@sunerpy/opencode-kiro-auth 0.9.0 → 0.10.0

package/README.md

@@ -85,7 +85,7 @@ customize which models are exposed (including thinking variants), see
    - Note: the TUI `/connect` flow does **not** currently run plugin OAuth
      prompts (Start URL / region), so Identity Center logins may fall back to
      Builder ID unless you use `opencode auth login` (or preconfigure
-     defaults in `~/.config/opencode/kiro.json`).
+     defaults in `~/.config/opencode/kiro-auth-plugin/kiro.json`).
    - For **IAM Identity Center**, you may also need a **profile ARN**
      (`profileArn`) — auto-detected from `kiro-cli profile` if available, or
      set `idc_profile_arn` manually.
@@ -97,7 +97,7 @@ customize which models are exposed (including thinking variants), see
 ## Configuration
 
 Plugin-wide behavior (auth sync, account selection, retry limits, effort
-mapping) lives in `~/.config/opencode/kiro.json`. See
+mapping) lives in `~/.config/opencode/kiro-auth-plugin/kiro.json`. See
 [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every
 option.
 
@@ -131,13 +131,13 @@ requests across them for combined quota and automatic failover.
    account (option 1) is the supported multi-account path.
 
 **Rotation strategy** — set `account_selection_strategy` in
-`~/.config/opencode/kiro.json`:
+`~/.config/opencode/kiro-auth-plugin/kiro.json`:
 
-| Strategy       | Behavior                                                            | Default |
-| -------------- | -------------------------------------------------------------------- | ------- |
-| `lowest-usage` | Each request picks the healthy account with the lowest used quota    | ✅      |
-| `round-robin`  | Cycles through accounts in order                                     |         |
-| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |       |
+| Strategy       | Behavior                                                               | Default |
+| -------------- | ---------------------------------------------------------------------- | ------- |
+| `lowest-usage` | Each request picks the healthy account with the lowest used quota      | ✅      |
+| `round-robin`  | Cycles through accounts in order                                       |         |
+| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |         |
 
 **Automatic failover** requires no configuration: a rate-limited or 403
 account is marked unhealthy and the next healthy account takes over. If every
@@ -165,7 +165,7 @@ per account, e.g. `929/10000`) and surfaces it in three places:
 
 1. **Auth menu label** — running `opencode auth login` and selecting
    `kiro-auth` shows `[current: <email> <used>/<limit> (<pct>%)]` on the
-   first login method; with multiple accounts they're joined with ` · `,
+   first login method; with multiple accounts they're joined with `·`,
    capped at 3 with a `+N more` suffix.
 2. **Startup toast** — once per plugin init, a toast shows
    `Kiro usage (<email>): <used>/<limit> (<pct>%)` a few seconds after
@@ -191,11 +191,11 @@ your `provider.kiro-auth.models` block.
 Thinking budgets map to Kiro's native `effort` field automatically:
 
 | OpenCode budget | Kiro effort |
-| ---------------- | ----------- |
-| `<= 10000`        | `low`       |
-| `<= 20000`        | `medium`    |
-| `<= 28000`        | `high`      |
-| `> 28000`         | `max`       |
+| --------------- | ----------- |
+| `<= 10000`      | `low`       |
+| `<= 20000`      | `medium`    |
+| `<= 28000`      | `high`      |
+| `> 28000`       | `max`       |
 
 Details and the full JSON example: [docs/MODELS.md](docs/MODELS.md).
 
@@ -283,12 +283,21 @@ Releases are automated with
 **Linux/macOS:**
 
 - SQLite database: `~/.config/opencode/kiro.db`
-- Plugin config: `~/.config/opencode/kiro.json`
+- Plugin config: `~/.config/opencode/kiro-auth-plugin/kiro.json`
+- Logs: `~/.config/opencode/kiro-auth-plugin/logs/`
+- Refresh and keep-alive locks: `~/.config/opencode/kiro-auth-plugin/`
 
 **Windows:**
 
 - SQLite database: `%APPDATA%\opencode\kiro.db`
-- Plugin config: `%APPDATA%\opencode\kiro.json`
+- Plugin config: `%APPDATA%\opencode\kiro-auth-plugin\kiro.json`
+- Logs: `%APPDATA%\opencode\kiro-auth-plugin\logs\`
+- Refresh and keep-alive locks: `%APPDATA%\opencode\kiro-auth-plugin\`
+
+Existing config, logs, and stale flat lock files are migrated automatically on
+first startup; no action is needed. The SQLite database deliberately remains at
+the flat `opencode/kiro.db` path because moving a live database during an upgrade
+is unsafe.
 
