agentskills-http 0.2.1__tar.gz → 0.2.3__tar.gz

{agentskills_http-0.2.1 → agentskills_http-0.2.3}/PKG-INFO

@@ -1,17 +1,16 @@
 Metadata-Version: 2.4
 Name: agentskills-http
-Version: 0.2.1
+Version: 0.2.3
 Summary: HTTP-based skill providers for the Agent Skills format (https://agentskills.io)
 License: MIT
 Author: Pratik Panda
-Requires-Python: >=3.12,<4.0
+Requires-Python: >=3.12,<3.14
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries
 Requires-Dist: agentskills-core (>=0.1.0,<1.0)
 Requires-Dist: httpx (>=0.27,<1.0)
@@ -23,12 +22,12 @@ Description-Content-Type: text/markdown
 # agentskills-http
 
 [![PyPI](https://img.shields.io/pypi/v/agentskills-http)](https://pypi.org/project/agentskills-http/)
-[![Python 3.12+](https://img.shields.io/pypi/pyversions/agentskills-http)](https://pypi.org/project/agentskills-http/)
+[![Python 3.12 | 3.13](https://img.shields.io/pypi/pyversions/agentskills-http)](https://pypi.org/project/agentskills-http/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/pratikxpanda/agentskills-sdk/blob/main/LICENSE)
 
 > HTTP static-file skill provider for the [Agent Skills SDK](../../README.md).
 
-Serves [Agent Skills](https://agentskills.io) from any static HTTP file host — S3, Azure Blob, CDN, GitHub Pages, Nginx, etc. Expects the same directory-tree layout as the filesystem provider, served over HTTP.
+Serves [Agent Skills](https://agentskills.io) from any static HTTP file host - S3, Azure Blob, CDN, GitHub Pages, Nginx, etc. Expects the same directory-tree layout as the filesystem provider, served over HTTP.
 
