dsh-llm-kiro
A Kiro provider for the DeepSeek Harness LLM seam.
The package is a standalone Cordis plugin: it mounts in any harness composition through
cordis.yml, registers the kiro provider route on ctx.llm, and needs no changes to the
harness itself.
What it handles
| Concern | Implementation |
|---|
| Existing credentials | Picks up an existing kiro-cli login (the auth_kv table of kiro-cli's SQLite store, IDC and social tokens) and the Kiro IDE token (~/.aws/sso/cache/kiro-auth-token.json with its OIDC client registration) — no second sign-in. An optional bearerTokenEnv reference bypasses ambient discovery for CI/bots. |
| Token refresh | Silent refresh of expired tokens through the AWS SSO OIDC /token endpoint (Builder ID / IAM Identity Center) or the Kiro desktop auth service (Google/GitHub social), write-back into the kiro-cli store so both consumers stay in sync; a 403 mid-stream re-reads the shared store and falls back to kiro-cli debug refresh-auth-token; last-resort failure surfaces as MISSING_CREDENTIAL/AUTH with guidance. |
| The backend | Region/endpoint resolution (SSO region → Kiro API region), the management control plane (List-Available-Profiles, List-Available-Models, shared ~/.kiro-management-models-cache.json catalog cache), and the runtime generateAssistantResponse call over the AWS event-stream protocol (Smithy framing via @smithy/core), with capacity backoff, first-token timeout, and the harness idle watchdog. |
| Models | A bootstrap catalog mirroring the kiro-cli-verified menu (15 models with context windows, output caps, reasoning capability, image modality), exact wire-id resolution (dashed harness ids ⇄ dotted wire ids), and management discovery for the Models page. Reasoning efforts map the harness off/low/high/max vocabulary onto each model's authenticated effort schema, with the Kiro thinking markers on the system prompt. |
Every runtime request carries the harness attribution User-Agent (from @deepseek-ai/dsh-llm
attributionHeaders()) plus the AWS SDK-shaped x-amz-user-agent telemetry header the backend expects.
Install
The package is ESM and declares the harness packages it talks to as peer dependencies — the host
DSH installation provides them. It also declares the dsh bundle manifest
(cordis.patch.yml ships with the package), so it mounts as a profile bundle as well as a
plain plugin dependency.
npx -y @deepseek-ai/dsh plugin --profile web install @joshryandavis/dsh-llm-kiro
Mount it in cordis.yml:
- id: llm-kiro
name: '@joshryandavis/dsh-llm-kiro'
config:
region: us-east-1 # optional; the credential's region wins when omitted
reasoningEffort: high # optional; off | low | high | max (default high)
That is the whole configuration for an existing kiro-cli or Kiro IDE login: credentials are picked
up ambiently, refreshed silently, and written back. A static bearer token works too:
- id: llm-kiro
name: '@joshryandavis/dsh-llm-kiro'
config:
bearerTokenEnv: KIRO_BEARER_TOKEN # stored via the harness credentials service
Config reference
All fields are optional; the llm-kiro user-settings section uses the same schema and can be
edited at runtime — a change reaches the next request without a restart.
| Field | Default | Meaning |
|---|
region | credential's region, else us-east-1 | Kiro API region override. |
runtimeURL | https://runtime.<region>.kiro.dev | Runtime endpoint override for gateway/proxy deployments. |
profileArn | management discovery | Profile ARN override. |
bearerTokenEnv | — | Credential reference for a static bearer token; bypasses ambient discovery. |
thinking | enabled | Deployment lock; disabled limits every request to off. |
reasoningEffort | high | Default effort; off disables thinking. |
maxTokens | 8192 | Default per-request output cap; per-model caps and explicit values win. |
defaultContextWindow | 200000 | Context capacity for models without an exact value. |
models | bootstrap catalog | Advisory model list shown to discovery consumers. |
streamIdleTimeoutMs | 300000 | Per-read idle budget. |
firstTokenTimeoutMs | 90000 | First-event budget; per-model overrides exist for slow models. |
retryPolicy | normal, five retries | Provider-owned retry policy for dsh-llm-retry. |
kiroCliDbPath | platform application-support | kiro-cli SQLite store override. |
ssoCacheDir | ~/.aws/sso/cache | Kiro IDE token directory override. |
allowKiroCliRefresh | true | Whether 403 recovery may shell out to kiro-cli. |
Models
Bootstrap catalog (harness id → wire id):
| Harness id | Wire id | Context | Reasoning | Images |
|---|
claude-opus-4-8 / claude-opus-4-7 | claude-opus-4.8 / claude-opus-4.7 | 1M | ✓ | ✓ |
claude-opus-4-6 | claude-opus-4.6 | 1M | ✓ | ✓ |
claude-sonnet-5 / claude-sonnet-4-6 | claude-sonnet-5 / claude-sonnet-4.6 | 1M | ✓ | ✓ |
claude-sonnet-4-5 / claude-sonnet-4 | claude-sonnet-4.5 / claude-sonnet-4 | 200K | ✓ | ✓ |
claude-haiku-4-5 | claude-haiku-4.5 | 200K | ✗ | ✓ |
claude-fable-5 | claude-fable-5 | 1M | ✓ | ✓ |
deepseek-3-2 | deepseek-3.2 | 164K | ✓ | ✗ |
minimax-m2-5 / minimax-m2-1 | minimax-m2.5 / minimax-m2.1 | 196K | ✗ | ✗ |
glm-5 | glm-5 | 200K | ✓ | ✗ |
qwen3-coder-next | qwen3-coder-next | 256K | ✓ | ✗ |
auto | auto | 1M | ✓ | ✓ |
Both dashed and dotted spellings resolve to the wire id. The authenticated management catalog
(per credential, per region) overrides capacities and effort ladders when discovery has run; the
catalog cache at ~/.kiro-management-models-cache.json is shared with pi-provider-kiro.
Development
pnpm install
pnpm run build # tsc -b: builds the dependency closure (into the .context checkout) + this package
pnpm test # vitest suite (95 tests): endpoints, store, refresh, models, serialize,
# translate, adapter transport, real Loader composition
Tests resolve the harness packages from the sibling .context/deepseek-harness checkout through
tsconfig paths (see vitest.config.ts), so they exercise the exact source APIs. Credential tests
are fully isolated from the host machine's real kiro-cli / Kiro IDE stores.
Known limitations and deferred work
- Interactive login is not bundled: with no ambient credentials the provider fails with
MISSING_CREDENTIAL and points at kiro-cli login or the Kiro IDE. A device-code flow can be
added later on the management seam.
- Legacy inline thinking dialect: reasoning arrives through the native
thinkingText events;
models that emit <thinking> tags inside content keep them in the visible text block.
- Replay state is not emitted; history is resent as provider-neutral content on follow-ups.
- The management catalog refresh is pull-based (discovery or cache age), not background-warmed.
License
MIT
