openai-agents-python

Agents SDK v0.24.0-alpha.7

Highlights

• Use Classic workflows alongside native execution. Import the retained v0 runtime through agents.classic. This alpha also changes executor write defaults; review the upgrade actions before opening existing environments.
• Keep conversations in your own storage. Add durable root Sessions with CustomStorage, and reconcile uncertain tool effects before resuming work.
• Add voice and hosted tools to native agents. Connect speech workflows to a Session, or use FileSearch, CodeInterpreter, and ImageGeneration through compatible Responses providers.
• Control context, completion, and usage. Transform model input, retain selected context during compaction, review proposed answers, and limit observed root usage.

Upgrading from 0.24.0-alpha.6

• Review Environment write policies. New Environments default to write_policy="strict", which requires a compatible Linux or macOS executor. The working directory remains writable; use writable_roots for additional directories. To retain the previous remote policy, including on Windows executors, set write_policy="legacy" and leave writable_roots=None. Local execution requires strict mode. When restoring legacy remote checkpoints or profiles, select legacy explicitly; reopening does not upgrade their policy. See the executor policy and restore rules.
• Check implicit reasoning settings. The bundled model catalog changes the default reasoning effort from low to medium for gpt-6-astra, gpt-6.1-sol, and gpt-5.6-sol. Set model_settings={"reasoning_effort": "low"} explicitly if you need the previous effort. This describes bundled metadata; an explicit setting or provider model metadata can select another value. (#5517)
• Rename MCP approval modes. Replace approval_mode="auto" with "native", and "approve" with "preapproved". The old values are rejected; the new names preserve their respective approval behavior.
• Update child step callbacks. NativeAgents.before_step now receives one ChildStepContext, with context, child, and step_index, instead of separate child and step-index arguments. Root before_step callbacks keep their existing signature.
• Handle MCP forms and URLs separately. ElicitationRequest is now the union FormRequest | UrlRequest. Use FormRequest.reply() or respond() for forms; use UrlRequest.reply_url_accept() or accept_url() for URL consent.

Added

• Application-owned conversation storage. SessionStore, SQLiteSessionStore, and CustomStorage persist root history and automatic Python tool results. This initial profile excludes native tools, Environments, children, planning tools, generated-code execution, manual tools, and portable checkpoints. SQLiteSessionStore requires one host and a local POSIX filesystem. Both local profiles and custom stores can report uncertain root calls for explicit reconciliation; neither automatically replays those effects. (#5514, #5502)
• Provider-hosted tools and storage. Add FileSearch, CodeInterpreter, and ImageGeneration, Code Interpreter caller policies, and provider-managed storage. Hosted tools require an API-key provider and a compatible standard Responses model; they exclude Responses Lite and Codex login. Hosted web search adds domain and location controls and retains citations. (#5576, hosted-tool guide)
• Context and completion hooks. Agent.transform_context changes sampled input without changing stored history. before_compact and selected-item retention control compaction. before_complete can accept, return ContinueTurn, or stop a proposed answer; rejected text may already have streamed and remai

Install the preview

Use standard CPython 3.10–3.14 in a virtual environment. These wheels include the native runtime; no Rust toolchain or source build is needed. This preview is distributed through GitHub Releases, not PyPI.

Run the command for your platform:

Linux x86_64 (glibc 2.39 or newer)

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-manylinux_2_39_x86_64.whl"

macOS 11 or newer on Apple Silicon

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-macosx_11_0_arm64.whl"

Windows x64

python -m pip install "https://github.com/openai/openai-agents-python/releases/download/v0.24.0-alpha.6/openai_agents-0.24.0a6-cp310-abi3-win_amd64.whl"

Wheels are not provided for Intel Macs, ARM Linux, ARM Windows, Alpine/musl, PyPy or free-threaded Python. The cp310-abi3 filenames also support standard CPython 3.11–3.14.

Check the installed version and native module:

python -c "from importlib.metadata import version; import agents._native; print(version('openai-agents'))"

Expect 0.24.0-alpha.6 or its equivalent Python packaging spelling, 0.24.0a6. SHA256SUMS contains checksums for all three wheels.

Release notes

Changes since 0.24.0-alpha.5. This preview expands conversation control, state recovery, and tool policies, and includes public API changes.

Added

• Control submitted work through a captured Turn, with get_result(), passive events(), manual request handling, steering, and cancellation. Queue prompts with Session.submit(..., if_busy="queue"), or steer the active Turn with if_busy="steer".
• Add LocalStorage to reopen conversations from a local profile, and extend portable SessionState capture and recovery. Add idle forks, caller-supplied compaction summaries, and checks for feature support and checkpoint readiness. LocalStorage profiles cannot export portable checkpoints.
• Add NativeOutput for native strict output and PromptedOutput for JSON validated in Python. Optional max_retries performs bounded corrections without tools or replaying the task. LocalStorage requires max_retries=0.
• Handle live manual tool requests and resume supported pending requests from checkpoints. Add experimental external-job recovery through agents.experimental.deferred and an optional MCP Tasks adapter.
• Select tools for each submission or model step within the Session's opening permissions. Add native web search, native child checklists, and native goals for local-storage Sessions.
• Validate Python tool return annotations and add tool policies for inspecting arguments and results. Extend native MCP support with argument replacement, result transforms, and application-managed form and URL interactions over supported HTTP, stdio, and model WebSocket paths.
• Add NetworkPolicy for native commands on supported Linux and macOS executors, subject to each platform's network and Unix socket limits. Manage remote executor lifetimes through an Environment supplied when opening a Session or running an Agent.
• Enable native child approvals and form requests with NativeAgents(interactions=True). Children continue to share the Session's tools and application context.
• Configure native OpenTelemetry export and inspect typed observations. NativeError now exposes available provider status codes, error codes, request IDs, and failure categories.
• Test real SDK sessions and Python tools against local scripted responses with agents.testing.ScriptedResponses, without a live model or API key.

