@zhafron/opencode-kiro-auth 1.4.9 → 1.4.11

package/dist/plugin/accounts.js

@@ -1,5 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { decodeRefreshToken, encodeRefreshToken } from '../kiro/auth';
+import { isPermanentError } from './health';
+import * as logger from './logger';
 import { kiroDb } from './storage/sqlite';
 import { writeToKiroCli } from './sync/kiro-cli';
 export function generateAccountId() {
@@ -72,6 +74,9 @@ export class AccountManager {
         const now = Date.now();
         const available = this.accounts.filter((a) => {
             if (!a.isHealthy) {
+                if (isPermanentError(a.unhealthyReason)) {
+                    return false;
+                }
                 if (a.failCount < 10 && a.recoveryTime && now >= a.recoveryTime) {
                     a.isHealthy = true;
                     delete a.unhealthyReason;
@@ -97,7 +102,7 @@ export class AccountManager {
         }
         if (!selected) {
             const fallback = this.accounts
-                .filter((a) => !a.isHealthy && a.failCount < 10)
+                .filter((a) => !a.isHealthy && a.failCount < 10 && !isPermanentError(a.unhealthyReason))
                 .sort((a, b) => (a.usedCount || 0) - (b.usedCount || 0) || (a.lastUsed || 0) - (b.lastUsed || 0))[0];
             if (fallback) {
                 fallback.isHealthy = true;
@@ -121,8 +126,10 @@ export class AccountManager {
             a.limitCount = meta.limitCount;
             if (meta.email)
                 a.email = meta.email;
-            a.failCount = 0;
-            kiroDb.upsertAccount(a);
+            if (!isPermanentError(a.unhealthyReason)) {
+                a.failCount = 0;
+            }
+            kiroDb.upsertAccount(a).catch(() => { });
         }
     }
     addAccount(a) {
@@ -131,14 +138,14 @@ export class AccountManager {
             this.accounts.push(a);
         else
             this.accounts[i] = a;
-        kiroDb.upsertAccount(a);
+        kiroDb.upsertAccount(a).catch(() => { });
     }
     removeAccount(a) {
         const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id);
+        kiroDb.deleteAccount(a.id).catch(() => { });
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)
@@ -161,7 +168,10 @@ export class AccountManager {
             if (p.clientId)
                 acc.clientId = p.clientId;
             acc.failCount = 0;
-            kiroDb.upsertAccount(acc);
+            acc.isHealthy = true;
+            delete acc.unhealthyReason;
+            delete acc.recoveryTime;
+            kiroDb.upsertAccount(acc).catch(() => { });
             writeToKiroCli(acc).catch(() => { });
         }
     }
@@ -169,12 +179,26 @@ export class AccountManager {
         const acc = this.accounts.find((x) => x.id === a.id);
         if (acc) {
             acc.rateLimitResetTime = Date.now() + ms;
-            kiroDb.upsertAccount(acc);
+            kiroDb.upsertAccount(acc).catch(() => { });
         }
     }
     markUnhealthy(a, reason, recovery) {
         const acc = this.accounts.find((x) => x.id === a.id);
-        if (acc) {
+        if (!acc)
+            return;
+        const isPermanent = isPermanentError(reason);
+        if (isPermanent) {
+            logger.warn('Account marked as permanently unhealthy', {
+                email: acc.email,
+                reason,
+                accountId: acc.id
+            });
+            acc.failCount = 10;
+            acc.isHealthy = false;
+            acc.unhealthyReason = reason;
+            delete acc.recoveryTime;
+        }
+        else {
             acc.failCount = (acc.failCount || 0) + 1;
             acc.unhealthyReason = reason;
             acc.lastUsed = Date.now();
@@ -182,12 +206,11 @@ export class AccountManager {
                 acc.isHealthy = false;
                 acc.recoveryTime = recovery || Date.now() + 3600000;
             }
-            kiroDb.upsertAccount(acc);
         }
+        kiroDb.upsertAccount(acc).catch(() => { });
     }
     async saveToDisk() {
-        for (const a of this.accounts)
-            kiroDb.upsertAccount(a);
+        await kiroDb.batchUpsertAccounts(this.accounts);
     }
     toAuthDetails(a) {
         const p = {