 ## Acknowledgements
 

package/dist/core/account/account-selector.js

@@ -27,7 +27,7 @@ export class AccountSelector {
         if (!acc) {
             this.circuitBreakerTrips++;
             if (this.accountManager.allSelectableBlockedByOverage()) {
-                throw new Error('All accounts have exceeded their free quota and entered paid overage. Set "stop_on_overage": false in ~/.config/opencode/kiro.json to continue with paid overage, or wait for the quota to reset.');
+                throw new Error('All accounts have exceeded their free quota and entered paid overage. Set "stop_on_overage": false in ~/.config/opencode/kiro-auth-plugin/kiro.json to continue with paid overage, or wait for the quota to reset.');
             }
             const wait = this.accountManager.getMinWaitTime();
             if (wait > 0 && wait < 30000) {

package/dist/core/auth/idc-auth-method.js

@@ -106,7 +106,7 @@ export class IdcAuthMethod {
                             error: e instanceof Error ? e.message : String(e)
                         });
                         if (startUrl && !profileArn) {
-                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
+                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro-auth-plugin/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
                         }
                         const errMsg = e instanceof Error ? e.message : String(e);
                         if (errMsg.includes('FEATURE_NOT_SUPPORTED')) {
@@ -176,7 +176,7 @@ export class IdcAuthMethod {
                 catch (e) {
                     const err = e instanceof Error ? e : new Error(String(e));
                     logger.error('IDC auth callback failed', err);
-                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
+                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-auth-plugin/logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
                 }
             }
         };

package/dist/plugin/config/loader.d.ts

@@ -1,5 +1,5 @@
 import { type KiroConfig } from './schema.js';
-export declare function getUserConfigPath(): string;
+export { getUserConfigPath } from '../paths.js';
 export declare function getProjectConfigPath(directory: string): string;
 export declare function loadConfig(directory: string): KiroConfig;
 export declare function configExists(path: string): boolean;

package/dist/plugin/config/loader.js

@@ -1,19 +1,9 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import * as logger from '../logger.js';
+import { getLegacyUserConfigPath, getLogsDir, getUserConfigPath } from '../paths.js';
 import { AccountSelectionStrategySchema, DEFAULT_CONFIG, KiroConfigSchema, RegionSchema } from './schema.js';
-function getConfigDir() {
-    const platform = process.platform;
-    if (platform === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
-    return join(xdgConfig, 'opencode');
-}
-export function getUserConfigPath() {
-    return join(getConfigDir(), 'kiro.json');
-}
+export { getUserConfigPath } from '../paths.js';
 function ensureUserConfigTemplate() {
     const path = getUserConfigPath();
     if (!existsSync(path)) {
@@ -155,11 +145,16 @@ function applyEnvOverrides(config) {
     };
 }
 export function loadConfig(directory) {
-    ensureUserConfigTemplate();
-    backfillUserConfig(getUserConfigPath());
-    let config = { ...DEFAULT_CONFIG };
     const userConfigPath = getUserConfigPath();
-    const userConfig = loadConfigFile(userConfigPath);
+    const legacyUserConfigPath = getLegacyUserConfigPath();
+    const configSourcePath = !existsSync(userConfigPath) && existsSync(legacyUserConfigPath)
+        ? legacyUserConfigPath
+        : userConfigPath;
+    if (configSourcePath === userConfigPath)
+        ensureUserConfigTemplate();
+    backfillUserConfig(configSourcePath);
+    let config = { ...DEFAULT_CONFIG };
+    const userConfig = loadConfigFile(configSourcePath);
     if (userConfig) {
         config = mergeConfigs(config, userConfig);
     }
@@ -175,5 +170,5 @@ export function configExists(path) {
     return existsSync(path);
 }
 export function getDefaultLogsDir() {
-    return join(getConfigDir(), 'kiro-logs');
+    return getLogsDir();
 }

package/dist/plugin/logger.js

@@ -1,22 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { getLogsDir } from './paths.js';
 const binaryToBase64Replacer = (_key, value) => {
     if (value instanceof Uint8Array)
         return Buffer.from(value).toString('base64');
     return value;
 };
-const getLogDir = () => {
-    const platform = process.platform;
-    const base = platform === 'win32'
-        ? join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode')
-        : join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-    return join(base, 'kiro-logs');
-};
 const writeToFile = (level, message, ...args) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const path = join(dir, 'plugin.log');
         const timestamp = new Date().toISOString();
@@ -42,7 +35,7 @@ const writeToFile = (level, message, ...args) => {
 };
 const writeApiLog = (type, data, timestamp, isError = false) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const prefix = isError ? 'error_' : '';
         const filename = `${prefix}${timestamp}_${type}.json`;

