@sunerpy/opencode-kiro-auth 0.9.0 → 0.11.0

package/README.md

@@ -85,7 +85,7 @@ customize which models are exposed (including thinking variants), see
    - Note: the TUI `/connect` flow does **not** currently run plugin OAuth
      prompts (Start URL / region), so Identity Center logins may fall back to
      Builder ID unless you use `opencode auth login` (or preconfigure
-     defaults in `~/.config/opencode/kiro.json`).
+     defaults in `~/.config/opencode/kiro-auth-plugin/kiro.json`).
    - For **IAM Identity Center**, you may also need a **profile ARN**
      (`profileArn`) — auto-detected from `kiro-cli profile` if available, or
      set `idc_profile_arn` manually.
@@ -97,7 +97,7 @@ customize which models are exposed (including thinking variants), see
 ## Configuration
 
 Plugin-wide behavior (auth sync, account selection, retry limits, effort
-mapping) lives in `~/.config/opencode/kiro.json`. See
+mapping) lives in `~/.config/opencode/kiro-auth-plugin/kiro.json`. See
 [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every
 option.
 
@@ -112,6 +112,11 @@ Paid-overage protection is on by default; see
 [Overage protection](docs/CONFIGURATION.md#overage-protection) before disabling
 `stop_on_overage`.
 
+Running multiple OpenCode processes at once? `distribute_across_processes`
+(default `true`) and `per_request_spread` (default `false`) control how load
+spreads across accounts — see
+[Account distribution across processes](docs/CONFIGURATION.md#account-distribution-across-processes).
+
 ## Multiple accounts & rotation
 
 You can register more than one Kiro account and let the plugin spread
@@ -131,13 +136,13 @@ requests across them for combined quota and automatic failover.
    account (option 1) is the supported multi-account path.
 
 **Rotation strategy** — set `account_selection_strategy` in
-`~/.config/opencode/kiro.json`:
+`~/.config/opencode/kiro-auth-plugin/kiro.json`:
 
-| Strategy       | Behavior                                                            | Default |
-| -------------- | -------------------------------------------------------------------- | ------- |
-| `lowest-usage` | Each request picks the healthy account with the lowest used quota    | ✅      |
-| `round-robin`  | Cycles through accounts in order                                     |         |
-| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |       |
+| Strategy       | Behavior                                                               | Default |
+| -------------- | ---------------------------------------------------------------------- | ------- |
+| `lowest-usage` | Each request picks the healthy account with the lowest used quota      | ✅      |
+| `round-robin`  | Cycles through accounts in order                                       |         |
+| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |         |
 
 **Automatic failover** requires no configuration: a rate-limited or 403
 account is marked unhealthy and the next healthy account takes over. If every
@@ -165,7 +170,7 @@ per account, e.g. `929/10000`) and surfaces it in three places:
 
 1. **Auth menu label** — running `opencode auth login` and selecting
    `kiro-auth` shows `[current: <email> <used>/<limit> (<pct>%)]` on the
-   first login method; with multiple accounts they're joined with ` · `,
+   first login method; with multiple accounts they're joined with `·`,
    capped at 3 with a `+N more` suffix.
 2. **Startup toast** — once per plugin init, a toast shows
    `Kiro usage (<email>): <used>/<limit> (<pct>%)` a few seconds after
@@ -191,11 +196,11 @@ your `provider.kiro-auth.models` block.
 Thinking budgets map to Kiro's native `effort` field automatically:
 
 | OpenCode budget | Kiro effort |
-| ---------------- | ----------- |
-| `<= 10000`        | `low`       |
-| `<= 20000`        | `medium`    |
-| `<= 28000`        | `high`      |
-| `> 28000`         | `max`       |
+| --------------- | ----------- |
+| `<= 10000`      | `low`       |
+| `<= 20000`      | `medium`    |
+| `<= 28000`      | `high`      |
+| `> 28000`       | `max`       |
 
 Details and the full JSON example: [docs/MODELS.md](docs/MODELS.md).
 
