@magpie-community/opencode-trae-auth 0.2.12 → 0.2.14

package/README.md

@@ -128,7 +128,16 @@ agent's `POST https://trae-api-cn.mchost.guru/api/agent/v3/llm_utils_chat`:
   - GLM also writes its own template, `<tool_call>name<arg_key>k</arg_key>
     <arg_value>v</arg_value></tool_call>` (a string kept as written, other
     types read as JSON), and sometimes a whole call into a native call's
-    name; both are read as the call.
+    name; both are read as the call. A name that holds the wrapper with
+    GLM's tags where its service stopped mid-call — `{"name":"bash",
+    "arguments":{"command</arg_key><arg_value>ls</arg_value>` — is read too:
+    the tags are the service's own handoff, so what stands between them is
+    the model's text (a quote left unescaped read as the quote it is, a
+    comma inside a value kept, a field's closing tag ending the value before
+    it), and the fields the native call did carry are kept beside the ones
+    the name's own text fills in. A name whose tool the request doesn't
+    have, or one no field can be read from, goes on as written, as any other
+    unknown tool does.
   - A block is read as models get it wrong too: every quote escaped
     (`{\"name\":…}`), quotes or backslashes in a string left unescaped, an
     opener with the name as an attribute (`<tool_call name="bash">` with
@@ -279,10 +288,29 @@ answered it 9074 even with the client's headers.
   `checked_in`, `credits`.
 - **Claim:** `POST api.trae.cn/trae/api/v2/ug/checkin_credits/claim`,
   the same, only while it is on and today's isn't in.
+- **The device, when Trae CN's own client is here (0.2.14):** the
+  account this machine's Trae CN desktop client is signed in as checks in
+  on the client's own device, the one Trae's device service registered:
+  `x-device-id` is the id in the client's
+  `globalStorage/storage.json` key `iCubeAuthInfo://icube-dc:<id>`,
+  `x-device-type` and `x-os-version` are this machine's, and no
+  `x-device-brand` is sent. The account is matched by the `userId` in the
+  client's sign-in (`iCubeAuthInfo://icube.cloudide`, plain JSON or the
+  client's fixed codec, as dingminhua/dsh-connect-trae reads it). The file
+  is only read: nothing in it is written, and the client's token is never
+  used. On one account the client's claim went through while the
+  plugin's, on its own device, got 9074 (yetone/magpie#808, #1920); that
+  this header is what changes it hasn't been tried on a real account
+  yet. Every other account keeps its own device, and a file that can't be
+  read or made out, or holds no single device, changes nothing. Files:
+  macOS `~/Library/Application Support/Trae CN/…`, Windows
+  `%APPDATA%\Trae CN\…` (or `trae-cn`), Linux `~/.config/trae-cn/…`
+  (or `Trae CN`; not seen on a real Linux install).
 - **What comes back:** Trae's answer as it is. A 401 or code 1001 marks
   the account for a new sign-in. Code 9095 means this device has checked
-  in today; nothing sends another device id to get round it, nor to get
-  round a 9074.
+  in today. No device id is ever made up, changed or rotated to get round
+  a 9095 or a 9074, and no account is given a device that isn't its
+  own client's.
 
 Only `api.trae.cn`'s `/trae/api/` pages are sent this way; any other URL
 that isn't a chat request is still refused (400). Needs 0.1.4 or later.

package/index.mjs

@@ -9,8 +9,11 @@
 // The account's fetch also sends Trae CN's own pages on api.trae.cn
 // (/trae/api/…) as the account, for magpie's daily check-in (每日签到:
 // /trae/api/v2/ug/checkin_credits/status, then /claim).
-import { createHash, generateKeyPairSync, randomBytes, randomUUID, randomInt, sign } from "node:crypto"
+import { createDecipheriv, createHash, generateKeyPairSync, randomBytes, randomUUID, randomInt, sign } from "node:crypto"
+import { readFile } from "node:fs/promises"
 import { createServer, STATUS_CODES } from "node:http"
+import { homedir, release, version as osVersion } from "node:os"
+import { join } from "node:path"
 
 const SITES = {
   // Trae CN (trae.cn): the authorization page sends the browser back to a
@@ -739,9 +742,12 @@ const ugUA = (site) =>
 // ugHeaders are the headers Trae CN's IDE (3.3.104) sends a growth page
 // with, and only those: its JWT, then its device (fb: x-device-id,
 // x-device-brand, x-device-type, x-os-version, x-app-version), not the
-// chat's tokens and versions.
