fix(kiro): resolve the Windows kiro-cli executable without PATH

Forced and add-account Kiro login shell out to the local CLI by bare
name. #710 taught Windows where the SQLite store lives, so a Windows box
can import tokens while PATH still has no `kiro-cli` -- and then login
fails on a machine that is otherwise correctly installed.

The resolver tries PATH first (both `PATH` and `Path`, since Windows uses
the latter), then the layouts the installers actually produce:
`%LOCALAPPDATA%\Kiro-Cli` and `C:\Program Files\Kiro-Cli` on Windows,
`~/.local/bin` and the usual prefixes elsewhere. With nothing found it
returns the bare command so spawn still reports the original error rather
than a path this code invented.

Two additions on top of the contributed patch. `existsSync` alone accepts
a *directory* named `kiro-cli`, which then reaches spawn() and fails with
EACCES instead of falling through to the next candidate -- candidates now
have to be files. And the tests only ever injected `pathEntries`, so the
environment parsing itself was never exercised; a case now drives `Path`
and `PATH` through the real code.

Both new tests were checked by ablation: removing the `isFile` guard
fails the directory case (6 pass / 1 fail) and restoring it returns 7/7,
so neither passes vacuously.

Windows behavior is unverifiable from macOS; the matrix CI on this branch
is what confirms it.

Co-authored-by: bitkyc08-arch <bitkyc08@gmail.com>

Author: aljjang95

docs-site/src/content/docs/guides/providers.md

@@ -165,6 +165,10 @@ read-only. Two environment variables make the source and token row selection exp
 - `KIROCLI_TOKEN_KEY` selects the exact `auth_kv` token key when a database contains multiple
   otherwise ambiguous token rows. A missing selection fails login instead of guessing.
 
+On Windows, import looks for `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`. Forced/add-account login
+also needs the local CLI binary: opencodex first uses `PATH`, then falls back to
+`%LOCALAPPDATA%\Kiro-Cli\kiro-cli.exe` and `C:\Program Files\Kiro-Cli\kiro-cli.exe`.
+
 After a successful import, opencodex persists the imported credential to
 `~/.opencodex/auth.json`.
 

src/oauth/kiro-credentials.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join, posix, win32 } from "node:path";
 import { Database } from "bun:sqlite";
@@ -169,6 +169,77 @@ export function resolveKiroCliNativeSessionEntries(
   return [{ location: "kiro-cli-linux-data", path: posix.join(home, ".local", "share", "kiro-cli", "data.sqlite3") }];
 }
 
+/**
+ * Resolve the absolute kiro-cli executable for spawn/login helpers.
+ *
+ * Pure + parameterized like `resolveKiroCliNativeSessionEntries` so Windows install layouts can be
+ * covered from any host. PATH remains the first choice; only when bare `kiro-cli` is missing do we
+ * fall back to the platform-native install directories next to the session database.
+ *
+ * Windows: official MSI installs to `C:\Program Files\Kiro-Cli\kiro-cli.exe`, while some local
+ * installs keep the binary next to `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`.
+ * macOS/Linux: prefer PATH, then the usual user-local bin directories.
+ */
+export function resolveKiroCliExecutable(
+  inputs: KiroCliNativeInputs & {
+    pathEntries?: string[];
+    exists?: (path: string) => boolean;
+    isFile?: (path: string) => boolean;
+  },
+): string {
+  const exists = inputs.exists ?? existsSync;
+  // A directory named `kiro-cli` on PATH satisfies existsSync and would then be handed to
+  // spawn(), which fails with EACCES at login instead of falling through to the next candidate.
+  // When a caller injects `exists` it owns the whole filesystem view, so the real stat would
+  // reject every synthetic path; such callers inject `isFile` too when they care about it.
+  const isFile = inputs.isFile ?? (inputs.exists ? () => true : ((path: string) => {
+    try {
+      return statSync(path).isFile();
+    } catch {
+      return false;
+    }
+  }));
+  const pathEntries = inputs.pathEntries
+    ?? (inputs.env.PATH ?? inputs.env.Path ?? "").split(inputs.platform === "win32" ? ";" : ":")
+      .map(entry => entry.trim())
+      .filter(Boolean);
+
+  const pathCandidates = inputs.platform === "win32"
+    ? pathEntries.flatMap(entry => [
+        win32.join(entry, "kiro-cli.exe"),
+        win32.join(entry, "kiro-cli"),
+      ])
+    : pathEntries.map(entry => posix.join(entry, "kiro-cli"));
+
+  const installCandidates: string[] = [];
+  if (inputs.platform === "win32") {
+    const localBase = inputs.env.LOCALAPPDATA?.trim()
+      || (inputs.env.USERPROFILE?.trim() ? win32.join(inputs.env.USERPROFILE.trim(), "AppData", "Local") : "")
+      || win32.join(inputs.home, "AppData", "Local");
+    const programFiles = inputs.env["ProgramFiles"]?.trim() || "C:\\Program Files";
+    installCandidates.push(
+      win32.join(localBase, "Kiro-Cli", "kiro-cli.exe"),
+      win32.join(programFiles, "Kiro-Cli", "kiro-cli.exe"),
+    );
+  } else if (inputs.platform === "darwin") {
+    installCandidates.push(
+      posix.join(inputs.home, ".local", "bin", "kiro-cli"),
+      "/usr/local/bin/kiro-cli",
+      "/opt/homebrew/bin/kiro-cli",
+    );
+  } else {
+    installCandidates.push(
+      posix.join(inputs.home, ".local", "bin", "kiro-cli"),
+      "/usr/local/bin/kiro-cli",
+    );
+  }
+
+  for (const candidate of [...pathCandidates, ...installCandidates]) {
+    if (exists(candidate) && isFile(candidate)) return candidate;
+  }
+  return inputs.platform === "win32" ? "kiro-cli.exe" : "kiro-cli";
+}
+
 function nativeKiroCliSessionEntries(): Array<{ location: KiroCliNativeLocation; path: string }> {
   // Only the stores that `kiro-cli logout` / `kiro-cli login` themselves mutate. Import fallbacks
   // (Amazon Q / SSO cache) and KIROCLI_DB_PATH selectors must not be snapshotted for rollback.

