@lifeaitools/clauth 1.5.32 → 1.5.34

package/cli/commands/serve.js

@@ -2978,8 +2978,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // fall through to MCP handling
     }
 
-    // ── MCP Streamable HTTP transport (2025-03-26 spec) ──
+    // ── MCP Streamable HTTP transport ──
     // POST /sse, /mcp, /gws, /clauth — JSON-RPC over HTTP
+    // claude.ai requires text/event-stream SSE format (like regen-media/Express).
     if (method === "POST" && (reqPath === "/sse" || isMcpPath)) {
       let body;
       try { body = await readBody(req); } catch {
@@ -2992,26 +2993,45 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const logMsg = `[${new Date().toISOString()}] Streamable HTTP [${reqPath}]: ${rpcMethod} id=${id}\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
 
+      // Check if client accepts SSE — claude.ai sends Accept: application/json, text/event-stream
+      const acceptsSSE = (req.headers.accept || "").includes("text/event-stream");
+
+      // Helper: respond in SSE or JSON format based on client preference
+      // SSE response matches regen-media/Express exactly: no CORS, Content-Length, x-powered-by
+      function mcpRespond(res, jsonRpcResponse) {
+        if (acceptsSSE) {
+          const ssePayload = `event: message\ndata: ${JSON.stringify(jsonRpcResponse)}\n\n`;
+          const buf = Buffer.from(ssePayload, "utf8");
+          res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Content-Length": buf.length,
+            "Cache-Control": "no-cache",
+            "vary": "Accept-Encoding",
+            "x-powered-by": "Express",
+          });
+          return res.end(buf);
+        }
+        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify(jsonRpcResponse));
+      }
+
       // Notifications — no response needed
       if (rpcMethod === "notifications/initialized" || rpcMethod === "initialized") {
-        res.writeHead(204, CORS);
+        res.writeHead(202, CORS);
         return res.end();
       }
 
       if (rpcMethod === "initialize") {
-        // Always return 2025-03-26 — returning 2025-11-25 causes claude.ai to require OAuth
         const result = {
           protocolVersion: "2025-03-26",
           serverInfo: { name: serverNameForPath(reqPath), version: VERSION },
-          capabilities: { tools: {} }
+          capabilities: { tools: { listChanged: true } }
         };
-        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result }));
+        return mcpRespond(res, { jsonrpc: "2.0", id, result });
       }
 
       if (rpcMethod === "tools/list") {
-        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: { tools: toolsForPath(reqPath) } }));
+        return mcpRespond(res, { jsonrpc: "2.0", id, result: { tools: toolsForPath(reqPath) } });
       }
 
       if (rpcMethod === "tools/call") {
@@ -3021,17 +3041,14 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         try {
           const result = await handleMcpTool(vault, name, args || {});
           password = vault.password;
-          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ jsonrpc: "2.0", id, result }));
+          return mcpRespond(res, { jsonrpc: "2.0", id, result });
         } catch (err) {
-          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: mcpError(`Internal error: ${err.message}`) }));
+          return mcpRespond(res, { jsonrpc: "2.0", id, result: mcpError(`Internal error: ${err.message}`) });
         }
       }
 
       // Unknown method
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown method: ${rpcMethod}` } }));
+      return mcpRespond(res, { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown method: ${rpcMethod}` } });
     }
 
     // ── MCP SSE transport — /sse and namespaced paths ────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.32",
+  "version": "1.5.34",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {