refactor(opencode): migrate kiro SDK to kiro-ai-provider npm package

Author: NachoFLizaur

bun.lock

@@ -119,8 +119,6 @@
     "@opentui/solid": "0.1.97",
     "@parcel/watcher": "2.5.1",
     "@pierre/diffs": "catalog:",
-    "@smithy/eventstream-codec": "4.2.12",
-    "@smithy/types": "4.13.1",
     "@solid-primitives/event-bus": "1.1.2",
     "@solid-primitives/scheduled": "1.5.2",
     "@standard-schema/spec": "1.0.0",
@@ -145,6 +143,7 @@
     "hono-openapi": "catalog:",
     "ignore": "7.0.5",
     "jsonc-parser": "3.3.1",
+    "kiro-ai-provider": "0.2.2",
     "mime-types": "3.0.2",
     "minimatch": "10.0.3",
     "npm-package-arg": "13.0.2",

packages/opencode/package.json

@@ -29,7 +29,7 @@ import { useExit } from "./exit"
 import { useArgs } from "./args"
 import { batch, createEffect, on } from "solid-js"
 import { Log } from "@/util/log"
-import { getQuota } from "@/provider/sdk/kiro/kiro-quota"
+import { getQuota } from "kiro-ai-provider"
 import { ConsoleState, emptyConsoleState, type ConsoleState as ConsoleStateType } from "@/config/console-state"
 
 export const { use: useSync, provider: SyncProvider } = createSimpleContext({

packages/opencode/src/cli/cmd/tui/context/sync.tsx

@@ -1,7 +1,7 @@
 import type { AssistantMessage } from "@opencode-ai/sdk/v2"
 import type { TuiPlugin, TuiPluginApi, TuiPluginModule } from "@opencode-ai/plugin/tui"
 import { createMemo, createSignal } from "solid-js"
-import { getQuota } from "@/provider/sdk/kiro/kiro-quota"
+import { getQuota } from "kiro-ai-provider"
 
 const id = "internal:sidebar-context"
 

packages/opencode/src/cli/cmd/tui/feature-plugins/sidebar/context.tsx

@@ -1,46 +1,10 @@
 import type { Hooks, PluginInput } from "@opencode-ai/plugin"
-import { Installation } from "@/installation"
-import { setTimeout as sleep } from "node:timers/promises"
-import path from "path"
-import os from "os"
+import { authenticate, getToken } from "kiro-ai-provider"
 
-const oidc = (region: string) => `https://oidc.${region}.amazonaws.com`
 const BUILDER_ID_URL = "https://view.awsapps.com/start"
-const SCOPES = [
-  "codewhisperer:completions",
-  "codewhisperer:analysis",
-  "codewhisperer:conversations",
-  "codewhisperer:transformations",
-  "codewhisperer:taskassist",
-]
-const GRANT_TYPES = ["urn:ietf:params:oauth:grant-type:device_code", "refresh_token"]
-const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
-const POLLING_MARGIN_MS = 3000
-const TOKEN_PATH = path.join(os.homedir(), ".aws", "sso", "cache", "kiro-auth-token.json")
-const CLIENT_PATH = path.join(os.homedir(), ".aws", "sso", "cache", "kiro-client-registration.json")
 const USER_AGENT = "aws-sdk-js/1.0.27 ua/2.1 os/darwin lang/js api/codewhispererstreaming#1.0.27 m/E Kiro-opencode"
 const USER_AGENT_SHORT = "aws-sdk-js/1.0.27 Kiro-opencode"
 
-function read<T>(filepath: string): Promise<T | undefined> {
-  const file = Bun.file(filepath)
-  return file
-    .exists()
-    .then((found) => (found ? file.text().then((text) => JSON.parse(text) as T) : undefined))
-    .catch(() => undefined)
-}
-
-function write(filepath: string, data: unknown): Promise<void> {
-  return Bun.write(filepath, JSON.stringify(data, null, 2))
-    .then(() => {})
-    .catch(() => {})
-}
-
-function mkdir(dir: string): Promise<void> {
-  return import("fs/promises")
-    .then((fs) => fs.mkdir(dir, { recursive: true }).then(() => {}))
-    .catch(() => {})
-}
-
 export async function KiroAuthPlugin(_input: PluginInput): Promise<Hooks> {
   return {
     auth: {
@@ -51,20 +15,18 @@ export async function KiroAuthPlugin(_input: PluginInput): Promise<Hooks> {
 
         return {
           async fetch(request: RequestInfo | URL, init?: RequestInit) {
-            const token = await read<{ accessToken: string }>(TOKEN_PATH)
+            const token = await getToken()
             if (!token) return fetch(request, init)
 
-            const headers: Record<string, string> = {
-              ...(init?.headers as Record<string, string>),
-              Authorization: `Bearer ${token.accessToken}`,
-              "User-Agent": USER_AGENT,
-              "x-amz-user-agent": USER_AGENT_SHORT,
-              "x-amzn-codewhisperer-optout": "true",
-            }
-
             return fetch(request, {
               ...init,
-              headers,
+              headers: {
+                ...(init?.headers as Record<string, string>),
+                Authorization: `Bearer ${token}`,
+                "User-Agent": USER_AGENT,
+                "x-amz-user-agent": USER_AGENT_SHORT,
+                "x-amzn-codewhisperer-optout": "true",
+              },
             })
           },
         }
@@ -106,138 +68,29 @@ export async function KiroAuthPlugin(_input: PluginInput): Promise<Hooks> {
                 ? (inputs.region || process.env.AWS_SSO_REGION || "us-east-1")
                 : "us-east-1"
 
