v0.24.0

0.24.0 (2026-10-15)

Features

• expose MCP annotations on converted tools (#5356) (75813f8)
• support run-wide tool exception formatting (#5326) (8fd9a7c)

Bug Fixes

• batch OpenAI conversation session writes within the API limit (#5334) (26345c1)
• defer automatic compaction for pending approvals (#5363) (5eb47a5)
• deps-dev: bump fastapi from 0.139.2 to 0.141.1 (#5312) (cdf23bd)
• deps-dev: bump grpcio from 1.83.1 to 1.84.0 (#5310) (a85487e)
• deps-dev: bump pymdown-extensions from 11.0.2 to 12.1 (#5314) (d9758b0)
• deps-dev: bump pymongo from 4.18.1 to 4.18.2 (#5313) (858856f)
• deps: bump boto3 from 1.42.75 to 1.43.109 (#5378) (7da6a92)
• deps: bump filelock from 3.20.3 to 4.0.12 (#5375) (14f4553)
• deps: bump fsspec from 2025.7.0 to 2026.6.0 (#5317) (66504e9)
• deps: bump redis from 7.0.1 to 8.1.0 (#5379) (24ebf1c)
• deps: bump temporalio from 1.33.0 to 1.34.0 (#5377) (c148280)
• deps: bump vercel-sandbox from 0.7.0 to 0.8.0 (#5374) (2938d87)
• deps: update fastapi requirement from >=0.141.1 to >=0.142.2 in /examples/realtime/twilio_sip (#5372) (f47d2c3)
• deps: update fastapi requirement in /examples/realtime/twilio_sip (f47d2c3)
• deps: update openai requirement from <4,>=3.19.1 to >=3.20.0,<4 in /examples/realtime/twilio_sip (#5308) (f346950)
• deps: update openai requirement from <4,>=3.20.0 to >=3.26.0,<4 in /examples/realtime/twilio_sip (#5376) (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (172ff5e)
• deps: update openai requirement in /examples/realtime/twilio_sip (f346950)
• deps: update pyjwt requirement from >=2.15.0 to >=2.15.1 in /examples/realtime/twilio (#5306) (7ca3c44)
• deps: update pyjwt requirement in /examples/realtime/twilio (7ca3c44)
• deps: update python-dotenv requirement (408c33f)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio (#5373) (c4cc409)
• deps: update python-dotenv requirement from >=1.2.3 to >=1.2.4 in /examples/realtime/twilio_sip (#5371) (408c33f)
• deps: update python-dotenv requirement in /examples/realtime/twilio (c4cc409)
• deps: update twilio requirement from <10,>=9.11.1 to >=9.11.2,<10 in /examples/realtime/twilio (#5307) (cb03652)
• deps: update twilio requirement in /examples/realtime/twilio (cb03652)
• deps: update uvicorn requirement from >=0.53.0 to >=0.54.0 in /examples/realtime/twilio_sip (#5309) (f84fe73)
• deps: update uvicorn requirement in /examples/realtime/twilio_sip (f84fe73)
• examples: render realtime tool events as text (#5283) (81f0ccf)
• honor Runner tracing opt-out inside caller traces (#5296) (8c4aa08)
• memory: replace Redis compaction history atomically (#5354) (f50525c)
• omit unserializable dataclass run contexts (#5303) (d7e52c3)
• preserve caller-owned exceptions during sandbox redaction (#5367) (2244e9f)
• preserve completed tool outputs when a sibling fails (#5332) (1c1a28d)
• preserve embedded separators in sandbox patches (#5365) (67d4f8a)
• preserve function-call aliases across RunState restoration (#5358) (f093ced)
• Preserve parameter descriptions in Args-only docstrings (#5302) (a726a9c)
• preserve RunState agent ownership across hook state changes (#5362) (d8e0a76)
• preserve tool outputs after callback failures (#5318) (71c2da4)
• recover from invalid sandbox tool arguments (#5321) (6ba967b)
• reject pending input when completed stop tools end resume (#5366) ([5a30187](https://github.com/openai/openai-agents-python/comm...

v0.23.1

0.23.1 (2026-10-02)

Bug Fixes

• restore release tests and refresh required readiness check (#5278) (730deb4)

Release readiness review (v0.23.0 -> TARGET 0a5a08b)

This is a release readiness report done by $final-release-review skill.

Diff

v0.23.0...0a5a08b

Release intent

• Review mode: final candidate
• Intended release: patch, 0.23.1
• Minimum required release type: patch
• Versioning verdict: compatible

Release call

🟢 GREEN LIGHT TO SHIP this exact candidate. No concrete release-blocking regression was identified. Human approval and normal repository protections still apply.

