openai 0.84.0 → 0.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03f5297b1df9de7c2e182a5f76a72a5a15f2e9a34468b554eb92eb7e8022182b
-  data.tar.gz: 414ac43f94cee9591533b94c02d1d904cdd6a6ba0beb8694e88745b1b30dfad6
+  metadata.gz: 37f60ef5c84fcaef53fccd86fa30e1cc0988b4033abdd3e14711247e082de5d4
+  data.tar.gz: 97cd2b216e53d22574e00031f94b0d2975393a9128a9d2528ea735679bb04f8f
 SHA512:
-  metadata.gz: a2dda8c58eb47a26113b553b1428d23502d0c6740808954b740c0a5cf5dac361a798f6a14f963cff9d1230256cd800295017dc07489f7c6798f50a59c4066b1c
-  data.tar.gz: 72d931bd9cc9fa963b2f9d0d6f6e66078eb778456097d041850013b814ec20c3b5c9661a4b68c9fa2ea56a829aaaccc657e544a8cb68863f6c9ae4dd653aeb01
+  metadata.gz: 1493b225ac23056cda189b6af2bdd547aeb3441fef8f85c9454ae2d2d51e87e84743807cd86875f85a1d055eeb1f8c30ab684b7a11f76e46f86fbcd47c3b0995
+  data.tar.gz: 702dc478f26dff8454563e36b2d3ed4113ced5f04f104d34ab399091b290bf34ca3cccbb1ad8f44b2dae132d40053e33b9d0a86dc20f3a66316e0aed9378459d

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.85.0](https://github.com/openai/openai-ruby/compare/v0.84.0...v0.85.0) (2026-09-03)
+
+
+### Features
+
+* **api:** add gpt-6-astra and related features ([#596](https://github.com/openai/openai-ruby/issues/596)) ([a08d882](https://github.com/openai/openai-ruby/commit/a08d882c2575e0743a18eb5a4eae7ef3f94b0314))
+
+
+### Bug Fixes
+
+* **ci:** restore Castiron statuses for fork PRs ([#572](https://github.com/openai/openai-ruby/issues/572)) ([b78af5a](https://github.com/openai/openai-ruby/commit/b78af5acf775627c8eddf42da41bef7ea7325235))
+* correct StringIO request content length ([#583](https://github.com/openai/openai-ruby/issues/583)) ([5baeac8](https://github.com/openai/openai-ruby/commit/5baeac8131511141491fc41abdb2e4e4c596f3de))
+* emit done events for terminal chat tool calls ([#573](https://github.com/openai/openai-ruby/issues/573)) ([891936c](https://github.com/openai/openai-ruby/commit/891936ce58db613a61d270792f40da400ea44b97))
+* handle nullable structured-output literals ([#568](https://github.com/openai/openai-ruby/issues/568)) ([c4fee85](https://github.com/openai/openai-ruby/commit/c4fee85338aa283d6cec80538e4524a406fa8b7d))
+* isolate chat stream logprob chunks ([#585](https://github.com/openai/openai-ruby/issues/585)) ([0daedb2](https://github.com/openai/openai-ruby/commit/0daedb2878373da899dac8b029fdb0523a26c6ef))
+* preserve initial chat stream system fingerprint ([#580](https://github.com/openai/openai-ruby/issues/580)) ([a31c1ce](https://github.com/openai/openai-ruby/commit/a31c1cef9ee8e1fc5ed7a9b29f23171260a101e4))
+* preserve late chat completion service tier ([#567](https://github.com/openai/openai-ruby/issues/567)) ([52a0c64](https://github.com/openai/openai-ruby/commit/52a0c64fbb04535d4c1250986a5116298048764e))
+* preserve nested array schema definitions ([#581](https://github.com/openai/openai-ruby/issues/581)) ([bbfbe29](https://github.com/openai/openai-ruby/commit/bbfbe29f53018b4a3a1c61edab355ad901bb0239))
+* preserve recursive structured output refs ([#584](https://github.com/openai/openai-ruby/issues/584)) ([b23fc75](https://github.com/openai/openai-ruby/commit/b23fc752952314de279a32175d98b7ca7fd33f8c))
+* preserve retained Responses stream events ([#577](https://github.com/openai/openai-ruby/issues/577)) ([149e685](https://github.com/openai/openai-ruby/commit/149e685c64f72052d19d9389ba07d40a14c4c070))
+* preserve string-tagged structured output models ([#582](https://github.com/openai/openai-ruby/issues/582)) ([983eaf9](https://github.com/openai/openai-ruby/commit/983eaf9c240f6888d2872abddd555fa3cdd5af95))
+* raise finish errors for initial chat stream chunks ([#579](https://github.com/openai/openai-ruby/issues/579)) ([c923659](https://github.com/openai/openai-ruby/commit/c923659aeddd2ed5e928830babd2f75ea6cbae3d))
+* short-circuit Bedrock profile credentials ([#588](https://github.com/openai/openai-ruby/issues/588)) ([1c7ed46](https://github.com/openai/openai-ruby/commit/1c7ed46782288a882aed9ccedcf69ecc53fd9c6d))
+
+
+### Documentation
+
+* clarify commit prefix user impact ([#575](https://github.com/openai/openai-ruby/issues/575)) ([73752ad](https://github.com/openai/openai-ruby/commit/73752ad281e7d3fde9c4b63bd1efa17b151ff5a6))
+* establish canonical security model ([#565](https://github.com/openai/openai-ruby/issues/565)) ([2ded215](https://github.com/openai/openai-ruby/commit/2ded21565f969d026c93027d1d7264a8081d6242))
+
 ## [0.84.0](https://github.com/openai/openai-ruby/compare/v0.83.0...v0.84.0) (2026-09-02)
 
 

data/README.md

@@ -15,7 +15,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "openai", "~> 0.84.0"
+gem "openai", "~> 0.85.0"
 ```
 
 <!-- x-release-please-end -->

data/SECURITY.md

@@ -1,5 +1,15 @@
 # Security Policy
 
+## Threat model authority
+
+This file governs vulnerability disclosure and reportability. The repository's
+canonical detailed threat model, trust boundaries, security invariants, and
+severity calibration are defined in
+[docs/architecture/security-model.md](docs/architecture/security-model.md).
