Fix session timeout by updating LastActivityTicks on every request

Update LastActivityTicks whenever a reference is acquired in the Started state,
not just when reference count drops to 0. This ensures sessions with ongoing
activity (POST requests) don't timeout even if a GET request is active.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>

Author: Copilot

src/ModelContextProtocol.AspNetCore/StreamableHttpSession.cs

@@ -58,6 +58,8 @@ public async ValueTask<IAsyncDisposable> AcquireReferenceAsync(CancellationToken
                     {
                         sessionManager.DecrementIdleSessionCount();
                     }
+                    // Update LastActivityTicks whenever a request is made to keep the session alive
+                    LastActivityTicks = sessionManager.TimeProvider.GetTimestamp();
                     break;
                 case SessionState.Disposed:
                     throw new ObjectDisposedException(nameof(StreamableHttpSession));

tests/ModelContextProtocol.AspNetCore.Tests/StreamableHttpServerConformanceTests.cs

@@ -521,6 +521,33 @@ public async Task IdleSessionsPastMaxIdleSessionCount_ArePruned_LongestIdleFirst
         Assert.StartsWith("MaxIdleSessionCount of 2 exceeded. Closing idle session", idleLimitLogMessage.Message);
     }
 
+    [Fact]
+    public async Task ActiveSession_WithPeriodicRequests_DoesNotTimeout()
+    {
+        var fakeTimeProvider = new FakeTimeProvider();
+        Builder.Services.AddMcpServer().WithHttpTransport(options =>
+        {
+            options.IdleTimeout = TimeSpan.FromHours(2);
+            options.TimeProvider = fakeTimeProvider;
+        });
+
+        await StartAsync();
+        await CallInitializeAndValidateAsync();
+
+        // Simulate multiple POST requests over a period longer than IdleTimeout
+        // Each request should update LastActivityTicks, preventing timeout
+        for (int i = 0; i < 5; i++)
+        {
+            // Advance time by 1 hour between requests
+            fakeTimeProvider.Advance(TimeSpan.FromHours(1));
+            await CallEchoAndValidateAsync();
+        }
+
+        // Total time elapsed: 5 hours (> 2 hour IdleTimeout)
+        // But session should still be alive because of periodic activity
+        await CallEchoAndValidateAsync();
+    }
+
     [Fact]
     public async Task McpServer_UsedOutOfScope_CanSendNotifications()
     {