Added optional timeout parameter

.github/copilot-instructions.md

@@ -54,5 +54,5 @@ Individual commands:
 
 - Auth modes: `api_key`, `bearer_static`, `bearer_provider`, `sso`.
 - `_build_default_headers()` only sets static auth; dynamic modes (`bearer_provider`, `sso`) are resolved per-request in `_merge_request_headers` / `_merge_request_headers_async`.
-- Typed wrapper methods use `_sync_generated_client()` / `_async_generated_client()` which return a `GeneratedClient` with its own internal `httpx.Client` (separate from the SDK's `self._client`).
-- In tests, to mock typed methods you must wire the mock transport into the generated client via `gc.set_httpx_client(httpx.Client(transport=transport, base_url=..., headers=dict(gc._headers)))`.
+- Typed wrapper methods pass `self._generated`, a `GeneratedClient` that sends through the SDK's `self._client` (`_SyncSender` / `_AsyncSender`), so one httpx client serves every method.
+- In tests, mock any method by passing `http_client=httpx.Client(transport=transport, base_url=...)`.

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.7.2] - 2026-10-05
+
+### Fixed
+
+- Apply a `timeout` passed to `Seclai(...)` or `AsyncSeclai(...)` to `run_agent()`, `list_agent_runs()`, `get_agent_run()`, `delete_agent_run()`, `list_sources()`, `get_content_detail()`, `delete_content()`, `list_content_embeddings()`, `upload_file_to_source()` and `upload_file_to_content()`. They sent through a second HTTP client that had no timeout, so the value was ignored and a stalled connection never returned. Without a `timeout` argument they still wait without limit: the 30-second default does not apply to them, so an upload that worked before still does
+- Send those ten methods through a supplied `http_client`. They ignored it, so its transport, proxy, certificates, default headers and `base_url` did not apply to them, and they went to `SECLAI_API_URL` whatever its `base_url` said. Its timeout still does not apply to them. A supplied client with no `base_url` still reaches the Seclai API from these methods, as it did before
+- Apply the unknown-version guard on each of those ten calls to a `Seclai-Version` in a supplied `http_client`'s default headers, which they now send. A value set on the client after `Seclai(...)` was built, and that this release was not built against, raises `SeclaiConfigurationError` unless `allow_unknown_api_version=True`
+
 ## [1.7.1] - 2026-10-05
 
 ### Changed
@@ -209,6 +217,7 @@ _Stable release. Packaging, CI, and documentation deployment only; no API change
 
 _Initial release._
 
+[1.7.2]: https://github.com/seclai/seclai-python/releases/tag/1.7.2
 [1.7.1]: https://github.com/seclai/seclai-python/releases/tag/1.7.1
 [1.7.0]: https://github.com/seclai/seclai-python/releases/tag/1.7.0
 [1.6.0]: https://github.com/seclai/seclai-python/releases/tag/1.6.0

README.md

@@ -79,6 +79,13 @@ asyncio.run(main())
 | `default_headers` | — | `None` |
 | `http_client` | — | `None` (auto-created `httpx.Client`) |
 
+Ten methods wait without limit unless you pass `timeout` yourself: `run_agent()`,
+`list_agent_runs()`, `get_agent_run()`, `delete_agent_run()`, `list_sources()`,
+`get_content_detail()`, `delete_content()`, `list_content_embeddings()`,
+`upload_file_to_source()` and `upload_file_to_content()`. The 30-second default
+does not apply to them, and neither does the timeout of an `http_client` you
+supply. Requests from every other method use a supplied client's own timeout.
+
 Set `SECLAI_API_URL` to point at a different API host (e.g., staging):
 
 ```bash
@@ -178,12 +185,7 @@ The guard covers the header however it reaches the wire: `api_version`,
 `default_headers`, a per-request `headers` argument, or the default headers of
 an `http_client` you supply, which are checked at construction and again on
 each request, exactly as a value in `default_headers` is. It covers nothing
-else. The typed methods that go through the generated client — `run_agent()`,
-`list_agent_runs()`, `get_agent_run()`, `delete_agent_run()`, `list_sources()`,
-`get_content_detail()`, `delete_content()`, `list_content_embeddings()`,
-`upload_file_to_source()` and `upload_file_to_content()` — do not use a supplied
-`http_client` at all, so nothing it carries reaches them. An account pinned
-server-side can still be
+else. An account pinned server-side can still be
 newer than this release — `get_api_version()` reports the `effective_version` the
 request resolved to, and comparing it against `LATEST_API_VERSION` is how you
 detect the gap.