API changes

• Use Agent.run() or Agent.run_sync() for one-shot calls; the redundant Runner aliases have been removed.
• Replace Turn.wait() and Session.wait() with Turn.get_result() on the captured Turn.
• Replace Session.interrupt() with Turn.cancel() for o

0.23.1 (2026-10-02)

Bug Fixes

• restore release tests and refresh required readiness check (#5278) (730deb4)

Release readiness review (v0.23.0 -> TARGET 0a5a08b21cd44808d73e8a9e732212dd33b3690d)

This is a release readiness report done by $final-release-review skill.

Diff

https://github.com/openai/openai-agents-python/compare/v0.23.0...0a5a08b21cd44808d73e8a9e732212dd33b3690d

Release intent

• Review mode: final candidate
• Intended release: patch, 0.23.1
• Minimum required release type: patch
• Versioning verdict: compatible

Release call

🟢 GREEN LIGHT TO SHIP this exact candidate. No concrete release-blocking regression was identified. Human approval and normal repository protections still apply.

Scope summary

• 28 files changed (+622/-42): release automation, test fixtures, integration/example tooling, and release metadata.
• The clean candidate contains current main a575a6e637feb9aea1b591237b007dd4991ddfba plus only six release-owned metadata files. Package, lockfile, manifest, source version and API baseline agree on 0.23.1. Snapshot source b31b9f8d13d49142a64f8873f2cc2ee40441a795 is an ancestor of the candidate.
• Relative to v0.23.0, SDK runtime source changes only its version string. API snapshot content, dependencies, Python support and persisted schemas are unchanged.

Risk assessment (ordered by impact)

1. First PyPI publication of the 0.23 series includes earlier migration requirements

   • Risk: 🟢 LOW with the previously reviewed migration paths. Users upgrading from 0.22.3 receive the 0.23.0 behavior changes as well as this patch.
   • Evidence: PyPI has neither 0.23.0 nor 0.23.1. The 0.23.0 release assessment in #5226 covers strict tools, approval restoration, encrypted history, resource limits, voice defaults and provider changes; this candidate does not alter those runtime paths.
   • Files: CHANGELOG.md, src/agents/version.py; unchanged 0.23.0 runtime contracts assessed in #5226.
   • Action: Carry forward the 0.23.0 migration guidance in the 0.23.1 announcement, particularly explicit strict-tool parameters, fresh legacy approvals, trusted encrypted-history import, resource-limit overrides and the explicit prior voice-model override.

2. Release checks recover without changing package behavior

   • Risk: 🟢 LOW. Test-loop initialization and required-check ownership are corrected while publication authorization remains intact.
   • Evidence: OS mocks are installed after event-loop initialization and restored before teardown. Authorized review events rerun the current PR-triggered readiness check instead of replacing or cancelling it. Source validation, native human approval, isolated builds and OIDC publishing remain unchanged.
   • Files: tests/sandbox/test_unix_local_user_file_io.py, .github/scripts/release_automation.py, .github/workflows/release-readiness-refresh.yml, .github/workflows/release-readiness.yml.
   • Action: Submit the exact-head human approval, allow readiness to refresh, merge through normal protections, and verify the publisher and uploaded provenance.

3. External-provider coverage now requires explicit maintainer intent

   • Risk: 🟢 LOW with an existing opt-in path. Default integration and automatic example runs no longer implicitly select the affected external-provider cases.
   • Evidence: Integration bootstrap resets inherited enable flags, removes the listed external-provider credentials by default, and rejects external model overrides without opt-in. External cases are deselected by default; automatic examples use the expanded skip list. Manual example selection remains available.
   • Files: `.github/scripts/run_integration_t

0.23.0 (2026-10-01)

Features

• mcp: add configurable MCP listing page limits (#5133) (9a21ab1)
• sandbox: add opt-in Docker removal protection (#5116) (ae5803f)
• sandbox: allow configuring memory consolidation turns (#5135) (daa1bcb)
• sessions: add an opt-in encrypted history scan budget (#5118) (a2fdb94)

Bug Fixes

• avoid awaiting cleanup during coroutine closure (#5163) (719c4e7)
• ci: update and group CodeQL actions together (#5262) (f76153c)
• ci: validate release source before building distributions (#5220) (2747c1c)
• core/extensions: respect sensitive trace capture for model metadata (#5129) (88b722d)
• core: bound agent tool streaming callback backlogs (#5106) (f23da76)
• core: isolate nested agent tool state across fresh runs (#5123) (46cc8d8)
• core: preserve closed parent constraints in singleton allOf (#5131) (f010d18)
• core: preserve guarded final outputs in agent tools (#5115) (f3a15f6)
• core: preserve structured guardrail diagnostics and agent output during persistence (#5016) (51bcea7)
• core: preserve tool identity during asynchronous enablement (#5136) (f2ae64c)
• core: redact default tool failure details (#5112) (40956e0)
• core: redact streaming task exception tracebacks (#5121) (c329e92)
• core: reject silently discarded kwargs tool argum