Claude-coauthored code put an unvalidated region into an upstream hostname, letting an authenticated caller send a Kiro API key to an attacker-controlled server.

+   * Accepts both `arn` and `profileArn` response field names (the API-key+   * JSON-1.0 surface returns `arn`).+   */+  async listAvailableProfiles(accessToken, region = "us-east-1") {+    const endpoint = `https://codewhisperer.${region}.amazonaws.com`;++    const response = await fetch(endpoint, {+      method: "POST",+      headers: {+        "Content-Type": "application/x-amz-json-1.0",+        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",+        "Authorization": `Bearer ${accessToken}`,+        "Accept": "application/json",+      },+      body: JSON.stringify({ maxResults: 10 }),+    });++    if (!response.ok) {+      const error = await response.text();+      throw new Error(`Failed to list profiles: ${error}`);+    }++    const data = await response.json();+    const profiles = Array.isArray(data?.profiles) ? data.profiles : [];+    const arnOf = (p) => p?.arn || p?.profileArn || null;+    const match = profiles.find((p) => arnOf(p)?.split(":")[3] === region) || profiles[0];+    return arnOf(match);+  }++  /**+   * Validate an API-key credential by listing profiles with it. API keys are+   * long-lived bearer tokens (no refresh), so the only way to validate one is+   * to make an authenticated CodeWhisperer call. Returns a credential object+   * ready to persist as a "kiro" connection with authMethod="api_key".+   */+  async validateApiKey(apiKey, region = "us-east-1") {+    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {+      throw new Error("API key is required");+    }+    const trimmed = apiKey.trim();++    let profileArn = null;+    try {+      profileArn = await this.listAvailableProfiles(trimmed, region);+    } catch (error) {+      throw new Error(`API key validation failed: ${error.message}`);+    }++    return {+      accessToken: trimmed,+      refreshToken: null,+      profileArn,+      region,+      authMethod: "api_key",+    };+  }+   /**    * List available models from CodeWhisperer API    */

+// google/github (social), imported (refresh-token paste), api_key (headless).+const KIRO_METHOD_LABELS = {+  "builder-id": "AWS Builder ID",+  idc: "IAM Identity Center",+  google: "Google",+  github: "GitHub",+  imported: "Imported Token",+  api_key: "API Key",+};++function kiroMethodLabel(conn) {+  const m = conn.providerSpecificData?.authMethod;+  if (m && KIRO_METHOD_LABELS[m]) return KIRO_METHOD_LABELS[m];+  return conn.authType === "api_key" ? "API Key" : "OAuth";+}++// Region is stored for builder-id/idc/api_key flows; social and imported flows+// omit it, so fall back to the region segment of the profileArn+// (arn:aws:codewhisperer:<region>:...).+function kiroRegion(conn) {+  const r = conn.providerSpecificData?.region;+  if (r) return r;+  const arn = conn.providerSpecificData?.profileArn;+  const seg = typeof arn === "string" ? arn.split(":")[3] : "";+  return seg || "";+}  function getCodexResetCreditCount(quota) {   const value = quota?.raw?.resetCredits?.availableCount;@@ -45,6 +75,7 @@ function getCodexResetCreditCount(quota) { }  export default function ProviderLimits() {+  const { copied, copy } = useCopyToClipboard();   const [connections, setConnections] = useState([]);   const [quotaData, setQuotaData] = useState({});   const [loading, setLoading] = useState({});@@ -892,6 +923,46 @@ export default function ProviderLimits() {                           Reset eligible: {resetCreditCount}                         </p>                       )}+                      {conn.provider === "kiro" && (+                        <div className="mt-1 flex flex-wrap items-center gap-1">+                          <span className="rounded-full bg-brand-500/10 px-2 py-0.5 text-[10px] font-semibold text-brand-600 dark:text-brand-300">+                            {kiroMethodLabel(conn)}+                          </span>+                          {kiroRegion(conn) && (+                            <span className="rounded-full bg-blue-500/10 px-2 py-0.5 text-[10px] font-semibold text-blue-600 dark:text-blue-400">+                              {kiroRegion(conn)}+                            </span>+                          )}+                          <span+                            className={`rounded-full px-2 py-0.5 text-[10px] font-semibold ${+                              isInactive+                                ? "bg-surface-2 text-text-muted"+                                : conn.testStatus === "active" || conn.testStatus === "success"+                                  ? "bg-green-500/10 text-green-600 dark:text-green-400"+                                  : conn.testStatus === "error" || conn.testStatus === "expired" || conn.testStatus === "unavailable"+                                    ? "bg-red-500/10 text-red-600 dark:text-red-400"+                                    : "bg-surface-2 text-text-muted"+                            }`}+                          >+                            {isInactive ? "disabled" : conn.testStatus || "unknown"}+                          </span>+                          {conn.providerSpecificData?.profileArn && (+                            <button+                              type="button"+                              onClick={() => copy(conn.providerSpecificData.profileArn, conn.id)}+                              title={conn.providerSpecificData.profileArn}+                              className="inline-flex max-w-full items-center gap-1 rounded-full border border-border-subtle px-2 py-0.5 text-[10px] text-text-muted transition-colors hover:text-primary"+                            >+                              <span className="material-symbols-outlined text-[12px]">+                                {copied === conn.id ? "check" : "content_copy"}+                              </span>+                              <code className="truncate font-mono">+                                {conn.providerSpecificData.profileArn}+                              </code>+                            </button>+                          )}+                        </div>+                      )}                     </div>

