@zhafron/opencode-kiro-auth 1.7.0 → 1.8.1

package/README.md

@@ -210,6 +210,25 @@ If you need to enter provider-specific values for an OAuth login (like IAM Ident
 
 Note for IDC/SSO (ODIC): the plugin may temporarily create an account with a placeholder email if it cannot fetch the real email during sync (e.g. offline). It will replace it with the real email once usage/email lookup succeeds.
 
+### Kiro CLI (Google/GitHub OAuth) users: plugin sync never runs
+
+If you authenticated via `kiro-cli login` using Google or GitHub OAuth (not AWS Builder ID or IAM Identity Center), the plugin's sync may never trigger. This happens because OpenCode requires a kiro entry in `auth.json` before making API requests, but the plugin loader only runs when a request is made.
+
+**Workaround:** Add a minimal placeholder entry to `~/.local/share/opencode/auth.json`:
+
+```json
+{
+  "kiro": {
+    "type": "api",
+    "key": "placeholder"
+  }
+}
+```
+
+After adding this, OpenCode will treat the provider as connected, trigger the plugin loader, and the kiro-cli sync will populate `kiro.db` with your actual tokens. The placeholder values are not used for API calls.
+
+**Important:** Ensure `auto_sync_kiro_cli` is `true` in `~/.config/opencode/kiro.json` and that `kiro-cli login` succeeds before applying this workaround.
+
 ### Error: ERR_INVALID_URL
 
 `TypeError [ERR_INVALID_URL]: "undefined/chat/completions" cannot be parsed as a URL`

package/dist/constants.d.ts

@@ -18,6 +18,7 @@ export declare const KIRO_CONSTANTS: {
 };
 export declare const MODEL_MAPPING: Record<string, string>;
 export declare const SUPPORTED_MODELS: string[];
+export declare function isLongContextModel(model: string): boolean;
 export declare const KIRO_AUTH_SERVICE: {
     ENDPOINT: string;
     SSO_OIDC_ENDPOINT: string;

package/dist/constants.js

@@ -46,23 +46,23 @@ export const KIRO_CONSTANTS = {
     ORIGIN_AI_EDITOR: 'AI_EDITOR'
 };
 export const MODEL_MAPPING = {
-    'claude-haiku-4-5': 'CLAUDE_HAIKU_4_5_20251001_V1_0',
-    'claude-haiku-4-5-thinking': 'CLAUDE_HAIKU_4_5_20251001_V1_0',
-    'claude-sonnet-4-5': 'CLAUDE_SONNET_4_5_20250929_V1_0',
