Kiro Account Manager

QQ Group: 653516618

A powerful multi-account management tool for Kiro IDE

Quick account switching, auto token refresh, group/tag management, machine ID management and more

English | 简体中文

---

✨ Features

🔐 Multi-Account Management

• Add, edit, and delete multiple Kiro accounts
• One-click quick account switching
• Support Builder ID, IAM Identity Center (SSO) and Social (Google/GitHub) login methods
• Batch import/export account data

🔄 Auto Refresh

• Auto refresh tokens before expiration
• Auto update account usage and subscription info after refresh
• Periodically check all account balances when auto-switch is enabled

📁 Groups & Tags

• Flexibly organize accounts with groups and tags
• Batch set groups/tags for multiple accounts
• One account can only belong to one group, but can have multiple tags

🔑 Machine ID Management

• Modify device identifier to prevent account association bans
• Auto switch machine ID when switching accounts
• Assign unique bound machine ID to each account
• Backup and restore original machine ID

🔄 Auto Account Switch

• Auto switch to available account when balance is low
• Configurable balance threshold and check interval

🎨 Personalization

• 21 theme colors available (grouped by color family)
• Dark/Light mode toggle
• Privacy mode to hide sensitive information

🌐 Proxy Support

• Support HTTP/HTTPS/SOCKS5 proxy
• All network requests through proxy server

🔄 Auto Update Detection

• Auto detect latest version from GitHub
• Show update content and download file list
• One-click to download page

---

📸 Screenshots

Home

Shows account statistics, current account details, subscription info and quota breakdown.

Account Management

Manage all accounts, search, filter, batch operations, one-click switch.

Machine ID Management

Manage device identifier, prevent account association bans, backup and restore.

Settings

Configure theme colors, privacy mode, auto refresh, proxy and more.

API Proxy Service

Provides OpenAI and Claude compatible API endpoints with multi-account rotation, auto token refresh, request retry and more.

Kiro IDE Settings

Sync Kiro IDE settings, edit MCP servers, manage user rules (Steering).

About

View version info, feature list, tech stack and author info.

---

📥 Installation

Windows

Simply run the .exe installer.

macOS

Since the app is not code-signed by Apple, macOS will show "damaged and can't be opened" on first launch. Please follow these steps:

Method 1: Terminal Command (Recommended)

xattr -cr /Applications/Kiro\ Account\ Manager.app

Method 2: Right-click Open 1. Find the app in Finder 2. Hold Control and click the app (or right-click) 3. Select "Open" 4. Click "Open" in the dialog

Linux

• AppImage: Add execute permission and run directly bash chmod +x kiro-account-manager-*.AppImage ./kiro-account-manager-*.AppImage
• deb: Install with dpkg -i
• snap: Install with snap install

---

📖 Usage Guide

Add Account

1. Click "Account Management" to enter account list page
2. Click "+ Add Account" button in the top right
3. Enter SSO Token or OIDC credentials
4. Click confirm to complete

Switch Account

1. Find the target account in Account Management page
2. Click the power icon on the account card to switch
3. Kiro IDE will use the new account after switching

Batch Set Groups/Tags

1. Select multiple accounts in Account Management page
2. Click "Group" or "Tag" button
3. Select groups/tags to add or remove in the dropdown menu

Machine ID Management

1. Click "Machine ID" on the left sidebar
2. Original machine ID will be auto backed up on first use
3. Click "Generate Random & Apply" to change machine ID
4. Click "Restore Original" to restore if needed

⚠️ Note: Modifying machine ID requires admin privileges, please run the app as administrator

Import/Export

• Export: Settings → Data Management → Export, supports JSON, TXT, CSV, Clipboard formats
• Import: Settings → Data Management → Import, restore account data from JSON file

---

🛠️ Tech Stack

• Framework: Electron + React + TypeScript
• State Management: Zustand
• Styling: Tailwind CSS
• Build Tool: Vite
• Icons: Lucide React

