fix: address round-5 review comments on 401 edge cases

Three fixes from claude[bot] review:

1. _startOrAuthSse 405 return doesn't reset _authRetryInFlight —
   401 → onUnauthorized → retry → 405 would leave the flag set
   forever, disabling onUnauthorized for subsequent send() 401s.
   Added reset before the 405 return.

2. SSE onerror handler — when onUnauthorized rejects in the connect
   path, the error went through .then(resolve, reject) without
   calling this.onerror. Every other error path in both transports
   calls both. Added this.onerror?.() before reject.

3. 401 with no authProvider drained body twice — the 401 block
   ran unconditionally, drained at line 232/285/521, fell through
   (no authProvider = no throw), then the generic error handler
   drained again (empty) and produced 'HTTP 401: null'. Gated the
   entire 401 block on this._authProvider (matching pre-PR
   structure) so no-auth 401s hit the generic error directly with
   intact body text.

Author: felixweinberger

packages/client/src/client/sse.ts

@@ -154,7 +154,10 @@ export class SSEClientTransport implements Transport {
                         this._authProvider
                             .onUnauthorized({ response, serverUrl: this._url, fetchFn: this._fetchWithInit })
                             .then(() => this._startOrAuth())
-                            .then(resolve, reject)
+                            .then(resolve, error => {
+                                this.onerror?.(error);
+                                reject(error);
+                            })
                             .finally(() => {
                                 this._authRetryInFlight = false;
                             });
@@ -261,14 +264,14 @@ export class SSEClientTransport implements Transport {
 
             const response = await (this._fetch ?? fetch)(this._endpoint, init);
             if (!response.ok) {
-                if (response.status === 401) {
+                if (response.status === 401 && this._authProvider) {
                     if (response.headers.has('www-authenticate')) {
                         const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
                         this._resourceMetadataUrl = resourceMetadataUrl;
                         this._scope = scope;
                     }
 
-                    if (this._authProvider?.onUnauthorized && !this._authRetryInFlight) {
+                    if (this._authProvider.onUnauthorized && !this._authRetryInFlight) {
                         this._authRetryInFlight = true;
                         await this._authProvider.onUnauthorized({
                             response,
@@ -285,9 +288,7 @@ export class SSEClientTransport implements Transport {
                             status: 401
                         });
                     }
-                    if (this._authProvider) {
-                        throw new UnauthorizedError();
-                    }
+                    throw new UnauthorizedError();
                 }
 
                 const text = await response.text?.().catch(() => null);

packages/client/src/client/streamableHttp.ts

@@ -211,14 +211,14 @@ export class StreamableHTTPClientTransport implements Transport {
             });
 
             if (!response.ok) {
-                if (response.status === 401) {
+                if (response.status === 401 && this._authProvider) {
                     if (response.headers.has('www-authenticate')) {
                         const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
                         this._resourceMetadataUrl = resourceMetadataUrl;
                         this._scope = scope;
                     }
 
-                    if (this._authProvider?.onUnauthorized && !this._authRetryInFlight) {
+                    if (this._authProvider.onUnauthorized && !this._authRetryInFlight) {
                         this._authRetryInFlight = true;
                         await this._authProvider.onUnauthorized({
                             response,
@@ -235,16 +235,15 @@ export class StreamableHTTPClientTransport implements Transport {
                             status: 401
                         });
                     }
-                    if (this._authProvider) {
-                        throw new UnauthorizedError();
-                    }
+                    throw new UnauthorizedError();
                 }
 
                 await response.text?.().catch(() => {});
 
                 // 405 indicates that the server does not offer an SSE stream at GET endpoint
                 // This is an expected case that should not trigger an error
                 if (response.status === 405) {
+                    this._authRetryInFlight = false;
                     return;
                 }
 
@@ -500,15 +499,15 @@ export class StreamableHTTPClientTransport implements Transport {
             }
 
             if (!response.ok) {
-                if (response.status === 401) {
+                if (response.status === 401 && this._authProvider) {
                     // Store WWW-Authenticate params for interactive finishAuth() path
                     if (response.headers.has('www-authenticate')) {
                         const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
                         this._resourceMetadataUrl = resourceMetadataUrl;
                         this._scope = scope;
                     }
 
-                    if (this._authProvider?.onUnauthorized && !this._authRetryInFlight) {
+                    if (this._authProvider.onUnauthorized && !this._authRetryInFlight) {
                         this._authRetryInFlight = true;
                         await this._authProvider.onUnauthorized({
                             response,
@@ -525,9 +524,7 @@ export class StreamableHTTPClientTransport implements Transport {
                             status: 401
                         });
                     }
-                    if (this._authProvider) {
-                        throw new UnauthorizedError();
-                    }
+                    throw new UnauthorizedError();
                 }
 
                 const text = await response.text?.().catch(() => null);