-    'claude-sonnet-4-5-thinking': 'CLAUDE_SONNET_4_5_20250929_V1_0',
-    'claude-sonnet-4-5-1m': 'CLAUDE_SONNET_4_5_20250929_LONG_V1_0',
-    'claude-sonnet-4-5-1m-thinking': 'CLAUDE_SONNET_4_5_20250929_LONG_V1_0',
+    'claude-haiku-4-5': 'claude-haiku-4.5',
+    'claude-haiku-4-5-thinking': 'claude-haiku-4.5',
+    'claude-sonnet-4-5': 'claude-sonnet-4.5',
+    'claude-sonnet-4-5-thinking': 'claude-sonnet-4.5',
+    'claude-sonnet-4-5-1m': 'claude-sonnet-4.5-1m',
+    'claude-sonnet-4-5-1m-thinking': 'claude-sonnet-4.5-1m',
     'claude-sonnet-4-6': 'claude-sonnet-4.6',
     'claude-sonnet-4-6-thinking': 'claude-sonnet-4.6',
-    'claude-sonnet-4-6-1m': 'claude-sonnet-4.6',
-    'claude-sonnet-4-6-1m-thinking': 'claude-sonnet-4.6',
-    'claude-opus-4-5': 'CLAUDE_OPUS_4_5_20251101_V1_0',
-    'claude-opus-4-5-thinking': 'CLAUDE_OPUS_4_5_20251101_V1_0',
+    'claude-sonnet-4-6-1m': 'claude-sonnet-4.6-1m',
+    'claude-sonnet-4-6-1m-thinking': 'claude-sonnet-4.6-1m',
+    'claude-opus-4-5': 'claude-opus-4.5',
+    'claude-opus-4-5-thinking': 'claude-opus-4.5',
     'claude-opus-4-6': 'claude-opus-4.6',
     'claude-opus-4-6-thinking': 'claude-opus-4.6',
-    'claude-opus-4-6-1m': 'claude-opus-4.6',
-    'claude-opus-4-6-1m-thinking': 'claude-opus-4.6',
-    'claude-sonnet-4': 'CLAUDE_SONNET_4_20250514_V1_0',
+    'claude-opus-4-6-1m': 'claude-opus-4.6-1m',
+    'claude-opus-4-6-1m-thinking': 'claude-opus-4.6-1m',
+    'claude-sonnet-4': 'claude-sonnet-4',
     'claude-3-7-sonnet': 'CLAUDE_3_7_SONNET_20250219_V1_0',
     'nova-swe': 'AGI_NOVA_SWE_V1_5',
     'gpt-oss-120b': 'OPENAI_GPT_OSS_120B_1_0',
@@ -71,6 +71,10 @@ export const MODEL_MAPPING = {
     'kimi-k2-thinking': 'MOONSHOT_KIMI_K2_THINKING'
 };
 export const SUPPORTED_MODELS = Object.keys(MODEL_MAPPING);
+const LONG_CONTEXT_MODELS = new Set(Object.keys(MODEL_MAPPING).filter((k) => k.includes('-1m')));
+export function isLongContextModel(model) {
+    return LONG_CONTEXT_MODELS.has(model);
+}
 export const KIRO_AUTH_SERVICE = {
     ENDPOINT: 'https://prod.{{region}}.auth.desktop.kiro.dev',
     SSO_OIDC_ENDPOINT: 'https://oidc.{{region}}.amazonaws.com',

