v0.17.0

Key Changes

Output-guardrail replay safety

Serialized output-bearing approval checkpoints now fail closed with UserError when the SDK cannot prove which response owns a pending terminal tool output. Continue with the live RunState when possible, or start a new run from safe input instead of replaying ambiguous serialized items. When an output guardrail rejects a completed function-tool result used as final output, the SDK replaces rejected content in SDK-owned replay surfaces with Output withheld by an output guardrail., sanitizes current guardrail metadata, and preserves earlier accepted history. This does not undo external tool side effects or erase application-owned copies.

Complete guardrail batch results

Guardrails started in the same batch now settle before the runner surfaces a tripwire or execution failure. Completed sibling results remain available in run state while further run processing is halted.

Explicit OpenAI client configuration

OpenAIProvider now rejects organization or project when openAIClient is also supplied because provider-level values cannot modify an already-created client. Configure these values when constructing the OpenAI client, then pass that client through openAIClient.

What's Changed

• fix(core): redact blocked tool outputs and aliases from replay state by @seratch in #1712
• fix(openai): reject ignored explicit-client options by @seratch in #1718

Documentation & Other Changes

• docs: v01.6.1 release by @seratch in #1696
• docs: fix access token typo in connectors example by @Chair403 in #1716
• fix: keep Codex verification for development sandboxed by @seratch in #1707
• chore: update versions by @github-actions[bot] in #1717

New Contributors

• @Chair403 made their first contribution in #1716

Full Changelog: v0.16.1...v0.17.0

v0.16.1

What's Changed

• feat(core): add model call timeouts by @seratch in #1679
• feat(sandbox): add run-scoped sandbox working directories by @seratch in #1683
• feat(sandbox): allow Docker sandboxes to disable networking by @seratch in #1695
• feat(extensions): add Modal sandbox resource options by @seratch in #1693
• fix(core): honor exact call approval decisions by @seratch in #1694
• fix(sandbox): validate view_image raster content by @seratch in #1704
• fix(sandbox): validate dynamic compaction ratios by @sylvesterkaczmarek in #1691
• fix(sandbox): trace effective run-scoped sandbox paths by @sylvesterkaczmarek in #1697

Documentation & Other Changes

• docs: prepare v0.16.0 release documentation by @seratch in #1646
• docs: document Agent.clone list property sharing by @thegoodengineer in #1705
• chore: update versions by @github-actions[bot] in #1688

Full Changelog: v0.16.0...v0.16.1

v0.16.0

Key Changes

Deterministic SDK testing utilities

This release adds provider-neutral testing utilities through @openai/agents/testing, @openai/agents-core/testing, @openai/agents/realtime/testing, and @openai/agents-realtime/testing. ScriptedModel, scriptedSandboxSession(), and ScriptedRealtimeTransport let applications exercise runner, sandbox, and Realtime workflows without live model, sandbox, WebRTC, or WebSocket dependencies. Existing runtime entry points and defaults remain unchanged.

Standard Schema inputs and outputs

Tools, handoffs, and agent structured outputs now accept supported Standard Schema values alongside Zod and raw JSON Schema. The schema must provide synchronous ~standard.validate behavior plus ~standard.jsonSchema.input() and ~standard.jsonSchema.output(), and generated schemas must have an object root. Standard Schema function-tool parameters require strict mode; use a Zod schema, raw JSON Schema, or application-side validation for unsupported cases.

Safer run, provider, and Realtime behavior

CallModelInputFilter can opt into stable prepared-item identity with preserveInputIdentity = true; default filters continue to receive deep copies, and the SDK does not freeze opted-in items. The release also tightens interruption snapshots, max-turn finalization, invalid tool-output redaction, Responses parallel-tool-call forwarding, Chat Completions reasoning placement, Realtime audio-rate fallback, and unsupported assistant-audio history replay handling.

What's Changed

• feat: add scripted testing utilities by @seratch in #1640
  • fix: detach Manifest snapshots in scripted sandbox calls by @seratch in #1658
  • fix: detach scripted model stream snapshots by @seratch in #1657
• feat: support Standard Schema inputs and agent outputs by @seratch in #1648
  • fix: avoid redundant Standard Schema validation by @seratch in #1656
• feat: preserve model input identity by @seratch in #1654
• fix(core): isolate interruption result arrays by @seratch in #1659
• fix(core): align Responses parallel tool calls with tools by @seratch in #1660
• fix(core): reject partially matched stacked diff anchors by @seratch in #1655
• fix(core): apply stacked diff anchors sequentially by @seratch in #1649
• fix(core): redact invalid typed tool output diagnostics by @seratch in #1662
• fix(core): detach RunState interruption snapshots by @seratch in #1664
• fix(core): finalize max-turn handler session output by @seratch in #1663
• fix(mcp): keep cached tool arrays private by @seratch in #1681
• fix(chat-completions): keep Chat Completions reasoning on its assistant message by @thegoodengineer in #1669
• fix(sandbox): snapshot sandbox HTTP event sink headers by @seratch in #1661
• fix(sandbox): describe granted view_image paths by @seratch in #1678
• fix(realtime): reject unsupported audio history replay by @sylvesterkaczmarek in #1665
• fix(realtime): handle non-finite audio rates by @seratch in #1680
• fix(extensions): forward strict settings through the AI SDK by @Maksim963 in #1643

