@sunerpy/opencode-kiro-auth 0.8.0 → 0.10.0

package/README.md

@@ -85,7 +85,7 @@ customize which models are exposed (including thinking variants), see
    - Note: the TUI `/connect` flow does **not** currently run plugin OAuth
      prompts (Start URL / region), so Identity Center logins may fall back to
      Builder ID unless you use `opencode auth login` (or preconfigure
-     defaults in `~/.config/opencode/kiro.json`).
+     defaults in `~/.config/opencode/kiro-auth-plugin/kiro.json`).
    - For **IAM Identity Center**, you may also need a **profile ARN**
      (`profileArn`) — auto-detected from `kiro-cli profile` if available, or
      set `idc_profile_arn` manually.
@@ -97,7 +97,7 @@ customize which models are exposed (including thinking variants), see
 ## Configuration
 
 Plugin-wide behavior (auth sync, account selection, retry limits, effort
-mapping) lives in `~/.config/opencode/kiro.json`. See
+mapping) lives in `~/.config/opencode/kiro-auth-plugin/kiro.json`. See
 [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every
 option.
 
@@ -108,6 +108,10 @@ multi-account or long-idle setups, enable
 (`token_keepalive_enabled: true`) to keep idle accounts' tokens fresh while
 OpenCode is running.
 
+Paid-overage protection is on by default; see
+[Overage protection](docs/CONFIGURATION.md#overage-protection) before disabling
+`stop_on_overage`.
+
 ## Multiple accounts & rotation
 
 You can register more than one Kiro account and let the plugin spread
@@ -127,13 +131,13 @@ requests across them for combined quota and automatic failover.
    account (option 1) is the supported multi-account path.
 
 **Rotation strategy** — set `account_selection_strategy` in
-`~/.config/opencode/kiro.json`:
+`~/.config/opencode/kiro-auth-plugin/kiro.json`:
 
-| Strategy       | Behavior                                                            | Default |
-| -------------- | -------------------------------------------------------------------- | ------- |
-| `lowest-usage` | Each request picks the healthy account with the lowest used quota    | ✅      |
-| `round-robin`  | Cycles through accounts in order                                     |         |
-| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |       |
+| Strategy       | Behavior                                                               | Default |
+| -------------- | ---------------------------------------------------------------------- | ------- |
+| `lowest-usage` | Each request picks the healthy account with the lowest used quota      | ✅      |
+| `round-robin`  | Cycles through accounts in order                                       |         |
+| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |         |
 
 **Automatic failover** requires no configuration: a rate-limited or 403
 account is marked unhealthy and the next healthy account takes over. If every
@@ -161,7 +165,7 @@ per account, e.g. `929/10000`) and surfaces it in three places:
 
 1. **Auth menu label** — running `opencode auth login` and selecting
    `kiro-auth` shows `[current: <email> <used>/<limit> (<pct>%)]` on the
-   first login method; with multiple accounts they're joined with ` · `,
+   first login method; with multiple accounts they're joined with `·`,
    capped at 3 with a `+N more` suffix.
 2. **Startup toast** — once per plugin init, a toast shows
    `Kiro usage (<email>): <used>/<limit> (<pct>%)` a few seconds after
@@ -187,11 +191,11 @@ your `provider.kiro-auth.models` block.
 Thinking budgets map to Kiro's native `effort` field automatically:
 
 | OpenCode budget | Kiro effort |
-| ---------------- | ----------- |
-| `<= 10000`        | `low`       |
-| `<= 20000`        | `medium`    |
-| `<= 28000`        | `high`      |
-| `> 28000`         | `max`       |
+| --------------- | ----------- |
+| `<= 10000`      | `low`       |
+| `<= 20000`      | `medium`    |
+| `<= 28000`      | `high`      |
+| `> 28000`       | `max`       |
 
 Details and the full JSON example: [docs/MODELS.md](docs/MODELS.md).
 