-function ugHeaders(a, site, extra = {}) {
-  return {
+// chat's tokens and versions. own is this machine's Trae CN client, when
+// it is signed in as this very account (ownClient): its device id and
+// this machine's OS go instead of the account's, and no brand is named
+// (fb leaves it out when it has no model to name).
+function ugHeaders(a, site, extra = {}, own) {
+  const h = {
     "Content-Type": "application/json",
     Authorization: `Cloud-IDE-JWT ${a.token}`,
     "User-Agent": ugUA(site),
@@ -750,8 +756,121 @@ function ugHeaders(a, site, extra = {}) {
     "x-device-type": "Windows",
     "x-os-version": "10.0.22631",
     "x-app-version": site.clientVersion,
-    ...extra,
   }
+  if (own) {
+    h["x-device-id"] = own.deviceId
+    h["x-device-type"] = own.type
+    h["x-os-version"] = own.os
+    delete h["x-device-brand"]
+  }
+  return { ...h, ...extra }
+}
+
+// ---- this machine's own Trae CN client ----------------------------------------------
+
+// Trae CN's desktop client keeps its state in a VS Code-style
+// globalStorage/storage.json. The device id Trae's device service gave
+// it is in a key's name, iCubeAuthInfo://icube-dc:<digits> (15 or 16
+// digits seen); its sign-in is the value of iCubeAuthInfo://icube.cloudide,
+// a JSON envelope (userId, token, …) stored as is or obfuscated with the
+// client's fixed AES-128-CBC codec. Seen in real clients' files
+// (yetone/magpie#808: the same id in the client's own did= query;
+// yetone/magpie#1705) and read the same way by dingminhua/dsh-connect-trae
+// (MIT), whose codec this is.
+const DC_KEY = "iCubeAuthInfo://icube-dc:"
+const AUTH_KEY = "iCubeAuthInfo://icube.cloudide"
+
+// ownClient.paths are where storage.json may be, in order; tests replace it
+const ownClient = {
+  paths: () => clientStoragePaths(process.platform, homedir(), process.env),
+}
+
+function clientStoragePaths(platform, home, env) {
+  const file = (root, name) => join(root, name, "User", "globalStorage", "storage.json")
+  if (platform === "darwin") return [file(join(home, "Library", "Application Support"), "Trae CN")]
+  if (platform === "win32") {
+    const roots = [env.APPDATA, join(home, "AppData", "Roaming")].filter((r, i, all) => r && all.indexOf(r) === i)
+    return roots.flatMap((r) => ["Trae CN", "trae-cn"].map((n) => file(r, n)))
+  }
+  if (platform === "linux") return ["trae-cn", "Trae CN"].map((n) => file(env.XDG_CONFIG_HOME || join(home, ".config"), n))
+  return []
+}
+
+// clientDevice is the device id of this machine's Trae CN client when the
+// client is signed in as uid, else undefined. It only reads: nothing of
+// the client's is written, kept or sent but that id, and the client's own
+// token is read past, never used. A file it can't read or make out, or one
+// with no single device, names no device, and the account keeps its own.
+// Never an id made up or changed: an account the client isn't signed in
+// as never gets the client's id.