---

💻 Development Guide

Requirements

• Node.js >= 18
• npm >= 9

Install Dependencies

npm install

Development Mode

npm run dev

Build Application

# Windows
npm run build:win

# macOS
npm run build:mac

# Linux
npm run build:linux

Build Multi-Architecture

# Windows 64-bit
npx electron-builder --win --x64

# Windows 32-bit
npx electron-builder --win --ia32

# Windows ARM64
npx electron-builder --win --arm64

# macOS Intel
npx electron-builder --mac --x64

# macOS Apple Silicon
npx electron-builder --mac --arm64

# Linux 64-bit
npx electron-builder --linux --x64

# Linux ARM64
npx electron-builder --linux --arm64

---

🚀 Auto Build (GitHub Actions)

The project is configured with GitHub Actions workflow for auto building all platforms and architectures:

Supported Platforms

Platform	Architecture	Format
Windows	x64, ia32, arm64	exe, zip
macOS	x64, arm64	dmg, zip
Linux	x64, arm64, armv7l	AppImage, deb, snap

Trigger Methods

1. Push Tag: Auto build and release when pushing v* format tags bash git tag v1.1.0 git push origin v1.1.0

2. Manual Trigger: Manually run workflow in GitHub Actions page

---

📋 Changelog

v1.7.5 (2026-6-7) — Thinking Mode + Enterprise profileArn Full Fix + Agent Mode & Steering + Tool Use Leak Fix

🧠 Thinking Mode Support (Claude 4.6+)

• New: Full thinking/extended thinking support for Claude 4.6+ models — automatically reads additionalModelRequestFieldsSchema from ListAvailableModels response to detect thinking capability
• New: Maps OpenAI thinking: {type, budget_tokens} and reasoning_effort to Kiro's additionalModelRequestFields (supports both output_config and reasoning schema paths)
• New: Maps Claude /v1/messages thinking: {type:"enabled", budget_tokens} to corresponding effort levels (low/medium/high/xhigh)
• New: Streaming reasoning content output — reasoning_content field in OpenAI format, thinking content blocks in Claude format
• New: THINKING_SIGNATURE_INVALID error auto-retry — strips reasoningContent from history and retries (signature invalidation due to model updates)

🔐 Enterprise Account profileArn Full Fix

• Fix: Enterprise (IdC) accounts now correctly fetch real profileArn via POST codewhisperer.{region}.amazonaws.com/ListAvailableProfiles
• Fix: Enterprise accounts forced to use CodeWhisperer endpoint (AmazonQ endpoint returns 400/403 for Enterprise IdC tokens)
• New: Self-healing profileArn — all account types (BuilderId/Github/Google/Enterprise) attempt auto-fetch on first request; fetched ARN is persisted to disk via IPC callback, never re-fetched
• New: Fallback ARN for Enterprise — region-aware arn:aws:codewhisperer:{region}:610548660232:profile/VNECVYCYYAWN used when auto-fetch fails
• New: setProfileArnPersistCallback module-level callback — self-healed profileArn writes back to account pool + renderer store + memory snapshot
• New: onProxyAccountUpdate IPC event — renderer listens and persists profileArn to both top-level and credentials.profileArn
• Fix: Sync field mismatch — ProxyPanel and lazy-sync now read acc.profileArn || acc.credentials?.profileArn
• Fix: refresh-account-token and verify-account-credentials now auto-fetch profileArn for ALL account types (not just Enterprise)
• Fix: refreshAccountToken store action now saves returned profileArn to both top-level and credentials

🔧 Tool Use XML Leak Fix

• Fix: Kiro backend occasionally sends <tool_use id="...">...</tool_use> XML as text content (in assistantResponseEvent / codeEvent) alongside structured toolUseEvent — these are now stripped from text output, preventing raw XML tags from appearing in client responses

🎛️ Agent Mode & Steering Support

• New: Agent Mode selector in proxy panel — switch between Vibe (chat first, then build) and Spec (plan first, then build); controls x-amzn-kiro-agent-mode header sent to Kiro backend
• New: Workspace Path configuration — set a local workspace path to load .kiro/steering/*.md rule files
• New: Steering file injection — always-type steering documents are automatically injected into every request's system prompt (supports YAML frontmatter with inclusion: always/fileMatch/manual)
• New: Context Usage breakdown parsing — captures ContextUsageEvent breakdown (Conversation / MCP tools / Steering files) from Kiro backend stream responses
• New: steeringLoader.ts module — reads, parses frontmatter, and formats steering files for prompt injection