+Codex Security scans and reviewers should use that document from the scanned
+revision rather than maintaining a second pasted threat model here or in scan
+configuration.
+
 ## Reporting a vulnerability
 
 Please report potential security vulnerabilities through OpenAI's

data/docs/architecture/security-model.md

@@ -0,0 +1,267 @@
+# OpenAI Ruby SDK Security Model
+
+This is the canonical detailed threat model for this repository. `SECURITY.md`
+remains the authority for disclosure and reportability; this document is the
+authority for architecture, trust boundaries, security invariants, attack
+surface, and severity calibration. Codex Security scans must load this file
+from the scanned revision instead of relying on a duplicated cloud-configured
+model.
+
+## 1. Overview
+
+The OpenAI Ruby gem is a caller-embedded Ruby 3.3+ library, not a hosted
+service. It converts caller-supplied configuration, parameters, files, and
+credentials into authenticated REST, SSE, and optional Realtime WebSocket
+requests, then parses remote responses into typed Ruby values
+([README.md](../../README.md#L1-L3),
+[README.md](../../README.md#L38-L59)).
+
+| Component | Role | Evidence |
+| --- | --- | --- |
+| `OpenAI::Client` and generated resources | Public REST entry points, credentials, retries, request options | `lib/openai/client.rb:5-41`, `lib/openai/client.rb:129-170` |
+| Base transport, HTTP client, and multipart encoder | URL construction, redirects, retries, default Net::HTTP TLS/pooling, multipart headers/files, serialization, response decoding | `lib/openai/internal/transport/base_client.rb:13-27`, `lib/openai/net_http_client.rb:55-71`, `lib/openai/net_http_client.rb:139-205`, `lib/openai/net_http_client.rb:241-345`, `lib/openai/file_part.rb:33-43`, `lib/openai/file_part.rb:110-119`, `lib/openai/internal/util.rb:533-565`, `lib/openai/http_client.rb:138-237` |
+| Streaming and Realtime helpers | Construct authenticated WebSocket handshakes, enforce transport policy, and parse SSE/WebSocket JSON into typed events | `lib/openai/internal/stream.rb:19-60`, `lib/openai/helpers/realtime/client_extension.rb:167-280`, `lib/openai/helpers/realtime/transports/async_websocket.rb:185-308`, `lib/openai/helpers/realtime/connection.rb:47-100` |
+| Webhook helper | Verify timestamp and HMAC before parsing webhook events | `lib/openai/resources/webhooks.rb:15-119` |
+| Providers and workload identity | Azure, Bedrock, built-in subject-token acquisition, exchange, and X.509 credential paths | `lib/openai/providers/azure.rb:40-58`, `lib/openai/auth/subject_token_providers/gcp_id_token_provider.rb:9-67`, `lib/openai/auth/subject_token_providers/azure_managed_identity_token_provider.rb:9-92`, `lib/openai/auth/subject_token_providers/k8s_service_account_token_provider.rb:9-37`, `lib/openai/auth/workload_identity_auth.rb:280-330` |
+| CI and release workflows | Run repository code, upload CodeQL results, publish trusted Castiron results, live checks/examples, and releases | `.github/workflows/ci.yml:18-32`, `.github/workflows/codeql.yml:3-53`, `.github/workflows/castiron-custom-code-comment.yml:4-38`, `.github/workflows/examples-e2e.yml:1-43`, `.github/workflows/create-releases.yml:14-79` |
+
+```mermaid
+flowchart LR
+  Caller[Embedding application] --> SDK[OpenAI Ruby SDK]
+  SDK --> API[Configured API or provider origin]
+  API --> Parser[JSON / SSE / WebSocket parsers]
+  Parser --> Caller
+  Webhook[Webhook sender] --> Verify[HMAC + timestamp verifier]
+  Verify --> Caller
+  PR[Candidate checkout] --> CI[Ordinary read-only CI]
+  PR --> CodeQL[CodeQL analysis]
+  CodeQL --> SecurityEvents[Code-scanning results]
+  PR --> Castiron[Candidate Castiron workflow]
+  Castiron --> Trusted[Main-sourced workflow_run publisher]
+  Trusted --> GitHub[Statuses and PR comments]
+  Main[Main revision] --> Live[Live / release workflows]
+  Live --> Secrets[Referenced credentials and publishing authority]
+```
+
+| Deployment or workflow | Resource or capability | Configuration and precedence | Safe effective value or location | Readers, writers, or recipients | Enforcing control | Evidence or unknowns |
+| --- | --- | --- | --- | --- | --- | --- |
+| Default SDK | API/admin bearer credential and default Net::HTTP connection | Explicit option, then environment fallback; explicit/data-residency base URL, then `OPENAI_BASE_URL`, then default | Bearer credential to configured origin; default `https://api.openai.com/v1`; pooled connection keyed by origin | Configured API origin | Configured-origin request construction; cross-origin redirects strip credentials and reject bodies; HTTPS downgrade rejected; default Net::HTTP selects TLS from the URL, loads default trust roots, pools by origin, requires configurators to leave new connections unstarted, requires validators to leave previously unstarted connections unstarted, and checks `use_ssl?` against the URL scheme | `lib/openai/client.rb:634-645`, `lib/openai/client.rb:669-693`, `lib/openai/helpers/data_residency.rb:16-33`, `lib/openai/internal/transport/base_client.rb:418-452`, `lib/openai/internal/transport/base_client.rb:153-215`, `lib/openai/net_http_client.rb:55-71`, `lib/openai/net_http_client.rb:139-205`, `lib/openai/net_http_client.rb:241-345` |
+| Webhook handler | Webhook secret | Explicit argument, then client option, then `OPENAI_WEBHOOK_SECRET` | In-process HMAC key | Local verifier only | Required headers, freshness window, HMAC, timing-safe comparison before `unwrap` parses JSON | `lib/openai/resources/webhooks.rb:15-119` |
