openai 0.95.0 → 0.96.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1a4b5e8a0b4b3e964fa90dca65b45eabfe72a29b443df8dc76a4d0ee3858475
-  data.tar.gz: 21eee4b1f9cf93ed7516d7466b575f22a4d5191c5b5b03bf50e8dd6f61def78d
+  metadata.gz: 45b725bdf2e7a6b6837d634f0a91df36e77e4051d3a44019742cd9176ecf53ec
+  data.tar.gz: d42beb5a3f77a5cb8ef597fa8ce4bb80c6a5485252becedbd67ec4e65ef5f674
 SHA512:
-  metadata.gz: a2e5e8a2626d87a134c2ad59f52ea2efe95d7fa2eaafab90e06c67058e69a0f9fb7e9f5f291184200c5fbc8a0902db779f721936561171140511b0f9020986f6
-  data.tar.gz: a0577ce317a33dd4612720e60b26ec3d6cdc02f936270adad3b0c1e3509027338c441fdad4d733ac1aa4318266472cd9281212b0c4266c8fcfc3234b9e9cb551
+  metadata.gz: 9ac89793e8ba7b821b5d98dbff7b8bf366d6ab251c06fdc2f23422347de291443267343bb5fac7c4c17e4fee1e357873681fdbd761aa16db0d6d59cca7a85c1e
+  data.tar.gz: 284f3124b3d366c6bd1ab7bc9955ed29ce4e5a6da39e08320fcc575847b7bf95f0246208cdb06042c049ef3226c2e3bae6f8551aca343f724c5ced65532b456a

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## [0.96.0](https://github.com/openai/openai-ruby/compare/v0.95.0...v0.96.0) (2026-09-29)
+
+
+### Features
+
+* **api:** add Agents credential and session options ([#766](https://github.com/openai/openai-ruby/issues/766)) ([27acf38](https://github.com/openai/openai-ruby/commit/27acf382abf7e94c051d35ca3d48870064ff9d27))
+* **api:** add Cyber access programs to Responses ([#757](https://github.com/openai/openai-ruby/issues/757)) ([f484e4e](https://github.com/openai/openai-ruby/commit/f484e4ee112023c2aadc71f9af549e3adf130bc1))
+* **api:** add GPT-6.1 Sol model identifier ([#781](https://github.com/openai/openai-ruby/issues/781)) ([a97c14f](https://github.com/openai/openai-ruby/commit/a97c14f89620aaccda51d593b00e7c7a16507eb6))
+* **live:** add optional transcript grouping over typed events ([#769](https://github.com/openai/openai-ruby/issues/769)) ([d6f2548](https://github.com/openai/openai-ruby/commit/d6f254810754f6310ead16928069a929c8a1a675))
+* **live:** add sideband attachment and stored fork WebSockets ([#771](https://github.com/openai/openai-ruby/issues/771)) ([7c6cf76](https://github.com/openai/openai-ruby/commit/7c6cf76e5c381707a1c2c6b4c8a8f6e347ee2ddb))
+* **live:** support caller-started primary WebSockets ([#770](https://github.com/openai/openai-ruby/issues/770)) ([dc3566d](https://github.com/openai/openai-ruby/commit/dc3566ddd9bfff7dd47a0214d8596dc95207284d))
+* **realtime:** add bounded finish for Translation WebSocket consumers ([#778](https://github.com/openai/openai-ruby/issues/778)) ([a92b422](https://github.com/openai/openai-ruby/commit/a92b422402da28c0f96b9fbd4cd635ee693211c9))
+* **realtime:** add typed Translation WebSocket connection ([#772](https://github.com/openai/openai-ruby/issues/772)) ([b3706d8](https://github.com/openai/openai-ruby/commit/b3706d84fbb68e700bb726559fba0da0393de567))
+* **responses:** add opt-in WebSocket incremental output ([#768](https://github.com/openai/openai-ruby/issues/768)) ([e190303](https://github.com/openai/openai-ruby/commit/e1903035d709a6b8aa40c0049ea8305c63eccc61))
+* **responses:** allow bounded WebSocket messages before allocation ([#775](https://github.com/openai/openai-ruby/issues/775)) ([bef7b8b](https://github.com/openai/openai-ruby/commit/bef7b8bc66d5feb42e8342fc4b3ef708fde129c5))
+* **responses:** bound compressed WebSocket wire and decoded sizes ([#776](https://github.com/openai/openai-ruby/issues/776)) ([0cc6b15](https://github.com/openai/openai-ruby/commit/0cc6b15a6049b43145ea806b129e1708c8836800))
+
+
+### Bug Fixes
+
