- Restrict the /authorize postMessage and the modal listener to the loopback
origin pair (localhost + 127.0.0.1) instead of "*"/single-origin. The dashboard
runs on localhost while Trae forces the callback onto 127.0.0.1, so a single
window.location.origin target silently dropped the success message (popup never
closed). Addresses CWE-359 without breaking the cross-loopback flow.
- TraeExecutor: cancel the SSE reader on completion, abort upfront when the caller
signal is already aborted, and accept string elements in array message content.
- Move ad-hoc dev scripts to scripts/ad-hoc/ per the repo style guide.
