OpenAI Agents SDK

0.24.0 (2026-10-15) Features expose MCP annotations on converted tools ( #5356 ) ( 75813f8 ) support run-wide tool exception formatting ( #5326 ) ( 8fd9a7c ) Bug Fixes batch OpenAI conversation session writes within the API limit ( #5334 ) ( 26345c1 ) defer automatic compaction for pending approvals ( #5363 ) ( 5eb47a5 ) deps-dev: bump fastapi from 0.139.2 to 0.141.1 ( #5312 ) ( cdf23bd ) deps-dev: bump grpcio from 1.83.1 to 1.84.0 ( #5310 ) ( a85487e ) deps-dev: bump pymdown-extensions from 11.0.2 to 12.1 ( #5314 ) ( d9758b0 ) deps-dev: bump pymongo from 4.18.1 to 4.18.2 ( #5313 ) ( 858856f )...

0.23.0 (2026-10-01) Features mcp: add configurable MCP listing page limits ( #5133 ) ( 9a21ab1 ) sandbox: add opt-in Docker removal protection ( #5116 ) ( ae5803f ) sandbox: allow configuring memory consolidation turns ( #5135 ) ( daa1bcb ) sessions: add an opt-in encrypted history scan budget ( #5118 ) ( a2fdb94 ) Bug Fixes avoid awaiting cleanup during coroutine closure ( #5163 ) ( 719c4e7 ) ci: update and group CodeQL actions together ( #5262 ) ( f76153c ) ci: validate release source before building distributions ( #5220 ) ( 2747c1c ) core/extensions: respect sensitive trace capture for mod...

What's Changed fix(core): align conditional approvals with validated tool arguments by @seratch in #5066 fix(core): deliver tool-not-found output on server-managed resume by @hyeonsang010716 in #4947 fix(sandbox): keep command paths POSIX on a Windows host by @hyeonsang010716 in #4958 fix(sessions): handle concurrent async SQLite startup by @00200200 in #4987 fix(sessions): do not forward session limit as Conversations page size by @tiagovilasboas in #4961 fix(tracing): do not cache a missing OPENAI_API_KEY by @hyeonsang010716 in #5017 fix(extensions): include shell and apply_patch calls in Ad...

What's Changed feat: support current image generation tool options by @seratch in #4932 fix(sandbox): prevent UnixLocal file API symlink races by @seratch in #4931 fix(sessions): reset compaction response chain after pop by @rksharma-owg in #4934 Documentation & Other Changes docs: document v0.22.1 behavior updates by @seratch in #4577 release: 0.22.2 by @seratch in #4935 Full Changelog : v0.22.1...v0.22.2

release: 0.22.1 ( #4576 )

Key Changes Version 0.22.0 is a minor release because it adds substantial runtime hardening and tightens an existing provider configuration contract. Applications that combine an explicit openai_client with organization or project must move those values to the AsyncOpenAI client. Highlights: Redacts terminal function-tool output rejected by agent output guardrails from replayable and persisted SDK state. Raises ModelBehaviorError for non-streaming Responses with terminal status failed or incomplete . Rejects conflicting provider options when OpenAIProvider receives an explicit client. Isolates...

What's Changed feat(core): add model call timeouts by @seratch in #4428 feat(sandbox): add run-scoped sandbox working directories by @seratch in #4427 feat(sandbox): allow Docker sandboxes to disable networking by @koadegno in #4452 feat(sandbox): add Modal sandbox resource options by @Filimoa in #4455 fix(core): honor exact call approval decisions by @seratch in #4447 fix(core): count Responses requests without usage by @seratch in #4453 fix(core): close all MultiProvider children after failures by @fszcd in #4438 fix(core): reject partially matched stacked anchors by [ 查看原始出处 → ]

Release v0.20.0

What's Changed fix: preserve completed tool guardrail results by @seratch in #4180 fix: redact invalid tool argument errors by @seratch in #4182 fix: defer non-stream session saves until output guardrails by @seratch in #4184 fix: honor resolved status before policy checks by @seratch in #4183 fix: cancel sibling work after concurrent failures by @seratch in #4185 fix: surface non-streaming content-filter refusals by @seratch in #4188 fix(mcp): derive streamable HTTP retry backoff from backoffs taken by @rxits in #4174 fix(realtime): clean up failed connection attempts by [ 查看原始出处 → ]

Release v0.19.3

What's Changed feat: expose original callable through wrapped by @seratch in #4038 fix: report input guardrail results when a tripwire aborts the run by @hsusul in #4071 fix: consolidate same-exception re-raises into bare raise across all modules by @AAliKKhan in #4023 fix(sandbox): preserve tagged EnvValue subclasses by @seratch in #4039 fix(modal): reject ephemeral paths during tar hydration by @LHMQ878 in #4045 fix(mcp): redact MCP prompt and resource transport errors by @seratch in #4067 fix(mcp): redact URL credentials from SDK errors by @seratch in #4015 fix(mcp): redact URL credentials ...