Scope summary

• 28 files changed (+622/-42): release automation, test fixtures, integration/example tooling, and release metadata.
• The clean candidate contains current main a575a6e637feb9aea1b591237b007dd4991ddfba plus only six release-owned metadata files. Package, lockfile, manifest, source version and API baseline agree on 0.23.1. Snapshot source b31b9f8d13d49142a64f8873f2cc2ee40441a795 is an ancestor of the candidate.
• Relative to v0.23.0, SDK runtime source changes only its version string. API snapshot content, dependencies, Python support and persisted schemas are unchanged.

Risk assessment (ordered by impact)

1. First PyPI publication of the 0.23 series includes earlier migration requirements

   • Risk: 🟢 LOW with the previously reviewed migration paths. Users upgrading from 0.22.3 receive the 0.23.0 behavior changes as well as this patch.
   • Evidence: PyPI has neither 0.23.0 nor 0.23.1. The 0.23.0 release assessment in #5226 covers strict tools, approval restoration, encrypted history, resource limits, voice defaults and provider changes; this candidate does not alter those runtime paths.
   • Files: CHANGELOG.md, src/agents/version.py; unchanged 0.23.0 runtime contracts assessed in #5226.
   • Action: Carry forward the 0.23.0 migration guidance in the 0.23.1 announcement, particularly explicit strict-tool parameters, fresh legacy approvals, trusted encrypted-history import, resource-limit overrides and the explicit prior voice-model override.

2. Release checks recover without changing package behavior

   • Risk: 🟢 LOW. Test-loop initialization and required-check ownership are corrected while publication authorization remains intact.
   • Evidence: OS mocks are installed after event-loop initialization and restored before teardown. Authorized review events rerun the current PR-triggered readiness check instead of replacing or cancelling it. Source validation, native human approval, isolated builds and OIDC publishing remain unchanged.
   • Files: tests/sandbox/test_unix_local_user_file_io.py, .github/scripts/release_automation.py, .github/workflows/release-readiness-refresh.yml, .github/workflows/release-readiness.yml.
   • Action: Submit the exact-head human approval, allow readiness to refresh, merge through normal protections, and verify the publisher and uploaded provenance.

3. External-provider coverage now requires explicit maintainer intent

   • Risk: 🟢 LOW with an existing opt-in path. Default integration and automatic example runs no longer implicitly select the affected external-provider cases.
   • Evidence: Integration bootstrap resets inherited enable flags, removes the listed external-provider credentials by default, and rejects external model overrides without opt-in. External cases are deselected by default; automatic examples use the expanded skip list. Manual example selection remains available.
   • Files: .github/scripts/run_integration_tests.py, integration_tests/conftest.py, Makefile, examples/run_examples.py, integration_tests/README.md.
   • Action: Use make integration-tests-providers-external, adding -- --all when direct-provider coverage is intended. Do not interpret default coverage as external-provider validation.

Documentation coverage (non-blocking)

• Coverage source: current open PRs #5279 and #4828; #4828 head fa2c43bc9e252c75d76d60c06959a725f1dc0205 has no release documentation coverage. No separate open docs/ PR was found after inspecting the current file lists.
• Status: covered for this patch's maintainer workflows; partially covered for inherited 0.23.0 migrations.
• Covered obligations: .github/RELEASING.md explains readiness refresh and retry; integration_tests/README.md explains explicit external-provider execution and credential behavior.
• Post-release suggestions: retain the detailed follow-ups from #5226. In particular, update docs/voice/quickstart.md and docs/voice/pipeline.md with the new default and explicit prior-model override; docs/human_in_the_loop.md with legacy approval/MCP restoration guidance; docs/tools.md and docs/realtime/transport.md with callback/message limits and overrides; docs/sessions/encrypted_session.md with trusted plaintext migration through add_items(). The inherited MCP, sandbox, tracing and SQLAlchemy guidance remains part of that separate documentation handoff.
• Publication timing: coordinate inherited migration documentation with 0.23.1 availability on PyPI.

Notes

• This report reviews v0.23.0 through the pinned candidate and reuses the earlier assessment only for unchanged inherited runtime paths. It is not a claim that 0.23.0 was published on PyPI.
• Normal exact-head CI/package checks are successful. Release readiness fails solely for the missing human approval expected at this handoff. No live API calls or routine local CI rerun were needed for this assessment.
• The separate experimental backfill changes are absent from this candidate.
• PyPI registry binding and the eventual uploaded artifact provenance require publication-time verification. A green source assessment does not prove publication succeeded.
• Any new candidate head invalidates this approval body.

v0.23.0

0.23.0 (2026-10-01)

Features

• mcp: add configurable MCP listing page limits (#5133) (9a21ab1)
• sandbox: add opt-in Docker removal protection (#5116) (ae5803f)
• sandbox: allow configuring memory consolidation turns (#5135) (daa1bcb)
• sessions: add an opt-in encrypted history scan budget (#5118) (a2fdb94)

