[mcp] HTTP daemon session map only shrinks on DELETE /mcp — clients that disconnect without terminating their session leak a Server + transport per session forever

[devinmlowe]

Evidence

src/interfaces/mcp/http.ts:61-70 (only removal path) and :85-95:

if (req.method === "DELETE" && sessionId) {
  const transport = sessions.get(sessionId);
  if (transport) { sessions.delete(sessionId); await transport.close(); }
  ...
}
...
const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
const sessionServer = new Server(serverInfo, { capabilities: { tools: {} } });
options.registerHandlers(sessionServer);
await sessionServer.connect(transport);
...
if (transport.sessionId) sessions.set(transport.sessionId, transport);

No transport.onclose handler, no last-seen timestamp, no idle sweep (rg -n 'onclose|setInterval|idle' src/interfaces/mcp/http.ts → nothing).

Why it's a bug

The bridge is well-behaved (bridge.ts:179 terminateSession() on dispose), but hosts registered with the HTTP transport by engram mcp install claude talk to the daemon directly, and a killed host never sends DELETE. On the long-running launchd/systemd daemon every such session start leaves a Server + StreamableHTTPServerTransport in the map until the daemon restarts. Objects are small (workers own the DB and model), so this is a slow unbounded growth rather than an outage — P3.

Suggested direction

Set transport.onclose to delete the entry, stamp lastSeen on each request, and sweep sessions idle for N hours (closing their transports).

Related: #28, #50.