@zhafron/opencode-kiro-auth 1.7.0 → 1.8.0

package/dist/core/auth/token-refresher.js

@@ -1,5 +1,6 @@
 import { accessTokenExpired } from '../../kiro/auth';
 import { KiroTokenRefreshError } from '../../plugin/errors';
+import * as logger from '../../plugin/logger';
 import { refreshAccessToken } from '../../plugin/token';
 export class TokenRefresher {
     config;
@@ -27,6 +28,11 @@ export class TokenRefresher {
         }
     }
     async handleRefreshError(error, account, showToast) {
+        logger.error('Token refresh failed', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
         if (this.config.auto_sync_kiro_cli) {
             await this.syncFromKiroCli();
         }
@@ -48,6 +54,11 @@ export class TokenRefresher {
             await this.repository.batchSave(this.accountManager.getAccounts());
             return { account, shouldContinue: true };
         }
+        logger.error('Token refresh unrecoverable', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
         throw error;
     }
 }

package/dist/core/request/error-handler.js

@@ -1,3 +1,4 @@
+import * as logger from '../../plugin/logger';
 export class ErrorHandler {
     config;
     accountManager;
@@ -8,13 +9,32 @@ export class ErrorHandler {
         this.repository = repository;
     }
     async handle(error, response, account, context, showToast) {
-        if (response.status === 400 && context.reductionFactor > 0.4) {
-            const newFactor = context.reductionFactor - 0.2;
-            showToast(`Context too long. Retrying with ${Math.round(newFactor * 100)}%...`, 'warning');
-            return {
-                shouldRetry: true,
-                newContext: { ...context, reductionFactor: newFactor }
-            };
+        if (response.status === 400) {
+            const body = await response.text();
+            const errorData = (() => {
+                try {
+                    return JSON.parse(body);
+                }
+                catch {
+                    return null;
+                }
+            })();
+            if (errorData?.reason === 'INVALID_MODEL_ID') {
+                throw new Error(`Invalid model: ${errorData.message}`);
+            }
+            logger.warn('HTTP 400 response body', {
+                body,
+                reductionFactor: context.reductionFactor,
+                email: account.email
+            });
+            if (context.reductionFactor > 0.4) {
+                const newFactor = context.reductionFactor - 0.2;
+                showToast(`Context too long. Retrying with ${Math.round(newFactor * 100)}%...`, 'warning');
+                return {
+                    shouldRetry: true,
+                    newContext: { ...context, reductionFactor: newFactor }
+                };
+            }
         }
         if (response.status === 401 && context.retry < this.config.rate_limit_max_retries) {
             return {
@@ -65,21 +85,21 @@ export class ErrorHandler {
             this.accountManager.getAccountCount() > 1) {
             let errorReason = response.status === 402 ? 'Quota' : 'Forbidden';
             let isPermanent = false;
-            try {
-                const errorBody = await response.text();
-                const errorData = JSON.parse(errorBody);
-                if (errorData.reason === 'INVALID_MODEL_ID') {
-                    throw new Error(`Invalid model: ${errorData.message}`);
+            const errorBody = await response.text();
+            const errorData = (() => {
+                try {
+                    return JSON.parse(errorBody);
                 }
-                if (errorData.reason === 'TEMPORARILY_SUSPENDED') {
-                    errorReason = 'Account Suspended';
-                    isPermanent = true;
+                catch {
+                    return null;
                 }
+            })();
+            if (errorData?.reason === 'INVALID_MODEL_ID') {
+                throw new Error(`Invalid model: ${errorData.message}`);
             }
-            catch (e) {
-                if (e instanceof Error && e.message.includes('Invalid model')) {
-                    throw e;
-                }
+            if (errorData?.reason === 'TEMPORARILY_SUSPENDED') {
+                errorReason = 'Account Suspended';
+                isPermanent = true;
             }
             if (isPermanent) {
                 account.failCount = 10;

