@zhafron/opencode-kiro-auth 1.4.8 → 1.4.11

package/README.md

@@ -1,4 +1,5 @@
 # OpenCode Kiro Auth Plugin
+
 [![npm version](https://img.shields.io/npm/v/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
 [![npm downloads](https://img.shields.io/npm/dm/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
 [![license](https://img.shields.io/npm/l/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
@@ -71,12 +72,25 @@ Add the plugin to your `opencode.json` or `opencode.jsonc`:
 1. **Authentication via Kiro CLI (Recommended)**:
    - Perform login directly in your terminal using `kiro-cli login`.
    - The plugin will automatically detect and import your session on startup.
+   - For AWS IAM Identity Center (SSO/IDC), the plugin imports both the token and device registration (OIDC client credentials) from the `kiro-cli` database.
 2. **Direct Authentication**:
    - Run `opencode auth login`.
    - Select `Other`, type `kiro`, and press enter.
    - Follow the instructions for **AWS Builder ID (IDC)**.
 3. Configuration will be automatically managed at `~/.config/opencode/kiro.db`.
 
+## Troubleshooting
+
+### Error: No accounts
+
+This happens when the plugin has no records in `~/.config/opencode/kiro.db`.
+
+1. Ensure `kiro-cli login` succeeds.
+2. Ensure `auto_sync_kiro_cli` is `true` in `~/.config/opencode/kiro.json`.
+3. Retry the request; the plugin will attempt a Kiro CLI sync when it detects zero accounts.
+
+Note for IDC/SSO (ODIC): the plugin may temporarily create an account with a placeholder email if it cannot fetch the real email during sync (e.g. offline). It will replace it with the real email once usage/email lookup succeeds.
+
 ## Configuration
 
 The plugin supports extensive configuration options. Edit `~/.config/opencode/kiro.json`:
@@ -118,10 +132,12 @@ The plugin supports extensive configuration options. Edit `~/.config/opencode/ki
 ## Storage
 
 **Linux/macOS:**
+
 - SQLite Database: `~/.config/opencode/kiro.db`
 - Plugin Config: `~/.config/opencode/kiro.json`
 
 **Windows:**
+
 - SQLite Database: `%APPDATA%\opencode\kiro.db`
 - Plugin Config: `%APPDATA%\opencode\kiro.json`
 

package/dist/plugin/accounts.js

@@ -1,5 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { decodeRefreshToken, encodeRefreshToken } from '../kiro/auth';
+import { isPermanentError } from './health';
+import * as logger from './logger';
 import { kiroDb } from './storage/sqlite';
 import { writeToKiroCli } from './sync/kiro-cli';
 export function generateAccountId() {
@@ -72,6 +74,9 @@ export class AccountManager {
         const now = Date.now();
         const available = this.accounts.filter((a) => {
             if (!a.isHealthy) {
+                if (isPermanentError(a.unhealthyReason)) {
+                    return false;
+                }
                 if (a.failCount < 10 && a.recoveryTime && now >= a.recoveryTime) {
                     a.isHealthy = true;
                     delete a.unhealthyReason;
@@ -97,7 +102,7 @@ export class AccountManager {
         }
         if (!selected) {
             const fallback = this.accounts
-                .filter((a) => !a.isHealthy && a.failCount < 10)
+                .filter((a) => !a.isHealthy && a.failCount < 10 && !isPermanentError(a.unhealthyReason))
                 .sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
             if (fallback) {
                 fallback.isHealthy = true;
@@ -121,8 +126,10 @@ export class AccountManager {
             a.limitCount = meta.limitCount;
             if (meta.email)
                 a.email = meta.email;
-            a.failCount = 0;
-            kiroDb.upsertAccount(a);
+            if (!isPermanentError(a.unhealthyReason)) {
+                a.failCount = 0;
+            }
+            kiroDb.upsertAccount(a).catch(() => { });
         }
     }
     addAccount(a) {
@@ -131,14 +138,14 @@ export class AccountManager {
             this.accounts.push(a);
         else
             this.accounts[i] = a;
-        kiroDb.upsertAccount(a);
+        kiroDb.upsertAccount(a).catch(() => { });
     }
     removeAccount(a) {
         const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id);
+        kiroDb.deleteAccount(a.id).catch(() => { });
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)
@@ -161,7 +168,10 @@ export class AccountManager {
             if (p.clientId)
                 acc.clientId = p.clientId;
             acc.failCount = 0;
-            kiroDb.upsertAccount(acc);
+            acc.isHealthy = true;
+            delete acc.unhealthyReason;
+            delete acc.recoveryTime;
+            kiroDb.upsertAccount(acc).catch(() => { });
             writeToKiroCli(acc).catch(() => { });
         }
     }
@@ -169,12 +179,26 @@ export class AccountManager {
         const acc = this.accounts.find((x) => x.id === a.id);
         if (acc) {
             acc.rateLimitResetTime = Date.now() + ms;
-            kiroDb.upsertAccount(acc);
+            kiroDb.upsertAccount(acc).catch(() => { });
         }
     }
     markUnhealthy(a, reason, recovery) {
         const acc = this.accounts.find((x) => x.id === a.id);
-        if (acc) {
+        if (!acc)
+            return;
+        const isPermanent = isPermanentError(reason);
+        if (isPermanent) {
+            logger.warn('Account marked as permanently unhealthy', {
+                email: acc.email,
+                reason,
+                accountId: acc.id
+            });
+            acc.failCount = 10;
+            acc.isHealthy = false;
+            acc.unhealthyReason = reason;
+            delete acc.recoveryTime;
+        }
+        else {
             acc.failCount = (acc.failCount || 0) + 1;
             acc.unhealthyReason = reason;
             acc.lastUsed = Date.now();
@@ -182,12 +206,11 @@ export class AccountManager {
                 acc.isHealthy = false;
                 acc.recoveryTime = recovery || Date.now() + 3600000;
             }
-            kiroDb.upsertAccount(acc);
         }
+        kiroDb.upsertAccount(acc).catch(() => { });
     }
     async saveToDisk() {
-        for (const a of this.accounts)
-            kiroDb.upsertAccount(a);
+        await kiroDb.batchUpsertAccounts(this.accounts);
     }
     toAuthDetails(a) {
         const p = {

