fix: reject duplicate initialize requests in ServerSession

[devcrocod]

ServerSession.handleInitialize() now rejects duplicate initialize requests with INVALID_REQUEST (-32600) error. clientCapabilities and clientVersion changed from var to AtomicRef-backed val, with atomic compareAndSet(null, ...) serving as both the guard and the write

How Has This Been Tested?

second initialize returns error, original capabilities preserved

Breaking Changes

none

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[Copilot]

Pull request overview

This PR hardens the Kotlin server session initialization handshake by rejecting duplicate initialize requests and adds integration tests to validate the behavior (including concurrent initialization attempts).

Changes:

• Reject duplicate initialize requests in ServerSession.handleInitialize() with JSON-RPC INVALID_REQUEST (-32600).
• Make clientCapabilities and clientVersion read-only public properties backed by AtomicRef, using compareAndSet(null, ...) to atomically guard initialization.
• Add JVM integration tests for first/duplicate/concurrent initialize behavior; adjust an existing client integration test to use a separate transport pair.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSession.kt	Adds atomic initialization guard and returns INVALID_REQUEST on duplicate initialize.
integration-test/src/jvmTest/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSessionInitializeTest.kt	New tests covering first initialize success and duplicate/concurrent initialize rejection.
integration-test/src/commonTest/kotlin/io/modelcontextprotocol/kotlin/sdk/client/ClientTest.kt	Fixes test setup by using a new transport pair for a second client/server connection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This test claims to verify that capabilities from the first initialize are preserved, but both requests use the same default ClientCapabilities() and the assertion checks clientVersion instead. This can’t detect a regression where clientCapabilities gets overwritten—consider passing distinct capabilities per request and asserting session.clientCapabilities (or update the comment to match what’s being asserted).

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!