What's Changed feat(sandbox): support native host paths in path grants by @seratch in #4009 fix: redact Realtime audio format diagnostics by @seratch in #3992 fix: redact Blaxel unmount paths in logging by @seratch in #3993 fix: retry pre-response WebSocket server errors by @dk3yyyy in #3991 fix(run): cancel the parallel input-guardrail task when the model turn fails by @gunjanjaswal in #3982 fix(run): allow empty streamed model input by @hsusul in #3995 fix(models): route falsey mapped providers by @hsusul in #3996 fix(memory): count valid SQLite session items for positive limits by

Key Changes This minor release does not introduce a breaking change. The minor version bump reflects a significant new OpenAI Responses feature area: Programmatic Tool Calling. Highlights: Added agents.tool.ProgrammaticToolCallingTool , which lets supported OpenAI Responses models generate JavaScript to coordinate eligible tools. It supports per-tool allowed_callers , structured function-tool outputs, and integration with Runner streaming, guardrails, approvals, sessions, and RunState . See Programmatic Tool Calling for setup and constraints. Added the public agents.decorators module and the s...

What's Changed feat: make task and turn tracing spans configurable by @seratch in #3834 feat(realtime): track response usage in session context by @seratch in #3812 fix(memory): serialize OpenAI conversation session initialization by @russeell in #3821 fix(models): raise UserError for conflicting provider args instead of assert by @Dhruva-Das in #3809 fix(handoffs): preserve user messages containing history wrappers by @russeell in #3815 fix(computer): isolate provider instances across concurrent runs by @russeell in #3843 fix(sandbox): avoid redundant E2B workspace root creation by @seratch i...

Key Changes RealtimeAgent's default is now gpt-realtime-2.1 Since this version, the default model for RealtimeAgents is gpt-realtime-2.1: https://developers.openai.com/api/docs/models/gpt-realtime-2.1 What's Changed feat: update default realtime model to gpt-realtime-2.1 by @seratch in #3740 feat: add Unicode storage option to SQLAlchemySession by @seratch in #3746 fix(visualization): keep fillcolor on handoff nodes by merging style attributes by @comp in #3744 Documentation & Other Changes docs: updates for v0.17.8 release by @seratch in #3737 Release 0.18.0 by @github-actions[bot] in #37...

What's Changed feat: add invalid final output recovery handler by @seratch in #3736 fix: propagate realtime session iterator cancellation by @fallintoplace in #3686 fix: redact realtime validation failure logs by @fallintoplace in #3687 fix: preserve non-dict Mapping values in _to_dump_compatible by @anxkhn in #3700 fix: escape quotes and backslashes in DOT names for visualization by @anxkhn in #3712 fix: enforce strict Pydantic validation when strict_json_schema=True + handoffs by @Om-Borse26 in #3724 fix: fix an issue with length-frame exec-stdin writes within a sandbox by @imran31415 in #37...

What's Changed feat: expose configurable websocket max_size limit by @anneheartrecord in #3645 feat: add buffered Chat Completions tool-call streaming by @incoffeemonster in #3506 fix: reduce sandbox sink buffering and spool timeouts by @2830500285 in #3642 fix: #3346 clean up branch-only messages when deleting branches by @Aphroq in #3347 fix: #3348 make AdvancedSQLiteSession add_items atomic by @Aphroq in #3349 fix: cancel sibling guardrail tasks when one raises by @adityasingh2400 in #3239 fix: skip

What's Changed feat: add pre-approval tool input guardrails by @seratch in #3487 feat: add SDK-only custom data for tool outputs by @seratch in #3486 fix: enforce the documented strict JSON-compatible contract for #3486 by @siddiksawani in #3657 fix: suppress handoff whitespace tool-name warnings by @seratch in #3652 Documentation & Other Changes docs: fix typo in sandbox guide by @mshsheikh in #3628 Release 0.17.6 by @github-actions[bot] in #3659 New Contributors @siddiksawani made their first contribution in

What's Changed fix: expose sandbox error retryability by @qiyaoq-oai in #3581 fix: #3512 type tool-end hook results as object by @seratch in #3518 fix: use tuple form for SpeechGroupSpanData __slots__ by @jluocsa in #3534 chore: bump Modal sandbox extra to 1.4.3 by @jdoughty04 in #3538 Documentation & Other Changes docs: add MongoDB session example under examples/memory by @alexbevi in #3036 docs: add missing space in MCP params docstrings by @jluocsa in #3535 docs: fix docstring typo in stdio params env description by @mshsheikh in [ 查看原始出处 → ]

