From dda911f35e834304a8ffcbec6a3fb209802dd645 Mon Sep 17 00:00:00 2001 From: Yoahoug Date: Fri, 20 Feb 2026 22:55:55 +0800 Subject: [PATCH 1/2] =?UTF-8?q?=E7=AE=80=E5=8C=96=E9=85=8D=E7=BD=AE?= =?UTF-8?q?=E6=96=B9=E5=BC=8F=E5=B9=B6=E6=B7=BB=E5=8A=A0=20Claude=204.6=20?= =?UTF-8?q?=E6=A8=A1=E5=9E=8B=E6=94=AF=E6=8C=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 主要改动： 1. 简化配置方式 - 新增根目录 .env.example 统一配置模板 - docker-compose.yml 改为从根目录 .env 读取配置 - 用户只需配置一个文件：ADMIN_PASSWORD 和 INTERNAL_API_KEY - 移除 kiro-gateway 单独配置的需求（账号凭证由 kiro-go 通过 HTTP 头转发） 2. 添加 Claude 4.6 模型支持 - kiro-gateway/kiro/config.py: 在 FALLBACK_MODELS 中添加 claude-sonnet-4.6 和 claude-opus-4.6 - 修复用户报告的 504 错误（模型不在缓存列表中） 3. 更新文档 - README.md: 简化为"三步启动"，添加 4.6 模型说明，更新配置说明 - 新增 CLAUDE.md: 为 Claude Code 提供项目架构和开发指南 - kiro-gateway/.env.example: 添加警告说明（kiro-stack 用户无需配置此文件） 4. 其他优化 - .gitignore: 添加根目录 .env 文件忽略规则 - 统一环境变量命名：INTERNAL_API_KEY（替代分散的 API_KEY 配置） 修复问题： - 修复 claude-sonnet-4.6 请求 504 超时错误 - 解决用户困惑：为什么 gateway 还需要配置 .env（现在不需要了） --- .env.example | 22 ++++ .gitignore | 6 +- CLAUDE.md | 182 +++++++++++++++++++++++++++++++++ README.md | 119 +++++++++------------ docker-compose.yml | 10 +- kiro-gateway/.env.example | 199 +++++------------------------------- kiro-gateway/kiro/config.py | 2 + 7 files changed, 288 insertions(+), 252 deletions(-) create mode 100644 .env.example create mode 100644 CLAUDE.md diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..8223e5f --- /dev/null +++ b/.env.example @@ -0,0 +1,22 @@ +# ============================================ +# Kiro Stack 配置文件 +# ============================================ + +# -------------------- 管理面板 -------------------- +# Web 管理面板密码（必填） +ADMIN_PASSWORD=change_this_password + +# -------------------- 内部通信 -------------------- +# kiro-go 和 kiro-gateway 之间的通信密钥（必填） +# 两个服务会自动使用这个密钥进行鉴权 +INTERNAL_API_KEY=change_this_api_key + +# -------------------- 可选配置 -------------------- +# 如果你在中国或有网络限制，可以配置代理 +# VPN_PROXY_URL=http://127.0.0.1:7890 +# VPN_PROXY_URL=socks5://127.0.0.1:1080 + +# 调试模式（可选） +# DEBUG_MODE=off # 关闭（默认） +# DEBUG_MODE=errors # 仅记录错误请求 +# DEBUG_MODE=all # 记录所有请求 diff --git a/.gitignore b/.gitignore index 2beda53..883782d 100644 --- a/.gitignore +++ b/.gitignore @@ -2,10 +2,14 @@ # 敏感数据 / Sensitive Data # ============================== +# 根目录环境变量（含密码和密钥） +.env +.env.local + # kiro-go 账号数据（含 Token） kiro-go/data/config.json -# kiro-gateway 环境变量 +# kiro-gateway 环境变量（已废弃，现在统一用根目录 .env） kiro-gateway/.env kiro-gateway/.env.local diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..d9d7198 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,182 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Project Overview + +Kiro Stack integrates two upstream projects to provide OpenAI/Anthropic-compatible API access to Kiro (Amazon Q Developer) accounts: + +- **kiro-go** (Go): Web admin panel, multi-account pool management, token refresh +- **kiro-gateway** (Python/FastAPI): Stable proxy layer with retry logic and dual-endpoint fallback + +## Architecture + +``` +Client (Claude Code/Cursor/etc) → kiro-go:8088 → kiro-gateway:8000 → Kiro API +``` + +**Request Flow:** +1. Client sends OpenAI/Anthropic-compatible request to kiro-go +2. kiro-go selects account from pool (weighted random selection) +3. If `KIRO_GATEWAY_BASE` is set, kiro-go forwards to kiro-gateway with account credentials in headers +4. kiro-gateway handles token refresh, retries, and dual-endpoint fallback +5. Response streams back through the chain + +**Key