Agents SDK v0.24.0-alpha.7

Highlights

• Use Classic workflows alongside native execution. Import the retained v0 runtime through agents.classic. This alpha also changes executor write defaults; review the upgrade actions before opening existing environments.
• Keep conversations in your own storage. Add durable root Sessions with CustomStorage, and reconcile uncertain tool effects before resuming work.
• Add voice and hosted tools to native agents. Connect speech workflows to a Session, or use FileSearch, CodeInterpreter, and ImageGeneration through compatible Responses providers.
• Control context, completion, and usage. Transform model input, retain selected context during compaction, review proposed answers, and limit observed root usage.

Upgrading from 0.24.0-alpha.6

• Review Environment write policies. New Environments default to write_policy="strict", which requires a compatible Linux or macOS executor. The working directory remains writable; use writable_roots for additional directories. To retain the previous remote policy, including on Windows executors, set write_policy="legacy" and leave writable_roots=None. Local execution requires strict mode. When restoring legacy remote checkpoints or profiles, select legacy explicitly; reopening does not upgrade their policy. See the executor policy and restore rules.
• Check implicit reasoning settings. The bundled model catalog changes the default reasoning effort from low to medium for gpt-6-astra, gpt-6.1-sol, and gpt-5.6-sol. Set model_settings={"reasoning_effort": "low"} explicitly if you need the previous effort. This describes bundled metadata; an explicit setting or provider model metadata can select another value. (#5517)
• Rename MCP approval modes. Replace approval_mode="auto" with "native", and "approve" with "preapproved". The old values are rejected; the new names preserve their respective approval behavior.
• Update child step callbacks. NativeAgents.before_step now receives one ChildStepContext, with context, child, and step_index, instead of separate child and step-index arguments. Root before_step callbacks keep their existing signature.
• Handle MCP forms and URLs separately. ElicitationRequest is now the union FormRequest | UrlRequest. Use FormRequest.reply() or respond() for forms; use UrlRequest.reply_url_accept() or accept_url() for URL consent.

Added

• Application-owned conversation storage. SessionStore, SQLiteSessionStore, and CustomStorage persist root history and automatic Python tool results. This initial profile excludes native tools, Environments, children, planning tools, generated-code execution, manual tools, and portable checkpoints. SQLiteSessionStore requires one host and a local POSIX filesystem. Both local profiles and custom stores can report uncertain root calls for explicit reconciliation; neither automatically replays those effects. (#5514, #5502)
• Provider-hosted tools and storage. Add FileSearch, CodeInterpreter, and ImageGeneration, Code Interpreter caller policies, and provider-managed storage. Hosted tools require an API-key provider and a compatible standard Responses model; they exclude Responses Lite and Codex login. Hosted web search adds domain and location controls and retains citations. (#5576, hosted-tool guide)
• Context and completion hooks. Agent.transform_context changes sampled input without changing stored history. before_compact and selected-item retention control compaction. before_complete can accept, return ContinueTurn, or stop a proposed answer; rejected text may already have streamed and remains in history. Advanced prepare_request editing supports a restricted HTTP profile. See the hook contracts and limits.
• Observed usage budgets. RunBudget limits root request admissions, reported tokens, or estimated cost before the next request. An admitted request can exceed a limit. Children are excluded; missing usage stops further admission by default. Active budgeted operations cannot use portable checkpoints. (#5555)
• MCP resources, prompts, and reconnection. Use Session.list_mcp_resources(), list_mcp_resource_templates(), read_mcp_resource(), list_mcp_prompts(), and get_mcp_prompt() with a selected HTTP or stdio server while the Session is idle. Retrieved data does not enter model context automatically. Scoped tool selection and explicit reconnection preserve control over admitted tools without replaying uncertain calls. (#5597, #5604, #5556)
• Local execution and project search. Environment.local() runs supported executor tools locally. On Linux, LocalStorageMount(source=path) grants read-only access to an existing canonical directory; source and destination must match. project_glob and project_grep search beneath the Environment's fixed working directory without granting command execution. (#5501, #5575, #5574)
• Integration and supervision. Add native A2A client and server adapters through the a2a extra, explicit TraceContext, workflow tracing controls, API-key rate-limit snapshots, turn receipts, exact-turn steering, and attention waits. Classic integrations use the classic and classic-* extras; Classic and native objects and checkpoints remain separate.
• Speech with native history and policies. agents.voice.NativeSessionVoiceWorkflow uses a caller-owned text-output Session with the speech pipeline. It speaks accepted final text after completion review and output validation. The application handles interactions and Session lifetime. Install the voice extra; Realtime agents remain under agents.classic.realtime. (#5596)

Changed

• Choose function-tool timeout handling. timeout_behavior="error_as_result" returns a timeout error to the model, with optional timeout_error_function formatting. Raising remains the default. (#5605)
• Optional buffered Responses. NativeProvider(response_mode="buffered") reads each complete HTTP JSON response before emitting model output. Select a standard Responses model explicitly; the default model uses Responses Lite. Buffered mode requires API-key authentication and excludes WebSockets, native children, and Codex login. Streaming remains the default. (#5589)
• Experimental saved-login reuse. NativeProvider(auth=CodexLogin()) can use a saved Codex login over HTTP. Omit api_key and base_url. This experimental feature may change or be removed; see the authentication guidance and limits.

