feat: add Kiro provider

[ikeda-tomoya-swx]

Closes #9165

Summary

Add a new provider for Kiro (AWS CodeWhisperer) that enables access to Claude models via AWS Bedrock using Kiro CLI authentication.

Features

• Full LanguageModelV2 SDK implementation - Complete AI SDK v2 compatibility
• Plugin-based authentication - Uses Kiro CLI's SQLite token storage
• Automatic token refresh - Refreshes expired tokens via AWS SSO OIDC endpoint automatically
• Automatic login prompt - Prompts user to run kiro-cli login when token is missing or refresh fails
• AWS Event Stream parsing - Proper handling of streaming responses
• Extended thinking support - Thinking mode variants (high, max) for supported models

Supported Models

Model	Thinking Support	Context Limit
claude-sonnet-4-5	✅ (high, max)	200K
claude-opus-4-5	✅ (high, max)	200K
claude-sonnet-4	✅ (high, max)	200K
claude-haiku-4-5	❌	200K
claude-3-7-sonnet	✅ (high, max)	200K

Architecture

graph TB
    subgraph OpenCode
        A[Session/LLM] --> B[KiroLanguageModel]
        B --> C[Converters]
        B --> D[Streaming Parser]
    end
    
    subgraph Authentication
        E[KiroAuthPlugin] --> F[(Kiro CLI SQLite)]
        E --> G[AWS SSO OIDC]
    end
    
    subgraph External
        H[AWS Bedrock API]
    end
    
    B --> E
    E -->|Bearer Token| H
    H -->|Event Stream| D
    C -->|Kiro Payload| H

Loading

Token Refresh Flow

sequenceDiagram
    participant OC as OpenCode
    participant Plugin as KiroAuthPlugin
    participant DB as SQLite DB
    participant OIDC as AWS SSO OIDC
    participant API as AWS Bedrock

    OC->>Plugin: Request with token
    Plugin->>DB: Get token
    DB-->>Plugin: Token (expires_at)
    
    alt Token valid (> 5min remaining)
        Plugin->>API: Request with Bearer token
        API-->>OC: Response
    else Token expired or expiring soon
        Plugin->>OIDC: Refresh token request
        OIDC-->>Plugin: New access_token (1hr)
        Plugin->>DB: Save new token
        Plugin->>API: Request with new Bearer token
        API-->>OC: Response
    end

Loading

Token Management

Automatic Refresh

• Access tokens expire in 1 hour
• Tokens are automatically refreshed via AWS SSO OIDC before expiry (5 min buffer)
• Refreshed tokens are saved back to Kiro CLI's SQLite database
• Tokens are shared with Kiro CLI (same database location)

Token Storage Location

OS	Path
macOS	~/Library/Application Support/kiro-cli/data.sqlite3
Windows	%APPDATA%/kiro-cli/data.sqlite3
Linux	~/.local/share/kiro-cli/data.sqlite3

File Structure

packages/opencode/src/
├── plugin/kiro.ts                         # Authentication plugin with auto-refresh
├── provider/
│   ├── provider.ts                        # Model definitions
│   ├── transform.ts                       # Variant support
│   └── sdk/kiro/src/
│       ├── index.ts                       # SDK entry point
│       ├── kiro-provider.ts               # Provider factory
│       ├── kiro-language-model.ts         # LanguageModelV2 implementation
│       ├── converters.ts                  # Prompt conversion
│       ├── streaming.ts                   # AWS Event Stream parser
│       └── model-resolver.ts              # Model name normalization

Testing

All 36 tests passing:

packages/opencode/test/
├── plugin/kiro.test.ts           # 4 tests
├── provider/kiro.test.ts         # 24 tests
└── provider/kiro-provider.test.ts # 8 tests

 36 pass
 0 fail
 82 expect() calls

Verification

Tested and verified working:

• ✅ Basic chat conversations
• ✅ Tool calls (bash, read, write, etc.)
• ✅ Multi-turn conversations
• ✅ Extended thinking mode
• ✅ Streaming responses
• ✅ Automatic token refresh

Checklist

• Code follows the project's style guidelines
• Tests added and passing
• TypeScript typecheck passes

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

No duplicate PRs found

[aiml-gmlee]

Hello, I was excited to see this PR and immediately tried building it locally.
During the process of parsing Kiro’s base URL, my region was set to ap-northeast-2, but there was no DNS entry for codewhisperer.ap-northeast-2.
When I fixed the region to us-east-2, it worked as expected.
Could you please take a look at this? And thank you very much for the great work.

