fix: call onerror callback for all error responses in StreamableHTTPServerTransport

Previously, many error paths in handlePostRequest, handleGetRequest, and
handleDeleteRequest would return JSON error responses without calling the
onerror callback, making these errors invisible to users who set up error
logging via transport.onerror.

This fix moves the onerror call into createJsonErrorResponse itself, ensuring
every error response consistently triggers the callback. Redundant manual
onerror calls before createJsonErrorResponse are removed to avoid double-firing.

Fixes #1395

Author: kai-agent-free

packages/server/src/server/streamableHttp.ts

@@ -287,6 +287,7 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
         options?: { headers?: Record<string, string>; data?: string }
     ): Response {
         const error: { code: number; message: string; data?: string } = { code, message };
+        this.onerror?.(new Error(message));
         if (options?.data !== undefined) {
             error.data = options.data;
         }
@@ -321,7 +322,6 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
             const hostHeader = req.headers.get('host');
             if (!hostHeader || !this._allowedHosts.includes(hostHeader)) {
                 const error = `Invalid Host header: ${hostHeader}`;
-                this.onerror?.(new Error(error));
                 return this.createJsonErrorResponse(403, -32_000, error);
             }
         }
@@ -331,7 +331,6 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
             const originHeader = req.headers.get('origin');
             if (originHeader && !this._allowedOrigins.includes(originHeader)) {
                 const error = `Invalid Origin header: ${originHeader}`;
-                this.onerror?.(new Error(error));
                 return this.createJsonErrorResponse(403, -32_000, error);
             }
         }
@@ -554,7 +553,6 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
 
             return new Response(readable, { headers });
         } catch (error) {
-            this.onerror?.(error as Error);
             return this.createJsonErrorResponse(500, -32_000, 'Error replaying events');
         }
     }
@@ -807,7 +805,6 @@ export class WebStandardStreamableHTTPServerTransport implements Transport {
             return new Response(readable, { status: 200, headers });
         } catch (error) {
             // return JSON-RPC formatted error
-            this.onerror?.(error as Error);
             return this.createJsonErrorResponse(400, -32_700, 'Parse error', { data: String(error) });
         }
     }

packages/server/test/server/streamableHttp.test.ts

@@ -765,4 +765,84 @@ describe('Zod v4', () => {
             await expect(transport.start()).rejects.toThrow('Transport already started');
         });
     });
+
+    describe('HTTPServerTransport - onerror callback', () => {
+        let transport: WebStandardStreamableHTTPServerTransport;
+        let errors: Error[];
+
+        beforeEach(async () => {
+            transport = new WebStandardStreamableHTTPServerTransport({
+                sessionIdGenerator: () => randomUUID()
+            });
+            errors = [];
+            transport.onerror = (error) => errors.push(error);
+            await transport.start();
+        });
+
+        it('should call onerror for invalid Accept header on POST', async () => {
+            const request = createRequest('POST', TEST_MESSAGES.initialize, { accept: 'application/json' });
+            const response = await transport.handleRequest(request);
+
+            expect(response.status).toBe(406);
+            expect(errors.length).toBe(1);
+            expect(errors[0].message).toMatch(/Not Acceptable/);
+        });
+
+        it('should call onerror for invalid Content-Type on POST', async () => {
+            const request = new Request('http://localhost/mcp', {
+                method: 'POST',
+                headers: {
+                    Accept: 'application/json, text/event-stream',
+                    'Content-Type': 'text/plain'
+                },
+                body: JSON.stringify(TEST_MESSAGES.initialize)
+            });
+            const response = await transport.handleRequest(request);
+
+            expect(response.status).toBe(415);
+            expect(errors.length).toBe(1);
+            expect(errors[0].message).toMatch(/Unsupported Media Type/);
+        });
+
+        it('should call onerror for invalid JSON on POST', async () => {
+            const request = new Request('http://localhost/mcp', {
+                method: 'POST',
+                headers: {
+                    Accept: 'application/json, text/event-stream',
+                    'Content-Type': 'application/json'
+                },
+                body: 'not valid json'
+            });
+            const response = await transport.handleRequest(request);
+
+            expect(response.status).toBe(400);
+            expect(errors.length).toBe(1);
+            expect(errors[0].message).toMatch(/Parse error/);
+        });
+
+        it('should call onerror for invalid JSON-RPC message on POST', async () => {
+            const request = new Request('http://localhost/mcp', {
+                method: 'POST',
+                headers: {
+                    Accept: 'application/json, text/event-stream',
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({ not: 'a jsonrpc message' })
+            });
+            const response = await transport.handleRequest(request);
+
+            expect(response.status).toBe(400);
+            expect(errors.length).toBe(1);
+            expect(errors[0].message).toMatch(/Parse error.*Invalid JSON-RPC/);
+        });
+
+        it('should call onerror for invalid Accept header on GET', async () => {
+            const request = createRequest('GET', undefined, { accept: 'application/json' });
+            const response = await transport.handleRequest(request);
+
+            expect(response.status).toBe(406);
+            expect(errors.length).toBe(1);
+            expect(errors[0].message).toMatch(/Not Acceptable/);
+        });
+    });
 });