@zhafron/opencode-kiro-auth 1.0.0

package/dist/src/plugin/types.d.ts

@@ -0,0 +1,144 @@
+export type KiroAuthMethod = 'social' | 'idc';
+export type KiroRegion = 'us-east-1' | 'us-west-2';
+export interface KiroAuthDetails {
+    refresh: string;
+    access: string;
+    expires: number;
+    authMethod: KiroAuthMethod;
+    region: KiroRegion;
+    profileArn?: string;
+    clientId?: string;
+    clientSecret?: string;
+    email?: string;
+}
+export interface RefreshParts {
+    refreshToken: string;
+    profileArn?: string;
+    clientId?: string;
+    clientSecret?: string;
+    authMethod?: KiroAuthMethod;
+}
+export interface ManagedAccount {
+    id: string;
+    email: string;
+    authMethod: KiroAuthMethod;
+    region: KiroRegion;
+    profileArn?: string;
+    clientId?: string;
+    clientSecret?: string;
+    refreshToken: string;
+    accessToken: string;
+    expiresAt: number;
+    rateLimitResetTime: number;
+    isHealthy: boolean;
+    unhealthyReason?: string;
+    recoveryTime?: number;
+    usedCount?: number;
+    limitCount?: number;
+    lastUsed?: number;
+}
+export interface AccountMetadata {
+    id: string;
+    email: string;
+    authMethod: KiroAuthMethod;
+    region: KiroRegion;
+    profileArn?: string;
+    clientId?: string;
+    clientSecret?: string;
+    refreshToken: string;
+    accessToken: string;
+    expiresAt: number;
+    rateLimitResetTime: number;
+    isHealthy: boolean;
+    unhealthyReason?: string;
+    recoveryTime?: number;
+    usedCount?: number;
+    limitCount?: number;
+}
+export interface AccountStorage {
+    version: 1;
+    accounts: AccountMetadata[];
+    activeIndex: number;
+}
+export interface CodeWhispererMessage {
+    userInputMessage?: {
+        content: string;
+        modelId: string;
+        origin: string;
+        images?: Array<{
+            format: string;
+            source: {
+                bytes: string;
+            };
+        }>;
+        userInputMessageContext?: {
+            toolResults?: Array<{
+                toolUseId: string;
+                content: Array<{
+                    text?: string;
+                    image?: {
+                        format: string;
+                        source: {
+                            bytes: string;
+                        };
+                    };
+                }>;
+                status?: string;
+            }>;
+            tools?: Array<{
+                toolSpecification: {
+                    name: string;
+                    description: string;
+                    inputSchema: {
+                        json: Record<string, unknown>;
+                    };
+                };
+            }>;
+        };
+    };
+    assistantResponseMessage?: {
+        content: string;
+    };
+}
+export interface CodeWhispererRequest {
+    conversationState: {
+        chatTriggerType: string;
+        conversationId: string;
+        history: CodeWhispererMessage[];
+        currentMessage: CodeWhispererMessage;
+    };
+    profileArn?: string;
+}
+export interface ToolCall {
+    toolUseId: string;
+    name: string;
+    input: string | Record<string, unknown>;
+}
+export interface ParsedResponse {
+    content: string;
+    toolCalls: ToolCall[];
+    stopReason?: string;
+    inputTokens?: number;
+    outputTokens?: number;
+}
+export interface UsageLimits {
+    usedCount: number;
+    limitCount: number;
+    contextUsagePercentage?: number;
+}
+export interface PreparedRequest {
+    url: string;
+    init: RequestInit;
+    streaming: boolean;
+    effectiveModel: string;
+    conversationId: string;
+}
+export type AccountSelectionStrategy = 'sticky' | 'round-robin';
+export interface StreamEvent {
+    type: string;
+    message?: any;
+    content_block?: any;
+    delta?: any;
+    index?: number;
+    usage?: any;
+}

package/dist/src/plugin/usage.d.ts

@@ -0,0 +1,28 @@
+import { KiroAuthDetails, UsageLimits, ParsedResponse } from './types';
+export declare function fetchUsageLimits(auth: KiroAuthDetails): Promise<UsageLimits>;
+export declare function calculateRecoveryTime(): number;
+export declare function isQuotaExhausted(usage: UsageLimits): boolean;
+export declare function formatUsageDisplay(usage: UsageLimits): string;
+export declare function calculateUsagePercentage(usage: UsageLimits): number;
+export declare function getRemainingCount(usage: UsageLimits): number;
+export declare function extractUsageFromResponse(response: ParsedResponse): {
+    inputTokens: number;
+    outputTokens: number;
+} | null;
+export declare function shouldRefreshUsage(lastFetchTime: number | undefined, intervalMs?: number): boolean;
+export declare function isUsageWarningThreshold(usage: UsageLimits, thresholdPercent?: number): boolean;
+export declare function getUsageStatus(usage: UsageLimits): 'healthy' | 'warning' | 'exhausted';
+export declare function formatRecoveryTime(recoveryTimeMs: number): string;
+export declare function getTimeUntilRecovery(recoveryTimeMs: number): number;
+export declare function formatTimeUntilRecovery(recoveryTimeMs: number): string;
+export interface UsageMetrics {
+    usage: UsageLimits;