Bug Fixes

• avoid awaiting cleanup during coroutine closure (#5163) (719c4e7)
• ci: update and group CodeQL actions together (#5262) (f76153c)
• ci: validate release source before building distributions (#5220) (2747c1c)
• core/extensions: respect sensitive trace capture for model metadata (#5129) (88b722d)
• core: bound agent tool streaming callback backlogs (#5106) (f23da76)
• core: isolate nested agent tool state across fresh runs (#5123) (46cc8d8)
• core: preserve closed parent constraints in singleton allOf (#5131) (f010d18)
• core: preserve guarded final outputs in agent tools (#5115) (f3a15f6)
• core: preserve structured guardrail diagnostics and agent output during persistence (#5016) (51bcea7)
• core: preserve tool identity during asynchronous enablement (#5136) (f2ae64c)
• core: redact default tool failure details (#5112) (40956e0)
• core: redact streaming task exception tracebacks (#5121) (c329e92)
• core: reject silently discarded kwargs tool arguments (#5174) (a9b1ce7)
• core: resolve tools after agent start hooks (#5124) (5237420)
• core: restore nested agent tool state against the tool's own agent (#5142) (ad93f54)
• core: retry pre-request WebSocket handshake failures (#4780) (265f16f)
• core: scope function tool approvals to their owning agent (#5144) (de25d82)
• core: select built-in shell and apply_patch tools by their own type (#4952) (eb68131)
• core: serialize only traced fields in ModelSettings.to_traceable_dict (#5003) (57f0b38)
• core: validate agent tool stream callbacks before execution (#5125) (fae72a4)
• core: validate tool_use_behavior callback results (#5173) (5a2d63f)
• deps-dev: bump coverage from 7.10.3 to 7.16.1 (#5152) (47c21ee)
• deps-dev: bump cryptography from 50.0.0 to 50.0.1 (#5234) (e6c6806)
• deps-dev: bump dapr from 1.16.0 to 1.18.3 (#5154) (e94309d)
• deps-dev: bump pymongo from 4.16.0 to 4.18.1 (#5155) (971c5f3)
• deps-dev: bump ruff from 0.9.2 to 0.16.8 (#5249) (9d2b318)
• deps-dev: bump textual from 8.2.3 to 8.2.8 (#5248) (f2df6e4)
• deps-dev: bump types-pynput from 1.8.1.20250809 to 1.8.1.20260712 (#5246) (582d048)
• deps: bump actions/create-github-app-token from 2.2.2 to 3.2.0 (#5245) (e6467e2)
• deps: bump anyio from 4.10.0 to 4.14.2 (#5091) (0910b46)
• deps: bump astral-sh/setup-uv from 9.0.0 to 10.2.0 (#5252) (52aa07c)
• deps: bump cbor2 from 5.9.0 to 6.1.4 (#5153) (34952bc)
• deps: bump pyjwt from 2.13.0 to 2.15.0 (#5271) (dc81a17)
• deps: bump runloop-api-client from 1.31.0 to 1.32.0 (#5156) (32edd3c)
• deps: bump temporalio from 1.26.0 to 1.33.0 (#5233) (6b5bad7)
• deps: bump the codeql group with 2 updates (#5273) (fffe955)
• deps: bump urllib3 from 2.7.0 to 2.8.0 (#5256) (28e9f4f)
• deps: update httpx2 requirement from >=2.12.0 to >=2.13.0 in /examples/realtime/twilio (#5147) ([153b3f1](https://...

v0.22.3

What's Changed

• fix(core): align conditional approvals with validated tool arguments by @seratch in #5066
• fix(core): deliver tool-not-found output on server-managed resume by @hyeonsang010716 in #4947
• fix(sandbox): keep command paths POSIX on a Windows host by @hyeonsang010716 in #4958
• fix(sessions): handle concurrent async SQLite startup by @00200200 in #4987
• fix(sessions): do not forward session limit as Conversations page size by @tiagovilasboas in #4961
• fix(tracing): do not cache a missing OPENAI_API_KEY by @hyeonsang010716 in #5017
• fix(extensions): include shell and apply_patch calls in AdvancedSQLiteSession's tool usage by @rioyu123 in #4982
• fix(extensions): reap subprocesses on early stream close by @Hughhhhcoder in #4804
• fix(extensions): preserve exact IDs in AdvancedSQLiteSession.delete_branch by @jiangLLM in #4980

