fix(core): remove pending response entries on request timeout and cancellation

McpClientSession and McpServerSession left the pendingResponses entry in
place when the downstream timeout fired or the caller cancelled, so each
timed-out request leaked its entry forever (request IDs are unique).
Mirror the doOnError/doOnCancel cleanup the streamable session variant
already performs after .timeout(requestTimeout).

Fixes #1133

Author: Lubaoshuai

mcp-core/src/main/java/io/modelcontextprotocol/spec/McpClientSession.java

@@ -264,7 +264,10 @@ public <T> Mono<T> sendRequest(String method, Object requestParams, TypeRef<T> t
 				this.pendingResponses.remove(requestId);
 				pendingResponseSink.error(error);
 			});
-		})).timeout(this.requestTimeout).handle((jsonRpcResponse, deliveredResponseSink) -> {
+		})).timeout(this.requestTimeout)
+			.doOnError(e -> this.pendingResponses.remove(requestId))
+			.doOnCancel(() -> this.pendingResponses.remove(requestId))
+			.handle((jsonRpcResponse, deliveredResponseSink) -> {
 			if (jsonRpcResponse.error() != null) {
 				logger.info("Server returned a JSON-RPC error when calling method {}: {}", method,
 						jsonRpcResponse.error());

mcp-core/src/main/java/io/modelcontextprotocol/spec/McpServerSession.java

@@ -184,7 +184,10 @@ public <T> Mono<T> sendRequest(String method, Object requestParams, TypeRef<T> t
 				this.pendingResponses.remove(requestId);
 				sink.error(error);
 			});
-		}).timeout(requestTimeout).handle((jsonRpcResponse, sink) -> {
+		}).timeout(requestTimeout)
+			.doOnError(e -> this.pendingResponses.remove(requestId))
+			.doOnCancel(() -> this.pendingResponses.remove(requestId))
+			.handle((jsonRpcResponse, sink) -> {
 			if (jsonRpcResponse.error() != null) {
 				sink.error(new McpError(jsonRpcResponse.error()));
 			}

mcp-core/src/test/java/io/modelcontextprotocol/spec/McpClientSessionTests.java

@@ -303,4 +303,23 @@ void testGracefulShutdown() {
 		StepVerifier.create(session.closeGracefully()).verifyComplete();
 	}
 
+	@Test
+	void testRequestTimeoutRemovesPendingResponse() throws Exception {
+		var transport = new MockMcpClientTransport();
+		var session = new McpClientSession(Duration.ofMillis(50), transport, Map.of(), Map.of(),
+				Function.identity());
+
+		Mono<String> responseMono = session.sendRequest(TEST_METHOD, "test", responseType);
+
+		StepVerifier.create(responseMono).expectError(java.util.concurrent.TimeoutException.class).verify();
+
+		var field = McpClientSession.class.getDeclaredField("pendingResponses");
+		field.setAccessible(true);
+		@SuppressWarnings("unchecked")
+		var pendingResponses = (java.util.Map<Object, ?>) field.get(session);
+		assertThat(pendingResponses).isEmpty();
+
+		session.close();
+	}
+
 }