stacklok / toolhive / 22907831911

push

github

Fix SSE/JSON race condition in session capability injection (#4075)

Bypass the mcp-go SDK notification mechanism during session registration
to prevent stale notifications from corrupting HTTP responses. During
OnRegisterSession, the notification-listening goroutine from the
initialize request has already exited, so notifications sent by
AddSessionTools/AddSessionResources accumulate in the channel and race
with the next request's response writer.

Replace AddSessionTools/AddSessionResources calls with direct
SetSessionTools/SetSessionResources on the session object, which sets
capabilities without triggering notifications. Also register resource
capabilities explicitly at server creation since the implicit
registration in AddSessionResources is now bypassed.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

41 of 53 new or added lines in 1 file covered. (77.36%)

47407 of 74246 relevant lines covered (63.85%)

74.33 hits per line