src/oauth/kiro.ts

@@ -18,13 +18,15 @@ import {
   persistKiroCliSessionRecovery,
   readImportedKiroCredential,
   readKiroCliSqliteCredential,
+  resolveKiroCliExecutable,
   restoreKiroCliSession,
   restoreStaleKiroCliSessionRecovery,
   requireKiroRegion,
   type ImportedKiroCredential,
   type KiroCliSessionSnapshot,
   type KiroImportDiagnostic,
 } from "./kiro-credentials";
+import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
 
 const DEFAULT_REGION = "us-east-1";
@@ -72,9 +74,18 @@ const pendingKiroLoginTransactions = new WeakMap<OAuthCredentials, KiroCliSessio
 /** Forced logins that started with no native CLI DB must logout on persistence failure. */
 const pendingKiroEmptyPriorSessions = new WeakSet<OAuthCredentials>();
 
+
+function resolveRuntimeKiroCliExecutable(): string {
+  return resolveKiroCliExecutable({
+    env: process.env,
+    platform: process.platform,
+    home: process.platform === "win32" ? homedir() : (process.env.HOME || homedir()),
+  });
+}
+
 function logoutKiroCliBestEffort(): void {
   try {
-    Bun.spawnSync(["kiro-cli", "logout"], {
+    Bun.spawnSync([resolveRuntimeKiroCliExecutable(), "logout"], {
       stdin: "ignore",
       stdout: "ignore",
       stderr: "ignore",
@@ -128,7 +139,7 @@ async function defaultKiroCliRunner(args: string[], signal?: AbortSignal): Promi
   throwIfKiroLoginCancelled(signal);
   let child: ReturnType<typeof Bun.spawn>;
   try {
-    child = Bun.spawn(["kiro-cli", ...args], {
+    child = Bun.spawn([resolveRuntimeKiroCliExecutable(), ...args], {
       stdin: "ignore",
       stdout: "pipe",
       stderr: "ignore",

