grove-mcp 1.0.3 → 1.0.6

package/index.js

@@ -17,11 +17,15 @@
 
 const https = require('https');
 const readline = require('readline');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
 
 const HOSTNAME = 'mcp.lyra.tg';
 const SSE_PATH = '/sse';
 
-// Per-user downstream service tokens from the MCP config env block.
+// Per-user downstream service tokens and session key from the MCP config env block.
 // Forwarded as custom headers on every POST so the K8s pod can use them
 // without storing tokens in the cluster environment.
 const TOKEN_HEADERS = {};
@@ -30,6 +34,64 @@ if (process.env.GROVE_OUTLINE_TOKEN)
 if (process.env.GROVE_MATTERMOST_TOKEN)
   TOKEN_HEADERS['Grove-Mattermost-Token'] = process.env.GROVE_MATTERMOST_TOKEN;
 
+// Per-user session isolation: scopes Redis session keys so multiple users
+// on the shared 3-pod cluster never overwrite each other's auth tokens.
+// If GROVE_SESSION_KEY is set in the environment and is not the placeholder
+// value, use it directly.  Otherwise auto-generate a stable random key the
+// first time and persist it to ~/.grove-mcp/session-key so that it survives
+// restarts without any manual configuration.
+(function resolveSessionKey() {
+  const PLACEHOLDER = '<your-session-key-here>';
+  const envKey = process.env.GROVE_SESSION_KEY;
+
+  if (envKey && envKey !== PLACEHOLDER) {
+    TOKEN_HEADERS['X-Grove-Session-Key'] = envKey;
+    return;
+  }
+
+  const keyFile = path.join(os.homedir(), '.grove-mcp', 'session-key');
+  try {
+    const stored = fs.readFileSync(keyFile, 'utf8').trim();
+    if (stored) {
+      TOKEN_HEADERS['X-Grove-Session-Key'] = stored;
+      return;
+    }
+  } catch (_) {
+    // File doesn't exist yet — generate below.
+  }
+
+  const generated = crypto.randomBytes(16).toString('hex');
+  try {
+    fs.mkdirSync(path.dirname(keyFile), { recursive: true });
+    fs.writeFileSync(keyFile, generated, { mode: 0o600 });
+  } catch (err) {
+    process.stderr.write(
+      `grove-mcp-bridge: warning: could not persist session key to ${keyFile}: ${err.message}\n`
+    );
+  }
+  TOKEN_HEADERS['X-Grove-Session-Key'] = generated;
+})();
+
+// Strip MCP spec fields that older Claude Desktop clients don't handle.
+// FastMCP 3.x auto-generates outputSchema from Python return type annotations;
+// Claude Desktop silently drops ALL tools when it sees this field (claude-code#25081).
+function stripMcpCompat(raw) {
+  try {
+    const msg = JSON.parse(raw);
+    if (msg.result && Array.isArray(msg.result.tools)) {
+      msg.result.tools = msg.result.tools.map(function (t) {
+        // eslint-disable-next-line no-unused-vars
+        var outputSchema = t.outputSchema, rest = Object.assign({}, t);
+        delete rest.outputSchema;
+        return rest;
+      });
+    }
+    return JSON.stringify(msg);
+  } catch (_) {
+    return raw;
+  }
+}
+
 let sessionPath = null;
 let affinityCookie = null; // sticky-session cookie from SSE response headers
 const pending = [];
@@ -86,8 +148,10 @@ const sseReq = https.request(
             for (const msg of pending) sendToServer(msg);
             pending.length = 0;
           } else if (eventType === 'message' && raw) {
-            // raw is already a serialised JSON-RPC object — write directly
-            process.stdout.write(raw + '\n');
+            // Strip modern MCP spec fields that cause Claude Desktop to silently
+            // drop all tools (anthropics/claude-code#25081): FastMCP 3.x emits
+            // outputSchema in tools/list which Claude Desktop doesn't understand.
+            process.stdout.write(stripMcpCompat(raw) + '\n');
           }
 
           eventType = '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grove-mcp",
-  "version": "1.0.3",
+  "version": "1.0.6",
   "description": "Claude Desktop bridge for the Grove MCP Server (Mattermost + Outline)",
   "main": "index.js",
   "bin": {