+* **websocket:** include default ports in proxy tunnels ([#780](https://github.com/openai/openai-ruby/issues/780)) ([c496e6b](https://github.com/openai/openai-ruby/commit/c496e6b301834ed5aea18ba09c514411eabf5776))
+
+
+### Chores
+
+* **api:** clarify approximate web search location defaults ([#755](https://github.com/openai/openai-ruby/issues/755)) ([f83af03](https://github.com/openai/openai-ruby/commit/f83af03a667a7045dde39d2a9ca328432e3d109b))
+* **api:** clarify documented API error responses ([#765](https://github.com/openai/openai-ruby/issues/765)) ([6f786c6](https://github.com/openai/openai-ruby/commit/6f786c6a752a0a2773ecf7c1b0b4490a94104c15))
+* **api:** clarify Realtime modality array definitions ([#756](https://github.com/openai/openai-ruby/issues/756)) ([9e18acf](https://github.com/openai/openai-ruby/commit/9e18acfc93ba6fbedaae37bb89956b1a4cc24b49))
+* **api:** correct fine-tuning bounds and Realtime response reference ([#752](https://github.com/openai/openai-ruby/issues/752)) ([4c1cd58](https://github.com/openai/openai-ruby/commit/4c1cd583ee2b79b0355fcc30f3b340c68dcfc337))
+* **api:** document batch error responses ([#760](https://github.com/openai/openai-ruby/issues/760)) ([38fec96](https://github.com/openai/openai-ruby/commit/38fec96d1c3bb77616e741e3c0d5d11b1f385b46))
+* **api:** document files and uploads error responses ([#759](https://github.com/openai/openai-ruby/issues/759)) ([6cdd7b1](https://github.com/openai/openai-ruby/commit/6cdd7b1785989cdaed5e81fb956cac2ccadd2361))
+* **api:** document fine-tuning and model errors ([#764](https://github.com/openai/openai-ruby/issues/764)) ([4b3b043](https://github.com/openai/openai-ruby/commit/4b3b043176413f6c70309290bf8f4129a8961c16))
+* **api:** document Responses not-found errors ([#758](https://github.com/openai/openai-ruby/issues/758)) ([1d556e2](https://github.com/openai/openai-ruby/commit/1d556e20aef0e30bd6990dda1b7d9059b1d0817e))
+* **api:** document stored chat completion errors ([#763](https://github.com/openai/openai-ruby/issues/763)) ([ddd1a68](https://github.com/openai/openai-ruby/commit/ddd1a68179ad1ec90af55f39f71310a59f92ddcf))
+* **deps-dev:** bump sorbet-runtime from 0.6.13499 to 0.6.13506 in the development-dependencies group ([#773](https://github.com/openai/openai-ruby/issues/773)) ([be9c528](https://github.com/openai/openai-ruby/commit/be9c5289d5d7eea7c71e78be640c192f81c6544d))
+* **deps:** bump ruby/setup-ruby from 1.324.0 to 1.326.0 ([#749](https://github.com/openai/openai-ruby/issues/749)) ([5aae05c](https://github.com/openai/openai-ruby/commit/5aae05c4b42f9d509bdf084282a7e33ef8758adc))
+* **deps:** bump ruby/setup-ruby from 1.326.0 to 1.327.0 ([#762](https://github.com/openai/openai-ruby/issues/762)) ([3921459](https://github.com/openai/openai-ruby/commit/39214594edf3c07ed2ce71c603946462735fa6ad))
+* **deps:** bump the codeql group with 2 updates ([#761](https://github.com/openai/openai-ruby/issues/761)) ([0185fa1](https://github.com/openai/openai-ruby/commit/0185fa1c637f1dbc9d3b3fa85c4c46a199702188))
+
+
+### Documentation
+
+* clarify collaborator-only pull request policy ([#750](https://github.com/openai/openai-ruby/issues/750)) ([c704778](https://github.com/openai/openai-ruby/commit/c7047782ff2ae38a859a08ef199e67a79c16b9fe))
+
 ## [0.95.0](https://github.com/openai/openai-ruby/compare/v0.94.0...v0.95.0) (2026-09-23)
 
 

data/README.md

@@ -15,7 +15,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "openai", "~> 0.95.0"
+gem "openai", "~> 0.96.0"
 ```
 
 <!-- x-release-please-end -->
@@ -1293,4 +1293,7 @@ This line will not receive separate maintenance.