Fixed

• Keep Classic mount credential files private during creation and replacement, and bound Classic sandbox archive extraction.
• Stop deferred work and automatic compaction after cancellation. Retain cleanup owners so callers can retry unfinished release of resources without repeating reconciliation or tool effects.
• Stop sampling retries after terminal provider authentication failures. Report typed output-failure reasons and captured context limits, and preserve cache-write token counts.
• Retain provider response observations and execution details under their configured policies. Reduce native startup and event-reading overhead.

Release verification

Source: c27b24cc6c4fa7e89ab54fa9f795ef4f2d4d5fb9.

Built and tested by Tests #42453125392.

Fresh-install checks passed on CPython 3.10 and 3.14 for Linux, macOS, and Windows: installation verification.

Install the preview

Use standard CPython 3.10–3.14 in a virtual environment. These wheels include the native runtime; no Rust toolchain or source build is needed. This preview is distributed through GitHub Releases, not PyPI.

Run the command for your platform:

Linux x86_64 (glibc 2.39 or newer)

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-manylinux_2_39_x86_64.whl"

macOS 11 or newer on Apple Silicon

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-macosx_11_0_arm64.whl"

Windows x64

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-win_amd64.whl"

Wheels are not provided for Intel Macs, ARM Linux, ARM Windows, Alpine/musl, PyPy or free-threaded Python. The cp310-abi3 filenames also support standard CPython 3.11–3.14.

Check the installed version and native module:

python -c "from importlib.metadata import version; import agents._native; print(version('openai-agents'))"

Expect 0.24.0-alpha.6 or its equivalent Python packaging spelling, 0.24.0a6. SHA256SUMS contains checksums for all three wheels.

Release notes

Changes since 0.24.0-alpha.5. This preview expands conversation control, state recovery, and tool policies, and includes public API changes.

Added

• Control submitted work through a captured Turn, with get_result(), passive events(), manual request handling, steering, and cancellation. Queue prompts with Session.submit(..., if_busy="queue"), or steer the active Turn with if_busy="steer".
• Add LocalStorage to reopen conversations from a local profile, and extend portable SessionState capture and recovery. Add idle forks, caller-supplied compaction summaries, and checks for feature support and checkpoint readiness. LocalStorage profiles cannot export portable checkpoints.
• Add NativeOutput for native strict output and PromptedOutput for JSON validated in Python. Optional max_retries performs bounded corrections without tools or replaying the task. LocalStorage requires max_retries=0.
• Handle live manual tool requests and resume supported pending requests from checkpoints. Add experimental external-job recovery through agents.experimental.deferred and an optional MCP Tasks adapter.
• Select tools for each submission or model step within the Session's opening permissions. Add native web search, native child checklists, and native goals for local-storage Sessions.
• Validate Python tool return annotations and add tool policies for inspecting arguments and results. Extend native MCP support with argument replacement, result transforms, and application-managed form and URL interactions over supported HTTP, stdio, and model WebSocket paths.
• Add NetworkPolicy for native commands on supported Linux and macOS executors, subject to each platform's network and Unix socket limits. Manage remote executor lifetimes through an Environment supplied when opening a Session or running an Agent.
• Enable native child approvals and form requests with NativeAgents(interactions=True). Children continue to share the Session's tools and application context.
• Configure native OpenTelemetry export and inspect typed observations. NativeError now exposes available provider status codes, error codes, request IDs, and failure categories.
• Test real SDK sessions and Python tools against local scripted responses with agents.testing.ScriptedResponses, without a live model or API key.

API changes

• Use Agent.run() or Agent.run_sync() for one-shot calls; the redundant Runner aliases have been removed.
• Replace Turn.wait() and Session.wait() with Turn.get_result() on the captured Turn.
• Replace Session.interrupt() with Turn.cancel() for one root Turn or Session.cancel_all() for the whole Session.
• Rename Subagent.submit() to Subagent.start(). Unify Python callbacks and manual tools under FunctionTool; remove the separate ManualTool declaration.
• Agent declarations are immutable. Create a new Agent to change defaults, use with_output_type() for an output-type variant, or use supported idle Session updates for an open conversation.
• Tool selection and Session updates cannot expand the permissions captured when the Session opened. Restored Sessions use current application tools, credentials, and policies.

