DeepSeek Harness (DSH) uses a plugin-based architecture. Integrating with the Kiro service usually involves complex authentication configuration. The dsh-kiro plugin encapsulates the Kiro integration workflow and supports multiple authentication methods, dynamic model discovery, and reasoning control.

Plugin Purpose

dsh-kiro is a Kiro provider plugin for DeepSeek Harness, maintained by dat-lequoc and released under the MIT license. It removes the need to manually configure cordis.yml and manage tokens, providing a complete Kiro integration solution. The plugin registers the kiro provider route and mounts automatically after installation, so manual configuration is not required.

Installation and Enablement

Install the plugin using the official command line:

dsh plugin --profile web add github:dat-lequoc/dsh-kiro

After installation, start DSH directly:

dsh --profile web

Authentication Methods

Web Interface Login

On the DSH Settings → Kiro page, the following login methods are supported:

  • AWS Builder ID: Uses the standard device code flow.
  • IAM Identity Center: Uses the device code flow. You must provide the https://<company>.awsapps.com/start URL and region.
  • Google / GitHub: Uses Kiro’s social device code flow and requires entering a one-time verification code on the authorization page.
  • Credential Import: Supports importing Kiro refresh tokens, API Keys, or Microsoft external IdP JSON credentials compatible with CLIProxyAPI.

Terminal Login

The plugin provides the kiro-login command for terminal authentication. Common examples include:

# 使用 AWS Builder ID 登录
kiro-login --region eu-central-1

# 使用 IAM Identity Center 登录
kiro-login --method idc --start-url https://company.awsapps.com/start --region eu-central-1

# 使用 GitHub 登录
kiro-login --method github

# 使用刷新令牌
KIRO_REFRESH_TOKEN='...' kiro-login --method refresh-token

# 使用 API Key
KIRO_API_KEY='...' kiro-login --method api-key

# 使用外部 IdP 凭证文件
kiro-login --method external-idp --credentials-file ./kiro-auth.json

# 配置代理
kiro-login --proxy http://user:pass@proxy.example:8080

Supported environment variables: KIRO_REGION, KIRO_PROXY_URL, KIRO_START_URL, KIRO_REFRESH_TOKEN, KIRO_API_KEY.

Credential Storage

Credentials managed by the plugin are stored by default in $DSH_HOME/storages/kiro-auth (typically ~/.dsh/storages/kiro-auth). Token and device registration files are set to 0600 permissions to ensure security.

  • Priority: Plugin-managed credentials > SSO cache from Kiro IDE/CLI.
  • Refresh Mechanism: Credentials managed by Builder ID, Google, GitHub, and IDC are automatically refreshed through regional AWS OIDC. Refreshed tokens and Profile ARNs are written atomically to storage.
  • Fallback: When no plugin-managed credentials exist, the plugin reads ~/.aws/sso/cache/kiro-auth-token.json from Kiro IDE/CLI for reuse.

Model Discovery and Reasoning Control

Model List

The plugin queries Kiro’s ListAvailableModels API to retrieve the list of models available for the current account, including Opus, Sonnet, Haiku, and open-weight model routes. The model list is cached for 5 minutes and can be manually refreshed on the settings page. Configuration selections are persisted to $DSH_HOME/storages/kiro-auth/model-settings.json.

Reasoning Parameters

The plugin automatically detects each model’s reasoning capabilities. Supported effort levels include none, low, medium, high, xhigh, and max.

In the DSH model menu, only the effort levels supported by the selected model are displayed. Configuration is sent using Kiro native fields. If using the legacy fallback of manual configuration, the old prompt marker behavior applies.

Configuration Override

You can set the default reasoning effort level in the global configuration file:

llm-kiro:
  reasoningEffort: medium

Advanced Features

  • Streaming Output: Supports streaming text, reasoning content, and tool calls through the Amazon EventStream protocol.
  • Image Support: Supports sending images to supported models, unlocking image attachments and the image reading tool included with Harness.
  • Proxy Support: Supports direct egress or authenticated HTTP/HTTPS CONNECT proxies.
  • Hot Reload: Changes to llm-kiro settings take effect without restarting DSH.

Notes

  • This is an independent integration project and is not officially affiliated with AWS or Kiro. Kiro and its logo are trademarks of Amazon.
  • There is no need to manually create cordis.yml entries or provide an API Key.
  • The plugin runs with the permissions of the current DSH process. Please review the source code and license before installing.