package/dist/plugin/health.d.ts

@@ -0,0 +1 @@
+export declare function isPermanentError(reason?: string): boolean;

package/dist/plugin/health.js

@@ -0,0 +1,9 @@
+export function isPermanentError(reason) {
+    if (!reason)
+        return false;
+    return (reason.includes('Invalid refresh token') ||
+        reason.includes('ExpiredTokenException') ||
+        reason.includes('InvalidTokenException') ||
+        reason.includes('HTTP_401') ||
+        reason.includes('HTTP_403'));
+}

package/dist/plugin/storage/locked-operations.d.ts

@@ -0,0 +1,5 @@
+import type { ManagedAccount } from '../types';
+export declare function withDatabaseLock<T>(dbPath: string, fn: () => Promise<T>): Promise<T>;
+export declare function createDeterministicId(email: string, authMethod: string, clientId?: string, profileArn?: string): string;
+export declare function mergeAccounts(existing: ManagedAccount[], incoming: ManagedAccount[]): ManagedAccount[];
+export declare function deduplicateAccounts(accounts: ManagedAccount[]): ManagedAccount[];

package/dist/plugin/storage/locked-operations.js

@@ -0,0 +1,91 @@
+import { createHash } from 'node:crypto';
+import { existsSync, promises as fs } from 'node:fs';
+import lockfile from 'proper-lockfile';
+import { isPermanentError } from '../health';
+const LOCK_OPTIONS = {
+    stale: 10000,
+    retries: {
+        retries: 5,
+        minTimeout: 100,
+        maxTimeout: 1000,
+        factor: 2
+    },
+    realpath: false
+};
+export async function withDatabaseLock(dbPath, fn) {
+    const lockPath = `${dbPath}.lock`;
+    if (!existsSync(dbPath)) {
+        const dir = dbPath.substring(0, dbPath.lastIndexOf('/'));
+        await fs.mkdir(dir, { recursive: true });
+        await fs.writeFile(dbPath, '');
+    }
+    let release = null;
+    try {
+        release = await lockfile.lock(dbPath, LOCK_OPTIONS);
+        return await fn();
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch (e) {
+                console.warn('Failed to release lock:', e);
+            }
+        }
+    }
+}
+export function createDeterministicId(email, authMethod, clientId, profileArn) {
+    const parts = [email, authMethod, clientId || '', profileArn || ''].join(':');
+    return createHash('sha256').update(parts).digest('hex');
+}
+export function mergeAccounts(existing, incoming) {
+    const accountMap = new Map();
+    for (const acc of existing) {
+        accountMap.set(acc.id, acc);
+    }
+    for (const acc of incoming) {
+        const existingAcc = accountMap.get(acc.id);
+        if (existingAcc) {
+            const hasPermanentError = isPermanentError(existingAcc.unhealthyReason) || isPermanentError(acc.unhealthyReason);
+            accountMap.set(acc.id, {
+                ...existingAcc,
+                ...acc,
+                lastUsed: Math.max(existingAcc.lastUsed || 0, acc.lastUsed || 0),
+                usedCount: Math.max(existingAcc.usedCount || 0, acc.usedCount || 0),
+                limitCount: Math.max(existingAcc.limitCount || 0, acc.limitCount || 0),
+                rateLimitResetTime: Math.max(existingAcc.rateLimitResetTime || 0, acc.rateLimitResetTime || 0),
+                isHealthy: hasPermanentError ? false : existingAcc.isHealthy || acc.isHealthy,
+                failCount: Math.max(existingAcc.failCount || 0, acc.failCount || 0),
+                lastSync: Math.max(existingAcc.lastSync || 0, acc.lastSync || 0)
+            });
+        }
+        else {
+            accountMap.set(acc.id, acc);
+        }
+    }
+    return Array.from(accountMap.values());
+}
+export function deduplicateAccounts(accounts) {
+    const accountMap = new Map();
+    for (const acc of accounts) {
+        const existing = accountMap.get(acc.id);
+        if (!existing) {
+            accountMap.set(acc.id, acc);
+            continue;
+        }
+        const currLastUsed = acc.lastUsed || 0;
+        const existLastUsed = existing.lastUsed || 0;
+        if (currLastUsed > existLastUsed) {
+            accountMap.set(acc.id, acc);
+        }
+        else if (currLastUsed === existLastUsed) {
+            const currAddedAt = acc.expiresAt || 0;
+            const existAddedAt = existing.expiresAt || 0;
+            if (currAddedAt > existAddedAt) {
+                accountMap.set(acc.id, acc);
+            }
+        }
+    }
+    return Array.from(accountMap.values());
+}

