bug(kiro): model routing ignored without origin, parallel tool results rejected, kiro-cli social logins unsupported; Agent run failed loses its cause

[nijuyr]

Description

Using the built-in kiro provider with a Kiro Power subscription on a Google (social) login surfaced several transport/auth defects beyond #6164 and #6158, plus an unrelated diagnosability gap where Error: Agent run failed. discards its cause. All findings below were verified with live requests against the real service (0.18.1 release and 0.18.3 source, macOS arm64). A fix branch exists locally; I can open a PR.

Already tracked elsewhere, same root causes I hit:

• fix(kiro): OAuth CodeWhisperer provider sends wrong target/headers and misparses streaming events #6164 — wrong x-amz-target/content-type, wrapped tools, event payload parsing
• bug(kiro): non-eventstream 200 body is masked as eventstream: truncated message #6158 — non-eventstream 200 body masked as eventstream: truncated message at end of stream

New findings

1. origin is required for model selection. Without userInputMessage.origin: "AI_EDITOR" the service ignores modelId and answers every request with auto (the modelId field in every response frame is auto). Selecting kiro/claude-opus-5.5 silently has no effect. Adding origin makes the response frames report the requested model.
2. Parallel tool results are split → HTTP 400 TOOL_USE_RESULT_MISMATCH. The OAuth transport puts only the last toolResult in currentMessage and leaves earlier results of the same parallel batch as a separate history entry. Kiro rejects the next turn:
   messages.4: tool_use ids were found without tool_result blocks immediately after … (TOOL_USE_RESULT_MISMATCH). All trailing consecutive toolResult messages must travel together in currentMessage.userInputMessageContext.toolResults.
3. Kiro-cli social logins cannot be used. Users whose subscription is on a Google/GitHub Kiro login have no supported path: Builder ID (gjc auth-broker login kiro) is a different Kiro account (in my case Q_DEVELOPER_STANDALONE_FREE vs. …_POWER on the Google login), and KIRO_API_KEY (ksk_) hits per-account ThrottlingException 429s. Verified facts for supporting it:
   • kiro-cli stores the token in data.sqlite3 → table auth_kv, key kirocli:social:token → {access_token, refresh_token, expires_at, profile_arn, provider} (macOS: ~/Library/Application Support/kiro-cli/).
   • Refresh: POST https://prod.us-east-1.auth.desktop.kiro.dev/refreshToken with {"refreshToken": …} → {accessToken, refreshToken, expiresIn: 3600, profileArn}. The refresh token was not rotated. Invalid token → 401 {"message":"Bad credentials"}. SSO OIDC CreateToken does not work for these tokens.
   • profileArn must be sent in conversationState and in ListAvailableModels for social credentials.
   • ListAvailableModels and GetUsageLimits accept the same OAuth bearer on codewhisperer.<region>.amazonaws.com.
4. Reasoning effort is not forwarded on the OAuth transport. Kiro takes the thinking budget as a prompt prefix <thinking_mode>enabled</thinking_mode><max_thinking_length>N</max_thinking_length> and streams inline <thinking>…</thinking> text, which currently lands in the answer text.

Separate: Error: Agent run failed. has no recorded cause

packages/agent/src/agent.ts replaces every thrown run failure with Agent run failed. (intentional — keeps provider text out of transcripts), but the cause is not logged anywhere, so these failures cannot be diagnosed. I saw 15 of them over 3 days on anthropic/claude-opus-5-5, all at or before stream start, no HTTP status, errorName: Error. Twice, two different sessions failed in the same millisecond, which points at shared state rather than one session. In the same window one Anthropic credential failed refresh 220× with invalid_grant: Refresh token not found or invalid yet stayed active (usage-path refresh failures never disable the row), and there were OAuth token refresh ownership remained ambiguous / SQLiteError: database is locked entries with ~11 concurrent gjc processes. Either would produce exactly this shape if thrown from getApiKey — not confirmed.

Suggested minimum: log the redacted cause (e.g. via redactCrashSecrets) at warn in that catch block, transcript/SDK surfaces unchanged.

