[lidge-jun]

Summary

Closes #6641.

Importing two different users of the same Kiro organization (IAM Identity Center) profile through the dashboard's Kiro CLI login kept only one account: the second user's login overwrote the first user's slot. The CLI import stored the resolved profile ARN as accountId, and the account store matched slots by accountId ?? email. An organization profile ARN is shared by every user of that profile, so it is not a user identity.

Kiro account identity is now the profile ARN plus the email that same-session kiro-cli whoami --format json reports (new src/oauth/kiro-account-identity.ts). accountId still holds the ARN, so request routing and persisted evidence keep reading it as the profile.

Case	Before	After
Second user of the same org profile (different whoami email)	overwrites the first user's slot	new slot
Same user re-imported	updates slot	updates slot
Personal / Builder ID (email only, or no identity)	unchanged	unchanged
whoami reports no user, profile has no identified user	ARN identity	ARN identity (unchanged)
whoami reports no user, profile has an identified user	overwrites that user	refused with a fixed, account-free message unless the refresh token proves the same CLI session; forced login rolls the CLI back to its prior session
Reauth of an identified slot with another user of the same ARN	accepted	OAuthReauthIdentityMismatchError
Rotated CLI recovery after a 400 refresh	adopts any local session with the same ARN	a row with a user needs same-session whoami to report that user; a row without a user recovers only while no other row shares its profile; cancellation propagates as cancellation

Already stored accounts. No row is rewritten on load, and every row keeps matching the shape it was saved with. ARN + email rows match their user's next import. ARN-only rows match ARN-only imports as before. Add account first records the current CLI user on an ARN-only row whose refresh token equals the live CLI session, through a serialized email-only bind that leaves tokens, plan, pause and health untouched. Another organization user is appended next to an ARN-only row and never overwrites it. While other rows share the profile, an unmatched Kiro login claims an identity-less active slot only as the same CLI session.

Evidence limits. No live Kiro login or kiro-cli execution was performed; behavior is pinned with fixtures and a fake CLI runner. OCX reads only email and the profile ARN fields from whoami. The accountType / region / startUrl fields and the email: null shape for Builder ID in the fixtures come from web summaries of the Kiro CLI command reference and its Amazon Q CLI predecessor, not from captured CLI output. Whether Kiro CLI 2.27.1 fills email for IAM Identity Center logins is not verified. If it does not, two users of the same org stay indistinguishable and the profile identity applies as before; the refusal only engages once one user of the profile is identified.

Verification

• bun run typecheck — pass (on the rebased head).
• bun run structure:check, bun run privacy:scan — pass.
• bun test tests/providers/kiro/ tests/oauth/ tests/ci-workflows/file-size-ratchet.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 1533 pass / 0 fail (85 files).
• New tests/providers/kiro/kiro-org-user-identity.test.ts (18 tests): same-org two users, same-user reimport, personal / Builder ID, no-user legacy identity, refusal with CLI rollback, same-session no-user refresh, legacy ARN-only / ARN+email migration, Add-account pre-bind, reauth mismatch, rotated-recovery guards, cancellation. Against unmodified dev sources, 8 of the original 14 cases fail; the 6 that pass are invariants that must not change.
• bun run test (pre-rebase head, concurrent worktree load, 702s): everything passed except 3 unrelated files (codex-inject-retained-table, client-link-relay, cli-access-audio-live), which pass alone (61/61).
• bun run test:changed (rebased head, while another worktree held CPU): 36475 pass / 36 fail across 1667 files; every failing file is outside this change (lab, service, native Codex/Grok toggles, live audio), and all 10 of them pass when run alone (419/419).
• Independent review by a different model family (GPT-6.1-Sol, high) across four rounds; findings were folded or rebutted on the issue's stated constraints.
• No GUI change.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed (docs-site/.../cli/providers-accounts.md, structure/providers-and-adapters.md).
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults (credential identity matching only; no token logging; error text is fixed and account-free).

Summary by CodeRabbit

• New Features
  • Kiro accounts sharing an IAM Identity Center profile are now distinguished by the signing-in user’s email when available, allowing each user to keep a separate account.
  • Reauthentication and session recovery now check that the CLI session belongs to the account before updating or restoring it.
  • Add account login restores the Kiro CLI’s previous session. Accounts without a known user can be identified on reauthentication when the identity can be verified.
• Documentation
  • Updated guidance on Kiro account identification, login behavior, and session restoration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T07:50:54.210747Z	5c5b58c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8e1911f0-bc59-4afa-a1ff-701b635ce877

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between a0191a1 and 5c5b58c.

---

---

📒 Files selected for processing (9)

• docs-site/src/content/docs/reference/cli/providers-accounts.md
• scripts/test-layout/layout.json
• src/oauth/index.ts
• src/oauth/kiro-account-identity.ts
• src/oauth/kiro.ts
• src/oauth/store.ts
• structure/providers-and-adapters.md
• tests/fixtures/test-layout-expected.json
• tests/providers/kiro/kiro-org-user-identity.test.ts

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

Kiro account identity now distinguishes users who share an organization profile by using the profile ARN and normalized kiro-cli whoami email. Login matching, legacy account binding, reauthentication, and rotated-session recovery apply additional checks when user identity is absent or uncertain.