@@ -192,7 +192,7 @@ export async function KiroAuthPlugin(_input: PluginInput): Promise<Hooks> {
         const token = await getKiroToken()
         if (!token) return {}

-        const region = token.region || "us-east-1"
+        const region = "us-east-1"
         const baseURL = `https://codewhisperer.${region}.amazonaws.com`

• FYI
  I search all region's url("codewhisperer.{region}.amazonaws.com"), but only "us-east-1" is working.
  maybe only one region is available.

[ikeda-tomoya-swx]

@aiml-gmlee
Thank you for testing this and reporting the issue! I wasn't able to test all regions myself, so this is really helpful.

I tested a few regions and confirmed that only us-east-1 is working for the Kiro API endpoint. I've now fixed the region to us-east-1 with a comment explaining this limitation.

8b97e9d

[aiml-gmlee]

good! tests are all passed!

[thangtuts]

Perfect! Please release ASAP!

[maxmax1992]

It works, but I needed to have a kiro-cli installed. For other providers I believe this is not a requirement.

[imleaver]

When can we know when this going to release? I need it badly T_T

[imleaver]

By the way when I tried to use this https://www.npmjs.com/package/@zhafron/opencode-kiro-auth with kiro-cli installed, my Kiro account get blocked. Beware of this method seem AWS team acting like claude code, not allow to use Kiro other than their own recognized agentic tools.

[hueyexe]

This is great work @ikeda-tomoya-swx I have pulled your branch, built from source and I'm currently running this locally until it can hopefully get released. FYI I use AWS SSO/IAM and it's working nicely (I had kiro-cli previously installed). The opencode-kiro-auth plugin is not compatible with AWS SSO, just builder IDs. But this is working a treat.

[hueyexe]

@ikeda-tomoya-swx after some time coding, I noticed the auto compacting did not happen (>80% context window). Manually triggering /compact results in an error: Error: Kiro API error: 400 Bad Request - {"message":"Improperly formed request.","reason":null}

[maxmax1992]

@ikeda-tomoya-swx getting same issue when compacting

[ItzMeAyben]

Tried using https://www.npmjs.com/package/@zhafron/opencode-kiro-auth but no luck, I pulled this branch and worked perfectly. Hoping it get merged asap. thanks!

[DaniBedz]

Tried using npmjs.com/package/@zhafron/opencode-kiro-auth but no luck, I pulled this branch and worked perfectly. Hoping it get merged asap. thanks!

Are you me? I went on the exact same journey. Keen for this to get merged please. 🙏🏻

[kfiramar]

Tried using https://www.npmjs.com/package/@zhafron/opencode-kiro-auth but no luck, I pulled this branch and worked perfectly. Hoping it get merged asap. thanks!

Tried using npmjs.com/package/@zhafron/opencode-kiro-auth but no luck, I pulled this branch and worked perfectly. Hoping it get merged asap. thanks!

Are you me? I went on the exact same journey. Keen for this to get merged please. 🙏🏻

I faced everything you did, but I did not find this PR... So I fixed all the errors you were facing with the plugin, if you want to use the plugin with the fixes feel free... PRs are open for it:

[hksonicoding]

I have also pulled this branch and tried the kiro plugin. It works. Looking forward to seeing this merged! Thank you for this very useful contribution!

[jsmsalt]

Thank you very much for this contribution. I hope it gets prioritized and merged soon!

[hyunseok-tmap]

Thank you very much! It works perfectly for me. I hope this gets merged soon!

[DaniBedz]

One thing I've noticed (but I'm not sure if this relates to issues with the provider itself), is that I can't get accurate context size/token usage info using the Kiro provider:

In the image above, this isn't a new session, so I'm expecting to see some usage % and other token values. This is the same in the TUI as well as the desktop app.

Here's an example from the same session, but using a different model/provider:

This is particular bad because it seems to break auto compact.

Let me know if you need me to provide any extra information for you to recreate.

[AmshegaR]

Kiro-CLI supports ACP now

Kiro-CLI adopts ACP
Kiro-CLI ACP Docs

[hueyexe]

Anyone keeping tabs on this thread; I have been using https://github.com/jwadow/kiro-gateway with Claude Code to tie me over in the meantime. It fails to auto-compact and tool use (web search) is broken but good enough.

@ikeda-tomoya-swx trust you are busy (day job, life etc.) but please let us know if we can help with this PR. Would be great if we can get this over the line.

[maksym-dakal]

While we wait for this PR to merge, we can use the Kiro auth plugin.
https://github.com/tickernelz/opencode-kiro-auth