package/dist/plugin/storage/migration.js

@@ -26,9 +26,10 @@ export async function migrateJsonToSqlite() {
             const accData = JSON.parse(await fs.readFile(accPath, 'utf-8'));
             const useData = useExists ? JSON.parse(await fs.readFile(usePath, 'utf-8')) : { usage: {} };
             if (accData.accounts && Array.isArray(accData.accounts)) {
+                const accounts = [];
                 for (const acc of accData.accounts) {
                     const usage = useData.usage[acc.id] || {};
-                    kiroDb.upsertAccount({
+                    accounts.push({
                         ...acc,
                         email: acc.realEmail || acc.email,
                         rateLimitResetTime: acc.rateLimitResetTime || 0,
@@ -40,6 +41,7 @@ export async function migrateJsonToSqlite() {
                         lastSync: usage.lastSync || 0
                     });
                 }
+                await kiroDb.batchUpsertAccounts(accounts);
             }
             await fs.rename(accPath, accPath + '.bak');
             if (useExists)

package/dist/plugin/storage/sqlite.d.ts

@@ -1,11 +1,17 @@
+import type { ManagedAccount } from '../types';
 export declare const DB_PATH: string;
 export declare class KiroDatabase {
     private db;
+    private path;
     constructor(path?: string);
     private init;
     getAccounts(): any[];
-    upsertAccount(acc: any): void;
-    deleteAccount(id: string): void;
+    private upsertAccountInternal;
+    upsertAccount(acc: ManagedAccount): Promise<void>;
+    batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
+    deleteAccount(id: string): Promise<void>;
+    private rowToAccount;
     close(): void;
 }
+export declare function createDatabase(path?: string): KiroDatabase;
 export declare const kiroDb: KiroDatabase;

package/dist/plugin/storage/sqlite.js

@@ -2,6 +2,7 @@ import { Database } from 'bun:sqlite';
 import { existsSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLock } from './locked-operations';
 function getBaseDir() {
     const p = process.platform;
     if (p === 'win32')
@@ -11,7 +12,9 @@ function getBaseDir() {
 export const DB_PATH = join(getBaseDir(), 'kiro.db');
 export class KiroDatabase {
     db;
+    path;
     constructor(path = DB_PATH) {
+        this.path = path;
         const dir = join(path, '..');
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
@@ -87,7 +90,7 @@ export class KiroDatabase {
     getAccounts() {
         return this.db.prepare('SELECT * FROM accounts').all();
     }
-    upsertAccount(acc) {
+    upsertAccountInternal(acc) {
         this.db
             .prepare(`
       INSERT INTO accounts (
@@ -108,11 +111,75 @@ export class KiroDatabase {
     `)
             .run(acc.id, acc.email, acc.authMethod, acc.region, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
     }
-    deleteAccount(id) {
-        this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+    async upsertAccount(acc) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, [acc]);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.run('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.run('COMMIT');
+            }
+            catch (e) {
+                this.db.run('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async batchUpsertAccounts(accounts) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, accounts);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.run('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.run('COMMIT');
+            }
+            catch (e) {
+                this.db.run('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async deleteAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+        });
+    }
+    rowToAccount(row) {
+        return {
+            id: row.id,
+            email: row.email,
+            authMethod: row.auth_method,
+            region: row.region,
+            clientId: row.client_id,
+            clientSecret: row.client_secret,
+            profileArn: row.profile_arn,
+            refreshToken: row.refresh_token,
+            accessToken: row.access_token,
+            expiresAt: row.expires_at,
+            rateLimitResetTime: row.rate_limit_reset,
+            isHealthy: row.is_healthy === 1,
+            unhealthyReason: row.unhealthy_reason,
+            recoveryTime: row.recovery_time,
+            failCount: row.fail_count,
+            lastUsed: row.last_used,
+            usedCount: row.used_count,
+            limitCount: row.limit_count,
+            lastSync: row.last_sync
+        };
     }
     close() {
         this.db.close();
     }
 }
+export function createDatabase(path) {
+    return new KiroDatabase(path);
+}
 export const kiroDb = new KiroDatabase();

package/dist/plugin/sync/kiro-cli.js

@@ -168,7 +168,7 @@ export async function syncFromKiroCli() {
                     if (placeholderId !== id) {
                         const placeholderRow = all.find((a) => a.id === placeholderId);
                         if (placeholderRow) {
-                            kiroDb.upsertAccount({
+                            await kiroDb.upsertAccount({
                                 id: placeholderId,
                                 email: placeholderRow.email,
                                 authMethod,
@@ -179,7 +179,8 @@ export async function syncFromKiroCli() {
                                 refreshToken: placeholderRow.refresh_token || refreshToken,
                                 accessToken: placeholderRow.access_token || accessToken,
                                 expiresAt: placeholderRow.expires_at || cliExpiresAt,
-                                isHealthy: 0,
+                                rateLimitResetTime: 0,
+                                isHealthy: false,
                                 failCount: 10,
                                 unhealthyReason: 'Replaced by real email',
                                 recoveryTime: Date.now() + 31536000000,
@@ -190,7 +191,7 @@ export async function syncFromKiroCli() {
                         }
                     }
                 }
-                kiroDb.upsertAccount({
+                await kiroDb.upsertAccount({
                     id,
                     email: resolvedEmail,
                     authMethod,
@@ -201,7 +202,8 @@ export async function syncFromKiroCli() {
                     refreshToken,
                     accessToken,
                     expiresAt: cliExpiresAt,
-                    isHealthy: 1,
+                    rateLimitResetTime: 0,
+                    isHealthy: true,
                     failCount: 0,
                     usedCount,
                     limitCount,

package/dist/plugin.js

@@ -6,6 +6,7 @@ import { AccountManager, createDeterministicAccountId } from './plugin/accounts'
 import { promptAddAnotherAccount, promptLoginMode } from './plugin/cli';
 import { loadConfig } from './plugin/config';
 import { KiroTokenRefreshError } from './plugin/errors';
+import { isPermanentError } from './plugin/health';
 import * as logger from './plugin/logger';
 import { transformToCodeWhisperer } from './plugin/request';
 import { parseEventStream } from './plugin/response';
@@ -143,7 +144,8 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                         (e.code === 'ExpiredTokenException' ||
                                             e.code === 'InvalidTokenException' ||
                                             e.code === 'HTTP_401' ||
-                                            e.code === 'HTTP_403')) {
+                                            e.code === 'HTTP_403' ||
+                                            e.message.includes('Invalid refresh token provided'))) {
                                         am.markUnhealthy(acc, e.message);
                                         await am.saveToDisk();
                                         continue;
@@ -187,8 +189,10 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                 }
                                 if (res.ok) {
                                     if (acc.failCount && acc.failCount > 0) {
-                                        acc.failCount = 0;
-                                        kiroDb.upsertAccount(acc);
+                                        if (!isPermanentError(acc.unhealthyReason)) {
+                                            acc.failCount = 0;
+                                            kiroDb.upsertAccount(acc).catch(() => { });
+                                        }
                                     }
                                     if (config.usage_tracking_enabled) {
                                         const sync = async (att = 0) => {
@@ -202,6 +206,12 @@ export const createKiroPlugin = (id) => async ({ client, directory }) => {
                                                     await sleep(1000 * Math.pow(2, att));
                                                     return sync(att + 1);
                                                 }
+                                                if (e.message?.includes('403') ||
+                                                    e.message?.includes('invalid') ||
+                                                    e.message?.includes('bearer token')) {
+                                                    am.markUnhealthy(acc, e.message);
+                                                    am.saveToDisk().catch(() => { });
+                                                }
                                             }
                                         };
                                         sync().catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.4.9",
+  "version": "1.4.11",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",