Documentation & Other Changes

• docs: align repository security and contributor guidance by @jbeckwith-oai in #4962
• docs: clarify Unix-local execution boundaries by @seratch in #5064
• docs: update translated pages by @seratch in #5065
• docs(examples): drop the duplicated word in the Temporal trace name by @simpleqt in #5079
• chore: enable Python Dependabot coverage with release-age cooldowns by @jbeckwith-oai in #4964
• chore: add code ownership and required release review guidance by @jbeckwith-oai in #4965
• fix(deps): update vulnerable dependencies without changing SDK APIs by @jbeckwith-oai in #4963
• chore(deps): update fastapi requirement from >=0.120.0 to >=0.141.1 in /examples/realtime/twilio_sip by @dependabot[bot] in #4966
• chore(deps): update uvicorn requirement from >=0.38.0 to >=0.52.4 in /examples/realtime/twilio_sip by @dependabot[bot] in #4968
• chore(deps): update openai requirement from <4,>=3.0.0 to >=3.8.0,<4 in /examples/realtime/twilio_sip by @dependabot[bot] in #4969
• chore(deps): bump typing-extensions from 4.14.1 to 4.16.0 by @dependabot[bot] in #4970
• chore(deps-dev): bump grpcio from 1.76.0 to 1.83.1 by @dependabot[bot] in #4971
• chore(deps): bump sqlalchemy from 2.0.43 to 2.0.52 by @dependabot[bot] in #4973
• chore(deps-dev): bump cryptography from 45.0.7 to 50.0.0 by @dependabot[bot] in #4975
• ci: add Python and Actions CodeQL security scanning by @jbeckwith-oai in #4974
• fix(ci): deploy docs after dependency and workflow updates by @dependabot[bot] in #4976
• fix(deps): update python-multipart requirement from >=0.0.31 to >=0.0.32 in /examples/realtime/twilio by @dependabot[bot] in #5030
• fix(deps): update python-dotenv requirement from >=1.2.2 to >=1.2.3 in /examples/realtime/twilio by @dependabot[bot] in #5031
• fix(deps): update starlette requirement from >=1.3.1 to >=1.6.0 in /examples/realtime/twilio_sip by @dependabot[bot] in #5033
• fix(deps): update python-dotenv requirement from >=1.2.2 to >=1.2.3 in /examples/realtime/twilio_sip by @dependabot[bot] in #5034
• fix(deps-dev): bump pymdown-extensions from 11.0.1 to 11.0.2 by @dependabot[bot] in #5036
• fix(deps): bump runloop-api-client from 1.16.0 to 1.31.0 by @dependabot[bot] in #5037
• fix(deps): bump starlette from 1.3.1 to 1.6.0 by @dependabot[bot] in #5038
• fix(deps): update starlette requirement from >=1.3.1 to >=1.6.0 in /examples/realtime/twilio by @dependabot[bot] in #5032
• Add SDKs team as repository code owner by @jbeckwith-oai in #5058
• release: 0.22.3 by @seratch in #5077

New Contributors

• @hyeonsang010716 made their first contribution in #4947
• @jbeckwith-oai made their first contribution in #4962
• @00200200 made their first contribution in #4987
• @jiangLLM made their first contribution in #4980
• @tiagovilasboas made their first contribution in #4961

Full Changelog: v0.22.2...v0.22.3

v0.22.2

What's Changed

• feat: support current image generation tool options by @seratch in #4932
• fix(sandbox): prevent UnixLocal file API symlink races by @seratch in #4931
• fix(sessions): reset compaction response chain after pop by @rksharma-owg in #4934

Documentation & Other Changes

• docs: document v0.22.1 behavior updates by @seratch in #4577
• release: 0.22.2 by @seratch in #4935

