精选8510月2日 09:08OpenAI Agents SDK Python（GitHub Releases）AI 编程与模型

OpenAI Agents SDK v0.23.0：新增MCP分页与沙箱保护，强化实时流安全与状态恢复

v0.23.0

原文

发到 X

推荐理由

本次更新引入了关键的安全加固（Realtime消息限幅、敏感信息红脱）和破坏性状态修复（嵌套工具状态隔离），直接影响Agent运行的稳定性与安全性，建议相关开发者尽快升级以规避潜在风险。

0.23.0 (2026-10-01)

Features

功能

mcp: add configurable MCP listing page limits (#5133) (9a21ab1)
sandbox: add opt-in Docker removal protection (#5116) (ae5803f)
sandbox: allow configuring memory consolidation turns (#5135) (daa1bcb)
sessions: add an opt-in encrypted history scan budget (#5118) (a2fdb94)

mcp：添加可配置的 MCP 列表页面限制 (#5133) (9a21ab1)
sandbox：添加可选的 Docker 移除保护 (#5116) (ae5803f)
sandbox：允许配置内存合并轮次 (#5135) (daa1bcb)
sessions：添加可选的加密历史记录扫描预算 (#5118) (a2fdb94)

Bug Fixes

错误修复

avoid awaiting cleanup during coroutine closure (#5163) (719c4e7)
ci: update and group CodeQL actions together (#5262) (f76153c)
ci: validate release source before building distributions (#5220) (2747c1c)
core/extensions: respect sensitive trace capture for model metadata (#5129) (88b722d)
core: bound agent tool streaming callback backlogs (#5106) (f23da76)
core: isolate nested agent tool state across fresh runs (#5123) (46cc8d8)
core: preserve closed parent constraints in singleton allOf (#5131) (f010d18)
core: preserve guarded final outputs in agent tools (#5115) (f3a15f6)
core: preserve structured guardrail diagnostics and agent output during persistence (#5016) (51bcea7)
core: preserve tool identity during asynchronous enablement (#5136) (f2ae64c)
core: redact default tool failure details (#5112) (40956e0)
core: redact streaming task exception tracebacks (#5121) (c329e92)
core: reject silently discarded kwargs tool arguments (#5174) (a9b1ce7)
core: resolve tools after agent start hooks (#5124) (5237420)
core: restore nested agent tool state against the tool's own agent (#5142) (ad93f54)
core: retry pre-request WebSocket handshake failures (#4780) (265f16f)
core: scope function tool approvals to their owning agent (#5144) (de25d82)
core: select built-in shell and apply_patch tools by their own type (#4952) (eb68131)
core: serialize only traced fields in ModelSettings.to_traceable_dict (#5003) (57f0b38)
core: validate agent tool stream callbacks before execution (#5125) (fae72a4)
core: validate tool_use_behavior callback results (#5173) (5a2d63f)
deps-dev: bump coverage from 7.10.3 to 7.16.1 (#5152) (47c21ee)
deps-dev: bump cryptography from 50.0.0 to 50.0.1 (#5234) (e6c6806)
deps-dev: bump dapr from 1.16.0 to 1.18.3 (#5154) (e94309d)
deps-dev: bump pymongo from 4.16.0 to 4.18.1 (#5155) (971c5f3)
deps-dev: bump ruff from 0.9.2 to 0.16.8 (#5249) (9d2b318)
deps-dev: bump textual from 8.2.3 to 8.2.8 (#5248) (f2df6e4)