+| Workload identity | Built-in GCP/Azure/Kubernetes subject token and exchanged access token | GCP provider uses fixed metadata host/path plus configurable audience/timeout; Azure managed identity uses fixed IMDS endpoint plus configurable resource, identity selectors, API version, and timeout; both metadata fetches inherit Net::HTTP environment-proxy routing; Kubernetes provider uses configured/default token path; exchange uses identity/service-account IDs and default issuer URL | GCP GET to `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`; Azure GET to `http://169.254.169.254/metadata/identity/oauth2/token`; Kubernetes token read from configured/default path; subject token sent to `https://auth.openai.com/oauth/token`; returned token cached in memory | Local GCP/Azure metadata service, caller-owned environment proxy, or token-file path; issuer; configured API origin | Fixed GCP host/path and `Metadata-Flavor` header; fixed Azure IMDS endpoint and `Metadata` header; configured open/read timeouts; Azure JSON parsing and `access_token` extraction; Kubernetes file read/error mapping; token-type mapping, exchange timeout/deadline handling, coordinated refresh; fixed metadata URLs do not bypass caller-owned proxy configuration | `lib/openai/auth/subject_token_providers/gcp_id_token_provider.rb:9-67`, `lib/openai/auth/subject_token_providers/azure_managed_identity_token_provider.rb:9-92`, `lib/openai/auth/subject_token_providers/k8s_service_account_token_provider.rb:9-37`, `lib/openai/auth/workload_identity_auth.rb:13-15`, `lib/openai/auth/workload_identity_auth.rb:280-330` |
+| X.509 workload identity | Attested mTLS transport and detached exchanged bearer token | Client uses the identity-configured transport when present, otherwise a caller-supplied attested `http_client` for a detached identity, and selects `X509TokenExchange` before token acquisition | Exchange POST to `https://mtls.auth.openai.com/oauth/token`; API requests use the selected transport's attested global/US/EU mTLS API origin | OpenAI mTLS issuer and matching attested API origin | Exact issuer endpoint and attested API-origin/header checks, TLS peer/hostname verification, proxy policy, no redirects | `lib/openai/client.rb:616-644`, `lib/openai/client.rb:739-756`, `test/openai/auth/x509_client_test.rb:16-34`, `lib/openai/auth/x509_transport.rb:5-10`, `lib/openai/auth/x509_transport.rb:14-26`, `lib/openai/auth/x509_transport.rb:174-237`, `lib/openai/auth/x509_transport.rb:243-315` |
+| Azure provider | API key or Entra bearer token | Explicit endpoint/credential, then Azure environment fallback | Credential attached only to normalized Azure origin | Configured Azure endpoint | Origin validation before credential attachment; conflicting auth rejected | `lib/openai/providers/azure.rb:47-58`, `lib/openai/providers/azure.rb:141-147` |
+| Bedrock provider | Bearer token or SigV4 authority | Explicit mode, environment, then AWS credential chain | Credential/signature to configured Bedrock origin | Configured Bedrock endpoint | Origin and endpoint/region validation; SigV4 disables redirects | `lib/openai/providers/bedrock.rb:105-168`, `lib/openai/providers/bedrock.rb:398-427` |
+| Realtime WebSocket transport | API/workload bearer credential, WebSocket destination, TLS/proxy policy, and trace confidentiality | Client handshake builder applies bearer auth and optional workload-token refresh; caller may select `websocket_base_url` only within provider restrictions | Authenticated `ws://` or `wss://` handshake to configured Realtime origin; proxy credentials stay on CONNECT | Configured Realtime endpoint and optional proxy | Base URL validation, provider/X.509 restrictions, proxy-authorization stripping, WSS peer/hostname verification, trace redaction | `lib/openai/helpers/realtime/client_extension.rb:167-280`, `lib/openai/helpers/realtime/transports/async_websocket.rb:185-224`, `lib/openai/helpers/realtime/transports/async_websocket.rb:294-378` |
+| Multipart uploads | Caller file contents, effective filename, content type, and multipart header parameters | Caller supplies `Pathname`, `IO`, or `FilePart`; optional filename/content type | File bytes to configured API origin; effective filename reduced to basename; header parameters escaped | Configured API origin | Media-type validation; `FilePart` basename reduction; encoder basename reduction for raw paths; quote/backslash escaping and CR/LF removal for multipart header parameters | `lib/openai/file_part.rb:33-43`, `lib/openai/file_part.rb:110-119`, `lib/openai/internal/util.rb:533-565` |
+| Diagnostic logging | Request/response diagnostics | Explicit log level, then `OPENAI_LOG`; supplied logger or stderr | Sanitized metadata and structural body summaries | Caller logger or stderr | Credential/query redaction; multipart, streaming, binary, and large JSON bodies omitted | `lib/openai/internal/logging.rb:10-26`, `lib/openai/internal/logging.rb:299-343` |
+| Dependency acquisition and installation | Gem source, locked revision, transitive gem, native extension, and install/build-script execution | Contributor/CI `Gemfile` selects `syntax_tree-rbs` from GitHub branch `main` and `Gemfile.lock` pins revision `247832988a850b8df050cf207f652872fda49973`; Bedrock CI selects `aws-sdk-core` through `gemfiles/bedrock.gemfile` and its lock; docs lockfiles and gemspec dependencies select other installed code | Locked RubyGems and Git sources plus package metadata from the reviewed revision | CI runners and consumer Bundler/RubyGems installations | Human/source review of dependency and lockfile changes; CI verifies the reviewed checkout but does not make an unreviewed dependency trustworthy | `AGENTS.md:39-42`, `Gemfile:3-15`, `Gemfile.lock:1-20`, `gemfiles/bedrock.gemfile:1-5`, `gemfiles/bedrock.gemfile.lock:1-58`, `.github/workflows/ci-checks.yml:124-144`, `openai.gemspec:18-48`, `docs/Gemfile:1-8`, `docs/Gemfile.lock:1-21` |
+| Ordinary PR CI | Candidate checkout execution | Checked-out PR revision runs lint, typecheck, build, and tests | Candidate code executes with repository-code authority | Ephemeral CI runner | `permissions: {}`, `contents: read`, `persist-credentials: false` | `.github/workflows/ci.yml:18-32`, `.github/workflows/ci-checks.yml:100-120` |