@@ -279,12 +283,21 @@ Releases are automated with
 **Linux/macOS:**
 
 - SQLite database: `~/.config/opencode/kiro.db`
-- Plugin config: `~/.config/opencode/kiro.json`
+- Plugin config: `~/.config/opencode/kiro-auth-plugin/kiro.json`
+- Logs: `~/.config/opencode/kiro-auth-plugin/logs/`
+- Refresh and keep-alive locks: `~/.config/opencode/kiro-auth-plugin/`
 
 **Windows:**
 
 - SQLite database: `%APPDATA%\opencode\kiro.db`
-- Plugin config: `%APPDATA%\opencode\kiro.json`
+- Plugin config: `%APPDATA%\opencode\kiro-auth-plugin\kiro.json`
+- Logs: `%APPDATA%\opencode\kiro-auth-plugin\logs\`
+- Refresh and keep-alive locks: `%APPDATA%\opencode\kiro-auth-plugin\`
+
+Existing config, logs, and stale flat lock files are migrated automatically on
+first startup; no action is needed. The SQLite database deliberately remains at
+the flat `opencode/kiro.db` path because moving a live database during an upgrade
+is unsafe.
 
 ## Acknowledgements
 

package/dist/core/account/account-selector.js

@@ -26,6 +26,9 @@ export class AccountSelector {
         let acc = this.accountManager.getCurrentOrNext();
         if (!acc) {
             this.circuitBreakerTrips++;
+            if (this.accountManager.allSelectableBlockedByOverage()) {
+                throw new Error('All accounts have exceeded their free quota and entered paid overage. Set "stop_on_overage": false in ~/.config/opencode/kiro-auth-plugin/kiro.json to continue with paid overage, or wait for the quota to reset.');
+            }
             const wait = this.accountManager.getMinWaitTime();
             if (wait > 0 && wait < 30000) {
                 if (this.accountManager.shouldShowToast()) {

package/dist/core/auth/idc-auth-method.js

@@ -106,7 +106,7 @@ export class IdcAuthMethod {
                             error: e instanceof Error ? e.message : String(e)
                         });
                         if (startUrl && !profileArn) {
-                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
+                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro-auth-plugin/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
                         }
                         const errMsg = e instanceof Error ? e.message : String(e);
                         if (errMsg.includes('FEATURE_NOT_SUPPORTED')) {
@@ -176,7 +176,7 @@ export class IdcAuthMethod {
                 catch (e) {
                     const err = e instanceof Error ? e : new Error(String(e));
                     logger.error('IDC auth callback failed', err);
-                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
+                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-auth-plugin/logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
                 }
             }
         };

package/dist/plugin/accounts.d.ts

@@ -10,24 +10,33 @@ export declare class AccountManager {
     private stickyId?;
     private quotaAvoidanceEnabled;
     private quotaReserveThreshold;
+    private stopOnOverage;
+    private overageThreshold;
     constructor(accounts: ManagedAccount[], strategy?: AccountSelectionStrategy, opts?: {
         quotaAvoidanceEnabled?: boolean;
         quotaReserveThreshold?: number;
+        stopOnOverage?: boolean;
+        overageThreshold?: number;
     });
     static loadFromDisk(strategy?: AccountSelectionStrategy, opts?: {
         quotaAvoidanceEnabled?: boolean;
         quotaReserveThreshold?: number;
+        stopOnOverage?: boolean;
+        overageThreshold?: number;
     }): Promise<AccountManager>;
     getAccountCount(): number;
     getAccounts(): ManagedAccount[];
     shouldShowToast(debounce?: number): boolean;
     shouldShowUsageToast(debounce?: number): boolean;
     getMinWaitTime(): number;
+    allSelectableBlockedByOverage(): boolean;
     getCurrentOrNext(): ManagedAccount | null;
     updateUsage(id: string, meta: {
         usedCount: number;
         limitCount: number;
+        overageCount?: number;
         email?: string;
+        lastSync?: number;
     }): void;
     addAccount(a: ManagedAccount): void;
     removeAccount(a: ManagedAccount): void;
@@ -36,4 +45,5 @@ export declare class AccountManager {
     markUnhealthy(a: ManagedAccount, reason: string, recovery?: number): void;
     saveToDisk(): Promise<void>;
     toAuthDetails(a: ManagedAccount): KiroAuthDetails;
+    private isOverageBlocked;
 }

