@zhafron/opencode-kiro-auth 1.3.0 → 1.4.0

package/dist/plugin/accounts.d.ts

@@ -1,14 +1,13 @@
-import type { AccountSelectionStrategy, KiroAuthDetails, ManagedAccount, UsageMetadata } from './types';
+import type { AccountSelectionStrategy, KiroAuthDetails, ManagedAccount } from './types';
 export declare function generateAccountId(): string;
 export declare function createDeterministicAccountId(email: string, method: string, clientId?: string, profileArn?: string): string;
 export declare class AccountManager {
     private accounts;
-    private usage;
     private cursor;
     private strategy;
     private lastToastTime;
     private lastUsageToastTime;
-    constructor(accounts: ManagedAccount[], usage: Record<string, UsageMetadata>, strategy?: AccountSelectionStrategy);
+    constructor(accounts: ManagedAccount[], strategy?: AccountSelectionStrategy);
     static loadFromDisk(strategy?: AccountSelectionStrategy): Promise<AccountManager>;
     getAccountCount(): number;
     getAccounts(): ManagedAccount[];
@@ -19,7 +18,7 @@ export declare class AccountManager {
     updateUsage(id: string, meta: {
         usedCount: number;
         limitCount: number;
-        realEmail?: string;
+        email?: string;
     }): void;
     addAccount(a: ManagedAccount): void;
     removeAccount(a: ManagedAccount): void;