package/dist/plugin/paths.d.ts

@@ -0,0 +1,9 @@
+export declare function getOpencodeConfigDir(): string;
+export declare function getPluginDir(): string;
+export declare function getUserConfigPath(): string;
+export declare function getLegacyUserConfigPath(): string;
+export declare function getLogsDir(): string;
+export declare function getLegacyLogsDir(): string;
+export declare function getRefreshLockPath(accountId: string): string;
+export declare function getKeepAliveLockPath(): string;
+export declare function getMigrationLockPath(): string;

package/dist/plugin/paths.js

@@ -0,0 +1,33 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export function getOpencodeConfigDir() {
+    const p = process.platform;
+    if (p === 'win32')
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export function getPluginDir() {
+    return join(getOpencodeConfigDir(), 'kiro-auth-plugin');
+}
+export function getUserConfigPath() {
+    return join(getPluginDir(), 'kiro.json');
+}
+export function getLegacyUserConfigPath() {
+    return join(getOpencodeConfigDir(), 'kiro.json');
+}
+export function getLogsDir() {
+    return join(getPluginDir(), 'logs');
+}
+export function getLegacyLogsDir() {
+    return join(getOpencodeConfigDir(), 'kiro-logs');
+}
+export function getRefreshLockPath(accountId) {
+    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
+    return join(getPluginDir(), `.kiro-refresh-${safeAccountId}.lock`);
+}
+export function getKeepAliveLockPath() {
+    return join(getPluginDir(), '.kiro-keepalive.lock');
+}
+export function getMigrationLockPath() {
+    return join(getOpencodeConfigDir(), '.kiro-auth-migration.lock');
+}

package/dist/plugin/storage/locked-operations.d.ts

@@ -1,7 +1,6 @@
 import type { ManagedAccount } from '../types.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
-export declare function getRefreshLockPath(accountId: string): string;
-export declare function getKeepAliveLockPath(): string;
 export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
@@ -9,4 +8,3 @@ export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T |
 export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
 export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
 export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];
-export {};

package/dist/plugin/storage/locked-operations.js

@@ -1,9 +1,10 @@
 import { createHash } from 'node:crypto';
 import { existsSync, promises as fs } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
+import { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 const LOCK_OPTIONS = {
     stale: 10000,
     retries: {
@@ -29,23 +30,6 @@ const KEEP_ALIVE_LOCK_OPTIONS = {
     retries: 0,
     realpath: false
 };
-function getBaseDir() {
-    // Keep this local instead of importing DB_PATH from sqlite.ts: sqlite.ts imports
-    // this module and also constructs `kiroDb` at module load, so importing it here
-    // would create a cycle and trigger database construction just to compute a lock path.
-    const p = process.platform;
-    if (p === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-}
-export function getRefreshLockPath(accountId) {
-    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
-    return join(getBaseDir(), `.kiro-refresh-${safeAccountId}.lock`);
-}
-export function getKeepAliveLockPath() {
-    return join(getBaseDir(), '.kiro-keepalive.lock');
-}
 export async function withDatabaseLock(dbPath, fn) {
     if (!existsSync(dbPath)) {
         const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));

package/dist/plugin/storage/migrate-layout.d.ts

@@ -0,0 +1 @@
+export declare function migrateSafeFilesIfNeeded(): void;

