fix: critical memory leak from per-session database connections (#554)

* fix: critical memory leak from per-session database connections (#542)

Each MCP session was creating its own database connection (~900MB),
causing OOM kills every ~20 minutes with 3-4 concurrent sessions.

Changes:
- Add SharedDatabase singleton pattern - all sessions share ONE connection
- Reduce session timeout from 30 min to 5 min (configurable)
- Add eager cleanup for reconnecting instances
- Fix telemetry event listener leak

Memory impact: ~900MB/session → ~68MB shared + ~5MB/session overhead

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Conceived by Romuald Czlonkowski - https://www.aiadvisors.pl/en

* fix: resolve test failures from shared database race conditions

- Fix `shutdown()` to respect shared database pattern (was directly closing)
- Add `await this.initialized` in both `close()` and `shutdown()` to prevent
  race condition where cleanup runs while initialization is in progress
- Add double-shutdown protection with `isShutdown` flag
- Export `SharedDatabaseState` type for proper typing
- Include error details in debug logs
- Add MCP server close to `shutdown()` for consistency with `close()`
- Null out `earlyLogger` in `shutdown()` for consistency

The CI test failure "The database connection is not open" was caused by:
1. `shutdown()` directly calling `this.db.close()` which closed the SHARED
   database connection, breaking subsequent tests
2. Race condition where `shutdown()` ran before initialization completed

Conceived by Romuald Członkowski - www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* test: add unit tests for shared-database module

Add comprehensive unit tests covering:
- getSharedDatabase: initialization, reuse, different path error, concurrent requests
- releaseSharedDatabase: refCount decrement, double-release guard
- closeSharedDatabase: state clearing, error handling, re-initialization
- Helper functions: isSharedDatabaseInitialized, getSharedDatabaseRefCount

21 tests covering the singleton database connection pattern used to prevent
~900MB memory leaks per session.

Conceived by Romuald Członkowski - www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

src/http-server-single-session.ts

@@ -26,6 +26,7 @@ import {
 } from './utils/protocol-version';
 import { InstanceContext, validateInstanceContext } from './types/instance-context';
 import { SessionState } from './types/session-state';
+import { closeSharedDatabase } from './database/shared-database';
 
 dotenv.config();
 
@@ -106,7 +107,12 @@ export class SingleSessionHTTPServer {
   private session: Session | null = null;  // Keep for SSE compatibility
   private consoleManager = new ConsoleManager();
   private expressServer: any;
-  private sessionTimeout = 30 * 60 * 1000; // 30 minutes
+  // Session timeout reduced from 30 minutes to 5 minutes for faster cleanup
+  // Configurable via SESSION_TIMEOUT_MINUTES environment variable
+  // This prevents memory buildup from stale sessions
+  private sessionTimeout = parseInt(
+    process.env.SESSION_TIMEOUT_MINUTES || '5', 10
+  ) * 60 * 1000;
   private authToken: string | null = null;
   private cleanupTimer: NodeJS.Timeout | null = null;
   
@@ -492,6 +498,29 @@ export class SingleSessionHTTPServer {
           // For initialize requests: always create new transport and server
           logger.info('handleRequest: Creating new transport for initialize request');
 
+          // EAGER CLEANUP: Remove existing sessions for the same instance
+          // This prevents memory buildup when clients reconnect without proper cleanup
+          if (instanceContext?.instanceId) {
+            const sessionsToRemove: string[] = [];
+            for (const [existingSessionId, context] of Object.entries(this.sessionContexts)) {
+              if (context?.instanceId === instanceContext.instanceId) {
+                sessionsToRemove.push(existingSessionId);
+              }
+            }
+            for (const oldSessionId of sessionsToRemove) {
+              // Double-check session still exists (may have been cleaned by concurrent request)
+              if (!this.transports[oldSessionId]) {
+                continue;
+              }
+              logger.info('Cleaning up previous session for instance', {
+                instanceId: instanceContext.instanceId,
+                oldSession: oldSessionId,
+                reason: 'instance_reconnect'
+              });
+              await this.removeSession(oldSessionId, 'instance_reconnect');
+            }
+          }
+
           // Generate session ID based on multi-tenant configuration
           let sessionIdToUse: string;
 
@@ -1422,7 +1451,16 @@ export class SingleSessionHTTPServer {
         });
       });
     }
-    
+
+    // Close the shared database connection (only during process shutdown)
+    // This must happen after all sessions are closed
+    try {
+      await closeSharedDatabase();
+      logger.info('Shared database closed');
+    } catch (error) {
+      logger.warn('Error closing shared database:', error);
+    }
+
     logger.info('Single-Session HTTP server shutdown completed');
   }