 
 ## Contributing
 
-See [the contributing documentation](https://github.com/openai/openai-ruby/tree/main/CONTRIBUTING.md).
+Please share bug reports and feature requests through [GitHub issues](https://github.com/openai/openai-ruby/issues).
+Pull requests are limited to repository collaborators; we do not accept pull requests from non-collaborators.
+See [CONTRIBUTING.md](https://github.com/openai/openai-ruby/blob/main/CONTRIBUTING.md) for the contribution policy and development guide.
+For security vulnerabilities, follow [SECURITY.md](https://github.com/openai/openai-ruby/blob/main/SECURITY.md).

data/docs/architecture/security-model.md

@@ -162,7 +162,7 @@ Important boundaries:
   `lib/openai/internal/stream.rb:35-40`,
   `lib/openai/helpers/realtime/errors.rb:26-70`,
   `lib/openai/http_client.rb:46-79`,
-  `CONTRIBUTING.md:42-50`).
+  `CONTRIBUTING.md:61-69`).
 - Candidate PR code reaching sensitive live/release credentials or repository
   write/publishing authority is a genuine boundary
   (`.github/workflows/live-smoke.yml:17-92`,
@@ -268,7 +268,7 @@ The following are hypotheses and review guidance, not confirmed findings.
 | Medium | Malformed or adversarial API/SSE/WebSocket data causes sensitive leakage, type confusion, or availability failure | Victim consumes untrusted remote data | Data exposure, incorrect application behavior, or DoS | JSON parsing, typed coercion, protocol errors, safe unknown events | Keep parsers data-only, incremental where applicable, and redact errors/logs | `lib/openai/internal/stream.rb:21-60`, `lib/openai/helpers/realtime/connection.rb:61-84` |
 | Medium | Multipart filename, content type, or field name reaches headers without normalization | Caller-supplied path or header parameter crosses multipart serialization | Absolute local path disclosure or multipart header injection | Media-type validation, basename reduction for `FilePart` and raw path/IO values, quote/backslash escaping, CR/LF removal | Preserve basename and header-parameter controls before upload | `lib/openai/file_part.rb:33-43`, `lib/openai/file_part.rb:110-119`, `lib/openai/internal/util.rb:533-565` |
 | Medium | Forged webhook, or replay of a captured valid webhook, becomes an accepted typed event | For forgery, attacker lacks the webhook secret; for replay, attacker can resend a valid signed payload within the tolerance window | Application accepts an unauthentic or repeated event | Required headers, HMAC, and timing-safe comparison reject forgery; timestamp validation bounds replay age but does not deduplicate `webhook-id` | Verify before parsing; callers that need replay prevention must deduplicate `webhook-id` | `lib/openai/resources/webhooks.rb:15-119` |
-| Medium | Sensitive runtime or live-example data leaks through diagnostics, exceptions, retained metadata, or artifacts | Untrusted data reaches logger/error/object serialization or a live-example report | Credential, prompt, response, file, header, or call-identifier disclosure | Redacted headers/queries; unsafe body categories omitted; derived HTTP errors are bounded/sanitized when no top-level scalar or explicit message is supplied; top-level scalar and explicit SSE messages remain remote data; Realtime URL call-ID redaction; retained bodies omitted from