fix(server): fire onsessionclosed once when DELETEs overlap (v1.x)

[axits-lab]

v1.x backport of #2583. Refs #2562 (item 2), which notes the item applies to both branches — I offered this on the issue and confirmed the window is present here before writing anything.

Draft: non-write-access users are capped at one open non-draft PR on this repo and #2582 holds it. Ready for review as-is.

The race, on this branch

WebStandardStreamableHTTPServerTransport.handleDeleteRequest is byte-identical to main's pre-fix code:

try {
    await Promise.resolve(this._onsessionclosed?.(this.sessionId!));
    return new Response(null, { status: 200 });
} finally {
    await this.close();
}

_closed is set by close(), so it stays false for as long as the callback is in flight. Neither validateSession nor validateProtocolVersion consults it, so a second DELETE arriving in that window passes every guard and fires the callback again for a session already being torn down.

Fix

Claim the notification synchronously, before the await — _closed cannot serve the purpose since by construction it is only set after the callback settles. DELETE stays idempotent: a concurrent or repeat request still terminates the session and answers 200, it just does not re-run the callback.

Test — one note worth flagging

The regression test drives transport.handleRequest() directly rather than going through a real socket.

My first attempt used fetch against createTestServer, matching the surrounding onsessionclosed tests, and it passed without the fix — over HTTP the callback release wins the race, so the two DELETEs simply serialize and the bug never surfaces. Driving the transport in-process makes the second DELETE provably reach the handler while the first is parked. It follows the existing WebStandardStreamableHTTPServerTransport - onerror callback block, which already tests this way.

Verified it fails without the src change:

× fires onsessionclosed once when two DELETEs overlap

Verification

• 1640/1640 tests pass across 52 files
• npm run lint and npm run typecheck clean

Changeset included.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1312370

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@modelcontextprotocol/sdk@2587

commit: 1312370