fix(dashboard): allow deleting the last extra-upstream-header row even when invalid (#12251)

.env.example

@@ -1175,11 +1175,6 @@ CODEX_OAUTH_CLIENT_ID=app_EMoamEEZ73f0CkXaXp7hrann
 # Trae OAuth token override. Used by: open-sse/executors/trae.ts.
 # TRAE_TOKEN=
 
-# Trae web client Origin/Referer override (fleet-wide bump if Trae moves hosts
-# again without a code change). Default: https://work.trae.ai.
-# Used by: open-sse/executors/trae.ts.
-# TRAE_WEB_ORIGIN=https://work.trae.ai
-
 # ── Gemini / Antigravity (Google-based) ──
 # These providers ship public OAuth client_id/secret values embedded in their
 # public CLIs. Defaults are baked into the code via

changelog.d/fixes/12190-trae-referer-401.md

@@ -1 +0,0 @@
-- fix(providers): refresh Trae's stale Referer/Origin and forward user timezone so imported connections stop failing with 401 (#12190)

changelog.d/fixes/12251-extra-upstream-headers-delete.md

@@ -0,0 +1 @@
+- fix(dashboard): allow deleting the last extra-upstream-header row even when invalid (#12251)

open-sse/executors/trae.ts

@@ -26,19 +26,6 @@ type ChatMessage = { role?: string; content?: unknown };
 
 const STREAM_TIMEOUT_MS = parseInt(process.env.TRAE_STREAM_TIMEOUT_MS || "300000", 10);
 
-// Trae's web client origin moved from solo.trae.ai to work.trae.ai (the SOLO
-// coding agent is now served under the TraeWork product surface); the backend
-// appears to validate Origin/Referer against the JWT session's real origin, so
-// a stale value here produces a clean 401 even with a fresh token (#12190).
-// Kept overridable — via env for a fleet-wide bump without a code change, and
-// per-connection via providerSpecificData.refererOrigin for an account that
-// still authenticates against the legacy host — rather than a second
-// hardcoded guess that would go stale the same way.
-const DEFAULT_TRAE_WEB_ORIGIN = (process.env.TRAE_WEB_ORIGIN || "https://work.trae.ai").replace(
-  /\/$/,
-  ""
-);
-
 function flattenQuery(messages: ChatMessage[]): string {
   const parts: string[] = [];
   for (const m of messages) {
@@ -74,17 +61,13 @@ export class TraeExecutor extends BaseExecutor {
   buildHeaders(credentials): Record<string, string> {
     const token = (credentials.accessToken as string) || "";
     const psd = (credentials.providerSpecificData as JsonRecord) || {};
-    const webOrigin = ((psd.refererOrigin as string) || DEFAULT_TRAE_WEB_ORIGIN).replace(/\/$/, "");
-    const timezone = psd.userTimezone as string | undefined;
     return {
       Authorization: `Cloud-IDE-JWT ${token}`,
       "Content-Type": "application/json",
       "X-Trae-Client-Type": "web",
       "X-Preferenced-Language": (psd.appLanguage as string) || "en",
       "x-user-region": (psd.userRegion as string) || "US",
-      Referer: `${webOrigin}/`,
-      Origin: webOrigin,
-      ...(timezone ? { "x-trae-user-timezone": timezone } : {}),
+      Referer: "https://solo.trae.ai/",
       "User-Agent":
         "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " +
         "(KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",

scripts/check/check-env-doc-sync.mjs

@@ -283,9 +283,6 @@ const ENV_ONLY_ALLOWLIST = new Set([
   "PII_WINDOW_SIZE",
   "TRAE_STREAM_TIMEOUT_MS",
   "TRAE_TOKEN",
-  // #12190: Trae host/Origin override. ENVIRONMENT.md documents no Trae variable at
-  // all; this joins its two siblings above under the same .env.example-only tier.
-  "TRAE_WEB_ORIGIN",
 ]);
 
