fix(kiro): discover the Windows kiro-cli token DB on login import (#710)

`ocx login kiro` could not import an existing Windows Kiro CLI session: it
reported no kiro-cli token and fell back to manual access-token paste even
while `kiro-cli whoami` showed an active login. The reader and token selector
were fine — only discovery was short. `nativeKiroCliSessionEntries()` listed
just the macOS and Linux stores, so `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`
was never a candidate. The reporter confirmed that pointing KIROCLI_DB_PATH
at it makes the import succeed with no manual paste.

Extract the candidate list into a pure `resolveKiroCliNativeSessionEntries(
env, platform, home)` and add the Windows store. Pure and parameterized
following src/claude/desktop-3p-paths.ts: `process.platform` is stubbable
here, but `os.platform()` does not follow it under Bun, so a resolver taking
its inputs is the reliable way to exercise the win32 branch and each of its
env fallback rungs from a macOS or Linux host.

Windows resolves LOCALAPPDATA -> %USERPROFILE%\AppData\Local -> injected
platform-native home. Deliberately not `userHome()`, which is
`HOME || homedir()`: Windows shells (Git Bash / MSYS / CI) routinely export a
POSIX-style HOME, which would aim the fallback at a non-native path. POSIX
branches keep `userHome()` so existing HOME-based fixtures still resolve.

The list returns one store per platform now instead of macOS+Linux on every
host. It also feeds forced-login snapshot/rollback, so naming the database
the local kiro-cli actually mutates is the correct contract; every consumer
already guards with existsSync.

Because the old cross-platform return value was load-bearing for fixtures,
four suites seeded the macOS layout unconditionally and would stop finding
their fixtures on the Linux and Windows CI legs. They now seed the
host-resolved layout and isolate LOCALAPPDATA/USERPROFILE, without which a
Windows runner could read the real user profile.

Also name the Windows store in the snapshot-failure repair message, which
Windows users can now reach.

Verification: bun run test 5987 pass / 1 skip / 0 fail (mandated by
src/AGENTS.md for OAuth changes); bun x tsc --noEmit clean; new suite 6 pass
covering all three win32 rungs by name; four amended suites 129 pass;
privacy scan passed.

Closes #710

Author: lidge-jun

src/oauth/kiro-credentials.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, join } from "node:path";
+import { isAbsolute, join, win32 } from "node:path";
 import { Database } from "bun:sqlite";
 
 const DEFAULT_EXPIRES_MS = 3600_000;
@@ -39,7 +39,14 @@ export type KiroDiagnosticStatus =
   | "registration_found";
 
 export interface KiroImportDiagnostic {
-  location: "kiro-creds-file" | "kiro-cli-db-env" | "kiro-cli-data" | "kiro-cli-linux-data" | "amazon-q-data" | "kiro-sso-cache";
+  location:
+    | "kiro-creds-file"
+    | "kiro-cli-db-env"
+    | "kiro-cli-data"
+    | "kiro-cli-linux-data"
+    | "kiro-cli-windows-data"
+    | "amazon-q-data"
+    | "kiro-sso-cache";
   status: KiroDiagnosticStatus;
 }
 
@@ -122,14 +129,56 @@ function jsonCredentialPaths(): string[] {
     .map(expandPath);
 }
 