Integration Point:** `kiro-go/proxy/handler.go:380-395` (`proxyToGatewayWithAccount`) injects account credentials as HTTP headers (`X-Kiro-Refresh-Token`, `X-Kiro-Region`, etc.) when forwarding to gateway. + +## Common Commands + +### Development + +```bash +# Start both services with Docker Compose +docker compose up -d + +# View logs +docker compose logs -f kiro-go +docker compose logs -f kiro-gateway + +# Rebuild after code changes +docker compose up -d --build + +# Stop services +docker compose down +``` + +### kiro-go (Go service) + +```bash +cd kiro-go + +# Build +go build -o kiro-go . + +# Run locally +./kiro-go + +# Run with custom config path +CONFIG_PATH=/path/to/config.json ./kiro-go + +# Format code +go fmt ./... +``` + +### kiro-gateway (Python service) + +```bash +cd kiro-gateway + +# Install dependencies +pip install -r requirements.txt + +# Run locally +python main.py + +# Run with custom port +python main.py --port 9000 + +# Run tests +pytest + +# Run specific test file +pytest tests/unit/test_auth.py + +# Run with verbose output +pytest -v +``` + +## Configuration + +### Environment Variables + +**Root .env file (simplified setup):** +- `ADMIN_PASSWORD` - Web admin panel password (required) +- `INTERNAL_API_KEY` - Internal communication key between kiro-go and kiro-gateway (required) +- `VPN_PROXY_URL` - HTTP/SOCKS5 proxy for restricted networks (optional) +- `DEBUG_MODE` - Logging mode: `off`, `errors`, `all` (optional) + +**How it works:** +- All configuration is in the root `.env` file +- `docker-compose.yml` reads from `.env` and distributes variables to both services +- kiro-go manages all account credentials +- When forwarding requests, kiro-go injects credentials as HTTP headers (`X-Kiro-*`) +- kiro-gateway receives credentials from headers, no need for separate .env configuration + +### Configuration Files + +**kiro-go:** `data/config.json` stores accounts, settings, and statistics. Thread-safe access via `config/config.go` with RWMutex. + +**kiro-gateway:** No configuration file needed when used with kiro-go. Receives all credentials via HTTP headers. + +## Code Structure + +### kiro-go (Go) + +**Entry point:** `main.go` - Initializes config, account pool, and HTTP handler + +**Core modules:** +- `config/config.go` - Configuration management with JSON persistence. Account struct includes auth credentials, subscription info, usage tracking, and runtime statistics +- `pool/account.go` - Account pool with weighted random selection. Maintains enabled accounts in memory +- `proxy/handler.go` - HTTP routing and request handling. Contains gateway proxy logic (lines 160-176, 380-395) +- `proxy/kiro.go` - Direct Kiro API client (used when gateway is not configured) +- `proxy/translator.go` - Request/response translation between OpenAI/Anthropic and Kiro formats +- `auth/` - Authentication methods: AWS Builder ID, IAM SSO, OIDC token refresh + +**Gateway Integration:** When `KIRO_GATEWAY_BASE` is set, `NewHandler()` creates a reverse proxy (`handler.go:163-176`). The `proxyToGatewayWithAccount()` function (`handler.go:380-395`) injects account credentials as headers before forwarding. + +### kiro-gateway (Python) + +**Entry point:** `main.py` - FastAPI app with lifespan management + +**Core modules:** +- `kiro/config.py` - Environment variable configuration +- `kiro/auth.py` - KiroAuthManager handles token refresh and authentication +- `kiro/auth_pool.py` - Builds authentication pool from credentials +- `kiro/routes_openai.py` - OpenAI-compatible `/v1/chat/completions` endpoint +- `kiro/routes_anthropic.py` - Anthropic-compatible `/v1/messages` endpoint +- `kiro/model_resolver.py` - Model name normalization and resolution +- `kiro/cache.py` - Model info caching + +**Request Headers:** Gateway expects account credentials in `X-Kiro-*` headers (set by kiro-go). If not present, falls back to environment variables. + +## Important Patterns + +### Account Pool Selection + +`pool/account.go` uses weighted random selection. Each account has a `Weight` field (default: 100). Higher weight = higher selection probability. Only enabled accounts are included in the pool. + +### Token Refresh + +Both services handle token refresh: +- **kiro-go:** Background refresh every 30 minutes (`handler.go:184-203`). Checks if token expires within 5 minutes and refreshes proactively +- **kiro-gateway:** Refreshes on-demand when token is expired or about to expire + +### Retry Logic + +**kiro-go:** When using gateway, implements failover with up to 4 attempts (`handler.go:397+`). Tries different accounts on failure. + +**kiro-gateway:** Implements dual-endpoint fallback (CodeWhisperer vs Amazon Q endpoints) with configurable retry logic. + +### Thinking Mode + +Both services support extended thinking mode. Triggered by model name suffix (default: `-thinking`). Configuration in `config.json` (`ThinkingSuffix`, `OpenAIThinkingFormat`, `ClaudeThinkingFormat`). + +## Testing + +**kiro-gateway only:** Uses pytest. Test structure: +- `tests/unit/` - Unit tests for individual modules +- `tests/integration/` - Integration tests +- `tests/conftest.py` - Shared fixtures + +**kiro-go:** No test suite currently exists. + +## Utilities + +**scripts/sync_tokens.py** - Syncs refresh tokens from kiro-go config to kiro-gateway .env file. Reads enabled accounts from `data/config.json` and writes `KIRO_REFRESH_TOKENS` to `.env` as comma-separated list. Useful for keeping gateway's token pool in sync with go service accounts. + +## Deployment Notes + +- Both services bind to `0.0.0.0` by default for Docker compatibility +- kiro-go stores persistent data in `data/config.json` - mount this volume in production +- Gateway is stateless - no persistent storage required +- Services communicate via internal Docker network when using docker-compose diff --git a/README.md b/README.md index 0e6fc14..147ad25 100644 --- a/README.md +++ b/README.md @@ -61,93 +61,60 @@ - Docker + Docker Compose - Kiro 账号（免费 / 付费均可） -### 1. 克隆仓库 +### 三步启动 ```bash +# 1. 克隆仓库 git clone https://github.com/your-username/kiro-stack.git cd kiro-stack -``` - -### 2. 配置 kiro-gateway - -```bash -cp kiro-gateway/.env.example kiro-gateway/.env -``` -编辑 `kiro-gateway/.env`，至少配置 API Key（用于 kiro-go 调用鉴权）： - -```env -# kiro-go 调用时使用的 API Key（自定义，需与 docker-compose.yml 保持一致） -API_KEY=your_api_key_here -``` - -> 完整配置项参考 [kiro-gateway/README.md](kiro-gateway/README.md) - -### 3. 配置 docker-compose.yml - -编辑根目录 `docker-compose.yml`： - -```yaml -services: - kiro-gateway: - ... - env_file: - - ./kiro-gateway/.env - ports: - - "8001:8000" # gateway 内部端口，不对外暴露也可 - - kiro-go: - ... - environment: - - ADMIN_PASSWORD=your_admin_password # Web 管理面板密码 - - KIRO_GATEWAY_BASE=http://kiro-gateway:8000 - - KIRO_GATEWAY_API_KEY=your_api_key_here # 需与 gateway API_KEY 一致 - ports: - - "8088:8080" # 对外暴露端口 -``` +# 2. 配置环境变量 +cp .env.example .env +# 编辑 .env，修改以下两项： +# ADMIN_PASSWORD=你的管理面板密码 +# INTERNAL_API_KEY=随机生成的密钥（用于内部通信） -### 4. 启动服务 - -```bash +# 3. 