[dev-willbird1936]

Description

Fix Streamable HTTP shutdown so SIGINT closes every active transport. The session registry is a Map, but the previous for-in loop never enumerated its entries.

Root cause

Shutdown cleanup did not iterate Map entries, so active transports could remain registered and their close hooks were skipped.

Testing

• Focused Vitest regression with two active transports: 1/1 passed.
• Full Everything Vitest suite: 108/108 passed across 6 files.
• Fresh recheck on 2026-07-15 repeated the focused test (1/1), full package suite (108/108), and package build successfully.
• Everything package build and root TypeScript workspace build: passed.
• LLM-client integration was not exercised; tests use the transport implementation directly.

This is an ordinary correctness/resource-cleanup fix, not a security report. Hosted CI and maintainer review remain pending.

[cliffhall]

Thank you for this pull request, and apologies for the long wait for a response.

Since it was opened, the reference servers have been rebuilt for the 2026-07-28 MCP specification (#4857) and released as v2 (2.0.0 on npm for the TypeScript servers, 2026.10.19 on PyPI for the Python servers). The code this PR changes has been replaced, and the behavior it addresses has either been fixed in v2 or no longer exists in the same form.

This is not a judgment on the change or on you; it's a consequence of the code it targets having been replaced. If the problem still happens on v2, please open a fresh issue with the version you're running and steps to reproduce. Note that this repository now accepts contributions as issues rather than pull requests from anyone but its maintainers; see CONTRIBUTING.md.

This is part of the backlog triage in #4875.