@zhafron/opencode-kiro-auth 1.4.8 → 1.4.9

package/README.md

@@ -1,4 +1,5 @@
 # OpenCode Kiro Auth Plugin
+
 [![npm version](https://img.shields.io/npm/v/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
 [![npm downloads](https://img.shields.io/npm/dm/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
 [![license](https://img.shields.io/npm/l/@zhafron/opencode-kiro-auth)](https://www.npmjs.com/package/@zhafron/opencode-kiro-auth)
@@ -71,12 +72,25 @@ Add the plugin to your `opencode.json` or `opencode.jsonc`:
 1. **Authentication via Kiro CLI (Recommended)**:
    - Perform login directly in your terminal using `kiro-cli login`.
    - The plugin will automatically detect and import your session on startup.
+   - For AWS IAM Identity Center (SSO/IDC), the plugin imports both the token and device registration (OIDC client credentials) from the `kiro-cli` database.
 2. **Direct Authentication**:
    - Run `opencode auth login`.
    - Select `Other`, type `kiro`, and press enter.
    - Follow the instructions for **AWS Builder ID (IDC)**.
 3. Configuration will be automatically managed at `~/.config/opencode/kiro.db`.
 
+## Troubleshooting
+
+### Error: No accounts
+
+This happens when the plugin has no records in `~/.config/opencode/kiro.db`.
+
+1. Ensure `kiro-cli login` succeeds.
+2. Ensure `auto_sync_kiro_cli` is `true` in `~/.config/opencode/kiro.json`.
+3. Retry the request; the plugin will attempt a Kiro CLI sync when it detects zero accounts.
+
+Note for IDC/SSO (ODIC): the plugin may temporarily create an account with a placeholder email if it cannot fetch the real email during sync (e.g. offline). It will replace it with the real email once usage/email lookup succeeds.
+
 ## Configuration
 
 The plugin supports extensive configuration options. Edit `~/.config/opencode/kiro.json`:
@@ -118,10 +132,12 @@ The plugin supports extensive configuration options. Edit `~/.config/opencode/ki
 ## Storage
 
