build(deps): bump openai-agents from 0.19.3 to 0.20.0 in /openai-agents-sdk - #182

Sourced from openai-agents's releases.

v0.20.0

Key Changes

Version 0.20.0 is a minor release because it changes the implicit default model and includes a potentially breaking MCP dependency migration for applications with customized local HTTP transports. MCP v1 remains supported, and affected applications can migrate to httpx2 or pin mcp<2.

Highlights:

• The default model is now gpt-5.6-luna; explicit models, run-level overrides, and OPENAI_DEFAULT_MODEL continue to take precedence.
• Local MCP connections support MCP Python SDK v1 and v2 across stdio, SSE, and Streamable HTTP transports.
• Applications using custom MCP HTTP authentication or client factories must use the HTTP types owned by the installed MCP major version, or pin mcp<2.
• RunState.add_input() can stage durable user input before a resumed model call, with guardrail, persistence, and serialization support.
• Sandbox mount validation adds explicit credential-exposure acknowledgements and preserves redacted error contracts without serializing credential authority.
• Realtime input transcription supports the GA transcription settings for gpt-live-transcribe, gpt-transcribe, and gpt-realtime-whisper.

What's Changed

• feat: use GPT-5.6 Luna as the default model by @​seratch in openai/openai-agents-python#4282
• feat: add durable pending input to RunState by @​seratch in openai/openai-agents-python#4325
• feat(mcp): support MCP Python SDK v1 and v2 by @​seratch in openai/openai-agents-python#4106
• feat(sessions): pass run context to custom sessions by @​seratch in openai/openai-agents-python#4209
• feat(realtime): support GA transcription options by @​seratch in openai/openai-agents-python#4351
• feat: preserve raw usage payloads by @​seratch in openai/openai-agents-python#4279
• feat: allow applications to approve unsafe replays by @​seratch in openai/openai-agents-python#4319
• fix: falsy optional reference handling by @​seratch in openai/openai-agents-python#4305
• fix: prevent queue consumer deadlocks by @​seratch in openai/openai-agents-python#4201
• fix: publish completed streamed guardrail results on failure paths by @​adityasingh2400 in openai/openai-agents-python#4223
• fix: annotate the bare tool guardrail decorator overloads by @​adityasingh2400 in openai/openai-agents-python#4238
• fix: tool approval is not honored on resume when Runner.run is given a context by @​ojassharma7 in openai/openai-agents-python#4245
• fix: redact JSON validation errors by @​seratch in openai/openai-agents-python#4211
• fix: copy raw_responses when building a RunState by @​adityasingh2400 in openai/openai-agents-python#4237
• fix: keep empty turns in the nested conversation history by @​abhay-codes07 in openai/openai-agents-python#4230
• fix: keep tool guardrail results when a resumed run interrupts again by @​adityasingh2400 in openai/openai-agents-python#4239
• fix: work on copies of the lists a resumed run adopts from RunState by @​hsusul in openai/openai-agents-python#4251
• fix: strip placeholder item IDs without provider_data on the Responses path by @​LeSingh1 in openai/openai-agents-python#4266
• fix: bind tool approvals to concrete invocations by @​seratch in openai/openai-agents-python#4257
• fix: normalize optional fields in tool invocation identity by @​seratch in openai/openai-agents-python#4289
• fix: count requests when providers omit usage by @​seratch in openai/openai-agents-python#4290
• fix: suppress pydantic serializer warnings by @​seratch in openai/openai-agents-python#4291
• fix: keep FunctionTool subclasses copyable by @​seratch in openai/openai-agents-python#4311
• fix: preserve streamed guardrail session state by @​seratch in openai/openai-agents-python#4312
• fix: keep acknowledged safety checks serializable after restore by @​ribhavjain in openai/openai-agents-python#4316
• fix: preserve default-valued fields in serialized tool output by @​hsusul in openai/openai-agents-python#4307
• fix: strip output-only created_by when replaying model output as input by @​hsusul in openai/openai-agents-python#4308
• fix: preserve local shell outputs across RunState resume by @​seratch in openai/openai-agents-python#4320
• fix: serialize containers of models and dataclasses as structured data by @​ribhavjain in openai/openai-agents-python#4339
• fix: reject schemas that exceed safe recursion depth by @​seratch in openai/openai-agents-python#4358
• fix: reject unsafe strict-schema ref siblings by @​seratch in openai/openai-agents-python#4356
• fix(sandbox): reject unsafe mount credential configurations by @​seratch in openai/openai-agents-python#4255
  • fix(extensions): settle snapshot directory mount transitions for Modal by @​seratch in openai/openai-agents-python#4315
  • fix(sandbox): preserve sandbox error contracts during mount redaction by @​seratch in openai/openai-agents-python#4344