package/dist/plugin/storage/migrate-layout.js

@@ -0,0 +1,191 @@
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, renameSync, rmdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import lockfile from 'proper-lockfile';
+import * as logger from '../logger.js';
+import { getLegacyLogsDir, getLegacyUserConfigPath, getLogsDir, getMigrationLockPath, getOpencodeConfigDir, getPluginDir, getUserConfigPath } from '../paths.js';
+const MIGRATION_LOCK_OPTIONS = {
+    stale: 15000,
+    retries: 0,
+    realpath: false
+};
+const MIGRATION_LOCK_ATTEMPTS = 4;
+function isCrossDeviceError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'EXDEV';
+}
+function removeTemporaryFile(path) {
+    if (!existsSync(path))
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: temporary file cleanup failed', {
+            path,
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+}
+function moveFile(source, destination) {
+    try {
+        renameSync(source, destination);
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !isCrossDeviceError(error))
+            throw error;
+    }
+    const temporaryDestination = `${destination}.tmp-${process.pid}`;
+    try {
+        copyFileSync(source, temporaryDestination);
+        renameSync(temporaryDestination, destination);
+        unlinkSync(source);
+    }
+    catch (error) {
+        removeTemporaryFile(temporaryDestination);
+        throw error;
+    }
+}
+function migrateUserConfig() {
+    const legacyPath = getLegacyUserConfigPath();
+    const destinationPath = getUserConfigPath();
+    if (!existsSync(legacyPath) || existsSync(destinationPath))
+        return false;
+    moveFile(legacyPath, destinationPath);
+    return true;
+}
+function migrateLogs() {
+    const legacyDir = getLegacyLogsDir();
+    if (!existsSync(legacyDir))
+        return 0;
+    const destinationDir = getLogsDir();
+    mkdirSync(destinationDir, { recursive: true });
+    let moved = 0;
+    for (const entry of readdirSync(legacyDir)) {
+        const source = join(legacyDir, entry);
+        const destination = join(destinationDir, entry);
+        if (existsSync(destination))
+            continue;
+        try {
+            moveFile(source, destination);
+            moved++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: log file move failed', {
+                source,
+                destination,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    if (readdirSync(legacyDir).length === 0) {
+        try {
+            rmdirSync(legacyDir);
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: legacy log directory cleanup failed', {
+                path: legacyDir,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return moved;
+}
+function removeStaleFlatLocks() {
+    const configDir = getOpencodeConfigDir();
+    let removed = 0;
+    for (const entry of readdirSync(configDir)) {
+        const isKeepAliveLock = entry === '.kiro-keepalive.lock';
+        const isRefreshLock = /^\.kiro-refresh-.*\.lock$/.test(entry);
+        if (!isKeepAliveLock && !isRefreshLock)
+            continue;
+        const path = join(configDir, entry);
+        try {
+            unlinkSync(path);
+            removed++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock cleanup failed', {
+                path,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return removed;
+}
+function acquireMigrationLock(path) {
+    let lastError;
+    for (let attempt = 0; attempt < MIGRATION_LOCK_ATTEMPTS; attempt++) {
+        try {
+            return lockfile.lockSync(path, MIGRATION_LOCK_OPTIONS);
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    logger.warn('Storage layout migration: lock acquisition skipped', lastError);
+    return null;
+}
+function runMigration() {
+    try {
+        mkdirSync(getPluginDir(), { recursive: true });
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: plugin directory creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const migrationLockPath = getMigrationLockPath();
+    try {
+        closeSync(openSync(migrationLockPath, 'a'));
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: lock file creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const release = acquireMigrationLock(migrationLockPath);
+    if (!release)
+        return;
+    let configMoved = false;
+    let logsMoved = 0;
+    let locksRemoved = 0;
+    try {
+        try {
+            configMoved = migrateUserConfig();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: config move failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            logsMoved = migrateLogs();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: logs migration failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            locksRemoved = removeStaleFlatLocks();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock scan failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    finally {
+        try {
+            release();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: lock release failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    logger.log('Storage layout migration complete', {
+        configMoved,
+        logsMoved,
+        locksRemoved
+    });
+}
+export function migrateSafeFilesIfNeeded() {
+    try {
+        runMigration();
+    }
+    catch (error) {
+        logger.warn('Storage layout migration failed non-fatally', error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/plugin.js

@@ -7,6 +7,7 @@ import { AccountRepository } from './infrastructure/database/account-repository.
 import { AccountManager } from './plugin/accounts.js';
 import { bootstrapAuthIfNeeded } from './plugin/auth-bootstrap.js';
 import { loadConfig } from './plugin/config/index.js';
+import { migrateSafeFilesIfNeeded } from './plugin/storage/migrate-layout.js';
 const KIRO_PROVIDER_ID = 'kiro-auth';
 let activeKeepAliveController = null;
 let keepAliveTeardownRegistered = false;
@@ -34,6 +35,12 @@ export function __getActiveKeepAliveControllerForTest() {
     return activeKeepAliveController;
 }
 export const createKiroPlugin = (id) => async ({ client, directory }) => {
+    try {
+        migrateSafeFilesIfNeeded();
+    }
+    catch (error) {
+        console.warn('Kiro storage layout migration failed non-fatally:', error instanceof Error ? error.message : String(error));
+    }
     const config = loadConfig(directory);
     const showToast = (message, variant) => {
         client.tui.showToast({ body: { message, variant } }).catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",