{"id":51829655,"url":"https://github.com/sunerpy/opencode-kiro-auth","last_synced_at":"2026-07-22T13:33:35.305Z","repository":{"id":370454651,"uuid":"1294874771","full_name":"sunerpy/opencode-kiro-auth","owner":"sunerpy","description":"OpenCode plugin: use AWS Kiro (CodeWhisperer) Claude \u0026 open-weight models via your Kiro subscription. Provider id kiro-auth. Multi-account rotation, usage display, Sonnet 5 / Opus 4.x.","archived":false,"fork":false,"pushed_at":"2026-07-16T11:48:09.000Z","size":488,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-16T13:23:10.635Z","etag":null,"topics":["ai","aws","claude","codewhisperer","kiro","opencode","plugin","typescript"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sunerpy.png","metadata":{"files":{"readme":"README.md","changelog":"changelog/CHANGELOG-v0.x.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-07-09T08:11:07.000Z","updated_at":"2026-07-16T11:48:26.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/sunerpy/opencode-kiro-auth","commit_stats":null,"previous_names":["sunerpy/opencode-kiro-auth"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/sunerpy/opencode-kiro-auth","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fopencode-kiro-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fopencode-kiro-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fopencode-kiro-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fopencode-kiro-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sunerpy","download_url":"https://codeload.github.com/sunerpy/opencode-kiro-auth/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fopencode-kiro-auth/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35764375,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-22T02:00:06.236Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","aws","claude","codewhisperer","kiro","opencode","plugin","typescript"],"created_at":"2026-07-22T13:33:34.574Z","updated_at":"2026-07-22T13:33:35.272Z","avatar_url":"https://github.com/sunerpy.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# opencode-kiro-auth\n\n[简体中文](docs/readme/README.zh.md) · English\n\n[![npm version](https://img.shields.io/npm/v/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)\n[![npm downloads](https://img.shields.io/npm/dm/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)\n[![codecov](https://codecov.io/gh/sunerpy/opencode-kiro-auth/branch/main/graph/badge.svg)](https://codecov.io/gh/sunerpy/opencode-kiro-auth)\n[![license](https://img.shields.io/npm/l/@sunerpy/opencode-kiro-auth)](https://www.npmjs.com/package/@sunerpy/opencode-kiro-auth)\n\n\u003e OpenCode plugin that lets OpenCode use AWS Kiro (CodeWhisperer) as a model\n\u003e provider — Claude Sonnet, Opus, and Haiku, plus the other models Kiro proxies\n\u003e (OpenAI GPT 5.6, DeepSeek, GLM, MiniMax, Qwen3) — with substantial trial\n\u003e quotas.\n\n## Table of Contents\n\n- [Features](#features)\n- [Installation](#installation)\n- [Setup / Auth](#setup--auth)\n- [Configuration](#configuration)\n- [Multiple accounts \u0026 rotation](#multiple-accounts--rotation)\n- [Usage display](#usage-display)\n- [Models](#models)\n- [Troubleshooting](#troubleshooting)\n- [Migration](#migration)\n- [Local plugin development](#local-plugin-development)\n- [Development](#development)\n- [Storage](#storage)\n- [Acknowledgements](#acknowledgements)\n- [Upstream sync](#upstream-sync)\n- [Disclaimer](#disclaimer)\n- [License](#license)\n\n## Features\n\n- **Multiple auth methods**: AWS Builder ID (IDC), IAM Identity Center (custom\n  Start URL), and Kiro Desktop (CLI-based) authentication.\n- **Auto-sync Kiro CLI**: automatically imports and synchronizes active\n  sessions from your local `kiro-cli` SQLite database.\n- **Gradual context truncation**: intelligently prevents error 400 by reducing\n  context size dynamically during retries.\n- **Intelligent account rotation**: prioritizes multi-account usage based on\n  lowest available quota.\n- **High-performance storage**: efficient account and usage management using\n  native Bun SQLite.\n- **Native thinking mode**: full support for Claude reasoning capabilities via\n  virtual model mappings.\n- **Kiro effort mapping**: maps OpenCode thinking budgets to Kiro's native\n  effort levels automatically.\n- **Automated recovery**: exponential backoff for rate limits and automated\n  token refresh.