pi-kiro-provider

pi-kiro-provider is a Pi extension that registers Kiro as a streaming AI provider backed by Kiro's AWS CodeWhisperer-compatible API and OAuth flow.

• Provider ID: kiro
• npm: https://www.npmjs.com/package/pi-kiro-provider
• GitHub: https://github.com/MasuRii/pi-kiro-provider

Features

• Registers the Kiro provider through Pi's provider API with authHeader: false so credentials stay managed by the OAuth provider path.
• Registers a Kiro OAuth provider with Builder ID, Google, and GitHub sign-in method labels.
• Replays runtime provider registration events for pi-multi-auth readiness and Pi session lifecycle events.
• Provides configurable model metadata, thinking-level mappings, prompt-caching metadata, request timeout, headers, and optional Kiro profile ARN support.
• Drops static Authorization header overrides so managed OAuth credentials cannot be bypassed by config.
• Writes optional debug logs only under the extension-local debug/ directory when debug is enabled.

Installation

npm package

pi install npm:pi-kiro-provider

Git repository

pi install git:github.com/MasuRii/pi-kiro-provider

Local extension folder

Place this folder in one of Pi's extension discovery paths:

Scope	Path
Global default	~/.pi/agent/extensions/pi-kiro-provider (respects PI_CODING_AGENT_DIR)
Project	.pi/extensions/pi-kiro-provider

Pi discovers the extension through the root index.ts entry listed in package.json.

Configuration

Runtime configuration lives in config.json at the extension root. The file is user-local, gitignored, and excluded from npm package contents. A starter template is included at config/config.example.json.

Copy the template before customizing local settings:

cp config/config.example.json config.json

Minimal default-compatible configuration:

{
  "enabled": true,
  "debug": false,
  "providerId": "kiro",
  "displayName": "Kiro",
  "upstreamUrl": "https://codewhisperer.us-east-1.amazonaws.com/generateAssistantResponse",
  "endpoint": "codewhisperer",
  "apiKey": "$KIRO_ACCESS_TOKEN",
  "requestTimeoutMs": 600000,
  "profileArn": "",
  "headers": {},
  "oauth": {
    "region": "us-east-1",
    "startUrl": "https://view.awsapps.com/start",
    "clientName": "kiro-oauth-client",
    "clientType": "public",
    "scopes": [
      "codewhisperer:completions",
      "codewhisperer:analysis",
      "codewhisperer:conversations"
    ],
    "grantTypes": [
      "urn:ietf:params:oauth:grant-type:device_code",
      "refresh_token"
    ],
    "issuerUrl": "https://identitycenter.amazonaws.com/ssoins-722374e8c3c8e6c6",
    "skipIssuerUrlForRegistration": false,
    "socialPortalUrl": "https://app.kiro.dev/signin",
    "socialPortalRedirectUri": "http://localhost:3128",
    "socialCallbackPath": "/oauth/callback",
    "socialAuthorizeUrl": "https://prod.us-east-1.auth.desktop.kiro.dev/login",
    "socialTokenUrl": "https://prod.us-east-1.auth.desktop.kiro.dev/oauth/token",
    "socialRefreshUrl": "https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken",
    "socialRedirectUri": "kiro://kiro.kiroAgent/authenticate-success",
    "methodLabels": {
      "builder-id": "AWS Builder ID",
      "google": "Google",
      "github": "GitHub"
    }
  }
}

Configuration options

Option	Type	Default	Description
enabled	boolean	true	Enables the provider extension.
debug	boolean	false	Enables file-only debug logging under debug/debug.log.
providerId	string	kiro	Provider ID registered with Pi.
displayName	string	Kiro	Human-readable provider name shown by Pi.
upstreamUrl	string	CodeWhisperer generateAssistantResponse endpoint	Streaming API endpoint.
endpoint	codewhisperer | amazonq	inferred from upstreamUrl	Controls upstream request/response formatting.
apiKey	string	$KIRO_ACCESS_TOKEN	Environment variable reference used by provider metadata.
requestTimeoutMs	number	600000	Request timeout for streaming and OAuth calls.
profileArn	string	empty	Optional Kiro profile ARN sent as x-kiro-profile-arn.
headers	object	{}	Additional non-authorization headers sent upstream.
oauth	object	Kiro OAuth defaults	OAuth device/social sign-in endpoint configuration.
models	array	built-in Kiro model list	Optional replacement model list. Omit to use built-in defaults.
modelDefaults	object	built-in model defaults	Optional defaults applied to configured models.

Authorization headers configured in headers, modelDefaults.headers, or model-level headers are ignored intentionally. Kiro credentials are selected by the provider/OAuth integration.

Validation

npm run typecheck
npm run lint
npm run test
npm run check
npm run package:dry-run

Publishing

The package metadata follows the same publish-ready shape used by established Pi extensions:

• entrypoint: index.ts
• package exports: . → ./index.ts
• Pi extension manifest: pi.extensions
• published files: source, README, changelog, license, and config template
• runtime config.json, debug/, test artifacts, package lock, and local metadata excluded from npm publication

Do not publish, push, or tag until the GitHub/npm release review is complete.

License

MIT