Fixed

• Keep each captured Turn's result stable across accepted steering, native continuations, and later submissions. Preserve one-shot manual checkpoints, matching interaction replies, and output-repair state across supported save and restore boundaries.
• Improve native child cancellation and Session cleanup. Stop native work when result policies expire, and preserve policy failure reasons when reporting root and child results.
• Reject malformed Python tool result envelopes and preserve server errors through MCP result transforms. Support nested OpenAI extension forms and HTTP telemetry export with client certificates.

Documentation and examples

• Move the preview source to the public repository. Refocus installation guidance on prebuilt wheels and move SDK build instructions to CONTRIBUTING.md.
• Add examples for browser applications, AG-UI streaming, deferred jobs, evaluation, observability, and common application tasks. Remove migration guides from the preview documentation.

Build and installation checks

Source: 2808233a56c32c9d7bb8b4f3bc739fe86e5fc282. Wheels come from the successful Tests run.

Fresh-install checks passed on CPython 3.10 and 3.14 for Linux, macOS, and Windows: installation verification.

0.24.0 (2026-10-15)

Features

• expose MCP annotations on converted tools (#5356) (75813f8)
• support run-wide tool exception formatting (#5326) (8fd9a7c)

Bug Fixes

• batch OpenAI conversation session writes within the API limit (#5334) (26345c1)
• defer automatic compaction for pending approvals (#5363) (5eb47a5)
• deps-dev: bump fastapi from 0.139.2 to 0.141.1 (#5312) (cdf23bd)
• deps-dev: bump grpcio from 1.83.1 to 1.84.0 (#5310) (a85487e)
• deps-dev: bump pymdown-extensions from 11.0.2 to 12.1 (#5314) (d9758b0)
• deps-dev: bump pymongo from 4.18.1 to 4.18.2 (#5313) (858856f)
• deps: bump boto3 from 1.42.75 to 1.43.109 (#5378) (7da6a92)
• deps: bump filelock from 3.20.3 to 4.0.12 (#5375) (14f4553)
• deps: bump fsspec from 2025.7.0 to 2026.6.0 (#5317) (66504e9)
• deps: bump redis from 7.0.1 to 8.1.0 (#5379) (24ebf1c)
• deps: bump temporalio from 1.33.0 to 1.34.0 (#5377) (c148280)
• deps: bump vercel-sandbox from 0.7.0 to 0.8.0 (#5374) (2938d87)
• deps: update fastapi requirement from >=0.141.1 to >=0.142.2 in /examples/realtime/twilio_sip (#5372) (f47d2c3)
• deps: update fastapi requirement in /examples/realtime/twilio_sip (f47d2c3)
• deps: update openai requirement from <4,>=3.19.1 to >=3.20.0,<4 in /examples/realtime/twilio_sip (#5308) (f346950)
• deps: update openai requirement from <4,>=3.20.0 to >=3.26.0,<4 in /examples/realtime/twilio_sip (#5376) (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (f346950)
• deps: update pyjwt requirement from >=2.15.0 to >=2.15.1 in /examples/realtime/twilio (#5306) (7ca3c44)
• deps: update pyjwt requirement in /examples/realtime/twilio (7ca3c44)
• deps: update python-dotenv requirement (408c33f)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio (#5373) (c4cc409)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio_sip (#5371) (408c33f)
• deps: update python-dotenv requirement in /examples/realtime/twilio (c4cc409)
• deps: update twilio requirement from <10,>=9.11.1 to >=9.11.2,<10 in /examples/realtime/twilio (#5307) (cb03652)
• deps: update twilio requirement in /examples/realtime/twilio (cb03652)
• deps: update uvicorn requirement from >=0.53.0 to >=0.54.0 in /examples/realtime/twilio_sip (#5309) (f84fe73)
• deps: update uvicorn requirement in /examples/realtime/twilio_sip (f84fe73)
• examples: render realtime tool events as text (#5283) (81f0ccf)
• honor Runner tracing opt-out inside caller traces (#5296) (8c4aa08)
• memory: replace Redis compaction history atomically (#5354) (f50525c)
• omit unserializable dataclass run contexts (#5303) (d7e52c3)
• preserve caller-owned exceptions during sandbox redaction (#5367) (2244e9f)
• preserve completed tool outputs when a sibling fails (#5332) (1c1a28d)
• preserve embedded separators in sandbox patches (#5365) (67d4f8a)
• preserve function-call aliases across RunState restoration (#5358) (f093ced)
• Preserve parameter descriptions in Args-only docstrings (#5302) (a726a9c)
• preserve RunState agent ownership across hook state changes (#5362) (d8e0a76)
• preserve tool outputs after callback failures (#5318) (71c2da4)
• recover from invalid sandbox tool arguments (#5321) (6ba967b)
• reject pending input when completed stop tools end resume (#5366) ([5a30187](https://github.com/openai/openai-agents-python/comm...