启动服务 docker compose up -d ``` -### 5. 添加账号 +### 添加账号并使用 1. 打开 `http://localhost:8088/admin` -2. 输入 `ADMIN_PASSWORD` 登录 +2. 使用 `ADMIN_PASSWORD` 登录 3. 添加 Kiro 账号（支持 AWS Builder ID / IAM SSO / SSO Token 等方式） - -### 6. 使用 API - -将客户端的 base URL 设为 `http://localhost:8088`，无需 API Key（或按面板配置）。 +4. 将客户端的 base URL 设为 `http://localhost:8088` ```bash # OpenAI 兼容 curl http://localhost:8088/v1/chat/completions \ -H "Content-Type: application/json" \ - -d '{"model": "claude-sonnet-4-5", "messages": [{"role": "user", "content": "Hello"}], "stream": true}' + -d '{"model": "claude-sonnet-4.5", "messages": [{"role": "user", "content": "Hello"}]}' # Anthropic 兼容 curl http://localhost:8088/v1/messages \ -H "Content-Type: application/json" \ - -d '{"model": "claude-sonnet-4-5", "max_tokens": 1024, "messages": [{"role": "user", "content": "Hello"}]}' + -d '{"model": "claude-sonnet-4.5", "max_tokens": 1024, "messages": [{"role": "user", "content": "Hello"}]}' ``` +> **说明：** 账号凭证由 kiro-go 管理，请求时自动转发给 kiro-gateway，无需在 gateway 单独配置 token。 + --- ## 支持的模型 -模型可用性取决于你的 Kiro 订阅等级，以下为常见免费模型： +模型可用性取决于你的 Kiro 订阅等级，以下为常见模型： | 模型 | 说明 | |------|------| -| `claude-sonnet-4-5` | 均衡性能，适合编程、写作等通用任务 | -| `claude-haiku-4-5` | 极速响应，适合简单任务 | +| `claude-sonnet-4.6` | 最新旗舰模型（2026年2月发布） | +| `claude-opus-4.6` | 最强推理模型（2026年2月发布） | +| `claude-sonnet-4.5` | 均衡性能，适合编程、写作等通用任务 | +| `claude-haiku-4.5` | 极速响应，适合简单任务 | | `claude-sonnet-4` | 上一代，稳定可靠 | -| `claude-3-7-sonnet` | 旧版，向后兼容 | -| `deepseek-v3-2` | 开源 MoE（685B/37B active），均衡 | -| `minimax-m2-1` | 开源 MoE（230B/10B active），适合复杂任务 | +| `claude-3.7-sonnet` | 旧版，向后兼容 | +| `deepseek-v3.2` | 开源 MoE（685B/37B active），均衡 | +| `minimax-m2.1` | 开源 MoE（230B/10B active），适合复杂任务 | | `qwen3-coder-next` | 开源 MoE（80B/3B active），代码专项 | 模型名称支持多种格式，如 `claude-sonnet-4.5` / `claude-sonnet-4-5` / `claude-sonnet-4-5-20250929` 均可正常解析。 @@ -156,25 +123,35 @@ curl http://localhost:8088/v1/messages \ ## 配置说明 -### kiro-go 环境变量 +### 环境变量（.env 文件） -| 变量 | 说明 | 默认值 | -|---|---|---| -| `ADMIN_PASSWORD` | Web 管理面板密码 | - | -| `CONFIG_PATH` | 配置文件路径 | `data/config.json` | -| `KIRO_GATEWAY_BASE` | kiro-gateway 地址，设置后请求走 gateway | 空（直连 Kiro API） | -| `KIRO_GATEWAY_API_KEY` | 调用 gateway 的鉴权 Key | 空 | +所有配置都在根目录的 `.env` 文件中： + +| 变量 | 说明 | 必填 | +|------|------|------| +| `ADMIN_PASSWORD` | Web 管理面板密码 | ✅ 是 | +| `INTERNAL_API_KEY` | kiro-go 和 kiro-gateway 之间的通信密钥 | ✅ 是 | +| `VPN_PROXY_URL` | HTTP/SOCKS5 代理（如有网络限制） | ❌ 否 | +| `DEBUG_MODE` | 调试模式：`off`（默认）/ `errors` / `all` | ❌ 否 | + +**说明：** +- `ADMIN_PASSWORD`：用于登录 Web 管理面板 +- `INTERNAL_API_KEY`：两个服务之间的内部鉴权，随机生成即可（如 `openssl rand -hex 32`） +- `VPN_PROXY_URL`：如果在中国或有网络限制，配置代理地址（如 `http://127.0.0.1:7890`） +- `DEBUG_MODE`：生产环境建议 `off`，排查问题时可设为 `errors` -### kiro-gateway 主要环境变量 +### 账号管理 -详见 [kiro-gateway/README.md](kiro-gateway/README.md)，常用项： +所有 Kiro 账号通过 Web 管理面板添加和管理： +1. 访问 `http://localhost:8088/admin` +2. 使用 `ADMIN_PASSWORD` 登录 +3. 点击"添加账号"，支持多种方式： + - AWS Builder ID（个人账号） + - IAM Identity Center（企业 SSO） + - SSO Token（从浏览器导入） + - 本地缓存（从 Kiro IDE 导入） -| 变量 | 说明 | -|---|---| -| `API_KEY` | API 访问密钥 | -| `PROXY_URL` | HTTP/SOCKS5 代理（如有网络限制） | -| `MAX_RETRIES` | 最大重试次数 | -| `RETRY_DELAY` | 重试间隔（秒） | +**无需在 kiro-gateway 配置 token**，所有账号凭证由 kiro-go 管理，请求时自动转发。 --- diff --git a/docker-compose.yml b/docker-compose.yml index e7d8c98..9675e62 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,8 +4,10 @@ services: image: kiro-gateway-local:latest container_name: kiro-gateway restart: unless-stopped - env_file: - - ./kiro-gateway/.env + environment: + - PROXY_API_KEY=${INTERNAL_API_KEY} + - VPN_PROXY_URL=${VPN_PROXY_URL:-} + - DEBUG_MODE=${DEBUG_MODE:-off} ports: - "8001:8000" @@ -21,6 +23,6 @@ services: - ./kiro-go/data:/app/data environment: - CONFIG_PATH=/app/data/config.json - - ADMIN_PASSWORD=change_this_password + - ADMIN_PASSWORD=${ADMIN_PASSWORD} - KIRO_GATEWAY_BASE=http://kiro-gateway:8000 - - KIRO_GATEWAY_API_KEY=change_this_api_key + - KIRO_GATEWAY_API_KEY=${INTERNAL_API_KEY} diff --git a/kiro-gateway/.env.example b/kiro-gateway/.env.example index 18e2b51..c1a7b3c 100644 --- a/kiro-gateway/.env.example +++ b/kiro-gateway/.env.example @@ -1,196 +1,43 @@ -# Kiro Gateway - Environment Configuration -# Copy this file to .env and fill in your values - -# =========================================== -# REQUIRED -# =========================================== - -# Password to protect YOUR proxy server -# This is NOT a token from anywhere - YOU make it up! -# Use this same value as api_key when connecting to your gateway -# Example: "my-super-secret-password-123" or any secure string -PROXY_API_KEY="my-super-secret-password-123" - -# =========================================== -# OPTION 1: Kiro IDE credentials (JSON file) -# =========================================== - -# Path to JSON credentials file from Kiro IDE -# KIRO_CREDS_FILE="~/.aws/sso/cache/kiro-auth-token.json" - -# =========================================== -# OPTION 2: Kiro IDE refresh token -# =========================================== - -# Your Kiro refresh token obtained from Kiro IDE traffic. -# REFRESH_TOKEN="your_kiro_refresh_token_here" - -# =========================================== -# OPTION 3: kiro-cli SQLite database (AWS SSO) -# =========================================== - -# Path to kiro-cli SQLite database (for AWS IAM Identity Center users) -# The gateway will auto-detect AWS SSO OIDC and use the correct endpoint -# KIRO_CLI_DB_FILE="~/.local/share/kiro-cli/data.sqlite3" - -# =========================================== -# OPTION 4: AWS SSO cache file (kiro-cli) -# =========================================== - -# Path to AWS SSO cache file (contains clientId and clientSecret) -# The gateway will auto-detect AWS SSO OIDC and use the correct endpoint -# KIRO_CREDS_FILE="~/.aws/sso/cache/your-sso-cache-file.json" - -# =========================================== -# PROFILE ARN (optional) -# =========================================== - -# AWS CodeWhisperer profile ARN -# For Kiro IDE: usually auto-detected from credentials file -# For kiro-cli (AWS SSO / Builder ID): not needed, will be ignored -# PROFILE_ARN="arn:aws:codewhisperer:us-east-1:..." - -# =========================================== -# OPTIONAL -# =========================================== - -# AWS region (default: us-east-1) -# KIRO_REGION="us-east-1" - -# =========================================== -# SERVER SETTINGS -# =========================================== - -# Server host (default: 0.0.0.0 - listen on all interfaces) -# Use "127.0.0.1" to only allow local connections -# SERVER_HOST="0.0.0.0" - -# Server port (default: 8000) -# Useful when port 8000 is already in use by another application -# -# Configuration priority (highest to lowest): -# 1. CLI arguments: python main.py --port 9000 -# 2. Environment variables: SERVER_PORT=9000 -# 3. Default value: 8000 -# -# Note: When using `uvicorn main:app --port 9000` directly, -# uvicorn handles its own CLI arguments (this setting is ignored) -# SERVER_PORT="8000" - -# =========================================== -# VPN/PROXY