package/dist/plugin/health.d.ts

@@ -0,0 +1 @@
+export declare function isPermanentError(reason?: string): boolean;

package/dist/plugin/health.js

@@ -0,0 +1,9 @@
+export function isPermanentError(reason) {
+    if (!reason)
+        return false;
+    return (reason.includes('Invalid refresh token') ||
+        reason.includes('ExpiredTokenException') ||
+        reason.includes('InvalidTokenException') ||
+        reason.includes('HTTP_401') ||
+        reason.includes('HTTP_403'));
+}

package/dist/plugin/storage/locked-operations.d.ts

@@ -0,0 +1,5 @@
+import type { ManagedAccount } from '../types';
+export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
+export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
+export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
+export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];

package/dist/plugin/storage/locked-operations.js

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto';
+import { existsSync, promises as fs } from 'node:fs';
+import lockfile from 'proper-lockfile';
+import { isPermanentError } from '../health';
+const LOCK_OPTIONS = {
+    stale: 10000,
+    retries: {
+        retries: 5,
+        minTimeout: 100,
+        maxTimeout: 1000,
+        factor: 2
+    },
+    realpath: false
+};
+export async function withDatabaseLock(dbPath, fn) {
+    const lockPath = `${dbPath}.lock`;
+    if (!existsSync(dbPath)) {
+        const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));
+        await fs.mkdir(dir, { recursive: true });
+        await fs.writeFile(dbPath, '');
+    }
+    let release = null;
+    try {
+        release = await lockfile.lock(dbPath, LOCK_OPTIONS);
+        return await fn();
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch (e) {
+                console.warn('Failed to release lock:', e);
+            }
+        }
+    }
+}
+export function createDeterministicId(email, authMethod, clientId, profileArn) {
+    const parts = [email, authMethod, clientId || '', profileArn || ''].join(':');
+    return createHash('sha256').update(parts).digest('hex');
+}
+export function mergeAccounts(existing, incoming) {
+    const accountMap = new Map();
+    for (const acc of existing) {
+        accountMap.set(acc.id, acc);
+    }
+    for (const acc of incoming) {
+        const existingAcc = accountMap.get(acc.id);
+        if (existingAcc) {
+            const hasPermanentError = isPermanentError(existingAcc.unhealthyReason) || isPermanentError(acc.unhealthyReason);
+            accountMap.set(acc.id, {
+                ...existingAcc,
+                ...acc,
+                lastUsed: Math.max(existingAcc.lastUsed || 0, acc.lastUsed || 0),
+                usedCount: Math.max(existingAcc.usedCount || 0, acc.usedCount || 0),
+                limitCount: Math.max(existingAcc.limitCount || 0, acc.limitCount || 0),
+                rateLimitResetTime: Math.max(existingAcc.rateLimitResetTime || 0, acc.rateLimitResetTime || 0),
+                isHealthy: hasPermanentError ? false : existingAcc.isHealthy || acc.isHealthy,
+                failCount: Math.max(existingAcc.failCount || 0, acc.failCount || 0),
+                lastSync: Math.max(existingAcc.lastSync || 0, acc.lastSync || 0)
+            });
+        }
+        else {
+            accountMap.set(acc.id, acc);
+        }
+    }
+    return Array.from(accountMap.values());
+}
+export function deduplicateAccounts(accounts) {
+    const accountMap = new Map();
+    for (const acc of accounts) {
+        const existing = accountMap.get(acc.id);
+        if (!existing) {
+            accountMap.set(acc.id, acc);
+            continue;
+        }
+        const currLastUsed = acc.lastUsed || 0;
+        const existLastUsed = existing.lastUsed || 0;
+        if (currLastUsed > existLastUsed) {
+            accountMap.set(acc.id, acc);
+        }
+        else if (currLastUsed === existLastUsed) {
+            const currAddedAt = acc.expiresAt || 0;
+            const existAddedAt = existing.expiresAt || 0;
+            if (currAddedAt > existAddedAt) {
+                accountMap.set(acc.id, acc);
+            }
+        }
+    }
+    return Array.from(accountMap.values());
+}