+    status: 'healthy' | 'warning' | 'exhausted';
+    percentage: number;
+    remaining: number;
+    recoveryTime?: number;
+    timeUntilRecovery?: number;
+    formattedDisplay: string;
+}
+export declare function buildUsageMetrics(usage: UsageLimits, recoveryTime?: number): UsageMetrics;
+export declare function fetchAndBuildUsageMetrics(auth: KiroAuthDetails): Promise<UsageMetrics>;

package/dist/src/plugin/usage.js

@@ -0,0 +1,159 @@
+const USAGE_LIMITS_ENDPOINT = 'https://q.{{region}}.amazonaws.com/getUsageLimits';
+const RESOURCE_TYPE = 'AGENTIC_REQUEST';
+const ORIGIN = 'AI_EDITOR';
+export async function fetchUsageLimits(auth) {
+    const url = buildUsageLimitsUrl(auth);
+    const headers = buildRequestHeaders(auth);
+    try {
+        const response = await fetch(url, {
+            method: 'GET',
+            headers,
+        });
+        if (!response.ok) {
+            throw new Error(`Usage limits request failed: ${response.status} ${response.statusText}`);
+        }
+        const data = await response.json();
+        return parseUsageLimitsResponse(data);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new Error(`Failed to fetch usage limits: ${error.message}`);
+        }
+        throw new Error('Failed to fetch usage limits: Unknown error');
+    }
+}
+function buildUsageLimitsUrl(auth) {
+    const baseUrl = USAGE_LIMITS_ENDPOINT.replace('{{region}}', auth.region);
+    const params = new URLSearchParams({
+        isEmailRequired: 'true',
+        origin: ORIGIN,
+        resourceType: RESOURCE_TYPE,
+    });
+    if (auth.authMethod === 'social' && auth.profileArn) {
+        params.append('profileArn', auth.profileArn);
+    }
+    return `${baseUrl}?${params.toString()}`;
+}
+function buildRequestHeaders(auth) {
+    return {
+        'Authorization': `Bearer ${auth.access}`,
+        'Content-Type': 'application/json',
+        'x-amzn-kiro-agent-mode': 'vibe',
+        'amz-sdk-request': 'attempt=1; max=1',
+    };
+}
+function parseUsageLimitsResponse(data) {
+    const usedCount = typeof data.usedCount === 'number' ? data.usedCount : 0;
+    const limitCount = typeof data.limitCount === 'number' ? data.limitCount : 0;
+    const contextUsagePercentage = typeof data.contextUsagePercentage === 'number'
+        ? data.contextUsagePercentage
+        : undefined;
+    return {
+        usedCount,
+        limitCount,
+        contextUsagePercentage,
+    };
+}
+export function calculateRecoveryTime() {
+    const now = new Date();
+    const nextMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0));
+    return nextMonth.getTime();
+}
+export function isQuotaExhausted(usage) {
+    return usage.usedCount >= usage.limitCount;
+}
+export function formatUsageDisplay(usage) {
+    const percentage = usage.limitCount > 0
+        ? Math.round((usage.usedCount / usage.limitCount) * 100)
+        : 0;
+    return `${usage.usedCount}/${usage.limitCount} (${percentage}%)`;
+}
+export function calculateUsagePercentage(usage) {
+    if (usage.limitCount <= 0) {
+        return 0;
+    }
+    return Math.round((usage.usedCount / usage.limitCount) * 100);
+}
+export function getRemainingCount(usage) {
+    const remaining = usage.limitCount - usage.usedCount;
+    return Math.max(0, remaining);
+}
+export function extractUsageFromResponse(response) {
+    const inputTokens = response.inputTokens;
+    const outputTokens = response.outputTokens;
+    if (typeof inputTokens === 'number' && typeof outputTokens === 'number') {
+        return {
+            inputTokens,
+            outputTokens,
+        };
+    }
+    return null;
+}
+export function shouldRefreshUsage(lastFetchTime, intervalMs = 300000) {
+    if (!lastFetchTime) {
+        return true;
+    }
+    return Date.now() - lastFetchTime >= intervalMs;
+}
+export function isUsageWarningThreshold(usage, thresholdPercent = 80) {
+    const percentage = calculateUsagePercentage(usage);
+    return percentage >= thresholdPercent && percentage < 100;
+}
+export function getUsageStatus(usage) {
+    if (isQuotaExhausted(usage)) {
+        return 'exhausted';
+    }
+    if (isUsageWarningThreshold(usage)) {
+        return 'warning';
+    }
+    return 'healthy';
+}
+export function formatRecoveryTime(recoveryTimeMs) {
+    const date = new Date(recoveryTimeMs);
+    return date.toISOString();
+}
+export function getTimeUntilRecovery(recoveryTimeMs) {
+    const now = Date.now();
+    const timeUntil = recoveryTimeMs - now;
+    return Math.max(0, timeUntil);
+}
+export function formatTimeUntilRecovery(recoveryTimeMs) {
+    const ms = getTimeUntilRecovery(recoveryTimeMs);
+    const seconds = Math.floor(ms / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (days > 0) {
+        return `${days}d ${hours % 24}h`;
+    }
+    if (hours > 0) {
+        return `${hours}h ${minutes % 60}m`;
+    }
+    if (minutes > 0) {
+        return `${minutes}m`;
+    }
+    return `${seconds}s`;
+}
+export function buildUsageMetrics(usage, recoveryTime) {
+    const status = getUsageStatus(usage);
+    const percentage = calculateUsagePercentage(usage);
+    const remaining = getRemainingCount(usage);
+    const formattedDisplay = formatUsageDisplay(usage);