0.23.1 (2026-10-02)

Bug Fixes

• restore release tests and refresh required readiness check (#5278) (730deb4)

Release readiness review (v0.23.0 -> TARGET 0a5a08b)

This is a release readiness report done by $final-release-review skill.

Diff

v0.23.0...0a5a08b

Release intent

• Review mode: final candidate
• Intended release: patch, 0.23.1
• Minimum required release type: patch
• Versioning verdict: compatible

Release call

🟢 GREEN LIGHT TO SHIP this exact candidate. No concrete release-blocking regression was identified. Human approval and normal repository protections still apply.

Scope summary

• 28 files changed (+622/-42): release automation, test fixtures, integration/example tooling, and release metadata.
• The clean candidate contains current main a575a6e637feb9aea1b591237b007dd4991ddfba plus only six release-owned metadata files. Package, lockfile, manifest, source version and API baseline agree on 0.23.1. Snapshot source b31b9f8d13d49142a64f8873f2cc2ee40441a795 is an ancestor of the candidate.
• Relative to v0.23.0, SDK runtime source changes only its version string. API snapshot content, dependencies, Python support and persisted schemas are unchanged.

Risk assessment (ordered by impact)

1. First PyPI publication of the 0.23 series includes earlier migration requirements

   • Risk: 🟢 LOW with the previously reviewed migration paths. Users upgrading from 0.22.3 receive the 0.23.0 behavior changes as well as this patch.
   • Evidence: PyPI has neither 0.23.0 nor 0.23.1. The 0.23.0 release assessment in #5226 covers strict tools, approval restoration, encrypted history, resource limits, voice defaults and provider changes; this candidate does not alter those runtime paths.
   • Files: CHANGELOG.md, src/agents/version.py; unchanged 0.23.0 runtime contracts assessed in #5226.
   • Action: Carry forward the 0.23.0 migration guidance in the 0.23.1 announcement, particularly explicit strict-tool parameters, fresh legacy approvals, trusted encrypted-history import, resource-limit overrides and the explicit prior voice-model override.

2. Release checks recover without changing package behavior

   • Risk: 🟢 LOW. Test-loop initialization and required-check ownership are corrected while publication authorization remains intact.
   • Evidence: OS mocks are installed after event-loop initialization and restored before teardown. Authorized review events rerun the current PR-triggered readiness check instead of replacing or cancelling it. Source validation, native human approval, isolated builds and OIDC publishing remain unchanged.
   • Files: tests/sandbox/test_unix_local_user_file_io.py, .github/scripts/release_automation.py, .github/workflows/release-readiness-refresh.yml, .github/workflows/release-readiness.yml.
   • Action: Submit the exact-head human approval, allow readiness to refresh, merge through normal protections, and verify the publisher and uploaded provenance.

3. External-provider coverage now requires explicit maintainer intent

   • Risk: 🟢 LOW with an existing opt-in path. Default integration and automatic example runs no longer implicitly select the affected external-provider cases.
   • Evidence: Integration bootstrap resets inherited enable flags, removes the listed external-provider credentials by default, and rejects external model overrides without opt-in. External cases are deselected by default; automatic examples use the expanded skip list. Manual example selection remains available.
   • Files: .github/scripts/run_integration_tests.py, integration_tests/conftest.py, Makefile, examples/run_examples.py, integration_tests/README.md.
   • Action: Use make integration-tests-providers-external, adding -- --all when direct-provider coverage is intended. Do not interpret default coverage as external-provider validation.

Documentation coverage (non-blocking)

• Coverage source: current open PRs #5279 and #4828; #4828 head fa2c43bc9e252c75d76d60c06959a725f1dc0205 has no release documentation coverage. No separate open docs/ PR was found after inspecting the current file lists.
• Status: covered for this patch's maintainer workflows; partially covered for inherited 0.23.0 migrations.
• Covered obligations: .github/RELEASING.md explains readiness refresh and retry; integration_tests/README.md explains explicit external-provider execution and credential behavior.
• Post-release suggestions: retain the detailed follow-ups from #5226. In particular, update docs/voice/quickstart.md and docs/voice/pipeline.md with the new default and explicit prior-model override; docs/human_in_the_loop.md with legacy approval/MCP restoration guidance; docs/tools.md and docs/realtime/transport.md with callback/message limits and overrides; docs/sessions/encrypted_session.md with trusted plaintext migration through add_items(). The inherited MCP, sandbox, tracing and SQLAlchemy guidance remains part of that separate documentation handoff.
• Publication timing: coordinate inherited migration documentation with 0.23.1 availability on PyPI.

Notes

• This report reviews v0.23.0 through the pinned candidate and reuses the earlier assessment only for unchanged inherited runtime paths. It is not a claim that 0.23.0 was published on PyPI.
• Normal exact-head CI/package checks are successful. Release readiness fails solely for the missing human approval expected at this handoff. No live API calls or routine local CI rerun were needed for this assessment.
• The separate experimental backfill changes are absent from this candidate.
• PyPI registry binding and the eventual uploaded artifact provenance require publication-time verification. A green source assessment does not prove publication succeeded.
• Any new candidate head invalidates this approval body.