package/dist/plugin/storage/migration.js

@@ -26,9 +26,10 @@ export async function migrateJsonToSqlite() {
             const accData = JSON.parse(await fs.readFile(accPath, 'utf-8'));
             const useData = useExists ? JSON.parse(await fs.readFile(usePath, 'utf-8')) : { usage: {} };
             if (accData.accounts && Array.isArray(accData.accounts)) {
+                const accounts = [];
                 for (const acc of accData.accounts) {
                     const usage = useData.usage[acc.id] || {};
-                    kiroDb.upsertAccount({
+                    accounts.push({
                         ...acc,
                         email: acc.realEmail || acc.email,
                         rateLimitResetTime: acc.rateLimitResetTime || 0,
@@ -40,6 +41,7 @@ export async function migrateJsonToSqlite() {
                         lastSync: usage.lastSync || 0
                     });
                 }
+                await kiroDb.batchUpsertAccounts(accounts);
             }
             await fs.rename(accPath, accPath + '.bak');
             if (useExists)

package/dist/plugin/storage/sqlite.d.ts

@@ -1,11 +1,17 @@
+import type { ManagedAccount } from '../types';
 export declare const DB_PATH: string;
 export declare class KiroDatabase {
     private db;
+    private path;
     constructor(path?: string);
     private init;
     getAccounts(): any[];
-    upsertAccount(acc: any): void;
-    deleteAccount(id: string): void;
+    private upsertAccountInternal;
+    upsertAccount(acc: ManagedAccount): Promise<void>;
+    batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
+    deleteAccount(id: string): Promise<void>;
+    private rowToAccount;
     close(): void;
 }
+export declare function createDatabase(path?: string): KiroDatabase;
 export declare const kiroDb: KiroDatabase;

package/dist/plugin/storage/sqlite.js

@@ -2,6 +2,7 @@ import { Database } from 'bun:sqlite';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLock } from './locked-operations';
 function getBaseDir() {
     const p = process.platform;
     if (p === 'win32')
@@ -11,7 +12,9 @@ function getBaseDir() {
 export const DB_PATH = join(getBaseDir(), 'kiro.db');
 export class KiroDatabase {
     db;
+    path;
     constructor(path = DB_PATH) {
+        this.path = path;
         const dir = join(path, '..');
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
@@ -87,7 +90,7 @@ export class KiroDatabase {
     getAccounts() {
         return this.db.prepare('SELECT * FROM accounts').all();
     }
-    upsertAccount(acc) {
+    upsertAccountInternal(acc) {
         this.db
             .prepare(`
       INSERT INTO accounts (
@@ -108,11 +111,75 @@ export class KiroDatabase {
     `)
             .run(acc.id, acc.email, acc.authMethod, acc.region, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
     }
-    deleteAccount(id) {
-        this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+    async upsertAccount(acc) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, [acc]);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.run('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.run('COMMIT');
+            }
+            catch (e) {
+                this.db.run('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async batchUpsertAccounts(accounts) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, accounts);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.run('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.run('COMMIT');
+            }
+            catch (e) {
+                this.db.run('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async deleteAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+        });
+    }
+    rowToAccount(row) {
+        return {
+            id: row.id,
+            email: row.email,
+            authMethod: row.auth_method,
+            region: row.region,
+            clientId: row.client_id,
+            clientSecret: row.client_secret,
+            profileArn: row.profile_arn,
+            refreshToken: row.refresh_token,
+            accessToken: row.access_token,
+            expiresAt: row.expires_at,
+            rateLimitResetTime: row.rate_limit_reset,
+            isHealthy: row.is_healthy === 1,
+            unhealthyReason: row.unhealthy_reason,
+            recoveryTime: row.recovery_time,
+            failCount: row.fail_count,
+            lastUsed: row.last_used,
+            usedCount: row.used_count,
+            limitCount: row.limit_count,
+            lastSync: row.last_sync
+        };
     }
     close() {
         this.db.close();
     }
 }
+export function createDatabase(path) {
+    return new KiroDatabase(path);
+}
 export const kiroDb = new KiroDatabase();