+    const metrics = {
+        usage,
+        status,
+        percentage,
+        remaining,
+        formattedDisplay,
+    };
+    if (recoveryTime) {
+        metrics.recoveryTime = recoveryTime;
+        metrics.timeUntilRecovery = getTimeUntilRecovery(recoveryTime);
+    }
+    return metrics;
+}
+export async function fetchAndBuildUsageMetrics(auth) {
+    const usage = await fetchUsageLimits(auth);
+    const recoveryTime = isQuotaExhausted(usage) ? calculateRecoveryTime() : undefined;
+    return buildUsageMetrics(usage, recoveryTime);
+}

package/dist/src/plugin.d.ts

@@ -0,0 +1,2 @@
+export declare const createKiroPlugin: (providerId: string) => ({ client, directory }: any) => Promise<any>;
+export declare const KiroOAuthPlugin: ({ client, directory }: any) => Promise<any>;

package/dist/src/plugin.js

@@ -0,0 +1,341 @@
+import { loadConfig } from './plugin/config';
+import { AccountManager, generateAccountId } from './plugin/accounts';
+import { createProactiveRefreshQueue } from './plugin/refresh-queue';
+import { createSessionRecoveryHook } from './plugin/recovery';
+import { accessTokenExpired, encodeRefreshToken } from './kiro/auth';
+import { refreshAccessToken } from './plugin/token';
+import { transformToCodeWhisperer } from './plugin/request';
+import { parseEventStream } from './plugin/response';
+import { transformKiroStream } from './plugin/streaming';
+import { fetchUsageLimits, calculateRecoveryTime } from './plugin/usage';
+import { updateAccountQuota } from './plugin/quota';
+import { authorizeKiroSocial, exchangeKiroSocial } from './kiro/oauth-social';
+import { authorizeKiroIDC, exchangeKiroIDC } from './kiro/oauth-idc';
+import { parseOAuthCallbackInput } from './plugin/oauth-parser';
+import { KiroTokenRefreshError } from './plugin/errors';
+import { KIRO_CONSTANTS } from './constants';
+const KIRO_PROVIDER_ID = 'kiro';
+const KIRO_API_PATTERN = /q\.(us-east-1|us-west-2)\.amazonaws\.com/;
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function isNetworkError(error) {
+    if (error instanceof Error) {
+        const message = error.message.toLowerCase();
+        return message.includes('econnreset') ||
+            message.includes('etimedout') ||
+            message.includes('enotfound') ||
+            message.includes('network') ||
+            message.includes('fetch failed');
+    }
+    return false;
+}
+function extractModelFromUrl(url) {
+    const match = url.match(/models\/([^/:]+)/);
+    return match?.[1] || null;
+}
+export const createKiroPlugin = (providerId) => async ({ client, directory }) => {
+    const config = loadConfig(directory);
+    const sessionRecovery = createSessionRecoveryHook(config.session_recovery, config.auto_resume);
+    return {
+        event: async (event) => {
+            if (event.type === 'session.error') {
+                await sessionRecovery.handleSessionError(event.error, event.sessionId);
+            }
+        },
+        auth: {
+            provider: providerId,
+            loader: async (getAuth, provider) => {
+                const auth = await getAuth();
+                const accountManager = await AccountManager.loadFromDisk(config.account_selection_strategy);
+                if (accountManager.getAccountCount() === 0) {
+                    return {
+                        apiKey: '',
+                        async fetch(input, init) {
+                            throw new Error('No Kiro accounts configured. Please run: opencode auth login');
+                        }
+                    };
+                }
+                const refreshQueue = createProactiveRefreshQueue({
+                    enabled: config.proactive_token_refresh,
+                    checkIntervalSeconds: config.token_refresh_interval_seconds,
+                    bufferSeconds: config.token_refresh_buffer_seconds,
+                });
+                refreshQueue.setAccountManager(accountManager);
+                refreshQueue.start();
+                return {
+                    apiKey: '',
+                    async fetch(input, init) {
+                        const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+                        if (!KIRO_API_PATTERN.test(url)) {
+                            return fetch(input, init);
+                        }
+                        const body = init?.body ? JSON.parse(init.body) : {};
+                        const model = extractModelFromUrl(url) || body.model || 'claude-opus-4-5';
+                        const providerOptions = body.providerOptions || {};
+                        const thinkingConfig = providerOptions.thinkingConfig;
+                        const thinkingEnabled = !!thinkingConfig;
+                        const thinkingBudget = thinkingConfig?.thinkingBudget || config.thinking_budget_tokens;
+                        let retryCount = 0;
+                        const maxRetries = config.rate_limit_max_retries;
+                        while (retryCount <= maxRetries) {
+                            const account = accountManager.getCurrentOrNext();
+                            if (!account) {