deps-dev: bump types-pynput from 1.8.1.20250809 to 1.8.1.20260712 (#5246) (582d048)
deps: bump actions/create-github-app-token from 2.2.2 to 3.2.0 (#5245) (e6467e2)
deps: bump anyio from 4.10.0 to 4.14.2 (#5091) (0910b46)
deps: bump astral-sh/setup-uv from 9.0.0 to 10.2.0 (#5252) (52aa07c)
deps: bump cbor2 from 5.9.0 to 6.1.4 (#5153) (34952bc)
deps: bump pyjwt from 2.13.0 to 2.15.0 (#5271) (dc81a17)
deps: bump runloop-api-client from 1.31.0 to 1.32.0 (#5156) (32edd3c)
deps: bump temporalio from 1.26.0 to 1.33.0 (#5233) (6b5bad7)
deps: bump the codeql group with 2 updates (#5273) (fffe955)
deps: bump urllib3 from 2.7.0 to 2.8.0 (#5256) (28e9f4f)
deps: update httpx2 requirement from >=2.12.0 to >=2.13.0 in /examples/realtime/twilio (#5147) (153b3f1)
deps: update httpx2 requirement from >=2.12.0 to >=2.13.0 in /examples/realtime/twilio_sip (#5151) (a62e594)
deps: update httpx2 requirement from >=2.13.0 to >=2.13.1 in /examples/realtime/twilio (#5266) (ed1145f)
deps: update httpx2 requirement from >=2.13.0 to >=2.13.1 in /examples/realtime/twilio_sip (#5269) (a5d7fd4)
deps: update httpx2 requirement in /examples/realtime/twilio (ed1145f)
deps: update httpx2 requirement in /examples/realtime/twilio_sip (a5d7fd4)
deps: update openai requirement from <4,>=3.17.0 to >=3.19.1,<4 in /examples/realtime/twilio_sip (#5270) (093e183)
deps: update openai requirement from <4,>=3.8.0 to >=3.17.0,<4 in /examples/realtime/twilio_sip (#5232) (5541111)
deps: update openai requirement in /examples/realtime/twilio_sip (093e183)
deps: update openai requirement in /examples/realtime/twilio_sip (5541111)
deps: update pyjwt requirement from >=2.13.0 to >=2.14.0 in /examples/realtime/twilio (#5149) (5ed5727)
deps: update pyjwt requirement from >=2.14.0 to >=2.15.0 in /examples/realtime/twilio (#5267) (0b60281)
deps: update pyjwt requirement in /examples/realtime/twilio (0b60281)
deps: update starlette requirement from >=1.6.0 to >=1.7.0 in /examples/realtime/twilio (#5265) (1e1cd73)
deps: update starlette requirement from >=1.6.0 to >=1.7.0 in /examples/realtime/twilio_sip (#5268) (36d7944)
deps: update starlette requirement in /examples/realtime/twilio (1e1cd73)
deps: update starlette requirement in /examples/realtime/twilio_sip (36d7944)
deps: update twilio requirement from <10,>=9 to >=9.11.1,<10 in /examples/realtime/twilio (#5148) (59d860f)
deps: update urllib3 requirement from >=2.7.0 to >=2.8.0 in /examples/realtime/twilio (#5231) (c513dd1)
deps: update urllib3 requirement in /examples/realtime/twilio (c513dd1)
deps: update uvicorn requirement from >=0.52.4 to >=0.53.0 in /examples/realtime/twilio_sip (#5150) (04e699f)
discard previous stream event aliases on model timeout (#5216) (de3b1d7)