package/dist/plugin/sync/kiro-cli.js

@@ -1,4 +1,5 @@
 import { Database } from 'bun:sqlite';
+import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
@@ -7,6 +8,9 @@ import * as logger from '../logger';
 import { kiroDb } from '../storage/sqlite';
 import { fetchUsageLimits } from '../usage';
 function getCliDbPath() {
+    const override = process.env.KIROCLI_DB_PATH;
+    if (override)
+        return override;
     const p = platform();
     if (p === 'win32')
         return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'kiro-cli', 'data.sqlite3');
@@ -14,6 +18,65 @@ function getCliDbPath() {
         return join(homedir(), 'Library', 'Application Support', 'kiro-cli', 'data.sqlite3');
     return join(homedir(), '.local', 'share', 'kiro-cli', 'data.sqlite3');
 }
+function safeJsonParse(value) {
+    if (typeof value !== 'string')
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeExpiresAt(input) {
+    if (typeof input === 'number') {
+        // Heuristic: < 10^10 is likely seconds.
+        return input < 10_000_000_000 ? input * 1000 : input;
+    }
+    if (typeof input === 'string' && input.trim()) {
+        const t = new Date(input).getTime();
+        if (!Number.isNaN(t) && t > 0)
+            return t;
+        const n = Number(input);
+        if (Number.isFinite(n) && n > 0)
+            return normalizeExpiresAt(n);
+    }
+    return 0;
+}
+function findClientCredsRecursive(input) {
+    const root = input;
+    if (!root || typeof root !== 'object')
+        return {};
+    const stack = [root];
+    const visited = new Set();
+    while (stack.length) {
+        const cur = stack.pop();
+        if (!cur || typeof cur !== 'object')
+            continue;
+        if (visited.has(cur))
+            continue;
+        visited.add(cur);
+        const clientId = cur.client_id || cur.clientId;
+        const clientSecret = cur.client_secret || cur.clientSecret;
+        if (typeof clientId === 'string' && typeof clientSecret === 'string') {
+            if (clientId && clientSecret)
+                return { clientId, clientSecret };
+        }
+        if (Array.isArray(cur)) {
+            for (const v of cur)
+                stack.push(v);
+            continue;
+        }
+        for (const v of Object.values(cur))
+            stack.push(v);
+    }
+    return {};
+}
+function makePlaceholderEmail(authMethod, region, clientId, profileArn) {
+    const seed = `${authMethod}:${region}:${clientId || ''}:${profileArn || ''}`;
+    const h = createHash('sha256').update(seed).digest('hex').slice(0, 16);
+    return `${authMethod}-placeholder+${h}@awsapps.local`;
+}
 export async function syncFromKiroCli() {
     const dbPath = getCliDbPath();
     if (!existsSync(dbPath))
@@ -22,66 +85,130 @@ export async function syncFromKiroCli() {
         const cliDb = new Database(dbPath, { readonly: true });
         cliDb.run('PRAGMA busy_timeout = 5000');
         const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
+        const deviceRegRow = rows.find((r) => typeof r?.key === 'string' && r.key.includes('device-registration'));
+        const deviceReg = safeJsonParse(deviceRegRow?.value);
+        const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
         for (const row of rows) {
             if (row.key.includes(':token')) {
-                let data;
-                try {
-                    data = JSON.parse(row.value);
-                }
-                catch {
+                const data = safeJsonParse(row.value);
+                if (!data)
                     continue;
-                }
-                if (!data.access_token)
-                    continue;
-                const authMethod = row.key.includes('odic') ? 'idc' : 'desktop';
+                const isIdc = row.key.includes('odic');
+                const authMethod = isIdc ? 'idc' : 'desktop';
                 const region = data.region || 'us-east-1';
-                const clientId = data.client_id ||
-                    (authMethod === 'idc'
-                        ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
-                            .client_id
-                        : undefined);
-                const clientSecret = data.client_secret ||
-                    (authMethod === 'idc'
-                        ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
-                            .client_secret
-                        : undefined);
+                const profileArn = data.profile_arn || data.profileArn;
+                const accessToken = data.access_token || data.accessToken || '';
+                const refreshToken = data.refresh_token || data.refreshToken;
+                if (!refreshToken)
+                    continue;
+                const clientId = data.client_id || data.clientId || (isIdc ? regCreds.clientId : undefined);
+                const clientSecret = data.client_secret || data.clientSecret || (isIdc ? regCreds.clientSecret : undefined);
+                if (authMethod === 'idc' && (!clientId || !clientSecret)) {
+                    logger.warn('Kiro CLI sync: missing IDC device credentials; skipping token import');
+                    continue;
+                }
+                const cliExpiresAt = normalizeExpiresAt(data.expires_at ?? data.expiresAt) || Date.now() + 3600000;
+                let usedCount = 0;
+                let limitCount = 0;
+                let email;
+                let usageOk = false;
                 try {
-                    const u = await fetchUsageLimits({
+                    const authForUsage = {
                         refresh: '',
-                        access: data.access_token,
-                        expires: 0,
-                        authMethod,
-                        region,
