mikser-io 8.0.0 → 8.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/engine.js +19 -1
package/package.json
CHANGED
package/src/engine.js
CHANGED
|
@@ -180,7 +180,25 @@ export async function setup(options) {
|
|
|
180
180
|
runtime.options.app.use((req, res, next) => {
|
|
181
181
|
res.header('Access-Control-Allow-Origin', origin)
|
|
182
182
|
res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
|
|
183
|
-
|
|
183
|
+
// mcp-session-id + mcp-protocol-version are
|
|
184
|
+
// Streamable HTTP transport headers. Browser-side
|
|
185
|
+
// MCP clients (basic-host, mcp-ui, anything not
|
|
186
|
+
// running in Node) send mcp-session-id on every
|
|
187
|
+
// request after initialize — and they can only
|
|
188
|
+
// *read* the initial session-id from the response
|
|
189
|
+
// if it's listed in Expose-Headers. Without both
|
|
190
|
+
// lines, browser hosts succeed at initialize and
|
|
191
|
+
// then hang because they can't continue the
|
|
192
|
+
// protocol. last-event-id is the SSE resume token
|
|
193
|
+
// — same family.
|
|
194
|
+
res.header(
|
|
195
|
+
'Access-Control-Allow-Headers',
|
|
196
|
+
'Content-Type, Authorization, mcp-session-id, mcp-protocol-version, last-event-id',
|
|
197
|
+
)
|
|
198
|
+
res.header(
|
|
199
|
+
'Access-Control-Expose-Headers',
|
|
200
|
+
'mcp-session-id, mcp-protocol-version',
|
|
201
|
+
)
|
|
184
202
|
if (req.method === 'OPTIONS') return res.sendStatus(204)
|
|
185
203
|
next()
|
|
186
204
|
})
|