feat(kiro): bulk refresh-token import + thinking/agentic variants

[aminfathullah]

Summary

Two related improvements to the Kiro provider, plus a small CLI build fix that fell out of testing.

1. Bulk refresh-token import

POST /api/oauth/kiro/import now accepts many tokens at once. The legacy single-token shape (and its connection response field) is preserved.

{ "refreshToken": "aorAAAAAG..." }                              // legacy
{ "refreshTokens": ["aorAAAAAG-1", "aorAAAAAG-2"] }             // new — array
{ "refreshTokens": "aorAAAAAG-1\naorAAAAAG-2 aorAAAAAG-3" }     // new — split on whitespace/comma/semicolon

Each token is validated and persisted in parallel; per-token results return as { imported: [...], failed: [...] }. Status is 200 if any succeed, 422 otherwise.

GET /api/oauth/kiro/auto-import?all=1 walks every ~/.aws/sso/cache/*.json, sorted with kiro-auth-token.json first and deduplicated by token.

KiroAuthModal swaps the single Input for a textarea with a live token count, calls ?all=1 for autodetect, and renders an imported/failed summary.

2. Thinking / agentic model variants

Added -thinking, -agentic, and -thinking-agentic synthetic model IDs for every Kiro base model (claude-sonnet-4.5, claude-haiku-4.5, deepseek-3.2, qwen3-coder-next, glm-5, MiniMax-M2.5) in both web (open-sse/config/providerModels.js) and CLI (cli/src/cli/menus/providers.js).

Suffixes are stripped before the upstream request leaves the process and inject Kiro's standard system-prompt sentinels.

3. Inline-thinking emission (Claude on Kiro)

Live testing surfaced that Claude on Kiro emits reasoning inline as <thinking>...</thinking> inside assistantResponseEvent.content, not as separate reasoningContentEvent frames. The new open-sse/executors/kiroThinking.js is a stream-safe state-machine splitter that holds back up to 11 trailing chars of a potential partial tag across SSE chunks, so tags split across slices are joined correctly. Only engaged when the request contains <system-reminder>thinking</system-reminder>; non-thinking flows are untouched.

4. CLI build fix (separate commit)

Next.js 16 with workspace tracing root writes the standalone bundle one level deep (.next/standalone/9router/server.js) instead of at the top. build-cli.js now probes all three layouts (flat, nested-by-workspace-folder, legacy nested-app) so the same script keeps working across Next upgrades.

Tests

• 13 tests for the inline-thinking splitter (cross-chunk splits, char-by-char streaming, leftover flush, partial-tag holdback, false-positive tag-shaped text)
• 16 tests for the import helpers (legacy/array/string shapes, mixed separators, dedupe, trim, malformed payloads, mask format)
• 29/29 new tests pass; ESLint clean across all modified files

$ vitest run unit/kiro.thinking-splitter.test.js unit/kiroImport.helpers.test.js
 ✓ unit/kiro.thinking-splitter.test.js (13 tests)
 ✓ unit/kiroImport.helpers.test.js     (16 tests)
 Test Files  2 passed (2)
      Tests  29 passed (29)

Pre-existing failures in unit/rtk.test.js and unit/oauth-cursor-auto-import.test.js are unrelated to this work and exist on master at v0.4.55.

Commits

1. feat(kiro): bulk refresh-token import + thinking/agentic model variants
2. fix(cli): detect Next.js 16 standalone layout under workspace folder