What's Changed feat: support Realtime custom voice objects by @lionel-oai in #3473 fix: #3459 add opt-in recovery for missing function tools by @seratch in #3461 fix: apply hardened http client default to MCP SSE transport by @ioleksiuk in #3466 fix: use non-None value for output in FunctionSpanData by @rmotgi1227 in #3475 fix: add missing entries to span slots by @rmotgi1227 in #3483 fix: redact invalid JSON payload in ModelBehaviorError data by @LeSingh1 in #3485 fix: export more tracing related functions & types from agents by @rmotgi1227 in

a## What's Changed fix: keep mountpoint credentials out of sandbox commands by @seratch in #3429 fix: unify memory optional dependency import errors by @seratch in #3389 fix: guard None text in text_message_output and add output guardrail count to RunErrorDetails by @zhoufengen in #3375 fix: avoid mutating FunctionTool params_json_schema by @ioleksiuk in #3382 fix: avoid mutating codex output schema input by @ioleksiuk in #3385 fix: #3357 output schema names for Literal types by @Aphroq in #3358 fix: skip wait_for_status when Vercel sandbox is in a terminal state by @cty-ut in [ 查看原始出处 → ]

What's Changed Sandboxes fix: include sandbox provider error details by @seratch in #3326 fix: #3274 limit sandbox archive extraction by @Aphroq in #3278 fix: #3273 validate git repo subpaths by @Aphroq in #3276 fix: allow empty GitRepo subpaths as repository root by @seratch in #3299 fix: preserve GitRepo root subpath aliases by @seratch in #3303 Tracing fix: make tracing shutdown best-effort on process exit by @seratch in #3343 fix: keep BatchTraceProcessor worker alive on exporter errors by [ 查看原始出处 → ]

Key Changes RealtimeAgent's default is now gpt-realtime-2 Since this version, the default model for RealtimeAgents is gpt-realtime-2: https://developers.openai.com/api/docs/models/gpt-realtime-2 Sandbox local source materialization change In this version, sandbox local source materialization keeps LocalFile.src and LocalDir.src within the materialization base_dir unless the source path is covered by Manifest.extra_path_grants . The base_dir is the SDK process current working directory when the manifest is applied; relative local sources are resolved from that directory, while absolute local so...

What's Changed fix: #3109 stabilize chat completions stream output indexes by @seratch in #3176 fix: #3168 validate MCP require_approval policies by @seratch in #3179 fix: #3116 restore session history after compaction replacement failures by @Aphroq in #3117 fix: #3171 reject corrupt Dapr session state updates by @Aphroq in #3173 fix: #3170 clean up git repo temp clones on failure by @Aphroq in

What's Changed fix(mcp): avoid mutating tool input schemas by @adityasingh2400 in #3134 fix(mcp): reject non-object tool input JSON by @adityasingh2400 in #3135 fix(mcp): make duplicate tool errors deterministic by @adityasingh2400 in #3136 fix: tolerate audio deltas before audio format negotiation in ModelAu… by @Quratulain-bilal in #3141 Documentation & Other Changes docs: updates for #3128 by @seratch in #3129 docs: update translated document pages by @github-actions[bot] in #3131 test: cover overlapping tool response creates by @adityasingh2400 in

What's Changed feat: add context management model setting by @seratch in #3128 fix: #3123 avoid replaying assistant conversation item IDs for OpenAIConversationsSession by @seratch in #3127 fix: redact function tool trace span errors by @Aphroq in #3111 fix: redact MCP invalid JSON errors when tool logging is disabled by @Aphroq in #3088 fix: reject failed responses stream terminals by @Aphroq in #3107 fix: only rewind matching session suffixes by @Aphroq in #3090 fix: reject string-like shell commands by @Aphroq in

What's Changed feat: expose Responses WebSocket keepalive options by @seratch in #3080 fix: restore UnixLocal PTY terminal signal defaults by @seratch in #3082 fix: #3074 restore SIGINT defaults for UnixLocal PTY children by @Aphroq in #3075 Documentation & Other Changes docs: add 0.15 changelog by @seratch in #3058 docs: update translated document pages by @github-actions[bot] in #3064 docs: improve quickstart documentation for Windows OS users by @seratch in #3071 docs: update translated document pages by @github-actions[bot] in #3072 test: cover guardrail name fallback to function name ...

Key Changes Better model refusal handling In this version, model refusals are now surfaced explicitly as ModelRefusalError instead of being treated as empty text output or, for structured outputs, causing the run loop to retry until MaxTurnsExceeded . This affects code that previously expected a refusal-only model response to complete with final_output == "" . To handle refusals without raising, provide a model_refusal run error handler: result = Runner . run_sync ( agent , input , error_handlers = { "model_refusal" : lambda data : data . error . refusal }, ) For structured-output agents, the ...