@@ -283,12 +288,21 @@ Releases are automated with
 **Linux/macOS:**
 
 - SQLite database: `~/.config/opencode/kiro.db`
-- Plugin config: `~/.config/opencode/kiro.json`
+- Plugin config: `~/.config/opencode/kiro-auth-plugin/kiro.json`
+- Logs: `~/.config/opencode/kiro-auth-plugin/logs/`
+- Refresh and keep-alive locks: `~/.config/opencode/kiro-auth-plugin/`
 
 **Windows:**
 
 - SQLite database: `%APPDATA%\opencode\kiro.db`
-- Plugin config: `%APPDATA%\opencode\kiro.json`
+- Plugin config: `%APPDATA%\opencode\kiro-auth-plugin\kiro.json`
+- Logs: `%APPDATA%\opencode\kiro-auth-plugin\logs\`
+- Refresh and keep-alive locks: `%APPDATA%\opencode\kiro-auth-plugin\`
+
+Existing config, logs, and stale flat lock files are migrated automatically on
+first startup; no action is needed. The SQLite database deliberately remains at
+the flat `opencode/kiro.db` path because moving a live database during an upgrade
+is unsafe.
 
 ## Acknowledgements
 

package/dist/core/account/account-selector.js

@@ -27,7 +27,7 @@ export class AccountSelector {
         if (!acc) {
             this.circuitBreakerTrips++;
             if (this.accountManager.allSelectableBlockedByOverage()) {
-                throw new Error('All accounts have exceeded their free quota and entered paid overage. Set "stop_on_overage": false in ~/.config/opencode/kiro.json to continue with paid overage, or wait for the quota to reset.');
+                throw new Error('All accounts have exceeded their free quota and entered paid overage. Set "stop_on_overage": false in ~/.config/opencode/kiro-auth-plugin/kiro.json to continue with paid overage, or wait for the quota to reset.');
             }
             const wait = this.accountManager.getMinWaitTime();
             if (wait > 0 && wait < 30000) {

package/dist/core/auth/idc-auth-method.js

@@ -106,7 +106,7 @@ export class IdcAuthMethod {
                             error: e instanceof Error ? e.message : String(e)
                         });
                         if (startUrl && !profileArn) {
-                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
+                            throw new Error(`Missing profile ARN for IAM Identity Center. Set "idc_profile_arn" in ~/.config/opencode/kiro-auth-plugin/kiro.json, or run "kiro-cli profile" once so it can be auto-detected. Original error: ${e instanceof Error ? e.message : String(e)}`);
                         }
                         const errMsg = e instanceof Error ? e.message : String(e);
                         if (errMsg.includes('FEATURE_NOT_SUPPORTED')) {
@@ -176,7 +176,7 @@ export class IdcAuthMethod {
                 catch (e) {
                     const err = e instanceof Error ? e : new Error(String(e));
                     logger.error('IDC auth callback failed', err);
-                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
+                    throw new Error(`IDC authorization failed: ${err.message}. Check ~/.config/opencode/kiro-auth-plugin/logs/plugin.log for details. If this is an Identity Center account, ensure you have selected an AWS Q Developer/CodeWhisperer profile (try: kiro-cli profile).`);
                 }
             }
         };

package/dist/plugin/accounts.d.ts

@@ -8,6 +8,8 @@ export declare class AccountManager {
     private lastUsageToastTime;
     private rrCursor;
     private stickyId?;
+    private startIndex;
+    private perRequestSpread;
     private quotaAvoidanceEnabled;
     private quotaReserveThreshold;
     private stopOnOverage;
@@ -17,12 +19,16 @@ export declare class AccountManager {
         quotaReserveThreshold?: number;
         stopOnOverage?: boolean;
         overageThreshold?: number;
+        startIndex?: number;
+        perRequestSpread?: boolean;
     });
     static loadFromDisk(strategy?: AccountSelectionStrategy, opts?: {
         quotaAvoidanceEnabled?: boolean;
         quotaReserveThreshold?: number;
         stopOnOverage?: boolean;
         overageThreshold?: number;
+        distributeAcrossProcesses?: boolean;
+        perRequestSpread?: boolean;
     }): Promise<AccountManager>;
     getAccountCount(): number;
     getAccounts(): ManagedAccount[];