escape terminal controls in result diagnostics (#5219) (e80737c)
examples: keep realtime debug error summaries payload-free (#5200) (e7d7097)
examples: keep Redis connection details out of diagnostics (#5205) (c2321d2)
examples: prevent auto-running the local Temporal shell workflow (#5218) (5b50815)
examples: restrict the Realtime demo to local bounded sessions (#5111) (4adad5e)
extensions: close owned event streams when runs fail (#5060) (d5abd9f)
extensions: honor run tracing policy in Codex command spans (#5138) (78e5b4d)
extensions: keep SQLite usage capture off the event loop (#4981) (8e338e5)
extensions: keep the current branch when a forced delete_branch fails (#5081) (165390c)
extensions: preserve filtered history during automatic compaction (#5103) (27625dd)
extensions: preserve subprocess errors for non-UTF8 stderr (#5186) (549fcee)
extensions: validate MongoDB session identifiers (#5104) (442469e)
keep the file when apply_patch does a case-only rename (#4890) (71306bf)
mcp: bind resumed MCP calls to their original recipients (#5119) (bd91ae6)
mcp: escape duplicate tool names in diagnostics (#5217) (fc4d832)
mcp: keep the Streamable HTTP session usable after a 5xx (#5061) (29aa40b)
mcp: preserve cache invalidation during refresh (#4807) (5e7afe4)
mcp: stop swallowing worker task cancellation (#5055) (c4c04b6)
memory: preserve encrypted SQLite history on wrong-key pops (#5083) (0f87da2)
memory: require encrypted envelopes for session history (#5204) (bb7cd2e)
migrate Vercel sandboxes to the owned provider client (#5255) (9706013)
normalize nullable Chat Completions token counts (#5238) (1ac6d82)
normalize nullable token counts in remaining provider paths (#5260) (1c5c275)
preserve completed tool results when resuming approvals (#5240) (872e2d6)
preserve function tool Annotated constraints (#5212) (ee9a12a)
preserve SDK error metadata after late tool timeouts (#5194) (160ed62)
preserve streamed cancellation and pending guardrail cleanup (#5224) (0d6b741)
realtime: bound incoming WebSocket message size by default (#5102) (5a80698)
realtime: end event iteration when session close starts (#5172) (f9108bd)
realtime: enforce Realtime tool output guardrails (#5127) (518b1f2)
realtime: name the agent whose turn ended in agent_end (#5073) (49660c5)
realtime: preserve heard audio during later responses (#5193) (86a13db)
realtime: redact exception details from Realtime tool error events (#5132) (a58d03c)
realtime: reset per-connection state on close (#5069) (a34b396)
redis: validate session keys before clearing (#5202) (b3d5c1d)
refresh encrypted session visibility before compaction (#5209) (92a2c60)