Documentation & Other Changes

• docs: updates for v0.15.0 release by @seratch in #1610
• chore: update versions by @github-actions[bot] in #1644

New Contributors

• @Maksim963 made their first contribution in #1643
• @sylvesterkaczmarek made their first contribution in #1665
• @thegoodengineer made their first contribution in #1669

Full Changelog: v0.15.0...v0.16.0

v0.15.0

Key Changes

OpenAI client compatibility and the new default model

This release requires openai 7.2 or later for applications that supply their own OpenAI client. Agents without an explicit model now use gpt-5.6-luna with reasoning.effort: "none" and text.verbosity: "low". Configure an explicit model or set OPENAI_DEFAULT_MODEL when an application needs a different default.

MCP v2 negotiation with legacy server support

Local MCP connections now use the MCP TypeScript SDK v2 client and negotiate the 2026-07-28 protocol where available, with compatible fallback for existing v1 servers. Applications using MCPServerStdio, MCPServerStreamableHttp, or MCPServerSSE do not need to bridge the v1 and v2 SDK packages themselves.

Durable input, tool output, and retry state

RunState.addInput() can stage new input while a run is paused, and pendingInput survives serialization until the next safe model request. JSON-compatible tool return values retain their structure across RunState serialization, while canonical invocation evidence prevents approved or completed local tool calls from being rebound incorrectly. Applications may explicitly approve an otherwise unsafe non-streaming model replay with approveUnsafeReplay: true.

Safer sandbox mount credentials

Credential-bearing in-container mounts now fail closed unless the application acknowledges the exact effective mount path with Manifest.withInContainerMountCredentialExposureAcknowledged() or, for ambient and external authority, Manifest.withInContainerMountBroadCredentialExposureAcknowledged(). Serialized credentials and unsafe mount authority are never trusted on resume. The deprecated Vercel allowS3CredentialExposure: true option remains available for released inline S3 configurations.

React Native and Realtime improvements

Core and Realtime packages now publish React Native conditions for portable shims. React Native applications provide an app-owned native WebRTC transport and retain responsibility for permissions, audio routing, and transport lifecycle. Realtime configuration also supports GA transcription models and context options, while closing browser WebRTC transports no longer stops caller-owned media streams.

More faithful provider and adapter results

The OpenAI and AI SDK adapters now preserve additional provider behavior across streaming and non-streaming runs, including Chat Completions audio, citations and request IDs, optional raw usage, AI SDK PDF inputs and prompt-cache retention, conversation program item IDs, apply-patch move destinations, and complete interleaved output ordering.

What's Changed

• feat(core): use gpt-5.6-luna as default model by @seratch in #1613
• feat(core): support MCP SDK v2 negotiation by @seratch in #1558
• feat(core): preserve raw usage payloads by @seratch in #1611
• feat(core): pass run context to custom sessions by @seratch in #1585
• feat(core): add durable pending input to RunState by @seratch in #1630
• feat(core): allow applications to approve unsafe replays by @seratch in #1628
• feat(realtime): support React Native custom transports by @seratch in #1604
• feat(realtime): support GA transcription options by @seratch in #1635
• feat(ai-sdk): support PDF file inputs by @seratch in #1588
• chore: upgrade OpenAI package to v7.2 by @seratch in #1591
• fix(core): tighten sandbox mount credential exposure by @seratch in #1627
• fix(core): protect sandbox mount credentials by @seratch in #1602
• fix(core): preserve free-form MCP object schemas by @seratch in #1629
• fix(core): scope hosted MCP approval identity by @seratch in #1600
• fix(core): bind tool approvals and completed replays to canonical invocations by @seratch in #1601
• fix(core): invalidate MCP tool caches safely by @seratch in #1605
• fix(core): count only admitted model turns by @seratch in #1606
• fix(core): normalize strict referenced tool arguments by @seratch in #1596
• fix(core): publish completed guardrail results by @seratch in #1589
• fix(core): redact JSON validation errors by @seratch in #1590
• fix(core): serialize MCP manager lifecycle operations by @seratch in #1633
• fix(core): preserve structured tool outputs in RunState by @seratch in #1631
• fix(core): reject overly deep strict JSON schemas by @seratch in #1638
• fix(openai): count requests without usage by @seratch in #1614
• fix(openai): propagate Chat Completions request IDs by @seratch in #1615
• fix(openai): preserve apply_patch move destinations by @seratch in #1616
• fix(openai): preserve streamed Chat Completions citations by @seratch in #1617
• fix(openai): preserve program item IDs in conversations by @seratch in #1618
• fix(openai): strip placeholder IDs from Responses input by @seratch in #1620
• fix(openai): serialize compaction session mutations by @seratch in #1624
• fix(openai): preserve streamed Chat Completions audio by @seratch in #1626
• fix(openai): omit parallel_tool_calls without tools by @seratch in #1637
• fix(realtime): keep a caller-supplied WebRTC media stream alive on close by @adityasingh2400 in #1586
• fix(realtime): accept duration usage on input transcription events by @AtecAi in #1371
• fix(extensions): preserve AI SDK response order by @seratch in #1594
• fix(extensions): align Twilio interruption playback by @seratch in #1608
• fix(extensions): forward AI SDK prompt cache retention by @seratch in #1619
• fix(extensions): redact Modal inline mount credential errors by @seratch in #1634
• fix(ai-sdk): preserve complete AI SDK final output by @seratch in #1595
• fix(ai-sdk): transform complete interleaved AI SDK output once by @seratch in #1597