 ## Installation
 
@@ -36,7 +35,7 @@ Serves [Agent Skills](https://agentskills.io) from any static HTTP file host —
 pip install agentskills-http
 ```
 
-Requires Python 3.12+. Installs `agentskills-core`, `httpx`, and `pyyaml` as dependencies.
+Requires Python 3.12 or 3.13. Installs `agentskills-core`, `httpx`, and `pyyaml` as dependencies.
 
 ## Expected URL Layout
 
@@ -97,7 +96,7 @@ provider = HTTPStaticFileSkillProvider("https://cdn.example.com/skills", client=
 
 | Parameter | Type | Default | Description |
 | --- | --- | --- | --- |
-| `base_url` | `str` | — | Root URL where the skill tree is hosted |
+| `base_url` | `str` | - | Root URL where the skill tree is hosted |
 | `client` | `AsyncClient \| None` | `None` | Pre-configured httpx client (caller manages lifecycle) |
 | `headers` | `dict \| None` | `None` | Extra headers sent with every request |
 | `params` | `dict \| None` | `None` | Query parameters appended to every request |
@@ -130,21 +129,21 @@ All exceptions inherit from `AgentSkillsError`.
 
 ## Security
 
-- **Input validation** — Skill IDs and resource names are validated against a safe-character pattern (`^[a-zA-Z0-9][a-zA-Z0-9._-]*$`) to prevent path-traversal and injection attacks.
-- **TLS warnings** — A `UserWarning` is emitted when `base_url` uses unencrypted HTTP. Set `require_tls=True` to reject HTTP URLs entirely.
-- **Redirect protection** — The internally-created HTTP client does not follow redirects by default, preventing open-redirect SSRF.
-- **Timeouts** — Default 30-second timeout on all HTTP requests.
-- **Response size limits** — Responses exceeding 10 MB (default) are rejected before processing. Configure via `max_response_bytes`.
-- **Error-message sanitization** — Error messages omit URLs and include only status codes and generic descriptions, preventing internal URL leakage.
+- **Input validation** - Skill IDs and resource names are validated against a safe-character pattern (`^[a-zA-Z0-9][a-zA-Z0-9._-]*$`) to prevent path-traversal and injection attacks.
+- **TLS warnings** - A `UserWarning` is emitted when `base_url` uses unencrypted HTTP. Set `require_tls=True` to reject HTTP URLs entirely.
+- **Redirect protection** - The internally-created HTTP client does not follow redirects by default, preventing open-redirect SSRF.
+- **Timeouts** - Default 30-second timeout on all HTTP requests.
+- **Response size limits** - Responses exceeding 10 MB (default) are rejected before processing. Configure via `max_response_bytes`.
+- **Error-message sanitization** - Error messages omit URLs and include only status codes and generic descriptions, preventing internal URL leakage.
 
 For the full security policy, see [SECURITY.md](../../../SECURITY.md).
 
 ## Deployment Considerations
 
-- **Rate limiting** — The SDK does not enforce rate limits on MCP tool
+- **Rate limiting** - The SDK does not enforce rate limits on MCP tool
   calls or HTTP requests. Deploy behind a reverse proxy or API gateway
   that provides rate limiting in production environments.
-- **Credential management** — Do not store secrets (API keys, SAS
+- **Credential management** - Do not store secrets (API keys, SAS
   tokens, Authorization headers) in config files committed to version
   control. Use environment variables or a secret manager instead.
 

{agentskills_http-0.2.1 → agentskills_http-0.2.3}/README.md

@@ -1,12 +1,12 @@
 # agentskills-http
 
 [![PyPI](https://img.shields.io/pypi/v/agentskills-http)](https://pypi.org/project/agentskills-http/)
-[![Python 3.12+](https://img.shields.io/pypi/pyversions/agentskills-http)](https://pypi.org/project/agentskills-http/)
+[![Python 3.12 | 3.13](https://img.shields.io/pypi/pyversions/agentskills-http)](https://pypi.org/project/agentskills-http/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/pratikxpanda/agentskills-sdk/blob/main/LICENSE)
 
 > HTTP static-file skill provider for the [Agent Skills SDK](../../README.md).
 
-Serves [Agent Skills](https://agentskills.io) from any static HTTP file host — S3, Azure Blob, CDN, GitHub Pages, Nginx, etc. Expects the same directory-tree layout as the filesystem provider, served over HTTP.
+Serves [Agent Skills](https://agentskills.io) from any static HTTP file host - S3, Azure Blob, CDN, GitHub Pages, Nginx, etc. Expects the same directory-tree layout as the filesystem provider, served over HTTP.
 
 ## Installation
 
@@ -14,7 +14,7 @@ Serves [Agent Skills](https://agentskills.io) from any static HTTP file host —
 pip install agentskills-http
 ```
 
-Requires Python 3.12+. Installs `agentskills-core`, `httpx`, and `pyyaml` as dependencies.
+Requires Python 3.12 or 3.13. Installs `agentskills-core`, `httpx`, and `pyyaml` as dependencies.
 
 ## Expected URL Layout
 
@@ -75,7 +75,7 @@ provider = HTTPStaticFileSkillProvider("https://cdn.example.com/skills", client=
 
 | Parameter | Type | Default | Description |
 | --- | --- | --- | --- |
-| `base_url` | `str` | — | Root URL where the skill tree is hosted |
+| `base_url` | `str` | - | Root URL where the skill tree is hosted |
 | `client` | `AsyncClient \| None` | `None` | Pre-configured httpx client (caller manages lifecycle) |
 | `headers` | `dict \| None` | `None` | Extra headers sent with every request |
 | `params` | `dict \| None` | `None` | Query parameters appended to every request |
@@ -108,21 +108,21 @@ All exceptions inherit from `AgentSkillsError`.
 
