Gamah Gamerson 42cee6807d Http.RequestStreamAsync: stream the response instead of buffering it ...

RequestStreamAsync went through RequestAsync, which sends with the
default HttpCompletionOption.ResponseContentRead - so the whole body was
downloaded before the task resolved, and the "stream" handed back was
the buffer. A response that never ends (NDJSON, SSE, a chunked long
poll) therefore never resolved at all.

It also did `using var response`, disposing the response and with it the
content stream, before returning that stream to the caller. That second
bug hid the first: you could not read the stream far enough to notice
the buffering.

Send with ResponseHeadersRead and return a stream that owns the
HttpResponseMessage and disposes it with itself. RequestAsync's
signature is untouched, so no Sandbox.Access change is needed, and the
consumer side (System.IO.Stream.*, StreamReader) was already
whitelisted. Validation is unaffected: SboxHttpHandler runs
Http.IsAllowedAsync before every send, redirects included, all before
the headers come back.

WebTests.HttpStreamTest serves paced chunked NDJSON on localhost:8080 (a
port Http.IsAllowed accepts) and asserts the call returns before the
body ends, that the lines arrive spread across it rather than at once,
and that a non-2xx still throws.

2026-07-30 17:55:19 +01:00

..

Http.cs

…

HttpRedirectValidation.cs

…

HttpStream.cs

…

WebSurface.cs

…