fix(kiro): accept authorized social device grants and quarantine desktop Bad credentials (#7053, #7054)

[lidge-jun]

Summary

Carries the two Kiro authentication fixes from @Veritas-7 onto an upstream branch so the repository CI runs them. Each is a separate commit with a Co-authored-by trailer. This PR originally carried five PRs. The three non-auth ones (#7055, #7056, #6925) already landed through #7065, and dev is merged in, so the diff is now only the Kiro changes.

• fix(kiro): accept the authorized status from the social device poll #7053: native Kiro social device login (--method google|github) succeeds when the poll returns status: "authorized", which is what the endpoint actually sends. Before this, every approved login ended as failed. "approved" is kept as an alias, and every other success check still applies (HTTP 200, no error key, non-empty tokens, valid profileArn).
• fix(kiro): treat desktop refresh "Bad credentials" as a terminal grant refusal #7054: on the desktop refresh endpoint only, HTTP 401 with exactly {"message":"Bad credentials"} counts as a terminal grant refusal and is reported under the fixed code bad_credentials, so the existing generation-fenced quarantine marks that account needsReauth. Any other status/message pair and the AWS SSO OIDC endpoint keep their current behavior.

Carries #7053, #7054.

Co-authored-by: Veritas-7 (trailer on each commit)

Verification

• Before the dev merge, exact-head CI on 12f8ef22e passed every required check.
• After the dev merge, bun test on the Kiro refresh-attention and kiro provider tests passes locally. CI reruns on the new head.

Checklist

• Targets dev
• Focused regression tests
• Docs and structure updated
• Security review (authentication and credential handling, MAINTAINERS.md): pending, HOLD

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2b19fc31-7b56-413b-9749-64b8de9d9681

📥 Commits

Reviewing files that changed from the base of the PR and between 1edd55a and f58b9f8.

📒 Files selected for processing (7)

• docs-site/src/content/docs/guides/providers.md
• src/oauth/kiro-device-login.ts
• src/oauth/kiro.ts
• structure/providers-and-adapters.md
• structure/providers/kiro.md
• tests/oauth/oauth-kiro-refresh-attention.test.ts
• tests/providers/kiro/kiro-device-social.test.ts

 _______________________________________
< Feature flags up; bug sightings down. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

HOLD: security review required. Both commits change Kiro authentication and credential handling (device-login success and refresh-failure quarantine). MAINTAINERS.md requires explicit security review for that, so this is not being merged under the maintainer integration exception. Both changes are narrow and exact-match, the upstream evidence is in #7053 and #7054, and the tests pass. Main reviewer question: should a desktop-endpoint 401 "Bad credentials" quarantine the account immediately, or only after a second confirming refresh?

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T16:33:28.298403Z	f58b9f8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.