package/dist/core/auth/token-refresher.js

@@ -1,5 +1,6 @@
 import { accessTokenExpired } from '../../kiro/auth';
 import { KiroTokenRefreshError } from '../../plugin/errors';
+import * as logger from '../../plugin/logger';
 import { refreshAccessToken } from '../../plugin/token';
 export class TokenRefresher {
     config;
@@ -27,6 +28,11 @@ export class TokenRefresher {
         }
     }
     async handleRefreshError(error, account, showToast) {
+        logger.error('Token refresh failed', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
         if (this.config.auto_sync_kiro_cli) {
             await this.syncFromKiroCli();
         }
@@ -48,6 +54,11 @@ export class TokenRefresher {
             await this.repository.batchSave(this.accountManager.getAccounts());
             return { account, shouldContinue: true };
         }
+        logger.error('Token refresh unrecoverable', {
+            email: account.email,
+            code: error instanceof KiroTokenRefreshError ? error.code : undefined,
+            message: error instanceof Error ? error.message : String(error)
+        });
         throw error;
     }
 }

package/dist/core/request/error-handler.js

@@ -8,15 +8,29 @@ export class ErrorHandler {
         this.repository = repository;
     }
     async handle(error, response, account, context, showToast) {
-        if (response.status === 400 && context.reductionFactor > 0.4) {
-            const newFactor = context.reductionFactor - 0.2;
-            showToast(`Context too long. Retrying with ${Math.round(newFactor * 100)}%...`, 'warning');
-            return {
-                shouldRetry: true,
-                newContext: { ...context, reductionFactor: newFactor }
-            };
+        const readBody = async () => {
+            try {
+                const body = JSON.parse(await response.clone().text());
+                return body.message || body.Message || body.__type || JSON.stringify(body);
+            }
+            catch {
+                return '';
+            }
+        };
+        if (response.status === 400) {
+            const reason = await readBody();
+            if (context.reductionFactor > 0.4) {
+                const newFactor = context.reductionFactor - 0.2;
+                showToast(`400: ${reason || 'unknown'}. Retrying with ${Math.round(newFactor * 100)}%...`, 'warning');
+                return {
+                    shouldRetry: true,
+                    newContext: { ...context, reductionFactor: newFactor }
+                };
+            }
         }
         if (response.status === 401 && context.retry < this.config.rate_limit_max_retries) {
+            const reason = await readBody();
+            showToast(`401: ${reason || 'Unauthorized'}. Retrying...`, 'warning');
             return {
                 shouldRetry: true,
                 newContext: { ...context, retry: context.retry + 1 }
@@ -38,14 +52,14 @@ export class ErrorHandler {
             catch (e) { }
             if (account.failCount < 5) {
                 const delay = 1000 * Math.pow(2, account.failCount - 1);
-                showToast(`Server Error (500): ${errorMessage}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
+                showToast(`500: ${errorMessage}. Retrying in ${Math.ceil(delay / 1000)}s...`, 'warning');
                 await this.sleep(delay);
                 return { shouldRetry: true };
             }
             else {
                 this.accountManager.markUnhealthy(account, `Server Error (500) after 5 attempts: ${errorMessage}`);
                 await this.repository.batchSave(this.accountManager.getAccounts());
-                showToast(`Server Error (500): ${errorMessage}. Marking account as unhealthy and switching...`, 'warning');
+                showToast(`500: ${errorMessage}. Marking account as unhealthy and switching...`, 'warning');
                 return { shouldRetry: true, switchAccount: true };
             }
         }
@@ -57,7 +71,7 @@ export class ErrorHandler {
             if (count > 1) {
                 return { shouldRetry: true, switchAccount: true };
             }
-            showToast(`Rate limited. Waiting ${Math.ceil(w / 1000)}s...`, 'warning');
+            showToast(`429: Rate limited. Waiting ${Math.ceil(w / 1000)}s...`, 'warning');
             await this.sleep(w);
             return { shouldRetry: true };
         }
@@ -65,29 +79,32 @@ export class ErrorHandler {
             this.accountManager.getAccountCount() > 1) {
             let errorReason = response.status === 402 ? 'Quota' : 'Forbidden';
             let isPermanent = false;
-            try {
-                const errorBody = await response.text();
-                const errorData = JSON.parse(errorBody);
-                if (errorData.reason === 'INVALID_MODEL_ID') {
-                    throw new Error(`Invalid model: ${errorData.message}`);
+            const errorBody = await response.text();
+            const errorData = (() => {
+                try {
+                    return JSON.parse(errorBody);
                 }
-                if (errorData.reason === 'TEMPORARILY_SUSPENDED') {
-                    errorReason = 'Account Suspended';
-                    isPermanent = true;
+                catch {
+                    return null;
                 }
+            })();
+            if (errorData?.reason === 'INVALID_MODEL_ID') {
+                throw new Error(`Invalid model: ${errorData.message}`);
             }
-            catch (e) {
-                if (e instanceof Error && e.message.includes('Invalid model')) {
-                    throw e;
-                }
+            if (errorData?.reason === 'TEMPORARILY_SUSPENDED') {
+                errorReason = 'Account Suspended';
+                isPermanent = true;
             }
             if (isPermanent) {
                 account.failCount = 10;
             }
+            showToast(`${response.status}: ${errorReason}. Switching account...`, 'warning');
             this.accountManager.markUnhealthy(account, errorReason);
             await this.repository.batchSave(this.accountManager.getAccounts());
             return { shouldRetry: true, switchAccount: true };
         }
+        const reason = await readBody();
+        showToast(`${response.status}: ${reason || response.statusText}`, 'error');
         return { shouldRetry: false };
     }
     async handleNetworkError(error, context, showToast) {