避免在协程关闭期间等待清理 (#5163) (719c4e7)
ci：更新并将 CodeQL 操作分组在一起 (#5262) (f76153c)
ci：在构建发行版之前验证发布源 (#5220) (2747c1c)
core/extensions：尊重模型元数据的敏感跟踪捕获 (#5129) (88b722d)
core：限制代理工具流式回调积压 (#5106) (f23da76)
core：在每次新运行中隔离嵌套代理工具状态 (#5123) (46cc8d8)
core：在单例 allOf 中保留已关闭的父级约束 (#5131) (f010d18)
core：在代理工具中保留受保护的最终输出 (#5115) (f3a15f6)
core：在持久化期间保留结构化护栏诊断和代理输出 (#5016) (51bcea7)
core：在异步启用期间保留工具身份 (#5136) (f2ae64c)
core：脱敏默认工具失败详情 (#5112) (40956e0)
core：脱敏流式任务异常的追溯信息 (#5121) (c329e92)
core：拒绝被静默丢弃的 kwargs 工具参数 (#5174) (a9b1ce7)
core：在代理启动钩子之后解析工具 (#5124) (5237420)
core：针对工具自身的代理恢复嵌套代理工具状态 (#5142) (ad93f54)
core：重试预请求 WebSocket 握手失败 (#4780) (265f16f)
core：将函数工具审批范围限定为其所属的代理 (#5144) (de25d82)
core：按其自身类型选择内置 shell 和 apply_patch 工具 (#4952) (eb68131)
core: ModelSettings.to_traceable_dict 中仅序列化追踪字段 (#5003) (57f0b38)
core: 在执行前验证代理工具流回调 (#5125) (fae72a4)
core: 验证 tool_use_behavior 回调结果 (#5173) (5a2d63f)
deps-dev: coverage 从 7.10.3 升级至 7.16.1 (#5152) (47c21ee)
deps-dev: cryptography 从 50.0.0 升级至 50.0.1 (#5234) (e6c6806)
deps-dev: dapr 从 1.16.0 升级至 1.18.3 (#5154) (e94309d)
deps-dev: pymongo 从 4.16.0 升级至 4.18.1 (#5155) (971c5f3)
deps-dev: ruff 从 0.9.2 升级至 0.16.8 (#5249) (9d2b318)
deps-dev: textual 从 8.2.3 升级至 8.2.8 (#5248) (f2df6e4)
deps-dev: types-pynput 从 1.8.1.20250809 升级至 1.8.1.20260712 (#5246) (582d048)
deps: actions/create-github-app-token 从 2.2.2 升级至 3.2.0 (#5245) (e6467e2)
deps: anyio 从 4.10.0 升级至 4.14.2 (#5091) (0910b46)
deps: astral-sh/setup-uv 从 9.0.0 升级至 10.2.0 (#5252) (52aa07c)
deps: cbor2 从 5.9.0 升级至 6.1.4 (#5153) (34952bc)
deps: pyjwt 从 2.13.0 升级至 2.15.0 (#5271) (dc81a17)
deps: runloop-api-client 从 1.31.0 升级至 1.32.0 (#5156) (32edd3c)
deps: temporalio 从 1.26.0 升级至 1.33.0 (#5233) (6b5bad7)
deps: 更新 codeql 组，共 2 项更新 (#5273) (fffe955)
deps: urllib3 从 2.7.0 升级至 2.8.0 (#5256) (28e9f4f)
deps: 在 /examples/realtime/twilio 中将 httpx2 要求从 >=2.12.0 更新至 >=2.13.0 (#5147) (153b3f1)
deps: 在 /examples/realtime/twilio_sip 中将 httpx2 要求从 >=2.12.0 更新至 >=2.13.0 (#5151) (a62e594)
deps: 在 /examples/realtime/twilio 中将 httpx2 要求从 >=2.13.0 更新至 >=2.13.1 (#5266) (ed1145f)
deps: 在 /examples/realtime/twilio_sip 中将 httpx2 要求从 >=2.13.0 更新至 >=2.13.1 (#5269) (a5d7fd4)
deps: 更新 /examples/realtime/twilio 中的 httpx2 (ed1145f)
deps: 更新 /examples/realtime/twilio_sip 中的 httpx2 依赖 (a5d7fd4)
deps: 在 /examples/realtime/twilio_sip 中将 openai 依赖从 <4,>=3.17.0 更新为 >=3.19.1,<4 (#5270) (093e183)
deps: 在 /examples/realtime/twilio_sip 中将 openai 依赖从 <4,>=3.8.0 更新为 >=3.17.0,<4 (#5232) (5541111)
deps: 更新 /examples/realtime/twilio_sip 中的 openai 依赖 (093e183)
deps: 更新 /examples/realtime/twilio_sip 中的 openai 依赖 (5541111)