package/dist/plugin/accounts.js

@@ -12,32 +12,20 @@ export function createDeterministicAccountId(email, method, clientId, profileArn
 }
 export class AccountManager {
     accounts;
-    usage;
     cursor;
     strategy;
     lastToastTime = 0;
     lastUsageToastTime = 0;
-    constructor(accounts, usage, strategy = 'sticky') {
+    constructor(accounts, strategy = 'sticky') {
         this.accounts = accounts;
-        this.usage = usage;
         this.cursor = 0;
         this.strategy = strategy;
-        for (const a of this.accounts) {
-            const m = this.usage[a.id];
-            if (m) {
-                a.usedCount = m.usedCount;
-                a.limitCount = m.limitCount;
-                a.realEmail = m.realEmail;
-            }
-        }
     }
     static async loadFromDisk(strategy) {
         const rows = kiroDb.getAccounts();
-        const usage = kiroDb.getUsage();
         const accounts = rows.map((r) => ({
             id: r.id,
             email: r.email,
-            realEmail: r.real_email,
             authMethod: r.auth_method,
             region: r.region,
             clientId: r.client_id,
@@ -50,9 +38,12 @@ export class AccountManager {
             isHealthy: r.is_healthy === 1,
             unhealthyReason: r.unhealthy_reason,
             recoveryTime: r.recovery_time,
-            lastUsed: r.last_used
+            failCount: r.fail_count || 0,
+            lastUsed: r.last_used,
+            usedCount: r.used_count,
+            limitCount: r.limit_count
         }));
-        return new AccountManager(accounts, usage, strategy || 'sticky');
+        return new AccountManager(accounts, strategy || 'sticky');
     }
     getAccountCount() {
         return this.accounts.length;
@@ -81,7 +72,7 @@ export class AccountManager {
         const now = Date.now();
         const available = this.accounts.filter((a) => {
             if (!a.isHealthy) {
-                if (a.recoveryTime && now >= a.recoveryTime) {
+                if (a.failCount < 3 && a.recoveryTime && now >= a.recoveryTime) {
                     a.isHealthy = true;
                     delete a.unhealthyReason;
                     delete a.recoveryTime;
@@ -91,18 +82,29 @@ export class AccountManager {
             }
             return !(a.rateLimitResetTime && now < a.rateLimitResetTime);
         });
-        if (available.length === 0)
-            return null;
         let selected;
-        if (this.strategy === 'sticky') {
-            selected = available.find((_, i) => i === this.cursor) || available[0];
-        }
-        else if (this.strategy === 'round-robin') {
-            selected = available[this.cursor % available.length];
-            this.cursor = (this.cursor + 1) % available.length;
+        if (available.length > 0) {
+            if (this.strategy === 'sticky') {
+                selected = available.find((_, i) => i === this.cursor) || available[0];
+            }
+            else if (this.strategy === 'round-robin') {
+                selected = available[this.cursor % available.length];
+                this.cursor = (this.cursor + 1) % available.length;
+            }
+            else if (this.strategy === 'lowest-usage') {
+                selected = [...available].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            }
         }
-        else if (this.strategy === 'lowest-usage') {
-            selected = [...available].sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+        if (!selected) {
+            const fallback = this.accounts
+                .filter((a) => !a.isHealthy && a.failCount < 3)
+                .sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
+            if (fallback) {
+                fallback.isHealthy = true;
+                delete fallback.unhealthyReason;
+                delete fallback.recoveryTime;
+                selected = fallback;
+            }
         }
         if (selected) {
             selected.lastUsed = now;
@@ -117,11 +119,11 @@ export class AccountManager {
         if (a) {
             a.usedCount = meta.usedCount;
             a.limitCount = meta.limitCount;
-            if (meta.realEmail)
-                a.realEmail = meta.realEmail;
+            if (meta.email)
+                a.email = meta.email;
+            a.failCount = 0;
+            kiroDb.upsertAccount(a);
         }
-        this.usage[id] = { ...meta, lastSync: Date.now() };
-        kiroDb.upsertUsage(id, this.usage[id]);
     }
     addAccount(a) {
         const i = this.accounts.findIndex((x) => x.id === a.id);
@@ -136,7 +138,6 @@ export class AccountManager {
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        delete this.usage[a.id];
         kiroDb.deleteAccount(a.id);
         if (this.accounts.length === 0)
             this.cursor = 0;
@@ -151,14 +152,15 @@ export class AccountManager {
             acc.accessToken = auth.access;
             acc.expiresAt = auth.expires;
             acc.lastUsed = Date.now();
-            if (auth.email && auth.email !== 'builder-id@aws.amazon.com')
-                acc.realEmail = auth.email;
+            if (auth.email)
+                acc.email = auth.email;
             const p = decodeRefreshToken(auth.refresh);
             acc.refreshToken = p.refreshToken;
             if (p.profileArn)
                 acc.profileArn = p.profileArn;
             if (p.clientId)
                 acc.clientId = p.clientId;
+            acc.failCount = 0;
             kiroDb.upsertAccount(acc);
             writeToKiroCli(acc).catch(() => { });
         }
@@ -175,7 +177,8 @@ export class AccountManager {
         if (acc) {
             acc.isHealthy = false;
             acc.unhealthyReason = reason;
-            acc.recoveryTime = recovery;
+            acc.failCount = (acc.failCount || 0) + 1;
+            acc.recoveryTime = acc.failCount >= 3 ? undefined : recovery || Date.now() + 3600000;
             kiroDb.upsertAccount(acc);
         }
     }