package/dist/plugin/accounts.js

@@ -19,12 +19,16 @@ export class AccountManager {
     stickyId;
     quotaAvoidanceEnabled;
     quotaReserveThreshold;
+    stopOnOverage;
+    overageThreshold;
     constructor(accounts, strategy = 'sticky', opts) {
         this.accounts = accounts;
         this.cursor = 0;
         this.strategy = strategy;
         this.quotaAvoidanceEnabled = opts?.quotaAvoidanceEnabled ?? true;
         this.quotaReserveThreshold = opts?.quotaReserveThreshold ?? 0.95;
+        this.stopOnOverage = opts?.stopOnOverage ?? true;
+        this.overageThreshold = opts?.overageThreshold ?? 0;
     }
     static async loadFromDisk(strategy, opts) {
         const rows = kiroDb.getAccounts();
@@ -48,7 +52,9 @@ export class AccountManager {
             failCount: r.fail_count || 0,
             lastUsed: r.last_used,
             usedCount: r.used_count,
-            limitCount: r.limit_count
+            limitCount: r.limit_count,
+            overageCount: r.overage_count || 0,
+            lastSync: r.last_sync
         }));
         return new AccountManager(accounts, strategy || 'sticky', opts);
     }
@@ -75,9 +81,31 @@ export class AccountManager {
         const waits = this.accounts.map((a) => (a.rateLimitResetTime || 0) - now).filter((t) => t > 0);
         return waits.length > 0 ? Math.min(...waits) : 0;
     }
+    allSelectableBlockedByOverage() {
+        if (!this.stopOnOverage)
+            return false;
+        const now = Date.now();
+        const healthEligible = (a) => {
+            if (isPermanentError(a.unhealthyReason))
+                return false;
+            if (a.isHealthy)
+                return true;
+            if (isAccessTokenError(a.unhealthyReason))
+                return true;
+            return a.failCount < 10;
+        };
+        const rateLimited = (a) => !!(a.rateLimitResetTime && now < a.rateLimitResetTime);
+        const hasOverageBlockedEligible = this.accounts.some((a) => healthEligible(a) && this.isOverageBlocked(a));
+        const hasCleanRateLimited = this.accounts.some((a) => healthEligible(a) && rateLimited(a) && !this.isOverageBlocked(a));
+        const hasHealthySelectable = this.accounts.some((a) => a.isHealthy && !rateLimited(a) && !this.isOverageBlocked(a));
+        return hasOverageBlockedEligible && !hasCleanRateLimited && !hasHealthySelectable;
+    }
     getCurrentOrNext() {
         const now = Date.now();
+        const overageBlocked = (a) => this.isOverageBlocked(a);
         const available = this.accounts.filter((a) => {
+            if (overageBlocked(a))
+                return false;
             if (!a.isHealthy) {
                 if (isPermanentError(a.unhealthyReason)) {
                     return false;
@@ -129,7 +157,10 @@ export class AccountManager {
         }
         if (!selected) {
             const fallback = this.accounts
-                .filter((a) => !a.isHealthy && a.failCount < 10 && !isPermanentError(a.unhealthyReason))
+                .filter((a) => !a.isHealthy &&
+                a.failCount < 10 &&
+                !isPermanentError(a.unhealthyReason) &&
+                !overageBlocked(a))
                 .sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
             if (fallback) {
                 fallback.isHealthy = true;
@@ -139,6 +170,8 @@ export class AccountManager {
             }
         }
         if (selected) {
+            if (overageBlocked(selected))
+                return null;
             selected.lastUsed = now;
             selected.usedCount = (selected.usedCount || 0) + 1;
             return selected;
@@ -150,6 +183,8 @@ export class AccountManager {
         if (a) {
             a.usedCount = meta.usedCount;
             a.limitCount = meta.limitCount;
+            a.overageCount = meta.overageCount ?? 0;
+            a.lastSync = meta.lastSync ?? a.lastSync;
             if (meta.email)
                 a.email = meta.email;
             if (!isPermanentError(a.unhealthyReason)) {
@@ -290,4 +325,7 @@ export class AccountManager {
             email: a.email
         };
     }
+    isOverageBlocked(a) {
+        return this.stopOnOverage && (a.overageCount ?? 0) > this.overageThreshold;
+    }
 }

package/dist/plugin/config/loader.d.ts

@@ -1,5 +1,5 @@
 import { type KiroConfig } from './schema.js';
-export declare function getUserConfigPath(): string;
+export { getUserConfigPath } from '../paths.js';
 export declare function getProjectConfigPath(directory: string): string;
 export declare function loadConfig(directory: string): KiroConfig;
 export declare function configExists(path: string): boolean;