-function nativeKiroCliSessionEntries(): Array<{ location: "kiro-cli-data" | "kiro-cli-linux-data"; path: string }> {
-  const home = userHome();
+export type KiroCliNativeLocation = "kiro-cli-data" | "kiro-cli-linux-data" | "kiro-cli-windows-data";
+
+export interface KiroCliNativeInputs {
+  env: Record<string, string | undefined>;
+  platform: NodeJS.Platform;
+  home: string;
+}
+
+/**
+ * Native kiro-cli session stores, as a pure function of (env, platform, home).
+ *
+ * Pure + parameterized following `src/claude/desktop-3p-paths.ts`: `process.platform` is stubbable
+ * in this repo, but `os.platform()` does NOT follow it under Bun, so a pure resolver is the reliable
+ * way to exercise the win32 branch (and its env fallbacks) on a macOS/Linux host.
+ *
+ * Windows (issue #710): the official installer stores the auth DB at
+ * `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3`. When LOCALAPPDATA is unset or blank, fall back to
+ * `%USERPROFILE%\AppData\Local`, then to the injected platform-native home. Deliberately NOT
+ * `userHome()`: that is `HOME || homedir()` and Windows shells (Git Bash / MSYS / CI) routinely
+ * export a POSIX-style `HOME`, which would point this at a non-native path.
+ *
+ * One entry per platform on purpose: this list also drives forced-login snapshot/rollback, so it
+ * must name the database the LOCAL kiro-cli actually mutates, never a foreign platform's path.
+ */
+export function resolveKiroCliNativeSessionEntries(
+  inputs: KiroCliNativeInputs,
+): Array<{ location: KiroCliNativeLocation; path: string }> {
+  const { env, platform, home } = inputs;
+  if (platform === "win32") {
+    const base = env.LOCALAPPDATA?.trim()
+      || (env.USERPROFILE?.trim() ? win32.join(env.USERPROFILE.trim(), "AppData", "Local") : "")
+      || win32.join(home, "AppData", "Local");
+    return [{ location: "kiro-cli-windows-data", path: win32.join(base, "Kiro-Cli", "data.sqlite3") }];
+  }
+  if (platform === "darwin") {
+    return [{ location: "kiro-cli-data", path: join(home, "Library", "Application Support", "kiro-cli", "data.sqlite3") }];
+  }
+  return [{ location: "kiro-cli-linux-data", path: join(home, ".local", "share", "kiro-cli", "data.sqlite3") }];
+}
+
+function nativeKiroCliSessionEntries(): Array<{ location: KiroCliNativeLocation; path: string }> {
   // Only the stores that `kiro-cli logout` / `kiro-cli login` themselves mutate. Import fallbacks
   // (Amazon Q / SSO cache) and KIROCLI_DB_PATH selectors must not be snapshotted for rollback.
-  return [
-    { location: "kiro-cli-data", path: join(home, "Library", "Application Support", "kiro-cli", "data.sqlite3") },
-    { location: "kiro-cli-linux-data", path: join(home, ".local", "share", "kiro-cli", "data.sqlite3") },
-  ];
+  return resolveKiroCliNativeSessionEntries({
+    env: process.env,
+    platform: process.platform,
+    // POSIX keeps HOME-first userHome() so existing HOME-based fixtures still resolve; win32 prefers
+    // LOCALAPPDATA/USERPROFILE and only falls back to this platform-native home.
+    home: process.platform === "win32" ? homedir() : userHome(),
+  });
 }
 
 function sqliteEntries(): Array<{ location: KiroImportDiagnostic["location"]; path: string }> {

src/oauth/kiro.ts

@@ -289,7 +289,8 @@ export async function loginKiro(ctrl: OAuthController, options: KiroLoginOptions
         "Kiro CLI session could not be backed up, so OCX will not sign it out. " +
           "Repair or remove the unreadable kiro-cli credential database " +
           "(usually `~/.local/share/kiro-cli/data.sqlite3` or " +
-          "`~/Library/Application Support/kiro-cli/data.sqlite3`), " +
+          "`~/Library/Application Support/kiro-cli/data.sqlite3`, or " +
+          "`%LOCALAPPDATA%\\Kiro-Cli\\data.sqlite3` on Windows), " +
           "unset KIROCLI_DB_PATH / KIRO_CLI_DB_FILE if set for import-only overrides, then retry.",
       );
     }

tests/kiro-adapter.test.ts

@@ -14,6 +14,8 @@ import { PROVIDER_REGISTRY } from "../src/providers/registry";
 import type { OcxParsedRequest, OcxProviderConfig } from "../src/types";
 
 const origHome = process.env.HOME;
+const origLocalAppData = process.env.LOCALAPPDATA;
+const origUserProfile = process.env.USERPROFILE;
 const origRegion = process.env.KIRO_REGION;
 const origApiRegion = process.env.KIRO_API_REGION;
 const origArn = process.env.KIRO_PROFILE_ARN;
@@ -24,8 +26,12 @@ let tmp: string;
 