Documentation & Other Changes

• docs: improve translation source clarity by @seratch in #1625
• ci: bound workflow job runtimes by @seratch in #1632
• perf: speed up test feedback by @seratch in #1621
• test: enforce silent test output by @seratch in #1607
• test: update sandbox storage mount integration fixture by @seratch in #1609
• test: add released package API contract by @seratch in #1636
• test: add historical RunState compatibility corpus by @seratch in #1639
• chore: update versions by @github-actions[bot] in #1587

New Contributors

• @adityasingh2400 made their first contribution in #1586
• @AtecAi made their first contribution in #1371

Full Changelog: v0.14.3...v0.15.0

v0.14.3

What's Changed

• feat: add session history transactions by @seratch in #1572
• fix: resolve model-visible tool name collisions consistently by @seratch in #1565
• fix: preserve approved tool results across output guardrails by @seratch in #1562
• fix: preserve completed tool guardrail results by @seratch in #1578
• fix: preserve inline compaction items across turns by @seratch in #1567
• fix: preserve causal order when deduplicating model input by @seratch in #1569
• fix: serialize conversation session ID lifecycle by @seratch in #1561
• fix: normalize closed typeless object schemas in strict tools by @seratch in #1564
• fix: include all paginated MCP tools by @seratch in #1556
• fix: preserve repeated session history provenance by @seratch in #1577
• fix: redact invalid tool argument errors by @seratch in #1579
• fix: surface content-filter refusals by @seratch in #1580
• fix: preserve committed tools on blocked output by @seratch in #1584
• fix: cancel sibling tool work on failure by @seratch in #1581
• fix(realtime): apply output guardrails to text deltas by @seratch in #1560
• fix(realtime): accept status-less conversation items (#1571) by @seratch in #1582
• fix(realtime): clean up failed connections by @seratch in #1583
• fix(sandbox): harden default snapshot path resolution by @seratch in #1563
• fix(sandbox): enforce output token budgets by @seratch in #1575
• fix(extensions): preserve streamed reasoning provider metadata by @seratch in #1576
• fix(tracing): name task spans after Runner workflows by @seratch in #1574

Documentation & Other Changes

• test(core): split RunState tests for parallel execution by @seratch in #1570
• chore(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1555
• chore: update versions by @github-actions[bot] in #1557

Full Changelog: v0.14.2...v0.14.3

v0.14.2

What's Changed

• feat: preserve sandbox environment secret references by @seratch in #1547
• fix: preserve raw realtime transport event payloads by @seratch in #1550
• fix: reject ephemeral paths during sandbox archive hydration by @seratch in #1553
• fix: redact endpoint credentials from MCP transport errors by @seratch in #1551
• fix: redact MCP URL credentials from external metadata by @seratch in #1552
• fix: clean MCP servers before reconnecting by @seratch in #1554

Documentation & Other Changes

• fix(examples): fail closed without financial research sources by @seratch in #1546
• chore: update versions by @github-actions[bot] in #1549

Full Changelog: v0.14.1...v0.14.2

v0.14.1

What's Changed

• fix(core): export lifecycle and agent tool helper types by @seratch in #1535
• fix(sandbox): support native Windows paths in path grants by @seratch in #1538
• fix(sandbox): allow Docker workdirs within path grants by @seratch in #1540
• fix(sandbox): preserve verified Docker sessions across resumes by @seratch in #1541

Documentation & Other Changes

• docs: updates for v0.14.0 by @seratch in #1493
• chore: update versions by @github-actions[bot] in #1536

Full Changelog: v0.14.0...v0.14.1

v0.14.0

Key Changes

Programmatic Tool Calling support

The SDK now supports Programmatic Tool Calling, allowing supported models to generate hosted JavaScript that coordinates eligible tools and reduces their intermediate results. Program calls are preserved across streaming, sessions, replay, and serialized RunState. Refer to a simple example to see how it works.