0.23.0 (2026-10-01)

Features

• mcp: add configurable MCP listing page limits (#5133) (9a21ab1)
• sandbox: add opt-in Docker removal protection (#5116) (ae5803f)
• sandbox: allow configuring memory consolidation turns (#5135) (daa1bcb)
• sessions: add an opt-in encrypted history scan budget (#5118) (a2fdb94)

Bug Fixes

• avoid awaiting cleanup during coroutine closure (#5163) (719c4e7)
• ci: update and group CodeQL actions together (#5262) (f76153c)
• ci: validate release source before building distributions (#5220) (2747c1c)
• core/extensions: respect sensitive trace capture for model metadata (#5129) (88b722d)
• core: bound agent tool streaming callback backlogs (#5106) (f23da76)
• core: isolate nested agent tool state across fresh runs (#5123) (46cc8d8)
• core: preserve closed parent constraints in singleton allOf (#5131) (f010d18)
• core: preserve guarded final outputs in agent tools (#5115) (f3a15f6)
• core: preserve structured guardrail diagnostics and agent output during persistence (#5016) (51bcea7)
• core: preserve tool identity during asynchronous enablement (#5136) (f2ae64c)
• core: redact default tool failure details (#5112) (40956e0)
• core: redact streaming task exception tracebacks (#5121) (c329e92)
• core: reject silently discarded kwargs tool arguments (#5174) (a9b1ce7)
• core: resolve tools after agent start hooks (#5124) (5237420)
• core: restore nested agent tool state against the tool's own agent (#5142) (ad93f54)
• core: retry pre-request WebSocket handshake failures (#4780) (265f16f)
• core: scope function tool approvals to their owning agent (#5144) (de25d82)
• core: select built-in shell and apply_patch tools by their own type (#4952) (eb68131)
• core: serialize only traced fields in ModelSettings.to_traceable_dict (#5003) (57f0b38)
• core: validate agent tool stream callbacks before execution (#5125) (fae72a4)
• core: validate tool_use_behavior callback results (#5173) (5a2d63f)
• deps-dev: bump coverage from 7.10.3 to 7.16.1 (#5152) (47c21ee)
• deps-dev: bump cryptography from 50.0.0 to 50.0.1 (#5234) (e6c6806)
• deps-dev: bump dapr from 1.16.0 to 1.18.3 (#5154) (e94309d)
• deps-dev: bump pymongo from 4.16.0 to 4.18.1 (#5155) (971c5f3)
• deps-dev: bump ruff from 0.9.2 to 0.16.8 (#5249) (9d2b318)
• deps-dev: bump textual from 8.2.3 to 8.2.8 (#5248) (f2df6e4)
• deps-dev: bump types-pynput from 1.8.1.20250809 to 1.8.1.20260712 (#5246) (582d048)
• deps: bump actions/create-github-app-token from 2.2.2 to 3.2.0 (#5245) (e6467e2)
• deps: bump anyio from 4.10.0 to 4.14.2 (#5091) (0910b46)
• deps: bump astral-sh/setup-uv from 9.0.0 to 10.2.0 (#5252) (52aa07c)
• deps: bump cbor2 from 5.9.0 to 6.1.4 (#5153) (34952bc)
• deps: bump pyjwt from 2.13.0 to 2.15.0 (#5271) (dc81a17)
• deps: bump runloop-api-client from 1.31.0 to 1.32.0 (#5156) (32edd3c)
• deps: bump temporalio from 1.26.0 to 1.33.0 (#5233) (6b5bad7)
• deps: bump the codeql group with 2 updates (#5273) (fffe955)
• deps: bump urllib3 from 2.7.0 to 2.8.0 (#5256) (28e9f4f)
• deps: update httpx2 requirement from >=2.12.0 to >=2.13.0 in /examples/realtime/twilio (#5147) ([153b3f1](https://...

What's Changed

• fix(core): align conditional approvals with validated tool arguments by @seratch in #5066
• fix(core): deliver tool-not-found output on server-managed resume by @hyeonsang010716 in #4947
• fix(sandbox): keep command paths POSIX on a Windows host by @hyeonsang010716 in #4958
• fix(sessions): handle concurrent async SQLite startup by @00200200 in #4987
• fix(sessions): do not forward session limit as Conversations page size by @tiagovilasboas in #4961
• fix(tracing): do not cache a missing OPENAI_API_KEY by @hyeonsang010716 in #5017
• fix(extensions): include shell and apply_patch calls in AdvancedSQLiteSession's tool usage by @rioyu123 in #4982
• fix(extensions): reap subprocesses on early stream close by @Hughhhhcoder in #4804
• fix(extensions): preserve exact IDs in AdvancedSQLiteSession.delete_branch by @jiangLLM in #4980