+| CodeQL PR analysis | Candidate checkout and code-scanning result upload | Pull requests, main pushes, and merge-group checks run action and Ruby analysis | Candidate source produces SARIF under runner temp; `security-events: write` uploads code-scanning results | GitHub code scanning | Top-level `permissions: {}`; job grants only `actions: read`, `contents: read`, and `security-events: write`; pinned checkout/CodeQL actions; `persist-credentials: false`; checked SARIF must exist and contain no findings | `.github/workflows/codeql.yml:3-28`, `.github/workflows/codeql.yml:37-53`, `.github/workflows/codeql.yml:55-96` |
+| Trusted Castiron workflow-run publisher | Commit-status and PR-comment writes | Candidate-associated `workflow_run` metadata -> main-sourced reporter recomputes from current Git objects for statuses and successful report comments; fallback failure comments use event/path, current-head, and monotonic-replacement checks | `statuses: write` and `pull-requests: write` only in publisher jobs | GitHub commit statuses and PR comments | Status path: no candidate artifact, run identity validation, exact head/base checks; successful comment path: trusted report artifact; fallback failure-comment path: main-sourced code, event/path filtering, current-head matching, monotonic replacement | `.github/workflows/castiron-custom-code-comment.yml:4-38`, `.github/workflows/castiron-custom-code-comment.yml:40-98`, `.github/workflows/castiron-custom-code-comment.yml:116-171`, `.github/workflows/castiron-custom-code-comment.yml:174-237` |
+| Live/release workflows | API keys, X.509 material, GitHub App private key, generated GitHub App token, RubyGems OIDC | Main-only conditions plus named environments; release job passes `OPENAI_SDKS_APP_PRIVATE_KEY` to pinned token action, then passes generated token to Release Please | Referenced long-lived private key as action input; generated short-lived release token; publishing OIDC | Main revision, token action, OpenAI API, GitHub, RubyGems | Repository/ref conditions, separate named environments, least privilege, pinned actions, generated token handoff, OIDC only for publishing | `.github/workflows/live-smoke.yml:17-92`, `.github/workflows/create-releases.yml:17-79` |
+| Examples E2E workflow | Live-example API credential and uploaded reports | Manual dispatch; main/repository condition; named `ci` environment; `OPENAI_API_KEY` secret reference | Credential only in the live-example step; allowlisted `report.json` and `summary.md` under runner temp | OpenAI API and GitHub artifact readers | `permissions: {}`, `contents: read`, checkout without persisted credentials, main/repository condition, allowlisted reports, 14-day retention, focused confidentiality/isolation tests | `.github/workflows/examples-e2e.yml:1-43`, `test/scripts/examples_e2e_test.rb:202-234`, `test/scripts/examples_e2e_test.rb:306-327` |
+
+## 2. Threat Model, Trust Boundaries, and Assumptions
+
+Protected assets include caller API/admin/provider credentials, workload subject
+tokens and exchanged access tokens, webhook secrets, X.509 private-key
+material, uploaded file contents, request destinations and headers, parsed
+response integrity, diagnostic confidentiality, GitHub App private-key
+material, and release/publishing integrity.
+
+Important boundaries:
+
+- Caller-controlled parameters, headers, files, base URLs, callbacks, loggers,
+  and custom transports cross into SDK request construction. These remain
+  caller authority inside the embedding process; the SDK is not a sandbox
+  (`lib/openai/http_client.rb:138-142`,
+  `lib/openai/internal/transport/base_client.rb:293-339`).
+- Configured origin to redirect destination is a network boundary. Credential
+  headers must not reach a different origin, request bodies must not cross
+  origins, and HTTPS must not downgrade to HTTP
+  (`lib/openai/internal/transport/base_client.rb:153-215`).
+- The default Net::HTTP implementation is the ordinary REST TLS and connection-
+  reuse boundary. It derives TLS from the requested scheme, installs default
+  trust roots, keys pools by origin, requires configurators to leave new
+  connections unstarted, requires validators to leave previously unstarted
+  connections unstarted, and checks `use_ssl?` against the URL scheme each time
+  (`lib/openai/net_http_client.rb:55-71`,
+  `lib/openai/net_http_client.rb:139-205`,
+  `lib/openai/net_http_client.rb:241-345`).
+- API, SSE, and WebSocket bytes cross parser/type-conversion boundaries. They
+  are parsed as data, not evaluated as code
+  (`lib/openai/internal/stream.rb:21-60`,
+  `lib/openai/helpers/realtime/connection.rb:61-84`).
+- Raw webhook payloads and headers cross an authenticity boundary. `unwrap`
+  verifies freshness and HMAC before parsing or coercion
+  (`lib/openai/resources/webhooks.rb:15-23`,
+  `lib/openai/resources/webhooks.rb:75-119`).
+- Built-in subject-token sources, the generic token issuer, and Azure/Bedrock
+  endpoints are credential-brokering boundaries. GCP acquisition uses the fixed
+  plaintext metadata host/path and metadata header with configurable audience
+  and timeout; Azure managed-identity acquisition uses the fixed plaintext IMDS
+  endpoint and metadata header with configurable resource, identity selectors,
+  API version, and timeout, then parses the returned JSON token. Both metadata
+  fetches inherit Net::HTTP environment-proxy routing, so a caller-owned proxy
+  can mediate the plaintext request/response and fixed URLs alone do not prove
+  direct source binding. Kubernetes acquisition reads its configured/default
+  token path and maps file failures. Credentials must remain bound to their
+  intended source, proxy, issuer, and destination
+  (`lib/openai/auth/subject_token_providers/gcp_id_token_provider.rb:9-67`,
+  `lib/openai/auth/subject_token_providers/azure_managed_identity_token_provider.rb:9-92`,
+  `lib/openai/auth/subject_token_providers/k8s_service_account_token_provider.rb:9-37`,
+  `lib/openai/auth/workload_identity_auth.rb:280-330`,
+  `lib/openai/providers/azure.rb:141-147`,
+  `lib/openai/providers/bedrock.rb:398-427`).
