fix(mcp): lowercase SSE event-source header keys to prevent duplicate Authorization (401)

src/agents/mcp-transport.ts

@@ -68,21 +68,14 @@ function buildSseEventSourceFetch(
   baseFetch: FetchLike,
 ): SseEventSourceFetch {
   return (url: string | URL, init?: RequestInit) => {
-    const sdkHeaders: Record<string, string> = {};
-    if (init?.headers) {
-      if (init.headers instanceof Headers) {
-        init.headers.forEach((value, key) => {
-          sdkHeaders[key] = value;
-        });
-      } else {
-        Object.assign(sdkHeaders, init.headers);
-      }
-    }
     // Header names are case-insensitive, but object spreads preserve case
     // variants and can duplicate Authorization on the wire. Normalize before
     // merging so operator headers override SDK headers as a single entry.
     const mergedHeaders: Record<string, string> = {};
-    for (const [key, value] of [...Object.entries(sdkHeaders), ...Object.entries(headers)]) {
+    for (const [key, value] of new Headers(init?.headers)) {
+      mergedHeaders[key.toLowerCase()] = value;
+    }
+    for (const [key, value] of Object.entries(headers)) {
       mergedHeaders[key.toLowerCase()] = value;
     }
     return baseFetch(url, {