+/**+ * POST /api/oauth/kiro/api-key+ * Import a Kiro API key (headless auth). The key is a long-lived bearer+ * credential — there is no refresh token. It is validated by listing+ * CodeWhisperer profiles, then stored with authMethod="api_key".+ */+export async function POST(request) {+  try {+    const { apiKey, region } = await request.json();++    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {+      return NextResponse.json(+        { error: "API key is required" },+        { status: 400 }+      );+    }++    const kiroService = new KiroService();++    // Validate the key and resolve its profileArn via ListAvailableProfiles+    const credential = await kiroService.validateApiKey(+      apiKey,+      region || "us-east-1"+    );++    // Extract email from JWT if the key happens to be a JWT (optional display)+    const email = kiroService.extractEmailFromJWT(credential.accessToken);++    // API keys never expire on a fixed schedule; persist a long horizon so the+    // proactive refresh path (which requires a refreshToken anyway) is skipped.+    const connection = await createProviderConnection({+      provider: "kiro",+      authType: "api_key",+      accessToken: credential.accessToken,+      refreshToken: null,+      expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),+      email: email || null,+      providerSpecificData: {+        profileArn: credential.profileArn,+        region: credential.region,+        authMethod: "api_key",+        provider: "API Key",+      },+      testStatus: "active",+    });++    return NextResponse.json({+      success: true,+      connection: {+        id: connection.id,+        provider: connection.provider,+        email: connection.email,+      },+    });+  } catch (error) {+    console.log("Kiro API key import error:", error);+    return NextResponse.json({ error: error.message }, { status: 500 });+  }+}

+export function assertValidAwsRegion(region) {+  if (typeof region !== "string" || !AWS_REGION_PATTERN.test(region)) {+    throw new Error("Invalid region");+  }+  return region;+}+ // Cursor OAuth Configuration (Import Token from Cursor IDE) // tokenStoragePaths: user-reference only, not stored in registry export const CURSOR_CONFIG = {

@@ -792,6 +793,7 @@ const PROVIDERS = {     requestDeviceCode: async (config, codeChallenge, options = {}) => {       const trimmedRegion = typeof options.region === "string" ? options.region.trim() : "";       const region = trimmedRegion || "us-east-1";+      assertValidAwsRegion(region);       const trimmedStartUrl = typeof options.startUrl === "string" ? options.startUrl.trim() : "";       const startUrl = trimmedStartUrl || config.startUrl;       const authMethod = options.authMethod === "idc" ? "idc" : "builder-id";@@ -860,6 +862,7 @@ const PROVIDERS = {     },     pollToken: async (config, deviceCode, codeVerifier, extraData) => {       const region = extraData?._region || "us-east-1";+      assertValidAwsRegion(region);       const tokenUrl = `https://oidc.${region}.amazonaws.com/token`;       const response = await fetch(tokenUrl, {         method: "POST",

  * Kiro OAuth Service@@ -17,6 +17,7 @@ export class KiroService {    * Returns clientId and clientSecret for device code flow    */   async registerClient(region = "us-east-1") {+    assertValidAwsRegion(region);     const endpoint = `https://oidc.${region}.amazonaws.com/client/register`;      const response = await fetch(endpoint, {@@ -50,6 +51,7 @@ export class KiroService {    * Start device authorization for AWS Builder ID or IDC    */   async startDeviceAuthorization(clientId, clientSecret, startUrl, region = "us-east-1") {+    assertValidAwsRegion(region);     const endpoint = `https://oidc.${region}.amazonaws.com/device_authorization`;      const response = await fetch(endpoint, {@@ -84,6 +86,7 @@ export class KiroService {    * Poll for token using device code (AWS Builder ID/IDC)    */   async pollDeviceToken(clientId, clientSecret, deviceCode, region = "us-east-1") {+    assertValidAwsRegion(region);     const endpoint = `https://oidc.${region}.amazonaws.com/token`;      const response = await fetch(endpoint, {@@ -176,7 +179,9 @@ export class KiroService {      // AWS SSO OIDC refresh (Builder ID or IDC)     if (clientId && clientSecret) {-      const endpoint = `https://oidc.${region || "us-east-1"}.amazonaws.com/token`;+      const safeRegion = region || "us-east-1";+      assertValidAwsRegion(safeRegion);+      const endpoint = `https://oidc.${safeRegion}.amazonaws.com/token`;        const response = await fetch(endpoint, {         method: "POST",@@ -262,6 +267,7 @@ export class KiroService {    * JSON-1.0 surface returns `arn`).    */   async listAvailableProfiles(accessToken, region = "us-east-1") {+    assertValidAwsRegion(region);     const endpoint = `https://codewhisperer.${region}.amazonaws.com`;      const response = await fetch(endpoint, {