pypi / openai-agents
openai-agents
What changed in openai-agents 0.23 to 0.24, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
7 breaking9 security8 new APIs and options9 behavior and defaults54 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initopenai-agents 0.2419 changes
Breaking changes 3
macOS sandbox commands deny Launch Services requests, preventing local commands from launching host applications through Launch Services.
Transactional append, clear, and replacement require a supported backend; Redis Cluster reads and pops remain available.
New snapshots use schema 1.21, and some legacy graphs with same-name non-root agents are rejected rather than risk incorrect agent ownership; finish affected tasks with their original SDK and agent code.
Security 1
Protected mount failures produce fresh redacted errors while retaining source arguments and linked exceptions and detaching the caught source traceback.
New APIs and options 2
The formatter arguments include an optional error field for tool exceptions.
The run-wide tool error formatter can receive the new tool_exception category for eligible decorated function failures; explicit per-tool handlers retain precedence.
Behavior and default changes 5
Automatic compaction waits while approvals are pending, avoiding compaction before approval history is ready.
Unserializable dataclass run contexts are omitted with a warning; use a serializer/deserializer or context_override, or strict_context=True to reject omission.
Deferred approval history is persisted across resumes and waits for the output guardrail boundary.
Converted MCP tools expose copied optional mcp_annotations metadata as discovery hints; it does not authorize execution or enter model schemas.
Writes are batched in requests of at most 20 items to respect the API limit; multi-request writes can commit partially, so reconcile remote history before retrying.
Fixes and other changes 8
Approved tools resumed after approval are traced inside the resumed agent span.
Accepted call/output pairs survive sibling or callback failures after input and tool-output guardrails permit publication, allowing supported recovery without replaying completed tools.
Unhandled computer safety checks now produce a warning.
Function-call aliases are preserved when restoring RunState.
Completed stop tools can reject added pending input when ending a resumed run; finish that run before starting a new user turn.
Standalone Redis replacement is atomic; coordinate other writers because atomic replacement does not prevent stale compaction across processes.
The tracing opt-out is honored inside caller-owned traces, including resumed tools and streamed cleanup.
Invalid sandbox tool arguments return recoverable tool errors without swallowing provider failures.
openai-agents 0.2368 changes
Breaking changes 4
Host sources in dictionary sandbox manifests are rejected.
Session history now requires encrypted envelopes.
Tool arguments that would be silently discarded as kwargs are now rejected.
Blank branch names are rejected for SQLite sessions.
Security 8
Streaming callback backlogs are bounded, and callbacks are validated before execution.
Host PATH read grants are limited to the child environment.
Exception details are redacted from Realtime tool error events.
Realtime tool output guardrails are now enforced.
Incoming WebSocket message size is bounded by default.
Grants are enforced during recursive removal.
Model metadata now respects the sensitive trace capture setting.
Special files are rejected in shared UnixLocal file I/O.
New APIs and options 6
An optional item budget is available for compaction rollback.
Docker removal protection can now be opted into.
An encrypted history scan budget is available as an opt-in.
MCP listing page limits are now configurable.
The number of turns used for memory consolidation can now be configured.
Bounded workspace outbox reads are available as an opt-in.
Behavior and default changes 4
Verbose connector output is summarized, reducing the amount of output passed through.
The STT session logging header is no longer forced.
Reasoning is omitted from default trace exports.
gpt-transcribe is now the default voice STT model.
Fixes and other changes 46
Literal Unicode content now matches correctly.
The agent_end event names the agent whose turn ended.
Tools are resolved after agent start hooks run.
Filtered history is preserved during automatic compaction.
Built-in shell and apply_patch tools are selected by their own type.
Premature end-of-file in Chat Completions streams is rejected.
Clearing a session now resets the compaction response chain.
Closed parent constraints are preserved in singleton allOf schemas.
Codex command spans now honor the run tracing policy.
Namespaced compaction model names are accepted.
Output-only metadata is stripped from compaction replay.
Default tool failure details are redacted.
Ambiguous canonical Docker removal paths are rejected.
Encrypted session visibility is refreshed before compaction.
Encrypted SQLite history is preserved when pops use the wrong key.
Exporter overrides are preserved during shutdown.
Annotated constraints on function tools are preserved.
Function tool approvals are scoped to their owning agent.
Agent tools now preserve guarded final outputs.
Host grants are validated against normalized workspace roots.
Resumed MCP calls are bound to their original recipients.
The traceable dictionary now serializes only traced fields.
MongoDB session identifiers are now validated.
Nested agent tool state is isolated across fresh runs and restored against the tool's own agent.
Nullable token counts are normalized in Chat Completions and remaining provider paths.
The pipeline tracing opt-out is honored inside caller traces.
Session keys are validated before clearing.
Terminal controls are escaped in result diagnostics.
Sandbox apply_patch approval scope is checked.
Fresh streamed handoffs are recovered after session append failures, preventing a failed append from losing the handoff.
Handoffs are recovered after compaction is cancelled.
Previous stream event aliases are discarded when a model times out.
The session remains usable after a 5xx response.
Streamed transcription is finished when input ends.
Exception tracebacks from streaming tasks are redacted.
Persistence now preserves structured guardrail diagnostics and agent output.
On Python 3.10, _wait_for_event raises the builtin TimeoutError.
Tool identity is preserved during asynchronous enablement.
Callback results are now validated.
An item with non-JSON-serializable values no longer causes the export batch to be discarded.
Rate-limited trace exports are retried.
Transcription iterators are finished when sessions close during setup.
UnixLocal snapshots preserve hardlinks and normalize special files and symlinks.
Legacy positional configuration arguments continue to be accepted.
Pre-request WebSocket handshake failures are retried.
Nested paths and symlink targets are preserved in workspace snapshots.