package/dist/plugin/storage/migration.js

@@ -4,10 +4,9 @@ import { join } from 'node:path';
 import * as logger from '../logger';
 import { kiroDb } from './sqlite';
 function getBaseDir() {
-    const platform = process.platform;
-    if (platform === 'win32') {
+    const p = process.platform;
+    if (p === 'win32')
         return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
-    }
     return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
 }
 export async function migrateJsonToSqlite() {
@@ -19,32 +18,32 @@ export async function migrateJsonToSqlite() {
             .access(accPath)
             .then(() => true)
             .catch(() => false);
+        const useExists = await fs
+            .access(usePath)
+            .then(() => true)
+            .catch(() => false);
         if (accExists) {
-            const data = JSON.parse(await fs.readFile(accPath, 'utf-8'));
-            if (data.accounts && Array.isArray(data.accounts)) {
-                for (const acc of data.accounts) {
+            const accData = JSON.parse(await fs.readFile(accPath, 'utf-8'));
+            const useData = useExists ? JSON.parse(await fs.readFile(usePath, 'utf-8')) : { usage: {} };
+            if (accData.accounts && Array.isArray(accData.accounts)) {
+                for (const acc of accData.accounts) {
+                    const usage = useData.usage[acc.id] || {};
                     kiroDb.upsertAccount({
                         ...acc,
+                        email: acc.realEmail || acc.email,
                         rateLimitResetTime: acc.rateLimitResetTime || 0,
                         isHealthy: acc.isHealthy !== false,
-                        lastUsed: acc.lastUsed || 0
+                        failCount: 0,
+                        lastUsed: acc.lastUsed || 0,
+                        usedCount: usage.usedCount || 0,
+                        limitCount: usage.limitCount || 0,
+                        lastSync: usage.lastSync || 0
                     });
                 }
             }
             await fs.rename(accPath, accPath + '.bak');
-        }
-        const useExists = await fs
-            .access(usePath)
-            .then(() => true)
-            .catch(() => false);
-        if (useExists) {
-            const data = JSON.parse(await fs.readFile(usePath, 'utf-8'));
-            if (data.usage && typeof data.usage === 'object') {
-                for (const [id, meta] of Object.entries(data.usage)) {
-                    kiroDb.upsertUsage(id, meta);
-                }
-            }
-            await fs.rename(usePath, usePath + '.bak');
+            if (useExists)
+                await fs.rename(usePath, usePath + '.bak');
         }
     }
     catch (e) {

package/dist/plugin/storage/sqlite.d.ts

@@ -1,4 +1,3 @@
-import type { UsageMetadata } from '../types';
 export declare const DB_PATH: string;
 export declare class KiroDatabase {
     private db;
@@ -7,10 +6,6 @@ export declare class KiroDatabase {
     getAccounts(): any[];
     upsertAccount(acc: any): void;
     deleteAccount(id: string): void;
-    getUsage(): Record<string, UsageMetadata>;
-    upsertUsage(id: string, meta: UsageMetadata): void;
-    getSetting(key: string): string | null;
-    setSetting(key: string, value: string): void;
     close(): void;
 }
 export declare const kiroDb: KiroDatabase;

