[remote-controlled-man]

What does this PR address?

Both HTTP clients fail to save a successful file response when its Content-Disposition filename contains directories. For example, filename="subdir/nested/document.pdf" is passed directly to NamedTemporaryFile(suffix=...), which raises FileNotFoundError instead of returning the download.

Keep only the filename's last component before creating the temporary file, handling both slash styles independently of the client OS. The temporary directory, randomized prefix, file bytes, and plain or absent filename behavior are preserved. This applies to synchronous and asynchronous downloads, including their shared task-result file response paths.

This follows the recipient guidance in RFC 6266 §4.3. #5533 fixed the analogous upload path in FileSchema.decode; this change covers the separate HTTP client response paths.

AI assistance was used for investigation, implementation, tests, and independent review.

Validation

• Regression tests exercise actual HTTP requests through the client action methods against a local ASGI application, without mocking the response parser or filesystem. The original synchronous and asynchronous directory-filename cases each reproduced FileNotFoundError before their respective fixes.
• 16 focused cases pass: relative and absolute paths, both slash styles, a Windows drive path, parent components, filename*, and plain/absent filename controls.
• Full unit suite: 315 passed, 5 skipped (macOS arm64 / Python 3.12.14, repository lockfile and SDK e2e requirements).
• Complete tests/e2e/bento_new_sdk suite: 9 passed.
• pre-commit run --all-files: passed; Buf hooks had no applicable files. git diff --check HEAD^ HEAD: passed.
• Both public clients (bentoml.SyncHTTPClient and bentoml.AsyncHTTPClient) downloaded matching bytes over a real local HTTP connection using the directory-containing response filename.
• Native Sphinx spelling build exited 0 with 60 warnings and 229 reported misspelled words. This is not a warning-free documentation build.
• make type still refers to the removed typecheck hook; typechecking was disabled upstream in #4113. No passing typecheck or cross-platform matrix result is claimed.

Before submitting

• Conventional Commits title.
• All-file pre-commit passed.
• Contribution and development guidelines reviewed.
• No documentation change required: corrects existing file download behavior.
• Regression tests added.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.