chore: merge the streamable HTTP branch (d15d817e) into environment serve

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/server/http/serveStreamableHttp.test.ts

@@ -519,6 +519,30 @@ it("requires exact Accept media ranges before a sessionless POST may replace the
   await client.close();
 });
 
+it("keeps the live session when the new client left before its initialize was probed", async () => {
+  const slot = new McpSessionSlot(
+    createEchoServer(() => undefined),
+    undefined,
+  );
+  const close = vi.spyOn(
+    WebStandardStreamableHTTPServerTransport.prototype,
+    "close",
+  );
+  try {
+    expect((await slot.handle(initializeRequest())).status).toBe(200);
+    const left = new AbortController();
+    left.abort();
+    const abandoned = new Request(initializeRequest(), { signal: left.signal });
+    expect((await slot.handle(abandoned)).status).toBe(400);
+    expect(close).not.toHaveBeenCalled();
+    expect((await slot.handle(initializeRequest())).status).toBe(200);
+    expect(close).toHaveBeenCalledTimes(1);
+  } finally {
+    close.mockRestore();
+    await slot.close();
+  }
+});
+
 it("keeps a session whose transport shutdown failed so the next close retries it", async () => {
   let shutdowns = 0;
   const slot = new McpSessionSlot(

src/server/http/serveStreamableHttp.ts

@@ -238,7 +238,9 @@ export class McpSessionSlot {
     const open = this.#live;
     if (
       open?.transport.sessionId !== undefined &&
-      (await isInitializePost(request))
+      (await isInitializePost(request)) &&
+      // A client that left while its initialize was probed would evict the session for nobody.
+      !request.signal.aborted
     ) {
       if (this.#closed) return SHUTTING_DOWN();
       this.logger?.info("MCP HTTP session replaced by a new client");