What's Changed fix: #3046 preserve MCP re-export import errors by @seratch in #3048 fix: #3043 delimit sandbox prompt instruction sections by @seratch in #3047 Documentation & Other Changes docs: fix typo in comment for WS event handler by @ateamofantsintheirprime in #3050 Release 0.14.8 by @github-actions[bot] in #3049 New Contributors @ateamofantsintheirprime made their first contribution in #3050 Full Changelog : v0.14.7...v0.14.8

What's Changed feat: #3001 add Modal sandbox idle timeout option by @seratch in #3005 fix: #3004 serve HITL resume tool outputs by @seratch in #3006 fix: backfill streamed terminal output by @ankitphogat in #3000 Documentation & Other Changes docs: clarify lazy skill source host paths by @alfozan in #2998 docs: update translated document pages by @github-actions[bot] in #2999 Release 0.14.5 by @github-actions[bot] in #3007 New Contributors @ankitphogat made their first contribution in

What's Changed feat: add BoxMount support by @alfozan in #2988 fix: ignore relative snapshot base overrides by @matthewflint in #2976 refactor: share sandbox ephemeral mount lifecycle by @seratch in #2986 refactor: share sandbox tar exclude arg generation by @seratch in #2987 refactor: extract sandbox session helper operations by @seratch in #2985 Documentation & Other Changes docs: remove duplicate word in voice interruptions section by @abhicris in #2981 docs: update translated document pages by @github-actions[bot] in #2982 docs: update translated document pages by @github-actions[bot] ...

What's Changed fix: #2962 normalize sandbox paths and add Windows CI by @seratch in #2963 fix: #2938 make sandboxes importable on Windows by @seratch in #2948 fix: prepare Daytona workspace root before start by @seratch in #2956 fix: windows errors with #2956 by @seratch in #2979 fix: #2951 warn for tool name character replacement by @seratch in #2953 fix: tighten LocalSnapshot restorable checks by [ 查看原始出处 → ]

What's Changed feat: support sandbox extra path grants by @qiyaoq-oai in #2920 feat: #2228 persist tool origin metadata in run items by @seratch in #2654 feat(extensions): add MongoDB session backend by @alexbevi in #2902 fix: loosen sandbox compaction model parsing by @sdcoffey in #2930 fix: remove_all_tools missing hosted tool types by @javierdejesusda in #2885 fix: tolerate None text in ResponseOutputText content items by @beveradb in #2883 fix: #1876 LiteLLM extra_body forwarding by

What's Changed fix: sanitize OpenAI tracing export payloads by @alfozan in #2896 fix: #2873 preserve computer driver compatibility for modifier keys by @seratch in #2877 fix #2151 shield server-managed handoffs from unsupported history rewrites by @seratch in #2747 fix: stop streamed tool execution after known input guardrail tripwire by @seratch in #2688 Documentation & Other Changes docs: update translated document pages by @github-actions[bot] in #2891 docs: align translated sandbox nav and refresh generated refs by @seratch in #2892 docs: clarify ToolContext availability in function-to...

What's Changed fix: #2863 lazy-load SQLiteSession exports by @seratch in #2864 fix: #2856 stop recursive trace preview truncation by @seratch in #2860 fix: harden SQLAlchemySession against transient SQLite locks by @seratch in #2854 Documentation & Other Changes docs: updates for #2844 changes by @seratch in #2845 docs: update translated document pages by @github-actions[bot] in #2847 docs(tracing): add HoneyHive to tracing integrations list by @m1lestones in [ 查看原始出处 → ]

What's Changed fix: #2806 sanitize AnyLLM responses replay input before validation by @seratch in #2813 Documentation & Other Changes fix: map extensions changes to the feature:extensions label by @seratch in #2814 Release 0.13.4 by @github-actions[bot] in #2815 Full Changelog : v0.13.3...v0.13.4

What's Changed fix: #2798 avoid stale hydrated input ids in server conversation tracker by @seratch in #2800 fix: #2797 accept raw image_url content parts on chat completions input by @seratch in #2799 Documentation & Other Changes docs: add non-OpenAI provider code example by @Muttaqi110 in #2792 docs: update translated document pages by @github-actions[bot] in #2793 chore: add Codex Stop hook for targeted Ruff tidy by @seratch in #2795 Release 0.13.3 by @github-actions[bot] in #2801 New Contributors @Muttaqi110 made their first contribution in

Key Changes Any-LLM extension Since this version, the extension module includes a new any-llm adapter as well. Please refer to the updated documentation and examples at https://github.com/openai/openai-agents-python/tree/main/examples/model_providers What's Changed feat: add any-llm model support with responses-compatible routing by @seratch in #2706 fix: preserve static MCP meta in converted function tools by @seratch in #2769 fix: #2760 wait for realtime response.done before follow-up response.create by @seratch in #2763 fix: handle cancelled single function tools as tool failures by @elaine...