Skip to content

Drop redundant @hono/node-server override, document SSE keep-alive #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SVilgelm merged 3 commits into from
Aug 9, 2026
Merged

Drop redundant @hono/node-server override, document SSE keep-alive #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
31bc6a8
Drop redundant @hono/node-server override, document SSE keep-alive
SVilgelm Aug 9, 2026
ed269a7
Bump vulnerable override pins to patched versions
SVilgelm Aug 9, 2026
d010bd9
Merge origin/main into sdk-1.30-cleanup
SVilgelm Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,13 @@ The plugin is one process inside Scrypted. `src/main.ts` declares `ScryptedMcpPl

`src/http-bridge.ts` is the only adapter between Scrypted's `HttpRequest`/`HttpResponse` and Web-standard `Request`/`Response`. Streamed responses (Content-Type: `text/event-stream`) flow through `HttpResponse.sendStream(AsyncGenerator<Buffer>)`; everything else buffers and `send`s.

Two SSE behaviours are inherited from the MCP SDK transport (since 1.30.0) rather than implemented here, and both depend on the bridge staying byte- and header-transparent:

- **Keep-alive.** The transport writes `: keepalive` comment frames into the SSE stream every 15s (`keepAliveMs`, default `DEFAULT_SSE_KEEP_ALIVE_MS`). This is what stops a reverse proxy from reaping a stream that idles during a long tool call — `create_backup` on a large database, and especially the `restore_backup` elicitation round-trip, which idles for as long as the human takes to answer. `readableStreamToBufferGenerator` must therefore keep forwarding every non-empty chunk; the only chunks it may drop are zero-length ones.
- **Proxy hints.** The transport sets `X-Accel-Buffering: no` and `Cache-Control: no-cache, no-transform` on SSE responses. These reach the client only because `fromWebResponse` copies the full header set through `headersToPlain` — don't switch it to an allowlist of known headers.

Request `Content-Type` is validated by parsed media type, not substring match, so `application/json` and `application/json; charset=utf-8` both pass but a comma-joined duplicate header 415s.

`src/scrypted.ts` is a thin `getComponent(name)` wrapper around `sdk.systemManager.getComponent(...)` plus re-exports of `systemManager` / `deviceManager` / `mediaManager`. Tools that previously went through `@scrypted/client` now hit the SDK directly.

## OAuth
Expand Down
3 changes: 1 addition & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,12 +65,11 @@
"overrides": {
"serialize-javascript": "^7.0.5",
"@babel/core": "^7.29.6",
"@hono/node-server": "^2.0.5",
"adm-zip": "^0.6.0",
"body-parser": "^2.3.0",
"brace-expansion": "^5.0.9",
"fast-uri": "^3.1.5",
"hono": "^4.12.27"
"hono": "^4.12.34"
},
"engines": {
"node": ">=24"
Expand Down