... (truncated)

Sourced from openai-agents's changelog.

0.20.0

Version 0.20.0 includes a potentially breaking MCP dependency migration for applications that customize local MCP HTTP transports. It also updates the SDK default model used when an agent or run does not explicitly select one.

Highlights:

• The SDK default model is now gpt-5.6-luna instead of gpt-5.4-mini. The default reasoning.effort="none" and verbosity="low" settings are unchanged.
• Explicit agent models, run-level model overrides, and the OPENAI_DEFAULT_MODEL environment variable continue to take precedence over the SDK default.
• Realtime input transcription settings now recognize gpt-transcribe, gpt-live-transcribe, and gpt-realtime-whisper. For low-latency gpt-live-transcribe sessions, nested audio.input.transcription settings can supply prompt, keywords, and multiple expected languages. The OpenAI client version pinned by this SDK supports the delay latency/accuracy level only with gpt-realtime-whisper. Use gpt-transcribe over WebSocket for transcription after a committed audio turn or for detected-language output. Setting audio.input.turn_detection=None explicitly disables automatic turn detection. See Input transcription settings.
• Local MCP connections created by the Agents SDK now support MCP Python SDK v2 while retaining v1 compatibility through mcp>=1.19.0,<3. The Agents SDK adapts ordinary stdio, SSE, and Streamable HTTP connections automatically. With MCP v2 installed, these connections use mcp.Client(mode="auto") to probe the newest supported protocol and fall back to the legacy initialize handshake for older servers. If dependency resolution selects MCP v2, applications that supply custom httpx.Auth objects or httpx.AsyncClient factories must migrate those values to httpx2, or pin mcp<2 to retain the v1 HTTP stack. MCPServerStreamableHttp's params["ignore_initialized_notification_failure"] = True option also remains v1-only. See MCP Python SDK v1 and v2 for migration details.
• Sandbox mount validation now rejects unsafe credential placement before sandbox or mount-helper side effects. Trusted applications can acknowledge mount-scoped or broad credential exposure for an exact in-container mount path without changing the storage capability tables. These acknowledgements are runtime-only and serialized sandbox state never grants credential authority by itself. At protected mount boundaries, the SDK returns a fresh redacted exception. If the source exception is an exact recognized SDK sandbox error and its approved structured fields validate, the replacement preserves that subtype and the validated safe fields. A recognized MountConfigError can also retain an SDK-generated safe validation message. Otherwise, the SDK returns a fresh generic redacted error. Provider-controlled or otherwise unapproved messages, command data, notes, context, causes, and source traceback state are not retained. See Mounts and remote storage and Resume from session state.
• Retry policies can inspect stable replay-safety facts and explicitly set RetryDecision(approve_unsafe_replay=True) for a non-streaming request that the provider marked unsafe. This approval does not bypass aborts, emitted streamed output, or separate local-side-effect vetoes such as Programmatic Tool Calling. See Runner-managed retries.
• Resumable RunState objects can now stage durable user input with add_input() before the next model call. Staged input survives serialization, runs through input guardrails, and produces one durable SDK input occurrence across local sessions and server-managed conversations. An explicitly approved unsafe replay can still resend the input to the provider and repeat provider-side work. See Add input before resuming.
• Runtime reliability fixes align streamed and non-streamed output-guardrail session persistence, preserve FunctionTool subclasses during copying and namespacing, and raise an explicit error for unsupported Chat Completions audio output instead of silently completing an empty stream. The OpenAIResponsesCompactionSession wrapper attempts and awaits pre-compaction history recovery before cancellation reaches the caller. A VoicePipeline consumer now receives transcription-session close failures after a clean run, while an earlier turn failure retains precedence over a later close failure. RunState round trips now preserve local shell output, acknowledged computer safety checks, default-valued tool output fields, and Pydantic model or dataclass outputs encountered while traversing dictionaries, lists, or tuples. MCP conversion preserves free-form object schemas and image output, and serializes other raw content blocks such as audio and resource blocks as valid JSON text. MCPServerManager serializes overlapping lifecycle operations and applies finite default timeouts to connection and cleanup. Model replay removes server-owned created_by metadata from output items before using them as input.