Full Changelog: v0.22.1...v0.22.2

v0.22.1

What's Changed

• feat(core): support image results in web search tools by @seratch in #4898
• feat(core): customize output guardrail blocked messages by @seratch in #4594
• feat(mcp): add server-wide guardrails to MCP tools by @seratch in #4632
• feat(sandbox): add configurable Unix-local environment isolation by @seratch in #4640
• feat(sandbox): allow labels on Docker sandbox containers by @seanxuu in #4564
• feat(voice): expose streamed transcription options by @seratch in #4645
• fix(core): detach aggregated request usage entries by @green3sf in #4519
• fix(core): fail closed on empty tool arguments by @hsusul in #4545
• fix(core): strip created_by when replaying RunItems as input by @hsusul in #4568
• fix(core): strict_schema error message, REPL whitespace input, debug docstrings by @simpleqt in #4600
• fix(core): max_turns no longer clobbers a tripped input guardrail exception in streaming by @shoemoney in #4606
• fix(core): preserve serialized approval resume ownership by @seratch in #4613
• fix(core): read tool args without Pydantic property shadowing by @hsusul in #4627
• fix(core): accept JSON Schema type arrays of object for tool outputs by @hsusul in #4647
• fix(core): honor End of File hunks when the file ends in a newline by @lllakshit in #4661
• fix(core): preserve tuple annotations for variadic tool arguments by @Excelius-Wang in #4655
• fix(core): fix streamed response span losing response/input when consumer stops at completed event by @XuQuanxin04 in #4692
• fix(core): apply **kwargs value annotation to each keyword value by @abhay-codes07 in #4714
• fix(core): reject **kwargs keys that collide with named tool parameters by @rajarshidattapy in #4674
• fix(core): reject fixed-length tuple annotations for variadic tool arguments by @subhashpolisetti in #4735
• fix(core): preserve Field constraints on variadic tool parameters by @rioyu123 in #4739
• fix(core): close model providers created by Runner by @Excelius-Wang in #4785
• fix(core/voice): honor OpenAI provider options over default clients by @green3sf in #4530
• fix(chat-completions): merge a streamed turn's message into its pending tool-call message by @mmjerge in #4728
• fix(chat-completions): raise ModelBehaviorError on truncated empty completions by @weike-zhang in #4513
• fix(chat-completions) reject unpaired function outputs in Chat Completions by @apcha-oai in #4699
• fix(extensions): skip AdvancedSQLiteSession usage store when the branch has no turn by @rioyu123 in #4822
• fix(extensions): nest extra_body on the any-llm chat path by @hsusul in #4544
• fix(mcp): deep-copy cached tools before returning them by @hsusul in #4525
• fix(mcp): clear active MCP servers after cleanup by @sylvesterkaczmarek in #4586
• fix(mcp): deduplicate managed servers by @hsusul in #4591
• fix(realtime): advance crossed guardrail thresholds by @hsusul in #4590
• fix(realtime): preserve item status on retrieved conversation items by @shoutoutuoadi325 in #4598
• fix(sandbox): finish dependency cleanup on cancellation by @hsusul in #4607
• fix(sandbox): keep unbounded UnixLocal workspace I/O off the event loop by @ayaangazali in #4700
• fix(sandbox): preserve UTF-8 boundaries in Cloudflare SSE by @Hughhhhcoder in #4707
• fix(sandbox): clean up PTY startup cancellation by @Hughhhhcoder in #4750
• fix(sandbox): settle PTY output before cleanup by @seratch in #4738
• fix(sandbox): preserve workdir for shell command lists by @hsusul in #4915
• fix(sessions): recover failed resumed Session writes before model calls by @seratch in #4630
• fix(sessions): recover failed resumed Session writes on a renewed interruption by @ayaangazali in #4650
• fix(sessions): persist resumed tool guardrail results by @FU-max-boop in #4654
• fix(sessions): recover resumed handoffs after session append failures by @seratch in #4725
• fix(sessions): settle conversation deletion before propagating cancellation by @Excelius-Wang in #4790
• fix(sessions): preserve concurrent writes during compaction by @seratch in #4736
• fix(sessions): reject resuming a run whose accepted terminal output was not persisted by @Ayushraj06-bit in #4698
• fix(sessions): preserve Session transformations during generation tracking by @seratch in #4917
• fix(tracing): flush buffered data after tracing is disabled by @sylvesterkaczmarek in #4528
• fix(tracing): preserve response IDs in redacted traces by @seratch in #4641
• fix(tracing): record the tool output on approval-gated function spans by @dfedoryshchev in #4866
• fix(voice): support custom OpenAI TTS voice IDs by @sylvesterkaczmarek in #4541
• fix(voice): forward streamed STT language and prompt by @seratch in #4574
• fix(voice): honor client config for streamed STT by @seratch in #4575
• fix(voice) reject ignored explicit-client options by @sylvesterkaczmarek in #4527
• fix(voice): include current OpenAI TTS voices by @sylvesterkaczmarek in #4535
• fix(voice): use monotonic STT event deadlines by @seratch in #4593
• fix(voice): support context in single-agent workflow by @sylvesterkaczmarek in #4636
• fix(voice): enforce public Voice class state coverage by @seratch in #4644
• fix(voice): redact STT prompts from traces by @hsusul in #4663
• fix(voice): redact TTS instructions from speech spans by @ayaangazali in #4676
• fix(voice): accept every NumPy spelling of a supported TTS dtype by @Nikhils-G in #4778
• fix(voice): wake stream when producer is cancelled by @Hughhhhcoder in #4825
• fix(visualization): preserve nodes with duplicate names by @tandede in #4512
• refactor: extract RunState agent graph identity by @seratch in #4876
• refactor: share provider generation-span population by @seratch in #4877

Documentation & Other Changes

• docs: document v0.22.0 behavior changes by @seratch in #4522
• docs: fix wording in handoff example prompts by @Chair403 in #4520
• docs: preserve English heading anchors in translated pages by @saime428 in #4580
• docs: refresh tracing integration links by @seratch in #4634
• docs: clarify capability visibility and authorization by @seratch in #4642
• docs: clarify database driver installation for SQLAlchemy sessions by @rioyu123 in #4743
• docs: skip reference pages on Windows by @sylvesterkaczmarek in #4761
• docs: clarify requ...

v0.22.0

Key Changes

Version 0.22.0 is a minor release because it adds substantial runtime hardening and tightens an existing provider configuration contract. Applications that combine an explicit openai_client with organization or project must move those values to the AsyncOpenAI client.