+async function clientDevice(uid) {
+  if (!uid) return undefined
+  for (const p of ownClient.paths()) {
+    let text
+    try {
+      text = await readFile(p, "utf8")
+    } catch {
+      continue // not installed here
+    }
+    try {
+      const doc = JSON.parse(text)
+      const ids = Object.keys(doc ?? {}).filter((k) => k.startsWith(DC_KEY)).map((k) => k.slice(DC_KEY.length))
+      if (ids.length !== 1 || !/^\d{8,20}$/.test(ids[0])) return undefined
+      const who = clientAuth(doc[AUTH_KEY])?.userId
+      return who != null && String(who) === String(uid) ? ids[0] : undefined
+    } catch {
+      return undefined
+    }
+  }
+  return undefined
+}
+
+// clientAuth is the client's sign-in envelope, as stored or decoded
+function clientAuth(v) {
+  if (typeof v !== "string" || !v.trim()) return undefined
+  const t = v.trim()
+  return JSON.parse(t.startsWith("{") ? t : clientDecode(t))
+}
+
+const xorOf = (a, b) => Buffer.from(a.map((x, i) => x ^ b[i]))
+const CODEC = {
+  "746305100000": xorOf(
+    [82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130, 155, 47, 255, 135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61, 238, 76, 149, 11, 66, 250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73, 109, 139, 209, 37],
+    [31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81, 127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160, 224, 59, 77, 174, 42, 245, 176, 200, 235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99, 85, 33, 12, 125],
+  ),
+  "123920200203": xorOf(
+    [191, 192, 216, 250, 122, 246, 220, 97, 31, 254, 98, 27, 8, 72, 71, 176, 135, 99, 96, 18, 127, 101, 203, 104, 211, 102, 191, 125, 37, 72, 150, 156, 51, 229, 121, 35, 17, 153, 141, 177, 110, 131, 150, 128, 172, 255, 254, 6, 18, 140, 55, 62, 236, 249, 135, 64, 135, 12, 117, 4, 89, 149, 168, 209],
+    [246, 204, 26, 232, 232, 70, 129, 109, 223, 146, 169, 242, 23, 241, 105, 145, 50, 196, 165, 42, 254, 120, 3, 54, 244, 207, 209, 85, 53, 6, 138, 106, 175, 148, 31, 204, 186, 186, 165, 182, 87, 142, 49, 10, 39, 110, 26, 154, 86, 56, 173, 125, 18, 64, 198, 225, 99, 99, 83, 82, 191, 134, 76, 170],
+  ),
+}
+
+// clientDecode undoes the client's codec: a 6-byte header naming the salt,
+// 32 random bytes, then AES-128-CBC under sha512(sha512(random) + salt);
+// the plaintext is led by its own sha512, which is checked
+function clientDecode(b64) {
+  const buf = Buffer.from(b64, "base64")
+  const salt = CODEC[buf.subarray(0, 6).toString("hex")]
+  if (!salt || buf.length <= 102) throw new Error("not the client's codec")
+  const key = createHash("sha512").update(Buffer.concat([createHash("sha512").update(buf.subarray(6, 38)).digest(), salt])).digest()
+  const d = createDecipheriv("aes-128-cbc", key.subarray(0, 16), key.subarray(16, 32))
+  const out = Buffer.concat([d.update(buf.subarray(38)), d.final()])
+  const body = out.subarray(64)
+  if (out.length < 64 || !createHash("sha512").update(body).digest().equals(out.subarray(0, 64))) throw new Error("the client's value doesn't check")
+  return body.toString("utf8")
+}
+
+// thisMachine is how the client names this machine's OS: its type, and
+// the OS's own version (Windows' product name, as "Windows 11 Home China"
+// was seen, else its build; elsewhere the kernel's release)
+function thisMachine(platform = process.platform) {
+  if (platform === "win32") {
+    let v = ""
+    try {
+      v = osVersion()
+    } catch {}
+    return { type: "windows", os: /^Windows \d/.test(v) ? v : `Windows ${release()}` }
+  }
+  return { type: platform === "darwin" ? "mac" : platform, os: `${platform === "darwin" ? "macOS" : platform} ${release()}` }
 }
 
 // ugPage: url is one of Trae's growth pages (the check-in)
@@ -1493,6 +1612,165 @@ function glmCall(s, tools = []) {
   return { name, arguments: args }
 }
 
+// Trae reads a model's call for it and hands a call it could not read on as
+// the native call: the wrapper the client's prompt asked for, with GLM's own
+// template tags where the model wrote them and a field's close left behind
+// (``{"name":"bash","arguments":{"command</arg_key><arg_value>ls</arg_value>``).