package/dist/plugin/config/loader.js

@@ -1,19 +1,9 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import * as logger from '../logger.js';
+import { getLegacyUserConfigPath, getLogsDir, getUserConfigPath } from '../paths.js';
 import { AccountSelectionStrategySchema, DEFAULT_CONFIG, KiroConfigSchema, RegionSchema } from './schema.js';
-function getConfigDir() {
-    const platform = process.platform;
-    if (platform === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
-    return join(xdgConfig, 'opencode');
-}
-export function getUserConfigPath() {
-    return join(getConfigDir(), 'kiro.json');
-}
+export { getUserConfigPath } from '../paths.js';
 function ensureUserConfigTemplate() {
     const path = getUserConfigPath();
     if (!existsSync(path)) {
@@ -155,11 +145,16 @@ function applyEnvOverrides(config) {
     };
 }
 export function loadConfig(directory) {
-    ensureUserConfigTemplate();
-    backfillUserConfig(getUserConfigPath());
-    let config = { ...DEFAULT_CONFIG };
     const userConfigPath = getUserConfigPath();
-    const userConfig = loadConfigFile(userConfigPath);
+    const legacyUserConfigPath = getLegacyUserConfigPath();
+    const configSourcePath = !existsSync(userConfigPath) && existsSync(legacyUserConfigPath)
+        ? legacyUserConfigPath
+        : userConfigPath;
+    if (configSourcePath === userConfigPath)
+        ensureUserConfigTemplate();
+    backfillUserConfig(configSourcePath);
+    let config = { ...DEFAULT_CONFIG };
+    const userConfig = loadConfigFile(configSourcePath);
     if (userConfig) {
         config = mergeConfigs(config, userConfig);
     }
@@ -175,5 +170,5 @@ export function configExists(path) {
     return existsSync(path);
 }
 export function getDefaultLogsDir() {
-    return join(getConfigDir(), 'kiro-logs');
+    return getLogsDir();
 }

package/dist/plugin/config/schema.d.ts

@@ -32,6 +32,15 @@ export declare const KiroConfigSchema: z.ZodObject<{
      * near-full and softly avoided. Default 0.95 (95%).
      */
     quota_reserve_threshold: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Exclude accounts that have entered AWS paid overage from selection.
+     */
+    stop_on_overage: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Paid-overage invocations tolerated before stopping an account. 0 means
+     * stop on any overage.
+     */
+    overage_threshold: z.ZodDefault<z.ZodNumber>;
     default_region: z.ZodDefault<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     rate_limit_retry_delay_ms: z.ZodDefault<z.ZodNumber>;
     rate_limit_max_retries: z.ZodDefault<z.ZodNumber>;
@@ -77,6 +86,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     account_selection_strategy: "sticky" | "round-robin" | "lowest-usage";
     quota_avoidance_enabled: boolean;
     quota_reserve_threshold: number;
+    stop_on_overage: boolean;
+    overage_threshold: number;
     default_region: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1";
     rate_limit_retry_delay_ms: number;
     rate_limit_max_retries: number;
@@ -106,6 +117,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     account_selection_strategy?: "sticky" | "round-robin" | "lowest-usage" | undefined;
     quota_avoidance_enabled?: boolean | undefined;
     quota_reserve_threshold?: number | undefined;
+    stop_on_overage?: boolean | undefined;
+    overage_threshold?: number | undefined;
     default_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     rate_limit_retry_delay_ms?: number | undefined;
     rate_limit_max_retries?: number | undefined;

package/dist/plugin/config/schema.js

@@ -64,6 +64,15 @@ export const KiroConfigSchema = z.object({
      * near-full and softly avoided. Default 0.95 (95%).
      */
     quota_reserve_threshold: z.number().min(0).max(1).default(0.95),
+    /**
+     * Exclude accounts that have entered AWS paid overage from selection.
+     */
+    stop_on_overage: z.boolean().default(true),
+    /**
+     * Paid-overage invocations tolerated before stopping an account. 0 means
+     * stop on any overage.
+     */
+    overage_threshold: z.number().min(0).default(0),
     default_region: RegionSchema.default('us-east-1'),
     rate_limit_retry_delay_ms: z.number().min(1000).max(60000).default(5000),
     rate_limit_max_retries: z.number().min(0).max(10).default(3),
@@ -110,6 +119,8 @@ export const DEFAULT_CONFIG = {
     account_selection_strategy: 'lowest-usage',
     quota_avoidance_enabled: true,
     quota_reserve_threshold: 0.95,
+    stop_on_overage: true,
+    overage_threshold: 0,
     default_region: 'us-east-1',
     rate_limit_retry_delay_ms: 5000,
     rate_limit_max_retries: 3,