 ## Security
 
-- **Input validation** — Skill IDs and resource names are validated against a safe-character pattern (`^[a-zA-Z0-9][a-zA-Z0-9._-]*$`) to prevent path-traversal and injection attacks.
-- **TLS warnings** — A `UserWarning` is emitted when `base_url` uses unencrypted HTTP. Set `require_tls=True` to reject HTTP URLs entirely.
-- **Redirect protection** — The internally-created HTTP client does not follow redirects by default, preventing open-redirect SSRF.
-- **Timeouts** — Default 30-second timeout on all HTTP requests.
-- **Response size limits** — Responses exceeding 10 MB (default) are rejected before processing. Configure via `max_response_bytes`.
-- **Error-message sanitization** — Error messages omit URLs and include only status codes and generic descriptions, preventing internal URL leakage.
+- **Input validation** - Skill IDs and resource names are validated against a safe-character pattern (`^[a-zA-Z0-9][a-zA-Z0-9._-]*$`) to prevent path-traversal and injection attacks.
+- **TLS warnings** - A `UserWarning` is emitted when `base_url` uses unencrypted HTTP. Set `require_tls=True` to reject HTTP URLs entirely.
+- **Redirect protection** - The internally-created HTTP client does not follow redirects by default, preventing open-redirect SSRF.
+- **Timeouts** - Default 30-second timeout on all HTTP requests.
+- **Response size limits** - Responses exceeding 10 MB (default) are rejected before processing. Configure via `max_response_bytes`.
+- **Error-message sanitization** - Error messages omit URLs and include only status codes and generic descriptions, preventing internal URL leakage.
 
 For the full security policy, see [SECURITY.md](../../../SECURITY.md).
 
 ## Deployment Considerations
 
-- **Rate limiting** — The SDK does not enforce rate limits on MCP tool
+- **Rate limiting** - The SDK does not enforce rate limits on MCP tool
   calls or HTTP requests. Deploy behind a reverse proxy or API gateway
   that provides rate limiting in production environments.
-- **Credential management** — Do not store secrets (API keys, SAS
+- **Credential management** - Do not store secrets (API keys, SAS
   tokens, Authorization headers) in config files committed to version
   control. Use environment variables or a secret manager instead.
 

{agentskills_http-0.2.1 → agentskills_http-0.2.3}/agentskills_http/static.py

@@ -28,7 +28,6 @@ for non-blocking HTTP requests.
 
 from __future__ import annotations
 
-import logging
 import re
 import warnings
 from typing import Any
@@ -44,8 +43,6 @@ from agentskills_core import (
     split_frontmatter,
 )
 
-_logger = logging.getLogger(__name__)
-
 # Input validation: identifiers (skill_id, resource name) must be safe
 # URL path segments.  Allows alphanumeric, hyphens, dots, underscores.
 # Must start with an alphanumeric character.  No path separators or
@@ -273,6 +270,60 @@ class HTTPStaticFileSkillProvider(SkillProvider):
     # Internal helpers
     # ------------------------------------------------------------------
 