Steps to Reproduce

1. Kiro Power subscription on a Google login; OAuth bearer from that login.
2. gjc --model kiro/claude-opus-5.5 -p "…" → response frames report modelId: auto (finding 1).
3. Any prompt that makes the model issue ≥2 parallel tool calls → next request fails with 400 TOOL_USE_RESULT_MISMATCH (finding 2).

Expected Behavior

Selected model is honored; parallel tool turns continue; kiro-cli social logins are importable and refreshable; failed runs leave a diagnosable cause in the log.

Environment

macOS 27 (arm64), gjc 0.18.1 (release) and 0.18.3 (source, dev-based branch), bun 1.4.2. Provider: kiro (OAuth), also anthropic for the run-failure part.

Proposed fix (local branch, can PR)

• fix(ai): send all trailing parallel tool results in currentMessage; set origin; send profileArn; forward reasoning as thinking budget and split inline <thinking> into thinking content; content-type check with the redacted body (overlaps bug(kiro): non-eventstream 200 body is masked as eventstream: truncated message #6158).
• feat(ai)!: import kiro-cli social logins via gjc setup credentials / startup auto-import, refresh via the Kiro auth service; remove the KIRO_API_KEY path.
• fix(agent): log the redacted cause behind Agent run failed.

[Yeachan-Heo]

Thanks, these are concrete and live-verified. Please open the PR from your fix branch against dev. A few scoping notes so it doesn't collide with work already in flight:

• bug(kiro): non-eventstream 200 body is masked as eventstream: truncated message #6158 (non-eventstream 200) is being fixed in fix(kiro): non-eventstream 200 body is masked as eventstream: truncated message #6159, and fix(kiro): OAuth CodeWhisperer provider sends wrong target/headers and misparses streaming events #6164 (target/content-type/tools/event parsing) has its own PR, fix(kiro): correct OAuth CodeWhisperer wire protocol (#6164) #6165. Please keep those hunks out of your PR, or rebase once they land.
• Findings 1 (origin: "AI_EDITOR" for model selection) and 2 (grouping trailing parallel toolResults into currentMessage) are new. Each should come with a request-body test that fails without the fix.
• The Agent run failed. cause-discarding item is a separate subsystem, so a separate PR would be easier to review.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[nijuyr]

Opened against dev, scoped as suggested:

• fix(ai): honor Kiro model selection and group parallel tool results (#6166) #6169 — findings 1 (origin: "AI_EDITOR") and 2 (trailing parallel toolResults in currentMessage). Request-body tests for both fail on dev without the fix. No hunks from fix(kiro): non-eventstream 200 body is masked as eventstream: truncated message #6159 / fix(kiro): correct OAuth CodeWhisperer wire protocol (#6164) #6165.
• fix(agent): log the redacted cause behind generic run failures (#6166) #6170 — Agent run failed. cause logging (redacted, warn, transcript unchanged), separate PR.

The kiro-cli social-login import (finding 3) and the reasoning/thinking forwarding (finding 4) are not included yet; they touch the same file as #6165, so I'll rebase and follow up once it lands.

[probepark]

Triage: C (decision needed for the remainder) · feature · P2

Findings 1-2 were merged via #6169 (dev be70f5e5), and the Agent run failed. cause logging was merged via #6170. What remains is kiro-cli social-login import and refresh, plus reasoning-effort forwarding on the OAuth transport. The proposed shape removes the KIRO_API_KEY path (breaking). Options:

1. Add social-login import and refresh alongside the existing API-key path, as a non-breaking, opt-in import. Recommended.
2. Replace KIRO_API_KEY as proposed (feat!). This needs a release/deprecation decision.
3. Keep this issue for social login only, and track reasoning-effort forwarding in a separate issue after fix(kiro): correct OAuth CodeWhisperer wire protocol (#6164) #6165 lands.

The work should wait for #6165 (same file), so the transport changes do not collide.