-                        clientId,
-                        clientSecret
-                    });
-                    const email = u.email;
-                    if (!email)
-                        continue;
-                    const id = createDeterministicAccountId(email, authMethod, clientId, data.profile_arn);
-                    const existing = kiroDb.getAccounts().find((a) => a.id === id);
-                    const cliExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() : 0;
-                    if (existing && existing.is_healthy === 1 && existing.expires_at >= cliExpiresAt)
-                        continue;
-                    kiroDb.upsertAccount({
-                        id,
-                        email,
+                        access: accessToken,
+                        expires: cliExpiresAt,
                         authMethod,
                         region,
+                        profileArn,
                         clientId,
                         clientSecret,
-                        profileArn: data.profile_arn,
-                        refreshToken: data.refresh_token,
-                        accessToken: data.access_token,
-                        expiresAt: cliExpiresAt || Date.now() + 3600000,
-                        isHealthy: 1,
-                        failCount: 0,
-                        usedCount: u.usedCount,
-                        limitCount: u.limitCount,
-                        lastSync: Date.now()
+                        email: ''
+                    };
+                    const u = await fetchUsageLimits(authForUsage);
+                    usedCount = u.usedCount || 0;
+                    limitCount = u.limitCount || 0;
+                    if (typeof u.email === 'string' && u.email) {
+                        email = u.email;
+                        usageOk = true;
+                    }
+                }
+                catch (e) {
+                    logger.warn('Kiro CLI sync: failed to fetch usage/email; falling back', {
+                        authMethod,
+                        region
                     });
+                    logger.debug('Kiro CLI sync: usage fetch error', e);
+                }
+                const all = kiroDb.getAccounts();
+                if (!email) {
+                    let existing;
+                    if (profileArn) {
+                        existing = all.find((a) => a.auth_method === authMethod && a.profile_arn === profileArn);
+                    }
+                    if (!existing && authMethod === 'idc' && clientId) {
+                        existing = all.find((a) => a.auth_method === 'idc' && a.client_id === clientId);
+                    }
+                    if (existing && typeof existing.email === 'string' && existing.email) {
+                        email = existing.email;
+                    }
+                    else {
+                        email = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                    }
+                }
+                const resolvedEmail = email || makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, profileArn);
+                const existingById = all.find((a) => a.id === id);
+                if (existingById &&
+                    existingById.is_healthy === 1 &&
+                    existingById.expires_at >= cliExpiresAt)
+                    continue;
+                if (usageOk) {
+                    const placeholderEmail = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                    const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
+                    if (placeholderId !== id) {
+                        const placeholderRow = all.find((a) => a.id === placeholderId);
+                        if (placeholderRow) {
+                            await kiroDb.upsertAccount({
+                                id: placeholderId,
+                                email: placeholderRow.email,
+                                authMethod,
+                                region: placeholderRow.region || region,
+                                clientId,
+                                clientSecret,
+                                profileArn,
+                                refreshToken: placeholderRow.refresh_token || refreshToken,
+                                accessToken: placeholderRow.access_token || accessToken,
+                                expiresAt: placeholderRow.expires_at || cliExpiresAt,
+                                rateLimitResetTime: 0,
+                                isHealthy: false,
+                                failCount: 10,
+                                unhealthyReason: 'Replaced by real email',
+                                recoveryTime: Date.now() + 31536000000,
+                                usedCount: placeholderRow.used_count || 0,
+                                limitCount: placeholderRow.limit_count || 0,
+                                lastSync: Date.now()
+                            });
+                        }
+                    }
                 }
-                catch { }
+                await kiroDb.upsertAccount({
+                    id,
+                    email: resolvedEmail,
+                    authMethod,
+                    region,
+                    clientId,
+                    clientSecret,
+                    profileArn,
+                    refreshToken,
+                    accessToken,
+                    expiresAt: cliExpiresAt,
+                    rateLimitResetTime: 0,
+                    isHealthy: true,
+                    failCount: 0,
+                    usedCount,
+                    limitCount,
+                    lastSync: Date.now()
+                });
             }
         }
         cliDb.close();