Documentation & Other Changes

• docs: align repository security and contributor guidance by @jbeckwith-oai in #4962
• docs: clarify Unix-local execution boundaries by @seratch in #5064
• docs: update translated pages by @seratch in #5065
• docs(examples): drop the duplicated word in the Temporal trace name by @simpleqt in #5079
• chore: enable Python Dependabot coverage with release-age cooldowns by @jbeckwith-oai in #4964
• chore: add code ownership and required release review guidance by @jbeckwith-oai in #4965
• fix(deps): update vulnerable dependencies without changing SDK APIs by @jbeckwith-oai in #4963
• chore(deps): update fastapi requirement from >=0.120.0 to >=0.141.1 in /examples/realtime/twilio_sip by @dependabot[bot] in #4966
• chore(deps): update uvicorn requirement from >=0.38.0 to >=0.52.4 in /examples/realtime/twilio_sip by @dependabot[bot] in #4968
• chore(deps): update openai requirement from <4,>=3.0.0 to >=3.8.0,<4 in /examples/realtime/twilio_sip by @dependabot[bot] in #4969
• chore(deps): bump typing-extensions from 4.14.1 to 4.16.0 by @dependabot[bot] in #4970
• chore(deps-dev): bump grpcio from 1.76.0 to 1.83.1 by @dependabot[bot] in #4971
• chore(deps): bump sqlalchemy from 2.0.43 to 2.0.52 by @dependabot[bot] in #4973
• chore(deps-dev): bump cryptography from 45.0.7 to 50.0.0 by @dependabot[bot] in #4975
• ci: add Python and Actions CodeQL security scanning by @jbeckwith-oai in #4974
• fix(ci): deploy docs after dependency and workflow updates by @dependabot[bot] in #4976
• fix(deps): update python-multipart requirement from >=0.0.31 to >=0.0.32 in /examples/realtime/twilio by @dependabot[bot] in #5030
• fix(deps): update python-dotenv requirement from >=1.2.2 to >=1.2.3 in /examples/realtime/twilio by @dependabot[bot] in #5031
• fix(deps): update starlette requirement from >=1.3.1 to >=1.6.0 in /examples/realtime/twilio_sip by @dependabot[bot] in #5033
• fix(deps): update python-dotenv requirement from >=1.2.2 to >=1.2.3 in /examples/realtime/twilio_sip by @dependabot[bot] in #5034
• fix(deps-dev): bump pymdown-extensions from 11.0.1 to 11.0.2 by @dependabot[bot] in #5036
• fix(deps): bump runloop-api-client from 1.16.0 to 1.31.0 by @dependabot[bot] in #5037
• fix(deps): bump starlette from 1.3.1 to 1.6.0 by @dependabot[bot] in #5038
• fix(deps): update starlette requirement from >=1.3.1 to >=1.6.0 in /examples/realtime/twilio by @dependabot[bot] in #5032
• Add SDKs team as repository code owner by @jbeckwith-oai in #5058
• release: 0.22.3 by @seratch in #5077

New Contributors

• @hyeonsang010716 made their first contribution in #4947
• @jbeckwith-oai made their first contribution in #4962
• @00200200 made their first contribution in #4987
• @jiangLLM made their first contribution in #4980
• @tiagovilasboas made their first contribution in #4961

Full Changelog: v0.22.2...v0.22.3

What's Changed

• feat: support current image generation tool options by @seratch in #4932
• fix(sandbox): prevent UnixLocal file API symlink races by @seratch in #4931
• fix(sessions): reset compaction response chain after pop by @rksharma-owg in #4934

Documentation & Other Changes

• docs: document v0.22.1 behavior updates by @seratch in #4577
• release: 0.22.2 by @seratch in #4935