+- X.509 workload identity is a separate credential boundary: the exchange uses
+  the fixed mTLS issuer while API requests use the selected transport's attested
+  matching mTLS origin. The certificate identity and exchanged bearer token
+  remain detached; controls enforce the exact issuer endpoint and approved API
+  origin/header/TLS/proxy/no-redirect policy
+  (`lib/openai/client.rb:616-644`,
+  `lib/openai/client.rb:739-756`,
+  `test/openai/auth/x509_client_test.rb:16-34`,
+  `lib/openai/auth/x509_transport.rb:5-10`,
+  `lib/openai/auth/x509_transport.rb:174-315`).
+- Authenticated Realtime handshakes are a transport boundary distinct from
+  event parsing. Bearer credentials, caller-selected WebSocket destinations,
+  TLS, proxy credentials, and traces must remain bound to their intended
+  origin and diagnostic audience
+  (`lib/openai/helpers/realtime/client_extension.rb:167-280`,
+  `lib/openai/helpers/realtime/transports/async_websocket.rb:185-224`,
+  `lib/openai/helpers/realtime/transports/async_websocket.rb:294-378`).
+- Multipart upload serialization is a file-path and header-integrity boundary.
+  `FilePart` validates media types and reduces explicit or inferred filenames to
+  basenames; the encoder again basenames raw paths and escapes quote, backslash,
+  CR, and LF header-parameter characters before bytes reach the API origin
+  (`lib/openai/file_part.rb:33-43`,
+  `lib/openai/file_part.rb:110-119`,
+  `lib/openai/internal/util.rb:533-565`).
+- Runtime/API data crossing into logs, exceptions, retained metadata objects, or
+  CI artifacts is a sensitive sink boundary. Logging redacts or omits sensitive
+  bodies; derived HTTP status messages are bounded and sanitized when no
+  top-level scalar or explicit message is supplied; top-level scalar and
+  explicit SSE error messages remain remote data; Realtime connection errors
+  redact call IDs from URLs; response metadata omits retained bodies from
+  inspection and serialization
+  (`lib/openai/internal/logging.rb:299-343`,
+  `lib/openai/errors.rb:259-409`,
+  `lib/openai/internal/stream.rb:35-40`,
+  `lib/openai/helpers/realtime/errors.rb:26-70`,
+  `lib/openai/http_client.rb:46-79`,
+  `CONTRIBUTING.md:42-50`).
+- Candidate PR code reaching sensitive live/release credentials or repository
+  write/publishing authority is a genuine boundary
+  (`.github/workflows/live-smoke.yml:17-92`,
+  `.github/workflows/examples-e2e.yml:1-43`,
+  `.github/workflows/create-releases.yml:17-79`).
+- The release GitHub App private key is distinct from the generated app token.
+  The main/repository-gated release job passes the referenced private key only
+  to a pinned token action, which mints the narrower token passed to Release
+  Please; disclosure of the private key can outlive one generated token
+  (`.github/workflows/create-releases.yml:17-46`).
+- Candidate source and generated SARIF crossing into CodeQL result upload are a
+  separate PR-adjacent write boundary. The workflow scopes the token to
+  `security-events: write` plus read-only metadata/content, uses pinned actions
+  without persisted checkout credentials, and validates that SARIF exists and
+  has no findings before the job succeeds
+  (`.github/workflows/codeql.yml:3-28`,
+  `.github/workflows/codeql.yml:37-53`,
+  `.github/workflows/codeql.yml:55-96`).
+- The manually dispatched Examples E2E job is a separate live-data boundary:
+  its main/repository-gated job references `OPENAI_API_KEY`, runs examples, and
+  always uploads only two allowlisted reports. Tests enforce report
+  confidentiality and workflow isolation
+  (`.github/workflows/examples-e2e.yml:1-43`,
+  `test/scripts/examples_e2e_test.rb:202-234`,
+  `test/scripts/examples_e2e_test.rb:306-327`).
+- Candidate-associated `workflow_run` metadata and Git objects crossing into
+  the trusted Castiron publisher are a genuine write-capable boundary. The
+  status path must preserve run-identity and exact-head/base checks; successful
+  report comments must remain bound to the trusted report artifact. The
+  fallback failure-comment path has narrower main-sourced event/path,
+  current-head, and monotonic-replacement checks that scans must assess
+  independently
+  (`.github/workflows/castiron-custom-code-comment.yml:34-98`,
+  `.github/workflows/castiron-custom-code-comment.yml:116-171`,
+  `.github/workflows/castiron-custom-code-comment.yml:174-237`).
+- Dependency declarations and locks cross a supply-chain boundary when Bundler
+  or RubyGems fetches and executes selected package code in CI or consumer
+  applications. A changed source, Git revision, transitive gem, native
+  extension, or install/build script needs explicit dependency review. The root
+  contributor/CI bundle currently selects `syntax_tree-rbs` from GitHub branch
+  `main` and locks revision `247832988a850b8df050cf207f652872fda49973`; the
+  Bedrock CI job separately selects `aws-sdk-core` through
+  `gemfiles/bedrock.gemfile` and its lock
+  (`AGENTS.md:39-42`, `Gemfile:3-15`, `Gemfile.lock:1-20`,
+  `gemfiles/bedrock.gemfile:1-5`, `gemfiles/bedrock.gemfile.lock:1-58`,
+  `.github/workflows/ci-checks.yml:124-144`,
+  `openai.gemspec:18-48`,
+  `docs/Gemfile:1-8`, `docs/Gemfile.lock:1-21`).
+
+Checked-in executable source has repository-code authority. Reviewed tracked
+examples, tests, fixtures, Rake tasks, build scripts, generators, and other
+checkout files are intentionally executable by local development and ordinary
+PR CI. A contributor who can modify those tracked files does not gain a new
+privilege merely because CI executes them. Do not report that execution alone
+as a security finding.
+
+That rule does not suppress a real finding when independently mutable
+lower-trust input crosses a parser/evaluator boundary, untrusted runtime/API/
+network data reaches a sensitive sink, candidate code can reach sensitive
+secrets or write/publishing authority, or shipped production code violates a
+security invariant.
+
+Assumptions:
+
+- The embedding application owns its local filesystem, network, process,
+  callback, proxy, and credential authority.
