fix: late peer-cancel cannot double-respond; mcpserver completion gets typed params

JSONRPCDispatcher._handle_request: pop from _in_flight in the inner
finally (right after the handler returns, before _write_result). No
checkpoint between handler return and pop, so a late
notifications/cancelled finds nothing and is a no-op; scope.cancel_called
is only true if the cancel landed during the handler. Previously a cancel
arriving during _write_result's checkpoint after the result was buffered
would send both the result and a code=0 "Request cancelled" for the
same id.

mcpserver/server.py: register completion/complete via
add_request_handler with CompleteRequestParams (was the legacy
_add_request_handler which defaulted params_type=RequestParams, so the
handler got base RequestParams and params.ref AttributeErrored). Delete
_add_request_handler (last caller).

Author: maxisbey

src/mcp/server/lowlevel/server.py

@@ -272,15 +272,6 @@ def add_notification_handler(
         """
         self._notification_handlers[method] = HandlerEntry(params_type, handler)
 
-    def _add_request_handler(
-        self,
-        method: str,
-        handler: RequestHandler[LifespanResultT, Any],
-    ) -> None:
-        # TODO: remove once experimental tasks plumbing and remaining callers
-        # migrate to `add_request_handler` with an explicit params_type.
-        self.add_request_handler(method, types.RequestParams, handler)
-
     # --- ServerRegistry protocol (consumed by ServerRunner) ------------------
 
     def get_request_handler(self, method: str) -> HandlerEntry[LifespanResultT] | None:

src/mcp/server/mcpserver/server.py

@@ -607,11 +607,7 @@ async def handler(
                     completion=result if result is not None else Completion(values=[], total=None, has_more=None),
                 )
 
-            # TODO(maxisbey): remove private access — completion needs post-construction
-            #   handler registration, find a better pattern for this
-            self._lowlevel_server._add_request_handler(  # pyright: ignore[reportPrivateUsage]
-                "completion/complete", handler
-            )
+            self._lowlevel_server.add_request_handler("completion/complete", CompleteRequestParams, handler)
             return func
 
         return decorator

src/mcp/shared/jsonrpc_dispatcher.py

@@ -565,20 +565,23 @@ async def _handle_request(
                 try:
                     result = await on_request(dctx, req.method, req.params)
                 finally:
-                    # Close the back-channel the moment the handler exits
-                    # (success or raise), before the response write - a handler
-                    # spawning detached work that later calls
-                    # `dctx.send_raw_request()` should see `NoBackChannelError`.
+                    # Handler done: close the back-channel (detached work that
+                    # later calls `dctx.send_raw_request()` should see
+                    # `NoBackChannelError`) and drop from `_in_flight` so a
+                    # late `notifications/cancelled` is a no-op rather than
+                    # racing the result write below. No checkpoint between
+                    # handler return and the pop, so the cancel can't
+                    # interleave there.
                     dctx.close()
+                    self._in_flight.pop(req.id, None)
                 await self._write_result(req.id, result)
             if scope.cancel_called:
-                # Peer-cancel: `_dispatch_notification` cancelled this scope.
-                # anyio swallows a scope's *own* cancel at __exit__, so the
-                # result write (or the handler) is interrupted and execution
-                # lands here rather than the `except cancelled` arm below.
+                # Peer-cancel: `_dispatch_notification` cancelled this scope
+                # while the handler was running. anyio swallows a scope's *own*
+                # cancel at __exit__, so execution lands here rather than the
+                # `except cancelled` arm below.
                 # TODO(maxisbey): spec says SHOULD NOT respond after cancel.
-                # The existing server always has and the interaction suite pins
-                # that; revisit once the suite's divergence entry is resolved.
+                # The existing server always has, so match that for now.
                 await self._write_error(req.id, ErrorData(code=0, message="Request cancelled"))
         except anyio.get_cancelled_exc_class():
             # Outer-cancel: run()'s task group is shutting down. Any bare