inspect/YAML/Marshal; Examples E2E reports are allowlisted and tested for sensitive output | Preserve redaction, bounded derived errors, metadata serialization controls, and allowlisted artifacts; treat preserved remote messages as remote data | `lib/openai/internal/logging.rb:299-343`, `lib/openai/errors.rb:259-409`, `lib/openai/internal/stream.rb:35-40`, `lib/openai/helpers/realtime/errors.rb:26-70`, `lib/openai/http_client.rb:46-79`, `.github/workflows/examples-e2e.yml:29-43`, `test/scripts/examples_e2e_test.rb:202-234`, `test/scripts/examples_e2e_test.rb:306-327`, `CONTRIBUTING.md:42-50` |
+| Medium | Sensitive runtime or live-example data leaks through diagnostics, exceptions, retained metadata, or artifacts | Untrusted data reaches logger/error/object serialization or a live-example report | Credential, prompt, response, file, header, or call-identifier disclosure | Redacted headers/queries; unsafe body categories omitted; derived HTTP errors are bounded/sanitized when no top-level scalar or explicit message is supplied; top-level scalar and explicit SSE messages remain remote data; Realtime URL call-ID redaction; retained bodies omitted from inspect/YAML/Marshal; Examples E2E reports are allowlisted and tested for sensitive output | Preserve redaction, bounded derived errors, metadata serialization controls, and allowlisted artifacts; treat preserved remote messages as remote data | `lib/openai/internal/logging.rb:299-343`, `lib/openai/errors.rb:259-409`, `lib/openai/internal/stream.rb:35-40`, `lib/openai/helpers/realtime/errors.rb:26-70`, `lib/openai/http_client.rb:46-79`, `.github/workflows/examples-e2e.yml:29-43`, `test/scripts/examples_e2e_test.rb:202-234`, `test/scripts/examples_e2e_test.rb:306-327`, `CONTRIBUTING.md:61-69` |
 | Not a finding by itself | Contributor changes a tracked test/example/fixture/build script and ordinary CI runs it | Contributor already controls candidate checkout code | No new authority | Read-only ordinary CI without referenced secrets or write authority | Require a separate privilege or boundary violation before reporting | `.github/workflows/ci.yml:18-32`, `.github/workflows/ci-checks.yml:100-120` |
 
 ## 4. Severity Calibration

data/examples/audio/record_and_play.rb

@@ -14,6 +14,6 @@ VOICE = "marin"
 client = OpenAI::Client.new
 clip = OpenAI::LocalAudio.record(duration: 5, timeout: 10)
 transcription = client.audio.transcriptions.create(model: TRANSCRIPTION_MODEL, file: clip)
-puts(transcription.text)
+puts(transcription.is_a?(StringIO) ? transcription.read : transcription.text)
 speech = client.audio.speech.create(model: SPEECH_MODEL, voice: VOICE, input: "Recording complete.")
 OpenAI::LocalAudio.play(speech, timeout: 30)

data/lib/openai/helpers/live/transcript_grouper.rb

@@ -0,0 +1,264 @@
+# frozen_string_literal: true
+
+require_relative "../../../openai"
+
+module OpenAI
+  module Live
+    # Groups public Live transcript deltas into immutable display snapshots.
+    # This is a speaker/acknowledgment heuristic, not VAD or lossless history.
+    # Create one per session and close it on transport loss or teardown.
+    class TranscriptGrouper
+      # IDs belong to this local display projection, not server turns or items.
+      # Each update contains the complete text; replace the displayed text.