+// The name then holds the call the model meant, and the call's own arguments
+// — where the model wrote them — hold the rest of it.
+const NAMECALL = /^\s*\{\s*"name"\s*:\s*"([^"\\]*)"\s*,\s*"(?:arguments|input|parameters)"\s*:\s*\{/
+// a wrapper the service put text in front of (`bash_abstract_command_0>{…}`):
+// the same shape, wherever it starts
+const NAMEHEAD = /\{\s*"name"\s*:\s*"([^"\\]*)"\s*,\s*"(?:arguments|input|parameters)"\s*:\s*\{/
+const NAMETAG = /<\/?arg_(?:key|value)\s*>/
+
+// nameCall is the call a name holds when it is one the model wrote there
+// ({name, arguments}), null when it isn't: a name without the wrapper, one
+// whose tool the request doesn't have, or one no field could be read from.
+// The wrapper and the tags are the service's own handoff, so what stands
+// between them is the model's text as it wrote it — a quote it left
+// unescaped is read as the quote it is, the way repairedJSON reads a file's
+// content. A value is JSON where the tool's schema says the field is no
+// string and the text is one; else the text, cut where the value was cut.
+function nameCall(s, tools = []) {
+  const text = String(s ?? "")
+  // a wrapper the service put text in front of (`bash_abstract_command_0>{…}`)
+  // is the call it holds, that text being no name the request has
+  const at = text.indexOf("{")
+  if (at < 0) return null
+  const m = NAMECALL.exec(text.slice(at))
+  if (!m) return null
+  const name = m[1]
+  const tool = tools.map((t) => t.function ?? t).find((t) => t?.name === name)
+  if (!tool) return null
+  const fields = nameFields(text.slice(at + m[0].length))
+  const args = {}
+  for (const [key, value] of fields) {
+    // a field the schema says is no string is its JSON where it is one (a
+    // number the model wrote, an object), else the text it is
+    if (tool.parameters?.properties?.[key]?.type !== "string") {
+      try {
+        args[key] = JSON.parse(value.trim())
+        continue
+      } catch {}
+    }
+    args[key] = value
+  }
+  return Object.keys(args).length ? { name, arguments: args } : null
+}
+
+// nameFields reads a wrapper's body as its fields: a key, then its value.
+// A tag stands where the service cut a colon or a quote, so a value ends at
+// the tag that ends it, at the next key, or at the structure that closes it
+// — and at a closing tag (`</description>`) whose name is a field's, because
+// what follows such a tag is the service's own text, not the model's.
+// What none of those reached is no field's text and is left out, so a call
+// cut in the middle keeps what it has.
+function nameFields(body) {
+  const out = []
+  let i = 0
+  for (let n = 0; n < 64 && i < body.length; n++) {
+    // between fields: blanks, a comma, or the tags that stand for either
+    i += (body.slice(i).match(/^[\s,]+|^<\/?[a-z_]+\s*>/) || [""])[0].length
+    if (body[i] !== '"') break
+    const key = nameString(body, i, () => true)
+    i = key.i
+    if (!key.text) break
+    const colon = body.slice(i).match(/^\s*:\s*/)
+    if (colon) i += colon[0].length
+    // a value the service cut at its tag: what stands after the tag is the
+    // model's text (limit</arg_key><arg_value>55)
+    i += (body.slice(i).match(/^(?:<\/?[a-z_]+\s*>)+/) || [""])[0].length
+    let value
+    if (body[i] === '"') {
+      const v = nameString(body, i, (rest) => endsValue(rest))
+      value = v.text
+      i = v.i
+      if (!value && !v.closed) break // an open quote with nothing in it
+    } else {
+      const rest = body.slice(i)
+      const stop = valueEnd(rest)
+      value = rest.slice(0, stop).replace(/^[\s,:]+/, "")
+      // the field's own close: the structure that follows it, and a quote
+      // the service cut it at where an escape isn't what stands before it
+      value = value.replace(/[\s,}\]]+$/, "").replace(/(?<!\\)"$/, "").replace(/[\s,}\]]+$/, "")
+      i += stop
+      // nothing introduced a value (no colon, no quote, no tag) and none
+      // stands: the wrapper is cut at the key, and an empty call read out
+      // of it would be a call the model never wrote
+      if (!value) break
+    }
+    out.push([key.text, value])
+  }
+  return out
+}
+
+// endsValue is what may stand after a string's closing quote: the structure
+// that closes the field (`,`, `}`, `]`, the end), a tag that stands for one,
+// or the next field's key.