\n\n## Installation\n\nAdd the plugin to your `opencode.json` or `opencode.jsonc`:\n\n```json\n{\n  \"plugin\": [\"@sunerpy/opencode-kiro-auth\"]\n}\n```\n\nThat alone registers the `kiro-auth` provider with a default model set. To\ncustomize which models are exposed (including thinking variants), see\n[Models](#models) and the full catalog in\n[docs/MODELS.md](docs/MODELS.md).\n\n## Setup / Auth\n\n1. **Authentication via Kiro CLI (recommended)**:\n   - Log in directly in your terminal with `kiro-cli login`.\n   - The plugin automatically bootstraps a minimal `kiro-auth` placeholder in\n     OpenCode's `auth.json` when it detects the Kiro CLI database, then\n     imports and synchronizes your active session on startup.\n   - For AWS IAM Identity Center (SSO/IDC), the plugin imports both the token\n     and device registration (OIDC client credentials) from the `kiro-cli`\n     database.\n2. **Direct authentication**:\n   - Run `opencode auth login`.\n   - Select `Other`, type `kiro-auth`, and press enter.\n   - You'll be prompted for your **IAM Identity Center Start URL** and\n     **region** (`sso_region`). Leave it blank for **AWS Builder ID**, or\n     enter your company's Start URL (e.g.\n     `https://your-company.awsapps.com/start`) for **IAM Identity Center\n     (SSO)**.\n   - Note: the TUI `/connect` flow does **not** currently run plugin OAuth\n     prompts (Start URL / region), so Identity Center logins may fall back to\n     Builder ID unless you use `opencode auth login` (or preconfigure\n     defaults in `~/.config/opencode/kiro-auth-plugin/kiro.json`).\n   - For **IAM Identity Center**, you may also need a **profile ARN**\n     (`profileArn`) — auto-detected from `kiro-cli profile` if available, or\n     set `idc_profile_arn` manually.\n   - A browser window opens directly to AWS's verification URL (no local auth\n     server). If it doesn't, copy/paste the URL and enter the code OpenCode\n     prints.\n3. Configuration is automatically managed at `~/.config/opencode/kiro.db`.\n\n## Configuration\n\nPlugin-wide behavior (auth sync, account selection, retry limits, effort\nmapping) lives in `~/.config/opencode/kiro-auth-plugin/kiro.json`. See\n[docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the full example and every\noption.\n\nNew default keys are backfilled into an existing `kiro.json` automatically when\nthe plugin loads (additive only — your existing values are never changed). For\nmulti-account or long-idle setups, enable\n[token keep-alive](docs/CONFIGURATION.md#token-keep-alive)\n(`token_keepalive_enabled: true`) to keep idle accounts' tokens fresh while\nOpenCode is running.\n\nPaid-overage protection is on by default; see\n[Overage protection](docs/CONFIGURATION.md#overage-protection) before disabling\n`stop_on_overage`.\n\nRunning multiple OpenCode processes at once? `distribute_across_processes`\n(default `true`) and `per_request_spread` (default `false`) control how load\nspreads across accounts — see\n[Account distribution across processes](docs/CONFIGURATION.md#account-distribution-across-processes).\n\n## Multiple accounts \u0026 rotation\n\nYou can register more than one Kiro account and let the plugin spread\nrequests across them for combined quota and automatic failover.\n\n**Adding accounts**, two ways:\n\n1. Run `opencode auth login`, select `kiro-auth`, and complete a Builder ID\n   or IAM Identity Center login. Run this once per account — each distinct\n   AWS identity is stored separately in `kiro.db`. Re-running login for the\n   same identity updates it in place; logging in with a different identity\n   adds a new account.\n2. Auto-sync from Kiro CLI: with `auto_sync_kiro_cli: true` (opt-in, default\n   `false`), the plugin imports credentials from your local `kiro-cli`\n   database. Note `kiro-cli` stores only one token per auth method, so it\n   cannot represent multiple accounts — manual `opencode auth login` per\n   account (option 1) is the supported multi-account path.