fix(http-stream): prevent session destruction on transient errors

[QuantGeekDev]

Problem

Clients using Streamable HTTP transport (like Cline with vscode:// protocol) experience "Session not found" (-32001) errors after a session is established and working briefly. Other IDEs are unaffected because they don't trigger the specific conditions that cause session destruction.

{"jsonrpc":"2.0","error":{"code":-32001,"message":"Session not found"},"id":null}

Root Cause

Three bugs in HttpStreamTransport cause premature session destruction:

1. onerror callback destroys sessions on transient errors (Primary)

The SDK fires onerror for non-fatal issues (parse errors on a single malformed request, failed SSE writes during event replay). The framework's handler unconditionally deleted the session from _transports, permanently killing it. Any subsequent request → -32001.

2. Re-initialization with a stale session ID is rejected (Secondary)

After a session is lost, if the client sends a new initialize request while still including the old mcp-session-id header, the framework rejects it with 404 instead of creating a new session. The client is stuck.

3. Broadcast send() failures remove sessions

If transport.send() throws during a broadcast (e.g., no open SSE stream for a request ID), the session is permanently removed from the map.

Fix

1. onerror: Log the error but preserve the session. Only onclose (explicit DELETE or server shutdown) removes sessions.

2. Re-initialization: Detect initialize requests with stale/invalid session IDs and create a new session instead of rejecting with 404.

3. Broadcast: Log failures but preserve sessions for future requests.

Tests

6 new regression tests in server-session-resilience.test.ts:

• ✅ Session survives single onerror event
• ✅ Session survives multiple onerror events
• ✅ Re-initialization with stale session ID creates new session
• ✅ Non-initialize requests with unknown session IDs still get 404
• ✅ onclose still correctly removes sessions (DELETE behavior preserved)
• ✅ Broadcast send failures preserve sessions

Full suite: 179 tests passing (14 suites)