🔧 Enterprise Switch-to-IDE Fix

• Fix: resolveProfileArnForWrite returned BuilderId placeholder ARN for Enterprise accounts when switching to IDE — IDE then used this invalid ARN causing "Invalid token" error. Now returns region-aware Enterprise fallback ARN
• Fix: All 5 call sites of resolveProfileArnForWrite now pass region parameter for correct Enterprise ARN generation

🗑️ Subscription: Delete Failed Accounts

• New: "Delete accounts" checkbox next to "Remove Failed" button in batch subscription link view — when checked, removing failed/expired links also permanently deletes the corresponding accounts (for banned account cleanup)
• New: Button turns red when checkbox is active; confirmation dialog warns about permanent account deletion

⚡ Payload Size Limit

• Change: Default payload size limit increased from 1.5MB to 150MB (153600 KB) to support large image attachments; max configurable limit raised to 200MB

---

v1.7.4 (2026-6-5) — profileArn Refined Strategy + CI Fix + Log Redaction Fix + Registration Anti-Hang

🛡️ profileArn Strategy Refinement

• Fix: Restored resolveProfileArnForWrite to return placeholder ARN for BuilderId — Kiro IDE internal logic depends on this field existing; removing it caused IDE malfunction
• Fix: Non-streaming API endpoints (ListAvailableModels, ListAvailableSubscriptions, CreateSubscriptionToken, setUserPreference) now send placeholder ARN again (AWS 400 "profileArn must not be null")
• Fix: Streaming endpoints (generateAssistantResponse / SendMessageStreaming) still do NOT send placeholder ARN (causes 403)
• Fix: Disabled migrateAccountDataIfNeeded cleanup of placeholder ARNs from account data

🔧 GitHub Actions CI Fix

• Fix: softprops/action-gh-release@v1 uploading duplicate filenames causing 404 — replaced with find + cp flatten-and-dedup to release-assets/ directory before upload
• New: Added yaml-language-server schema declaration to suppress IDE YAML lint false-positives

📝 Log Redaction Fix

• Fix: inputTokens, outputTokens, cacheReadTokens, reasoningTokens and other metric fields were incorrectly redacted as *** — removed overly broad 'token' matching rule, added SAFE_KEYS whitelist

🐛 Registration Fixes

• Fix: Registrar.destroy() did not call abort(), causing destroyed registrars to continue executing async steps (e.g. sending OTP), leading to "no registration in progress" error when submitting verification code
• Fix: Outlook IMAP readLine() had no timeout — when the server stalls mid-stream (network jitter / throttling / half-closed connection), the Promise hung forever, causing the mail-polling step to deadlock. Added 30s timeout with auto-reconnect on next retry

💎 Proxy Panel UX

• Fix: "Preferred Endpoint" dropdown obscured by the "Security & Observability" card below (z-index stacking context fix)
• Improvement: Entering the proxy panel no longer triggers a full account sync on every mount; sync only fires when accounts actually change

---

v1.7.3 (2026-6-4) — Kiro IDE Token Bidirectional Sync + BuilderId Placeholder ARN Full Closure + Proactive Renewal + macOS Auto-Update Fix

This release focuses on the core failure "after switching accounts / refreshing tokens in this app, Kiro IDE desktop gets force-logged-out ~1 hour later", closes the chain of bugs where BuilderId accounts still got written placeholder profileArn in multiple paths, adds an optional IDE Token proactive-renewal capability (off by default), fixes macOS auto-update 404, and ships a Kiro IDE binary patcher script plus several UI tweaks.

🔥 Core Fix: Kiro IDE Token Bidirectional Sync (resolves "force-logout ~1h after switching")

• Fix: 🔥 switch-account wrote the already-rotated/invalidated old refreshToken to disk — the old code only updated the local variable accessToken after calling OIDC for access_v2 + refresh_v2, but the refreshToken written into ~/.aws/sso/cache/kiro-auth-token.json wa