Upgrade the Agents API pin to openai-python 3.45.0

apps/web/e2e/data/resources.mjs

@@ -42,7 +42,7 @@ export function buildResources(now) {
   ].map((template, index) => ({
     id: uuid(), object: "agent.environment.template", name: template.name,
     created_at: now - 86400 * (4 + index * 5), updated_at: now - 86400 * (1 + index * 2),
-    capability_directories: index === 0 ? ["/workspace/capabilities"] : [], network: template.network, packages: template.packages,
+    capability_directories: index === 0 ? ["/workspace/capabilities"] : [], network: template.network, desktop: { enabled: false }, packages: template.packages,
     files: template.files, plugins: [], skills: template.skills,
   }));
 
@@ -56,7 +56,7 @@ export function buildResources(now) {
     const created = vault.created_at + 3600 * (index + 1);
     return { id: uuid(), vault_id: vault.id, name, object: "vault.credential",
       auth: { type: "static_bearer", mcp_server_url: `https://mcp.example.com/${name.toLowerCase().replace(/\s+/g, "-")}` },
-      created_at: created, updated_at: created + (index % 2 ? 86400 : 0) };
+      metadata: {}, created_at: created, updated_at: created + (index % 2 ? 86400 : 0) };
   }).reverse()]));
 
   return {

apps/web/e2e/data/routes.mjs

@@ -72,7 +72,7 @@ export function buildDemo(now = Math.floor(Date.now() / 1000), publicUrl = "http
     const { object: _o, metadata: _m, created_at: _c, updated_at: _u, ...snapshot } = agent;
     sessions.push({
       id, object: "agent.session", agent: snapshot,
-      environment: envType === "none" ? { type: "none" } : envType === "self_hosted" ? { type: "self_hosted", id: uuid(), remote_url: daemonUrl(publicUrl), workspace_directory: "/srv/work", capability_directories: [] } : { type: "openai_hosted", id: uuid(), capability_directories: [], network: { access: "disabled", allowed_domains: [] }, packages: { npm: [], python: [], system: [] }, files: [], plugins: [], skills: [] },
+      environment: envType === "none" ? { type: "none" } : envType === "self_hosted" ? { type: "self_hosted", id: uuid(), remote_url: daemonUrl(publicUrl), workspace_directory: "/srv/work", capability_directories: [] } : { type: "openai_hosted", id: uuid(), container_size: null, desktop: { enabled: false }, capability_directories: [], network: { access: "disabled", allowed_domains: [] }, packages: { npm: [], python: [], system: [] }, files: [], plugins: [], skills: [] },
       status, error: status === "failed" ? pick(["Sandbox allocation failed: node unavailable.", "Model provider returned 429 Too Many Requests.", "Tool call timed out after 300 s."]) : null,
       metadata: {}, required_actions: status === "requires_action" ? [{ type: "function_call", call_id: uuid(), turn_id: sessionTurns.at(-1)?.id ?? uuid(), name: "approve_refund", arguments: {} }] : [],
       vault_ids: [], usage: status === "in_progress" ? null : sessionTurns.length ? { input_tokens: input, output_tokens: output, total_tokens: input + output, input_tokens_details: { cached_tokens: cached }, output_tokens_details: { reasoning_tokens: reasoning } } : null,

apps/web/e2e/projects.spec.ts

@@ -22,7 +22,7 @@ test("creates a project, shows a new key once, revokes it and archives the proje
   await expect(call.getByLabel("Shell", { exact: true })).toHaveText(`export OPENAI_BASE_URL=https://core.example.com/v1\nexport OPENAI_API_KEY=${key}`);
   await expect(call.getByLabel("curl", { exact: true })).toContainText('curl "$OPENAI_BASE_URL/agents"');
   await expect(call.getByLabel("curl", { exact: true })).toContainText('curl "$OPENAI_BASE_URL/agents/sessions"');
-  await expect(call.getByLabel("Python", { exact: true })).toContainText("pip install openai==3.13.0");
+  await expect(call.getByLabel("Python", { exact: true })).toContainText("pip install openai==3.45.0");
   await issued.getByRole("button", { name: "I've saved this key" }).click();
   await expect(page.getByRole("table", { name: "Keys of Acceptance" })).toContainText("ci");
   await expect(page.getByLabel("New key ci")).toHaveCount(0);

apps/web/src/features/api-keys/HowToCall.tsx

@@ -9,7 +9,7 @@ import { useCopy } from "./IssuedKey";
 import "./how-to-call.css";
 
