Summary

• locally patch @modelcontextprotocol/sdk@1.29.0 to reinitialize a Streamable HTTP session after a POST carrying a session ID receives 404
• coalesce concurrent stale-session failures into one initialization and retry each rejected POST at most once
• support replacement servers that initialize without issuing another optional session ID
• prevent delayed responses from an expired session from overwriting the replacement session state
• avoid replaying a request that timed out or was aborted while recovery was running
• close the client if replacement initialization fails
• add a focused regression test using the real SDK transport against a loopback HTTP server

This is intentionally limited to the POST failure reported in #25137. It does not infer session expiry from optional GET/SSE failures and does not retry ambiguous network failures. Recovery uses fresh request options rather than retaining the original connection signal. The patch can be removed after an equivalent SDK release is adopted.

Closes #25137.
Related to master MCP issue #28567.

Validation

• bun test test/mcp/session-recovery.test.ts from packages/opencode
• bun test test/mcp from packages/opencode
• bun typecheck from packages/opencode
• bun install --frozen-lockfile
• regression test verifies over real loopback HTTP that the stale request receives 404, replacement initialization omits the expired session header, and the original request retries once with the replacement session
• manually verified concurrent failures share one initialization, timed-out requests are not replayed, stateless replacement initialization succeeds, delayed stale responses cannot replace the recovered session, and GET 404 does not trigger recovery