+                                throw new Error('No available Kiro accounts. Please run: opencode auth login');
+                            }
+                            const authDetails = accountManager.toAuthDetails(account);
+                            if (accessTokenExpired(authDetails)) {
+                                try {
+                                    const refreshed = await refreshAccessToken(authDetails);
+                                    accountManager.updateFromAuth(account, refreshed);
+                                    await accountManager.saveToDisk();
+                                }
+                                catch (error) {
+                                    if (error instanceof KiroTokenRefreshError && error.code === 'invalid_grant') {
+                                        accountManager.removeAccount(account);
+                                        await accountManager.saveToDisk();
+                                        continue;
+                                    }
+                                    throw error;
+                                }
+                            }
+                            const prepared = transformToCodeWhisperer(url, init?.body, model, authDetails, thinkingEnabled, thinkingBudget);
+                            try {
+                                const response = await fetch(prepared.url, prepared.init);
+                                if (!response.ok) {
+                                    const status = response.status;
+                                    if (status === 401 && retryCount === 0) {
+                                        const refreshed = await refreshAccessToken(authDetails);
+                                        accountManager.updateFromAuth(account, refreshed);
+                                        await accountManager.saveToDisk();
+                                        retryCount++;
+                                        continue;
+                                    }
+                                    if (status === 402) {
+                                        const recoveryTime = calculateRecoveryTime();
+                                        accountManager.markUnhealthy(account, 'Quota exhausted', recoveryTime);
+                                        await accountManager.saveToDisk();
+                                        retryCount++;
+                                        continue;
+                                    }
+                                    if (status === 403) {
+                                        accountManager.markUnhealthy(account, 'Forbidden');
+                                        await accountManager.saveToDisk();
+                                        retryCount++;
+                                        continue;
+                                    }
+                                    if (status === 429) {
+                                        const retryAfter = parseInt(response.headers.get('retry-after') || '60') * 1000;
+                                        accountManager.markRateLimited(account, retryAfter);
+                                        await accountManager.saveToDisk();
+                                        await sleep(config.rate_limit_retry_delay_ms);
+                                        retryCount++;
+                                        continue;
+                                    }
+                                    throw new Error(`Kiro API error: ${status}`);
+                                }
+                                if (config.usage_tracking_enabled) {
+                                    try {
+                                        const usage = await fetchUsageLimits(authDetails);
+                                        updateAccountQuota(account, usage);
+                                        await accountManager.saveToDisk();
+                                    }
+                                    catch (error) {
+                                        if (config.debug) {
+                                            console.error('Failed to fetch usage:', error);
+                                        }
+                                    }
+                                }
+                                if (prepared.streaming) {
+                                    const stream = transformKiroStream(response, model, prepared.conversationId);
+                                    return new Response(new ReadableStream({
+                                        async start(controller) {
+                                            try {
+                                                for await (const event of stream) {
+                                                    controller.enqueue(new TextEncoder().encode(`data: ${JSON.stringify(event)}\n\n`));
+                                                }
+                                                controller.close();
+                                            }
+                                            catch (error) {
+                                                controller.error(error);
+                                            }