Changes

Kiro organization-user identity

Layer / File(s)	Summary
Identity matching and account slots src/oauth/kiro-account-identity.ts, src/oauth/store.ts, src/oauth/index.ts, tests/providers/kiro/kiro-org-user-identity.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json	Kiro login matching uses profile ARN and normalized email. Identity-less logins and legacy rows use refresh-token checks. Matching updates retain an existing user identity. The added tests cover separate users, same-user updates, identity-less cases, and login rejection and session restoration expectations.
Legacy account binding and import src/oauth/kiro.ts, src/oauth/store.ts, tests/providers/kiro/kiro-org-user-identity.test.ts, structure/providers-and-adapters.md, docs-site/src/content/docs/reference/cli/providers-accounts.md	Add account can bind a verified email to an ARN-only row when the profile ARN and refresh-token proof match; the stored credential’s other fields remain unchanged. Tests and documentation cover legacy-row import and binding rules.
Reauthentication and rotated-session recovery src/oauth/index.ts, src/oauth/kiro-account-identity.ts, src/oauth/kiro.ts, tests/providers/kiro/kiro-org-user-identity.test.ts	Kiro reauthentication checks profile and user identity against other stored accounts. A rotated CLI credential is retried only after ownership checks pass. Tests cover identity mismatches, matching identities, unavailable identity, and cancellation.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant KiroCLI
  participant OAuthStore
  participant KiroIdentityMatcher
  User->>KiroCLI: Complete Kiro CLI login
  KiroCLI->>OAuthStore: Provide profile ARN and email
  OAuthStore->>KiroIdentityMatcher: Find matching account
  KiroIdentityMatcher-->>OAuthStore: Return match or no match
  OAuthStore->>OAuthStore: Update matching slot or apply slot-upgrade rules

Loading

---

---

Merge Risk: ⚪ Minimal · up to 5c5b5

The change separates users who share a Kiro organization profile and adds safeguards for cases where the user is unknown. No concrete merge-blocking problem was found. If the CLI does not report an email, users sharing a profile stay indistinguishable, as the PR notes.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 5 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Issue #6641 requires separate selectable accounts for different users who share one Kiro organization profile, while preserving same-user reimport behavior and distinguishing identity collisions. The …
Out of Scope Changes check		The changed files remain connected to #6641. src/oauth/kiro-account-identity.ts, src/oauth/kiro.ts, src/oauth/store.ts, and src/oauth/index.ts implement identity matching, same-session checks,…
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: keeping users who share a Kiro organization profile as separate accounts. It is concise and directly matches the pull request objectives.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 5 files. (4 skipped: 4 unsupported.)

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[Ingwannu]

Focused correctness review of 5c5b58c0386a6668f928a2d03513a8f9526fa599, against trusted dev a0191a1b6fd921a6e5a9d12cb123c8df88b023e7 (nine-file diff).

I independently ran the complete new regression file: bun test --no-env-file --preload ./tests/preload.ts --isolate ./tests/providers/kiro/kiro-org-user-identity.test.ts --timeout 30000 — 18 passed, 0 failed, 57 assertions, Bun 1.4.0/Linux. This uses disposable SQLite homes, injected CLI runners, synthetic refresh responses and no-op configuration persistence; no real Kiro login, CLI process, account or provider request was used.

The reviewed implementation keeps the profile ARN in accountId and makes user email part of Kiro-specific matching rather than changing other providers' identity rules. The same-session legacy bind changes only email under the store mutation owner, and the fixtures cover unrelated legacy slots, identified-user reauth mismatch, CLI rollback after refusal, rotated-session recovery, cancellation and preserving an unidentified row alongside a different identified user. I did not find a concrete correctness blocker in those tested flows.

Please retain the qualification in the description when resolving #6641: this demonstrates conditional separation when same-session whoami supplies the user's email, not that CLI 2.27.1 actually supplies it for the reported IAM Identity Center login. The no-user fixture deliberately retains profile-only matching. A primary version-specific JSON shape or a reporter's minimal redacted field-shape confirmation (not tokens, a full credential file or live paid test) is needed to claim the original two-user scenario is resolved. Do not describe the modeled accountType/startUrl fixture as captured vendor output.

This is COMMENTED, not approval or the mandatory independent trust-boundary review. Current-head Cross-platform CI 38219702942 is queued, not complete; the author's wider suite/typecheck receipts are separate from my focused run. No sponsorship, workflow approval, scan or merge. Validation ran as ubuntu in one isolated worktree with fresh private homes, verified CPU75% / MemoryHigh1280MiB / MemoryMax1536MiB / swap0 / tasks64 / nice10 and a finite deadline. IOWeight20 was requested without an enforcement claim; protected runtime files were unchanged and the unit terminated successfully.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md dev-only path; actor @lidge-jun, admin), merged as 8d12a3c; head 5c5b58c038 bound with --match-head-commit, no unresolved threads, no change requests (Ingwannu COMMENTED with no blocker; Codex review no findings). Exact-head CI: 35 pass / 7 skipped. The first attempt's test 2/4 (a 12-file codex-integration batch over its 120 s limit) and windows 9/9 (a catalog-auto-refresh child Bun process not exiting within 20 s) are the #4956 class, unrelated to Kiro, and passed on a failed-jobs rerun. Credential-boundary review: GPT-6.1-Sol high (different family from the Claude builder), four rounds, final PASS; Ingwannu ran the 18-case regression independently (18/0). One commit behind dev (#6975), no overlapping files. #6641 stays open until the whoami email shape is confirmed, per the review.