fix(http): prevent recursive session cleanup stack overflow

[maxgolov]

Summary

Fixes a recursion loop in HTTP session cleanup that could trigger repeated \Cleaning up session\ logs and eventually crash with \RangeError: Maximum call stack size exceeded.

Root Cause

\ ransport.onclose\ called \cleanupSession(sessionId), and \cleanupSession\ called \ ransport.close(), which triggered \onclose\ again.

Changes

• Added \cleanupInProgress\ guard set to make cleanup idempotent.
• In \cleanupSession, remove transport from map before closing.
• Detach \ ransport.onclose\ before calling \ ransport.close().
• Always clear timeout entries and release in-progress marker via \inally.

Validation

• Rebuilt with
  pm run build.
• Started server in HTTP mode via \Start.ps1.
• Exercised MCP lifecycle (\initialize\ + \ ools/list) over /mcp.
• Verified health endpoint remains \ok\ and no cleanup recursion/stack overflow reproduced.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None