+                                        }
+                                    }), {
+                                        headers: {
+                                            'Content-Type': 'text/event-stream',
+                                            'Cache-Control': 'no-cache',
+                                            'Connection': 'keep-alive',
+                                        }
+                                    });
+                                }
+                                else {
+                                    const text = await response.text();
+                                    const parsed = parseEventStream(text);
+                                    const claudeResponse = {
+                                        id: prepared.conversationId,
+                                        type: 'message',
+                                        role: 'assistant',
+                                        model: model,
+                                        content: [
+                                            { type: 'text', text: parsed.content }
+                                        ],
+                                        usage: {
+                                            input_tokens: parsed.inputTokens || 0,
+                                            output_tokens: parsed.outputTokens || 0,
+                                        },
+                                        stop_reason: parsed.stopReason || 'end_turn',
+                                    };
+                                    if (parsed.toolCalls.length > 0) {
+                                        claudeResponse.content.push(...parsed.toolCalls.map(tc => ({
+                                            type: 'tool_use',
+                                            id: tc.toolUseId,
+                                            name: tc.name,
+                                            input: typeof tc.input === 'string' ? JSON.parse(tc.input) : tc.input,
+                                        })));
+                                        claudeResponse.stop_reason = 'tool_use';
+                                    }
+                                    return new Response(JSON.stringify(claudeResponse), {
+                                        headers: { 'Content-Type': 'application/json' }
+                                    });
+                                }
+                            }
+                            catch (error) {
+                                if (isNetworkError(error) && retryCount < maxRetries) {
+                                    await sleep(config.rate_limit_retry_delay_ms * Math.pow(2, retryCount));
+                                    retryCount++;
+                                    continue;
+                                }
+                                throw error;
+                            }
+                        }
+                        throw new Error('Max retries exceeded');
+                    }
+                };
+            },
+            methods: [
+                {
+                    label: 'Google OAuth (Social)',
+                    type: 'oauth',
+                    authorize: async (inputs) => {
+                        if (!inputs || !inputs.region) {
+                            return {
+                                url: '',
+                                instructions: 'Use CLI: opencode auth login',
+                                method: 'auto',
+                                callback: async () => ({
+                                    type: 'failed',
+                                    error: 'TUI auth not supported. Use: opencode auth login'
+                                }),
+                            };
+                        }
+                        const region = inputs.region || KIRO_CONSTANTS.DEFAULT_REGION;
+                        const auth = await authorizeKiroSocial(region);
+                        return {
+                            url: auth.url,
+                            instructions: 'Visit the URL above, complete Google OAuth, then paste the full redirect URL or authorization code below.',
+                            method: 'code',
+                            callback: async (codeInput) => {
+                                try {
+                                    const { code, state } = parseOAuthCallbackInput(codeInput);
+                                    const result = await exchangeKiroSocial(code, state);
+                                    const accountManager = await AccountManager.loadFromDisk();
+                                    const account = {
+                                        id: generateAccountId(),
+                                        email: result.email,
+                                        authMethod: 'social',
+                                        region: result.region,
+                                        profileArn: result.profileArn,
+                                        refreshToken: result.refreshToken,
+                                        accessToken: result.accessToken,