Sensitive model and tool data logging is now disabled by default

Model and tool data is no longer logged unless explicitly enabled. Use setSensitiveDataLoggingEnabled(true) to opt in programmatically, or set the corresponding OPENAI_AGENTS_DONT_LOG_* environment variables to 0 or false.

Task and turn tracing is enabled by default

Runs now emit task and turn spans by default, providing a clearer trace hierarchy and usage metadata. Set includeTaskAndTurnSpans to false in the per-run tracing configuration to opt out.

Run cancellation now propagates to function and MCP tools

Cancellation signals now reach streaming and non-streaming function tools as well as MCP tool requests. Stream completion also waits for background work and cleanup to settle before resolving.

AI SDK 7 support

The AI SDK adapter now supports LanguageModelV4 models and AI SDK 7 while preserving existing v2 and v3 compatibility.

Vercel S3 bucket mounts

A new VercelCloudBucketMountStrategy enables S3 buckets to be mounted in Vercel sandboxes using Mountpoint for Amazon S3.

What's Changed

• feat: add Programmatic Tool Calling support by @seratch in #1472
• feat: add task and turn tracing spans by @seratch in #1488
• feat(extensions): add Vercel cloud bucket mounts by @seratch in #1501
• feat: disable sensitive data logging by default by @seratch in #1517
  • fix: honor sensitive logging flags across runtime paths by @seratch in #1516
  • fix: redact sensitive tool and model data from error logs by @seratch in #1512
• fix: distinguish missing sandbox paths from inaccessible files by @seratch in #1514
• fix: fail closed on invalid dynamic tool approval arguments by @seratch in #1511
• fix: preserve assistant message phases across Responses history and replay by @seratch in #1513
• fix(core): wait for cancelled stream cleanup before resolving completion by @seratch in #1527
• fix(core): propagate non-streaming run cancellation to function tools by @seratch in #1528
• fix(core): propagate streamed cancellation to function tools by @seratch in #1529
• fix(core): propagate cancellation to MCP tool requests by @seratch in #1532
• fix(core): parse SELinux permission markers by @seratch in #1504
• fix(extensions): preserve AI SDK v3 image tool outputs by @seratch in #1492
• fix(extensions): support AI SDK v4 models by @akim136 in #1500
• fix(extensions): pin and verify rclone sandbox installs by @seratch in #1508
• fix(extensions): flush pending assistant message before user/system turns in ai-sdk integration by @yotam2010 in #1507
• fix(extensions): preserve refusal messages in AI SDK history by @seratch in #1524

Documentation & Other Changes

• docs: improve semantic validation flows for examples by @seratch in #1496
• test(integration): exercise AI SDK v4 tool loops by @seratch in #1503
• test: add published SDK behavior integration coverage by @seratch in #1519
• chore: upgrade pnpm toolchain by @seratch in #1502
• chore: add sensitive logging audit skill by @seratch in #1515
• chore: upgrade pnpm toolchain by @seratch in #1533
• chore: update versions by @github-actions[bot] in #1491

New Contributors

• @akim136 made their first contribution in #1500
• @yotam2010 made their first contribution in #1507

Full Changelog: v0.13.5...v0.14.0

v0.13.5

What's Changed

• feat(ai-sdk): support provider-executed tool search by @seratch in #1483
• fix: decode base64 without host globals by @seratch in #1481
• fix: correlate streamed text with output items by @seratch in #1486

Documentation & Other Changes

• docs: clarify sandbox client support on Windows by @seratch in #1489
• chore: upgrade pnpm toolchain by @seratch in #1487
• chore: bump E2B version by @matthewlouisbrockman in #1490
• chore: update versions by @github-actions[bot] in #1482

New Contributors

• @matthewlouisbrockman made their first contribution in #1490

Full Changelog: v0.13.4...v0.13.5

v0.13.4

What's Changed

• fix: preserve stream usage reported on non-final chunks by @sohumt123 in #1474
• fix: fail union/tuple schema conversion instead of silently dropping members by @parthkinro in #1476
• fix(ai-sdk): concatenate all text parts in non-streaming responses by @LeSingh1 in #1475

Documentation & Other Changes

• fix: preflight pnpm upgrades against action setup by @seratch in #1470
• chore: update versions by @github-actions[bot] in #1477

New Contributors

• @LeSingh1 made their first contribution in #1475
• @parthkinro made their first contribution in #1476
• @sohumt123 made their first contribution in #1474

Full Changelog: v0.13.3...v0.13.4