SETTINGS -# =========================================== - -# VPN/Proxy URL for accessing Kiro API through a proxy server. -# Leave empty to connect directly (default). +# ============================================ +# Kiro Gateway - 独立部署配置文件 +# ============================================ # -# Use cases: -# - China: GFW (Great Firewall) blocks AWS endpoints -# - Corporate networks: Often require mandatory proxy -# - Privacy: Hide your IP address from AWS +# ⚠️ 注意：如果你使用 kiro-stack 整合部署，请忽略此文件！ # -# Supports HTTP and SOCKS5 protocols. -# Authentication can be embedded in the URL. +# kiro-stack 用户请配置根目录的 .env 文件，无需配置此文件。 +# 账号凭证由 kiro-go 管理，通过 HTTP 头自动转发给 gateway。 # -# Examples: -# VPN_PROXY_URL="http://127.0.0.1:7890" -# VPN_PROXY_URL="socks5://127.0.0.1:1080" -# VPN_PROXY_URL="http://user:password@proxy.company.com:8080" -# VPN_PROXY_URL="192.168.1.100:8080" # defaults to http:// +# 此文件仅用于 kiro-gateway 独立部署（不使用 kiro-go）。 +# 详见：https://github.com/jwadow/kiro-gateway # -# VPN_PROXY_URL="" +# ============================================ # =========================================== -# FIRST TOKEN TIMEOUT (Streaming Retry) +# REQUIRED (独立部署时必填) # =========================================== -# Timeout for waiting for the first token from the model (in seconds). -# If the model doesn't respond within this time, the request will be cancelled and retried. -# This helps handle "stuck" requests when the model takes too long to start responding. -# Default: 15 seconds (recommended for production) -# Set a lower value (e.g., 5-10) for more aggressive retry behavior. -# FIRST_TOKEN_TIMEOUT="15" - -# Maximum number of retry attempts when first token timeout occurs. -# After exhausting all attempts, a 504 Gateway Timeout error will be returned. -# Default: 3 attempts -# FIRST_TOKEN_MAX_RETRIES="3" - -# Read timeout for streaming responses (in seconds). -# This is the maximum time to wait for data between chunks during streaming. -# Should be longer than FIRST_TOKEN_TIMEOUT since the model may pause between chunks -# while "thinking" (especially for tool calls or complex reasoning). -# Default: 300 seconds (5 minutes) - generous timeout to avoid premature disconnects. -# STREAMING_READ_TIMEOUT="300" +# 访问密码（自定义） +PROXY_API_KEY="my-super-secret-password-123" # =========================================== -# FAKE REASONING (Extended Thinking via Tag Injection) +# 账号凭证（独立部署时选择一种方式） # =========================================== -# Enable fake reasoning - injects special tags into requests to enable model reasoning. -# When enabled, the model will include its reasoning process in the response. -# The response is then parsed and converted to OpenAI-compatible reasoning_content format. -# -# WHY "FAKE"? This is NOT native extended thinking API support. Instead, we inject -# enabled tags into the prompt, and the model responds -# with ... blocks that we parse and convert to reasoning_content. -# It works great, but it's a hack - hence "fake" reasoning. -# -# Default: true (ENABLED by default for premium experience out of the box) -# To disable, set to false: -# FAKE_REASONING=false - -# Maximum thinking length in tokens. -# This value is injected into the request as {value} -# Higher values allow for more detailed reasoning but increase response time and token usage. -# Default: 4000 tokens -# FAKE_REASONING_MAX_TOKENS=4000 - -# How to handle the thinking block in responses: -# - "as_reasoning_content": Extract to reasoning_content