Use HTTP transport for browser dotnettestcli

[Evangelink]

Summary

Uses authenticated HTTP request/reply as the browser-compatible transport for --server dotnettestcli, replacing the WebSocket implementation from #10118 while preserving the existing versioned binary serializer/message contract and legacy --dotnet-test-pipe <name> behavior.

The primary channel is entirely host-initiated request/reply. Each existing framed host request becomes one authenticated binary HTTP POST, and the response body contains exactly one existing framed reply. Exactly one request is allowed in flight, preserving protocol ordering without polling, SSE, redirects, or retries.

Merge order

#10149 is the focused revert of the WebSocket implementation from #10118. This HTTP branch was implemented independently from the WebSocket branch, so it is expected to report conflicts while #10118 remains on main.

1. Merge Revert WebSocket transport for browser-wasm dotnettestcli #10149.
2. Re-evaluate this PR against the resulting main.
3. Merge this HTTP implementation.

Do not merge this PR before #10149.

Bootstrap

Hidden pre-launch options:

--dotnet-test-transport http
--dotnet-test-http-endpoint <absolute-uri>
--dotnet-test-http-token <per-run-bearer-token>

--dotnet-test-transport pipe is also accepted explicitly. Omitting the transport continues to infer the legacy named-pipe path from --dotnet-test-pipe.

SDK HTTP gateway contract

For every host-initiated protocol interaction, the SDK gateway accepts:

POST <per-run-endpoint>
Authorization: Bearer <per-run-token>
Content-Type: application/octet-stream

<one complete existing dotnettestcli frame>

A successful response must be 2xx, use Content-Type: application/octet-stream, and contain exactly one complete existing dotnettestcli frame. The frame remains the existing little-endian length prefix, serializer ID, and versioned serializer payload; no serializer IDs, field IDs, layouts, or supported protocol versions change.

The gateway must:

• create an unguessable endpoint/token pair per run and reject unauthorized requests;
• never log the token or expose it through errors;
• process requests in arrival order and return exactly one reply per request;
• avoid retries and redirects because an ambiguous replay could duplicate a protocol message;
• support browser CORS preflight for the application origin, POST, Authorization, and Content-Type;
• support applicable Private Network Access preflight when a public/secure origin targets a loopback or private-network gateway;
• use HTTPS except for loopback development endpoints.

HTTP has no persistent disconnect signal: loss is detected by the current or next POST. SDK-initiated reverse control (ServerControlPipeName, currently cancellation) remains named-pipe-only and outside this primary-channel change.

Why HTTP

Area	HTTP request/reply	WebSocket
Product browser code	Ordinary .NET HttpClient/fetch; no custom JavaScript transport	Persistent WebSocket lifecycle and browser-specific JS interop
SDK gateway	Conventional authenticated request/reply endpoint	WebSocket upgrade, socket/session state, and frame routing
Browser policy	CORS and potentially PNA preflight	Origin/network policy plus WebSocket upgrade support
Overhead	HTTP dispatch and headers per interaction	Lower per-message overhead after one persistent upgrade
Disconnect detection	Current or next request	Immediate close/error signal
Future reverse traffic	Requires a separate design	Persistent duplex channel is naturally more flexible

The current protocol only needs host-initiated request/reply. HTTP therefore delivers the required behavior with substantially less permanent browser-specific code, a bearer header instead of a URL token, and no wire-version change. The accepted tradeoffs are per-request overhead, CORS/PNA requirements, and weaker idle disconnect detection.

Safety and review hardening

• Validates endpoint scheme and loopback rules; rejects credentials, query strings, and fragments.
• Redacts tokens and endpoint paths/user-info from diagnostics, including repeated or malformed sensitive-option sequences.
• Disables automatic redirects on desktop and browser handlers so authenticated frames are never replayed.
• Requires application/octet-stream responses before frame decoding.
• Validates response framing, size limits (including chunked responses), response count/type, cancellation, disposal, and connection failures.
• Adds browser/WASI named-pipe guards without changing desktop named-pipe behavior.
• Keeps hidden help/info expectations, localization, API baselines, and protocol documentation aligned.

All review comments through commit 1af0d2098 are addressed and replied to.

