fix(providers): refresh Trae's stale Referer/Origin and forward user timezone (#12190) (#13255)

Merged as part of the owner batch of 2026-09-11.

This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`.

- ESLint over every changed file: no errors
- `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK
- complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437
- 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied.
- `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch.

⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.

src/app/api/oauth/trae/import/route.ts

@@ -20,6 +20,8 @@ import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
  *   scope          — optional, default "marscode-us"
  *   tenant         — optional, default "marscode"
  *   region         — optional, default "US-East"
+ *   userRegion     — optional, default "US" (x-user-region header; real value for non-US accounts)
+ *   userTimezone   — optional, forwarded as x-trae-user-timezone when present
  */
 async function requireOAuthImportAuth(request: Request) {
   // GHSA-mg76: importing a provider connection is a state-mutating admin action;
@@ -51,7 +53,17 @@ export async function POST(request: Request) {
     if (isValidationFailure(validation)) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
     }
-    const { accessToken, webId, bizUserId, userUniqueId, scope, tenant, region } = validation.data;
+    const {
+      accessToken,
+      webId,
+      bizUserId,
+      userUniqueId,
+      scope,
+      tenant,
+      region,
+      userRegion,
+      userTimezone,
+    } = validation.data;
 
     const connection: any = await createProviderConnection({
       provider: "trae",
@@ -71,7 +83,12 @@ export async function POST(request: Request) {
         aiRegion: region || "US-East",
         appLanguage: "en",
         appVersion: "1.0.0.1229",
-        userRegion: "US",
+        // "US" stays the best-effort default so existing imports that omit
+        // userRegion keep behaving as before; a real account region (e.g.
+        // "SG") must be user-supplied — it is not a universal replacement
+        // default (#12190).
+        userRegion: userRegion || "US",
+        ...(userTimezone ? { userTimezone } : {}),
         userIdentity: "Free",
         authMethod: "imported",
       },
@@ -125,6 +142,18 @@ export async function GET(request: Request) {
       { name: "scope", label: "Scope", description: "default: marscode-us", type: "text" },
       { name: "tenant", label: "Tenant", description: "default: marscode", type: "text" },
       { name: "region", label: "Region", description: "default: US-East", type: "text" },
+      {
+        name: "userRegion",
+        label: "User Region",
+        description: "x-user-region header, e.g. 'SG'. default: US",
+        type: "text",
+      },
+      {
+        name: "userTimezone",
+        label: "User Timezone",
+        description: "x-trae-user-timezone header, e.g. 'America/Recife'. optional",
+        type: "text",
+      },
     ],
   });
 }

src/app/authorize/parseCallback.ts

@@ -29,6 +29,8 @@ export type ParsedTraeCallback = {
       clientId: string;
       refreshExpireAt: number | null;
       authMethod: "oauth_callback";
+      userRegion?: string;
+      userTimezone?: string;
     };
     testStatus: "active";
   };
@@ -65,6 +67,13 @@ export function parseTraeCallbackQuery(q: URLSearchParams): ParsedTraeCallback |
 
   const userId = (info.UserID as string) || "";
   const region = (info.Region as string) || "US-East";
+  // Best-effort: the /authorize callback's userInfo payload has not been
+  // observed to carry a distinct x-user-region/timezone value distinct from
+  // Region — if Trae ever adds one under these names it propagates
+  // automatically; otherwise buildHeaders() falls back to "US"/no timezone
+  // header exactly as it does today (#12190).
+  const userRegion = (info.UserRegion as string) || undefined;
+  const userTimezone = (info.Timezone as string) || undefined;
 
   return {
     ok: true,
@@ -90,6 +99,8 @@ export function parseTraeCallbackQuery(q: URLSearchParams): ParsedTraeCallback |
         clientId: (userJwt.ClientID as string) || "en1oxy7wnw8j9n",
         refreshExpireAt: refreshExpiresAtMs || null,
         authMethod: "oauth_callback",
+        ...(userRegion ? { userRegion } : {}),
+        ...(userTimezone ? { userTimezone } : {}),
       },
       testStatus: "active",
     },

src/lib/oauth/providers/trae.ts

@@ -42,6 +42,8 @@ type TraeRawTokens = {
   app_version?: string;
   userRegion?: string;
   user_region?: string;
+  userTimezone?: string;
+  user_timezone?: string;
   userIdentity?: string;
   user_identity?: string;
 };
@@ -69,6 +71,7 @@ export const trae = {
       appLanguage: tokens.appLanguage || tokens.app_language || "en",
       appVersion: tokens.appVersion || tokens.app_version || "1.0.0.1229",
       userRegion: tokens.userRegion || tokens.user_region || "US",
+      userTimezone: tokens.userTimezone || tokens.user_timezone || undefined,
       userIdentity: tokens.userIdentity || tokens.user_identity || "Free",
       // Preserved for callers that key off a machine id (e.g. the IDE flow).
       machineId: tokens.machineId,

src/shared/validation/schemas/auth.ts

@@ -183,6 +183,11 @@ export const traeImportSchema = z.object({
   scope: z.string().trim().optional(),
   tenant: z.string().trim().optional(),
   region: z.string().trim().optional(),
+  // Real account region (e.g. "SG") sent as the x-user-region header — the
+  // "US" default only works for US accounts and produces a 401 for others
+  // (#12190). Optional so existing imports keep behaving as before.
+  userRegion: z.string().trim().optional(),
+  userTimezone: z.string().trim().optional(),
 });
 
 export const kiroImportSchema = z.object({