the request
+//                         is invalid" is the canonical signal.
+//
+//   isRefreshTokenDead  — the REFRESH token itself is dead (or the OIDC client
+//                         registration expired). PERMANENT: the account needs a
+//                         re-login. This is exactly the historical
+//                         isPermanentError keyword set.
+//
+// isPermanentError is kept as an alias of isRefreshTokenDead so every existing
+// caller (request-handler, accounts, stale-accounts, locked-operations) keeps
+// its "permanent = exclude / don't auto-heal / needs-reauth" semantics: a
+// refresh-token-dead account IS permanent. invalid-bearer is deliberately NOT
+// in this set, so it is no longer treated as permanent.
+/** REFRESH-token-dead signals (needs re-login). Historical permanent set. */
+export function isRefreshTokenDead(reason) {
     if (!reason)
         return false;
     return (reason.includes('Invalid refresh token') ||
@@ -11,3 +32,37 @@ export function isPermanentError(reason) {
         reason.includes('HTTP_401') ||
         reason.includes('HTTP_403'));
 }
+/**
+ * ACCESS-token-error signals (refreshable, transient). The canonical case is
+ * the CodeWhisperer invalid-bearer 403 whose message is "The bearer token
+ * included in the request is invalid". Matched case-insensitively so a
+ * capitalization drift on the wire does not misclassify it as dead.
+ */
+export function isAccessTokenError(reason) {
+    if (!reason)
+        return false;
+    const lower = reason.toLowerCase();
+    return (lower.includes('bearer token included in the request is invalid') ||
+        lower.includes('access token has expired') ||
+        lower.includes('access_token expired') ||
+        lower.includes('the access token expired'));
+}
+/**
+ * Back-compat alias. Semantics == refresh-token-dead == permanent (needs
+ * re-auth). Preserved so callers that gate exclude/auto-heal/needs-reauth on
+ * "permanent" keep working unchanged.
+ */
+export function isPermanentError(reason) {
+    return isRefreshTokenDead(reason);
+}
+/**
+ * Ensure a reason string classifies as refresh-token-dead when persisted via
+ * markUnhealthy (which decides permanence from the reason string). If the raw
+ * message already matches a dead keyword it is returned unchanged; otherwise a
+ * dead marker is prepended so the stored reason is recognized as permanent by
+ * isRefreshTokenDead / isPermanentError.
+ */
+export function toDeadReason(reason) {
+    const base = reason && reason.length > 0 ? reason : 'Account needs re-authentication';
+    return isRefreshTokenDead(base) ? base : `InvalidTokenException: ${base}`;
+}

package/dist/plugin/image-handler.js

@@ -36,7 +36,7 @@ function extractImagesFromOpenAI(content) {
                         data: data
                     });
                 }
-                catch (e) {
+                catch {
                     continue;
                 }
             }

package/dist/plugin/logger.js

@@ -38,7 +38,7 @@ const writeToFile = (level, message, ...args) => {
             .join(' ')}\n`;
         appendFileSync(path, content);
     }
-    catch (e) { }
+    catch { }
 };
 const writeApiLog = (type, data, timestamp, isError = false) => {
     try {
@@ -50,7 +50,7 @@ const writeApiLog = (type, data, timestamp, isError = false) => {
         const content = JSON.stringify(data, binaryToBase64Replacer, 2);
         writeFileSync(path, content);
     }
-    catch (e) { }
+    catch { }
 };
 export function log(message, ...args) {
     writeToFile('INFO', message, ...args);

package/dist/plugin/request.js

@@ -29,7 +29,7 @@ function inferToolSpecFromHistory(name, toolUsesInHistory) {
     const json = Object.keys(properties).length > 0 ? { type: 'object', properties } : { type: 'object' };
     return { name, description: `Tool ${name}`, inputSchema: { json } };
 }
-function buildCodeWhispererRequest(body, model, auth, think = false, budget = 20000, showToast) {
+function buildCodeWhispererRequest(body, model, auth, think = false, budget = 20000, _showToast) {
     const req = typeof body === 'string' ? JSON.parse(body) : body;
     const { messages, tools, system } = req;
     const convId = crypto.randomUUID();

package/dist/plugin/response.js

@@ -68,7 +68,7 @@ function parseEventStreamChunk(rawText, model) {
             try {
                 parsedInput = JSON.parse(tc.input);
             }
-            catch (e) {
+            catch {
                 parsedInput = tc.input;
             }
         }

package/dist/plugin/storage/locked-operations.d.ts

@@ -1,5 +1,12 @@
 import type { ManagedAccount } from '../types.js';
+type LockRelease = () => Promise<void>;
+export declare function getRefreshLockPath(accountId: string): string;
+export declare function getKeepAliveLockPath(): string;
 export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
+export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
+export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
+export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T | null>;
 export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
 export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
 export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];
+export {};

