RagLeapBounded HTTP for every network provider, plus a Tool.call fix. Published to PyPI on 2026-10-10.
Added: a response-size cap (max_response_bytes, default 1 MiB) and a hard total deadline (total_timeout, default 20 s; 90 s for vision) on Tavily, Serper, GitHub search, Gemini and Anthropic vision. Before, urllib's timeout covered each socket operation, not the whole request, and the body was read without a limit. The new fields are optional and validated. Failures return a failed ToolResult. GitHub error bodies are capped at 16 KiB and still surfaced.
Fixed: Tool.call raised TypeError when a model-chosen argument was named self. self is now positional-only.
CI: the ragleap-tools job now runs Python 3.10, 3.11 and 3.12.
Verified: 200 tests (133 existing unchanged plus 67 new, run against a real local HTTP server), passing on Python 3.10, 3.11 and 3.12 in CI; 38 of 38 deliberate code breaks caught by the tests. Live on the new transport: Gemini vision (2026-10-09) and unauthenticated GitHub search, including the size cap, the deadline and a real HTTP 422. The published wheel and sdist were checked: installed files identical to the tested ones, sdist hash matches PyPI, sdist tests pass against the installed wheel.
NOT verified live: Anthropic vision, Tavily, Serper, authenticated GitHub requests.
Known limitations: Python cannot kill a thread, so an abandoned request is stopped on a best-effort basis (control still returns on time); DNS resolution is not covered by the per-operation timeout; responses over the cap now fail where they used to succeed.
Details: packages/ragleap-tools/CHANGELOG.md