package/dist/plugin/storage/sqlite.js

@@ -23,21 +23,66 @@ export class KiroDatabase {
         this.db.run('PRAGMA journal_mode = WAL');
         this.db.run(`
       CREATE TABLE IF NOT EXISTS accounts (
-        id TEXT PRIMARY KEY, email TEXT NOT NULL, real_email TEXT, auth_method TEXT NOT NULL,
+        id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
         region TEXT NOT NULL, client_id TEXT, client_secret TEXT, profile_arn TEXT,
         refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
         rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
-        recovery_time INTEGER, last_used INTEGER DEFAULT 0
+        recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
+        used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
       )
     `);
-        this.db.run(`
-      CREATE TABLE IF NOT EXISTS usage (
-        account_id TEXT PRIMARY KEY, used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0,
-        real_email TEXT, last_sync INTEGER,
-        FOREIGN KEY(account_id) REFERENCES accounts(id) ON DELETE CASCADE
-      )
-    `);
-        this.db.run('CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT)');
+        const columns = this.db.prepare('PRAGMA table_info(accounts)').all();
+        const names = new Set(columns.map((c) => c.name));
+        if (names.has('real_email')) {
+            this.db.run('BEGIN TRANSACTION');
+            try {
+                this.db.run("UPDATE accounts SET email = real_email WHERE real_email IS NOT NULL AND real_email != '' AND email LIKE 'builder-id@aws.amazon.com%'");
+                this.db.run(`
+          CREATE TABLE accounts_new (
+            id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
+            region TEXT NOT NULL, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+            refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
+            rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
+            recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
+            used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
+          )
+        `);
+                this.db.run(`
+          INSERT INTO accounts_new (id, email, auth_method, region, client_id, client_secret, profile_arn, refresh_token, access_token, expires_at, rate_limit_reset, is_healthy, unhealthy_reason, recovery_time, fail_count, last_used, used_count, limit_count, last_sync)
+          SELECT id, email, auth_method, region, client_id, client_secret, profile_arn, refresh_token, access_token, expires_at, COALESCE(rate_limit_reset, 0), COALESCE(is_healthy, 1), unhealthy_reason, recovery_time, COALESCE(fail_count, 0), COALESCE(last_used, 0), 0, 0, 0 FROM accounts
+        `);
+                this.db.run('DROP TABLE accounts');
+                this.db.run('ALTER TABLE accounts_new RENAME TO accounts');
+                this.db.run('COMMIT');
+            }
+            catch (e) {
+                this.db.run('ROLLBACK');
+            }
+        }
+        else {
+            const needed = {
+                fail_count: 'INTEGER DEFAULT 0',
+                used_count: 'INTEGER DEFAULT 0',
+                limit_count: 'INTEGER DEFAULT 0',
+                last_sync: 'INTEGER DEFAULT 0'
+            };
+            for (const [n, d] of Object.entries(needed)) {
+                if (!names.has(n))
+                    this.db.run(`ALTER TABLE accounts ADD COLUMN ${n} ${d}`);
+            }
+        }
+        const hasUsageTable = this.db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='usage'")
+            .get();
+        if (hasUsageTable) {
+            this.db.run(`
+        UPDATE accounts SET 
+          used_count = COALESCE((SELECT used_count FROM usage WHERE usage.account_id = accounts.id), used_count),
+          limit_count = COALESCE((SELECT limit_count FROM usage WHERE usage.account_id = accounts.id), limit_count),
+          last_sync = COALESCE((SELECT last_sync FROM usage WHERE usage.account_id = accounts.id), last_sync)
+      `);
+            this.db.run('DROP TABLE usage');
+        }
     }
     getAccounts() {
         return this.db.prepare('SELECT * FROM accounts').all();
@@ -46,57 +91,26 @@ export class KiroDatabase {
         this.db
             .prepare(`
       INSERT INTO accounts (
-        id, email, real_email, auth_method, region, client_id, client_secret,
+        id, email, auth_method, region, client_id, client_secret,
         profile_arn, refresh_token, access_token, expires_at, rate_limit_reset,
-        is_healthy, unhealthy_reason, recovery_time, last_used
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
+        used_count, limit_count, last_sync
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
-        email=excluded.email, real_email=excluded.real_email, auth_method=excluded.auth_method,
+        email=excluded.email, auth_method=excluded.auth_method,
         region=excluded.region, client_id=excluded.client_id, client_secret=excluded.client_secret,
         profile_arn=excluded.profile_arn, refresh_token=excluded.refresh_token,
         access_token=excluded.access_token, expires_at=excluded.expires_at,
         rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
         unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,
-        last_used=excluded.last_used
+        fail_count=excluded.fail_count, last_used=excluded.last_used,
+        used_count=excluded.used_count, limit_count=excluded.limit_count, last_sync=excluded.last_sync
     `)
-            .run(acc.id, acc.email, acc.realEmail || null, acc.authMethod, acc.region, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.lastUsed || 0);
+            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
     }
     deleteAccount(id) {
         this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
     }
-    getUsage() {
-        const rows = this.db.prepare('SELECT * FROM usage').all();
-        const usage = {};
-        for (const r of rows) {
-            usage[r.account_id] = {
-                usedCount: r.used_count,
-                limitCount: r.limit_count,
-                realEmail: r.real_email,
-                lastSync: r.last_sync
-            };
-        }
-        return usage;
-    }
-    upsertUsage(id, meta) {
-        this.db
-            .prepare(`
-      INSERT INTO usage (account_id, used_count, limit_count, real_email, last_sync)
-      VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(account_id) DO UPDATE SET
-        used_count=excluded.used_count, limit_count=excluded.limit_count,
-        real_email=excluded.real_email, last_sync=excluded.last_sync
-    `)
-            .run(id, meta.usedCount, meta.limitCount, meta.realEmail || null, meta.lastSync);
-    }
-    getSetting(key) {
-        const row = this.db.prepare('SELECT value FROM settings WHERE key = ?').get(key);
-        return row ? row.value : null;
-    }
-    setSetting(key, value) {
-        this.db
-            .prepare('INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value')
-            .run(key, value);
-    }
     close() {
         this.db.close();
     }

