openai 0.92.0 → 0.94.0

data/rbi/openai/models/beta/agents/environments/template_update_params.rbi

@@ -51,7 +51,9 @@ module OpenAI
             sig { returns(T.nilable(String)) }
             attr_accessor :name
 
-            # Network access for an OpenAI-hosted environment.
+            # Network access available after setup completes. Omit to preserve the current
+            # policy, or pass `null` to reset to disabled for GA requests or enabled for
+            # alpha/beta requests.
             sig { returns(T.nilable(OpenAI::Beta::Agents::Environments::TemplateUpdateParams::Network)) }
             attr_reader :network
 
@@ -60,7 +62,7 @@ module OpenAI
             }
             attr_writer :network
 
-            # Packages to install in an OpenAI-hosted environment.
+            # Packages installed before the runtime network policy applies.
             sig { returns(T.nilable(OpenAI::Beta::Agents::Environments::TemplateUpdateParams::Packages)) }
             attr_reader :packages
 
@@ -147,10 +149,12 @@ module OpenAI
               # A replacement human-readable display name, or `null` to clear the name.
               name: nil,
 
-              # Network access for an OpenAI-hosted environment.
+              # Network access available after setup completes. Omit to preserve the current
+              # policy, or pass `null` to reset to disabled for GA requests or enabled for
+              # alpha/beta requests.
               network: nil,
 
-              # Packages to install in an OpenAI-hosted environment.
+              # Packages installed before the runtime network policy applies.
               packages: nil,
 
               # Replacement plugin configuration installed for each new session.
@@ -213,7 +217,9 @@ module OpenAI
               sig { returns(T.nilable(T::Array[String])) }
               attr_accessor :allowed_domains
 
-              # Network access for an OpenAI-hosted environment.
+              # Network access available after setup completes. Omit to preserve the current
+              # policy, or pass `null` to reset to disabled for GA requests or enabled for
+              # alpha/beta requests.
               sig do
                 params(
 
@@ -254,7 +260,7 @@ module OpenAI
                 }
                 OrSymbol = T.type_alias { T.any(Symbol, String) }
 
-                # Allows unrestricted network access, matching an omitted network policy.
+                # Allows unrestricted network access.
                 ENABLED = T.let(
                   :enabled,
                   OpenAI::Beta::Agents::Environments::TemplateUpdateParams::Network::Access::TaggedSymbol
@@ -302,7 +308,7 @@ module OpenAI
               sig { returns(T.nilable(T::Array[String])) }
               attr_accessor :system_
 
-              # Packages to install in an OpenAI-hosted environment.
+              # Packages installed before the runtime network policy applies.
               sig do
                 params(
 

data/rbi/openai/models/beta/agents/session_create_params.rbi

@@ -47,7 +47,10 @@ module OpenAI
           sig { params(agent_id: String).void }
           attr_writer :agent_id
 
-          # Initial input submitted when creating a session.
+          # Initial input to submit when the session is created. A string is shorthand for a
+          # single user message. Required when `environment.type` is `none`, or when
+          # `stream` is `true` for an environment that is not `self_hosted`; optional for
+          # self-hosted and non-streaming execution environments.
           sig { returns(T.nilable(OpenAI::Beta::Agents::SessionCreateParams::Input::Variants)) }
           attr_accessor :input
 
@@ -96,7 +99,10 @@ module OpenAI
             # unchanged.
             agent_id: nil,
 
-            # Initial input submitted when creating a session.
+            # Initial input to submit when the session is created. A string is shorthand for a
+            # single user message. Required when `environment.type` is `none`, or when
+            # `stream` is `true` for an environment that is not `self_hosted`; optional for
+            # self-hosted and non-streaming execution environments.
             input: nil,
 
             # Up to 16 string key-value pairs, with keys up to 64 and values up to 512
@@ -150,14 +156,15 @@ module OpenAI
             sig { params(model: String).void }
             attr_writer :model
 
-            # Explicit configuration for creating and coordinating subagents.
+            # Configuration for creating and coordinating subagents.
             sig { returns(T.nilable(OpenAI::Beta::MultiAgentConfigParam)) }
             attr_reader :multi_agent
 
             sig { params(multi_agent: T.nilable(OpenAI::Beta::MultiAgentConfigParam::OrHash)).void }
             attr_writer :multi_agent
 
-            # Reasoning configuration for the agent.
+            # Configuration for model reasoning. Omit to keep the current settings; pass
+            # `null` to reset to the model's default effort.
             sig { returns(T.nilable(OpenAI::Beta::AgentReasoningParam)) }
             attr_reader :reasoning
 
