- Restrict the /authorize postMessage and the modal listener to the loopback
origin pair (localhost + 127.0.0.1) instead of "*"/single-origin. The dashboard
runs on localhost while Trae forces the callback onto 127.0.0.1, so a single
window.location.origin target silently dropped the success message (popup never
closed). Addresses CWE-359 without breaking the cross-loopback flow.
- TraeExecutor: cancel the SSE reader on completion, abort upfront when the caller
signal is already aborted, and accept string elements in array message content.
- Move ad-hoc dev scripts to scripts/ad-hoc/ per the repo style guide.
Full SOLO remote-agent integration against solo.trae.ai's reverse-engineered
API (upgrades the previous import_token stub).
- open-sse/executors/trae.ts: streaming executor for the solo_agent_remote API
(POST /chat_sessions + GET /events SSE -> OpenAI chat.completions), accumulating
plan_item thoughts and mapping token_usage. Headless Cloud-IDE-JWT refresh via
the ExchangeToken endpoint.
- Session mode via model id: `trae/work` runs the fast work-mode auto agent;
`trae/auto` and named models (gpt-5.4, kimi-k2.5, gemini-3.1-pro, ...) run in
code mode.
- Provider registry entry (models + 272k context) and executor wiring.
- Two credential paths: browser /authorize loopback callback (captures the JWT +
long-lived refresh token) and manual Cloud-IDE-JWT paste via
POST /api/oauth/trae/import (Zod-validated).
- TraeAuthModal dashboard UI wired into the provider detail page.
- mapTokens/providerSpecificData carry the SOLO common_params identity fields.
- Tests: executor (stream/non-stream/error/refresh/work-mode + callback parser)
and updated oauth-trae provider tests.