package/dist/plugin/sync/kiro-cli.js

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { createDeterministicAccountId } from '../accounts';
 import * as logger from '../logger';
 import { kiroDb } from '../storage/sqlite';
+import { fetchUsageLimits } from '../usage';
 function getCliDbPath() {
     const p = platform();
     if (p === 'win32')
@@ -32,8 +33,8 @@ export async function syncFromKiroCli() {
                 }
                 if (!data.access_token)
                     continue;
-                const email = data.email || 'cli-account@kiro.dev';
                 const authMethod = row.key.includes('odic') ? 'idc' : 'desktop';
+                const region = data.region || 'us-east-1';
                 const clientId = data.client_id ||
                     (authMethod === 'idc'
                         ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
@@ -44,25 +45,43 @@ export async function syncFromKiroCli() {
                         ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
                             .client_secret
                         : undefined);
-                const id = createDeterministicAccountId(email, authMethod, clientId, data.profile_arn);
-                const existing = kiroDb.getAccounts().find((a) => a.id === id);
-                const cliExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() : 0;
-                if (existing && existing.expires_at >= cliExpiresAt)
-                    continue;
-                kiroDb.upsertAccount({
-                    id,
-                    email,
-                    realEmail: data.real_email || email,
-                    authMethod,
-                    region: data.region || 'us-east-1',
-                    clientId,
-                    clientSecret,
-                    profileArn: data.profile_arn,
-                    refreshToken: data.refresh_token,
-                    accessToken: data.access_token,
-                    expiresAt: cliExpiresAt || Date.now() + 3600000,
-                    isHealthy: 1
-                });
+                try {
+                    const u = await fetchUsageLimits({
+                        refresh: '',
+                        access: data.access_token,
+                        expires: 0,
+                        authMethod,
+                        region,
+                        clientId,
+                        clientSecret
+                    });
+                    const email = u.email;
+                    if (!email)
+                        continue;
+                    const id = createDeterministicAccountId(email, authMethod, clientId, data.profile_arn);
+                    const existing = kiroDb.getAccounts().find((a) => a.id === id);
+                    const cliExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() : 0;
+                    if (existing && existing.is_healthy === 1 && existing.expires_at >= cliExpiresAt)
+                        continue;
+                    kiroDb.upsertAccount({
+                        id,
+                        email,
+                        authMethod,
+                        region,
+                        clientId,
+                        clientSecret,
+                        profileArn: data.profile_arn,
+                        refreshToken: data.refresh_token,
+                        accessToken: data.access_token,
+                        expiresAt: cliExpiresAt || Date.now() + 3600000,
+                        isHealthy: 1,
+                        failCount: 0,
+                        usedCount: u.usedCount,
+                        limitCount: u.limitCount,
+                        lastSync: Date.now()
+                    });
+                }
+                catch { }
             }
         }
         cliDb.close();
@@ -77,7 +96,7 @@ export async function writeToKiroCli(acc) {
         return;
     try {
         const cliDb = new Database(dbPath);
-        cliDb.exec('PRAGMA busy_timeout = 5000');
+        cliDb.run('PRAGMA busy_timeout = 5000');
         const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
         const targetKey = acc.authMethod === 'idc' ? 'kirocli:odic:token' : 'kirocli:social:token';
         const row = rows.find((r) => r.key === targetKey || r.key.endsWith(targetKey));