@@ -233,10 +240,11 @@ module OpenAI
               # The model to use for the agent. The requested model name is preserved.
               model: nil,
 
-              # Explicit configuration for creating and coordinating subagents.
+              # Configuration for creating and coordinating subagents.
               multi_agent: nil,
 
-              # Reasoning configuration for the agent.
+              # Configuration for model reasoning. Omit to keep the current settings; pass
+              # `null` to reset to the model's default effort.
               reasoning: nil,
 
               # The service tier used for model requests.
@@ -309,7 +317,10 @@ module OpenAI
             end
           end
 
-          # Initial input submitted when creating a session.
+          # Initial input to submit when the session is created. A string is shorthand for a
+          # single user message. Required when `environment.type` is `none`, or when
+          # `stream` is `true` for an environment that is not `self_hosted`; optional for
+          # self-hosted and non-streaming execution environments.
           module Input
             extend OpenAI::Internal::Type::Union
 

data/rbi/openai/models/beta/agents/session_update_params.rbi

@@ -99,7 +99,7 @@ module OpenAI
             sig { params(reasoning: OpenAI::Beta::Agents::SessionUpdateParams::Agent::Reasoning::OrHash).void }
             attr_writer :reasoning
 
-            # The service tier used for model requests.
+            # Omit to keep the current tier. Null resets it to auto.
             sig { returns(T.nilable(OpenAI::Beta::Agents::SessionUpdateParams::Agent::ServiceTier::OrSymbol)) }
             attr_accessor :service_tier
 
@@ -123,7 +123,7 @@ module OpenAI
               # Reasoning settings to update. Omit to keep the current effort.
               reasoning: nil,
 
-              # The service tier used for model requests.
+              # Omit to keep the current tier. Null resets it to auto.
 
               service_tier: nil
             )
@@ -149,7 +149,7 @@ module OpenAI
                 )
               end
 
-              # The amount of reasoning effort the model should use.
+              # Omit to keep the current effort. Null selects the model's default effort.
               sig { returns(T.nilable(OpenAI::Beta::Agents::SessionUpdateParams::Agent::Reasoning::Effort::OrSymbol)) }
               attr_accessor :effort
 
@@ -163,7 +163,7 @@ module OpenAI
               end
               def self.new(
 
-                # The amount of reasoning effort the model should use.
+                # Omit to keep the current effort. Null selects the model's default effort.
 
                 effort: nil
               )
@@ -177,7 +177,7 @@ module OpenAI
               def to_hash
               end
 
-              # The amount of reasoning effort the model should use.
+              # Omit to keep the current effort. Null selects the model's default effort.
               module Effort
                 extend OpenAI::Internal::Type::Enum
 
@@ -210,7 +210,7 @@ module OpenAI
               end
             end
 
-            # The service tier used for model requests.
+            # Omit to keep the current tier. Null resets it to auto.
             module ServiceTier
               extend OpenAI::Internal::Type::Enum
 

data/rbi/openai/models/beta/agents/sessions/turn.rbi

@@ -36,7 +36,7 @@ module OpenAI
             sig { returns(Integer) }
             attr_accessor :created_at
 
-            # A customer-safe error describing why a session request failed.
+            # A customer-safe error. Non-null only for a failed turn.
             sig { returns(T.nilable(OpenAI::Beta::SessionTurnError)) }
             attr_reader :error
 
@@ -63,7 +63,8 @@ module OpenAI
             sig { returns(T.nilable(String)) }
             attr_accessor :subagent_id
 
-            # Recorded token usage for a session or turn. Usage is best effort and may change.
+            # Best-effort token usage for the turn, or null if unknown. Recorded usage may
+            # change.
             sig { returns(T.nilable(OpenAI::Beta::TokenUsage)) }
             attr_reader :usage
 
@@ -114,7 +115,7 @@ module OpenAI
               # subagent opening time when the preceding timestamps are unavailable.
               created_at:,
 
-              # A customer-safe error describing why a session request failed.
+              # A customer-safe error. Non-null only for a failed turn.
               error:,
 
               # The ID of the session that owns the turn.
@@ -129,7 +130,8 @@ module OpenAI
               # The ID of the subagent that ran the turn, if applicable.
               subagent_id:,
 
-              # Recorded token usage for a session or turn. Usage is best effort and may change.
+              # Best-effort token usage for the turn, or null if unknown. Recorded usage may
+              # change.
               usage:,
 
               # The object type. Always `agent.session.turn`.

data/rbi/openai/models/beta/agents/vault.rbi

@@ -37,8 +37,7 @@ module OpenAI
           sig { returns(Symbol) }
           attr_accessor :object
 