+function endsValue(rest) {
+  if (/^\s*(?:[,}\]$]|<\/?[a-z_]+\s*>)/.test(rest)) return true
+  return /^\s*"(?:[^"\\]|\\.)*"\s*(?::|<\/?[a-z_]+\s*>)/.test(rest)
+}
+
+// valueEnd is where an unquoted value runs out: the next key, a tag that
+// ends it, or the structure that closes the field. A comma inside it is the
+// model's own (sed -n 1,9p), so only a brace or a bracket closes a field.
+function valueEnd(rest) {
+  const stops = [
+    rest.search(/"(?:(?:[^"\\<>]*)"\s*(?::|,|\s*<\/?[a-z_]+\s*>)|[^"\\<>]*<\/?[a-z_]+\s*>)/),
+    rest.search(/<\/?[a-z_]+\s*>/),
+    rest.search(/[}\]]/),
+  ].filter((x) => x >= 0)
+  return stops.length ? Math.min(...stops) : rest.length
+}
+
+// nameString reads the string at s[i] === '"', its escapes kept as written.
+// ends says, for what follows a quote, whether that quote ended the string:
+// a quote the model left unescaped inside a value is escaped as read on.
+// `closed` is whether the model's own quote ended it, where the read ran
+// into a tag or the end of the text.
+function nameString(s, i, ends) {
+  i++ // the opening quote
+  let src = ""
+  while (i < s.length) {
+    const ch = s[i]
+    if (ch === "\\") {
+      src += s[i] + (s[i + 1] ?? "")
+      i += 2
+      continue
+    }
+    if (ch === "<") {
+      // a tag ends the run: the service cut the value at it, whether it is
+      // one of its own (`</arg_value>`) or a field's (`</description>`),
+      // for neither is text the model wrote
+      if (/^<\/?[a-z_][\w-]*\s*>/.test(s.slice(i))) break
+    }
+    if (ch === '"') {
+      if (ends(s.slice(i + 1))) {
+        i++
+        return { text: decode(src), i, closed: true }
+      }
+      src += '\\"'
+      i++
+      continue
+    }
+    src += ch
+    i++
+  }
+  return { text: decode(src), i, closed: false }
+}
+
+// decode is a string's own source as the string: the escapes the model wrote
+// are the characters they stand for, a newline among them
+function decode(src) {
+  try {
+    return JSON.parse('"' + escapeRaw(src) + '"')
+  } catch {
+    return src
+  }
+}
+
 // toolNamed is the request's own name for a tool a model named otherwise
 // (Read for read, list-files for list_files); name itself when the request
 // has none like it. A tool it has none of goes on as named: the agent tells
@@ -1684,12 +1962,21 @@ class NativeCalls {
   }
   take(tools = []) {
     return this.calls.filter((c) => c.name).map(({ id, name, arguments: a }) => {
-      // a name that holds the whole call, as JSON or in GLM's template:
-      // that call, its arguments the name's when it gave none of its own
-      const w = name.trimStart().startsWith("{") ? looseJSON(name) : name.includes("<arg_key>") ? glmCall(name, tools) : null
+      // a name that holds the whole call, as the client's wrapper or in
+      // GLM's template: that call, its arguments the name's when it gave
+      // none of its own. The wrapper is read as JSON where it is whole —
+      // its nesting is its own — and as the service's handoff where it was
+      // left mid-call, a wrapper written with a space (`{ "name"`) whole
+      // like any other
+      const w = name.trimStart().startsWith("{") ? looseJSON(name) ?? nameCall(name, tools)
+        : NAMEHEAD.test(name) ? nameCall(name, tools)
+        : name.includes("<arg_key>") ? glmCall(name, tools) : null
       if (w?.name) {
         name = String(w.name)
-        if (!a || a.trim() === "{}") a = callArgs(w)
+        // the name's own arguments are the model's; what the name read fills
+        // the fields they left (the wrapper's text is the whole call where
+        // Trae moved the arguments with it, and the rest where it did not)
+        a = nameArgs(a, w)
       }
       const v = a && !done(a) ? looseJSON(a) : null
       return { id: id || callId(), name, arguments: v ? JSON.stringify(v) : a || "{}" }
@@ -1697,6 +1984,25 @@ class NativeCalls {
   }
 }
 
+// nameArgs is the arguments of a call a name held: the native call's own
+// where it carried them, else the name's, and the two together where each
+// has a field the other hasn't — the service moves the arguments it read
+// into the native call and leaves the rest in the name. The name's side is
+// read the way main reads a whole name (`callArgs`: `arguments`, `input`,
+// `parameters`, arguments given as a string, or the flat fields), so what
+// main already read keeps reading the same. The two stand together only as
+// two sets of fields; a call's own arguments that are not that — text the
+// service cut, or a value that isn't a call's fields — go on as they stand,
+// which is what main passed on and what the agent can answer.
