Restrict recent-activity feedType to user|org; document following limitation

.fast-agent/tool-cards/hf_api_tool.py

@@ -46,7 +46,10 @@ ALLOWED_ENDPOINT_PATTERNS: list[str] = [
     r"^/collections/[^/]+/items$",
     # Auth check
     r"^/(models|datasets|spaces)/[^/]+/[^/]+/auth-check$",
-    # Recent activity feed (undocumented)
+    # Recent activity feed (undocumented).
+    # Note: this tool intentionally supports only `feedType=user|org` in params.
+    # `feedType=following` requires cookie/session auth in practice and is blocked
+    # with a clear error before making a network request.
     r"^/recent-activity$",
 ]
 
@@ -161,6 +164,44 @@ def _build_url(endpoint: str, params: dict[str, Any] | None) -> str:
     return url
 
 
+def _validate_recent_activity_params(endpoint: str, params: dict[str, Any]) -> None:
+    """Validate /recent-activity query semantics for robust auth behavior.
+
+    We explicitly support only `feedType=user|org` with `entity`.
+    `feedType=following` is intentionally rejected because it requires browser
+    cookie/session auth and is not reliably accessible with bearer-token auth.
+    """
+    normalized = _normalize_endpoint(endpoint)
+    if normalized != "/recent-activity":
+        return
+
+    feed_type = str(params.get("feedType", "")).strip().lower()
+    if not feed_type:
+        raise ValueError(
+            "For /recent-activity, set params.feedType to 'user' or 'org' "
+            "and include params.entity."
+        )
+
+    if feed_type == "following":
+        raise ValueError(
+            "feedType='following' is restricted (cookie/session auth only) and "
+            "is not supported by hf_api_request. Use feedType='user' or 'org'."
+        )
+
+    if feed_type not in {"user", "org"}:
+        raise ValueError(
+            f"Unsupported feedType='{feed_type}'. Supported values for "
+            "/recent-activity are 'user' and 'org'."
+        )
+
+    entity = str(params.get("entity", "")).strip()
+    if not entity:
+        raise ValueError(
+            f"For /recent-activity with feedType='{feed_type}', "
+            "params.entity is required."
+        )
+
+
 def _request_once(
     *,
     url: str,
@@ -426,6 +467,7 @@ Returns:
         raise ValueError("max_pages must be >= 1.")
 
     req_params = dict(params or {})
+    _validate_recent_activity_params(endpoint, req_params)
     url = _build_url(endpoint, req_params)
     status_code, payload = _request_once(
         url=url,