Validation

• DotnetTestHttpClientTests: 16/16 passed.
• CommandLineArgumentsRedactorTests: 7/7 passed.
• Combined review regression slice: 23/23 passed.
• PlatformCommandLineProviderTests: 100/100 passed.
• BrowserWasmExecution_DotnetTestHttpTransportExercisesLiveGateway: passed under Node/browser-wasm, covering handshake, help, discovery, execution/session traffic, bearer auth, framing, ordering, unauthorized response, disconnect, and cancellation.
• Help/info acceptance slice: 30/30 passed.
• Legacy DotnetTestPipeBaselineTests: 5/5 passed.
• .\build.cmd -pack -bl /p:RepositoryCommit=a467c796c566b855eb645d6752eedbc00f8204de: succeeded with 0 warnings and 0 errors; produced packages passed content and metadata validation.

[Copilot]

Pull request overview

Adds an authenticated HTTP transport for the dotnettestcli protocol, enabling browser-WASM while preserving binary framing and named-pipe compatibility.

Changes:

• Adds HTTP request/reply transport, bootstrap validation, and diagnostic redaction.
• Adds unit and browser-WASM gateway coverage.
• Updates protocol documentation, resources, help expectations, and API baselines.

Show a summary per file

File	Description
test/UnitTests/Microsoft.Testing.Platform.UnitTests/Microsoft.Testing.Platform.UnitTests.csproj	Links HTTP transport into supported test targets.
test/UnitTests/Microsoft.Testing.Platform.UnitTests/IPC/DotnetTestHttpClientTests.cs	Tests HTTP framing, authentication, ordering, and failures.
test/UnitTests/Microsoft.Testing.Platform.UnitTests/CommandLine/PlatformCommandLineProviderTests.cs	Tests transport option validation.
test/UnitTests/Microsoft.Testing.Platform.UnitTests/CommandLine/CommandLineArgumentsRedactorTests.cs	Tests token and endpoint redaction.
test/IntegrationTests/Microsoft.Testing.Platform.Acceptance.IntegrationTests/HelpInfoTests.cs	Updates hidden option expectations.
test/IntegrationTests/Microsoft.Testing.Platform.Acceptance.IntegrationTests/HelpInfoAllExtensionsTests.cs	Updates all-extension option expectations.
test/IntegrationTests/Microsoft.Testing.Platform.Acceptance.IntegrationTests/BrowserWasmExecutionTests.cs	Adds live browser-WASM HTTP gateway scenarios.
src/Platform/Microsoft.Testing.Platform/ServerMode/DotnetTest/Transport/DotnetTestHttpClient.cs	Implements authenticated HTTP request/reply transport.
src/Platform/Microsoft.Testing.Platform/ServerMode/DotnetTest/IPC/DotnetTestDataConsumer.cs	Enables browser-compatible consumption.
src/Platform/Microsoft.Testing.Platform/ServerMode/DotnetTest/DotnetTestHelper.cs	Resolves selected transport.
src/Platform/Microsoft.Testing.Platform/ServerMode/DotnetTest/DotnetTestConnection.cs	Integrates HTTP and guards named-pipe operations.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.zh-Hant.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.zh-Hans.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.tr.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.ru.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.pt-BR.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.pl.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.ko.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.ja.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.it.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.fr.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.es.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.de.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/xlf/PlatformResources.cs.xlf	Adds localized resource entries.
src/Platform/Microsoft.Testing.Platform/Resources/PlatformResources.resx	Defines transport messages and descriptions.
src/Platform/Microsoft.Testing.Platform/Resources/PlatformResources.cs	Exposes new resources to tests.
src/Platform/Microsoft.Testing.Platform/OutputDevice/DotnetTestPassthroughOutputDevice.cs	Removes obsolete browser suppressions.
src/Platform/Microsoft.Testing.Platform/IPC/NamedPipeConnectionBase.cs	Generalizes framing to streams and adds size limits.
src/Platform/Microsoft.Testing.Platform/InternalAPI/InternalAPI.Unshipped.txt	Tracks new and changed internal APIs.
src/Platform/Microsoft.Testing.Platform/CommandLine/PlatformCommandLineProvider.cs	Registers and validates HTTP bootstrap options.
src/Platform/Microsoft.Testing.Platform/CommandLine/CommandLineArgumentsRedactor.cs	Redacts sensitive bootstrap arguments.
src/Platform/Microsoft.Testing.Platform/Builder/TestApplication.cs	Uses redaction for diagnostic logging.
src/Platform/Microsoft.Testing.Extensions.TrxReport/InternalAPI/InternalAPI.Unshipped.txt	Tracks shared framing API changes.
src/Platform/Microsoft.Testing.Extensions.Retry/InternalAPI/InternalAPI.Unshipped.txt	Tracks shared framing API changes.
src/Platform/Microsoft.Testing.Extensions.MSBuild/InternalAPI.Unshipped.txt	Tracks shared framing API changes.
src/Platform/Microsoft.Testing.Extensions.HangDump/InternalAPI/InternalAPI.Unshipped.txt	Tracks shared framing API changes.
docs/mstest-runner-protocol/004-protocol-dotnet-test-pipe.md	Documents HTTP transport and gateway contract.