Full Changelog: v0.22.1...v0.22.2

What's Changed

• feat(core): support image results in web search tools by @seratch in #4898
• feat(core): customize output guardrail blocked messages by @seratch in #4594
• feat(mcp): add server-wide guardrails to MCP tools by @seratch in #4632
• feat(sandbox): add configurable Unix-local environment isolation by @seratch in #4640
• feat(sandbox): allow labels on Docker sandbox containers by @seanxuu in #4564
• feat(voice): expose streamed transcription options by @seratch in #4645
• fix(core): detach aggregated request usage entries by @green3sf in #4519
• fix(core): fail closed on empty tool arguments by @hsusul in #4545
• fix(core): strip created_by when replaying RunItems as input by @hsusul in #4568
• fix(core): strict_schema error message, REPL whitespace input, debug docstrings by @simpleqt in #4600
• fix(core): max_turns no longer clobbers a tripped input guardrail exception in streaming by @shoemoney in #4606
• fix(core): preserve serialized approval resume ownership by @seratch in #4613
• fix(core): read tool args without Pydantic property shadowing by @hsusul in #4627
• fix(core): accept JSON Schema type arrays of object for tool outputs by @hsusul in #4647
• fix(core): honor End of File hunks when the file ends in a newline by @lllakshit in #4661
• fix(core): preserve tuple annotations for variadic tool arguments by @Excelius-Wang in #4655
• fix(core): fix streamed response span losing response/input when consumer stops at completed event by @XuQuanxin04 in #4692
• fix(core): apply **kwargs value annotation to each keyword value by @abhay-codes07 in #4714
• fix(core): reject **kwargs keys that collide with named tool parameters by @rajarshidattapy in #4674
• fix(core): reject fixed-length tuple annotations for variadic tool arguments by @subhashpolisetti in #4735
• fix(core): preserve Field constraints on variadic tool parameters by @rioyu123 in #4739
• fix(core): close model providers created by Runner by @Excelius-Wang in #4785
• fix(core/voice): honor OpenAI provider options over default clients by @green3sf in #4530
• fix(chat-completions): merge a streamed turn's message into its pending tool-call message by @mmjerge in #4728
• fix(chat-completions): raise ModelBehaviorError on truncated empty completions by @weike-zhang in #4513
• fix(chat-completions) reject unpaired function outputs in Chat Completions by @apcha-oai in #4699
• fix(extensions): skip AdvancedSQLiteSession usage store when the branch has no turn by @rioyu123 in #4822
• fix(extensions): nest extra_body on the any-llm chat path by @hsusul in #4544
• fix(mcp): deep-copy cached tools before returning them by @hsusul in #4525
• fix(mcp): clear active MCP servers after cleanup by @sylvesterkaczmarek in #4586
• fix(mcp): deduplicate managed servers by @hsusul in #4591
• fix(realtime): advance crossed guardrail thresholds by @hsusul in #4590
• fix(realtime): preserve item status on retrieved conversation items by @shoutoutuoadi325 in #4598
• fix(sandbox): finish dependency cleanup on cancellation by @hsusul in #4607
• fix(sandbox): keep unbounded UnixLocal workspace I/O off the event loop by @ayaangazali in #4700
• fix(sandbox): preserve UTF-8 boundaries in Cloudflare SSE by @Hughhhhcoder in #4707
• fix(sandbox): clean up PTY startup cancellation by @Hughhhhcoder in #4750
• fix(sandbox): settle PTY output before cleanup by @seratch in #4738
• fix(sandbox): preserve workdir for shell command lists by @hsusul in #4915
• fix(sessions): recover failed resumed Session writes before model calls by @seratch in #4630
• fix(sessions): recover failed resumed Session writes on a renewed interruption by @ayaangazali in #4650
• fix(sessions): persist resumed tool guardrail results by @FU-max-boop in #4654
• fix(sessions): recover resumed handoffs after session append failures by @seratch in #4725
• fix(sessions): settle conversation deletion before propagating cancellation by @Excelius-Wang in #4790
• fix(sessions): preserve concurrent writes during compaction by @seratch in #4736
• fix(sessions): reject resuming a run whose accepted terminal output was not persisted by @Ayushraj06-bit in #4698
• fix(sessions): preserve Session transformations during generation tracking by @seratch in #4917
• fix(tracing): flush buffered data after tracing is disabled by @sylvesterkaczmarek in #4528
• fix(tracing): preserve response IDs in redacted traces by @seratch in #4641
• fix(tracing): record the tool output on approval-gated function spans by @dfedoryshchev in #4866
• fix(voice): support custom OpenAI TTS voice IDs by @sylvesterkaczmarek in #4541
• fix(voice): forward streamed STT language and prompt by @seratch in #4574
• fix(voice): honor client config for streamed STT by @seratch in #4575
• fix(voice) reject ignored explicit-client options by @sylvesterkaczmarek in #4527
• fix(voice): include current OpenAI TTS voices by @sylvesterkaczmarek in #4535
• fix(voice): use monotonic STT event deadlines by @seratch in #4593
• fix(voice): support context in single-agent workflow by @sylvesterkaczmarek in #4636
• fix(voice): enforce public Voice class state coverage by @seratch in #4644
• fix(voice): redact STT prompts from traces by @hsusul in #4663
• fix(voice): redact TTS instructions from speech spans by @ayaangazali in #4676
• fix(voice): accept every NumPy spelling of a supported TTS dtype by @Nikhils-G in #4778
• fix(voice): wake stream when producer is cancelled by @Hughhhhcoder in #4825
• fix(visualization): preserve nodes with duplicate names by @tandede in #4512
• refactor: extract RunState agent graph identity by @seratch in #4876
• refactor: share provider generation-span population by @seratch in #4877

Documentation & Other Changes

• docs: document v0.22.0 behavior changes by @seratch in #4522
• docs: fix wording in handoff example prompts by @Chair403 in #4520
• docs: preserve English heading anchors in translated pages by @saime428 in #4580
• docs: refresh tracing integration links by @seratch in #4634
• docs: clarify capability visibility and authorization by @seratch in #4642
• docs: clarify database driver installation for SQLAlchemy sessions by @rioyu123 in #4743
• docs: skip reference pages on Windows by @sylvesterkaczmarek in #4761
• docs: clarify requ...