field (OpenAI-compatible, recommended) -# - "remove": Remove thinking block completely, return only final answer -# - "pass": Pass through as-is with original tags in content -# - "strip_tags": Remove tags but keep thinking content in regular content -# -# Default: "as_reasoning_content" -# FAKE_REASONING_HANDLING=as_reasoning_content - -# Maximum size of initial buffer for tag detection (characters). -# The parser buffers this many characters before deciding if response contains thinking tags. -# Lower values = faster first token appearance, but may miss tags with leading whitespace. -# Default: 20 characters (enough for longest tag = 11 chars + some whitespace) -# FAKE_REASONING_INITIAL_BUFFER_SIZE=20 +# 方式 1: JSON 凭证文件 +# KIRO_CREDS_FILE="~/.aws/sso/cache/kiro-auth-token.json" -# =========================================== -# TRUNCATION RECOVERY -# =========================================== +# 方式 2: Refresh Token +# REFRESH_TOKEN="your_kiro_refresh_token_here" -# Enable automatic truncation recovery when Kiro API cuts off large responses. -# When the model generates large tool calls or content, the upstream API may truncate -# the response mid-stream. This feature automatically notifies the model about truncation, -# allowing it to adapt its approach (e.g., write smaller files, split operations). -# -# Default: true (ENABLED by default for better out-of-the-box experience) -# TRUNCATION_RECOVERY=true +# 方式 3: kiro-cli 数据库 +# KIRO_CLI_DB_FILE="~/.local/share/kiro-cli/data.sqlite3" # =========================================== -# LOGGING +# 可选配置 # =========================================== -# Log level: TRACE, DEBUG, INFO, WARNING, ERROR, CRITICAL -# Default: INFO (recommended for production) -# Set to DEBUG for detailed troubleshooting -# LOG_LEVEL="INFO" +# 代理设置（中国用户或网络受限时） +# VPN_PROXY_URL=http://127.0.0.1:7890 -# =========================================== -# DEBUG (for development only) -# =========================================== - -# Debug logging mode: -# - off: disabled (default) -# - errors: save logs only for failed requests (4xx, 5xx) - recommended for troubleshooting -# - all: save logs for every request (overwrites on each request) +# 调试模式 # DEBUG_MODE=off - -# Directory for debug log files -# DEBUG_DIR="debug_logs" diff --git a/kiro-gateway/kiro/config.py b/kiro-gateway/kiro/config.py index 9f1f6ce..f630fa3 100644 --- a/kiro-gateway/kiro/config.py +++ b/kiro-gateway/kiro/config.py @@ -264,6 +264,8 @@ def _get_raw_env_value(var_name: str, env_file: str = ".env") -> Optional[str]: {"modelId": "claude-haiku-4.5"}, {"modelId": "claude-sonnet-4.5"}, {"modelId": "claude-opus-4.5"}, + {"modelId": "claude-sonnet-4.6"}, + {"modelId": "claude-opus-4.6"}, ] # ================================================================================================== From 9b7200ece29d3f329f1c950d3b64e5d37db7c7c3 Mon Sep 17 00:00:00 2001 From: Yoahoug Date: Sat, 21 Feb 2026 12:10:14 +0800 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E9=9B=86=E6=88=90?= =?UTF-8?q?=E6=A8=A1=E5=BC=8F=E5=90=AF=E5=8A=A8=E5=A4=B1=E8=B4=A5=E5=B9=B6?= =?UTF-8?q?