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 3
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (2)

src/Platform/Microsoft.Testing.Platform/ServerMode/DotnetTest/Transport/DotnetTestHttpClient.cs:134

• On netstandard2.0 consumers, HttpResponseMessage.Content can be null. A valid 2xx response with no body therefore throws NullReferenceException here instead of the transport's expected IOException for a missing content type/frame. Read the media type null-safely so an absent body follows the existing validation error path.

            if (!MediaType.Equals(httpResponse.Content.Headers.ContentType?.MediaType, StringComparison.OrdinalIgnoreCase))
            {
                throw new IOException(
                    $"The dotnet test HTTP gateway returned content type '{httpResponse.Content.Headers.ContentType?.MediaType ?? "missing"}' instead of '{MediaType}'.");
            }

src/Platform/Microsoft.Testing.Platform/CommandLine/CommandLineArgumentsRedactor.cs:49

• A bearer token may validly begin with -, but this branch treats such a separate argument as an unrelated option and logs it verbatim. Logging occurs before command-line validation, so --dotnet-test-http-token -secret exposes the token even though parsing later rejects the launch. When a sensitive value is pending, fail closed by redacting an unrecognized option-shaped argument; only recognized sensitive options should replace the pending state.

                else
                {
                    redacted[i] = arg;
                    redactNextValue = false;
                    sanitizeNextEndpoint = false;
                }

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Evangelink]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved and pushed in commit 56e353d.

[Copilot]

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 2
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 2
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 41/41 changed files
• Comments generated: 2
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 41/41 changed files
• Comments generated: 1
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 43/43 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (1)

src/Platform/Microsoft.Testing.Platform/CommandLine/Parser.cs:56

• A response-file path after a malformed sensitive option still leaks. For example, ---dotnet-test-http-token @secret-token leaves currentOption null, so the response-file error reports secret-token verbatim even though the argument redactor recognizes this sequence as sensitive. Derive the diagnostic path from the redacted argument sequence so malformed/leading-whitespace sensitive options are covered too.

                bool containsSensitiveValue =
                    PlatformCommandLineProvider.DotNetTestHttpTokenOptionKey.Equals(currentOption, StringComparison.OrdinalIgnoreCase)
                    || PlatformCommandLineProvider.DotNetTestHttpEndpointOptionKey.Equals(currentOption, StringComparison.OrdinalIgnoreCase);
                string diagnosticPath = containsSensitiveValue ? "***REDACTED***" : responseFilePath;

• Files reviewed: 43/43 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 43/43 changed files
• Comments generated: 0 new
• Review effort level: Medium

[Copilot]

Review details

• Files reviewed: 43/43 changed files
• Comments generated: 0 new
• Review effort level: Medium

[github-actions]

🧪 Test quality grade — PR #10143

45 new test methods graded across 5 files. Every test grades A (90–100). The suite demonstrates exceptional quality: meaningful DataRow parameterization covering security-relevant boundary cases, precise AreEqual/Contains/DoesNotContain assertion pairs that verify both presence of safe output and absence of sensitive data, exact error-message equality checks, and well-targeted exception-type assertions. The DotnetTestHttpClientTests concurrency tests are particularly thorough, capturing active-request counts, IsConnected state, and queued-waiter cancellation behavior. No meaningful mutations survive in any test.