\n\n**Rotation strategy** — set `account_selection_strategy` in\n`~/.config/opencode/kiro-auth-plugin/kiro.json`:\n\n| Strategy       | Behavior                                                               | Default |\n| -------------- | ---------------------------------------------------------------------- | ------- |\n| `lowest-usage` | Each request picks the healthy account with the lowest used quota      | ✅      |\n| `round-robin`  | Cycles through accounts in order                                       |         |\n| `sticky`       | Always uses the first account; switches only when it becomes unhealthy |         |\n\n**Automatic failover** requires no configuration: a rate-limited or 403\naccount is marked unhealthy and the next healthy account takes over. If every\naccount is rate-limited, the plugin waits out the minimum reset time and\nretries. A circuit breaker trips after 10 consecutive selection failures to\navoid a hot loop.\n\n**Removing an account**: run `opencode auth login`, select `kiro-auth`,\nchoose \"Remove a Kiro account (N stored)\", then pick the account from the\ndropdown (or cancel).\n\n\u003e **Note:** removal is persistent. Once you remove an account it stays\n\u003e removed across restarts and Kiro CLI auto-sync — it won't come back on its\n\u003e own. To re-add it, just log in with that account again via\n\u003e `opencode auth login`. See\n\u003e [Removing accounts \u0026 the removal tombstone](docs/CONFIGURATION.md#removing-accounts--the-removal-tombstone)\n\u003e for how this works.\n\nFull config key reference: [docs/CONFIGURATION.md](docs/CONFIGURATION.md).\n\n## Usage display\n\nThe plugin reads real quota from Kiro's usage API (`usedCount`/`limitCount`\nper account, e.g. `929/10000`) and surfaces it in three places:\n\n1. **Auth menu label** — running `opencode auth login` and selecting\n   `kiro-auth` shows `[current: \u003cemail\u003e \u003cused\u003e/\u003climit\u003e (\u003cpct\u003e%)]` on the\n   first login method; with multiple accounts they're joined with `·`,\n   capped at 3 with a `+N more` suffix.\n2. **Startup toast** — once per plugin init, a toast shows\n   `Kiro usage (\u003cemail\u003e): \u003cused\u003e/\u003climit\u003e (\u003cpct\u003e%)` a few seconds after\n   OpenCode starts, turning yellow (`warning`) at ≥90% usage.\n3. **Runtime warning** — a warning toast fires whenever a selected account\n   is at ≥90% usage.\n\nThere is **no persistent usage widget** in the TUI status bar — usage only\nshows up via the label and toasts above. To check usage at any time, either\nrestart OpenCode (triggers the startup toast) or query `kiro.db` directly:\n\n```bash\npython3 -c \"import sqlite3;r=sqlite3.connect('$HOME/.config/opencode/kiro.db').execute('SELECT email,used_count,limit_count FROM accounts').fetchall();[print(f'{e}: {u}/{l} (left {l-u})') for e,u,l in r]\"\n```\n\n## Models\n\nThe default install exposes Claude Sonnet/Opus/Haiku plus the open-weight\nmodels Kiro proxies. To pin an exact model list or configure thinking-budget\nvariants, paste the full catalog from [docs/MODELS.md](docs/MODELS.md) into\nyour `provider.kiro-auth.models` block.\n\nThinking budgets map to Kiro's native `effort` field automatically:\n\n| OpenCode budget | Kiro effort |\n| --------------- | ----------- |\n| `\u003c= 10000`      | `low`       |\n| `\u003c= 20000`      | `medium`    |\n| `\u003c= 28000`      | `high`      |\n| `\u003e 28000`       | `max`       |\n\nDetails and the full JSON example: [docs/MODELS.md](docs/MODELS.md).\n\n\u003e **Note:** OpenCode's per-agent thinking level (`--variant` / an agent's\n\u003e `variant` in `oh-my-openagent.json`) isn't honored per agent by this\n\u003e plugin — OpenCode consumes it upstream. Use the global `effort` key in\n\u003e `kiro.json` instead. See\n\u003e [Reasoning effort](docs/CONFIGURATION.md#reasoning-effort) for details.\n\n\u003e **Note:** Reasoning-capable Kiro models (Claude Opus 4.x and other\n\u003e reasoning-capable models) stream their chain-of-thought as a separate\n\u003e event, which the plugin surfaces as OpenCode's own reasoning block — shown\n\u003e as \"Thought: `\u003cduration\u003e`\" above the final reply. No config needed. See\n\u003e [Reasoning display](docs/CONFIGURATION.md#reasoning-display) for details.\n\n\u003e **Note:** Per-request thinking level via model variants — pick\n\u003e `kiro-auth/claude-opus-4-8-xhigh` (or similar) straight from the model\n\u003e list to pin an explicit Kiro effort level for that model, no `kiro.json`\n\u003e edit needed. Base models like `claude-opus-4-8` remain available and keep\n\u003e using the global `effort` setting. See [docs/VARIANTS.md](docs/VARIANTS.md)\n\u003e for the full variant list and why they exist.