+- Custom transports, token providers, and loggers are caller-owned extension
+  points, not less-trusted sandboxed plugins.
+- Azure and Bedrock custom HTTP endpoints are caller-selected; HTTPS outside
+  local/private testing is a caller obligation where the provider permits HTTP.
+- External branch protection, environment approval rules, secret configuration,
+  and RubyGems trusted-publisher bindings are not proven by repository files.
+- Large JSON bodies and SSE events are supported API contracts; arbitrary fixed
+  rejection limits are not an acceptable security fix.
+
+## 3. Attack Surface, Mitigations, and Attacker Stories
+
+The following are hypotheses and review guidance, not confirmed findings.
+
+| Priority | Scenario and capability gain | Prerequisites | Impact | Existing controls | Mitigation | Evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+| High | Redirect, TLS, or pooled-connection confusion sends credentials or a body to an unintended origin | Remote endpoint controls redirect or caller/provider origin handling is bypassed, or default connection validation/pooling regresses | Credential or payload disclosure | Cross-origin credential stripping, body rejection, HTTPS downgrade rejection, provider origin validation, default trust roots, origin-keyed pools, return-time unstarted postconditions for new connections, scheme-matched `use_ssl?` checks | Preserve origin, redirect, TLS, and pool controls | `lib/openai/internal/transport/base_client.rb:153-215`, `lib/openai/providers/azure.rb:141-147`, `lib/openai/net_http_client.rb:55-71`, `lib/openai/net_http_client.rb:139-205`, `lib/openai/net_http_client.rb:241-345` |
+| High | Candidate PR code reaches live/release credentials or publishing authority | Privileged workflow executes candidate code or exposes secrets/write tokens | Credential theft or release compromise | Main-only conditions, named environments, least-privilege permissions, trusted publisher separation | Keep candidate and live/release workflows isolated | `.github/workflows/live-smoke.yml:17-92`, `.github/workflows/create-releases.yml:17-79` |
+| High | Release GitHub App private key reaches an unintended action, log, or artifact | Main/repository release gate or pinned token-action input boundary regresses | Attacker can mint GitHub App tokens beyond one workflow token lifetime | Main/repository condition, named release environment, empty job permissions, pinned token action, generated token passed separately to Release Please | Keep the private key confined to token minting and preserve generated-token handoff | `.github/workflows/create-releases.yml:17-46` |
+| Medium | Candidate source or generated SARIF influences the write-capable CodeQL upload outside its intended code-scanning result path | PR-adjacent CodeQL action or token scoping regresses | Forged or unintended code-scanning results | Top-level empty permissions; scoped `security-events: write`; read-only content/metadata; pinned actions; no persisted checkout credentials; SARIF existence/shape/finding checks | Preserve least privilege and keep upload input limited to CodeQL output | `.github/workflows/codeql.yml:3-28`, `.github/workflows/codeql.yml:37-53`, `.github/workflows/codeql.yml:55-96` |
+| High | Candidate-associated workflow metadata or Git objects influence the write-capable Castiron publisher without the path-specific trusted validation | Attacker controls a PR head or associated workflow metadata and a status, successful-comment, or fallback-comment check regresses | Forged or stale commit statuses and PR comments | Statuses use main-sourced recomputation plus run/head/base checks; successful comments use a trusted report artifact; fallback comments rely on main-sourced event/path, current-head, and monotonic-replacement checks | Preserve each path's distinct recomputation, freshness, artifact-binding, or fallback-isolation checks before its write | `.github/workflows/castiron-custom-code-comment.yml:34-98`, `.github/workflows/castiron-custom-code-comment.yml:116-171`, `.github/workflows/castiron-custom-code-comment.yml:174-237` |
+| High | A dependency declaration or lockfile selects malicious package code, native extension, or install/build script | Lower-trust change alters a source, Git revision, transitive dependency, or executable package hook that CI or a consumer installs; the contributor/CI bundle currently includes Git-sourced `syntax_tree-rbs` locked at `247832988a850b8df050cf207f652872fda49973`; Bedrock CI separately installs its `aws-sdk-core` bundle | Code execution in CI or consumer applications | Reviewed lockfiles and dependency policy; ordinary and Bedrock CI execute selected dependencies with runner authority | Review direct/transitive dependencies, sources, locked revisions, native extensions, and scripts before acceptance | `AGENTS.md:39-42`, `Gemfile:3-15`, `Gemfile.lock:1-20`, `gemfiles/bedrock.gemfile:1-5`, `gemfiles/bedrock.gemfile.lock:1-58`, `.github/workflows/ci-checks.yml:124-144`, `openai.gemspec:18-48`, `docs/Gemfile:1-8`, `docs/Gemfile.lock:1-21` |
+| High | Built-in subject-token acquisition or exchange sends a token to an unintended source, proxy, issuer, or origin | Lower-trust configuration, caller-owned environment proxy, local token path, metadata response, or endpoint handling is bypassed | Credential disclosure or forged authentication | Fixed GCP metadata host/path/header with configurable audience/timeout; fixed Azure IMDS endpoint/header with configurable resource/selectors/API version/timeout and JSON token extraction; inherited Net::HTTP environment-proxy routing remains caller-owned; configured/default Kubernetes path with mapped failures; fixed/default issuer paths, origin checks, X.509 destination restrictions | Preserve strict source, proxy, destination, timeout, redirect, and response-parsing handling | `lib/openai/auth/subject_token_providers/gcp_id_token_provider.rb:9-67`, `lib/openai/auth/subject_token_providers/azure_managed_identity_token_provider.rb:9-92`, `lib/openai/auth/subject_token_providers/k8s_service_account_token_provider.rb:9-37`, `lib/openai/auth/workload_identity_auth.rb:303-330`, `lib/openai/providers/bedrock.rb:398-427` |