0.19.0

This minor release does not introduce a breaking change. The minor version bump reflects a significant new OpenAI Responses feature area: Programmatic Tool Calling.

Highlights:

• Added [ProgrammaticToolCallingTool][agents.tool.ProgrammaticToolCallingTool], which lets supported OpenAI Responses models generate JavaScript to coordinate tools eligible for Programmatic Tool Calling. It supports per-tool allowed_callers, structured outputs from FunctionTool instances, and integration with Runner streaming, guardrails, approvals, sessions, and RunState. See Programmatic Tool Calling for setup and constraints.
• Added the public agents.decorators module and @tool as a shorter alias for the existing @function_tool decorator, alongside the existing guardrail decorators. FunctionTool instances now also support async callable objects.
• SDK configuration now consistently accepts either typed settings objects or dictionaries across agents, runs, models, sessions, sandboxes, and voice pipelines, with validation for unknown settings.
• Hardened error and diagnostic logging across models, tools, MCP, Realtime, sessions, sandboxes, and tracing to avoid exposing raw sensitive payloads while preserving useful debugging context.
• Improved AnyLLM, LiteLLM, and Chat Completions compatibility, preserved session history across model retries, and added provider retry guidance for WebSocket overloads that occur before a response starts, so opt-in Runner retry policies can replay the failed attempt when permitted.
• Added S3 mounts that can be configured only when a Vercel sandbox is created through VercelCloudBucketMountStrategy. Mounted sessions exclude bucket contents from workspace persistence and intentionally do not support dynamic mount changes or session resume.

0.18.0

This minor release does not introduce a breaking change. The minor version bump is for the Realtime agents default model update only.

Highlights:

• Realtime agents now use gpt-realtime-2.1 as the default model, so new Realtime setups use the latest recommended model without extra configuration.

0.17.0

In this version, sandbox local source materialization keeps LocalFile.src and LocalDir.src within the materialization base_dir unless the source path is covered by Manifest.extra_path_grants. The base_dir is the SDK process current working directory when the manifest is applied; relative local sources are resolved from that directory, while absolute local sources must already be inside it or under an explicit grant. This closes a local artifact boundary issue, but it can affect applications that intentionally copy trusted host files or directories from outside that base directory into a sandbox workspace.

To migrate, grant trusted host roots at the manifest level with SandboxPathGrant, preferably as read-only when the sandbox only needs to read those files:

from pathlib import Path
from agents.sandbox import Manifest, SandboxPathGrant
from agents.sandbox.entries import Dir, LocalDir
This is an absolute host path outside the SDK process base_dir.
TRUSTED_DOCS_ROOT = Path("/opt/my-app/docs")
</tr></table>

... (truncated)

• d2bda3f release: 0.20.0 (#4348)
• c0b8763 perf: limit mypy to runtime source
• 27c1060 fix: reject unsafe strict-schema ref siblings (#4356)
• 23da2b6 fix(chat-completions): omit parallel_tool_calls without tools on the Chat Com...
• b2a460d chore: preserve review credit for verified type-erasure edits
• 2231eb5 fix: reject schemas that exceed safe recursion depth (#4358)
• cda89c8 fix: freeze new public submodule callables
• 67e6d37 fix: refresh release candidates consistently
• a5def04 feat(realtime): support GA transcription options (#4351)
• 6849766 fix: freeze Runloop platform properties (#4355)
• Additional commits viewable in compare view