Highlights:

• Redacts terminal function-tool output rejected by agent output guardrails from replayable and persisted SDK state.
• Raises ModelBehaviorError for non-streaming Responses with terminal status failed or incomplete.
• Rejects conflicting provider options when OpenAIProvider receives an explicit client.
• Isolates usage accounting between independent RunState checkpoints while preserving nested-agent aggregation.
• Expands agents registered through handoff(agent) in generated graphs.
• Clarifies the existing shallow-copy behavior of Agent.clone() and RealtimeAgent.clone().

What's Changed

• fix(core): redact blocked tool outputs from replay state by @seratch in #4507
• fix(core): reject ignored explicit-client options for OpenAIProvider by @sylvesterkaczmarek in #4497
• fix(core): preserve Griffe logger inheritance by @sylvesterkaczmarek in #4494
• fix(core): reject terminal failed/incomplete responses in non-streaming get_response by @weike-zhang in https://github.* * fix(core): isolate usage between RunState checkpoints by @chiruu12 in #4479
  fix(sandbox): require apply_patch update hunks by @li2631026381-alt in #4470
• fix(sandbox): enforce Windows mypy compatibility by @seratch in #4499
• fix(tracing): respect model-data logging redaction for record_model_error_on_span by @sylvesterkaczmarek in #4496
• fix(tracing): clean up processors after tracing is disabled by @sylvesterkaczmarek in #4502
• fix(visualization): expand handoff() targets in agent graphs by @hsusul in #4517

Documentation & Other Changes

• docs: document v0.21.1 runtime behavior by @seratch in #4460
• docs: correct Agent.clone list attribute semantics by @thegoodengineer in #4474
• docs: add testing resources to llms indexes by @teachershuang in #4509
• ci: align Python version coverage by @seratch in #4475
• test: use sys.executable instead of tee for the stdio placeholder command by @ErenAta16 in #4478
• fix: keep Codex verification for development sandboxed by @seratch in #4508
  com//pull/4516
• release: 0.22.0 by @seratch in #4523

New Contributors

• @li2631026381-alt made their first contribution in #4470
• @thegoodengineer made their first contribution in #4474
• @teachershuang made their first contribution in #4509
• @weike-zhang made their first contribution in #4516
• @chiruu12 made their first contribution in #4479

Full Changelog: v0.21.1...v0.22.0

v0.21.1

What's Changed

• feat(core): add model call timeouts by @seratch in #4428
• feat(sandbox): add run-scoped sandbox working directories by @seratch in #4427
• feat(sandbox): allow Docker sandboxes to disable networking by @koadegno in #4452
• feat(sandbox): add Modal sandbox resource options by @Filimoa in #4455
• fix(core): honor exact call approval decisions by @seratch in #4447
• fix(core): count Responses requests without usage by @seratch in #4453
• fix(core): close all MultiProvider children after failures by @fszcd in #4438
• fix(core): reject partially matched stacked anchors by @Coiggahou2002 in #4431
• fix(chat-completions): Chat Completions reasoning replay by @seratch in #4432
• fix(realtime): truncate audio at zero elapsed time by @Chirag6722 in #4457
• fix(realtime): end iteration after clean server close by @seratch in #4461
• fix(sessions): prevent advanced SQLite structure table conflicts by @seratch in #4454
• fix(sessions): include compaction usage in run totals by @seratch in #4446
• fix(sandbox): validate view_image raster content by @seratch in #4462
• fix(sandbox): keep model paths POSIX-normalized by @sylvesterkaczmarek in #4416
• fix(sandbox): normalize apply_patch paths as POSIX by @sylvesterkaczmarek in #4437

Documentation & Other Changes

• docs: updates for v0.21.0 release by @seratch in #4381
• docs: list Tuning Engines tracing integration by @cerebrixos in #4440
• fix: update cffi lock for Python 3.14 by @seratch in #4448
• release: 0.21.1 by @seratch in #4467

New Contributors

• @Coiggahou2002 made their first contribution in #4431
• @fszcd made their first contribution in #4438
• @cerebrixos made their first contribution in #4440
• @Filimoa made their first contribution in #4455
• @koadegno made their first contribution in #4452
• @Chirag6722 made their first contribution in #4457

Full Changelog: v0.21.0...v0.21.1

v0.21.0

Key Changes

This minor release does not introduce a known breaking SDK behavior change. The minor version bump is for the new provider-neutral testing APIs and the OpenAI Python v3 compatibility update.

Highlights:

• Added agents.testing, agents.realtime.testing, and agents.voice.testing utilities for deterministic Agent, Sandbox, Realtime, and Voice workflow tests without provider requests.
• Updated OpenAI provider compatibility to openai>=3.0.0,<4, including HTTPX2-aware request, response, transport, and exception handling.
• Hardened RunState interruption snapshots, recursive agent-tool approvals, max-turn finalization, streaming cleanup, and sensitive-error redaction.
• Improved MCP lifecycle snapshot isolation and added configurable retry backoff ceilings.
• Added Sandbox Runloop existing-secret support and tightened view-image path grants.
• Added stricter Voice validation for invalid channels, frame rates, incomplete multichannel frames, and non-finite audio rates.