 // ─── Parsing helpers ───────────────────────────────────────────────────────

src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx

@@ -707,7 +707,10 @@ export default function ModelCompatPopover({
                       </div>
                       <button
                         type="button"
-                        disabled={disabled || headerRows.length <= 1}
+                        disabled={
+                          disabled ||
+                          (headerRows.length <= 1 && !row.name.trim() && !row.value.trim())
+                        }
                         onClick={() => removeHeaderRow(row.id)}
                         title={t("compatUpstreamRemoveRow")}
                         className="flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border border-border/80 text-text-muted hover:bg-red-500/10 hover:text-red-600 dark:hover:text-red-400 disabled:opacity-30 disabled:hover:bg-transparent disabled:hover:text-text-muted transition-colors"

src/app/(dashboard)/dashboard/providers/[id]/components/__tests__/modelCompatPopover-12251-delete-invalid-header.test.tsx

@@ -0,0 +1,113 @@
+// @vitest-environment jsdom
+// Repro for #12251
+import React, { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import ModelCompatPopover from "../ModelCompatPopover";
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => (key: string) => key,
+}));
+
+let container: HTMLDivElement;
+let root: Root;
+
+async function flushEffects() {
+  await act(async () => {
+    await Promise.resolve();
+  });
+}
+
+async function openPopover() {
+  const trigger = container.querySelector("button") as HTMLButtonElement;
+  await act(async () => trigger.click());
+  await flushEffects();
+}
+
+describe("ModelCompatPopover upstream headers — invalid single row cannot be deleted (#12251)", () => {
+  beforeEach(() => {
+    (
+      globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+    ).IS_REACT_ACT_ENVIRONMENT = true;
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+
+  afterEach(() => {
+    act(() => root.unmount());
+    document.body.innerHTML = "";
+    vi.unstubAllGlobals();
+  });
+
+  it("lets the user delete the invalid header via the delete icon when it is the ONLY row present", async () => {
+    const onCompatPatch = vi.fn();
+
+    act(() => {
+      root.render(
+        <ModelCompatPopover
+          t={(key) => key}
+          providerId="openai"
+          modelId="gpt-test"
+          effectiveModelNormalize={() => false}
+          effectiveModelPreserveDeveloper={() => true}
+          getUpstreamHeadersRecord={() => ({
+            "https://evil.example.com/callback": "some-secret-value",
+          })}
+          onCompatPatch={onCompatPatch}
+        />
+      );
+    });
+
+    await openPopover();
+
+    const nameInput = document.querySelector(
+      'input[placeholder="compatUpstreamHeaderNamePlaceholder"]'
+    ) as HTMLInputElement;
+    expect(nameInput).toBeTruthy();
+    expect(nameInput.value).toBe("https://evil.example.com/callback");
+
+    const rowButtons = document.querySelectorAll('button[title="compatUpstreamRemoveRow"]');
+    expect(rowButtons.length).toBe(1);
+
+    const removeButton = rowButtons[0] as HTMLButtonElement;
+
+    // EXPECTED (fixed) behavior: a populated row should always be removable via
+    // its own delete icon, even when it is the only row.
+    expect(removeButton.disabled).toBe(false);
+
+    await act(async () => removeButton.click());
+    await flushEffects();
+
+    expect(onCompatPatch).toHaveBeenCalledWith("openai", { upstreamHeaders: {} });
+  });
+
+  it("keeps the delete button disabled when the sole row is genuinely blank", async () => {
+    const onCompatPatch = vi.fn();
+
+    act(() => {
+      root.render(
+        <ModelCompatPopover
+          t={(key) => key}
+          providerId="openai"
+          modelId="gpt-test"
+          effectiveModelNormalize={() => false}
+          effectiveModelPreserveDeveloper={() => true}
+          getUpstreamHeadersRecord={() => ({})}
+          onCompatPatch={onCompatPatch}
+        />
+      );
+    });
+
+    await openPopover();
+
+    const rowButtons = document.querySelectorAll('button[title="compatUpstreamRemoveRow"]');
+    expect(rowButtons.length).toBe(1);
+
+    const removeButton = rowButtons[0] as HTMLButtonElement;
+
+    // A blank sole row must stay non-deletable so the form always shows an
+    // editable add-affordance.
+    expect(removeButton.disabled).toBe(true);
+  });
+});

