From e425f477a44fa030a8dc5a6c28bed14d9bdfd762 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Sat, 14 Feb 2026 13:33:37 +0700
Subject: [PATCH] fix(cli): add kiro auth-method flag wiring and help

- parse and validate --kiro-auth-method for Kiro and Kiro composite tiers

- pass selected method through auth/import flows

- document supported Kiro auth-method values in ccs --help

Refs #552

Refs #233
---
 src/cliproxy/executor/index.ts | 33 +++++++++++++++++++++++++++++++++
 src/commands/help-command.ts   |  4 ++++
 2 files changed, 37 insertions(+)

diff --git a/src/cliproxy/executor/index.ts b/src/cliproxy/executor/index.ts
index c084dc68..3ea5b1c7 100644
--- a/src/cliproxy/executor/index.ts
+++ b/src/cliproxy/executor/index.ts
@@ -52,6 +52,7 @@ import {
 import { loadOrCreateUnifiedConfig } from '../../config/unified-config-loader';
 import { installImageAnalyzerHook } from '../../utils/hooks';
 import { HttpsTunnelProxy } from '../https-tunnel-proxy';
+import { isKiroAuthMethod, KiroAuthMethod, normalizeKiroAuthMethod } from '../auth/auth-types';
 
 // Import modular components
 import { waitForProxyReadyWithSpinner, spawnProxy } from './lifecycle-manager';
@@ -307,6 +308,33 @@ export async function execClaudeWithCLIProxy(
     setNickname = argsWithoutProxy[nicknameIdx + 1];
   }
 
+  // Parse --kiro-auth-method flag
+  let kiroAuthMethod: KiroAuthMethod | undefined;
+  const kiroMethodIdx = argsWithoutProxy.indexOf('--kiro-auth-method');
+  if (kiroMethodIdx !== -1) {
+    const rawMethod = argsWithoutProxy[kiroMethodIdx + 1];
+    if (!rawMethod || rawMethod.startsWith('-')) {
+      console.error(fail('--kiro-auth-method requires a value'));
+      console.error('    Supported values: aws, aws-authcode, google, github');
+      process.exitCode = 1;
+      return;
+    }
+    const normalized = rawMethod.trim().toLowerCase();
+    if (!isKiroAuthMethod(normalized)) {
+      console.error(fail(`Invalid --kiro-auth-method value: ${rawMethod}`));
+      console.error('    Supported values: aws, aws-authcode, google, github');
+      process.exitCode = 1;
+      return;
+    }
+    kiroAuthMethod = normalizeKiroAuthMethod(normalized);
+  }
+
+  if (kiroAuthMethod && provider !== 'kiro' && !compositeProviders.includes('kiro')) {
+    console.error(fail('--kiro-auth-method is only valid for ccs kiro'));
+    process.exitCode = 1;
+    return;
+  }
+
   // Parse --thinking / --effort flags (aliases; first occurrence wins)
   const thinkingParse = parseThinkingOverride(argsWithoutProxy);
   if (thinkingParse.error) {
@@ -465,6 +493,7 @@ export async function execClaudeWithCLIProxy(
     const authSuccess = await triggerOAuth(provider, {
       verbose,
       import: true,
+      ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
       ...(setNickname ? { nickname: setNickname } : {}),
     });
     if (!authSuccess) {
@@ -495,6 +524,7 @@ export async function execClaudeWithCLIProxy(
           const authSuccess = await triggerOAuth(p, {
             verbose,
             add: addAccount,
+            ...(kiroAuthMethod && p === 'kiro' ? { kiroMethod: kiroAuthMethod } : {}),
             ...(forceHeadless ? { headless: true } : {}),
             ...(setNickname ? { nickname: setNickname } : {}),
             ...(noIncognito ? { noIncognito: true } : {}),
@@ -535,6 +565,7 @@ export async function execClaudeWithCLIProxy(
       const authSuccess = await triggerOAuth(provider, {
         verbose,
         add: addAccount,
+        ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
         ...(forceHeadless ? { headless: true } : {}),
         ...(setNickname ? { nickname: setNickname } : {}),
         ...(noIncognito ? { noIncognito: true } : {}),
@@ -854,6 +885,7 @@ export async function execClaudeWithCLIProxy(
     '--accounts',
     '--use',
     '--nickname',
+    '--kiro-auth-method',
     '--thinking',
     '--effort',
     '--1m',
@@ -872,6 +904,7 @@ export async function execClaudeWithCLIProxy(
     if (
       argsWithoutProxy[idx - 1] === '--use' ||
       argsWithoutProxy[idx - 1] === '--nickname' ||
+      argsWithoutProxy[idx - 1] === '--kiro-auth-method' ||
       argsWithoutProxy[idx - 1] === '--thinking' ||
       argsWithoutProxy[idx - 1] === '--effort'
     )
diff --git a/src/commands/help-command.ts b/src/commands/help-command.ts
index 0e8f0065..5d269d75 100644
--- a/src/commands/help-command.ts
+++ b/src/commands/help-command.ts
@@ -193,6 +193,10 @@ Run ${color('ccs config', 'command')} for web dashboard`.trim();
       ['ccs <provider> --logout', 'Clear authentication'],
       ['ccs <provider> --headless', 'Headless auth (for SSH)'],
       ['ccs <provider> --port-forward', 'Force port-forwarding mode (skip prompt)'],
+      ['ccs kiro --auth --kiro-auth-method aws', 'Kiro via AWS Builder ID (device code)'],
+      ['ccs kiro --auth --kiro-auth-method aws-authcode', 'Kiro via AWS auth code flow'],
+      ['ccs kiro --auth --kiro-auth-method google', 'Kiro via Google OAuth'],
+      ['ccs kiro --auth --kiro-auth-method github', 'Kiro via GitHub OAuth (Dashboard flow)'],
       ['ccs kiro --import', 'Import token from Kiro IDE'],
       ['ccs kiro --incognito', 'Use incognito browser (default: normal)'],
       ['ccs codex "explain code"', 'Use with prompt'],