test(e2e): expect SdkHttpError after a second 401 from onUnauthorized

[claude]

Requested by Felix Weinberger · Slack thread

Follows #2934, which corrected the AuthProvider.onUnauthorized() docs.

Before: the e2e manifest recorded a second 401 after the onUnauthorized retry as surfacing as UnauthorizedError, and listed the real behaviour as a known failure.

After: the requirement says what the client does: a second 401 on the retry rejects with SdkHttpError (ClientHttpAuthentication); without onUnauthorized the 401 surfaces as UnauthorizedError. The scenario expects that and the known-failure entry is gone.

Motivation and Context

Keeps the e2e requirement registry consistent with the documented and implemented behaviour.

How Has This Been Tested?

client-auth scenario: all four cells of the requirement pass; coverage gates pass; typecheck and lint clean.

Breaking Changes

None. Test files only; no changeset.

Types of changes

• Bug fix
• New feature
• Breaking change
• Documentation/test update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

🤖 Generated with Claude Code

https://claude.ai/code/session_012VRbFCp41otcScXE1YY3es

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5f322a6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2936

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2936

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2936

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2936

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2936

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2936

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2936

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2936

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2936

commit: 5f322a6

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline note, I checked whether this silently redefines the requirement: the JSDoc on AuthProvider.onUnauthorized() (packages/client/src/client/auth.ts:88-92) and the transport (packages/client/src/client/streamableHttp.ts:1099-1107) both already specify SdkHttpError (ClientHttpAuthentication, status 401) on the post-retry 401 and UnauthorizedError only without onUnauthorized, so the manifest wording now matches shipped behavior rather than diverging from it. Also ruled out: the second rejects.toMatchObject on the same settled promise is fine (vitest re-awaits it), and status being a prototype getter on SdkHttpError is matched by toMatchObject since subset matching walks the prototype chain; no other knownFailures or coverage target references the old body title.

Extended reasoning...

The change touches only the e2e conformance suite (test/e2e/requirements.ts and test/e2e/scenarios/client-auth.test.ts): it rewords one manifest entry, removes its knownFailures record, and flips the matching scenario body from a test.fails() assertion of UnauthorizedError to a passing assertion of SdkHttpError. No SDK source changes; the asserted behavior matches the current JSDoc on AuthProvider.onUnauthorized() and the streamableHttp transport's auth-retry path. It exercises auth error surfacing in tests but modifies no auth code. Deferring rather than approving because the repo CODEOWNERS assigns all paths to the SDK team and I could not run the suite in this sandbox (no node_modules), so the passing claim rests on static reading.