-          # A collection of credentials that agent tools can use to authenticate to MCP
-          # servers.
+          # A collection of credentials for MCP servers and OpenAI-hosted environments.
           sig do
             params(
 

data/rbi/openai/models/beta/agents/vaults/credential.rbi

@@ -22,7 +22,7 @@ module OpenAI
             sig { returns(String) }
             attr_accessor :id
 
-            # The authentication method and non-secret configuration for the MCP server.
+            # The authentication method and non-secret configuration of the credential.
             sig { returns(OpenAI::Beta::Agents::Vaults::CredentialAuth::Variants) }
             attr_accessor :auth
 
@@ -46,7 +46,7 @@ module OpenAI
             sig { returns(String) }
             attr_accessor :vault_id
 
-            # Metadata for a stored MCP server credential. Secret values are never returned.
+            # Metadata for a stored credential. Secret values are never returned.
             sig do
               params(
 
@@ -54,7 +54,8 @@ module OpenAI
 
                 auth: T.any(
                   OpenAI::Beta::Agents::Vaults::CredentialAuth::McpOauth::OrHash,
-                  OpenAI::Beta::Agents::Vaults::CredentialAuth::StaticBearer::OrHash
+                  OpenAI::Beta::Agents::Vaults::CredentialAuth::StaticBearer::OrHash,
+                  OpenAI::Beta::Agents::Vaults::CredentialAuth::EnvironmentVariable::OrHash
                 ),
 
                 created_at: Integer,
@@ -74,7 +75,7 @@ module OpenAI
               # The ID of the credential.
               id:,
 
-              # The authentication method and non-secret configuration for the MCP server.
+              # The authentication method and non-secret configuration of the credential.
               auth:,
 
               # The Unix timestamp, in seconds, when the credential was created.

data/rbi/openai/models/beta/agents/vaults/credential_auth.rbi

@@ -9,15 +9,15 @@ module OpenAI
 
         module Vaults
 
-          # The MCP server and authentication configuration of a vault credential, excluding
-          # secrets.
+          # The authentication configuration of a vault credential, excluding secrets.
           module CredentialAuth
             extend OpenAI::Internal::Type::Union
 
             Variants = T.type_alias do
               T.any(
                 OpenAI::Beta::Agents::Vaults::CredentialAuth::McpOauth,
-                OpenAI::Beta::Agents::Vaults::CredentialAuth::StaticBearer
+                OpenAI::Beta::Agents::Vaults::CredentialAuth::StaticBearer,
+                OpenAI::Beta::Agents::Vaults::CredentialAuth::EnvironmentVariable
               )
             end
 
@@ -37,8 +37,7 @@ module OpenAI
               sig { returns(String) }
               attr_accessor :mcp_server_url
 
-              # Configuration used to refresh an MCP OAuth access token, excluding secret
-              # values.
+              # Public refresh metadata without refresh tokens or OAuth client secrets.
               sig { returns(T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuth::McpOauth::Refresh)) }
               attr_reader :refresh
 
@@ -74,8 +73,7 @@ module OpenAI
                 # The HTTPS MCP server URL authorized by this credential.
                 mcp_server_url:,
 
-                # Configuration used to refresh an MCP OAuth access token, excluding secret
-                # values.
+                # Public refresh metadata without refresh tokens or OAuth client secrets.
                 refresh:,
 
                 # The type of the object. Always `mcp_oauth`.
@@ -126,8 +124,7 @@ module OpenAI
                 sig { returns(OpenAI::Beta::Agents::Vaults::McpOauthTokenEndpointAuth::Variants) }
                 attr_accessor :token_endpoint_auth
 
-                # Configuration used to refresh an MCP OAuth access token, excluding secret
-                # values.
+                # Public refresh metadata without refresh tokens or OAuth client secrets.
                 sig do
                   params(
 
