[LizunovSergey]

Fixes #2646.

Root cause

When a legacy-era request was aborted, Protocol reused the original request's full transport options for notifications/cancelled. If that request carried a resumptionToken, StreamableHTTPClientTransport interpreted the cancellation send as a resume operation, swallowed the notification, and opened a resumed GET instead of posting the cancellation.

Fix

• Keep relatedRequestId on the cancellation send so request correlation is preserved.
• Do not pass resumptionToken or onresumptiontoken to the cancellation notification.
• Add a regression test that records the transport options for the cancellation send.
• Add a patch changeset for @modelcontextprotocol/core.

Validation

• Regression test fails against the previous implementation and passes with this change.
• pnpm --filter @modelcontextprotocol/core-internal test: 69 files, 1,434 tests passed.
• Monorepo build passed via the pre-push hook.
• Monorepo typecheck passed via the pre-push hook.
• pnpm lint:all passed.
• Changeset status and formatting checks passed.

[changeset-bot]

🦋 Changeset detected

Latest commit: c9c5481

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/core-internal	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2649

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2649

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2649

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2649

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2649

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2649

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2649

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2649

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2649

commit: c9c5481

[LizunovSergey]

Rebased onto main and taken out of draft.

The conflict was with the initialize guard added upstream, which wraps the same
notifications/cancelled send this PR narrows. Both changes are kept: the guard stays, and the send
options drop resumptionToken / onresumptiontoken, leaving { relatedRequestId }.

@modelcontextprotocol/core-internal: 1448 tests pass, typecheck and lint clean.

[LizunovSergey]

Rebased onto main. #3115 routed the cancellation send through the instrumented _sendNotificationMessage, so the resolution keeps that call and passes only { relatedRequestId }.

I also moved the changeset from @modelcontextprotocol/core to core-internal, client and server, as #2668 and #2654 did for the same code path: Protocol lives in core-internal, which ships inside client and server.