=E5=AE=8C=E5=96=84=E6=96=87=E6=A1=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - docker-compose.yml: kiro-gateway 新增 SKIP_STARTUP_CREDENTIAL_CHECK=true 解决集成部署时 gateway 因找不到本地凭证而无法启动的问题 （凭证由 kiro-go 通过 X-Kiro-* 请求头动态传入，无需启动时校验） - kiro-gateway/main.py: validate_configuration() 识别 SKIP_STARTUP_CREDENTIAL_CHECK 为 true 时跳过凭证校验，记录 INFO 日志说明原因 - kiro-gateway/kiro/http_client.py: 429 错误日志附带响应体 便于区分真正的限流与模型无权限（Kiro API 对两者均返回 429） - README.md: 新增 feature 分支改动说明 新增 claude-sonnet-4.6/opus-4.6 无法使用的原因说明（账号权限问题，非代码 Bug） --- README.md | 31 +++++++++++++++++++++++++++++++ docker-compose.yml | 1 + kiro-gateway/kiro/http_client.py | 7 ++++++- kiro-gateway/main.py | 7 +++++++ 4 files changed, 45 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 147ad25..0124aa6 100644 --- a/README.md +++ b/README.md @@ -119,6 +119,18 @@ curl http://localhost:8088/v1/messages \ 模型名称支持多种格式，如 `claude-sonnet-4.5` / `claude-sonnet-4-5` / `claude-sonnet-4-5-20250929` 均可正常解析。 +> **⚠️ 关于 `claude-sonnet-4.6` / `claude-opus-4.6` 无法使用的说明** +> +> 这两个模型目前处于**小范围灰度开放**阶段，Kiro API 对无权限的请求会返回 HTTP 429， +> 与普通「限流」使用相同的状态码，因此日志中会看到 `Streaming failed after 3 attempts` 的报错。 +> +> **原因并非代码 Bug，而是你的 Kiro 账号/Region 尚未获得该模型的访问权限。** +> +> 排查步骤： +> 1. 先用 `claude-sonnet-4.5` 发一条测试请求，若成功则账号和链路均正常 +> 2. 等待 AWS 对你的账号开放 4.6 模型（通常随 Kiro IDE 版本升级逐步推送） +> 3. 开放后无需任何配置变更，直接使用即可 + --- ## 配置说明 @@ -178,6 +190,25 @@ kiro-stack/ ## 更新日志 +### `feature/simplify-config-and-add-4.6-models` + +**配置简化：** +- 整合部署只需配置**根目录一个 `.env` 文件**，不再需要单独维护 `kiro-gateway/.env` +- 账号凭证（Refresh Token 等）完全通过 kiro-go Web 管理面板管理，kiro-go 转发请求时自动通过 `X-Kiro-*` HTTP 头传递给 gateway +- `kiro-gateway/.env.example` 更新注释，明确标注仅独立部署时才需要此文件 + +**新增模型支持：** +- 在 gateway 内置 fallback 模型列表中添加 `claude-sonnet-4.6`、`claude-opus-4.6`、`claude-opus-4.6-1m` + +**集成模式启动修复：** +- 新增 `SKIP_STARTUP_CREDENTIAL_CHECK=true` 环境变量（已在 `docker-compose.yml` 中预设） +- 修复集成部署时 kiro-gateway 因找不到本地静态凭证而无法启动的问题（凭证由请求头动态传入，无需启动时校验） + +**日志改进：** +- 429 错误日志现在会附带 Kiro API 返回的响应体，便于判断是真正限流还是模型无权限 + +--- + ### 相比原版的改动 **kiro-go 改动：** diff --git a/docker-compose.yml b/docker-compose.yml index 9675e62..63d7022 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,6 +8,7 @@ services: - PROXY_API_KEY=${INTERNAL_API_KEY} - VPN_PROXY_URL=${VPN_PROXY_URL:-} - DEBUG_MODE=${DEBUG_MODE:-off} + - SKIP_STARTUP_CREDENTIAL_CHECK=true ports: - "8001:8000" diff --git a/kiro-gateway/kiro/http_client.py b/kiro-gateway/kiro/http_client.py index 943fa49..e30f1b1 100644 --- a/kiro-gateway/kiro/http_client.py +++ b/kiro-gateway/kiro/http_client.py @@ -234,7 +234,12 @@ async def request_with_retry( # 429 - rate limit, wait and retry if response.status_code == 429: delay = BASE_RETRY_DELAY * (2 ** attempt) - logger.warning(f"Received 429, waiting {delay}s (attempt {attempt + 1}/{MAX_RETRIES})") + try: + await response.aread() + _body = response.text[:500] + except Exception: + _body = "<无法读取响应体>" + logger.warning(f"Received 429, waiting {delay}s (attempt {attempt + 1}/{MAX_RETRIES}) | body: {_body}") await asyncio.sleep(delay) continue diff --git a/kiro-gateway/main.py b/kiro-gateway/main.py index e810eed..c85d74e 100644 --- a/kiro-gateway/main.py +++ b/kiro-gateway/main.py @@ -208,10 +208,17 @@ def validate_configuration() -> None: Checks: - Either REFRESH_TOKEN, KIRO_CREDS_FILE, or KIRO_CLI_DB_FILE is configured - Supports both .env file (local) and environment variables (Docker) + - When SKIP_STARTUP_CREDENTIAL_CHECK=true, skips credential check + (used in kiro-stack integrated mode where credentials come from kiro-go headers) Raises: SystemExit: If critical configuration is missing """ + # 集成模式：凭证由 kiro-go 通过 X-Kiro-* 请求头动态传入，无需启动时校验 + if os.getenv("SKIP_STARTUP_CREDENTIAL_CHECK", "").lower() in ("true", "1", "yes"): + logger.info("SKIP_STARTUP_CREDENTIAL_CHECK=true，跳过凭证校验（集成模式：凭证由请求头传入）") + return + errors = [] # Check if .env file exists (optional - can use environment variables)