src/app/api/oauth/trae/import/route.ts

@@ -20,8 +20,6 @@ import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
  *   scope          — optional, default "marscode-us"
  *   tenant         — optional, default "marscode"
  *   region         — optional, default "US-East"
- *   userRegion     — optional, default "US" (x-user-region header; real value for non-US accounts)
- *   userTimezone   — optional, forwarded as x-trae-user-timezone when present
  */
 async function requireOAuthImportAuth(request: Request) {
   // GHSA-mg76: importing a provider connection is a state-mutating admin action;
@@ -53,17 +51,7 @@ export async function POST(request: Request) {
     if (isValidationFailure(validation)) {
       return NextResponse.json({ error: validation.error }, { status: 400 });
     }
-    const {
-      accessToken,
-      webId,
-      bizUserId,
-      userUniqueId,
-      scope,
-      tenant,
-      region,
-      userRegion,
-      userTimezone,
-    } = validation.data;
+    const { accessToken, webId, bizUserId, userUniqueId, scope, tenant, region } = validation.data;
 
     const connection: any = await createProviderConnection({
       provider: "trae",
@@ -83,12 +71,7 @@ export async function POST(request: Request) {
         aiRegion: region || "US-East",
         appLanguage: "en",
         appVersion: "1.0.0.1229",
-        // "US" stays the best-effort default so existing imports that omit
-        // userRegion keep behaving as before; a real account region (e.g.
-        // "SG") must be user-supplied — it is not a universal replacement
-        // default (#12190).
-        userRegion: userRegion || "US",
-        ...(userTimezone ? { userTimezone } : {}),
+        userRegion: "US",
         userIdentity: "Free",
         authMethod: "imported",
       },
@@ -142,18 +125,6 @@ export async function GET(request: Request) {
       { name: "scope", label: "Scope", description: "default: marscode-us", type: "text" },
       { name: "tenant", label: "Tenant", description: "default: marscode", type: "text" },
       { name: "region", label: "Region", description: "default: US-East", type: "text" },
-      {
-        name: "userRegion",
-        label: "User Region",
-        description: "x-user-region header, e.g. 'SG'. default: US",
-        type: "text",
-      },
-      {
-        name: "userTimezone",
-        label: "User Timezone",
-        description: "x-trae-user-timezone header, e.g. 'America/Recife'. optional",
-        type: "text",
-      },
     ],
   });
 }

src/app/authorize/parseCallback.ts

@@ -29,8 +29,6 @@ export type ParsedTraeCallback = {
       clientId: string;
       refreshExpireAt: number | null;
       authMethod: "oauth_callback";
-      userRegion?: string;
-      userTimezone?: string;
     };
     testStatus: "active";
   };
@@ -67,13 +65,6 @@ export function parseTraeCallbackQuery(q: URLSearchParams): ParsedTraeCallback |
 
   const userId = (info.UserID as string) || "";
   const region = (info.Region as string) || "US-East";
-  // Best-effort: the /authorize callback's userInfo payload has not been
-  // observed to carry a distinct x-user-region/timezone value distinct from
-  // Region — if Trae ever adds one under these names it propagates
-  // automatically; otherwise buildHeaders() falls back to "US"/no timezone
-  // header exactly as it does today (#12190).
-  const userRegion = (info.UserRegion as string) || undefined;
-  const userTimezone = (info.Timezone as string) || undefined;
 
   return {
     ok: true,
@@ -99,8 +90,6 @@ export function parseTraeCallbackQuery(q: URLSearchParams): ParsedTraeCallback |
         clientId: (userJwt.ClientID as string) || "en1oxy7wnw8j9n",
         refreshExpireAt: refreshExpiresAtMs || null,
         authMethod: "oauth_callback",
-        ...(userRegion ? { userRegion } : {}),
-        ...(userTimezone ? { userTimezone } : {}),
       },
       testStatus: "active",
     },

src/lib/oauth/providers/trae.ts

@@ -42,8 +42,6 @@ type TraeRawTokens = {
   app_version?: string;
   userRegion?: string;
   user_region?: string;
-  userTimezone?: string;
-  user_timezone?: string;
   userIdentity?: string;
   user_identity?: string;
 };
@@ -71,7 +69,6 @@ export const trae = {
       appLanguage: tokens.appLanguage || tokens.app_language || "en",
       appVersion: tokens.appVersion || tokens.app_version || "1.0.0.1229",
       userRegion: tokens.userRegion || tokens.user_region || "US",
-      userTimezone: tokens.userTimezone || tokens.user_timezone || undefined,
       userIdentity: tokens.userIdentity || tokens.user_identity || "Free",
       // Preserved for callers that key off a machine id (e.g. the IDE flow).
       machineId: tokens.machineId,

