dsh-llm-kiro

A Kiro provider for the DeepSeek Harness LLM seam.

The package is a standalone Cordis plugin: it mounts in any harness composition through cordis.yml, registers the kiro provider route on ctx.llm, and needs no changes to the harness itself.

What it handles

Concern	Implementation
Existing credentials	Picks up an existing kiro-cli login (the auth_kv table of kiro-cli's SQLite store, IDC and social tokens) and the Kiro IDE token (~/.aws/sso/cache/kiro-auth-token.json with its OIDC client registration) — no second sign-in. An optional bearerTokenEnv reference bypasses ambient discovery for CI/bots.
Token refresh	Silent refresh of expired tokens through the AWS SSO OIDC /token endpoint (Builder ID / IAM Identity Center) or the Kiro desktop auth service (Google/GitHub social), write-back into the kiro-cli store so both consumers stay in sync; a 403 mid-stream re-reads the shared store and falls back to kiro-cli debug refresh-auth-token; last-resort failure surfaces as MISSING_CREDENTIAL/AUTH with guidance.
The backend	Region/endpoint resolution (SSO region → Kiro API region), the management control plane (List-Available-Profiles, List-Available-Models, shared ~/.kiro-management-models-cache.json catalog cache), and the runtime generateAssistantResponse call over the AWS event-stream protocol (Smithy framing via @smithy/core), with capacity backoff, first-token timeout, and the harness idle watchdog.
Models	A bootstrap catalog mirroring the kiro-cli-verified menu (15 models with context windows, output caps, reasoning capability, image modality), exact wire-id resolution (dashed harness ids ⇄ dotted wire ids), and management discovery for the Models page. Reasoning efforts map the harness off/low/high/max vocabulary onto each model's authenticated effort schema, with the Kiro thinking markers on the system prompt.

Every runtime request carries the harness attribution User-Agent (from @deepseek-ai/dsh-llm attributionHeaders()) plus the AWS SDK-shaped x-amz-user-agent telemetry header the backend expects.

Install

The package is ESM and declares the harness packages it talks to as peer dependencies — the host DSH installation provides them. It also declares the dsh bundle manifest (cordis.patch.yml ships with the package), so it mounts as a profile bundle as well as a plain plugin dependency.

npx -y @deepseek-ai/dsh plugin --profile web install @joshryandavis/dsh-llm-kiro

Mount it in cordis.yml:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    region: us-east-1        # optional; the credential's region wins when omitted
    reasoningEffort: high    # optional; off | low | high | max (default high)

That is the whole configuration for an existing kiro-cli or Kiro IDE login: credentials are picked up ambiently, refreshed silently, and written back. A static bearer token works too:

- id: llm-kiro
  name: '@joshryandavis/dsh-llm-kiro'
  config:
    bearerTokenEnv: KIRO_BEARER_TOKEN   # stored via the harness credentials service

Config reference

All fields are optional; the llm-kiro user-settings section uses the same schema and can be edited at runtime — a change reaches the next request without a restart.

Field	Default	Meaning
region	credential's region, else us-east-1	Kiro API region override.
runtimeURL	https://runtime.<region>.kiro.dev	Runtime endpoint override for gateway/proxy deployments.
profileArn	management discovery	Profile ARN override.
bearerTokenEnv	—	Credential reference for a static bearer token; bypasses ambient discovery.
thinking	enabled	Deployment lock; disabled limits every request to off.
reasoningEffort	high	Default effort; off disables thinking.
maxTokens	8192	Default per-request output cap; per-model caps and explicit values win.
defaultContextWindow	200000	Context capacity for models without an exact value.
models	bootstrap catalog	Advisory model list shown to discovery consumers.
streamIdleTimeoutMs	300000	Per-read idle budget.
firstTokenTimeoutMs	90000	First-event budget; per-model overrides exist for slow models.
retryPolicy	normal, five retries	Provider-owned retry policy for dsh-llm-retry.
kiroCliDbPath	platform application-support	kiro-cli SQLite store override.
ssoCacheDir	~/.aws/sso/cache	Kiro IDE token directory override.
allowKiroCliRefresh	true	Whether 403 recovery may shell out to kiro-cli.

Models

Bootstrap catalog (harness id → wire id):

Harness id	Wire id	Context	Reasoning	Images
claude-opus-4-8 / claude-opus-4-7	claude-opus-4.8 / claude-opus-4.7	1M	✓	✓
claude-opus-4-6	claude-opus-4.6	1M	✓	✓
claude-sonnet-5 / claude-sonnet-4-6	claude-sonnet-5 / claude-sonnet-4.6	1M	✓	✓
claude-sonnet-4-5 / claude-sonnet-4	claude-sonnet-4.5 / claude-sonnet-4	200K	✓	✓
claude-haiku-4-5	claude-haiku-4.5	200K	✗	✓
claude-fable-5	claude-fable-5	1M	✓	✓
deepseek-3-2	deepseek-3.2	164K	✓	✗
minimax-m2-5 / minimax-m2-1	minimax-m2.5 / minimax-m2.1	196K	✗	✗
glm-5	glm-5	200K	✓	✗
qwen3-coder-next	qwen3-coder-next	256K	✓	✗
auto	auto	1M	✓	✓

Both dashed and dotted spellings resolve to the wire id. The authenticated management catalog (per credential, per region) overrides capacities and effort ladders when discovery has run; the catalog cache at ~/.kiro-management-models-cache.json is shared with pi-provider-kiro.

Development

pnpm install
pnpm run build       # tsc -b: builds the dependency closure (into the .context checkout) + this package
pnpm test            # vitest suite (95 tests): endpoints, store, refresh, models, serialize,
                     # translate, adapter transport, real Loader composition

Tests resolve the harness packages from the sibling .context/deepseek-harness checkout through tsconfig paths (see vitest.config.ts), so they exercise the exact source APIs. Credential tests are fully isolated from the host machine's real kiro-cli / Kiro IDE stores.

Known limitations and deferred work

• Interactive login is not bundled: with no ambient credentials the provider fails with MISSING_CREDENTIAL and points at kiro-cli login or the Kiro IDE. A device-code flow can be added later on the management seam.
• Legacy inline thinking dialect: reasoning arrives through the native thinkingText events; models that emit <thinking> tags inside content keep them in the visible text block.
• Replay state is not emitted; history is resent as provider-neutral content on follow-ups.
• The management catalog refresh is pull-based (discovery or cache age), not background-warmed.

License

MIT