 beforeEach(() => {
   // isolate: empty HOME so no kiro-cli SQLite is read; deterministic region.
+  // The native store resolves per-platform (issue #710) and win32 prefers LOCALAPPDATA/USERPROFILE
+  // over HOME, so an empty HOME alone would no longer keep a Windows runner off its real profile.
   tmp = mkdtempSync(join(tmpdir(), "kiro-adapter-"));
   process.env.HOME = tmp;
+  process.env.LOCALAPPDATA = join(tmp, "AppData", "Local");
+  process.env.USERPROFILE = tmp;
   process.env.OPENCODEX_HOME = tmp;
   process.env.KIRO_REGION = "us-east-1";
   delete process.env.KIRO_API_REGION;
@@ -35,6 +41,8 @@ beforeEach(() => {
 });
 afterEach(() => {
   if (origHome === undefined) delete process.env.HOME; else process.env.HOME = origHome;
+  if (origLocalAppData === undefined) delete process.env.LOCALAPPDATA; else process.env.LOCALAPPDATA = origLocalAppData;
+  if (origUserProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = origUserProfile;
   if (origRegion === undefined) delete process.env.KIRO_REGION; else process.env.KIRO_REGION = origRegion;
   if (origApiRegion === undefined) delete process.env.KIRO_API_REGION; else process.env.KIRO_API_REGION = origApiRegion;
   if (origArn === undefined) delete process.env.KIRO_PROFILE_ARN; else process.env.KIRO_PROFILE_ARN = origArn;
@@ -52,7 +60,12 @@ function parsedWith(messages: unknown[], tools?: unknown[], modelId = "claude-so
 }
 
 function seedKiroCliMetadata(profileArn: string, region: string): void {
-  const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+  // Host-resolved layout (issue #710): mirrors resolveKiroCliNativeSessionEntries.
+  const dir = process.platform === "win32"
+    ? join(tmp, "AppData", "Local", "Kiro-Cli")
+    : process.platform === "darwin"
+      ? join(tmp, "Library", "Application Support", "kiro-cli")
+      : join(tmp, ".local", "share", "kiro-cli");
   mkdirSync(dir, { recursive: true });
   const db = new Database(join(dir, "data.sqlite3"));
   db.run("CREATE TABLE auth_kv (key TEXT PRIMARY KEY, value TEXT)");

tests/kiro-oauth.test.ts

@@ -11,6 +11,8 @@ import { inspectKiroCliSqlite, loginKiro, readKiroCliSqlite, refreshKiroToken, r
 setDefaultTimeout(30_000);
 
 const origHome = process.env.HOME;
+const origLocalAppData = process.env.LOCALAPPDATA;
+const origUserProfile = process.env.USERPROFILE;
 const origEnvTok = process.env.KIRO_ACCESS_TOKEN;
 const origArn = process.env.KIRO_PROFILE_ARN;
 const origRegion = process.env.KIRO_REGION;
@@ -33,6 +35,11 @@ function silenceWarn(): ReturnType<typeof spyOn> {
 beforeEach(() => {
   tmp = mkdtempSync(join(tmpdir(), "kiro-oauth-"));
   process.env.HOME = tmp;
+  // The native-store resolver is per-platform (issue #710), and on win32 it prefers
+  // LOCALAPPDATA/USERPROFILE over HOME — so HOME alone no longer isolates a Windows runner from its
+  // real profile. Point both at the temp dir for the duration of each test.
+  process.env.LOCALAPPDATA = join(tmp, "AppData", "Local");
+  process.env.USERPROFILE = tmp;
   delete process.env.KIRO_ACCESS_TOKEN;
   delete process.env.KIRO_PROFILE_ARN;
   delete process.env.KIRO_REGION;
@@ -47,6 +54,10 @@ afterEach(() => {
   for (const warning of warnSpies.splice(0)) warning.mockRestore();
   if (origHome === undefined) delete process.env.HOME;
   else process.env.HOME = origHome;
+  if (origLocalAppData === undefined) delete process.env.LOCALAPPDATA;
+  else process.env.LOCALAPPDATA = origLocalAppData;
+  if (origUserProfile === undefined) delete process.env.USERPROFILE;
+  else process.env.USERPROFILE = origUserProfile;
   if (origEnvTok === undefined) delete process.env.KIRO_ACCESS_TOKEN;
   else process.env.KIRO_ACCESS_TOKEN = origEnvTok;
   if (origArn === undefined) delete process.env.KIRO_PROFILE_ARN;
@@ -69,11 +80,21 @@ afterEach(() => {
   rmSync(tmp, { recursive: true, force: true });
 });
 