src/shared/validation/schemas/auth.ts

@@ -183,11 +183,6 @@ export const traeImportSchema = z.object({
   scope: z.string().trim().optional(),
   tenant: z.string().trim().optional(),
   region: z.string().trim().optional(),
-  // Real account region (e.g. "SG") sent as the x-user-region header — the
-  // "US" default only works for US accounts and produces a 401 for others
-  // (#12190). Optional so existing imports keep behaving as before.
-  userRegion: z.string().trim().optional(),
-  userTimezone: z.string().trim().optional(),
 });
 
 export const kiroImportSchema = z.object({

tests/unit/trae-headers-12190.test.ts

@@ -1,80 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-// Import the executor directly (not via executors/index.ts) — index pulls in
-// the entire provider registry and DB layer which is slow and unnecessary for
-// the unit-level behavior we want to exercise here.
-const { TraeExecutor } = await import("../../open-sse/executors/trae.ts");
-
-const CREDS = {
-  accessToken: "JWT.test.token",
-  providerSpecificData: {
-    webId: "WID",
-    bizUserId: "BUID",
-    userUniqueId: "UUID",
-    scope: "marscode-us",
-    tenant: "marscode",
-    region: "US-East",
-  },
-};
-
-test("issue #12190: buildHeaders sends the current work.trae.ai Origin/Referer, not stale solo.trae.ai", () => {
-  const ex = new TraeExecutor();
-  const h = ex.buildHeaders(CREDS);
-  assert.equal(h.Referer, "https://work.trae.ai/", `Referer should be work.trae.ai, got ${h.Referer}`);
-  assert.equal(h.Origin, "https://work.trae.ai", `Origin should be sent, got ${h.Origin}`);
-});
-
-test("issue #12190: buildHeaders forwards x-trae-user-timezone from providerSpecificData when present", () => {
-  const ex = new TraeExecutor();
-  const creds = {
-    ...CREDS,
-    providerSpecificData: { ...CREDS.providerSpecificData, userTimezone: "America/Recife" },
-  };
-  const h = ex.buildHeaders(creds);
-  assert.equal(
-    h["x-trae-user-timezone"],
-    "America/Recife",
-    `x-trae-user-timezone should be forwarded, got ${h["x-trae-user-timezone"]}`
-  );
-});
-
-test("issue #12190: buildHeaders omits x-trae-user-timezone when no timezone is known", () => {
-  const ex = new TraeExecutor();
-  const h = ex.buildHeaders(CREDS);
-  assert.equal(
-    Object.hasOwn(h, "x-trae-user-timezone"),
-    false,
-    "no x-trae-user-timezone key should be sent when providerSpecificData has no userTimezone"
-  );
-});
-
-test("issue #12190: buildHeaders still respects a custom providerSpecificData.userRegion", () => {
-  const ex = new TraeExecutor();
-  const creds = {
-    ...CREDS,
-    providerSpecificData: { ...CREDS.providerSpecificData, userRegion: "SG" },
-  };
-  const h = ex.buildHeaders(creds);
-  assert.equal(h["x-user-region"], "SG", `x-user-region should respect a custom region, got ${h["x-user-region"]}`);
-});
-
-test("issue #12190: buildHeaders defaults x-user-region to US when none is set", () => {
-  const ex = new TraeExecutor();
-  const h = ex.buildHeaders(CREDS);
-  assert.equal(h["x-user-region"], "US");
-});
-
-test("issue #12190: buildHeaders lets a per-connection refererOrigin override the default web origin", () => {
-  const ex = new TraeExecutor();
-  const creds = {
-    ...CREDS,
-    providerSpecificData: {
-      ...CREDS.providerSpecificData,
-      refererOrigin: "https://solo.trae.ai",
-    },
-  };
-  const h = ex.buildHeaders(creds);
-  assert.equal(h.Referer, "https://solo.trae.ai/");
-  assert.equal(h.Origin, "https://solo.trae.ai");
-});