+      Segment = Data.define(:id, :previous_id, :speaker, :text, :start_ms, :end_ms)
+      ClosedSegment = Data.define(:segment, :reason)
+
+      # @api private
+      Options = Data.define(
+        :min_turn_separation_ms,
+        :assistant_silence_ms,
+        :backchannel_max_duration_ms,
+        :backchannel_isolation_ms,
+        :additional_acknowledgments
+      )
+      # @api private
+      Fragment = Data.define(:speaker, :text, :start_ms, :end_ms, :received_at)
+      # @api private
+      Update = Data.define(:segment, :reason)
+      private_constant :Options, :Fragment, :Update
+
+      # Timing values are milliseconds, between 0 and 2147483647.
+      # Set backchannel_max_duration_ms to zero to disable suppression.
+      # Callbacks are serialized outside the state lock and may reenter push/close.
+      # They run on the caller or the owned timer thread; exceptions propagate.
+      def initialize(
+        on_segment_updated: nil,
+        on_segment_closed: nil,
+        min_turn_separation_ms: 500,
+        assistant_silence_ms: 2000,
+        backchannel_max_duration_ms: 1000,
+        backchannel_isolation_ms: 2000,
+        additional_acknowledgments: []
+      )
+        timings = [min_turn_separation_ms, assistant_silence_ms, backchannel_max_duration_ms, backchannel_isolation_ms]
+        unless timings.all? { |value|
+            (value.is_a?(Integer) || value.is_a?(Float)) && value.between?(0, 2_147_483_647)
+          }
+          raise ArgumentError, "Timing must be between 0 and 2147483647 ms"
+        end
+
+        unless additional_acknowledgments.is_a?(Array) &&
+            additional_acknowledgments.all? { |value| value.is_a?(String) }
+          raise ArgumentError, "additional_acknowledgments must be an array of strings"
+        end
+
+        unless [on_segment_updated, on_segment_closed].all? { |value| value.nil? || value.respond_to?(:call) }
+          raise ArgumentError, "Transcript callbacks must respond to call"
+        end
+
+        options = Options.new(*timings, additional_acknowledgments)
+        @grouping = Grouping.new(options, "segment_#{SecureRandom.hex(8)}")
+        @on_segment_updated = on_segment_updated
+        @on_segment_closed = on_segment_closed
+        @lock = Mutex.new
+        @wake = ConditionVariable.new
+        @seen_ids = {}
+        @last_start_ms = {}
+        @pending = []
+        @updates = []
+        @closed = false
+        @dispatching = false
+      end
+
+      # Consume a typed Live event. Duplicate IDs, empty text and other events
+      # are ignored. Invalid transcript fields and use after close raise.
+      # Original events and their strings remain owned by the caller.
+      # @return [void]
+      def push(event)
+        should_drain = @lock.synchronize do
+          raise RuntimeError, "Cannot push events after closing the transcript grouper" if @closed
+
+          if event.is_a?(SessionClosedEvent)
+            enqueue(finish(:session_closed))
+          else
+            speaker = case event
+            when InputTranscriptDeltaEvent
+              :user
+            when OutputTranscriptDeltaEvent
+              :assistant
+            else
+              return
+            end
+
+            fragment = normalize(event, speaker)
+            return if @seen_ids.key?(event.event_id)
+
+            @seen_ids[event.event_id.dup.freeze] = true
+            return if fragment.text.empty?
+
+            emitted = []
+            first = @pending.first
+            if first && first.start_ms == fragment.start_ms && first.end_ms == fragment.end_ms
+              @pending << fragment
+              emitted.concat(flush_pending) if @pending.any? { |part| part.speaker != speaker }
+            else
+              emitted.concat(flush_pending)
+              if @grouping.speaker == speaker
+                emitted.concat(commit([fragment]))
+              else
+                @pending << fragment
+              end
+            end
+
+            start_timer
+            @wake.signal
+            enqueue(emitted)
+          end
+        end
+
+        drain if should_drain
+        nil
+      end
+
+      # Flush/finalize once and cancel the owned timer. Never closes a transport.
+      # A callback already running can finish after close returns.
