@j0hanz/filesystem-mcp 1.19.0 → 1.19.1

package/dist/server/bootstrap.js

@@ -23,7 +23,7 @@ import { createTaskStore } from './task-store.js';
 function buildServerCapabilities(options = {}) {
     const capabilities = {
         logging: {},
-        resources: {},
+        resources: { listChanged: true },
         tools: {},
         prompts: options.enablePromptListChanged ? { listChanged: true } : {},
         completions: {},
@@ -294,6 +294,21 @@ function isAllowedOrigin(origin) {
         return true; // Non-browser clients omit Origin.
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
+const EXPOSED_HEADERS = [
+    'WWW-Authenticate',
+    'Mcp-Session-Id',
+    'Mcp-Protocol-Version',
+].join(', ');
+function setCorsHeaders(req, res) {
+    const { origin } = req.headers;
+    if (origin === undefined)
+        return;
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id, Last-Event-ID');
+    res.setHeader('Access-Control-Expose-Headers', EXPOSED_HEADERS);
+    res.setHeader('Access-Control-Max-Age', '86400');
+}
 function normalizeAllowedHostname(host) {
     const trimmed = host.trim().toLowerCase();
     if (trimmed === '::1')
@@ -410,7 +425,7 @@ function assertHttpBindingSecurity(host) {
 }
 function writeMethodNotAllowedResponse(res) {
     res.writeHead(405, {
-        Allow: 'GET, POST, DELETE',
+        Allow: 'GET, POST, DELETE, OPTIONS',
         'Content-Type': 'application/json',
     });
     res.end(JSON.stringify({
@@ -490,6 +505,10 @@ export async function startHttpServer(port, options) {
     }
     async function dispatchMcpMethod(method, req, res, sessionId) {
         switch (method) {
+            case 'OPTIONS':
+                res.writeHead(204);
+                res.end();
+                return;
             case 'POST':
                 await handlePostRequest(req, res, sessionId);
                 return;
@@ -505,6 +524,7 @@ export async function startHttpServer(port, options) {
         const sessionId = getSessionId(req);
         if (!ensureAllowedOrigin(req, res))
             return;
+        setCorsHeaders(req, res);
         if (!ensureAllowedHostHeader(req, res, httpHost))
             return;
         if (!ensureAuthorizedRequest(req, res))
@@ -526,6 +546,8 @@ export async function startHttpServer(port, options) {
                 Logger.warn(`[HTTP] Evicting stale session ${sessionId}: client never sent notifications/initialized`);
                 session.close().catch((err) => {
                     Logger.error(`[HTTP] Error closing stale session ${sessionId}:`, formatUnknownErrorMessage(err));
+                    // Ensure event store is cleaned even if session.close() fails
+                    eventStore.delete(sessionId);
                 });
             }
         }

package/dist/tools/task-support.js

@@ -304,6 +304,7 @@ async function runTaskInBackground(run, args, ctx, taskStore, taskId, toolName,
                 taskAbort.abort(new Error('Task cancelled by client'));
         });
     }, cancelPollMs ?? TASK_CANCEL_POLL_MS);
+    cancelPoller.unref();
     const start = performance.now();
     let taskStatuses;
     let result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@j0hanz/filesystem-mcp",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "mcpName": "io.github.j0hanz/filesystem-mcp",
   "description": "Secure filesystem MCP server for reading, writing, searching, diffing, and patching files.",
   "author": "j0hanz",