package/dist/plugin/logger.js

@@ -1,22 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { getLogsDir } from './paths.js';
 const binaryToBase64Replacer = (_key, value) => {
     if (value instanceof Uint8Array)
         return Buffer.from(value).toString('base64');
     return value;
 };
-const getLogDir = () => {
-    const platform = process.platform;
-    const base = platform === 'win32'
-        ? join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode')
-        : join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-    return join(base, 'kiro-logs');
-};
 const writeToFile = (level, message, ...args) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const path = join(dir, 'plugin.log');
         const timestamp = new Date().toISOString();
@@ -42,7 +35,7 @@ const writeToFile = (level, message, ...args) => {
 };
 const writeApiLog = (type, data, timestamp, isError = false) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const prefix = isError ? 'error_' : '';
         const filename = `${prefix}${timestamp}_${type}.json`;

package/dist/plugin/paths.d.ts

@@ -0,0 +1,9 @@
+export declare function getOpencodeConfigDir(): string;
+export declare function getPluginDir(): string;
+export declare function getUserConfigPath(): string;
+export declare function getLegacyUserConfigPath(): string;
+export declare function getLogsDir(): string;
+export declare function getLegacyLogsDir(): string;
+export declare function getRefreshLockPath(accountId: string): string;
+export declare function getKeepAliveLockPath(): string;
+export declare function getMigrationLockPath(): string;

package/dist/plugin/paths.js

@@ -0,0 +1,33 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export function getOpencodeConfigDir() {
+    const p = process.platform;
+    if (p === 'win32')
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export function getPluginDir() {
+    return join(getOpencodeConfigDir(), 'kiro-auth-plugin');
+}
+export function getUserConfigPath() {
+    return join(getPluginDir(), 'kiro.json');
+}
+export function getLegacyUserConfigPath() {
+    return join(getOpencodeConfigDir(), 'kiro.json');
+}
+export function getLogsDir() {
+    return join(getPluginDir(), 'logs');
+}
+export function getLegacyLogsDir() {
+    return join(getOpencodeConfigDir(), 'kiro-logs');
+}
+export function getRefreshLockPath(accountId) {
+    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
+    return join(getPluginDir(), `.kiro-refresh-${safeAccountId}.lock`);
+}
+export function getKeepAliveLockPath() {
+    return join(getPluginDir(), '.kiro-keepalive.lock');
+}
+export function getMigrationLockPath() {
+    return join(getOpencodeConfigDir(), '.kiro-auth-migration.lock');
+}

package/dist/plugin/storage/locked-operations.d.ts

@@ -1,7 +1,6 @@
 import type { ManagedAccount } from '../types.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
-export declare function getRefreshLockPath(accountId: string): string;
-export declare function getKeepAliveLockPath(): string;
 export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
@@ -9,4 +8,3 @@ export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T |
 export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
 export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
 export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];
-export {};

package/dist/plugin/storage/locked-operations.js

@@ -1,9 +1,10 @@
 import { createHash } from 'node:crypto';
 import { existsSync, promises as fs } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
+import { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 const LOCK_OPTIONS = {
     stale: 10000,
     retries: {
@@ -29,23 +30,6 @@ const KEEP_ALIVE_LOCK_OPTIONS = {
     retries: 0,
     realpath: false
 };
-function getBaseDir() {
-    // Keep this local instead of importing DB_PATH from sqlite.ts: sqlite.ts imports
-    // this module and also constructs `kiroDb` at module load, so importing it here
-    // would create a cycle and trigger database construction just to compute a lock path.
-    const p = process.platform;
-    if (p === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-}
-export function getRefreshLockPath(accountId) {
-    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
-    return join(getBaseDir(), `.kiro-refresh-${safeAccountId}.lock`);
-}
-export function getKeepAliveLockPath() {
-    return join(getBaseDir(), '.kiro-keepalive.lock');
-}
 export async function withDatabaseLock(dbPath, fn) {
     if (!existsSync(dbPath)) {
         const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));
@@ -139,6 +123,7 @@ export function mergeAccounts(existing, incoming) {
             // in-memory token triple from another process must not clobber a newer
             // persisted token triple during this cross-process merge.
             const tokenWinner = (acc.expiresAt || 0) >= (existingAcc.expiresAt || 0) ? acc : existingAcc;
+            const usageWinner = (acc.lastSync || 0) >= (existingAcc.lastSync || 0) ? acc : existingAcc;
             accountMap.set(acc.id, {
                 ...existingAcc,
                 ...acc,
@@ -146,8 +131,9 @@ export function mergeAccounts(existing, incoming) {
                 accessToken: tokenWinner.accessToken,
                 expiresAt: tokenWinner.expiresAt,
                 lastUsed: Math.max(existingAcc.lastUsed || 0, acc.lastUsed || 0),
-                usedCount: Math.max(existingAcc.usedCount || 0, acc.usedCount || 0),
-                limitCount: Math.max(existingAcc.limitCount || 0, acc.limitCount || 0),
+                usedCount: usageWinner.usedCount ?? 0,
+                limitCount: usageWinner.limitCount ?? 0,
+                overageCount: usageWinner.overageCount ?? 0,
                 rateLimitResetTime: Math.max(existingAcc.rateLimitResetTime || 0, acc.rateLimitResetTime || 0),
                 isHealthy: incomingRecovered
                     ? true