package/dist/plugin/accounts.js

@@ -15,8 +15,10 @@ export class AccountManager {
     strategy;
     lastToastTime = 0;
     lastUsageToastTime = 0;
-    rrCursor = 0;
+    rrCursor;
     stickyId;
+    startIndex;
+    perRequestSpread;
     quotaAvoidanceEnabled;
     quotaReserveThreshold;
     stopOnOverage;
@@ -29,6 +31,9 @@ export class AccountManager {
         this.quotaReserveThreshold = opts?.quotaReserveThreshold ?? 0.95;
         this.stopOnOverage = opts?.stopOnOverage ?? true;
         this.overageThreshold = opts?.overageThreshold ?? 0;
+        this.startIndex = opts?.startIndex ?? 0;
+        this.perRequestSpread = opts?.perRequestSpread ?? false;
+        this.rrCursor = this.startIndex;
     }
     static async loadFromDisk(strategy, opts) {
         const rows = kiroDb.getAccounts();
@@ -56,7 +61,23 @@ export class AccountManager {
             overageCount: r.overage_count || 0,
             lastSync: r.last_sync
         }));
-        return new AccountManager(accounts, strategy || 'sticky', opts);
+        let startIndex = 0;
+        if (opts?.distributeAcrossProcesses !== false) {
+            try {
+                startIndex = await kiroDb.nextAssignmentIndex();
+            }
+            catch (error) {
+                logger.warn('assignment index failed, using 0', {
+                    error: error instanceof Error ? error.message : String(error)
+                });
+                startIndex = 0;
+            }
+        }
+        return new AccountManager(accounts, strategy || 'sticky', {
+            ...opts,
+            startIndex,
+            perRequestSpread: opts?.perRequestSpread
+        });
     }
     getAccountCount() {
         return this.accounts.length;
@@ -140,10 +161,26 @@ export class AccountManager {
             const nearFull = available.filter((a) => ratio(a) >= this.quotaReserveThreshold);
             candidatePool = ample.length > 0 ? ample : nearFull;
         }
+        const sorted = [...this.accounts].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        const N = sorted.length;
         let selected;
         if (candidatePool.length > 0) {
-            if (this.strategy === 'sticky') {
-                selected = candidatePool.find((a) => a.id === this.stickyId) || candidatePool[0];
+            if (this.perRequestSpread) {
+                selected = [...candidatePool].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            }
+            else if (this.strategy === 'sticky') {
+                if (this.stickyId) {
+                    selected = candidatePool.find((a) => a.id === this.stickyId);
+                }
+                if (!selected) {
+                    for (let k = 0; k < N; k++) {
+                        const candidate = sorted[(this.startIndex + k) % N];
+                        if (candidate && candidatePool.some((account) => account.id === candidate.id)) {
+                            selected = candidate;
+                            break;
+                        }
+                    }
+                }
                 if (selected)
                     this.stickyId = selected.id;
             }
@@ -151,8 +188,21 @@ export class AccountManager {
                 selected = candidatePool[this.rrCursor % candidatePool.length];
                 this.rrCursor++;
             }
-            else if (this.strategy === 'lowest-usage') {
-                selected = [...candidatePool].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            else {
+                const sortedIndexById = new Map(sorted.map((account, index) => [account.id, index]));
+                selected = [...candidatePool].sort((a, b) => {
+                    const usageDifference = (a.usedCount || 0) - (b.usedCount || 0);
+                    if (usageDifference !== 0)
+                        return usageDifference;
+                    const lastUsedDifference = (a.lastUsed || 0) - (b.lastUsed || 0);
+                    if (lastUsedDifference !== 0)
+                        return lastUsedDifference;
+                    const aIndex = sortedIndexById.get(a.id) ?? 0;
+                    const bIndex = sortedIndexById.get(b.id) ?? 0;
+                    const aOffset = (((aIndex - this.startIndex) % N) + N) % N;
+                    const bOffset = (((bIndex - this.startIndex) % N) + N) % N;
+                    return aOffset - bOffset;
+                })[0];
             }
         }
         if (!selected) {

package/dist/plugin/config/loader.d.ts

@@ -1,5 +1,5 @@
 import { type KiroConfig } from './schema.js';
-export declare function getUserConfigPath(): string;
+export { getUserConfigPath } from '../paths.js';
 export declare function getProjectConfigPath(directory: string): string;
 export declare function loadConfig(directory: string): KiroConfig;
 export declare function configExists(path: string): boolean;

