Forward upstream notifications to downstream SSE clients

[davidruzicka]

Summary

Forward upstream MCP notifications to downstream HTTP/SSE clients so proxied tool catalogs and other server-initiated events stay in sync.

Why

tools/list_changed and similar notifications only help if mcp4openapi can receive them from upstream sessions and deliver them to connected downstream clients. The current SSE support is close, but notification forwarding is not complete.

Deliverables

• Add an upstream message callback path that can emit notifications independently of request/response handling.
• Update downstream delivery so sendToClient() writes to live SSE streams as well as resumable queues.
• Preserve replay behavior for reconnects using existing event IDs and queued messages.
• Ensure session-bound notification-only and response-only HTTP requests keep the correct session context.
• Add explicit tests for live delivery, reconnect replay, and cleanup.

Acceptance criteria

• An upstream notifications/tools/list_changed event reaches a connected downstream SSE client.
• Notifications are queued when no stream is attached and replayed on resume where supported.
• Session cleanup removes forwarding state and does not leak listeners.
• Failures do not leak secrets or raw upstream transport details.

Suggested files

• src/transport/http-transport.ts
• src/mcp/mcp-server.ts
• related HTTP transport tests

Agent-authored issue.

[github-actions]

🤖 Agent note (issuer)

Autonomy gate decision: unsafe
Reasons:

• issue includes explicit acceptance or validation structure
• issue matches high-risk keywords that should stay in a human lane