# pi-kiro-dev

Kiro Dev provider extension for [Pi](https://github.com/earendil-works/pi). It integrates AWS Builder ID and IAM Identity Center device login, dynamic Kiro profile/model discovery, and the current `kiro.dev` streaming protocol.

## Install

```bash
pi install npm:pi-kiro-dev
```

Restart Pi or run `/reload`, then authenticate:

```text
/login kiro
```

Leave the start URL blank for AWS Builder ID, or enter an IAM Identity Center start URL and optional region. Credentials are stored by Pi in `~/.pi/agent/auth.json` and include a sensitive refresh token and OIDC client secret.

## Usage

Once authenticated, check your Kiro credit balance from the prompt:

```text
/kiro-usage
```

It prints the credits used against the subscription total, the remaining credits, and the next reset date for the signed-in profile. Pi 0.84.x does not expose a standard usage-provider extension interface (plugins cannot register a `/usage` provider), so this package provides the query as the `/kiro-usage` compatibility command instead.

## What this package implements

- AWS SSO-OIDC device authorization and refresh
- request timeouts, cancellation, `authorization_pending`, and `slow_down`
- credit usage queries through `management.<region>.kiro.dev/getUsageLimits`
  (exposed as the `/kiro-usage` command)
- Kiro profile and model discovery through `management.<region>.kiro.dev`
- streaming through `runtime.<region>.kiro.dev/generateAssistantResponse`
- Kiro tool calls, thinking content, images, usage, and AWS EventStream CRC validation
- region-aware runtime routing and profile-scoped models

This package targets the current Kiro Dev endpoints. It is separate from the older `pi-kiro` package, whose published `0.1.3` release still targets the retired `q.<region>.amazonaws.com` runtime.

## Development

```bash
bun install
bun run typecheck
bun run test
bun run build
```

Try the local package without installing it permanently:

```bash
pi -e .
```

## Security

Pi extensions run with full user permissions. Review the source before installation. Treat `refresh`, `clientSecret`, and access tokens as passwords; do not log or transmit them outside the AWS/Kiro endpoints used by this extension.

This project is not affiliated with Amazon Web Services or Kiro.

## License

MIT