# v0.4.30 (2026-05-11)

## Features
- MCP stdio→SSE bridge: expose local stdio MCP plugins over SSE (api/mcp/[plugin]/sse, /message)
- Dynamic Linux cert resolution + NSS DB injection (Debian/Arch/Fedora/openSUSE, Chrome/Chromium/Firefox incl. snap) (#1010)
- Cowork tool: expanded settings UI & API
- GitBook docs (DocsContent, DocsLayout)
## Fixes
- OAuth callback postMessage scoped to expected origins (CWE-1385) (#998)
- Re-enable TLS verification on DNS-bypass fetch (CWE-295) (#998)
- Normalize `developer` role → `system` for OpenAI-format providers (Deepseek, Groq, …) (#1011, closes #773)
- Respect `PORT` env in internal model-test fetch (#1014)
- Dropdown text readability in dark theme on usage page (#997)
## Improvements
- Refactor Claude CLI spoof headers into shared constant
- Tool deduper utility in open-sse handlers

src/app/api/mcp/[plugin]/message/route.js

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server";
+import { sendToChild, findPlugin } from "@/lib/mcp/stdioSseBridge";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function POST(request, { params }) {
+  const { plugin } = await params;
+  if (!findPlugin(plugin)) {
+    return NextResponse.json({ error: `Unknown plugin: ${plugin}` }, { status: 404 });
+  }
+  try {
+    const body = await request.json();
+    sendToChild(plugin, body);
+    return new Response(null, { status: 202 });
+  } catch (e) {
+    return NextResponse.json({ error: e.message }, { status: 500 });
+  }
+}