package/dist/plugin/accounts.js

@@ -131,7 +131,11 @@ export class AccountManager {
                 delete a.unhealthyReason;
                 delete a.recoveryTime;
             }
-            kiroDb.upsertAccount(a).catch(() => { });
+            kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+                method: 'updateUsage',
+                email: a.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     addAccount(a) {
@@ -140,14 +144,22 @@ export class AccountManager {
             this.accounts.push(a);
         else
             this.accounts[i] = a;
-        kiroDb.upsertAccount(a).catch(() => { });
+        kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+            method: 'addAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     removeAccount(a) {
         const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id).catch(() => { });
+        kiroDb.deleteAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)
@@ -173,15 +185,27 @@ export class AccountManager {
             acc.isHealthy = true;
             delete acc.unhealthyReason;
             delete acc.recoveryTime;
-            kiroDb.upsertAccount(acc).catch(() => { });
-            writeToKiroCli(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markRateLimited(a, ms) {
         const acc = this.accounts.find((x) => x.id === a.id);
         if (acc) {
             acc.rateLimitResetTime = Date.now() + ms;
-            kiroDb.upsertAccount(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'markRateLimited',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markUnhealthy(a, reason, recovery) {
@@ -209,7 +233,11 @@ export class AccountManager {
                 acc.recoveryTime = recovery || Date.now() + 3600000;
             }
         }
-        kiroDb.upsertAccount(acc).catch(() => { });
+        kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+            method: 'markUnhealthy',
+            email: acc.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     async saveToDisk() {
         await kiroDb.batchUpsertAccounts(this.accounts);

package/dist/plugin/request.js

@@ -1,6 +1,6 @@
 import * as crypto from 'crypto';
 import * as os from 'os';
-import { KIRO_CONSTANTS } from '../constants.js';
+import { KIRO_CONSTANTS, buildUrl, extractRegionFromArn } from '../constants.js';
 import { buildHistory, extractToolNamesFromHistory, historyHasToolCalling, injectSystemPrompt, truncateHistory } from '../infrastructure/transformers/history-builder.js';
 import { findOriginalToolCall, getContentText, mergeAdjacentMessages, truncate } from '../infrastructure/transformers/message-transformer.js';
 import { convertToolsToCodeWhisperer, deduplicateToolResults } from '../infrastructure/transformers/tool-transformer.js';
@@ -221,7 +221,7 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
     const osN = osP === 'win32' ? `windows#${osR}` : osP === 'darwin' ? `macos#${osR}` : `${osP}#${osR}`;
     const ua = `aws-sdk-js/3.738.0 ua/2.1 os/${osN} lang/js md/nodejs#${nodeV} api/codewhisperer#3.738.0 m/E KiroIDE`;
     return {
-        url: KIRO_CONSTANTS.BASE_URL.replace('{{region}}', auth.region),
+        url: buildUrl(KIRO_CONSTANTS.BASE_URL, extractRegionFromArn(auth.profileArn) ?? auth.region),
         init: {
             method: 'POST',
             headers: {

package/dist/plugin/storage/migrations.js

@@ -4,6 +4,7 @@ export function runMigrations(db) {
     migrateUsageTable(db);
     migrateStartUrlColumn(db);
     migrateOidcRegionColumn(db);
+    migrateDropRefreshTokenUniqueIndex(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -126,3 +127,29 @@ function migrateOidcRegionColumn(db) {
     // Backfill: historically `region` was used for both service + OIDC.
     db.run('UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = \"\"');
 }
+function migrateDropRefreshTokenUniqueIndex(db) {
+    // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
+    // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
+    // harmful: duplicate rows (same account, different legacy vs hash id) share the same
+    // refresh_token, causing UNIQUE constraint violations on every upsert.
+    db.run('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    // Clean up duplicate rows: same email + same refresh_token but different ids.
+    // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
+    const duplicates = db
+        .prepare(`SELECT email, refresh_token FROM accounts
+       GROUP BY email, refresh_token
+       HAVING COUNT(*) > 1`)
+        .all();
+    for (const dup of duplicates) {
+        const rows = db
+            .prepare(`SELECT id FROM accounts WHERE email = ? AND refresh_token = ?
+         ORDER BY
+           CASE WHEN id LIKE 'kiro-cli-sync-%' THEN 1 ELSE 0 END ASC,
+           last_used DESC, expires_at DESC`)
+            .all(dup.email, dup.refresh_token);
+        // Keep the first row (deterministic hash id preferred), delete the rest
+        for (const row of rows.slice(1)) {
+            db.prepare('DELETE FROM accounts WHERE id = ?').run(row.id);
+        }
+    }
+}

package/dist/plugin/storage/sqlite.js

@@ -50,10 +50,10 @@ export class KiroDatabase {
         is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
         used_count, limit_count, last_sync
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(refresh_token) DO UPDATE SET
+      ON CONFLICT(id) DO UPDATE SET
         id=excluded.id, email=excluded.email, auth_method=excluded.auth_method,
         region=excluded.region, oidc_region=excluded.oidc_region, client_id=excluded.client_id, client_secret=excluded.client_secret,
-        profile_arn=excluded.profile_arn, start_url=excluded.start_url,
+        profile_arn=excluded.profile_arn, start_url=excluded.start_url, refresh_token=excluded.refresh_token,
         access_token=excluded.access_token, expires_at=excluded.expires_at,
         rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
         unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",