+/**
+ * The native kiro-cli store is resolved per-platform (issue #710), so fixtures must seed the layout
+ * the HOST resolves. Mirrors `resolveKiroCliNativeSessionEntries` in src/oauth/kiro-credentials.ts.
+ */
+function kiroCliDbDir(): string {
+  if (process.platform === "win32") return join(tmp, "AppData", "Local", "Kiro-Cli");
+  if (process.platform === "darwin") return join(tmp, "Library", "Application Support", "kiro-cli");
+  return join(tmp, ".local", "share", "kiro-cli");
+}
+
 function seedKiroCliDb(
   token: { access_token: string; refresh_token?: string; expires_at?: string; profile_arn?: string; region?: string },
   opts: { registration?: Record<string, unknown>; stateArn?: string } = {},
 ) {
-  const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+  const dir = kiroCliDbDir();
   mkdirSync(dir, { recursive: true });
   const db = new Database(join(dir, "data.sqlite3"));
   db.run("CREATE TABLE auth_kv (key TEXT PRIMARY KEY, value TEXT)");
@@ -89,7 +110,7 @@ function seedKiroCliDb(
 }
 
 function seedKiroCliRawValue(value: string) {
-  const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+  const dir = kiroCliDbDir();
   mkdirSync(dir, { recursive: true });
   const db = new Database(join(dir, "data.sqlite3"));
   db.run("CREATE TABLE auth_kv (key TEXT PRIMARY KEY, value TEXT)");
@@ -103,7 +124,7 @@ function removeKiroCliDb(): void {
 }
 
 function kiroCliDbPath(): string {
-  return join(tmp, "Library", "Application Support", "kiro-cli", "data.sqlite3");
+  return join(kiroCliDbDir(), "data.sqlite3");
 }
 
 function kiroCliRecoveryPath(): string {
@@ -284,7 +305,7 @@ describe("kiro oauth — import-first", () => {
   });
 
   test("force login refuses to log out when a present CLI session cannot be snapshotted", async () => {
-    const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+    const dir = kiroCliDbDir();
     mkdirSync(dir, { recursive: true });
     const db = new Database(join(dir, "data.sqlite3"));
     db.run("CREATE TABLE other_table (key TEXT PRIMARY KEY, value TEXT)");
@@ -603,7 +624,7 @@ describe("kiro oauth — import-first", () => {
   });
 
   test("inspectKiroCliSqlite distinguishes schema mismatch from no token", () => {
-    const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+    const dir = kiroCliDbDir();
     mkdirSync(dir, { recursive: true });
     const db = new Database(join(dir, "data.sqlite3"));
     db.run("CREATE TABLE other_table (key TEXT PRIMARY KEY, value TEXT)");
@@ -634,7 +655,7 @@ describe("kiro oauth — import-first", () => {
   });
 
   test("inspectKiroCliSqlite distinguishes unreadable database path", () => {
-    const dir = join(tmp, "Library", "Application Support", "kiro-cli");
+    const dir = kiroCliDbDir();
     mkdirSync(join(dir, "data.sqlite3"), { recursive: true });
 
     const result = inspectKiroCliSqlite();

tests/kiro-review-regressions.test.ts

@@ -17,6 +17,10 @@ import type { OcxConfig } from "../src/types";
 
 const ENV_KEYS = [
   "HOME",
+  // The native kiro-cli store resolves per-platform (issue #710) and win32 prefers these over HOME,
+  // so both must be isolated or a Windows runner would read the real user profile.
+  "LOCALAPPDATA",
+  "USERPROFILE",
   "OPENCODEX_HOME",
   "KIRO_ACCESS_TOKEN",
   "KIRO_REFRESH_TOKEN",
@@ -41,8 +45,18 @@ function config(): OcxConfig {
   };
 }
 
+/**
+ * Seeds/reads the layout the HOST resolver picks (issue #710). Mirrors
+ * `resolveKiroCliNativeSessionEntries` in src/oauth/kiro-credentials.ts.
+ */
+function kiroCliDbDir(): string {
+  if (process.platform === "win32") return join(tmp, "AppData", "Local", "Kiro-Cli");
+  if (process.platform === "darwin") return join(tmp, "Library", "Application Support", "kiro-cli");
+  return join(tmp, ".local", "share", "kiro-cli");
+}
+
 function kiroCliDbPath(): string {
-  return join(tmp, "Library", "Application Support", "kiro-cli", "data.sqlite3");
+  return join(kiroCliDbDir(), "data.sqlite3");
 }
 
 function kiroCliRecoveryPath(): string {
@@ -107,6 +121,8 @@ beforeEach(() => {
   tmp = mkdtempSync(join(tmpdir(), "kiro-review-regressions-"));
   for (const key of ENV_KEYS) delete process.env[key];
   process.env.HOME = tmp;
+  process.env.LOCALAPPDATA = join(tmp, "AppData", "Local");
+  process.env.USERPROFILE = tmp;
   process.env.OPENCODEX_HOME = join(tmp, "opencodex");
 });
 