package/dist/plugin/storage/locked-operations.js

@@ -1,5 +1,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, promises as fs } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
 const LOCK_OPTIONS = {
@@ -12,8 +14,39 @@ const LOCK_OPTIONS = {
     },
     realpath: false
 };
+const REFRESH_LOCK_OPTIONS = {
+    stale: 15000,
+    retries: {
+        retries: 10,
+        minTimeout: 100,
+        maxTimeout: 1000,
+        factor: 2
+    },
+    realpath: false
+};
+const KEEP_ALIVE_LOCK_OPTIONS = {
+    stale: 120000,
+    retries: 0,
+    realpath: false
+};
+function getBaseDir() {
+    // Keep this local instead of importing DB_PATH from sqlite.ts: sqlite.ts imports
+    // this module and also constructs `kiroDb` at module load, so importing it here
+    // would create a cycle and trigger database construction just to compute a lock path.
+    const p = process.platform;
+    if (p === 'win32') {
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
+    }
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export function getRefreshLockPath(accountId) {
+    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
+    return join(getBaseDir(), `.kiro-refresh-${safeAccountId}.lock`);
+}
+export function getKeepAliveLockPath() {
+    return join(getBaseDir(), '.kiro-keepalive.lock');
+}
 export async function withDatabaseLock(dbPath, fn) {
-    const lockPath = `${dbPath}.lock`;
     if (!existsSync(dbPath)) {
         const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));
         await fs.mkdir(dir, { recursive: true });
@@ -35,6 +68,58 @@ export async function withDatabaseLock(dbPath, fn) {
         }
     }
 }
+export async function withRefreshLock(accountId, fn) {
+    const lockPath = getRefreshLockPath(accountId);
+    if (!existsSync(lockPath)) {
+        await fs.mkdir(dirname(lockPath), { recursive: true });
+        await fs.writeFile(lockPath, '');
+    }
+    let release = null;
+    try {
+        release = await lockfile.lock(lockPath, REFRESH_LOCK_OPTIONS);
+        return await fn();
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch (e) {
+                console.warn('Failed to release refresh lock:', e);
+            }
+        }
+    }
+}
+export async function tryAcquireKeepAliveLock() {
+    const lockPath = getKeepAliveLockPath();
+    if (!existsSync(lockPath)) {
+        await fs.mkdir(dirname(lockPath), { recursive: true });
+        await fs.writeFile(lockPath, '');
+    }
+    try {
+        return await lockfile.lock(lockPath, KEEP_ALIVE_LOCK_OPTIONS);
+    }
+    catch {
+        return null;
+    }
+}
+export async function withKeepAliveLock(fn) {
+    const release = await tryAcquireKeepAliveLock();
+    if (!release) {
+        return null;
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        try {
+            await release();
+        }
+        catch (e) {
+            console.warn('Failed to release keep-alive lock:', e);
+        }
+    }
+}
 export function createDeterministicId(email, authMethod, clientId, profileArn) {
     const parts = [email, authMethod, clientId || '', profileArn || ''].join(':');
     return createHash('sha256').update(parts).digest('hex');
@@ -50,9 +135,16 @@ export function mergeAccounts(existing, incoming) {
             const incomingHasPermanentError = isPermanentError(acc.unhealthyReason);
             const hasPermanentError = isPermanentError(existingAcc.unhealthyReason) || incomingHasPermanentError;
             const incomingRecovered = acc.isHealthy && !incomingHasPermanentError;
+            // AWS SSO-OIDC rotates refresh tokens and invalidates the old token; a stale
+            // in-memory token triple from another process must not clobber a newer
+            // persisted token triple during this cross-process merge.
+            const tokenWinner = (acc.expiresAt || 0) >= (existingAcc.expiresAt || 0) ? acc : existingAcc;
             accountMap.set(acc.id, {
                 ...existingAcc,
                 ...acc,
+                refreshToken: tokenWinner.refreshToken,
+                accessToken: tokenWinner.accessToken,
+                expiresAt: tokenWinner.expiresAt,
                 lastUsed: Math.max(existingAcc.lastUsed || 0, acc.lastUsed || 0),
                 usedCount: Math.max(existingAcc.usedCount || 0, acc.usedCount || 0),
                 limitCount: Math.max(existingAcc.limitCount || 0, acc.limitCount || 0),

package/dist/plugin/storage/migrations.js

@@ -81,7 +81,7 @@ function migrateRealEmailColumn(db) {
             db.exec('ALTER TABLE accounts_new RENAME TO accounts');
             db.exec('COMMIT');
         }
-        catch (e) {
+        catch {
             db.exec('ROLLBACK');
         }
     }

package/dist/plugin/storage/sqlite.d.ts

@@ -7,9 +7,13 @@ export declare class KiroDatabase {
     private init;
     getAccounts(): any[];
     private upsertAccountInternal;
+    private isRemovedSync;
+    private purgeRemovedAccountsSync;
     upsertAccount(acc: ManagedAccount): Promise<void>;
     batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
     deleteAccount(id: string): Promise<void>;
+    removeAccountWithTombstone(id: string): Promise<void>;
+    cleanupSupersededIdentities(keepId: string, email: string, authMethod: string, profileArn: string | undefined): Promise<string[]>;
     addRemovedAccount(id: string): Promise<void>;
     isAccountRemoved(id: string): Promise<boolean>;
     clearRemovedAccount(id: string): Promise<void>;