+| High | Realtime bearer credentials, proxy credentials, or trace data reach an unintended destination or audience | Lower-trust destination, proxy, TLS, or tracing behavior bypasses handshake controls | Credential disclosure or authenticated connection to the wrong peer | Base-URL/provider restrictions, proxy-header stripping, WSS verification, proxy handling, trace redaction | Preserve destination/TLS/proxy/redaction controls independently from event parsing | `lib/openai/helpers/realtime/client_extension.rb:167-280`, `lib/openai/helpers/realtime/transports/async_websocket.rb:185-224`, `lib/openai/helpers/realtime/transports/async_websocket.rb:294-378` |
+| Medium | Malformed or adversarial API/SSE/WebSocket data causes sensitive leakage, type confusion, or availability failure | Victim consumes untrusted remote data | Data exposure, incorrect application behavior, or DoS | JSON parsing, typed coercion, protocol errors, safe unknown events | Keep parsers data-only, incremental where applicable, and redact errors/logs | `lib/openai/internal/stream.rb:21-60`, `lib/openai/helpers/realtime/connection.rb:61-84` |
+| Medium | Multipart filename, content type, or field name reaches headers without normalization | Caller-supplied path or header parameter crosses multipart serialization | Absolute local path disclosure or multipart header injection | Media-type validation, basename reduction for `FilePart` and raw path/IO values, quote/backslash escaping, CR/LF removal | Preserve basename and header-parameter controls before upload | `lib/openai/file_part.rb:33-43`, `lib/openai/file_part.rb:110-119`, `lib/openai/internal/util.rb:533-565` |
+| Medium | Forged webhook, or replay of a captured valid webhook, becomes an accepted typed event | For forgery, attacker lacks the webhook secret; for replay, attacker can resend a valid signed payload within the tolerance window | Application accepts an unauthentic or repeated event | Required headers, HMAC, and timing-safe comparison reject forgery; timestamp validation bounds replay age but does not deduplicate `webhook-id` | Verify before parsing; callers that need replay prevention must deduplicate `webhook-id` | `lib/openai/resources/webhooks.rb:15-119` |
+| Medium | Sensitive runtime or live-example data leaks through diagnostics, exceptions, retained metadata, or artifacts | Untrusted data reaches logger/error/object serialization or a live-example report | Credential, prompt, response, file, header, or call-identifier disclosure | Redacted headers/queries; unsafe body categories omitted; derived HTTP errors are bounded/sanitized when no top-level scalar or explicit message is supplied; top-level scalar and explicit SSE messages remain remote data; Realtime URL call-ID redaction; retained bodies omitted from inspect/YAML/Marshal; Examples E2E reports are allowlisted and tested for sensitive output | Preserve redaction, bounded derived errors, metadata serialization controls, and allowlisted artifacts; treat preserved remote messages as remote data | `lib/openai/internal/logging.rb:299-343`, `lib/openai/errors.rb:259-409`, `lib/openai/internal/stream.rb:35-40`, `lib/openai/helpers/realtime/errors.rb:26-70`, `lib/openai/http_client.rb:46-79`, `.github/workflows/examples-e2e.yml:29-43`, `test/scripts/examples_e2e_test.rb:202-234`, `test/scripts/examples_e2e_test.rb:306-327`, `CONTRIBUTING.md:42-50` |
+| Not a finding by itself | Contributor changes a tracked test/example/fixture/build script and ordinary CI runs it | Contributor already controls candidate checkout code | No new authority | Read-only ordinary CI without referenced secrets or write authority | Require a separate privilege or boundary violation before reporting | `.github/workflows/ci.yml:18-32`, `.github/workflows/ci-checks.yml:100-120` |
+
+## 4. Severity Calibration
+
+- Critical: unauthorized release/publishing compromise, protected credential
+  theft with broad impact, or a cross-account/tenant boundary failure.
+- High: realistic credential disclosure, authenticated request redirection,
+  protected CI/release boundary bypass, or forged authentication with meaningful
+  account impact.
+- Medium: production-reachable parser, webhook, retry, logging, or availability
+  failures with bounded impact or meaningful prerequisites.
+- Low: narrowly reachable confidentiality/integrity defects with limited impact
+  and strong mitigating prerequisites.
+- Out of scope without additional authority: ordinary execution of
+  contributor-controlled tracked checkout code, caller-chosen dangerous
+  configuration, caller-owned callbacks/custom transports, purely local
+  self-effects, and hypothetical stories without a realistic lower-trust route
+  to a sensitive operation.
+
+Severity depends on the attacker's initial authority, the new capability gained,
+reachability, deployment prerequisites, and effective controls. Missing evidence
+is an explicit uncertainty, not proof that a control succeeds or fails.

data/lib/openai/client.rb

@@ -86,6 +86,9 @@ module OpenAI
     # @return [OpenAI::Resources::VectorStores]
     attr_reader :vector_stores
 
+    # @return [OpenAI::Resources::Safety]
+    attr_reader :safety
+
     # @return [OpenAI::Resources::Webhooks]
     attr_reader :webhooks
 
@@ -806,6 +809,7 @@ module OpenAI
       @fine_tuning = OpenAI::Resources::FineTuning.new(client: self)
       @graders = OpenAI::Resources::Graders.new(client: self)
       @vector_stores = OpenAI::Resources::VectorStores.new(client: self)
+      @safety = OpenAI::Resources::Safety.new(client: self)
       @webhooks = OpenAI::Resources::Webhooks.new(client: self)
       @beta = OpenAI::Resources::Beta.new(client: self)
       @batches = OpenAI::Resources::Batches.new(client: self)

data/lib/openai/helpers/streaming/chat_completion_stream.rb

@@ -133,6 +133,12 @@ module OpenAI
               index_choice_snapshot!(choice_snapshot)
             end
 
+            @current_completion_snapshot = completion_snapshot
+
+            chunk.choices.each do |choice|
+              handle_finish_reason(choice.finish_reason, completion_snapshot) if choice.finish_reason
+            end
+
             return completion_snapshot
           end
 
@@ -144,6 +150,7 @@ module OpenAI
 
           completion_snapshot.usage = chunk.usage if chunk.usage
           completion_snapshot.system_fingerprint = chunk.system_fingerprint if chunk.system_fingerprint
+          completion_snapshot.service_tier = chunk.service_tier if chunk.service_tier
 
           completion_snapshot
         end
@@ -332,8 +339,8 @@ module OpenAI
 
           if choice_snapshot.logprobs.nil?