package/dist/plugin/config/loader.js

@@ -1,19 +1,9 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import * as logger from '../logger.js';
+import { getLegacyUserConfigPath, getLogsDir, getUserConfigPath } from '../paths.js';
 import { AccountSelectionStrategySchema, DEFAULT_CONFIG, KiroConfigSchema, RegionSchema } from './schema.js';
-function getConfigDir() {
-    const platform = process.platform;
-    if (platform === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
-    return join(xdgConfig, 'opencode');
-}
-export function getUserConfigPath() {
-    return join(getConfigDir(), 'kiro.json');
-}
+export { getUserConfigPath } from '../paths.js';
 function ensureUserConfigTemplate() {
     const path = getUserConfigPath();
     if (!existsSync(path)) {
@@ -155,11 +145,16 @@ function applyEnvOverrides(config) {
     };
 }
 export function loadConfig(directory) {
-    ensureUserConfigTemplate();
-    backfillUserConfig(getUserConfigPath());
-    let config = { ...DEFAULT_CONFIG };
     const userConfigPath = getUserConfigPath();
-    const userConfig = loadConfigFile(userConfigPath);
+    const legacyUserConfigPath = getLegacyUserConfigPath();
+    const configSourcePath = !existsSync(userConfigPath) && existsSync(legacyUserConfigPath)
+        ? legacyUserConfigPath
+        : userConfigPath;
+    if (configSourcePath === userConfigPath)
+        ensureUserConfigTemplate();
+    backfillUserConfig(configSourcePath);
+    let config = { ...DEFAULT_CONFIG };
+    const userConfig = loadConfigFile(configSourcePath);
     if (userConfig) {
         config = mergeConfigs(config, userConfig);
     }
@@ -175,5 +170,5 @@ export function configExists(path) {
     return existsSync(path);
 }
 export function getDefaultLogsDir() {
-    return join(getConfigDir(), 'kiro-logs');
+    return getLogsDir();
 }

package/dist/plugin/config/schema.d.ts

@@ -19,6 +19,16 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region: z.ZodOptional<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     idc_profile_arn: z.ZodOptional<z.ZodString>;
     account_selection_strategy: z.ZodDefault<z.ZodEnum<["sticky", "round-robin", "lowest-usage"]>>;
+    /**
+     * Give each process a distinct start index so simultaneous starts spread
+     * across accounts.
+     */
+    distribute_across_processes: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Re-pick the lowest-usage account for every request instead of pinning one.
+     * Overrides sticky selection.
+     */
+    per_request_spread: z.ZodDefault<z.ZodBoolean>;
     /**
      * Softly avoid accounts whose usage ratio is at/above
      * `quota_reserve_threshold` when other accounts still have room. When ALL
@@ -84,6 +94,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     auto_effort_mapping: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     account_selection_strategy: "sticky" | "round-robin" | "lowest-usage";
+    distribute_across_processes: boolean;
+    per_request_spread: boolean;
     quota_avoidance_enabled: boolean;
     quota_reserve_threshold: number;
     stop_on_overage: boolean;
@@ -115,6 +127,8 @@ export declare const KiroConfigSchema: z.ZodObject<{
     idc_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     idc_profile_arn?: string | undefined;
     account_selection_strategy?: "sticky" | "round-robin" | "lowest-usage" | undefined;
+    distribute_across_processes?: boolean | undefined;
+    per_request_spread?: boolean | undefined;
     quota_avoidance_enabled?: boolean | undefined;
     quota_reserve_threshold?: number | undefined;
     stop_on_overage?: boolean | undefined;

package/dist/plugin/config/schema.js

@@ -51,6 +51,16 @@ export const KiroConfigSchema = z.object({
     idc_region: RegionSchema.optional(),
     idc_profile_arn: z.string().optional(),
     account_selection_strategy: AccountSelectionStrategySchema.default('lowest-usage'),
+    /**
+     * Give each process a distinct start index so simultaneous starts spread
+     * across accounts.
+     */
+    distribute_across_processes: z.boolean().default(true),
+    /**
+     * Re-pick the lowest-usage account for every request instead of pinning one.
+     * Overrides sticky selection.
+     */
+    per_request_spread: z.boolean().default(false),
     /**
      * Softly avoid accounts whose usage ratio is at/above
      * `quota_reserve_threshold` when other accounts still have room. When ALL
@@ -117,6 +127,8 @@ export const KiroConfigSchema = z.object({
 });
 export const DEFAULT_CONFIG = {
     account_selection_strategy: 'lowest-usage',
+    distribute_across_processes: true,
+    per_request_spread: false,
     quota_avoidance_enabled: true,
     quota_reserve_threshold: 0.95,
     stop_on_overage: true,