@@ -232,6 +229,74 @@ module OpenAI
 
             end
 
+            class EnvironmentVariable < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuth::EnvironmentVariable,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The destinations where the proxy can substitute the secret, subject to the
+              # environment network policy.
+              sig { returns(OpenAI::Beta::Agents::Vaults::CredentialNetworking::Variants) }
+              attr_accessor :networking
+
+              # The environment variable name that receives the placeholder in the sandbox.
+              sig { returns(String) }
+              attr_accessor :secret_name
+
+              # The type of the object. Always `environment_variable`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # Metadata for an HTTP credential used only in OpenAI-hosted environments. Sandbox
+              # code receives a placeholder. The proxy substitutes the secret for allowed HTTPS
+              # destinations on ports 443 and 8443. The real secret is not available to sandbox
+              # code for local computation and is never returned in this resource.
+              sig do
+                params(
+
+                  networking: T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworking::Unrestricted::OrHash,
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworking::Limited::OrHash
+                  ),
+
+                  secret_name: String,
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # The destinations where the proxy can substitute the secret, subject to the
+                # environment network policy.
+                networking:,
+
+                # The environment variable name that receives the placeholder in the sandbox.
+                secret_name:,
+
+                # The type of the object. Always `environment_variable`.
+
+                type: :environment_variable
+              )
+              end
+
+              sig do
+                override.returns(
+                  {
+                    networking: OpenAI::Beta::Agents::Vaults::CredentialNetworking::Variants,
+                    secret_name: String,
+                    type: Symbol
+                  }
+                )
+              end
+              def to_hash
+              end
+
+            end
+
             sig { override.returns(T::Array[OpenAI::Beta::Agents::Vaults::CredentialAuth::Variants]) }
             def self.variants
             end

data/rbi/openai/models/beta/agents/vaults/credential_auth_create_param.rbi

@@ -9,14 +9,15 @@ module OpenAI
 
         module Vaults
 
-          # Authentication credentials for an MCP server used by agent tools.
+          # Authentication credentials for an MCP server or an OpenAI-hosted environment.
           module CredentialAuthCreateParam
             extend OpenAI::Internal::Type::Union
 
             Variants = T.type_alias do
               T.any(
                 OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth,
-                OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer
+                OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::StaticBearer,
+                OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::EnvironmentVariable
               )
             end
 
@@ -44,7 +45,7 @@ module OpenAI
               sig { returns(T.nilable(String)) }
               attr_accessor :expires_at
 
-              # Configuration for refreshing the access token of an MCP OAuth credential.
+              # Optional refresh configuration for an HTTPS OAuth token endpoint.
               sig { returns(T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::McpOauth::Refresh)) }
               attr_reader :refresh
 
@@ -83,7 +84,7 @@ module OpenAI
                 # When the OAuth access token expires, as an RFC 3339 timestamp, if known.
                 expires_at: nil,
 
-                # Configuration for refreshing the access token of an MCP OAuth credential.
+                # Optional refresh configuration for an HTTPS OAuth token endpoint.
                 refresh: nil,
 
                 # The type of the object. Always `mcp_oauth`.
@@ -149,7 +150,7 @@ module OpenAI
                 sig { returns(T.nilable(String)) }
                 attr_accessor :scope
 
-                # Configuration for refreshing the access token of an MCP OAuth credential.
+                # Optional refresh configuration for an HTTPS OAuth token endpoint.
                 sig do
                   params(
 
@@ -277,6 +278,106 @@ module OpenAI
 
             end
 
+            class EnvironmentVariable < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::EnvironmentVariable,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The destinations where the proxy can substitute this secret. The environment
+              # network policy must also allow them.
+              sig {
+                returns(
+                  T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Unrestricted,
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Limited
+                  )
+                )
+              }
+              attr_accessor :networking
+
+              # The environment variable name that receives the placeholder, such as
+              # `SERVICE_API_KEY`. Use ASCII letters, digits, and underscores, starting with a
+              # letter or underscore. Names starting with `CODEX_` and managed proxy or
+              # certificate variable names are reserved.
+              sig { returns(String) }
+              attr_accessor :secret_name
+
+              # The write-only secret to store. Never returned in credential resources or
+              # supplied directly to sandbox code. Must be nonempty and must not contain
+              # carriage returns, newlines, or NUL bytes.
+              sig { returns(String) }
+              attr_accessor :secret_value
+
+              # The type of the object. Always `environment_variable`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # An HTTP credential for OpenAI-hosted environments only. The sandbox receives an
+              # environment variable containing a placeholder, not the secret. Use the
+              # placeholder unchanged in outgoing requests. The egress proxy replaces the
+              # placeholder with the secret for allowed HTTPS destinations on ports 443 and
+              # 8443. Sandbox code cannot read the real secret or use it for local computation,
+              # such as signing a request.
+              sig do
+                params(
+
+                  networking: T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Unrestricted::OrHash,
+                    OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Limited::OrHash
+                  ),
+
+                  secret_name: String,
+
+                  secret_value: String,
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # The destinations where the proxy can substitute this secret. The environment
+                # network policy must also allow them.
+                networking:,
+
+                # The environment variable name that receives the placeholder, such as
+                # `SERVICE_API_KEY`. Use ASCII letters, digits, and underscores, starting with a
+                # letter or underscore. Names starting with `CODEX_` and managed proxy or
+                # certificate variable names are reserved.
+                secret_name:,
+
+                # The write-only secret to store. Never returned in credential resources or
+                # supplied directly to sandbox code. Must be nonempty and must not contain
+                # carriage returns, newlines, or NUL bytes.
+                secret_value:,
+
+                # The type of the object. Always `environment_variable`.
+
+                type: :environment_variable
+              )
+              end
+
+              sig do
+                override.returns(
+                  {
+                    networking: T.any(
+                      OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Unrestricted,
+                      OpenAI::Beta::Agents::Vaults::CredentialNetworkingParam::Limited
+                    ),
+                    secret_name: String,
+                    secret_value: String,
+                    type: Symbol
+                  }
+                )
+              end
+              def to_hash
+              end
+
+            end
+
             sig { override.returns(T::Array[OpenAI::Beta::Agents::Vaults::CredentialAuthCreateParam::Variants]) }
             def self.variants
             end