+                                        expiresAt: result.expiresAt,
+                                        rateLimitResetTime: 0,
+                                        isHealthy: true,
+                                    };
+                                    accountManager.addAccount(account);
+                                    await accountManager.saveToDisk();
+                                    return {
+                                        type: 'success',
+                                        refresh: encodeRefreshToken(result.refreshToken, result.profileArn, undefined, undefined, 'social'),
+                                        access: result.accessToken,
+                                        expires: result.expiresAt,
+                                    };
+                                }
+                                catch (error) {
+                                    return {
+                                        type: 'failed',
+                                        error: error instanceof Error ? error.message : 'Unknown error',
+                                    };
+                                }
+                            },
+                        };
+                    }
+                },
+                {
+                    label: 'AWS Builder ID (IDC)',
+                    type: 'oauth',
+                    authorize: async (inputs) => {
+                        if (!inputs || !inputs.region) {
+                            return {
+                                url: '',
+                                instructions: 'Use CLI: opencode auth login',
+                                method: 'auto',
+                                callback: async () => ({
+                                    type: 'failed',
+                                    error: 'TUI auth not supported. Use: opencode auth login'
+                                }),
+                            };
+                        }
+                        const region = inputs.region || KIRO_CONSTANTS.DEFAULT_REGION;
+                        const auth = await authorizeKiroIDC(region);
+                        return {
+                            url: auth.url,
+                            instructions: 'Visit the URL above, complete AWS Builder ID authentication. The token exchange will happen automatically after you authorize.',
+                            method: 'auto',
+                            callback: async () => {
+                                try {
+                                    const state = Buffer.from(JSON.stringify({
+                                        deviceCode: auth.deviceCode,
+                                        region: auth.region,
+                                        clientId: auth.clientId,
+                                        clientSecret: auth.clientSecret,
+                                    })).toString('base64url');
+                                    await new Promise(resolve => setTimeout(resolve, 5000));
+                                    const result = await exchangeKiroIDC(state);
+                                    const accountManager = await AccountManager.loadFromDisk();
+                                    const account = {
+                                        id: generateAccountId(),
+                                        email: result.email,
+                                        authMethod: 'idc',
+                                        region: result.region,
+                                        clientId: result.clientId,
+                                        clientSecret: result.clientSecret,
+                                        refreshToken: result.refreshToken,
+                                        accessToken: result.accessToken,
+                                        expiresAt: result.expiresAt,
+                                        rateLimitResetTime: 0,
+                                        isHealthy: true,
+                                    };
+                                    accountManager.addAccount(account);
+                                    await accountManager.saveToDisk();
+                                    return {
+                                        type: 'success',
+                                        refresh: encodeRefreshToken(result.refreshToken, undefined, result.clientId, result.clientSecret, 'idc'),
+                                        access: result.accessToken,
+                                        expires: result.expiresAt,
+                                    };
+                                }
+                                catch (error) {
+                                    return {
+                                        type: 'failed',
+                                        error: error instanceof Error ? error.message : 'Unknown error',
+                                    };
+                                }
+                            },
+                        };
+                    }
+                }
+            ]
+        }
+    };
+};
+export const KiroOAuthPlugin = createKiroPlugin(KIRO_PROVIDER_ID);