+    async def _stream_bytes(self, url: str, not_found_error: type[Exception]) -> bytes:
+        """Stream a GET request and return the response bytes.
+
+        Uses ``httpx.AsyncClient.stream`` so that overly large
+        responses are detected **during** download rather than after
+        the entire body has been buffered into memory.
+
+        Args:
+            url: The URL to fetch.
+            not_found_error: Exception type to raise on HTTP 404
+                (e.g. :class:`SkillNotFoundError` or
+                :class:`ResourceNotFoundError`).
+
+        Raises:
+            not_found_error: On 404.
+            AgentSkillsError: On other HTTP/connection errors or if
+                the response exceeds *max_response_bytes*.
+        """
+        try:
+            async with self._client.stream("GET", url) as resp:
+                if resp.status_code == 404:
+                    raise not_found_error("Skill content not found")
+                try:
+                    resp.raise_for_status()
+                except httpx.HTTPStatusError as exc:
+                    raise AgentSkillsError(f"HTTP {resp.status_code} error") from exc
+
+                # Check Content-Length header for an early reject when
+                # the server advertises the size up-front.
+                cl = resp.headers.get("content-length")
+                if cl is not None and int(cl) > self._max_response_bytes:
+                    raise AgentSkillsError(
+                        f"Response exceeds maximum size ({self._max_response_bytes} bytes)"
+                    )
+
+                # Stream chunks and enforce the byte limit
+                # incrementally to avoid buffering the full body.
+                chunks: list[bytes] = []
+                received = 0
+                async for chunk in resp.aiter_bytes():
+                    received += len(chunk)
+                    if received > self._max_response_bytes:
+                        raise AgentSkillsError(
+                            f"Response exceeds maximum size ({self._max_response_bytes} bytes)"
+                        )
+                    chunks.append(chunk)
+
+        except (SkillNotFoundError, ResourceNotFoundError, AgentSkillsError):
+            raise
+        except httpx.HTTPError as exc:
+            raise AgentSkillsError("HTTP request failed") from exc
+
+        return b"".join(chunks)
+
     async def _get_text(self, url: str) -> str:
         """GET a URL and return the response text.
 
@@ -281,21 +332,8 @@ class HTTPStaticFileSkillProvider(SkillProvider):
             AgentSkillsError: On other HTTP or connection errors,
                 or if the response exceeds *max_response_bytes*.
         """
-        try:
-            resp = await self._client.get(url)
-        except httpx.HTTPError as exc:
-            raise AgentSkillsError("HTTP request failed") from exc
-        if resp.status_code == 404:
-            raise SkillNotFoundError("Skill content not found")
-        try:
-            resp.raise_for_status()
-        except httpx.HTTPStatusError as exc:
-            raise AgentSkillsError(f"HTTP {resp.status_code} error") from exc
-        if len(resp.content) > self._max_response_bytes:
-            raise AgentSkillsError(
-                f"Response exceeds maximum size ({self._max_response_bytes} bytes)"
-            )
-        return resp.text
+        data = await self._stream_bytes(url, SkillNotFoundError)
+        return data.decode("utf-8")
 
     async def _get_bytes(self, url: str) -> bytes:
         """GET a URL and return the response bytes.
@@ -305,21 +343,7 @@ class HTTPStaticFileSkillProvider(SkillProvider):
             AgentSkillsError: On other HTTP or connection errors,
                 or if the response exceeds *max_response_bytes*.
         """
-        try:
-            resp = await self._client.get(url)
-        except httpx.HTTPError as exc:
-            raise AgentSkillsError("HTTP request failed") from exc
-        if resp.status_code == 404:
-            raise ResourceNotFoundError("Resource not found")
-        try:
-            resp.raise_for_status()
-        except httpx.HTTPStatusError as exc:
-            raise AgentSkillsError(f"HTTP {resp.status_code} error") from exc
-        if len(resp.content) > self._max_response_bytes:
-            raise AgentSkillsError(
-                f"Response exceeds maximum size ({self._max_response_bytes} bytes)"
-            )
-        return resp.content
+        return await self._stream_bytes(url, ResourceNotFoundError)
 
     async def _get_skill_md(self, skill_id: str) -> str:
         """Fetch the full text of a skill's ``SKILL.md``."""

{agentskills_http-0.2.1 → agentskills_http-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "agentskills-http"
-version = "0.2.1"
+version = "0.2.3"
 description = "HTTP-based skill providers for the Agent Skills format (https://agentskills.io)"
 license = "MIT"
 authors = ["Pratik Panda"]
@@ -17,7 +17,7 @@ classifiers = [
 ]
 
 [tool.poetry.dependencies]
-python = ">=3.12,<4.0"
+python = ">=3.12,<3.14"
 agentskills-core = ">=0.1.0,<1.0"
 httpx = ">=0.27,<1.0"
 pyyaml = ">=6.0,<7.0"