package/dist/plugin/types.d.ts

@@ -21,7 +21,6 @@ export interface RefreshParts {
 export interface ManagedAccount {
     id: string;
     email: string;
-    realEmail?: string;
     authMethod: KiroAuthMethod;
     region: KiroRegion;
     clientId?: string;
@@ -34,14 +33,15 @@ export interface ManagedAccount {
     isHealthy: boolean;
     unhealthyReason?: string;
     recoveryTime?: number;
+    failCount: number;
     usedCount?: number;
     limitCount?: number;
+    lastSync?: number;
     lastUsed?: number;
 }
 export interface UsageMetadata {
     usedCount: number;
     limitCount: number;
-    realEmail?: string;
     lastSync: number;
 }
 export interface CodeWhispererMessage {

package/dist/plugin/usage.js

@@ -34,12 +34,12 @@ export function updateAccountQuota(account, usage, accountManager) {
     const meta = {
         usedCount: usage.usedCount || 0,
         limitCount: usage.limitCount || 0,
-        realEmail: usage.email
+        email: usage.email
     };
     account.usedCount = meta.usedCount;
     account.limitCount = meta.limitCount;
-    if (meta.realEmail)
-        account.realEmail = meta.realEmail;
+    if (usage.email)
+        account.email = usage.email;
     if (accountManager)
         accountManager.updateUsage(account.id, meta);
 }

