fix(server): settle in-flight JSON-mode requests on transport close

[axits-lab]

Refs #2559.

Draft because non-write-access users are capped at one open PR here and #2582 holds it. Ready for review as-is.

One half reproduces, one no longer does

The hang — real, fixed here. close() runs every stream mapping's cleanup. JSON response mode's cleanup only deleted the map entry:

cleanup: () => {
    this._streamMapping.delete(streamId);
}

so the Promise<Response> returned by handleRequest() was never settled and a POST whose handler was still running hung indefinitely. Probed by parking a tool handler, waiting until it had genuinely started, then closing:

toolStarted before close = true
request after close()    = hung

It now resolves with a 503 JSON-RPC error:

request after close() = settled, status 503
{"jsonrpc":"2.0","error":{"code":-32000,"message":"Service Unavailable: transport closed before a response was produced"},"id":null}

The success path is untouched — send() resolves before it calls cleanup(), and re-resolving a settled promise is a no-op, so this only fires when nothing was sent.

The leak — no longer reproduces on main. The issue notes send() "never runs the mapping's cleanup", but it has since #2286 (merged 2026-06-26); stream.cleanup() is called on both branches at streamableHttp.ts:1229/:1232. Measured directly:

_streamMapping.size after a completed JSON-mode POST = 0

So I've left that half alone rather than write a no-op change. Shout if you're seeing it on a path I haven't hit.

Test

Added to the existing JSON-response-mode block. It waits until the handler is genuinely parked before closing — closing earlier lands before the POST is even validated and the test proves nothing (my first attempt did exactly that and passed for the wrong reason).

Fails without the src change:

× settles an in-flight request when the transport closes mid-handler
  AssertionError: expected true to be false

Verification

• 469/469 tests pass in @modelcontextprotocol/server; 99/99 in @modelcontextprotocol/node (which wraps this transport)
• pnpm lint and pnpm typecheck clean

Changeset included.

On your note that this applies to v1.x too — happy to put up the equivalent there, and I asked on the issue whether you'd prefer that as its own PR or a backport after this lands.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1472942

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2584

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2584

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2584

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2584

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2584

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2584

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2584

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2584

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2584

commit: 1472942