 **Linux/macOS:**
+
 - SQLite Database: `~/.config/opencode/kiro.db`
 - Plugin Config: `~/.config/opencode/kiro.json`
 
 **Windows:**
+
 - SQLite Database: `%APPDATA%\opencode\kiro.db`
 - Plugin Config: `%APPDATA%\opencode\kiro.json`
 

package/dist/plugin/sync/kiro-cli.js

@@ -1,4 +1,5 @@
 import { Database } from 'bun:sqlite';
+import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
@@ -7,6 +8,9 @@ import * as logger from '../logger';
 import { kiroDb } from '../storage/sqlite';
 import { fetchUsageLimits } from '../usage';
 function getCliDbPath() {
+    const override = process.env.KIROCLI_DB_PATH;
+    if (override)
+        return override;
     const p = platform();
     if (p === 'win32')
         return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'kiro-cli', 'data.sqlite3');
@@ -14,6 +18,65 @@ function getCliDbPath() {
         return join(homedir(), 'Library', 'Application Support', 'kiro-cli', 'data.sqlite3');
     return join(homedir(), '.local', 'share', 'kiro-cli', 'data.sqlite3');
 }
+function safeJsonParse(value) {
+    if (typeof value !== 'string')
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeExpiresAt(input) {
+    if (typeof input === 'number') {
+        // Heuristic: < 10^10 is likely seconds.
+        return input < 10_000_000_000 ? input * 1000 : input;
+    }
+    if (typeof input === 'string' && input.trim()) {
+        const t = new Date(input).getTime();
+        if (!Number.isNaN(t) && t > 0)
+            return t;
+        const n = Number(input);
+        if (Number.isFinite(n) && n > 0)
+            return normalizeExpiresAt(n);
+    }
+    return 0;
+}
+function findClientCredsRecursive(input) {
+    const root = input;
+    if (!root || typeof root !== 'object')
+        return {};
+    const stack = [root];
+    const visited = new Set();
+    while (stack.length) {
+        const cur = stack.pop();
+        if (!cur || typeof cur !== 'object')
+            continue;
+        if (visited.has(cur))
+            continue;
+        visited.add(cur);
+        const clientId = cur.client_id || cur.clientId;
+        const clientSecret = cur.client_secret || cur.clientSecret;
+        if (typeof clientId === 'string' && typeof clientSecret === 'string') {
+            if (clientId && clientSecret)
+                return { clientId, clientSecret };
+        }
+        if (Array.isArray(cur)) {
+            for (const v of cur)
+                stack.push(v);
+            continue;
+        }
+        for (const v of Object.values(cur))
+            stack.push(v);
+    }
+    return {};
+}
+function makePlaceholderEmail(authMethod, region, clientId, profileArn) {
+    const seed = `${authMethod}:${region}:${clientId || ''}:${profileArn || ''}`;
+    const h = createHash('sha256').update(seed).digest('hex').slice(0, 16);
+    return `${authMethod}-placeholder+${h}@awsapps.local`;
+}
 export async function syncFromKiroCli() {
     const dbPath = getCliDbPath();
     if (!existsSync(dbPath))
@@ -22,66 +85,128 @@ export async function syncFromKiroCli() {
         const cliDb = new Database(dbPath, { readonly: true });
         cliDb.run('PRAGMA busy_timeout = 5000');
         const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
+        const deviceRegRow = rows.find((r) => typeof r?.key === 'string' && r.key.includes('device-registration'));
+        const deviceReg = safeJsonParse(deviceRegRow?.value);
+        const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
         for (const row of rows) {
             if (row.key.includes(':token')) {
-                let data;
-                try {
-                    data = JSON.parse(row.value);
-                }
-                catch {
+                const data = safeJsonParse(row.value);
+                if (!data)
                     continue;
-                }
-                if (!data.access_token)
-                    continue;
-                const authMethod = row.key.includes('odic') ? 'idc' : 'desktop';
+                const isIdc = row.key.includes('odic');
+                const authMethod = isIdc ? 'idc' : 'desktop';
                 const region = data.region || 'us-east-1';
-                const clientId = data.client_id ||
-                    (authMethod === 'idc'
-                        ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
-                            .client_id
-                        : undefined);
-                const clientSecret = data.client_secret ||
-                    (authMethod === 'idc'
-                        ? JSON.parse(rows.find((r) => r.key.includes('device-registration'))?.value || '{}')
-                            .client_secret
-                        : undefined);
+                const profileArn = data.profile_arn || data.profileArn;
+                const accessToken = data.access_token || data.accessToken || '';
+                const refreshToken = data.refresh_token || data.refreshToken;
+                if (!refreshToken)
+                    continue;
+                const clientId = data.client_id || data.clientId || (isIdc ? regCreds.clientId : undefined);
+                const clientSecret = data.client_secret || data.clientSecret || (isIdc ? regCreds.clientSecret : undefined);
+                if (authMethod === 'idc' && (!clientId || !clientSecret)) {
+                    logger.warn('Kiro CLI sync: missing IDC device credentials; skipping token import');
+                    continue;
+                }
+                const cliExpiresAt = normalizeExpiresAt(data.expires_at ?? data.expiresAt) || Date.now() + 3600000;
+                let usedCount = 0;
+                let limitCount = 0;
+                let email;
+                let usageOk = false;
                 try {
-                    const u = await fetchUsageLimits({
+                    const authForUsage = {
                         refresh: '',
-                        access: data.access_token,
-                        expires: 0,
-                        authMethod,
-                        region,
-                        clientId,
-                        clientSecret
-                    });
-                    const email = u.email;
-                    if (!email)
-                        continue;
-                    const id = createDeterministicAccountId(email, authMethod, clientId, data.profile_arn);
-                    const existing = kiroDb.getAccounts().find((a) => a.id === id);
-                    const cliExpiresAt = data.expires_at ? new Date(data.expires_at).getTime() : 0;
-                    if (existing && existing.is_healthy === 1 && existing.expires_at >= cliExpiresAt)
-                        continue;
-                    kiroDb.upsertAccount({
-                        id,
-                        email,
+                        access: accessToken,
+                        expires: cliExpiresAt,
                         authMethod,
                         region,
+                        profileArn,
                         clientId,
                         clientSecret,
-                        profileArn: data.profile_arn,
-                        refreshToken: data.refresh_token,
-                        accessToken: data.access_token,
-                        expiresAt: cliExpiresAt || Date.now() + 3600000,
-                        isHealthy: 1,
-                        failCount: 0,
-                        usedCount: u.usedCount,
-                        limitCount: u.limitCount,
-                        lastSync: Date.now()
+                        email: ''
+                    };
+                    const u = await fetchUsageLimits(authForUsage);
+                    usedCount = u.usedCount || 0;
+                    limitCount = u.limitCount || 0;
+                    if (typeof u.email === 'string' && u.email) {
+                        email = u.email;
+                        usageOk = true;
+                    }
+                }
+                catch (e) {
+                    logger.warn('Kiro CLI sync: failed to fetch usage/email; falling back', {
+                        authMethod,
+                        region
                     });
+                    logger.debug('Kiro CLI sync: usage fetch error', e);
+                }
+                const all = kiroDb.getAccounts();
+                if (!email) {
+                    let existing;
+                    if (profileArn) {
+                        existing = all.find((a) => a.auth_method === authMethod && a.profile_arn === profileArn);
+                    }
+                    if (!existing && authMethod === 'idc' && clientId) {
+                        existing = all.find((a) => a.auth_method === 'idc' && a.client_id === clientId);
+                    }
+                    if (existing && typeof existing.email === 'string' && existing.email) {
+                        email = existing.email;
+                    }
+                    else {
+                        email = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                    }
+                }
+                const resolvedEmail = email || makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, profileArn);
+                const existingById = all.find((a) => a.id === id);
+                if (existingById &&
+                    existingById.is_healthy === 1 &&
+                    existingById.expires_at >= cliExpiresAt)
+                    continue;
+                if (usageOk) {
+                    const placeholderEmail = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                    const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
+                    if (placeholderId !== id) {
+                        const placeholderRow = all.find((a) => a.id === placeholderId);
+                        if (placeholderRow) {
+                            kiroDb.upsertAccount({
+                                id: placeholderId,
+                                email: placeholderRow.email,
+                                authMethod,
+                                region: placeholderRow.region || region,
+                                clientId,
+                                clientSecret,
+                                profileArn,
+                                refreshToken: placeholderRow.refresh_token || refreshToken,
+                                accessToken: placeholderRow.access_token || accessToken,
+                                expiresAt: placeholderRow.expires_at || cliExpiresAt,
+                                isHealthy: 0,
+                                failCount: 10,
+                                unhealthyReason: 'Replaced by real email',
+                                recoveryTime: Date.now() + 31536000000,
+                                usedCount: placeholderRow.used_count || 0,
+                                limitCount: placeholderRow.limit_count || 0,
+                                lastSync: Date.now()
+                            });
+                        }
+                    }
                 }
-                catch { }
+                kiroDb.upsertAccount({
+                    id,
+                    email: resolvedEmail,
+                    authMethod,
+                    region,
+                    clientId,
+                    clientSecret,
+                    profileArn,
+                    refreshToken,
+                    accessToken,
+                    expiresAt: cliExpiresAt,
+                    isHealthy: 1,
+                    failCount: 0,
+                    usedCount,
+                    limitCount,
+                    lastSync: Date.now()
+                });
             }
         }
         cliDb.close();

