feat(cli): p3 WasiHttpHooks route through ActHttpClient (full reqwest)

Wires the p3 hook to ActHttpClient::send_p3 and drops wasmtime-
wasi-http's default-send-request feature entirely. Both p2 and p3
now go through reqwest — no fallback.

Root cause of the earlier p3 trap: response bodies were wrapped in
http_body_util::StreamBody, which never overrides is_end_stream()
(always returns false). wasi-fetch guests traps when reading HTTP/2
responses because they rely on is_end_stream() to detect body
completion. HTTP/1.1 responses worked because the transfer-encoding
framing gives the guest another signal.

Fix: use reqwest::Body::from(response) as the response body source —
reqwest::Body delegates is_end_stream() to its hyper inner body,
matching what wasmtime-wasi-http's default IncomingResponseBody does.
Map errors with BodyExt::map_err, box as UnsyncBoxBody.

Also: strip transfer-encoding / content-length from forwarded
response headers — reqwest/hyper already consumed transport framing,
propagating the original hints can confuse the guest when bytes
re-frame through our pipeline.

wasmtime-wasi-http dep now uses default-features = false with
explicit [p2, p3] — drops the tokio-rustls / rustls /
webpki-roots transitive bundle from default-send-request.

Author: GamePad64

Cargo.lock

@@ -47,7 +47,7 @@ shellexpand = "3"
 wasmparser.workspace = true
 wasmtime = { version = "43", features = ["component-model", "component-model-async"] }
 wasmtime-wasi = { version = "43", features = ["p3"] }
-wasmtime-wasi-http = { version = "43", features = ["p3"] }
+wasmtime-wasi-http = { version = "43", default-features = false, features = ["p2", "p3"] }
 http = "1"
 http-body-util = "0.1"
 hyper = "1"

act-cli/Cargo.toml

@@ -292,17 +292,19 @@ async fn reqwest_response_to_p3(
     P3ErrorCode,
 > {
     let status = resp.status();
-    let version = resp.version();
-    let headers = resp.headers().clone();
-
-    let byte_stream = resp
-        .bytes_stream()
-        .map_ok(hyper::body::Frame::data)
-        .map_err(reqwest_to_p3_error);
+    let mut headers = resp.headers().clone();
+    headers.remove(http::header::TRANSFER_ENCODING);
+    headers.remove(http::header::CONTENT_LENGTH);
+
+    // Use reqwest::Body as the streaming source rather than bytes_stream +
+    // StreamBody. reqwest::Body implements http_body::Body with a correct
+    // `is_end_stream()` override (StreamBody always returns `false`, which
+    // confuses wasi-fetch guests into trapping mid-read on HTTP/2 responses).
+    let reqwest_body = reqwest::Body::from(resp);
     let body: UnsyncBoxBody<Bytes, P3ErrorCode> =
-        BodyExt::boxed_unsync(StreamBody::new(byte_stream));
+        BodyExt::boxed_unsync(BodyExt::map_err(reqwest_body, reqwest_to_p3_error));
 
-    let mut builder = http::Response::builder().status(status).version(version);
+    let mut builder = http::Response::builder().status(status);
     if let Some(hdrs) = builder.headers_mut() {
         hdrs.extend(headers);
     }

act-cli/src/runtime/http_client.rs

@@ -160,7 +160,7 @@ impl wasmtime_wasi_http::p3::WasiHttpHooks for PolicyHttpHooks {
         request: http::Request<
             http_body_util::combinators::UnsyncBoxBody<bytes::Bytes, P3ErrorCode>,
         >,
-        _options: Option<wasmtime_wasi_http::p3::RequestOptions>,
+        options: Option<wasmtime_wasi_http::p3::RequestOptions>,
         fut: Box<dyn Future<Output = Result<(), P3ErrorCode>> + Send>,
     ) -> Box<
         dyn Future<
@@ -182,6 +182,7 @@ impl wasmtime_wasi_http::p3::WasiHttpHooks for PolicyHttpHooks {
             Decision::Allow => {
                 tracing::debug!(?method, %uri, "http policy allow (p3)");
                 let _ = fut;
+                let _ = options;
                 let client = self.client.clone();
                 Box::new(async move {
                     match client.send_p3(request).await {