[SemonCat]

When Magpie runs on a remote server or in Docker, choosing Builder ID or IAM Identity Center on Kiro's portal redirects the browser to localhost before the account login page appears. The original flow needs two pasted callback URLs and leaves users at an unreachable page immediately after selecting a provider.

This adds a sign-in selector to the plugin:

• AWS Builder ID registers its client and opens AWS authorization directly.
• IAM Identity Center asks for the organization's HTTPS Start URL and AWS region (blank defaults to us-east-1), then opens the organization login directly.
• Kiro sign-in page retains the original portal for Google, GitHub and other methods; callers without prompt inputs retain the portal behavior.

Direct AWS login skips the first loopback callback, leaving one final callback URL to paste into remote Magpie. Local browsers retain automatic completion. This uses authorization code + PKCE, with the existing scopes; it does not introduce device authorization or a public callback relay.

The shared callback handler also validates stage-specific state/path, reuses the existing AWS authorization URL for repeated portal callbacks, exchanges each accepted code at most once, and releases a superseded login's listener. Stale or unrelated callbacks do not cancel the current login. Package version: 0.1.20 → 0.1.21.

Validation

• Isolated HOME: bun test packages/kiro — 110 passed, 0 failed, including remote callback transport emulation, direct Builder ID and organization login, PKCE, invalid inputs, stale state, duplicate callbacks and superseded login cases.
• bun scripts/check.mjs kiro, node --check packages/kiro/index.mjs, git diff --check: passed.
• The deployed implementation passed the same 110-test suite in remote Magpie's Bun 1.4.4 runtime. The final PR preserves upstream's existing schema/search implementation and tests.
• Live remote Magpie 0.1.2124: direct personal Builder ID reached the AWS account login page; direct IAM Identity Center reached the intended organization's username page. The operator then completed organization login and confirmed success. Personal Builder ID end-to-end account authorization was not separately completed.

Tests use synthetic codes, states and tokens. No account credentials, organization-specific Start URL or live authorization URLs are included in the patch.

[yetone]

Thanks @SemonCat! Merged as 498358c and published as @magpie-community/opencode-kiro-auth@0.1.21. magpie v0.1.2144 raises Kiro's mover min to 0.1.21, so users already moved onto the plugin get it automatically.

Reviewed line by line at 236db71. bun test packages/kiro passes 110 of 110. Separate probes on mote, which weren't committed, covered:

• the paste-once Builder ID flow, including the PKCE check and refresh;
• region and Start URL validation, run before any request goes out;
• denied and expired codes;
• a newer sign-in superseding an older one, with the older one's port freed at once.

These ran against a mocked AWS. A real Builder ID or Identity Center sign-in wasn't tried on our side, so a report from a real org account is welcome.