From 6c2083949f887a9f1a1d37bf8cc2a27c3bd650d7 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Fri, 13 Feb 2026 19:33:33 +0700
Subject: [PATCH] fix(cliproxy): mark Kiro as device_code flow for dashboard
 auth

CLIProxyAPIPlus uses device code flow for Kiro authentication, returning
{method: "device_code", state, status} without an immediate URL. The URL
is provided via polling the /get-auth-status endpoint.

Previously, Kiro was configured as authorization_code flow, causing
dashboard auth to fail with "No authorization URL received from CLIProxyAPI"
because the web-server routes expected synchronous URL response.

Changes:
- provider-capabilities.ts: kiro.oauthFlow = 'device_code', callbackPort = null
- provider-config.ts: Add 'kiro' to DEVICE_CODE_PROVIDERS array
- provider-capabilities.test.ts: Update test expectations

This routes Kiro through /start endpoint which properly handles device code
flow via WebSocket events (deviceCodeReceived, deviceCodeCompleted, etc).

Closes #552
---
 src/cliproxy/provider-capabilities.ts             | 4 ++--
 tests/unit/cliproxy/provider-capabilities.test.ts | 4 ++--
 ui/src/lib/provider-config.ts                     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/cliproxy/provider-capabilities.ts b/src/cliproxy/provider-capabilities.ts
index bb377629..6dec96a8 100644
--- a/src/cliproxy/provider-capabilities.ts
+++ b/src/cliproxy/provider-capabilities.ts
@@ -46,8 +46,8 @@ export const PROVIDER_CAPABILITIES: Record<CLIProxyProvider, ProviderCapabilitie
   },
   kiro: {
     displayName: 'Kiro (AWS)',
-    oauthFlow: 'authorization_code',
-    callbackPort: 9876,
+    oauthFlow: 'device_code',
+    callbackPort: null,
     aliases: ['codewhisperer'],
   },
   ghcp: {
diff --git a/tests/unit/cliproxy/provider-capabilities.test.ts b/tests/unit/cliproxy/provider-capabilities.test.ts
index 2e32cb27..7aa13e7e 100644
--- a/tests/unit/cliproxy/provider-capabilities.test.ts
+++ b/tests/unit/cliproxy/provider-capabilities.test.ts
@@ -30,13 +30,12 @@ describe('provider-capabilities', () => {
   });
 
   it('returns providers by OAuth flow capability', () => {
-    expect(getProvidersByOAuthFlow('device_code')).toEqual(['qwen', 'ghcp']);
+    expect(getProvidersByOAuthFlow('device_code')).toEqual(['qwen', 'kiro', 'ghcp']);
     expect(getProvidersByOAuthFlow('authorization_code')).toEqual([
       'gemini',
       'codex',
       'agy',
       'iflow',
-      'kiro',
       'claude',
     ]);
   });
@@ -53,6 +52,7 @@ describe('provider-capabilities', () => {
 
   it('exposes callback port and display name capabilities', () => {
     expect(getOAuthCallbackPort('qwen')).toBeNull();
+    expect(getOAuthCallbackPort('kiro')).toBeNull();
     expect(getOAuthCallbackPort('gemini')).toBe(8085);
     expect(getProviderDisplayName('agy')).toBe('AntiGravity');
   });
diff --git a/ui/src/lib/provider-config.ts b/ui/src/lib/provider-config.ts
index a7ca02a1..bdcbd378 100644
--- a/ui/src/lib/provider-config.ts
+++ b/ui/src/lib/provider-config.ts
@@ -76,7 +76,7 @@ export function getProviderDisplayName(provider: string): string {
  * Providers that use Device Code OAuth flow instead of Authorization Code flow.
  * Device Code flow requires displaying a user code for manual entry at provider's website.
  */
-export const DEVICE_CODE_PROVIDERS: CLIProxyProvider[] = ['ghcp', 'qwen'];
+export const DEVICE_CODE_PROVIDERS: CLIProxyProvider[] = ['ghcp', 'kiro', 'qwen'];
 
 /** Check if provider uses Device Code flow */
 export function isDeviceCodeProvider(provider: string): boolean {