+function nameArgs(native, fromName) {
+  const a = typeof native === "string" ? native.trim() : ""
+  const named = callArgs(fromName)
+  if (!a || a === "{}") return named
+  const own = looseJSON(a), side = looseJSON(named)
+  if (!own || !side || typeof own !== "object" || typeof side !== "object" || Array.isArray(own) || Array.isArray(side)) return a
+  return JSON.stringify({ ...side, ...own })
+}
+
 // resent says next is the call's whole arguments sent again after a
 // partial snapshot, not a piece of them: Trae resends a snapshot whose
 // punctuation isn't the first one's (− for -, ′ for '), so it doesn't
@@ -2141,9 +2447,16 @@ const makePlugin = (site) => async ({ client }) => {
     const ug = ugPage(url)
     let sent = method === "GET" || method === "HEAD" ? undefined : typeof body === "string" ? body : "{}"
     if (ug && sent !== undefined && /^\s*(\{\s*\})?\s*$/.test(sent)) sent = JSON.stringify({ req_source: 1 })
+    // the account this machine's own Trae CN client is signed in as checks
+    // in on the client's device, the one Trae registered: on one account
+    // the client's own claim went through while the plugin's, on a device
+    // it had made up, came back 9074 (yetone/magpie#808, #1920). Every
+    // other account keeps its own device; none is given the client's.
+    const deviceId = ug && site.id === "trae-cn" ? await clientDevice(a.uid) : undefined
+    const own = deviceId ? { deviceId, ...thisMachine() } : undefined
     const res = await fetch(url, {
       method,
-      headers: ug ? ugHeaders(a, site, { Accept: "application/json" }) : ideHeaders(a, site, { Accept: "application/json" }),
+      headers: ug ? ugHeaders(a, site, { Accept: "application/json" }, own) : ideHeaders(a, site, { Accept: "application/json" }),
       body: sent,
       signal: signal ?? AbortSignal.timeout(20_000),
     })
@@ -2496,4 +2809,4 @@ const makePlugin = (site) => async ({ client }) => {
 export const TraeCNAuthPlugin = makePlugin(SITES["trae-cn"])
 export const TraeGlobalAuthPlugin = makePlugin(SITES["trae-global"])
 
-export const _internal = { traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }
+export const _internal = { ownClient, clientStoragePaths, clientDevice, clientDecode, thisMachine, traeHost, accountOf, HOSTS: SITES["trae-cn"].hosts, MODELS: SITES["trae-cn"].models, TextTools, NativeCalls, looseJSON, glmCall, nameCall, toolNamed, unwrapped, traeMessages, chatBody, credits, dollarUsageOf, whenOf, newDevice, proofOf, SITES, SESSION, conversationID }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-trae-auth",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "OpenCode provider plugins for Trae: Trae CN (trae.cn) and Trae Global (trae.ai), free tier included, with Trae's own browser sign-in",
   "type": "module",
   "main": "./index.mjs",