From c3bf51dbf08f80ff1bb9e0d1a2a0fd6ba150a87b Mon Sep 17 00:00:00 2001
From: Veritas-7 <234569343+Veritas-7@users.noreply.github.com>
Date: Tue, 13 Oct 2026 20:43:02 +0900
Subject: [PATCH] fix(kiro): accept the authorized status from the social
 device poll

The Kiro social device poll reports a completed grant as status
"authorized", but the poll branch only accepted "approved", so every
Google/GitHub device login ended as failed after browser approval and no
account was stored. Accept "authorized" and keep "approved" as an alias;
all other success checks are unchanged.

Assisted-by: Claude Opus 5.5 (Claude Code)
---
 src/oauth/kiro-device-login.ts                |  3 ++-
 .../providers/kiro/kiro-device-social.test.ts | 21 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/oauth/kiro-device-login.ts b/src/oauth/kiro-device-login.ts
index d57fc1dfbbf..9db5f28c296 100644
--- a/src/oauth/kiro-device-login.ts
+++ b/src/oauth/kiro-device-login.ts
@@ -250,9 +250,10 @@ async function poll(flow: Flow, principal: KiroDevicePrincipal): Promise<KiroDev
       if (data.status === "authorization_pending") return publicView(flow);
       if (data.status === "expired_token" || data.status === "expired") return terminal(flow, "expired");
     }
+    // The social poll reports a completed grant as status "authorized"; "approved" is kept as an alias.
     if (result.status !== 200 || Object.hasOwn(data, "error") || error || (builder && (data.status !== undefined || !positive(data.expiresIn) || !isStorableKiroClientPart(flow.clientId)
       || !isStorableKiroClientPart(flow.clientSecret)))
-      || (!builder && (data.status !== undefined && data.status !== "approved"))) return terminal(flow, "failed");
+      || (!builder && (data.status !== undefined && data.status !== "authorized" && data.status !== "approved"))) return terminal(flow, "failed");
     if (!code(data.accessToken) || !code(data.refreshToken)
       || (!builder && (typeof data.profileArn !== "string" || !PROFILE_ARN.test(data.profileArn)))) return terminal(flow, "failed");
     const credential: OAuthCredentials = {
diff --git a/tests/providers/kiro/kiro-device-social.test.ts b/tests/providers/kiro/kiro-device-social.test.ts
index de76006066a..b035ae92fb0 100644
--- a/tests/providers/kiro/kiro-device-social.test.ts
+++ b/tests/providers/kiro/kiro-device-social.test.ts
@@ -32,6 +32,27 @@ describe("Kiro social device grant", () => {
     expect(JSON.stringify(done)).not.toMatch(/private-access|private-refresh|private-device/);
   });
 
+  test("accepts the authorized status the social poll returns after a pending reply", async () => {
+    fixture = kiroDeviceFixture();
+    const polls = [
+      { status: "authorization_pending", accessToken: null, refreshToken: null, profileArn: null },
+      { status: "authorized", identityProvider: "Google", accessToken: "private-access", refreshToken: "private-refresh", profileArn },
+    ];
+    fixture.setPost(async url => url.endsWith("/authorization") ? response(socialAuthorization) : response(polls.shift()!));
+    const start = await startKiroDeviceLogin("google", "admin-token");
+    fixture.advance(5_000);
+    expect((await statusKiroDeviceLogin(start.flowId, "admin-token"))?.state).toBe("pending");
+    expect(getAccountSet("kiro")).toBeNull();
+    fixture.advance(5_000);
+    const done = await statusKiroDeviceLogin(start.flowId, "admin-token");
+    expect(done?.state).toBe("done");
+    expect(polls).toHaveLength(0);
+    const account = getAccountSet("kiro")?.accounts[0];
+    expect(account?.credential.refresh).toBe("private-refresh");
+    expect(account?.credential.kiro?.profileArn).toBe(profileArn);
+    expect(JSON.stringify(done)).not.toMatch(/private-access|private-refresh|private-device/);
+  });
+
   test("unknown approval status or malformed profile persists nothing", async () => {
     for (const approval of [
       { status: "strange", accessToken: "a", refreshToken: "r", profileArn },