package/dist/plugin/logger.js

@@ -1,22 +1,15 @@
 import { Buffer } from 'node:buffer';
 import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { getLogsDir } from './paths.js';
 const binaryToBase64Replacer = (_key, value) => {
     if (value instanceof Uint8Array)
         return Buffer.from(value).toString('base64');
     return value;
 };
-const getLogDir = () => {
-    const platform = process.platform;
-    const base = platform === 'win32'
-        ? join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode')
-        : join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-    return join(base, 'kiro-logs');
-};
 const writeToFile = (level, message, ...args) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const path = join(dir, 'plugin.log');
         const timestamp = new Date().toISOString();
@@ -42,7 +35,7 @@ const writeToFile = (level, message, ...args) => {
 };
 const writeApiLog = (type, data, timestamp, isError = false) => {
     try {
-        const dir = getLogDir();
+        const dir = getLogsDir();
         mkdirSync(dir, { recursive: true });
         const prefix = isError ? 'error_' : '';
         const filename = `${prefix}${timestamp}_${type}.json`;

package/dist/plugin/paths.d.ts

@@ -0,0 +1,9 @@
+export declare function getOpencodeConfigDir(): string;
+export declare function getPluginDir(): string;
+export declare function getUserConfigPath(): string;
+export declare function getLegacyUserConfigPath(): string;
+export declare function getLogsDir(): string;
+export declare function getLegacyLogsDir(): string;
+export declare function getRefreshLockPath(accountId: string): string;
+export declare function getKeepAliveLockPath(): string;
+export declare function getMigrationLockPath(): string;

package/dist/plugin/paths.js

@@ -0,0 +1,33 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export function getOpencodeConfigDir() {
+    const p = process.platform;
+    if (p === 'win32')
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export function getPluginDir() {
+    return join(getOpencodeConfigDir(), 'kiro-auth-plugin');
+}
+export function getUserConfigPath() {
+    return join(getPluginDir(), 'kiro.json');
+}
+export function getLegacyUserConfigPath() {
+    return join(getOpencodeConfigDir(), 'kiro.json');
+}
+export function getLogsDir() {
+    return join(getPluginDir(), 'logs');
+}
+export function getLegacyLogsDir() {
+    return join(getOpencodeConfigDir(), 'kiro-logs');
+}
+export function getRefreshLockPath(accountId) {
+    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
+    return join(getPluginDir(), `.kiro-refresh-${safeAccountId}.lock`);
+}
+export function getKeepAliveLockPath() {
+    return join(getPluginDir(), '.kiro-keepalive.lock');
+}
+export function getMigrationLockPath() {
+    return join(getOpencodeConfigDir(), '.kiro-auth-migration.lock');
+}

package/dist/plugin/storage/locked-operations.d.ts

@@ -1,7 +1,7 @@
 import type { ManagedAccount } from '../types.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 type LockRelease = () => Promise<void>;
-export declare function getRefreshLockPath(accountId: string): string;
-export declare function getKeepAliveLockPath(): string;
+export declare function withDatabaseLockSync<T>(dbPath: string, fn: () => T): T;
 export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
 export declare function tryAcquireKeepAliveLock(): Promise<LockRelease | null>;
@@ -9,4 +9,3 @@ export declare function withKeepAliveLock<T>(fn: () => Promise<T>): Promise<T |
 export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
 export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
 export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];
-export {};