-            const registration = await fetch(`${oidc(region)}/client/register`, {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/json",
-                "User-Agent": `opencode/${Installation.VERSION}`,
-              },
-              body: JSON.stringify({
-                clientName: "opencode-kiro",
-                clientType: "public",
-                scopes: SCOPES,
-                grantTypes: GRANT_TYPES,
-                issuerUrl: url,
-              }),
-            })
+            const { promise: pending, resolve } = Promise.withResolvers<{ url: string; code: string }>()
 
-            if (!registration.ok) {
-              throw new Error("Failed to register OIDC client")
-            }
-
-            const client = (await registration.json()) as {
-              clientId: string
-              clientSecret: string
-              clientIdIssuedAt: number
-              clientSecretExpiresAt: number
-            }
-
-            const device = await fetch(`${oidc(region)}/device_authorization`, {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/json",
-                "User-Agent": `opencode/${Installation.VERSION}`,
-              },
-              body: JSON.stringify({
-                clientId: client.clientId,
-                clientSecret: client.clientSecret,
-                startUrl: url,
-              }),
+            const auth = authenticate({
+              startUrl: url,
+              region,
+              onVerification: (verify, code) => resolve({ url: verify, code }),
             })
 
-            if (!device.ok) {
-              throw new Error("Failed to start device authorization")
-            }
-
-            const auth = (await device.json()) as {
-              verificationUri: string
-              verificationUriComplete: string
-              userCode: string
-              deviceCode: string
-              interval: number
-              expiresIn: number
-            }
+            const verification = await pending
 
             return {
-              url: auth.verificationUriComplete,
-              instructions: `Enter code: ${auth.userCode}`,
+              url: verification.url,
+              instructions: verification.code,
               method: "auto" as const,
-              async callback() {
-                const delay = { ms: auth.interval }
-
-                while (true) {
-                  const response = await fetch(`${oidc(region)}/token`, {
-                    method: "POST",
-                    headers: {
-                      "Content-Type": "application/json",
-                      "User-Agent": `opencode/${Installation.VERSION}`,
-                    },
-                    body: JSON.stringify({
-                      clientId: client.clientId,
-                      clientSecret: client.clientSecret,
-                      grantType: DEVICE_GRANT,
-                      deviceCode: auth.deviceCode,
-                    }),
-                  })
-
-                  if (response.ok) {
-                    const tokens = (await response.json()) as {
-                      accessToken: string
-                      refreshToken: string
-                      expiresIn: number
-                      tokenType: string
-                    }
-
-                    const expires = new Date(Date.now() + tokens.expiresIn * 1000)
-
-                    await mkdir(path.dirname(TOKEN_PATH))
-
-                    await write(TOKEN_PATH, {
-                      accessToken: tokens.accessToken,
-                      refreshToken: tokens.refreshToken,
-                      expiresAt: expires.toISOString(),
-                      region,
-                      clientId: client.clientId,
-                      clientSecret: client.clientSecret,
-                    })
-
-                    await write(CLIENT_PATH, {
-                      clientId: client.clientId,
-                      clientSecret: client.clientSecret,
-                      clientIdIssuedAt: client.clientIdIssuedAt,
-                      clientSecretExpiresAt: client.clientSecretExpiresAt,
-                    })
-
-                    return {
-                      type: "success" as const,
-                      refresh: tokens.refreshToken,
-                      access: tokens.accessToken,
-                      expires: expires.getTime(),
-                    }
-                  }
-
-                  const error = (await response.json().catch(() => ({}))) as {
-                    error?: string
-                    error_description?: string
-                  }
-
-                  if (error.error === "authorization_pending") {
-                    await sleep(delay.ms * 1000 + POLLING_MARGIN_MS)
-                    continue
-                  }
-
-                  if (error.error === "slow_down") {
-                    delay.ms = delay.ms + 5
-                    await sleep(delay.ms * 1000 + POLLING_MARGIN_MS)
-                    continue
-                  }
-
-                  if (error.error) return { type: "failed" as const }
-
-                  await sleep(delay.ms * 1000 + POLLING_MARGIN_MS)
-                  continue
-                }
-              },
+              callback: () =>
+                auth
+                  .then((result) => ({
+                    type: "success" as const,
+                    refresh: result.refreshToken,
+                    access: result.accessToken,
+                    expires: Date.now() + 3600000,
+                  }))
+                  .catch(() => ({ type: "failed" as const })),
             }
           },
         },

packages/opencode/src/plugin/kiro.ts

@@ -35,7 +35,7 @@ import { createOpenAI } from "@ai-sdk/openai"
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible"
 import { createOpenRouter } from "@openrouter/ai-sdk-provider"
 import { createOpenaiCompatible as createGitHubCopilotOpenAICompatible } from "./sdk/copilot"
-import { createKiro } from "./sdk/kiro"
+import { createKiro, hasToken, getApiRegion } from "kiro-ai-provider"
 import { createXai } from "@ai-sdk/xai"
 import { createMistral } from "@ai-sdk/mistral"
 import { createGroq } from "@ai-sdk/groq"
@@ -54,7 +54,6 @@ import {
   isWorkflowModel,
   discoverWorkflowModels,
 } from "gitlab-ai-provider"
-import { hasToken, getApiRegion } from "./sdk/kiro/kiro-auth"
 import { fromNodeProviderChain } from "@aws-sdk/credential-providers"
 import { GoogleAuth } from "google-auth-library"
 import { ProviderTransform } from "./transform"