 /** The official SDK release Core is pinned to (contracts/agents-api/upstream.json). */
-const SDK_PIN = "openai==3.13.0";
+const SDK_PIN = "openai==3.45.0";
 
 /** Stands for the model name in the Session example; the note under the samples says what to put there. */
 export const MODEL_PLACEHOLDER = "<model>";

contracts/agents-api/core.openapi.yaml

@@ -2086,6 +2086,10 @@ definitions:
       - ManagedArchiveReleased
   v1.Agent:
     properties:
+      compaction:
+        type: object
+      experimental:
+        type: object
       id:
         type: string
       instructions:
@@ -2107,6 +2111,7 @@ definitions:
           - flex
           - priority
           - fast
+          - ultrafast
         type: string
       text:
         $ref: '#/definitions/v1.TextConfig'
@@ -2161,6 +2166,10 @@ definitions:
         type: integer
       id:
         type: string
+      metadata:
+        additionalProperties:
+          type: string
+        type: object
       name:
         type: string
       object:
@@ -2175,6 +2184,7 @@ definitions:
       - auth
       - created_at
       - id
+      - metadata
       - name
       - object
       - updated_at
@@ -2187,17 +2197,21 @@ definitions:
         x-nullable: true
       mcp_server_url:
         type: string
+      networking:
+        type: object
       refresh:
         allOf:
           - $ref: '#/definitions/v1.OAuthCredentialRefresh'
         x-nullable: true
+      secret_name:
+        type: string
       type:
         enum:
           - mcp_oauth
           - static_bearer
+          - environment_variable
         type: string
     required:
-      - mcp_server_url
       - type
     type: object
   v1.CredentialDeleted:
@@ -2298,6 +2312,8 @@ definitions:
         type: array
       created_at:
         type: integer
+      desktop:
+        type: object
       files:
         items:
           type: object
@@ -2328,6 +2344,7 @@ definitions:
     required:
       - capability_directories
       - created_at
+      - desktop
       - files
       - id
       - name
@@ -2504,6 +2521,12 @@ definitions:
         items:
           type: string
         type: array
+      request:
+        type: object
+      request_id:
+        type: string
+      response:
+        type: object
       role:
         enum:
           - user
@@ -2525,6 +2548,9 @@ definitions:
         items:
           $ref: '#/definitions/v1.SummaryText'
         type: array
+      title:
+        type: string
+        x-nullable: true
       turn_id:
         type: string
       type:
@@ -2535,6 +2561,9 @@ definitions:
           - function_call_output
           - agent_message
           - mcp_call
+          - computer_use_call
+          - computer_use_approval_request
+          - computer_use_approval_request_result
           - web_search_call
           - command_execution
           - create_subagent_call
@@ -2735,10 +2764,15 @@ definitions:
         type: string
       name:
         type: string
+      request:
+        type: object
+      request_id:
+        type: string
       turn_id:
         type: string
       type:
         enum:
+          - computer_use_approval_request
           - function_call
           - environment_connection
         type: string
@@ -3171,8 +3205,12 @@ definitions:
     type: object
   v1.SavedAgent:
     properties:
+      compaction:
+        type: object
       created_at:
         type: integer
+      experimental:
+        type: object
       id:
         type: string
       instructions:
@@ -3202,6 +3240,7 @@ definitions:
           - flex
           - priority
           - fast
+          - ultrafast
         type: string
       text:
         $ref: '#/definitions/v1.TextConfig'
@@ -3293,6 +3332,11 @@ definitions:
         items:
           $ref: '#/definitions/v1.RequiredAction'
         type: array
+      review:
+        enum:
+          - none
+          - auto_review
+        type: string
       status:
         enum:
           - idle
@@ -3420,6 +3464,11 @@ definitions:
         items:
           type: string
         type: array
+      container_size:
+        type: object
+        x-nullable: true
+      desktop:
+        type: object
       files:
         items:
           type: object
@@ -3646,6 +3695,7 @@ definitions:
     properties:
       bytes:
         type: integer
+        x-nullable: true
       created_at:
         type: integer
       expires_at:
@@ -3839,9 +3889,16 @@ definitions:
           - context_length_exceeded
           - session_budget_exceeded
           - usage_limit_exceeded
+          - project_spend_limit_exceeded
+          - organization_spend_limit_exceeded
+          - organization_usage_limit_exceeded
+          - billing_not_active
+          - credit_balance_exhausted
           - rate_limit_exceeded
+          - flex_unavailable
           - server_overloaded
           - cyber_policy
+          - misalignment_policy_violation
           - connection_failed
           - server_error
           - authentication_error

contracts/agents-api/environment-files.md

@@ -4,7 +4,7 @@ title: "Environment files and Artifacts"
 
 A Session's workspace holds live files that the agent and its tools change. `/agents/environments/{environment_id}/files` lists one workspace directory and creates files in it. When a Turn completes, Core copies the files under the workspace's `outputs/` directory into immutable Artifacts, read through `/agents/sessions/{session_id}/artifacts`. Artifacts outlive the Environment; workspace files do not.
 