data/rbi/openai/models/beta/agents/vaults/credential_auth_rotate_param.rbi

@@ -9,15 +9,16 @@ module OpenAI
 
         module Vaults
 
-          # Updates to a vault credential without changing its authentication method or MCP
-          # server.
+          # Updates to a vault credential without changing its authentication method or
+          # destination configuration.
           module CredentialAuthRotateParam
             extend OpenAI::Internal::Type::Union
 
             Variants = T.type_alias do
               T.any(
                 OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth,
-                OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer
+                OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer,
+                OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable
               )
             end
 
@@ -43,7 +44,7 @@ module OpenAI
               sig { returns(T.nilable(String)) }
               attr_accessor :expires_at
 
-              # Updates to an MCP credential's existing OAuth refresh configuration.
+              # Optional write-only refresh-token and client-secret updates.
               sig { returns(T.nilable(OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::Refresh)) }
               attr_reader :refresh
 
@@ -79,7 +80,7 @@ module OpenAI
                 # case the expiry is cleared.
                 expires_at: nil,
 
-                # Updates to an MCP credential's existing OAuth refresh configuration.
+                # Optional write-only refresh-token and client-secret updates.
                 refresh: nil,
 
                 # The type of the object. Always `mcp_oauth`.
@@ -119,8 +120,7 @@ module OpenAI
                 sig { returns(T.nilable(String)) }
                 attr_accessor :scope
 
-                # Client-secret updates that preserve the credential's OAuth authentication
-                # method.
+                # Client-secret updates for the existing token endpoint authentication method.
                 sig {
                   returns(
                     T.nilable(
@@ -133,7 +133,7 @@ module OpenAI
                 }
                 attr_accessor :token_endpoint_auth
 
-                # Updates to an MCP credential's existing OAuth refresh configuration.
+                # Optional write-only refresh-token and client-secret updates.
                 sig do
                   params(
 
@@ -160,8 +160,7 @@ module OpenAI
                   # scopes, or pass `null` to stop sending a scope parameter.
                   scope: nil,
 
-                  # Client-secret updates that preserve the credential's OAuth authentication
-                  # method.
+                  # Client-secret updates for the existing token endpoint authentication method.
 
                   token_endpoint_auth: nil
                 )
@@ -236,6 +235,58 @@ module OpenAI
 
             end
 
+            class EnvironmentVariable < OpenAI::Internal::Type::BaseModel
+              OrHash = T.type_alias do
+                T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable,
+                  OpenAI::Internal::AnyHash
+                )
+              end
+
+              # The write-only replacement secret. Never returned in credential resources or
+              # supplied directly to sandbox code. Must be nonempty and must not contain
+              # carriage returns, newlines, or NUL bytes.
+              sig { returns(String) }
+              attr_accessor :secret_value
+
+              # The type of the object. Always `environment_variable`.
+              sig { returns(Symbol) }
+              attr_accessor :type
+
+              # Replace the secret for an OpenAI-hosted environment credential. The environment
+              # variable name and networking configuration remain unchanged.
+              sig do
+                params(
+
+                  secret_value: String,
+
+                  type: Symbol
+                )
+                  .returns(T.attached_class)
+              end
+              def self.new(
+
+                # The write-only replacement secret. Never returned in credential resources or
+                # supplied directly to sandbox code. Must be nonempty and must not contain
+                # carriage returns, newlines, or NUL bytes.
+                secret_value:,
+
+                # The type of the object. Always `environment_variable`.
+
+                type: :environment_variable
+              )
+              end
+
+              sig do
+                override.returns(
+                  {secret_value: String, type: Symbol}
+                )
+              end
+              def to_hash
+              end
+
+            end
+
             sig { override.returns(T::Array[OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::Variants]) }
             def self.variants
             end