package/dist/infrastructure/transformers/history-builder.js

@@ -102,7 +102,20 @@ export function buildHistory(msgs, resolved, toolResultLimit) {
             if (!arm.content && !arm.toolUses) {
                 continue;
             }
-            history.push({ assistantResponseMessage: arm });
+            const prevMsg = history[history.length - 1];
+            if (prevMsg && prevMsg.assistantResponseMessage) {
+                // Merge consecutive assistant messages instead of injecting synthetic user turn
+                const prev = prevMsg.assistantResponseMessage;
+                if (arm.content) {
+                    prev.content = prev.content ? `${prev.content}\n\n${arm.content}` : arm.content;
+                }
+                if (arm.toolUses) {
+                    prev.toolUses = [...(prev.toolUses || []), ...arm.toolUses];
+                }
+            }
+            else {
+                history.push({ assistantResponseMessage: arm });
+            }
         }
     }
     return history;

package/dist/infrastructure/transformers/message-transformer.js

@@ -20,13 +20,16 @@ export function sanitizeHistory(history) {
             result.push(m);
         }
     }
-    if (result.length > 0) {
+    while (result.length > 0) {
         const first = result[0];
-        if (!first ||
-            !first.userInputMessage ||
-            first.userInputMessage.userInputMessageContext?.toolResults) {
-            return [];
-        }
+        if (first?.userInputMessage && !first.userInputMessage.userInputMessageContext?.toolResults)
+            break;
+        result.shift();
+    }
+    if (result.length === 0)
+        return [];
+    while (result.length > 0 && result[result.length - 1]?.assistantResponseMessage) {
+        result.pop();
     }
     return result;
 }

package/dist/plugin/accounts.js

@@ -131,7 +131,11 @@ export class AccountManager {
                 delete a.unhealthyReason;
                 delete a.recoveryTime;
             }
-            kiroDb.upsertAccount(a).catch(() => { });
+            kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+                method: 'updateUsage',
+                email: a.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     addAccount(a) {
@@ -140,14 +144,22 @@ export class AccountManager {
             this.accounts.push(a);
         else
             this.accounts[i] = a;
-        kiroDb.upsertAccount(a).catch(() => { });
+        kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+            method: 'addAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     removeAccount(a) {
         const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id).catch(() => { });
+        kiroDb.deleteAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)
@@ -173,15 +185,27 @@ export class AccountManager {
             acc.isHealthy = true;
             delete acc.unhealthyReason;
             delete acc.recoveryTime;
-            kiroDb.upsertAccount(acc).catch(() => { });
-            writeToKiroCli(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markRateLimited(a, ms) {
         const acc = this.accounts.find((x) => x.id === a.id);
         if (acc) {
             acc.rateLimitResetTime = Date.now() + ms;
-            kiroDb.upsertAccount(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'markRateLimited',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markUnhealthy(a, reason, recovery) {
@@ -209,7 +233,11 @@ export class AccountManager {
                 acc.recoveryTime = recovery || Date.now() + 3600000;
             }
         }
-        kiroDb.upsertAccount(acc).catch(() => { });
+        kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+            method: 'markUnhealthy',
+            email: acc.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     async saveToDisk() {
         await kiroDb.batchUpsertAccounts(this.accounts);