tests/kiro-windows-cli-executable-path.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, test } from "bun:test";
+import { resolveKiroCliExecutable } from "../src/oauth/kiro-credentials";
+
+/**
+ * Forced/add-account Kiro login still shells out to the local CLI. After #710 fixed Windows
+ * SQLite discovery, Windows installs can import tokens while PATH still lacks `kiro-cli`.
+ * The pure executable resolver covers that layout without launching the real binary.
+ */
+describe("kiro-cli executable resolution", () => {
+  const WIN_HOME = "C:\\Users\\u";
+
+  test("prefers the first PATH hit before install-directory fallbacks", () => {
+    const exists = (path: string) => path === "C:\\Tools\\kiro-cli.exe";
+    expect(resolveKiroCliExecutable({
+      env: {
+        PATH: "C:\\Tools;C:\\Windows\\System32",
+        LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local",
+      },
+      platform: "win32",
+      home: WIN_HOME,
+      pathEntries: ["C:\\Tools", "C:\\Windows\\System32"],
+      exists,
+    })).toBe("C:\\Tools\\kiro-cli.exe");
+  });
+
+  test("win32 falls back to %LOCALAPPDATA%\\Kiro-Cli\\kiro-cli.exe", () => {
+    const exists = (path: string) => path === "C:\\Users\\u\\AppData\\Local\\Kiro-Cli\\kiro-cli.exe";
+    expect(resolveKiroCliExecutable({
+      env: {
+        PATH: "C:\\Windows\\System32",
+        LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local",
+      },
+      platform: "win32",
+      home: WIN_HOME,
+      pathEntries: ["C:\\Windows\\System32"],
+      exists,
+    })).toBe("C:\\Users\\u\\AppData\\Local\\Kiro-Cli\\kiro-cli.exe");
+  });
+
+  test("win32 falls back to Program Files\\Kiro-Cli when LOCALAPPDATA binary is absent", () => {
+    const exists = (path: string) => path === "C:\\Program Files\\Kiro-Cli\\kiro-cli.exe";
+    expect(resolveKiroCliExecutable({
+      env: {
+        PATH: "C:\\Windows\\System32",
+        LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local",
+        ProgramFiles: "C:\\Program Files",
+      },
+      platform: "win32",
+      home: WIN_HOME,
+      pathEntries: ["C:\\Windows\\System32"],
+      exists,
+    })).toBe("C:\\Program Files\\Kiro-Cli\\kiro-cli.exe");
+  });
+
+  test("linux keeps PATH-first resolution and falls back to ~/.local/bin", () => {
+    const exists = (path: string) => path === "/home/u/.local/bin/kiro-cli";
+    expect(resolveKiroCliExecutable({
+      env: { PATH: "/usr/bin" },
+      platform: "linux",
+      home: "/home/u",
+      pathEntries: ["/usr/bin"],
+      exists,
+    })).toBe("/home/u/.local/bin/kiro-cli");
+  });
+
+  test("returns the bare command when no candidate exists so spawn can report the original error", () => {
+    expect(resolveKiroCliExecutable({
+      env: { PATH: "C:\\Windows\\System32" },
+      platform: "win32",
+      home: WIN_HOME,
+      pathEntries: ["C:\\Windows\\System32"],
+      exists: () => false,
+    })).toBe("kiro-cli.exe");
+  });
+
+  test("skips a directory named kiro-cli and keeps looking", () => {
+    // A directory passes existsSync, so without the isFile guard this resolves to
+    // C:\Tools\kiro-cli and spawn() fails with EACCES at login time.
+    const exists = (path: string) =>
+      path === "C:\\Tools\\kiro-cli" || path === "C:\\Program Files\\Kiro-Cli\\kiro-cli.exe";
+    const isFile = (path: string) => path !== "C:\\Tools\\kiro-cli";
+    expect(resolveKiroCliExecutable({
+      env: { PATH: "C:\\Tools", ProgramFiles: "C:\\Program Files" },
+      platform: "win32",
+      home: WIN_HOME,
+      pathEntries: ["C:\\Tools"],
+      exists,
+      isFile,
+    })).toBe("C:\\Program Files\\Kiro-Cli\\kiro-cli.exe");
+  });
+
+  test("parses PATH from the environment under both Windows casings", () => {
+    // The resolver must read the env itself, not only an injected pathEntries array:
+    // Windows exposes the variable as `Path`, POSIX as `PATH`.
+    const exists = (path: string) => path === "C:\\Tools\\kiro-cli.exe";
+    expect(resolveKiroCliExecutable({
+      env: { Path: "C:\\Tools;C:\\Windows\\System32" },
+      platform: "win32",
+      home: WIN_HOME,
+      exists,
+    })).toBe("C:\\Tools\\kiro-cli.exe");
+    expect(resolveKiroCliExecutable({
+      env: { PATH: "C:\\Tools" },
+      platform: "win32",
+      home: WIN_HOME,
+      exists,
+    })).toBe("C:\\Tools\\kiro-cli.exe");
+  });
+});