package/dist/plugin.js

@@ -6,6 +6,7 @@ import { AccountManager, createDeterministicAccountId } from './plugin/accounts'
 import { promptAddAnotherAccount, promptLoginMode } from './plugin/cli';
 import { loadConfig } from './plugin/config';
 import { KiroTokenRefreshError } from './plugin/errors';
+import { isPermanentError } from './plugin/health';
 import * as logger from './plugin/logger';
 import { transformToCodeWhisperer } from './plugin/request';
 import { parseEventStream } from './plugin/response';
@@ -83,6 +84,7 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                         const think = model.endsWith('-thinking') || !!body.providerOptions?.thinkingConfig;
                         const budget = body.providerOptions?.thinkingConfig?.thinkingBudget || 20000;
                         let retry = 0, iterations = 0, reductionFactor = 1.0;
+                        let triedEmptySync = false;
                         const startTime = Date.now(), maxIterations = config.max_request_iterations, timeoutMs = config.request_timeout_ms;
                         while (true) {
                             iterations++;
@@ -90,7 +92,15 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 throw new Error(`Exceeded max iterations (${maxIterations})`);
                             if (Date.now() - startTime > timeoutMs)
                                 throw new Error('Request timeout');
-                            const count = am.getAccountCount();
+                            let count = am.getAccountCount();
+                            if (count === 0 && config.auto_sync_kiro_cli && !triedEmptySync) {
+                                triedEmptySync = true;
+                                await syncFromKiroCli();
+                                const refreshedAm = await AccountManager.loadFromDisk(config.account_selection_strategy);
+                                for (const a of refreshedAm.getAccounts())
+                                    am.addAccount(a);
+                                count = am.getAccountCount();
+                            }
                             if (count === 0)
                                 throw new Error('No accounts');
                             let acc = am.getCurrentOrNext();
@@ -134,7 +144,8 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                         (e.code === 'ExpiredTokenException' ||
                                             e.code === 'InvalidTokenException' ||
                                             e.code === 'HTTP_401' ||
-                                            e.code === 'HTTP_403')) {
+                                            e.code === 'HTTP_403' ||
+                                            e.message.includes('Invalid refresh token provided'))) {
                                         am.markUnhealthy(acc, e.message);
                                         await am.saveToDisk();
                                         continue;
@@ -178,8 +189,10 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 }
                                 if (res.ok) {
                                     if (acc.failCount && acc.failCount > 0) {
-                                        acc.failCount = 0;
-                                        kiroDb.upsertAccount(acc);
+                                        if (!isPermanentError(acc.unhealthyReason)) {
+                                            acc.failCount = 0;
+                                            kiroDb.upsertAccount(acc).catch(() => { });
+                                        }
                                     }
                                     if (config.usage_tracking_enabled) {
                                         const sync = async (att = 0) => {
@@ -193,6 +206,12 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                                     await sleep(1000 * Math.pow(2, att));
                                                     return sync(att + 1);
                                                 }
+                                                if (e.message?.includes('403') ||
+                                                    e.message?.includes('invalid') ||
+                                                    e.message?.includes('bearer token')) {
+                                                    am.markUnhealthy(acc, e.message);
+                                                    am.saveToDisk().catch(() => { });
+                                                }
                                             }
                                         };
                                         sync().catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.4.8",
+  "version": "1.4.11",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",