package/dist/plugin/storage/migrate-layout.d.ts

@@ -0,0 +1 @@
+export declare function migrateSafeFilesIfNeeded(): void;

package/dist/plugin/storage/migrate-layout.js

@@ -0,0 +1,191 @@
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, renameSync, rmdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import lockfile from 'proper-lockfile';
+import * as logger from '../logger.js';
+import { getLegacyLogsDir, getLegacyUserConfigPath, getLogsDir, getMigrationLockPath, getOpencodeConfigDir, getPluginDir, getUserConfigPath } from '../paths.js';
+const MIGRATION_LOCK_OPTIONS = {
+    stale: 15000,
+    retries: 0,
+    realpath: false
+};
+const MIGRATION_LOCK_ATTEMPTS = 4;
+function isCrossDeviceError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'EXDEV';
+}
+function removeTemporaryFile(path) {
+    if (!existsSync(path))
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: temporary file cleanup failed', {
+            path,
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+}
+function moveFile(source, destination) {
+    try {
+        renameSync(source, destination);
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !isCrossDeviceError(error))
+            throw error;
+    }
+    const temporaryDestination = `${destination}.tmp-${process.pid}`;
+    try {
+        copyFileSync(source, temporaryDestination);
+        renameSync(temporaryDestination, destination);
+        unlinkSync(source);
+    }
+    catch (error) {
+        removeTemporaryFile(temporaryDestination);
+        throw error;
+    }
+}
+function migrateUserConfig() {
+    const legacyPath = getLegacyUserConfigPath();
+    const destinationPath = getUserConfigPath();
+    if (!existsSync(legacyPath) || existsSync(destinationPath))
+        return false;
+    moveFile(legacyPath, destinationPath);
+    return true;
+}
+function migrateLogs() {
+    const legacyDir = getLegacyLogsDir();
+    if (!existsSync(legacyDir))
+        return 0;
+    const destinationDir = getLogsDir();
+    mkdirSync(destinationDir, { recursive: true });
+    let moved = 0;
+    for (const entry of readdirSync(legacyDir)) {
+        const source = join(legacyDir, entry);
+        const destination = join(destinationDir, entry);
+        if (existsSync(destination))
+            continue;
+        try {
+            moveFile(source, destination);
+            moved++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: log file move failed', {
+                source,
+                destination,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    if (readdirSync(legacyDir).length === 0) {
+        try {
+            rmdirSync(legacyDir);
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: legacy log directory cleanup failed', {
+                path: legacyDir,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return moved;
+}
+function removeStaleFlatLocks() {
+    const configDir = getOpencodeConfigDir();
+    let removed = 0;
+    for (const entry of readdirSync(configDir)) {
+        const isKeepAliveLock = entry === '.kiro-keepalive.lock';
+        const isRefreshLock = /^\.kiro-refresh-.*\.lock$/.test(entry);
+        if (!isKeepAliveLock && !isRefreshLock)
+            continue;
+        const path = join(configDir, entry);
+        try {
+            unlinkSync(path);
+            removed++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock cleanup failed', {
+                path,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return removed;
+}
+function acquireMigrationLock(path) {
+    let lastError;
+    for (let attempt = 0; attempt < MIGRATION_LOCK_ATTEMPTS; attempt++) {
+        try {
+            return lockfile.lockSync(path, MIGRATION_LOCK_OPTIONS);
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    logger.warn('Storage layout migration: lock acquisition skipped', lastError);
+    return null;
+}
+function runMigration() {
+    try {
+        mkdirSync(getPluginDir(), { recursive: true });
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: plugin directory creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const migrationLockPath = getMigrationLockPath();
+    try {
+        closeSync(openSync(migrationLockPath, 'a'));
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: lock file creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const release = acquireMigrationLock(migrationLockPath);
+    if (!release)
+        return;
+    let configMoved = false;
+    let logsMoved = 0;
+    let locksRemoved = 0;
+    try {
+        try {
+            configMoved = migrateUserConfig();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: config move failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            logsMoved = migrateLogs();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: logs migration failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            locksRemoved = removeStaleFlatLocks();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock scan failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    finally {
+        try {
+            release();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: lock release failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    logger.log('Storage layout migration complete', {
+        configMoved,
+        logsMoved,
+        locksRemoved
+    });
+}
+export function migrateSafeFilesIfNeeded() {
+    try {
+        runMigration();
+    }
+    catch (error) {
+        logger.warn('Storage layout migration failed non-fatally', error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/plugin/storage/migrations.js