-The routes follow the SDK pinned in [upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json): the [Environment files resource](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/files.py), its [list parameters](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environments/file_list_params.py), [EnvironmentFile](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environments/environment_file.py) and [TokenPage](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/pagination.py). They need the `OpenAI-Beta: agents=v1` header.
+The routes follow the SDK pinned in [upstream.json](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/contracts/agents-api/upstream.json): the [Environment files resource](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/resources/beta/agents/environments/files.py), its [list parameters](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/agents/environments/file_list_params.py), [EnvironmentFile](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/agents/environments/environment_file.py) and [TokenPage](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/pagination.py). They need the `OpenAI-Beta: agents=v1` header.
 
 ## Where files work
 

contracts/agents-api/environments.md

@@ -18,24 +18,25 @@ Paths follow the SDK resource methods, before the service's `/v1` prefix. The li
 
 | Resource | Operations | Rules |
 | --- | --- | --- |
-| [Environment](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/environments.py) | `GET /agents/environments/{id}` | Created through Session configuration. Returns `id`, `type`, `status` and the `files`, `plugins` and `skills` recorded at Session creation. |
-| [Template](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/templates.py) | `POST`, `GET /agents/environments/templates`; `GET`, `POST`, `DELETE /agents/environments/templates/{id}` | See [Templates](#templates). |
-| [Files](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/resources/beta/agents/environments/files.py) | `POST`, `GET /agents/environments/{id}/files` | See [Environment files](./environment-files.md). |
+| [Environment](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/resources/beta/agents/environments/environments.py) | `GET /agents/environments/{id}` | Created through Session configuration. Returns `id`, `type`, `status` and the `files`, `plugins` and `skills` recorded at Session creation. |
+| Environment collection | `POST`, `GET /agents/environments` | Not supported: 404 `unsupported_operation` ([unsupported operations](./wire-semantics.md#unsupported-operations)). Environments are created only through Session configuration. |
+| [Template](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/resources/beta/agents/environments/templates.py) | `POST`, `GET /agents/environments/templates`; `GET`, `POST`, `DELETE /agents/environments/templates/{id}` | See [Templates](#templates). |
+| [Files](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/resources/beta/agents/environments/files.py) | `POST`, `GET /agents/environments/{id}/files` | See [Environment files](./environment-files.md). |
 
 An Environment read joins its live owning Session within the caller's Project and returns the durable connection status. It needs no live Runtime, starts no native work and changes no connection state. The installation arrays list API-managed files, Plugins and Skills for both placements: files as `{id, type, path, file_id, size_bytes}` without content, Skills as `{type, name, description, skill_id, version}` and Plugins as `{type, name, description}`. Capabilities discovered in local capability directories are not listed.
 
-[Session environment input](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/environment_param.py) and [output](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/environment.py) have different shapes:
+[Session environment input](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/environment_param.py) and [output](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/environment.py) have different shapes:
 
 - `none` selects no Environment.
 - `self_hosted` input requires `workspace_directory`; the nullable `capability_directories` defaults to an empty list. Output adds the Environment ID and the output-only `remote_url`. The output's `/workspace` default does not make the input field optional.
 - `openai_hosted` can reference a Template and supply `capability_directories`, `network`, `packages`, `files`, `plugins`, `skills`, `env` and `setup_commands`.
 
 | Projection | States |
 | --- | --- |
-| [Environment resource](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agents/environment_info.py) | `pending`, `connected`, `disconnected`, `expired`, `failed` |
-| [Session environment event](https://github.com/openai/openai-python/blob/d7c41efee1b0802b79f3f88a678ef2052b06e9ce/src/openai/types/beta/agent_session_environment_state.py) | `pending`, `ready`, `connected`, `disconnected`, `failed`, with a nullable error |
+| [Environment resource](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/agents/environment_info.py) | `pending`, `ready`, `connected`, `disconnected`, `suspended`, `expired`, `failed` |
+| [Session environment event](https://github.com/openai/openai-python/blob/9b3458a2ef563493111a0a4265d4e9e7e14fe840/src/openai/types/beta/agent_session_environment_state.py) | The same seven states, with a nullable error |
 