package/dist/plugin/request.js

@@ -1,6 +1,6 @@
 import * as crypto from 'crypto';
 import * as os from 'os';
-import { KIRO_CONSTANTS } from '../constants.js';
+import { KIRO_CONSTANTS, buildUrl, extractRegionFromArn, isLongContextModel } from '../constants.js';
 import { buildHistory, extractToolNamesFromHistory, historyHasToolCalling, injectSystemPrompt, truncateHistory } from '../infrastructure/transformers/history-builder.js';
 import { findOriginalToolCall, getContentText, mergeAdjacentMessages, truncate } from '../infrastructure/transformers/message-transformer.js';
 import { convertToolsToCodeWhisperer, deduplicateToolResults } from '../infrastructure/transformers/tool-transformer.js';
@@ -29,9 +29,10 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
     if (lastMsg && lastMsg.role === 'assistant' && getContentText(lastMsg) === '{')
         msgs.pop();
     const cwTools = tools ? convertToolsToCodeWhisperer(tools) : [];
-    const toolResultLimit = Math.floor(250000 * reductionFactor);
+    const longCtx = isLongContextModel(model);
+    const toolResultLimit = Math.floor((longCtx ? 1250000 : 250000) * reductionFactor);
     let history = buildHistory(msgs, resolved, toolResultLimit);
-    const historyLimit = Math.floor(850000 * reductionFactor);
+    const historyLimit = Math.floor((longCtx ? 4250000 : 850000) * reductionFactor);
     history = truncateHistory(history, historyLimit);
     history = injectSystemPrompt(history, sys, resolved);
     const curMsg = msgs[msgs.length - 1];
@@ -164,7 +165,7 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
     }
     if (orphanedTrs.length > 0) {
         const prev = history[history.length - 1];
-        if (prev && !prev.userInputMessage) {
+        if (!prev || prev.assistantResponseMessage) {
             history.push({
                 userInputMessage: {
                     content: 'Running tools...',
@@ -221,7 +222,7 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
     const osN = osP === 'win32' ? `windows#${osR}` : osP === 'darwin' ? `macos#${osR}` : `${osP}#${osR}`;
     const ua = `aws-sdk-js/3.738.0 ua/2.1 os/${osN} lang/js md/nodejs#${nodeV} api/codewhisperer#3.738.0 m/E KiroIDE`;
     return {
-        url: KIRO_CONSTANTS.BASE_URL.replace('{{region}}', auth.region),
+        url: buildUrl(KIRO_CONSTANTS.BASE_URL, extractRegionFromArn(auth.profileArn) ?? auth.region),
         init: {
             method: 'POST',
             headers: {

package/dist/plugin/storage/migrations.js

@@ -4,6 +4,7 @@ export function runMigrations(db) {
     migrateUsageTable(db);
     migrateStartUrlColumn(db);
     migrateOidcRegionColumn(db);
+    migrateDropRefreshTokenUniqueIndex(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -126,3 +127,29 @@ function migrateOidcRegionColumn(db) {
     // Backfill: historically `region` was used for both service + OIDC.
     db.run('UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = \"\"');
 }
+function migrateDropRefreshTokenUniqueIndex(db) {
+    // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
+    // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
+    // harmful: duplicate rows (same account, different legacy vs hash id) share the same
+    // refresh_token, causing UNIQUE constraint violations on every upsert.
+    db.run('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    // Clean up duplicate rows: same email + same refresh_token but different ids.
+    // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
+    const duplicates = db
+        .prepare(`SELECT email, refresh_token FROM accounts
+       GROUP BY email, refresh_token
+       HAVING COUNT(*) > 1`)
+        .all();
+    for (const dup of duplicates) {
+        const rows = db
+            .prepare(`SELECT id FROM accounts WHERE email = ? AND refresh_token = ?
+         ORDER BY
+           CASE WHEN id LIKE 'kiro-cli-sync-%' THEN 1 ELSE 0 END ASC,
+           last_used DESC, expires_at DESC`)
+            .all(dup.email, dup.refresh_token);
+        // Keep the first row (deterministic hash id preferred), delete the rest
+        for (const row of rows.slice(1)) {
+            db.prepare('DELETE FROM accounts WHERE id = ?').run(row.id);
+        }
+    }
+}

package/dist/plugin/storage/sqlite.js

@@ -50,10 +50,10 @@ export class KiroDatabase {
         is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
         used_count, limit_count, last_sync
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(refresh_token) DO UPDATE SET
+      ON CONFLICT(id) DO UPDATE SET
         id=excluded.id, email=excluded.email, auth_method=excluded.auth_method,
         region=excluded.region, oidc_region=excluded.oidc_region, client_id=excluded.client_id, client_secret=excluded.client_secret,
-        profile_arn=excluded.profile_arn, start_url=excluded.start_url,
+        profile_arn=excluded.profile_arn, start_url=excluded.start_url, refresh_token=excluded.refresh_token,
         access_token=excluded.access_token, expires_at=excluded.expires_at,
         rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
         unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",
@@ -8,6 +8,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "format": "prettier --write 'src/**/*.ts'",
+    "test": "bun test",
     "typecheck": "tsc --noEmit",
     "prepare": "husky"
   },