Grade	Test	Mutation	Notes	How to improve
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MasksToken	3/3 killed	DataRow covers separator shapes (space, =, :); exact equality assertion kills inline-vs-positional mutations.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ RemovesEndpointPathAndPreservesOtherArguments	4/4 killed	Full composed-string equality verifies path stripping and that non-sensitive args are preserved.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ RepeatedTokenOptionDoesNotExposeValue	2/2 killed	Edge case where the token-option name appears as the next arg; exact equality kills option-as-value confusion mutations.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ OptionShapedTokenValueDoesNotExposeValue	2/2 killed	Verifies option-shaped value ("-secret") is treated as a positional value and redacted.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ OptionShapedEndpointValueDoesNotExposeValue	2/2 killed	Verifies endpoint option-shaped value is redacted, not parsed as an option name.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MalformedSensitiveOptionPrefixDoesNotExposeValue	4/4 killed	DataRow covers triple-dash and leading-space malformed prefixes for both token and endpoint.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MasksEveryPositionalSensitiveValueUntilNextOption	4/4 killed	Multi-arg scenario; exact full-string equality kills any off-by-one in multi-value scanning.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MasksEmptyInlineSensitiveValue	2/2 killed	DataRow covers empty inline value for both token and endpoint options.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MasksExcessValuesAfterInlineSensitiveValue	4/4 killed	Exact equality verifies that positional excess values after an inline value are also redacted.	—
A (90–100)	new CommandLineArgumentsRedactorTests. Redact_ MasksInvalidOrCredentialedEndpoint	2/2 killed	DataRow for non-URL and credentialed endpoint both produce full redaction.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ InvalidCommandLineRedactsHttpTransportSecrets	4/4 killed	IsFalse + Contains(safe) + DoesNotContain(sensitive×2) kills redaction-bypass and path-strip mutations end-to-end.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ ParserErrorsRedactHttpTransportSecrets	4/4 killed	DataRow for token and endpoint parser errors; Contains(REDACTED) + DoesNotContain(sensitive) covers both axes.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ MalformedSensitiveOptionPrefixIsRedacted	4/4 killed	DataRow covers malformed-prefix token and endpoint; checks both safe fragment presence and sensitive absence.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ SeparatedMalformedSensitiveOptionValueIsRedacted	4/4 killed	DataRow 4 cases covering triple-dash separated form for both token and endpoint.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ LeadingWhitespaceSensitiveOptionIsRedacted	4/4 killed	DataRow 4 cases for leading-whitespace option form; safe+sensitive containment assertions.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ ResponseFileParserErrorsRedactExpandedSensitiveValues	4/4 killed	Writes temp file with malformed sensitive arg, validates redaction in parser error path.	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ ResponseFileErrorsRedactSensitivePath	4/4 killed	DataRow 6 cases across normal/malformed/leading-space option forms; Contains(REDACTED) + DoesNotContain(path).	—
A (90–100)	new CommandLineHandlerTests. ParseAndValidateAsync_ ResponseFileAccessErrorsRedactSensitivePath	2/2 killed	Creates real temp dir, verifies dir-path is not leaked in error; DataRow for token and endpoint options.	—
A (90–100)	new PlatformCommandLineProviderTests. IsValid_ When_ Server_ DotnetTestCli_ With_ HttpTransport	2/2 killed	Verifies all four HTTP options together pass validation; IsTrue kills any mutation that makes it invalid.	—
A (90–100)	new PlatformCommandLineProviderTests. IsValid_ When_ DotnetTestTransport_ HasAcceptedArgument	3/3 killed	DataRow("pipe","http","HTTP") covers case-insensitivity and both transport values.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ DotnetTestTransport_ HasUnknownArgument	2/2 killed	IsFalse + Contains("websocket") kills both the validity flip and the error-message content.	—
A (90–100)	new PlatformCommandLineProviderTests. DotnetTestHttpEndpoint_ ValidatesSecurityRequirements	9/9 killed	DataRow 9 cases covering http vs https, localhost/IP vs external, userinfo, query, fragment, and scheme; AreEqual(expectedValid) kills each branch.	—