package/dist/plugin/storage/locked-operations.js

@@ -1,9 +1,10 @@
 import { createHash } from 'node:crypto';
-import { existsSync, promises as fs } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { existsSync, promises as fs, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { isPermanentError } from '../health.js';
+import { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
+export { getKeepAliveLockPath, getRefreshLockPath } from '../paths.js';
 const LOCK_OPTIONS = {
     stale: 10000,
     retries: {
@@ -29,22 +30,46 @@ const KEEP_ALIVE_LOCK_OPTIONS = {
     retries: 0,
     realpath: false
 };
-function getBaseDir() {
-    // Keep this local instead of importing DB_PATH from sqlite.ts: sqlite.ts imports
-    // this module and also constructs `kiroDb` at module load, so importing it here
-    // would create a cycle and trigger database construction just to compute a lock path.
-    const p = process.platform;
-    if (p === 'win32') {
-        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
-    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+const SYNC_LOCK_OPTIONS = { stale: 10000, retries: 0, realpath: false };
+const SYNC_LOCK_DEADLINE_MS = 10000;
+function blockingBackoff(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-export function getRefreshLockPath(accountId) {
-    const safeAccountId = accountId.replace(/[^A-Za-z0-9_-]/g, '');
-    return join(getBaseDir(), `.kiro-refresh-${safeAccountId}.lock`);
+function isLockContention(e) {
+    return typeof e === 'object' && e !== null && 'code' in e && e.code === 'ELOCKED';
 }
-export function getKeepAliveLockPath() {
-    return join(getBaseDir(), '.kiro-keepalive.lock');
+export function withDatabaseLockSync(dbPath, fn) {
+    if (!existsSync(dbPath)) {
+        mkdirSync(dirname(dbPath), { recursive: true });
+        writeFileSync(dbPath, '');
+    }
+    // proper-lockfile's sync API rejects a retries object, so bounded lock-acquisition backoff is
+    // done here to serialize the synchronous constructor/init (schema + migrations) across processes.
+    const deadline = Date.now() + SYNC_LOCK_DEADLINE_MS;
+    let release = null;
+    let attempt = 0;
+    for (;;) {
+        try {
+            release = lockfile.lockSync(dbPath, SYNC_LOCK_OPTIONS);
+            break;
+        }
+        catch (e) {
+            if (!isLockContention(e) || Date.now() >= deadline)
+                throw e;
+            blockingBackoff(Math.min(100 * 2 ** attempt++, 500));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        try {
+            release();
+        }
+        catch (e) {
+            console.warn('Failed to release lock:', e);
+        }
+    }
 }
 export async function withDatabaseLock(dbPath, fn) {
     if (!existsSync(dbPath)) {

package/dist/plugin/storage/migrate-layout.d.ts

@@ -0,0 +1 @@
+export declare function migrateSafeFilesIfNeeded(): void;

