fix: reject overflowing keep-alive intervals

Reject timer delays above Node's maximum in addition to NaN and Infinity, and keep the lifecycle regression focused on cleanup rather than the transport's pre-existing error-status mapping.

Author: mattzcarey

src/server/webStandardStreamableHttp.ts

@@ -274,10 +274,9 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
     private startKeepAlive(streamId: string, controller: ReadableStreamDefaultController<Uint8Array>, encoder: TextEncoder): void {
         // A deferred arm (e.g. after an event-store await that straddled
         // close()) must not outlive the transport: close()'s timer sweep has
-        // already run. Non-finite intervals (NaN, Infinity) and non-positive
-        // ones disable keep-alive: setInterval would clamp them to ~1ms and
-        // flood every stream with comment frames.
-        if (!Number.isFinite(this._keepAliveMs) || this._keepAliveMs <= 0 || this._closed) {
+        // already run. Invalid timer delays disable keep-alive rather than
+        // letting setInterval clamp them to ~1ms and flood every stream.
+        if (!Number.isFinite(this._keepAliveMs) || this._keepAliveMs <= 0 || this._keepAliveMs > 2_147_483_647 || this._closed) {
             return;
         }
         this.stopKeepAlive(streamId);
@@ -681,8 +680,8 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
     private async handlePostRequest(req: Request, options?: HandleRequestOptions): Promise<Response> {
         // Set once the SSE stream bookkeeping has been registered, so the
         // catch below can reclaim it: an error after registration (a failed
-        // priming event write, a throwing message handler) returns 400 and
-        // discards the Response, leaving nothing that could ever cancel the
+        // priming event write, a throwing message handler) returns an error
+        // response, leaving nothing that could ever cancel the discarded
         // stream or retire the request mappings.
         let reclaimSseBookkeeping: (() => void) | undefined;
         try {

test/server/streamableHttp.test.ts

@@ -3452,8 +3452,8 @@ describe('WebStandardStreamableHTTPServerTransport SSE keep-alive', () => {
         await transport.close();
     });
 
-    it.each([Number.NaN, Number.POSITIVE_INFINITY])(
-        'should disable keep-alive for non-finite keepAliveMs %s instead of arming a clamped interval',
+    it.each([Number.NaN, Number.POSITIVE_INFINITY, 2_147_483_648])(
+        'should disable keep-alive for invalid keepAliveMs %s instead of arming a clamped interval',
         async keepAliveMs => {
             const { transport, sessionId } = await createTransport({ keepAliveMs });
 
@@ -3542,13 +3542,12 @@ describe('WebStandardStreamableHTTPServerTransport SSE keep-alive', () => {
         expect(vi.getTimerCount()).toBe(0);
         storeFails = true;
 
-        const response = await transport.handleRequest(
+        await transport.handleRequest(
             req('POST', {
                 body: { jsonrpc: '2.0', method: 'tools/call', params: { name: 'noop', arguments: {} }, id: 'call-1' },
                 headers: withSession(sessionId)
             })
         );
-        expect(response.status).toBe(400);
 
         // The discarded stream must not carry a permanently-firing timer
         expect(vi.getTimerCount()).toBe(0);