A (90–100)	new PlatformCommandLineProviderTests. DotnetTestHttpToken_ ValidatesBearerSyntax	6/6 killed	DataRow 6 cases for valid token and whitespace/header-injection/comma variants; AreEqual(expectedValid) kills each.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ HttpTransport_ IsIncomplete	4/4 killed	DataRow(true,false) varies server flag; IsFalse + AreEqual(exact error message) kills both paths.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ HttpOptionHasNoHttpTransport	4/4 killed	DataRow for endpoint and token options; IsFalse + AreEqual(exact message) kills both variations.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ HttpAndPipeTransportsAreCombined	2/2 killed	IsFalse + AreEqual(exact conflict message) verifies the mutual-exclusion rule precisely.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ ExplicitPipeTransportHasNoPipeName	3/3 killed	DataRow(null,dotnettestcli,jsonrpc) with AreEqual on the formatted error message kills all server-protocol variations.	—
A (90–100)	new PlatformCommandLineProviderTests. IsInvalid_ When_ Server_ DotnetTestCli_ Without_ DotnetTestPipe	4/4 killed	DataRow("dotnettestcli","DotnetTestCli") verifies case-insensitivity; AreEqual(exact message).	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ PostsFullFrameWithBearerAuthentication	5/5 killed	Checks frame length prefix, serializer ID bytes, Bearer scheme, token value, and content-type — kills any wire-format mutation.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ SerializesConcurrentRequests	4/4 killed	Verifies maximumActiveRequests=1 and count=2; kills any concurrency relaxation mutation.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ PropagatesCancellation	2/2 killed	ThrowsExactlyAsync(TaskCanceledException) with 100ms CTS; kills swallowed-cancellation mutations.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ CancellationDoesNotAllowOverlappingSend	5/5 killed	Active and waiting tasks both throw OperationCanceled; count=1; IsConnected=false after cancel.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ ResponseBodyCancellationDoesNotAllowOverlappingSend	5/5 killed	Cancellation during body-read path: both tasks cancel, count=1, IsConnected=false.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ FailureCancelsQueuedRequest	5/5 killed	Active throws IOException on 401; queued waiter throws OperationCanceled; count=1; IsConnected=false.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ UsesCallerCancellationInsteadOfHttpClientTimeout	2/2 killed	100ms delay with 10ms HttpClient timeout; AreSame(expected response) confirms timeout is not honored.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ DisposeCancelsActiveRequestAndWaiter	2/2 killed	Both active and waiting tasks throw OperationCanceled after Dispose.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsInvalidChunkedFramePayloadLength	4/4 killed	DataRow(-1,0,3,MaxValue); ThrowsExactlyAsync(IOException) + Contains("invalid frame payload length").	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsNonSuccessWithoutLeakingToken	3/3 killed	ThrowsExactlyAsync(IOException) + Contains("401") + DoesNotContain(Token) kills error-format and token-leak mutations.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsRedirectResponses	2/2 killed	DataRow(TemporaryRedirect, PermanentRedirect); ThrowsExactlyAsync(IOException) + Contains(status code string).	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsUnexpectedResponseContentType	3/3 killed	DataRow(null,"text/plain","application/..."); Contains("content type") + conditional Contains kills each branch.	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsMissingResponseContent	2/2 killed	Null content: ThrowsExactlyAsync(IOException) + Contains("no content type").	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RejectsMissingOrMultipleResponseFrames	2/2 killed	DataRow(false,true) for 0 and 2 frames; Contains conditional on "more than one" vs "invalid response frame length".	—
A (90–100)	new DotnetTestHttpClientTests. RequestReplyAsync_ RequiresConnectAndRejectsUseAfterDispose	4/4 killed	ThrowsExactlyAsync(InvalidOperationException) before connect and (ObjectDisposedException) after dispose.	—
A (90–100)	new CurrentTestApplicationModuleInfoTests. ExecutableInfo_ ToStringRedactsHttpTransportSecrets	4/4 killed	Contains(safe host) + Contains(REDACTED) + DoesNotContain(path) + DoesNotContain(token) — all four axes checked.	—
A (90–100)	new BrowserWasmExecutionTests. BrowserWasmExecution_ DotnetTestHttpTransportExercisesLiveGateway	N/A	Six end-to-end scenarios (help/discover/run/unauthorized/disconnect/cancel) with rich assertions per scenario.	—

_{This advisory comment was generated automatically. Grades are heuristic and informational — they do not block merging. Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Generated by the Grade Tests on PR (on open / sync) workflow. · sonnet46 243.3 AIC · ⌖ 6.38 AIC · ⊞ 10.3K · [◷]( · ◷)