package/dist/plugin/storage/migrate-layout.js

@@ -0,0 +1,191 @@
+import { closeSync, copyFileSync, existsSync, mkdirSync, openSync, readdirSync, renameSync, rmdirSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import lockfile from 'proper-lockfile';
+import * as logger from '../logger.js';
+import { getLegacyLogsDir, getLegacyUserConfigPath, getLogsDir, getMigrationLockPath, getOpencodeConfigDir, getPluginDir, getUserConfigPath } from '../paths.js';
+const MIGRATION_LOCK_OPTIONS = {
+    stale: 15000,
+    retries: 0,
+    realpath: false
+};
+const MIGRATION_LOCK_ATTEMPTS = 4;
+function isCrossDeviceError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'EXDEV';
+}
+function removeTemporaryFile(path) {
+    if (!existsSync(path))
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: temporary file cleanup failed', {
+            path,
+            error: error instanceof Error ? error.message : String(error)
+        });
+    }
+}
+function moveFile(source, destination) {
+    try {
+        renameSync(source, destination);
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !isCrossDeviceError(error))
+            throw error;
+    }
+    const temporaryDestination = `${destination}.tmp-${process.pid}`;
+    try {
+        copyFileSync(source, temporaryDestination);
+        renameSync(temporaryDestination, destination);
+        unlinkSync(source);
+    }
+    catch (error) {
+        removeTemporaryFile(temporaryDestination);
+        throw error;
+    }
+}
+function migrateUserConfig() {
+    const legacyPath = getLegacyUserConfigPath();
+    const destinationPath = getUserConfigPath();
+    if (!existsSync(legacyPath) || existsSync(destinationPath))
+        return false;
+    moveFile(legacyPath, destinationPath);
+    return true;
+}
+function migrateLogs() {
+    const legacyDir = getLegacyLogsDir();
+    if (!existsSync(legacyDir))
+        return 0;
+    const destinationDir = getLogsDir();
+    mkdirSync(destinationDir, { recursive: true });
+    let moved = 0;
+    for (const entry of readdirSync(legacyDir)) {
+        const source = join(legacyDir, entry);
+        const destination = join(destinationDir, entry);
+        if (existsSync(destination))
+            continue;
+        try {
+            moveFile(source, destination);
+            moved++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: log file move failed', {
+                source,
+                destination,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    if (readdirSync(legacyDir).length === 0) {
+        try {
+            rmdirSync(legacyDir);
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: legacy log directory cleanup failed', {
+                path: legacyDir,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return moved;
+}
+function removeStaleFlatLocks() {
+    const configDir = getOpencodeConfigDir();
+    let removed = 0;
+    for (const entry of readdirSync(configDir)) {
+        const isKeepAliveLock = entry === '.kiro-keepalive.lock';
+        const isRefreshLock = /^\.kiro-refresh-.*\.lock$/.test(entry);
+        if (!isKeepAliveLock && !isRefreshLock)
+            continue;
+        const path = join(configDir, entry);
+        try {
+            unlinkSync(path);
+            removed++;
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock cleanup failed', {
+                path,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return removed;
+}
+function acquireMigrationLock(path) {
+    let lastError;
+    for (let attempt = 0; attempt < MIGRATION_LOCK_ATTEMPTS; attempt++) {
+        try {
+            return lockfile.lockSync(path, MIGRATION_LOCK_OPTIONS);
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    logger.warn('Storage layout migration: lock acquisition skipped', lastError);
+    return null;
+}
+function runMigration() {
+    try {
+        mkdirSync(getPluginDir(), { recursive: true });
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: plugin directory creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const migrationLockPath = getMigrationLockPath();
+    try {
+        closeSync(openSync(migrationLockPath, 'a'));
+    }
+    catch (error) {
+        logger.warn('Storage layout migration: lock file creation failed', error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const release = acquireMigrationLock(migrationLockPath);
+    if (!release)
+        return;
+    let configMoved = false;
+    let logsMoved = 0;
+    let locksRemoved = 0;
+    try {
+        try {
+            configMoved = migrateUserConfig();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: config move failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            logsMoved = migrateLogs();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: logs migration failed', error instanceof Error ? error.message : String(error));
+        }
+        try {
+            locksRemoved = removeStaleFlatLocks();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: stale lock scan failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    finally {
+        try {
+            release();
+        }
+        catch (error) {
+            logger.warn('Storage layout migration: lock release failed', error instanceof Error ? error.message : String(error));
+        }
+    }
+    logger.log('Storage layout migration complete', {
+        configMoved,
+        logsMoved,
+        locksRemoved
+    });
+}
+export function migrateSafeFilesIfNeeded() {
+    try {
+        runMigration();
+    }
+    catch (error) {
+        logger.warn('Storage layout migration failed non-fatally', error instanceof Error ? error.message : String(error));
+    }
+}

package/dist/plugin/storage/migrations.js

@@ -7,15 +7,22 @@ export function runMigrations(db) {
     migrateDropRefreshTokenUniqueIndex(db);
     migrateRemovedAccountsTable(db);
     migrateOverageColumn(db);
+    migratePluginMetaTable(db);
 }
 function migrateToUniqueRefreshToken(db) {
-    const hasIndex = db
-        .prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'")
-        .get();
-    if (hasIndex)
+    const indexProbe = db.prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'");
+    if (indexProbe.get())
         return;
-    db.exec('BEGIN TRANSACTION');
+    // BEGIN IMMEDIATE (not deferred BEGIN): a deferred read-then-write txn raises unrecoverable
+    // SQLITE_BUSY_SNAPSHOT (busy_timeout cannot retry it) if another connection writes after the
+    // read snapshot. Taking the write lock at BEGIN makes concurrent processes serialize via
+    // busy_timeout instead of racing into a snapshot conflict.
+    db.exec('BEGIN IMMEDIATE');
     try {
+        if (indexProbe.get()) {
+            db.exec('COMMIT');
+            return;
+        }
         const duplicates = db
             .prepare(`
         SELECT refresh_token, COUNT(*) as count 
@@ -167,3 +174,6 @@ function migrateOverageColumn(db) {
         db.exec('ALTER TABLE accounts ADD COLUMN overage_count INTEGER DEFAULT 0');
     }
 }
+function migratePluginMetaTable(db) {
+    db.exec('CREATE TABLE IF NOT EXISTS plugin_meta (key TEXT PRIMARY KEY, value INTEGER NOT NULL)');
+}