Key Changes

Version 0.22.0 is a minor release because it adds substantial runtime hardening and tightens an existing provider configuration contract. Applications that combine an explicit openai_client with organization or project must move those values to the AsyncOpenAI client.

Highlights:

• Redacts terminal function-tool output rejected by agent output guardrails from replayable and persisted SDK state.
• Raises ModelBehaviorError for non-streaming Responses with terminal status failed or incomplete.
• Rejects conflicting provider options when OpenAIProvider receives an explicit client.
• Isolates usage accounting between independent RunState checkpoints while preserving nested-agent aggregation.
• Expands agents registered through handoff(agent) in generated graphs.
• Clarifies the existing shallow-copy behavior of Agent.clone() and RealtimeAgent.clone().

What's Changed

• fix(core): redact blocked tool outputs from replay state by @seratch in #4507
• fix(core): reject ignored explicit-client options for OpenAIProvider by @sylvesterkaczmarek in #4497
• fix(core): preserve Griffe logger inheritance by @sylvesterkaczmarek in #4494
• fix(core): reject terminal failed/incomplete responses in non-streaming get_response by @weike-zhang in https://github.* * fix(core): isolate usage between RunState checkpoints by @chiruu12 in #4479
  fix(sandbox): require apply_patch update hunks by @li2631026381-alt in #4470
• fix(sandbox): enforce Windows mypy compatibility by @seratch in #4499
• fix(tracing): respect model-data logging redaction for record_model_error_on_span by @sylvesterkaczmarek in #4496
• fix(tracing): clean up processors after tracing is disabled by @sylvesterkaczmarek in #4502
• fix(visualization): expand handoff() targets in agent graphs by @hsusul in #4517

Documentation & Other Changes

• docs: document v0.21.1 runtime behavior by @seratch in #4460
• docs: correct Agent.clone list attribute semantics by @thegoodengineer in #4474
• docs: add testing resources to llms indexes by @teachershuang in #4509
• ci: align Python version coverage by @seratch in #4475
• test: use sys.executable instead of tee for the stdio placeholder command by @ErenAta16 in #4478
• fix: keep Codex verification for development sandboxed by @seratch in #4508
  com//pull/4516
• release: 0.22.0 by @seratch in #4523

New Contributors

• @li2631026381-alt made their first contribution in #4470
• @thegoodengineer made their first contribution in #4474
• @teachershuang made their first contribution in #4509
• @weike-zhang made their first contribution in #4516
• @chiruu12 made their first contribution in #4479

Full Changelog: v0.21.1...v0.22.0

What's Changed

• feat(core): add model call timeouts by @seratch in #4428
• feat(sandbox): add run-scoped sandbox working directories by @seratch in #4427
• feat(sandbox): allow Docker sandboxes to disable networking by @koadegno in #4452
• feat(sandbox): add Modal sandbox resource options by @Filimoa in #4455
• fix(core): honor exact call approval decisions by @seratch in #4447
• fix(core): count Responses requests without usage by @seratch in #4453
• fix(core): close all MultiProvider children after failures by @fszcd in #4438
• fix(core): reject partially matched stacked anchors by @Coiggahou2002 in #4431
• fix(chat-completions): Chat Completions reasoning replay by @seratch in #4432
• fix(realtime): truncate audio at zero elapsed time by @Chirag6722 in #4457
• fix(realtime): end iteration after clean server close by @seratch in #4461
• fix(sessions): prevent advanced SQLite structure table conflicts by @seratch in #4454
• fix(sessions): include compaction usage in run totals by @seratch in #4446
• fix(sandbox): validate view_image raster content by @seratch in #4462
• fix(sandbox): keep model paths POSIX-normalized by @sylvesterkaczmarek in #4416
• fix(sandbox): normalize apply_patch paths as POSIX by @sylvesterkaczmarek in #4437

Documentation & Other Changes

• docs: updates for v0.21.0 release by @seratch in #4381
• docs: list Tuning Engines tracing integration by @cerebrixos in #4440
• fix: update cffi lock for Python 3.14 by @seratch in #4448
• release: 0.21.1 by @seratch in #4467

New Contributors

• @Coiggahou2002 made their first contribution in #4431
• @fszcd made their first contribution in #4438
• @cerebrixos made their first contribution in #4440
• @Filimoa made their first contribution in #4455
• @koadegno made their first contribution in #4452
• @Chirag6722 made their first contribution in #4457

Full Changelog: v0.21.0...v0.21.1