             choice_snapshot.logprobs = OpenAI::Chat::ChatCompletionChunk::Choice::Logprobs.new(
-              content: choice_logprobs.content,
-              refusal: choice_logprobs.refusal
+              content: choice_logprobs.content&.dup,
+              refusal: choice_logprobs.refusal&.dup
             )
           else
             if choice_logprobs.content
@@ -527,7 +534,7 @@ module OpenAI
               model: data[:model],
               choices: choices,
               usage: data[:usage],
-              system_fingerprint: nil,
+              system_fingerprint: data[:system_fingerprint],
               service_tier: data[:service_tier]
             }
           )
@@ -647,11 +654,6 @@ module OpenAI
 
           if choice_snapshot.finish_reason
             events.concat(content_done_events(choice_snapshot, response_format))
-
-            if @current_tool_call_index && !@done_tool_calls.include?(@current_tool_call_index)
-              event = tool_done_event(tool_calls_by_index, @current_tool_call_index)
-              events << event if event
-            end
           end
 
           Array(choice_chunk.delta.tool_calls).each do |tool_call|
@@ -667,6 +669,13 @@ module OpenAI
             @current_tool_call_index = tool_call.index
           end
 
+          if choice_snapshot.finish_reason &&
+              @current_tool_call_index &&
+              !@done_tool_calls.include?(@current_tool_call_index)
+            event = tool_done_event(tool_calls_by_index, @current_tool_call_index)
+            events << event if event
+          end
+
           events
         end
 

data/lib/openai/helpers/streaming/response_stream.rb

@@ -190,12 +190,7 @@ module OpenAI
         def accumulate_event(event:, current_snapshot:)
           if current_snapshot.nil?
             if event.is_a?(OpenAI::Models::Responses::ResponseCreatedEvent)
-              # Use the converter to create a new, isolated copy of the response object.
-              # This ensures proper type validation and prevents shared object references.
-              return OpenAI::Internal::Type::Converter.coerce(
-                OpenAI::Models::Responses::Response,
-                event.response
-              )
+              return isolated_value(event.response)
             end
 
             unless @resumed
@@ -212,12 +207,12 @@ module OpenAI
 
           case event
           when OpenAI::Models::Responses::ResponseOutputItemAddedEvent
-            current_snapshot.output.push(event.item)
+            current_snapshot.output.push(isolated_value(event.item))
 
           when OpenAI::Models::Responses::ResponseContentPartAddedEvent
             output = current_snapshot.output[event.output_index]
             if output && output.type == :message
-              output.content.push(event.part)
+              output.content.push(isolated_value(event.part))
               current_snapshot.output[event.output_index] = output
             end
 
@@ -248,6 +243,16 @@ module OpenAI
 
         private
 
+        # Materialize fresh containers before snapshot accumulation mutates them.
+        # Coercing an already-typed model returns it unchanged, so first use the
+        # model's recursive raw representation. Unknown union fallbacks stay raw.
+        def isolated_value(value)
+          raw = OpenAI::Internal::Type::BaseModel.recursively_to_h(value, convert: false)
+          return raw unless value.is_a?(OpenAI::Internal::Type::BaseModel)
+
+          OpenAI::Internal::Type::Converter.coerce(value.class, raw)
+        end
+
         def assert_type(object, expected_type)
           return if object && object.type == expected_type
           actual_type = object ? object.type : "nil"

data/lib/openai/helpers/structured_output/array_of.rb

@@ -24,10 +24,10 @@ module OpenAI
         # @return [Hash{Symbol=>Object}]
         def to_json_schema_inner(state:)
           OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.cache_def!(state, type: self) do
-            state.fetch(:path) << "[]"
+            new_state = {**state, path: [*state.fetch(:path), "[]"]}
             items = OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.to_json_schema_inner(
               item_type,
-              state: state
+              state: new_state
             )
             items = OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.to_nilable(items) if nilable?
             OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.assoc_meta!(items, meta: @meta)

data/lib/openai/helpers/structured_output/base_model.rb

@@ -32,13 +32,27 @@ module OpenAI
             OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.cache_def!(state, type: self) do
               path = state.fetch(:path)
               properties = field_values.to_h do |field|
-                api_name, type, nilable, meta = field.fetch_values(:api_name, :type, :nilable, :meta)
+                api_name, type, nilable, const, meta = field.fetch_values(:api_name, :type, :nilable, :const, :meta)
                 new_state = {**state, path: [*path, ".#{api_name}"]}
 
-                schema = OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.to_json_schema_inner(
-                  type,
-                  state: new_state
-                )
+                literal_const = case const
+                when Integer, TrueClass, FalseClass
+                  true
+                when Float
+                  const.finite?
+                else
+                  false
+                end
+
+                schema = if literal_const
+                  {const: const}
+                else
+                  OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.to_json_schema_inner(
+                    type,
+                    state: new_state
+                  )
+                end
+
                 schema = OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.to_nilable(schema) if nilable
                 OpenAI::Helpers::StructuredOutput::JsonSchemaConverter.assoc_meta!(
                   schema,

data/lib/openai/helpers/structured_output/chat_completion_parser.rb

@@ -67,7 +67,10 @@ module OpenAI
               }
             )
           in {
-              response_format: {type: :json_schema, json_schema: OpenAI::StructuredOutput::JsonSchemaConverter => model}
+              response_format: {
+                  type: :json_schema | "json_schema",
+                  json_schema: OpenAI::StructuredOutput::JsonSchemaConverter => model
+                }
             }
             parsed.fetch(:response_format).update(
               json_schema: {
@@ -78,7 +81,7 @@ module OpenAI
             )
           in {
               response_format: {
-                  type: :json_schema,
+                  type: :json_schema | "json_schema",
                   json_schema: {schema: OpenAI::StructuredOutput::JsonSchemaConverter => model}
                 }
             }
@@ -124,7 +127,7 @@ module OpenAI
           return [] if tools.nil?
 
           tools.map do |tool|
-            next tool unless tool[:type] == :function
+            next tool unless [:function, "function"].include?(tool[:type])
 
             function_name = tool.dig(:function, :name)
             model = tool_models[function_name]