+      # @return [void]
+      def close
+        should_drain = @lock.synchronize { enqueue(@closed ? [] : finish(:manual)) }
+        drain if should_drain
+        nil
+      end
+
+      private
+
+      def normalize(event, speaker)
+        unless event.event_id.is_a?(String) &&
+            !event.event_id.empty? &&
+            event.delta.is_a?(String) &&
+            event.start_ms.is_a?(Integer) &&
+            event.start_ms.between?(0, 9_007_199_254_740_991) &&
+            event.end_ms.is_a?(Integer) &&
+            event.end_ms.between?(event.start_ms, 9_007_199_254_740_991)
+          raise(
+            ArgumentError,
+            "Invalid Live transcript delta: expected an event ID, text and nonnegative timed interval"
+          )
+        end
+
+        Fragment.new(speaker, event.delta.dup.freeze, event.start_ms, event.end_ms, now_ms)
+      end
+
+      def finish(reason)
+        @closed = true
+        @wake.signal
+        emitted = flush_pending + @grouping.close(source_now, reason)
+        @seen_ids.clear
+        emitted
+      end
+
+      def commit(fragments)
+        first = fragments.first
+        return [] unless first
+
+        emitted = []
+        if fragments.any? { |part| @last_start_ms[part.speaker] && part.start_ms < @last_start_ms[part.speaker] }
+          emitted.concat(@grouping.close(source_now, :timestamp_reset))
+          @last_start_ms.clear
+          @anchor_source_ms = nil
+        end
+
+        fragments.each { |part| @last_start_ms[part.speaker] = part.start_ms }
+        @anchor_source_ms = [@anchor_source_ms || 0, *fragments.map(&:end_ms)].max
+        @anchor_received_at = fragments.map(&:received_at).max
+        emitted.concat(@grouping.process(fragments))
+      end
+
+      def flush_pending
+        pending = @pending
+        @pending = []
+        commit(pending)
+      end
+
+      def now_ms = Process.clock_gettime(Process::CLOCK_MONOTONIC, :float_millisecond)
+
+      def source_now
+        @anchor_source_ms ? @anchor_source_ms + [0, now_ms - @anchor_received_at].max : 0
+      end
+
+      def timer_delay
+        delay = if (first = @pending.first)
+          first.received_at + 50 - now_ms
+        elsif (deadline = @grouping.deadline)
+          deadline - source_now
+        end
+
+        @update_due_ms = if @grouping.update_pending?
+          @update_due_ms || (now_ms + 50)
+        end
+
+        [delay, @update_due_ms && (@update_due_ms - now_ms)].compact.min
+      end
+
+      def start_timer
+        return if @timer_thread&.alive?
+
+        @timer_thread = Thread.new { timer_loop }
+        @timer_thread.name = "openai-live-transcript"
+      end
+
+      def timer_loop
+        loop do
+          should_drain = @lock.synchronize do
+            loop do
+              return if @closed
+
+              delay = timer_delay
+              if delay && delay <= 0
+                break enqueue(flush_pending + @grouping.advance(source_now) + @grouping.flush_update)
+              end
+
+              @wake.wait(@lock, delay && (delay / 1000.0))
+            end
+          end
+
+          drain if should_drain
+        end
+      end
+
+      # Enqueue while holding the state lock so caller/timer transitions retain
+      # their order. One drain owns callback delivery, including reentrant work.
+      def enqueue(emitted)
+        @updates.concat(emitted)
+        return false if @dispatching || @updates.empty?
+
+        @dispatching = true
+      end
+
+      def drain
+        drained = false
+        loop do
+          update = @lock.synchronize do
+            if @updates.empty?
+              @dispatching = false
+              drained = true
+              return
+            end
+
+            @updates.shift
+          end
+
+          if update.reason
+            @on_segment_closed&.call(ClosedSegment.new(update.segment, update.reason))
+          else
+            @on_segment_updated&.call(update.segment)
+          end
+        end
+
+      ensure
+        @lock.synchronize { @dispatching = false } unless drained
+      end
+    end
+  end
+end
+
+require_relative "transcript_grouping"