package/dist/plugin.js

@@ -83,6 +83,7 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                         const think = model.endsWith('-thinking') || !!body.providerOptions?.thinkingConfig;
                         const budget = body.providerOptions?.thinkingConfig?.thinkingBudget || 20000;
                         let retry = 0, iterations = 0, reductionFactor = 1.0;
+                        let triedEmptySync = false;
                         const startTime = Date.now(), maxIterations = config.max_request_iterations, timeoutMs = config.request_timeout_ms;
                         while (true) {
                             iterations++;
@@ -90,7 +91,15 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 throw new Error(`Exceeded max iterations (${maxIterations})`);
                             if (Date.now() - startTime > timeoutMs)
                                 throw new Error('Request timeout');
-                            const count = am.getAccountCount();
+                            let count = am.getAccountCount();
+                            if (count === 0 && config.auto_sync_kiro_cli && !triedEmptySync) {
+                                triedEmptySync = true;
+                                await syncFromKiroCli();
+                                const refreshedAm = await AccountManager.loadFromDisk(config.account_selection_strategy);
+                                for (const a of refreshedAm.getAccounts())
+                                    am.addAccount(a);
+                                count = am.getAccountCount();
+                            }
                             if (count === 0)
                                 throw new Error('No accounts');
                             let acc = am.getCurrentOrNext();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",