fix: prevent stack overflow in transport close with re-entrancy guard

When 15-25+ transports close simultaneously, close() -> onclose()
triggers the Protocol layer to call close() again recursively,
causing a stack overflow. The process stays alive but becomes
unresponsive.

Three problems in the original close():
1. No re-entrancy guard: onclose() can call back into close()
2. Iterating _streamMapping while cleanup callbacks delete from it
3. No error isolation: one failing cleanup prevents others

The fix:
- Adds _closing boolean guard to prevent recursive calls
- Snapshots stream values into an array and clears the map before
  iterating, avoiding mutation-during-iteration
- Wraps each cleanup() in try/catch so one failure doesn't block
  remaining stream cleanups
- Calls onclose() only after all cleanup is complete

Note: two prior PRs (#1700, #1705) attempted similar fixes but were
closed. This implementation combines the best elements of both:
the re-entrancy guard from #1700 and the snapshot-before-clear
pattern from #1705, with the addition of error isolation.

Closes #1699

Author: claygeo

packages/server/src/server/streamableHttp.ts

@@ -899,15 +899,34 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
         return undefined;
     }
 
+    private _closing = false;
+
     async close(): Promise<void> {
-        // Close all SSE connections
-        for (const { cleanup } of this._streamMapping.values()) {
-            cleanup();
+        // Guard against re-entrant calls. When onclose() triggers the
+        // Protocol layer to call close() again, this prevents infinite
+        // recursion that causes a stack overflow with many transports.
+        if (this._closing) {
+            return;
         }
-        this._streamMapping.clear();
+        this._closing = true;
 
-        // Clear any pending responses
+        // Snapshot and clear before iterating to avoid issues with
+        // cleanup callbacks that modify the map during iteration.
+        const streams = Array.from(this._streamMapping.values());
+        this._streamMapping.clear();
         this._requestResponseMap.clear();
+
+        // Close all SSE connections with error isolation so one
+        // failing cleanup doesn't prevent others from running.
+        for (const { cleanup } of streams) {
+            try {
+                cleanup();
+            } catch {
+                // Individual stream cleanup failures should not
+                // prevent other streams from being cleaned up.
+            }
+        }
+
         this.onclose?.();
     }