@@ -6,6 +6,7 @@ export function runMigrations(db) {
     migrateOidcRegionColumn(db);
     migrateDropRefreshTokenUniqueIndex(db);
     migrateRemovedAccountsTable(db);
+    migrateOverageColumn(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -159,3 +160,10 @@ function migrateRemovedAccountsTable(db) {
     // so kiro-cli auto-sync does not silently re-import them. Cleared only on deliberate login.
     db.exec('CREATE TABLE IF NOT EXISTS removed_accounts (id TEXT PRIMARY KEY, removed_at INTEGER NOT NULL)');
 }
+function migrateOverageColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(accounts)').all();
+    const names = new Set(columns.map((c) => c.name));
+    if (!names.has('overage_count')) {
+        db.exec('ALTER TABLE accounts ADD COLUMN overage_count INTEGER DEFAULT 0');
+    }
+}

package/dist/plugin/storage/sqlite.js

@@ -33,7 +33,8 @@ export class KiroDatabase {
         refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
         rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
         recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
-        used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
+        used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0,
+        overage_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
       )
     `);
         runMigrations(this.db);
@@ -56,8 +57,8 @@ export class KiroDatabase {
         id, email, auth_method, region, oidc_region, client_id, client_secret,
         profile_arn, start_url, refresh_token, access_token, expires_at, rate_limit_reset,
         is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
-        used_count, limit_count, last_sync
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        used_count, limit_count, overage_count, last_sync
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
         id=excluded.id, email=excluded.email, auth_method=excluded.auth_method,
         region=excluded.region, oidc_region=excluded.oidc_region, client_id=excluded.client_id, client_secret=excluded.client_secret,
@@ -66,9 +67,10 @@ export class KiroDatabase {
         rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
         unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,
         fail_count=excluded.fail_count, last_used=excluded.last_used,
-        used_count=excluded.used_count, limit_count=excluded.limit_count, last_sync=excluded.last_sync
+        used_count=excluded.used_count, limit_count=excluded.limit_count,
+        overage_count=excluded.overage_count, last_sync=excluded.last_sync
     `)
-            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.oidcRegion || null, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.startUrl || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
+            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.oidcRegion || null, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.startUrl || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.overageCount || 0, acc.lastSync || 0);
     }
     isRemovedSync(id) {
         return !!this.db.prepare('SELECT id FROM removed_accounts WHERE id = ?').get(id);
@@ -233,6 +235,7 @@ export class KiroDatabase {
             lastUsed: row.last_used,
             usedCount: row.used_count,
             limitCount: row.limit_count,
+            overageCount: row.overage_count || 0,
             lastSync: row.last_sync
         };
     }

package/dist/plugin/types.d.ts

@@ -42,6 +42,7 @@ export interface ManagedAccount {
     failCount: number;
     usedCount?: number;
     limitCount?: number;
+    overageCount?: number;
     lastSync?: number;
     lastUsed?: number;
 }

package/dist/plugin/usage.d.ts

@@ -1,3 +1,16 @@
-import { KiroAuthDetails, ManagedAccount } from './types.js';
-export declare function fetchUsageLimits(auth: KiroAuthDetails): Promise<any>;
-export declare function updateAccountQuota(account: ManagedAccount, usage: any, accountManager?: any): void;
+import type { KiroAuthDetails, ManagedAccount } from './types.js';
+interface UsageSnapshot {
+    usedCount: number;
+    limitCount: number;
+    overageCount: number;
+    email?: string;
+}
+interface UsageUpdateMeta extends UsageSnapshot {
+    lastSync: number;
+}
+interface AccountUsageManager {
+    updateUsage(id: string, meta: UsageUpdateMeta): void;
+}
+export declare function fetchUsageLimits(auth: KiroAuthDetails): Promise<UsageSnapshot>;
+export declare function updateAccountQuota(account: ManagedAccount, usage: Partial<UsageSnapshot>, accountManager?: AccountUsageManager): void;
+export {};