[Yeachan-Heo]

#6169 (findings 1 and 2: origin: "AI_EDITOR" and grouping trailing parallel tool results) is merged to dev as be70f5e. #6170 (redacted cause logging for Agent run failed.) is in review. The kiro-cli social-login part is still open here.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Fixed

This issue has been resolved in the following merged PRs:

• PR fix(ai): honor Kiro model selection and group parallel tool results (#6166) #6169: be70f5e fix(ai): honor Kiro model selection and group parallel tool results (merged 2026-09-30)
• PR fix(agent): log the redacted cause behind generic run failures (#6166) #6170: a1b2591 fix(agent): log the redacted cause behind generic run failures (merged 2026-09-30)

Both commits are currently on origin/dev.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

자동 처리에서 이 이슈를 닫았는데, 다 해결된 상태가 아니라서 다시 엽니다. #6169(모델 선택, 병렬 tool 결과)와 #6170(run 실패 원인 로깅)은 머지됐습니다. 아직 남은 건 kiro-cli social login import/refresh와 OAuth 경로의 reasoning effort 전달 두 가지이고, dev에는 아직 들어가지 않았습니다.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Current state on dev: 667643adf3dd0a7bdba32524423e612f329343c0 (verified as the current origin/dev head). PRs #6169 and #6170 are merged and cover model selection/parallel tool results and redacted agent-failure diagnostics. The related transport prerequisite #6165 is also merged; its final review is approved after the earlier requested changes were addressed, and its relevant CI passed.

The remaining findings are Kiro social-login import/refresh and reasoning-effort forwarding on the OAuth transport. Those changes are not in the current dev source: the transport still describes reasoning as API-key-only, and there is no kiro-cli social-token import path.

Blocker: the product scope is still undecided. The existing triage explicitly raised three choices: (1) add social-login import/refresh as a non-breaking opt-in alongside KIRO_API_KEY (recommended); (2) remove KIRO_API_KEY as a breaking change, which requires an explicit release/deprecation decision; or (3) keep this issue focused on social login and split reasoning-effort forwarding into a separate issue. The latest update confirms both findings remain but does not select an option. Because that choice changes auth compatibility and PR scope, I have not opened a PR. Keeping #6166 open and blocked on an explicit choice of 1, 2, or 3.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

The remaining #6166 scope—Kiro CLI social-login import/refresh and OAuth reasoning passthrough—is present on dev in squash merge commit b0e087fac4213890d7761da52947da8b3edea989 from PR #6460.

Base SHA: e9a49b93e511c08615c4716310a88455114cff08
PR head SHA: 312b80fb6d7eb952a6562fa48f13aa2eccf39481
Merged dev SHA: b0e087fac4213890d7761da52947da8b3edea989
CI: all applicable checks passed, including AI and coding-agent tests/type checks, native build, virtual integration validation, local public surfaces, and GJC state gates. Configured Windows/macOS/WSL and release/RSS checks were skipped; no check failed.
Review state: GitHub still reports REVIEW_REQUIRED; Codex left only a COMMENT review, and no write-access maintainer approval is recorded. The PR was merged by Yeachan-Heo; this note does not claim an approval occurred.

Verification commands:

• bun test packages/ai/test/kiro-*.test.ts packages/coding-agent/test/kiro-*.test.ts packages/coding-agent/test/credential-import.test.ts packages/coding-agent/test/credential-auto-import-flows.test.ts — 223 passed.
• bun --cwd=packages/ai run check:types
• bun --cwd=packages/coding-agent run check:types
• bunx biome check packages/ai/src/auth-storage.ts packages/ai/src/provider-models/special.ts packages/ai/src/providers/kiro-api-key.ts packages/ai/src/providers/kiro-codewhisperer.ts packages/ai/src/usage.ts packages/ai/src/utils/oauth/index.ts packages/ai/src/utils/oauth/kiro.ts packages/ai/src/utils/oauth/types.ts packages/ai/test/kiro-codewhisperer-reasoning.test.ts packages/ai/test/kiro-social-oauth.test.ts packages/coding-agent/src/cli/setup-cli.ts packages/coding-agent/src/modes/components/provider-onboarding-selector.ts packages/coding-agent/src/modes/controllers/selector-controller.ts packages/coding-agent/src/setup/credential-auto-import.ts packages/coding-agent/src/setup/credential-import.ts packages/coding-agent/test/kiro-cli-credential-import.test.ts

Disposition: close this issue as completed because the requested remaining code is merged to dev; PR #6460 used squash merge. The PR base is not the repository default branch, so the issue was closed explicitly as completed.

—
GJC coding agent