tests/kiro-windows-cli-db-path.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "bun:test";
+
+import { resolveKiroCliNativeSessionEntries } from "../src/oauth/kiro-credentials";
+
+/**
+ * Issue #710: `ocx login kiro` could not import an existing Windows Kiro CLI session because the
+ * native-store candidate list only covered macOS and Linux. The reporter verified the real path is
+ * `%LOCALAPPDATA%\Kiro-Cli\data.sqlite3` (and that pointing KIROCLI_DB_PATH there made the import
+ * succeed), so the reader and token selector already worked — only discovery was short.
+ *
+ * These drive the pure resolver directly, so the win32 branch and each of its env fallback rungs are
+ * exercised on any host: `process.platform` is stubbable in this repo, but `os.platform()` does not
+ * follow it under Bun, so a platform-sniffing implementation could not be covered from macOS/Linux.
+ */
+describe("kiro-cli native session store resolution", () => {
+  const WIN_HOME = "C:\\Users\\u";
+
+  test("win32 uses %LOCALAPPDATA%\\Kiro-Cli\\data.sqlite3 (the path verified on issue #710)", () => {
+    const entries = resolveKiroCliNativeSessionEntries({
+      env: { LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local" },
+      platform: "win32",
+      home: WIN_HOME,
+    });
+
+    expect(entries).toEqual([
+      { location: "kiro-cli-windows-data", path: "C:\\Users\\u\\AppData\\Local\\Kiro-Cli\\data.sqlite3" },
+    ]);
+  });
+
+  // Middle rung of the win32 chain (LOCALAPPDATA -> USERPROFILE -> injected home). A blank
+  // LOCALAPPDATA must fall THROUGH rather than produce a rootless `\AppData\Local\...` path.
+  test("win32 falls back to %USERPROFILE%\\AppData\\Local when LOCALAPPDATA is blank", () => {
+    const entries = resolveKiroCliNativeSessionEntries({
+      env: { LOCALAPPDATA: "   ", USERPROFILE: "C:\\Users\\u" },
+      platform: "win32",
+      home: "D:\\injected-home",
+    });
+
+    expect(entries).toEqual([
+      { location: "kiro-cli-windows-data", path: "C:\\Users\\u\\AppData\\Local\\Kiro-Cli\\data.sqlite3" },
+    ]);
+  });
+
+  test("win32 falls back to the injected home when no Windows env var is usable", () => {
+    for (const env of [{}, { LOCALAPPDATA: "" }, { LOCALAPPDATA: "", USERPROFILE: "" }]) {
+      const entries = resolveKiroCliNativeSessionEntries({ env, platform: "win32", home: WIN_HOME });
+
+      expect(entries).toEqual([
+        { location: "kiro-cli-windows-data", path: "C:\\Users\\u\\AppData\\Local\\Kiro-Cli\\data.sqlite3" },
+      ]);
+    }
+  });
+
+  test("darwin keeps the Application Support store", () => {
+    const entries = resolveKiroCliNativeSessionEntries({
+      env: {},
+      platform: "darwin",
+      home: "/Users/u",
+    });
+
+    expect(entries).toEqual([
+      { location: "kiro-cli-data", path: "/Users/u/Library/Application Support/kiro-cli/data.sqlite3" },
+    ]);
+  });
+
+  test("linux keeps the XDG-style share store", () => {
+    const entries = resolveKiroCliNativeSessionEntries({
+      env: {},
+      platform: "linux",
+      home: "/home/u",
+    });
+
+    expect(entries).toEqual([
+      { location: "kiro-cli-linux-data", path: "/home/u/.local/share/kiro-cli/data.sqlite3" },
+    ]);
+  });
+
+  // The list also feeds forced-login snapshot/rollback, which must never touch a foreign platform's
+  // database: exactly one entry per platform, and Windows env vars never leak into POSIX resolution.
+  test("resolution is one native store per platform and ignores foreign env vars", () => {
+    const windowsEnv = { LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local", USERPROFILE: "C:\\Users\\u" };
+
+    for (const platform of ["win32", "darwin", "linux"] as const) {
+      expect(resolveKiroCliNativeSessionEntries({ env: windowsEnv, platform, home: "/home/u" })).toHaveLength(1);
+    }
+
+    expect(resolveKiroCliNativeSessionEntries({ env: windowsEnv, platform: "linux", home: "/home/u" })).toEqual([
+      { location: "kiro-cli-linux-data", path: "/home/u/.local/share/kiro-cli/data.sqlite3" },
+    ]);
+  });
+});