From c6ea8a0b280bad54ef936f0f785f250cbb197a2a Mon Sep 17 00:00:00 2001
From: Will-hxw <1176843521@qq.com>
Date: Tue, 21 Apr 2026 12:00:20 +0800
Subject: [PATCH 1/2] fix(release): include lock files in version bump check

The has_changes() function only considered .py and .ts files when
deciding whether to bump a package version. This caused packages
with only lockfile changes (e.g., uv.lock from dependabot) to be
skipped during release.

Fixes Issue #3870
---
 scripts/release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release.py b/scripts/release.py
index e4ce1274c3..e4bb64ecd5 100755
--- a/scripts/release.py
+++ b/scripts/release.py
@@ -113,7 +113,7 @@ def has_changes(path: Path, git_hash: GitHash) -> bool:
         )
 
         changed_files = [Path(f) for f in output.stdout.splitlines()]
-        relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts"]]
+        relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts", ".lock"]]
         return len(relevant_files) >= 1
     except subprocess.CalledProcessError:
         return False

From 9ca4b6b8e8919edf657ee8b5db5e33eadc29faf3 Mon Sep 17 00:00:00 2001
From: Will-hxw <1176843521@qq.com>
Date: Tue, 21 Apr 2026 12:09:58 +0800
Subject: [PATCH 2/2] fix(filesystem): prevent MCP roots from overriding
 CLI-provided directories

When a client sends MCP roots, the server should not override explicitly
CLI-provided directories. This fixes the issue where users could not scope
the filesystem server to a directory outside the client's project root.

If CLI directories are explicitly provided, they take precedence over MCP
roots protocol.

Fixes Issue #3929
---
 scripts/release.py      | 2 +-
 src/filesystem/index.ts | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/release.py b/scripts/release.py
index e4bb64ecd5..e4ce1274c3 100755
--- a/scripts/release.py
+++ b/scripts/release.py
@@ -113,7 +113,7 @@ def has_changes(path: Path, git_hash: GitHash) -> bool:
         )
 
         changed_files = [Path(f) for f in output.stdout.splitlines()]
-        relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts", ".lock"]]
+        relevant_files = [f for f in changed_files if f.suffix in [".py", ".ts"]]
         return len(relevant_files) >= 1
     except subprocess.CalledProcessError:
         return False
diff --git a/src/filesystem/index.ts b/src/filesystem/index.ts
index 7b67e63e58..377d7243af 100644
--- a/src/filesystem/index.ts
+++ b/src/filesystem/index.ts
@@ -89,6 +89,9 @@ if (accessibleDirectories.length === 0 && allowedDirectories.length > 0) {
 
 allowedDirectories = accessibleDirectories;
 
+// Track if directories were explicitly provided via CLI args
+const hasCliDirectories = args.length > 0;
+
 // Initialize the global allowedDirectories in lib.ts
 setAllowedDirectories(allowedDirectories);
 
@@ -703,7 +706,13 @@ server.registerTool(
 );
 
 // Updates allowed directories based on MCP client roots
+// Only overrides if no CLI directories were explicitly provided
 async function updateAllowedDirectoriesFromRoots(requestedRoots: Root[]) {
+  // If CLI directories were explicitly provided, MCP roots should not override them
+  if (hasCliDirectories) {
+    console.error("Ignoring MCP roots: CLI-provided directories take precedence");
+    return;
+  }
   const validatedRootDirs = await getValidRootDirectories(requestedRoots);
   if (validatedRootDirs.length > 0) {
     allowedDirectories = [...validatedRootDirs];