\n\n## Troubleshooting\n\nCommon issues — 403/AccessDeniedException with IAM Identity Center, \"No\naccounts\", `/connect` vs `opencode auth login`, and Kiro CLI OAuth users whose\nsync doesn't start — are covered in\n[docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md).\n\n## Migration\n\nIf you're upgrading from a version that used the provider id `kiro` instead of\n`kiro-auth`:\n\n- A stale `kiro` key in OpenCode's `auth.json` will be claimed by OpenCode's\n  **built-in** `kiro` provider (models.dev provider #91), not this plugin.\n  Remove or ignore that key — this plugin now bootstraps and uses `kiro-auth`.\n- Any config or session string of the form `kiro/\u003cmodel\u003e` must become\n  `kiro-auth/\u003cmodel\u003e` (e.g. `kiro/claude-sonnet-4-5` →\n  `kiro-auth/claude-sonnet-4-5`).\n\n## Local plugin development\n\nPoint OpenCode directly at your local repo path in `opencode.json` or\n`opencode.jsonc`:\n\n```json\n{\n  \"plugin\": [\"/path/to/opencode-kiro-auth\"]\n}\n```\n\nThen build and restart OpenCode to pick up changes: `bun run build`.\n\n## Development\n\nThis project uses Bun. The [Makefile](Makefile) is the single source of truth\nfor local checks and mirrors CI:\n\n```bash\nmake install    # bun install\nmake ci         # typecheck + fmt-check + test (what CI runs)\nmake build      # tsc + fix-esm-imports -\u003e dist/\n```\n\nAgent contributors: see [AGENTS.md](AGENTS.md) for the codebase architecture\nmap, invariants that must not break, and the CodeGraph-assisted workflow.\n\n### Releasing\n\nReleases are automated with\n[release-please](https://github.com/googleapis/release-please):\n\n- Use [Conventional Commits](https://www.conventionalcommits.org/) for commit\n  messages and pull request titles (`feat:`, `fix:`, `chore:`, …) — these drive\n  the next version bump automatically.\n- release-please opens and maintains a release pull request on `main`.\n  **Merging that PR** cuts the git tag + GitHub Release and triggers the\n  workflow that runs typecheck/test/build and then publishes to npm.\n- Contributors never hand-edit the version in `package.json` or the files under\n  [`changelog/`](changelog/) — release-please maintains both.\n\n## Storage\n\n**Linux/macOS:**\n\n- SQLite database: `~/.config/opencode/kiro.db`\n- Plugin config: `~/.config/opencode/kiro-auth-plugin/kiro.json`\n- Logs: `~/.config/opencode/kiro-auth-plugin/logs/`\n- Refresh and keep-alive locks: `~/.config/opencode/kiro-auth-plugin/`\n\n**Windows:**\n\n- SQLite database: `%APPDATA%\\opencode\\kiro.db`\n- Plugin config: `%APPDATA%\\opencode\\kiro-auth-plugin\\kiro.json`\n- Logs: `%APPDATA%\\opencode\\kiro-auth-plugin\\logs\\`\n- Refresh and keep-alive locks: `%APPDATA%\\opencode\\kiro-auth-plugin\\`\n\nExisting config, logs, and stale flat lock files are migrated automatically on\nfirst startup; no action is needed. The SQLite database deliberately remains at\nthe flat `opencode/kiro.db` path because moving a live database during an upgrade\nis unsafe.\n\n## Acknowledgements\n\nSpecial thanks to [AIClient-2-API](https://github.com/justlovemaki/AIClient-2-API)\nfor providing the foundational Kiro authentication logic and request patterns.\n\n## Upstream sync\n\nThis package is a fork of\n[tickernelz/opencode-kiro-auth](https://github.com/tickernelz/opencode-kiro-auth).\nUpstream fixes and improvements are tracked via the `upstream` git remote\n(`https://github.com/tickernelz/opencode-kiro-auth.git`) and cherry-picked into\nthis fork as needed.\n\nNote: [AIClient-2-API](https://github.com/justlovemaki/AIClient-2-API) (credited\nabove) is licensed under **GPLv3**, a strong copyleft license. Because this\nproject's Kiro authentication logic and request patterns are derived from it,\nthis project is now licensed under **GPLv3** as well, to comply with\nAIClient-2-API's copyleft requirements.\n\n## Disclaimer\n\nThis plugin is provided strictly for learning and educational purposes.\nIt is an independent implementation and is not affiliated with, endorsed by,\nor supported by Amazon Web Services (AWS) or Anthropic.\nUse of this plugin is at your own risk.\n\nFeel free to open a PR to optimize this plugin further.\n\n## License\n\nGPL-3.0-or-later, see [LICENSE](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsunerpy%2Fopencode-kiro-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsunerpy%2Fopencode-kiro-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsunerpy%2Fopencode-kiro-auth/lists"}