BobSong-dev opened a new pull request, #7638: URL: https://github.com/apache/shenyu/pull/7638
## Background The existing MCP Streamable HTTP transport captures business responses in session-level state. A completed response can remain retained, a second request can execute with an already pending JSON-RPC ID, and a late callback from a cancelled request can interfere with a newer request using that ID. Removing a session clears its maps but does not cancel its active handlers. ## Changes - Bind response capture to each subscribed request through Reactor Context, rather than to the session or JSON-RPC ID alone; - Reject duplicate pending IDs before SDK dispatch with HTTP 400 / JSON-RPC -32600; - Discard callbacks from inactive owners and release captured responses on completion, error or cancellation; - Cancel owned handler subscriptions when their session closes, without cancelling requests in another session; - Add regressions for ID reuse, cross-session isolation, caller deadlines, graceful shutdown and real loopback HTTP duplicate/disconnect handling. This only changes the existing session-based Streamable HTTP transport. It does not change Agent Gateway's independent same-ID request contract, add timeouts/retries, upgrade the SDK, or depend on an unmerged PR. Cancellation is subscription cancellation, not a guarantee of remote rollback. ## Verification - Before the fix: 15 tests, 4 failures, 0 errors, 0 skipped; the original 11 tests passed; - Windows/JDK 17 on publication base `ad89a887a`: selected 13-module `clean verify`, 145 tests / 13 suites, 0 failures/errors/skips; Checkstyle and RAT passed in all 13 modules; - Earlier base `971354fef`, with identical edited transport/test bytes: Windows and RISC-V/QEMU each passed 140 tests / 13 suites, 0 failures/errors/skips; Checkstyle and RAT passed in 11 modules. The newer baseline adds five upstream decorator tests; RISC-V was not rerun on the newer baseline; - 25 same-JVM rounds of four existing race/network cases passed, with no dropped Reactor errors or remaining exchange-holder bindings; - `git diff --check` and source/worktree isolation checks passed. Loopback HTTP tests use controlled SDK handlers, not a deployed Admin/Bootstrap/Agent stack. Full-project Java tests were not run. Expected closed-session error logs and SDK notification warnings remain in the local logs; they did not fail the build. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