package/dist/plugin.js

@@ -1,8 +1,8 @@
 import { exec } from 'node:child_process';
 import { KIRO_CONSTANTS } from './constants';
-import { accessTokenExpired, encodeRefreshToken } from './kiro/auth';
+import { accessTokenExpired } from './kiro/auth';
 import { authorizeKiroIDC } from './kiro/oauth-idc';
-import { AccountManager, generateAccountId } from './plugin/accounts';
+import { AccountManager, createDeterministicAccountId } from './plugin/accounts';
 import { promptAddAnotherAccount, promptLoginMode } from './plugin/cli';
 import { loadConfig } from './plugin/config';
 import { KiroTokenRefreshError } from './plugin/errors';
@@ -54,6 +54,22 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                 if (config.auto_sync_kiro_cli)
                     await syncFromKiroCli();
                 const am = await AccountManager.loadFromDisk(config.account_selection_strategy);
+                const allAccs = am.getAccounts();
+                for (const acc of allAccs) {
+                    if (acc.isHealthy && (!acc.lastSync || Date.now() - acc.lastSync > 3600000)) {
+                        try {
+                            const auth = am.toAuthDetails(acc);
+                            const u = await fetchUsageLimits(auth);
+                            am.updateUsage(acc.id, {
+                                usedCount: u.usedCount,
+                                limitCount: u.limitCount,
+                                email: u.email
+                            });
+                        }
+                        catch { }
+                    }
+                }
+                await am.saveToDisk();
                 return {
                     apiKey: '',
                     baseURL: KIRO_CONSTANTS.BASE_URL.replace('/generateAssistantResponse', '').replace('{{region}}', config.default_region || 'us-east-1'),
@@ -76,7 +92,7 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                             const count = am.getAccountCount();
                             if (count === 0)
                                 throw new Error('No accounts');
-                            const acc = am.getCurrentOrNext();
+                            let acc = am.getCurrentOrNext();
                             if (!acc) {
                                 const wait = am.getMinWaitTime();
                                 if (wait > 0 && wait < 30000) {
@@ -87,6 +103,14 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 }
                                 throw new Error('All accounts are unhealthy or rate-limited');
                             }
+                            if (count > 1 && am.shouldShowToast())
+                                showToast(`Using ${acc.email} (${am.getAccounts().indexOf(acc) + 1}/${count})`, 'info');
+                            if (am.shouldShowUsageToast() &&
+                                acc.usedCount !== undefined &&
+                                acc.limitCount !== undefined) {
+                                const p = acc.limitCount > 0 ? (acc.usedCount / acc.limitCount) * 100 : 0;
+                                showToast(formatUsageMessage(acc.usedCount, acc.limitCount, acc.email), p >= 80 ? 'warning' : 'info');
+                            }
                             const auth = am.toAuthDetails(acc);
                             if (accessTokenExpired(auth, config.token_expiry_buffer_ms)) {
                                 try {
@@ -102,6 +126,7 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                     if (stillAcc &&
                                         !accessTokenExpired(refreshedAm.toAuthDetails(stillAcc), config.token_expiry_buffer_ms)) {
                                         showToast('Credentials recovered from Kiro CLI sync.', 'info');
+                                        acc = stillAcc;
                                         continue;
                                     }
                                     if (e instanceof KiroTokenRefreshError &&
@@ -120,19 +145,19 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                             let prep = prepRequest(reductionFactor);
                             const apiTimestamp = config.enable_log_api_request ? logger.getTimestamp() : null;
                             if (config.enable_log_api_request && apiTimestamp) {
-                                let parsedBody = null;
+                                let b = null;
                                 try {
-                                    parsedBody = prep.init.body ? JSON.parse(prep.init.body) : null;
+                                    b = prep.init.body ? JSON.parse(prep.init.body) : null;
                                 }
                                 catch { }
                                 logger.logApiRequest({
                                     url: prep.url,
                                     method: prep.init.method,
                                     headers: prep.init.headers,
-                                    body: parsedBody,
+                                    body: b,
                                     conversationId: prep.conversationId,
                                     model: prep.effectiveModel,
-                                    email: acc.realEmail || acc.email
+                                    email: acc.email
                                 }, apiTimestamp);
                             }
                             try {
@@ -252,9 +277,9 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                     conversationId: prep.conversationId,
                                     model: prep.effectiveModel
                                 };
-                                let lastBody = null;
+                                let lastB = null;
                                 try {
-                                    lastBody = prep.init.body ? JSON.parse(prep.init.body) : null;
+                                    lastB = prep.init.body ? JSON.parse(prep.init.body) : null;
                                 }
                                 catch { }
                                 if (!config.enable_log_api_request)
@@ -262,10 +287,10 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                         url: prep.url,
                                         method: prep.init.method,
                                         headers: prep.init.headers,
-                                        body: lastBody,
+                                        body: lastB,
                                         conversationId: prep.conversationId,
                                         model: prep.effectiveModel,
-                                        email: acc.realEmail || acc.email
+                                        email: acc.email
                                     }, rData, logger.getTimestamp());
                                 throw new Error(`Kiro Error: ${res.status}`);
                             }
@@ -294,11 +319,10 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                             const accounts = [];
                             let startFresh = true;
                             const existingAm = await AccountManager.loadFromDisk(config.account_selection_strategy);
-                            const allAccounts = existingAm.getAccounts();
-                            const idcAccounts = allAccounts.filter((a) => a.authMethod === 'idc');
-                            if (idcAccounts.length > 0) {
-                                const existingAccounts = idcAccounts.map((acc, idx) => ({
-                                    email: acc.realEmail || acc.email,
+                            const idcAccs = existingAm.getAccounts().filter((a) => a.authMethod === 'idc');
+                            if (idcAccs.length > 0) {
