# v0.4.30 (2026-05-11)

## Features
- MCP stdio→SSE bridge: expose local stdio MCP plugins over SSE (api/mcp/[plugin]/sse, /message)
- Dynamic Linux cert resolution + NSS DB injection (Debian/Arch/Fedora/openSUSE, Chrome/Chromium/Firefox incl. snap) (#1010)
- Cowork tool: expanded settings UI & API
- GitBook docs (DocsContent, DocsLayout)
## Fixes
- OAuth callback postMessage scoped to expected origins (CWE-1385) (#998)
- Re-enable TLS verification on DNS-bypass fetch (CWE-295) (#998)
- Normalize `developer` role → `system` for OpenAI-format providers (Deepseek, Groq, …) (#1011, closes #773)
- Respect `PORT` env in internal model-test fetch (#1014)
- Dropdown text readability in dark theme on usage page (#997)
## Improvements
- Refactor Claude CLI spoof headers into shared constant
- Tool deduper utility in open-sse handlers

src/app/api/mcp/[plugin]/sse/route.js

@@ -0,0 +1,35 @@
+import { registerSession, unregisterSession, findPlugin } from "@/lib/mcp/stdioSseBridge";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(request, { params }) {
+  const { plugin } = await params;
+  if (!findPlugin(plugin)) {
+    return new Response(`Unknown plugin: ${plugin}`, { status: 404 });
+  }
+
+  const encoder = new TextEncoder();
+  let sid;
+
+  const stream = new ReadableStream({
+    start(controller) {
+      const send = (chunk) => controller.enqueue(encoder.encode(chunk));
+      sid = registerSession(plugin, send);
+      // MCP SSE handshake: tell client where to POST messages.
+      send(`event: endpoint\ndata: /api/mcp/${plugin}/message?sessionId=${sid}\n\n`);
+    },
+    cancel() {
+      if (sid) unregisterSession(plugin, sid);
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no",
+    },
+  });
+}