-The two vocabularies are separate; never cast one to the other. The resource moves as follows, and a failed or expired Environment is final:
+Core emits `ready` only in events. It never reports `suspended`, even for an idle hosted Environment it checkpoints and stops, and it emits no `agent.session.environment.suspended`, `.expired` or `.reset` event; an Environment whose retention ends reads `expired` without the event. The resource moves as follows, and a failed or expired Environment is final:
 
 ```mermaid
 stateDiagram-v2

contracts/agents-api/go-bindings.json

@@ -52,6 +52,7 @@
   "CredentialAuth": {
     "sources": ["#/components/schemas/VaultCredentialAuthResource"],
     "fields": {
+      "mcp_server_url": {"type": "string", "omit": false},
       "expires_at": {"omit": false},
       "refresh": {"type": "*OAuthCredentialRefresh", "omit": false}
     }
@@ -181,7 +182,7 @@
     }
   },
   "InputTokenDetails": {
-    "sources": ["#/components/schemas/InputTokensDetailsResource"]
+    "sources": ["#/components/schemas/InputTokensDetailsResource-2"]
   },
   "Item": {
     "sources": ["#/components/schemas/SessionTurnItemResource"],
@@ -275,7 +276,7 @@
     "sources": ["#/components/schemas/RotateMcpOauthTokenEndpointAuthParam"]
   },
   "OutputTokenDetails": {
-    "sources": ["#/components/schemas/OutputTokensDetailsResource"]
+    "sources": ["#/components/schemas/OutputTokensDetailsResource-2"]
   },
   "Reasoning": {
     "sources": ["#/components/schemas/ReasoningParam"]
@@ -297,7 +298,7 @@
   },
   "SavedAgent": {
     "sources": ["#/components/schemas/AgentResource"],
-    "embed": {"SavedAgentConfiguration": ["x_agents_core", "model", "name", "instructions", "multi_agent", "reasoning", "service_tier", "text", "tools"]},
+    "embed": {"SavedAgentConfiguration": ["x_agents_core", "model", "name", "instructions", "multi_agent", "reasoning", "service_tier", "text", "tools", "compaction", "experimental"]},
     "order": ["id", "object", "metadata", "created_at", "updated_at"]
   },
   "SavedAgentConfiguration": {
@@ -352,7 +353,8 @@
       "workspace_directory": {"type": "string"},
       "files": {"type": "*[]json.RawMessage"},
       "plugins": {"type": "*[]json.RawMessage"},
-      "skills": {"type": "*[]json.RawMessage"}
+      "skills": {"type": "*[]json.RawMessage"},
+      "container_size": {"type": "json.RawMessage"}
     },
     "order": ["type", "id", "capability_directories", "remote_url", "workspace_directory", "network", "packages", "files", "plugins", "skills"]
   },

contracts/agents-api/harness-capabilities.md

@@ -25,8 +25,9 @@ Placements are `none` (no Environment), hosted (`openai_hosted`) and self-hosted
 | [Message images](./message-content.md#images) | PNG and JPEG data URLs: verified on all placements; other data URLs: admitted; remote URLs: rejected | PNG and JPEG data URLs: verified on all placements; remote URLs and GIF and WebP data URLs: admitted | Rejected |
 | `reasoning.effort` | `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`: admitted | `low`, `medium`, `high`, `xhigh`, `max`: admitted | `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`: admitted |
 | `reasoning.summary` | `concise`, `detailed`, `auto`: admitted | `auto`: admitted | Rejected |
-| `service_tier` other than `auto` | `default`, `flex`, `priority`, `fast`: admitted | Rejected | Rejected |
+| `service_tier` other than `auto` | `default`, `flex`, `priority`, `fast`: admitted; `ultrafast` rejected | Rejected | Rejected |
 | `text.verbosity` other than `medium` | Admitted; the native model decides | Rejected | Rejected |
+| `compaction.async: true`, `experimental.time_awareness: true` and the `automations` and `computer_use` tools | Rejected | Rejected | Rejected |
 | [Public token usage](./sessions-events.md) | Measured counters | Null | Null |
 
 Native model parameters and provider protocols per Harness are in [model execution](./model-execution.md).