package/dist/plugin/storage/sqlite.d.ts

@@ -18,6 +18,7 @@ export declare class KiroDatabase {
     isAccountRemoved(id: string): Promise<boolean>;
     clearRemovedAccount(id: string): Promise<void>;
     listRemovedAccounts(): Promise<string[]>;
+    nextAssignmentIndex(): Promise<number>;
     markAccountsUnhealthy(ids: string[], reason: string): Promise<void>;
     private rowToAccount;
     close(): void;

package/dist/plugin/storage/sqlite.js

@@ -2,7 +2,7 @@ import Database from 'libsql';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { deduplicateAccounts, mergeAccounts, withDatabaseLock } from './locked-operations.js';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLock, withDatabaseLockSync } from './locked-operations.js';
 import { runMigrations } from './migrations.js';
 function getBaseDir() {
     const p = process.platform;
@@ -21,7 +21,7 @@ export class KiroDatabase {
             mkdirSync(dir, { recursive: true });
         this.db = new Database(path);
         this.db.pragma('busy_timeout = 5000');
-        this.init();
+        withDatabaseLockSync(this.path, () => this.init());
     }
     init() {
         this.db.pragma('journal_mode = WAL');
@@ -185,6 +185,14 @@ export class KiroDatabase {
     async listRemovedAccounts() {
         return this.db.prepare('SELECT id FROM removed_accounts').all().map((r) => r.id);
     }
+    async nextAssignmentIndex() {
+        return withDatabaseLock(this.path, async () => {
+            const row = this.db
+                .prepare("INSERT INTO plugin_meta(key,value) VALUES('assignment_cursor',0) ON CONFLICT(key) DO UPDATE SET value=value+1 RETURNING value")
+                .get();
+            return row?.value ?? 0;
+        });
+    }
     async markAccountsUnhealthy(ids, reason) {
         if (ids.length === 0)
             return;

package/dist/plugin.js

@@ -7,6 +7,7 @@ import { AccountRepository } from './infrastructure/database/account-repository.
 import { AccountManager } from './plugin/accounts.js';
 import { bootstrapAuthIfNeeded } from './plugin/auth-bootstrap.js';
 import { loadConfig } from './plugin/config/index.js';
+import { migrateSafeFilesIfNeeded } from './plugin/storage/migrate-layout.js';
 const KIRO_PROVIDER_ID = 'kiro-auth';
 let activeKeepAliveController = null;
 let keepAliveTeardownRegistered = false;
@@ -34,6 +35,12 @@ export function __getActiveKeepAliveControllerForTest() {
     return activeKeepAliveController;
 }
 export const createKiroPlugin = (id) => async ({ client, directory }) => {
+    try {
+        migrateSafeFilesIfNeeded();
+    }
+    catch (error) {
+        console.warn('Kiro storage layout migration failed non-fatally:', error instanceof Error ? error.message : String(error));
+    }
     const config = loadConfig(directory);
     const showToast = (message, variant) => {
         client.tui.showToast({ body: { message, variant } }).catch(() => { });
@@ -45,7 +52,9 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
         quotaAvoidanceEnabled: config.quota_avoidance_enabled,
         quotaReserveThreshold: config.quota_reserve_threshold,
         stopOnOverage: config.stop_on_overage,
-        overageThreshold: config.overage_threshold
+        overageThreshold: config.overage_threshold,
+        distributeAcrossProcesses: config.distribute_across_processes,
+        perRequestSpread: config.per_request_spread
     });
     authHandler.setAccountManager(accountManager);
     const requestHandler = new RequestHandler(accountManager, config, repository, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunerpy/opencode-kiro-auth",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",