deps: 在 /examples/realtime/twilio 中将 pyjwt 依赖从 >=2.13.0 更新为 >=2.14.0 (#5149) (5ed5727)
deps: 在 /examples/realtime/twilio 中将 pyjwt 依赖从 >=2.14.0 更新为 >=2.15.0 (#5267) (0b60281)
deps: 更新 /examples/realtime/twilio 中的 pyjwt 依赖 (0b60281)
deps: 在 /examples/realtime/twilio 中将 starlette 依赖从 >=1.6.0 更新为 >=1.7.0 (#5265) (1e1cd73)
deps: 在 /examples/realtime/twilio_sip 中将 starlette 依赖从 >=1.6.0 更新为 >=1.7.0 (#5268) (36d7944)
deps: 更新 /examples/realtime/twilio 中的 starlette 依赖 (1e1cd73)
deps: 更新 /examples/realtime/twilio_sip 中的 starlette 依赖 (36d7944)
deps: 在 /examples/realtime/twilio 中将 twilio 依赖从 <10,>=9 更新为 >=9.11.1,<10 (#5148) (59d860f)
deps: 在 /examples/realtime/twilio 中将 urllib3 依赖从 >=2.7.0 更新为 >=2.8.0 (#5231) (c513dd1)
deps: 更新 /examples/realtime/twilio 中的 urllib3 依赖 (c513dd1)
deps: 在 /examples/realtime/twilio_sip 中将 uvicorn 依赖从 >=0.52.4 更新为 >=0.53.0 (#5150) (04e699f)
在模型超时时丢弃之前的流事件别名 (#5216) (de3b1d7)
在结果诊断中转义终端控制字符 (#5219) (e80737c)
示例：保持实时调试错误摘要有效载荷为空 (#5200) (e7d7097)
示例：将 Redis 连接详细信息排除在诊断信息之外 (#5205) (c2321d2)
示例：防止自动运行本地 Temporal shell 工作流 (#5218) (5b50815)
示例：将 Realtime 演示限制为本地有界会话 (#5111) (4adad5e)
扩展：当运行失败时关闭拥有的事件流 (#5060) (d5abd9f)
扩展：在 Codex 命令跨度中遵守运行跟踪策略 (#5138) (78e5b4d)
extensions：将 SQLite 使用捕获移出事件循环 (#4981) (8e338e5)
extensions：当强制删除分支失败时保留当前分支 (#5081) (165390c)
extensions：在自动压缩期间保留过滤后的历史记录 (#5103) (27625dd)
extensions：为非 UTF-8 标准错误流保留子进程错误 (#5186) (549fcee)
extensions：验证 MongoDB 会话标识符 (#5104) (442469e)
apply_patch 仅进行大小写重命名时保留文件 (#4890) (71306bf)
mcp：将恢复的 MCP 调用绑定到其原始接收者 (#5119) (bd91ae6)
mcp：在诊断信息中转义重复的工具名称 (#5217) (fc4d832)
mcp：在发生 5xx 错误后保持 Streamable HTTP 会话可用 (#5061) (29aa40b)
mcp：在刷新期间保留缓存失效 (#4807) (5e7afe4)
mcp：停止吞没工作任务的取消操作 (#5055) (c4c04b6)
memory：在密钥错误的弹出操作中保留加密的 SQLite 历史记录 (#5083) (0f87da2)
memory：要求会话历史使用加密信封 (#5204) (bb7cd2e)
将 Vercel 沙箱迁移至拥有者提供程序客户端 (#5255) (9706013)
规范化可空的 Chat Completions 令牌计数 (#5238) (1ac6d82)
规范化其余提供程序路径中的可空令牌计数 (#5260) (1c5c275)
在恢复审批时保留已完成工具调用的结果 (#5240) (872e2d6)
保留函数工具的 Annotated 约束条件 (#5212) (ee9a12a)
在工具超时后保留 SDK 错误元数据 (#5194) (160ed62)
保留流式传输的取消操作和待处理的护栏清理 (#5224) (0d6b741)
realtime：默认限制传入 WebSocket 消息的大小 (#5102) (5a80698)
realtime：在会话关闭开始时结束事件迭代 (#5172) (f9108bd)
realtime：强制执行 Realtime 工具输出的护栏规则 (#5127) (518b1f2)
realtime：在 agent_end 中标识轮次结束的代理 (#5073) (49660c5)
实时：在后续响应期间保留已接收的音频 (#5193) (86a13db)
实时：从 Realtime 工具错误事件中脱敏异常详情 (#5132) (a58d03c)
实时：在关闭时重置每个连接的状态 (#5069) (a34b396)
Redis：在清除前验证会话密钥 (#5202) (b3d5c1d)
在压缩前刷新加密会话的可见性 (#5209) (92a2c60)

更进一步：量化金融体系

看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力

进入量化体系 →

话题#安全 #新功能 #OpenAI Agents SDK #MCP