What's Changed

• feat: support OpenAI Python 3 and HTTPX2 by @seratch in #4380
• feat: add scripted model test utilities by @seratch in #4362
  • fix: freeze public testing module contracts by @seratch in #4386
  • fix: freeze public testing API state contracts by @seratch in #4404
  • fix(core): preserve scripted annotation streaming across Python SDK releases by @apcha-oai in #4422
• fix(core): isolate interruption results by @hsusul in #4384
• fix(core): close the model stream when a streamed turn ends in a terminal failure by @Luccacvb in #4366
• fix(core): redact tool output value from output-type validation errors by @hsusul in #4396
• fix(core): align Responses parallel tool calls with converted tools by @seratch in #4405
• fix(core): max-turn handler session semantics by @seratch in #4412
• fix(core): detach RunState interruption snapshots by @seratch in #4409
• fix(core): isolate RunState checkpoint tool decisions by @seratch in #4413
• fix(core): resume recursive agent tool approvals by @seratch in #4414
• fix(mcp): stop handing the tools cache to callers by @chinmayv095 in #4424
• fix(mcp): protect manager lifecycle state snapshots by @seratch in #4407
• fix(mcp): isolate manager lifecycle results by @hsusul in #4368
• fix(mcp): add configurable retry backoff ceiling by @seratch in #4379
• fix(realtime): handle non-finite audio rates by @hsusul in #4419
• fix(sandbox): expose the scripted sandbox session type by @seratch in #4406
• fix(sandbox): apply stacked anchors sequentially by @seratch in #4369
• fix(sandbox): snapshot HTTP proxy headers by @hsusul in #4397
• fix(sandbox): snapshot per-op audit policies by @hsusul in #4398
• fix(sandbox): honor view_image extra path grants by @sylvesterkaczmarek in #4417
• fix(sessions): handle zero conversation history limits by @hsusul in #4365
• fix(voice): honor WAV sample width by @FU-max-boop in #4361
• fix(voice): reject incomplete multichannel audio frames by @seratch in #4370
• fix(voice): reject non-positive audio channels by @hansu650 in #4372
• fix(voice): reject non-positive audio frame rates by @hsusul in #4382
• fix(voice): stop buffering audio when audio tracing is disabled by @rxits in #4411
• fix(extensions): gate AnyLLM parallel tool calls on converted tools by @weivwang in #4363
• fix(extensions): preserve resume argument ordering by @viyatb-oai in #4400
• fix(extensions): let managed_secrets reference existing Runloop secrets by @xumaple in #4378

Documentation & Other Changes

• docs: synchronize v0.20.0 features by @seratch in #4280
• docs: clarify PGP key location by @jaideeppyne in #4371
• test: order test spans by start sequence, not by started_at alone by @ErenAta16 in #4392
• release: 0.21.0 by @seratch in #4387

New Contributors

• @FU-max-boop made their first contribution in #4361
• @weivwang made their first contribution in #4363
• @jaideeppyne made their first contribution in #4371
• @hansu650 made their first contribution in #4372
• @xumaple made their first contribution in #4378
• @viyatb-oai made their first contribution in #4400
• @ErenAta16 made their first contribution in #4392
• @apcha-oai made their first contribution in #4422
• @sylvesterkaczmarek made their first contribution in #4417

Full Changelog: v0.20.0...v0.21.0

v0.20.0

Key Changes

Version 0.20.0 is a minor release because it changes the implicit default model and includes a potentially breaking MCP dependency migration for applications with customized local HTTP transports. MCP v1 remains supported, and affected applications can migrate to httpx2 or pin mcp<2.

Highlights:

• The default model is now gpt-5.6-luna; explicit models, run-level overrides, and OPENAI_DEFAULT_MODEL continue to take precedence.
• Local MCP connections support MCP Python SDK v1 and v2 across stdio, SSE, and Streamable HTTP transports.
• Applications using custom MCP HTTP authentication or client factories must use the HTTP types owned by the installed MCP major version, or pin mcp<2.
• RunState.add_input() can stage durable user input before a resumed model call, with guardrail, persistence, and serialization support.
• Sandbox mount validation adds explicit credential-exposure acknowledgements and preserves redacted error contracts without serializing credential authority.
• Realtime input transcription supports the GA transcription settings for gpt-live-transcribe, gpt-transcribe, and gpt-realtime-whisper.