+                                const existingAccounts = idcAccs.map((acc, idx) => ({
+                                    email: acc.email,
                                     index: idx
                                 }));
                                 startFresh = (await promptLoginMode(existingAccounts)) === 'fresh';
@@ -309,15 +333,29 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                     const { url, waitForAuth } = await startIDCAuthServer(authData, config.auth_server_port_start, config.auth_server_port_range);
                                     openBrowser(url);
                                     const res = await waitForAuth();
+                                    const u = await fetchUsageLimits({
+                                        refresh: '',
+                                        access: res.accessToken,
+                                        expires: res.expiresAt,
+                                        authMethod: 'idc',
+                                        region,
+                                        clientId: res.clientId,
+                                        clientSecret: res.clientSecret
+                                    });
+                                    if (!u.email) {
+                                        console.log('\n[Error] Failed to fetch account email. Skipping...\n');
+                                        continue;
+                                    }
                                     accounts.push(res);
                                     const am = await AccountManager.loadFromDisk(config.account_selection_strategy);
                                     if (accounts.length === 1 && startFresh)
                                         am.getAccounts()
                                             .filter((a) => a.authMethod === 'idc')
                                             .forEach((a) => am.removeAccount(a));
+                                    const id = createDeterministicAccountId(u.email, 'idc', res.clientId);
                                     const acc = {
-                                        id: generateAccountId(),
-                                        email: res.email,
+                                        id,
+                                        email: u.email,
                                         authMethod: 'idc',
                                         region,
                                         clientId: res.clientId,
@@ -326,39 +364,18 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                         accessToken: res.accessToken,
                                         expiresAt: res.expiresAt,
                                         rateLimitResetTime: 0,
-                                        isHealthy: true
+                                        isHealthy: true,
+                                        failCount: 0
                                     };
-                                    try {
-                                        const u = await fetchUsageLimits({
-                                            refresh: encodeRefreshToken({
-                                                refreshToken: res.refreshToken,
-                                                clientId: res.clientId,
-                                                clientSecret: res.clientSecret,
-                                                authMethod: 'idc'
-                                            }),
-                                            access: res.accessToken,
-                                            expires: res.expiresAt,
-                                            authMethod: 'idc',
-                                            region,
-                                            clientId: res.clientId,
-                                            clientSecret: res.clientSecret,
-                                            email: res.email
-                                        });
-                                        am.updateUsage(acc.id, {
-                                            usedCount: u.usedCount,
-                                            limitCount: u.limitCount,
-                                            realEmail: u.email
-                                        });
-                                    }
-                                    catch { }
                                     am.addAccount(acc);
+                                    am.updateUsage(id, { usedCount: u.usedCount, limitCount: u.limitCount });
                                     await am.saveToDisk();
-                                    showToast(`Account authenticated (${res.email})`, 'success');
+                                    console.log(`\n[Success] Added: ${u.email} (Quota: ${u.usedCount}/${u.limitCount})\n`);
                                     if (!(await promptAddAnotherAccount(am.getAccountCount())))
                                         break;
                                 }
                                 catch (e) {
-                                    showToast(`Failed: ${e.message}`, 'error');
+                                    console.log(`\n[Error] Login failed: ${e.message}\n`);
                                     break;
                                 }
                             }
@@ -384,9 +401,21 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 callback: async () => {
                                     try {
                                         const res = await waitForAuth(), am = await AccountManager.loadFromDisk(config.account_selection_strategy);
+                                        const u = await fetchUsageLimits({
+                                            refresh: '',
+                                            access: res.accessToken,
+                                            expires: res.expiresAt,
+                                            authMethod: 'idc',
+                                            region,
+                                            clientId: res.clientId,
+                                            clientSecret: res.clientSecret
+                                        });
+                                        if (!u.email)
+                                            throw new Error('No email');
+                                        const id = createDeterministicAccountId(u.email, 'idc', res.clientId);
                                         const acc = {
-                                            id: generateAccountId(),
-                                            email: res.email,
+                                            id,
+                                            email: u.email,
                                             authMethod: 'idc',
                                             region,
                                             clientId: res.clientId,
@@ -395,9 +424,12 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                             accessToken: res.accessToken,
                                             expiresAt: res.expiresAt,
                                             rateLimitResetTime: 0,
-                                            isHealthy: true
+                                            isHealthy: true,
+                                            failCount: 0
                                         };
                                         am.addAccount(acc);
+                                        if (u.email)
+                                            am.updateUsage(id, { usedCount: u.usedCount, limitCount: u.limitCount });
                                         await am.saveToDisk();
                                         return { type: 'success', key: res.accessToken };
                                     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",