package/dist/plugin/usage.js

@@ -1,3 +1,26 @@
+import { z } from 'zod';
+const UsageLimitsResponseSchema = z
+    .object({
+    usageBreakdownList: z
+        .array(z
+        .object({
+        currentUsage: z.number().optional(),
+        usageLimit: z.number().optional(),
+        currentOverages: z.number().optional(),
+        freeTrialInfo: z
+            .object({
+            currentUsage: z.number().optional(),
+            usageLimit: z.number().optional()
+        })
+            .passthrough()
+            .nullable()
+            .optional()
+    })
+        .passthrough())
+        .optional(),
+    userInfo: z.object({ email: z.string().optional() }).passthrough().optional()
+})
+    .passthrough();
 export async function fetchUsageLimits(auth) {
     // Try different parameter combinations
     const attempts = [
@@ -42,8 +65,8 @@ export async function fetchUsageLimits(auth) {
                 lastError = new Error(`Status: ${res.status}${errType ? ` (${errType})` : ''}${requestId ? ` [${requestId}]` : ''}: ${msg}`);
                 continue;
             }
-            const data = await res.json();
-            let usedCount = 0, limitCount = 0;
+            const data = UsageLimitsResponseSchema.parse(await res.json());
+            let usedCount = 0, limitCount = 0, overageCount = 0;
             if (Array.isArray(data.usageBreakdownList)) {
                 for (const s of data.usageBreakdownList) {
                     if (s.freeTrialInfo) {
@@ -52,9 +75,10 @@ export async function fetchUsageLimits(auth) {
                     }
                     usedCount += s.currentUsage || 0;
                     limitCount += s.usageLimit || 0;
+                    overageCount += s.currentOverages || 0;
                 }
             }
-            return { usedCount, limitCount, email: data.userInfo?.email };
+            return { usedCount, limitCount, overageCount, email: data.userInfo?.email };
         }
         catch (e) {
             lastError = e instanceof Error ? e : new Error(String(e));
@@ -68,10 +92,14 @@ export function updateAccountQuota(account, usage, accountManager) {
     const meta = {
         usedCount: usage.usedCount || 0,
         limitCount: usage.limitCount || 0,
+        overageCount: usage.overageCount || 0,
+        lastSync: Date.now(),
         email: usage.email
     };
     account.usedCount = meta.usedCount;
     account.limitCount = meta.limitCount;
+    account.overageCount = meta.overageCount;
+    account.lastSync = meta.lastSync;
     if (usage.email)
         account.email = usage.email;
     if (accountManager)

package/dist/plugin.js

@@ -7,6 +7,7 @@ import { AccountRepository } from './infrastructure/database/account-repository.
 import { AccountManager } from './plugin/accounts.js';
 import { bootstrapAuthIfNeeded } from './plugin/auth-bootstrap.js';
 import { loadConfig } from './plugin/config/index.js';
+import { migrateSafeFilesIfNeeded } from './plugin/storage/migrate-layout.js';
 const KIRO_PROVIDER_ID = 'kiro-auth';
 let activeKeepAliveController = null;
 let keepAliveTeardownRegistered = false;
@@ -34,6 +35,12 @@ export function __getActiveKeepAliveControllerForTest() {
     return activeKeepAliveController;
 }
 export const createKiroPlugin = (id) => async ({ client, directory }) => {
+    try {
+        migrateSafeFilesIfNeeded();
+    }
+    catch (error) {
+        console.warn('Kiro storage layout migration failed non-fatally:', error instanceof Error ? error.message : String(error));
+    }
     const config = loadConfig(directory);
     const showToast = (message, variant) => {
         client.tui.showToast({ body: { message, variant } }).catch(() => { });
@@ -43,7 +50,9 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
     const authHandler = new AuthHandler(config, repository);
     const accountManager = await AccountManager.loadFromDisk(config.account_selection_strategy, {
         quotaAvoidanceEnabled: config.quota_avoidance_enabled,
-        quotaReserveThreshold: config.quota_reserve_threshold
+        quotaReserveThreshold: config.quota_reserve_threshold,
+        stopOnOverage: config.stop_on_overage,
+        overageThreshold: config.overage_threshold
     });
     authHandler.setAccountManager(accountManager);
     const requestHandler = new RequestHandler(accountManager, config, repository, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",