What's Changed

• feat: use GPT-5.6 Luna as the default model by @seratch in #4282
• feat: add durable pending input to RunState by @seratch in #4325
• feat(mcp): support MCP Python SDK v1 and v2 by @seratch in #4106
• feat(sessions): pass run context to custom sessions by @seratch in #4209
• feat(realtime): support GA transcription options by @seratch in #4351
• feat: preserve raw usage payloads by @seratch in #4279
• feat: allow applications to approve unsafe replays by @seratch in #4319
• fix: falsy optional reference handling by @seratch in #4305
• fix: prevent queue consumer deadlocks by @seratch in #4201
• fix: publish completed streamed guardrail results on failure paths by @adityasingh2400 in #4223
• fix: annotate the bare tool guardrail decorator overloads by @adityasingh2400 in #4238
• fix: tool approval is not honored on resume when Runner.run is given a context by @ojassharma7 in #4245
• fix: redact JSON validation errors by @seratch in #4211
• fix: copy raw_responses when building a RunState by @adityasingh2400 in #4237
• fix: keep empty turns in the nested conversation history by @abhay-codes07 in #4230
• fix: keep tool guardrail results when a resumed run interrupts again by @adityasingh2400 in #4239
• fix: work on copies of the lists a resumed run adopts from RunState by @hsusul in #4251
• fix: strip placeholder item IDs without provider_data on the Responses path by @LeSingh1 in #4266
• fix: bind tool approvals to concrete invocations by @seratch in #4257
• fix: normalize optional fields in tool invocation identity by @seratch in #4289
• fix: count requests when providers omit usage by @seratch in #4290
• fix: suppress pydantic serializer warnings by @seratch in #4291
• fix: keep FunctionTool subclasses copyable by @seratch in #4311
• fix: preserve streamed guardrail session state by @seratch in #4312
• fix: keep acknowledged safety checks serializable after restore by @ribhavjain in #4316
• fix: preserve default-valued fields in serialized tool output by @hsusul in #4307
• fix: strip output-only created_by when replaying model output as input by @hsusul in #4308
• fix: preserve local shell outputs across RunState resume by @seratch in #4320
• fix: serialize containers of models and dataclasses as structured data by @ribhavjain in #4339
• fix: reject schemas that exceed safe recursion depth by @seratch in #4358
• fix: reject unsafe strict-schema ref siblings by @seratch in #4356
• fix(sandbox): reject unsafe mount credential configurations by @seratch in #4255
  • fix(extensions): settle snapshot directory mount transitions for Modal by @seratch in #4315
  • fix(sandbox): preserve sandbox error contracts during mount redaction by @seratch in #4344
  • feat(sandbox): add explicit mount credential exposure acknowledgements by @seratch in #4321
• fix(sandbox): cancel sibling env resolvers when one fails by @PranavMishra28 in #4195
• fix(sandbox): encode Blaxel terminal WebSocket URL query values by @abhay-codes07 in #4217
• fix(sandbox): stop splitting Cloudflare SSE events at chunk boundaries by @abhay-codes07 in #4215
• fix(sandbox): keep move_to when coercing apply_patch operation mappings by @hsusul in #4242
• fix(sandbox): retain program items in memory rollouts by @seratch in #4276
• fix(sandbox): restore archived file modes when extracting a workspace tar by @hsusul in #4287
• fix(sandbox): keep source entry metadata when lazily loading a skill by @hsusul in #4294
• fix(mcp): hosted MCP approval identity by @seratch in #4256
• fix(mcp): keep MCP error content when structured output is enabled by @adityasingh2400 in #4224
• fix(mcp): build the active server list without re-consuming the iterable by @adityasingh2400 in #4235
• fix(mcp): preserve free-form MCP object schemas by @seratch in #4310
• fix(mcp): serialize non-text content blocks as JSON instead of Python repr by @ribhavjain in #4338
• fix(mcp): serialize manager lifecycle operations by @seratch in #4340
• fix(mcp): bound lifecycle and CI waits by @seratch in #4342
• fix(chat-completions): keep url citations when converting chat completions output by @adityasingh2400 in #4222
• fix(chat-completions): assemble chat completions content parts in content index order by @adityasingh2400 in #4236
• fix(chat-completions): propagate the OpenAI request ID on the Chat Completions path by @hsusul in #4243
• fix(chat-completions): keep url citations on the streamed chat completions path by @Luccacvb in #4252
• fix(chat-completions): announce the chat completions assistant message once by @hsusul in #4275
• fix(chat-completions): convert input_file items that reference a file_id on the Chat Completions path by @hsusul in #4295
• fix(chat-completions): raise on audio output in the streamed chat completions path by @Luccacvb in #4309
• fix(chat-completions): omit parallel_tool_calls without tools on the Chat Completions path by @Luccacvb in #4359
• fix(sessions): release SQLite engine config entries when engines are collected by @adityasingh2400 in #4210
• fix(sessions): enforce closed state on SQLite session empty add_items by @adityasingh2400 in #4231
• fix(sessions): make session mutations atomic by @seratch in #4212
• fix(sessions): preserve required program item ids for OpenAI conversations by @hsusul in #4253
• fix(sessions): apply the reasoning item id policy to stored session history by @LeSingh1 in #4278
• fix(sessions): preserve DaprSession created_at across writes by @adityasingh2400 in #4213
• fix(sessions): strip placeholder item IDs before Conv...