fix: gh-106749 healing checkpoints at remaining throw sites; anyio>=4.10 on 3.14

The BaseSession.__aexit__ checkpoint only heals throws at or before
session exit. Under xdist per-worker test ordering, the unmasked
victims sit after later cancel-scope sites: client/streamable_http.py,
client/sse.py, client/websocket.py, server/streamable_http_manager.py
(finally-cancel after task-group join), and
shared/memory.py:create_client_server_memory_streams (heals
caller-driven cancels). Same shielded-checkpoint pattern at each. Also
updated the _memory.py comment to reference the new memory.py heal.

3.14 lowest-direct: anyio 4.9.0 from_thread.py has return-in-finally
which Python 3.14 (PEP 765) warns about at compile time; the warning
lands in the stdio test child stderr. Fixed in anyio 4.10
(agronholm/anyio#816); marker-split the floor (locked already has
4.10).

Author: maxisbey

pyproject.toml

@@ -25,7 +25,11 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-    "anyio>=4.9",
+    # anyio < 4.10 triggers a compile-time SyntaxWarning on Python 3.14 (PEP 765,
+    # "'return' in a 'finally' block"); for stdio servers it lands on the child's
+    # stderr (agronholm/anyio#816, fixed in 4.10).
+    "anyio>=4.10; python_version >= '3.14'",
+    "anyio>=4.9; python_version < '3.14'",
     "httpx>=0.27.1,<1.0.0",
     "httpx-sse>=0.4",
     "pydantic>=2.12.0",

src/mcp/client/_memory.py

@@ -87,7 +87,9 @@ async def _run_server() -> None:
                     # completes the join would hang forever, so bound the wait
                     # and fall back to cancelling. The healthy path returns
                     # from wait() without the timeout firing, so the cancel is
-                    # never reached and gh-106749 stays avoided.
+                    # never reached and gh-106749 stays avoided. If the cancel
+                    # does fire, the checkpoint at the end of
+                    # `create_client_server_memory_streams` resyncs the tracer.
                     with anyio.move_on_after(SERVER_SHUTDOWN_GRACE):
                         await server_done.wait()
                     if not server_done.is_set():

src/mcp/client/sse.py

@@ -5,6 +5,7 @@
 from urllib.parse import parse_qs, urljoin, urlparse
 
 import anyio
+import anyio.lowlevel
 import httpx
 from anyio.abc import TaskStatus
 from httpx_sse import SSEError, aconnect_sse
@@ -157,3 +158,10 @@ async def _send_message(session_message: SessionMessage) -> None:
 
                 yield read_stream, write_stream
                 tg.cancel_scope.cancel()
+            # The cancel above is delivered via `coro.throw()` into this task at
+            # the task-group join; on CPython 3.11 (gh-106749) that drops `'call'`
+            # trace events for the outer await chain and desyncs coverage's CTracer
+            # past the caller's frame. Yielding once here resumes via `.send()`,
+            # which re-stamps the missing `'call'` events and resyncs the tracer.
+            # Shielded so a pending outer cancel is not re-delivered at this point.
+            await anyio.lowlevel.cancel_shielded_checkpoint()

src/mcp/client/streamable_http.py

@@ -9,6 +9,7 @@
 from dataclasses import dataclass
 
 import anyio
+import anyio.lowlevel
 import httpx
 from anyio.abc import TaskGroup
 from httpx_sse import EventSource, ServerSentEvent, aconnect_sse
@@ -586,3 +587,10 @@ def start_get_stream() -> None:
                 if transport.session_id and terminate_on_close:
                     await transport.terminate_session(client)
                 tg.cancel_scope.cancel()
+        # The cancel above is delivered via `coro.throw()` into this task at
+        # the task-group join; on CPython 3.11 (gh-106749) that drops `'call'`
+        # trace events for the outer await chain and desyncs coverage's CTracer
+        # past the caller's frame. Yielding once here resumes via `.send()`,
+        # which re-stamps the missing `'call'` events and resyncs the tracer.
+        # Shielded so a pending outer cancel is not re-delivered at this point.
+        await anyio.lowlevel.cancel_shielded_checkpoint()

src/mcp/client/websocket.py

@@ -3,6 +3,7 @@
 from contextlib import asynccontextmanager
 
 import anyio
+import anyio.lowlevel
 from anyio.streams.memory import MemoryObjectReceiveStream, MemoryObjectSendStream
 from pydantic import ValidationError
 from websockets.asyncio.client import connect as ws_connect
@@ -83,3 +84,10 @@ async def ws_writer():
 
             # Once the caller's 'async with' block exits, we shut down
             tg.cancel_scope.cancel()
+        # The cancel above is delivered via `coro.throw()` into this task at
+        # the task-group join; on CPython 3.11 (gh-106749) that drops `'call'`
+        # trace events for the outer await chain and desyncs coverage's CTracer
+        # past the caller's frame. Yielding once here resumes via `.send()`,
+        # which re-stamps the missing `'call'` events and resyncs the tracer.
+        # Shielded so a pending outer cancel is not re-delivered at this point.
+        await anyio.lowlevel.cancel_shielded_checkpoint()

src/mcp/server/streamable_http_manager.py

@@ -9,6 +9,7 @@
 from uuid import uuid4
 
 import anyio
+import anyio.lowlevel
 from anyio.abc import TaskStatus
 from starlette.requests import Request
 from starlette.responses import Response
@@ -139,6 +140,13 @@ async def lifespan(app: Starlette) -> AsyncIterator[None]:
                 # Clear any remaining server instances
                 self._server_instances.clear()
                 self._session_owners.clear()
+        # The cancel above is delivered via `coro.throw()` into this task at
+        # the task-group join; on CPython 3.11 (gh-106749) that drops `'call'`
+        # trace events for the outer await chain and desyncs coverage's CTracer
+        # past the caller's frame. Yielding once here resumes via `.send()`,
+        # which re-stamps the missing `'call'` events and resyncs the tracer.
+        # Shielded so a pending outer cancel is not re-delivered at this point.
+        await anyio.lowlevel.cancel_shielded_checkpoint()
 
     async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> None:
         """Process ASGI request with proper session handling and transport setup.

src/mcp/shared/memory.py

@@ -5,6 +5,8 @@
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 
+import anyio.lowlevel
+
 from mcp.shared._context_streams import ContextReceiveStream, ContextSendStream, create_context_streams
 from mcp.shared.message import SessionMessage
 
@@ -28,3 +30,11 @@ async def create_client_server_memory_streams() -> AsyncGenerator[tuple[MessageS
 
     async with server_to_client_receive, client_to_server_send, client_to_server_receive, server_to_client_send:
         yield client_streams, server_streams
+    # Callers routinely cancel a task group wrapped around these streams just
+    # before this context exits; that cancel is delivered via `coro.throw()`,
+    # which on CPython 3.11 (gh-106749) drops `'call'` trace events for the
+    # outer await chain and desyncs coverage's CTracer past the caller's frame.
+    # Closing memory streams never suspends, so this is the last chance to
+    # resync: yielding once resumes via `.send()`, which re-stamps the missing
+    # `'call'` events. Shielded so a pending outer cancel is not re-delivered.
+    await anyio.lowlevel.cancel_shielded_checkpoint()