openai 0.90.0 → 0.91.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed1195dfde86772df82a57968852233c3a37680a78766331eda4daca5961a74c
-  data.tar.gz: be58d94437e2b61b07576d3dac3769897ac72dffdfffbe6895e2fe0b13fcd345
+  metadata.gz: 5a61cd08e625c8aba5c20a9b541efa3deed121cf8ffdd5fb297e4326de359fc7
+  data.tar.gz: 64bf26a74023158218b6b64e113231a3dffece2b104ea7c8802ca774bb092173
 SHA512:
-  metadata.gz: 3b363e344db928b8523e320c1f623a6d6f479c62806031eb362eff88ac3322760e794ad0993e19a5bc65fdc95d7f5bc97d9ff4592e8a8b1b19edac07f1a1e03f
-  data.tar.gz: 9544d48b551ba4e9928025e0bec07c57fa35b5ce3c8f2afb7f1fad7d1700cb40576ff896bc65c05b90cd55ac2fd2edb491cd42d24d119bf07326bb85d2913b1f
+  metadata.gz: 37ae5e3821eaa44ddccf1727c913aa6551dd1d3a432e7b3be44ba98b8fa2497e5c87b9a0ac58ef44c3e1a3f338e3dff6d5e1f81ee86ef1a0f035b8c0152c5806
+  data.tar.gz: 5162f83225a3a33fe9e7937cf43294f4bfc141963e52ba2d886dd6a642dc16d76dbd43235faf5157bfaa9bb3aed556836b44215649d05178127142bf9a2f80ed

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.91.0](https://github.com/openai/openai-ruby/compare/v0.90.0...v0.91.0) (2026-09-18)
+
+
+### Features
+
+* **api:** add agent session model settings ([#708](https://github.com/openai/openai-ruby/issues/708)) ([244a98e](https://github.com/openai/openai-ruby/commit/244a98e6e2eba0aa30f094116249e84433d8794d))
+* **api:** add audio-mini model choices ([#710](https://github.com/openai/openai-ruby/issues/710)) ([3cdfe3f](https://github.com/openai/openai-ruby/commit/3cdfe3f275eb0c3678803b1037b64271ace69135))
+* **api:** add compaction progress events ([#706](https://github.com/openai/openai-ruby/issues/706)) ([47e2dc7](https://github.com/openai/openai-ruby/commit/47e2dc7e8cd22c1d949cfaeae32531d7dd23f9b5))
+* **api:** add managed Responses WebSocket sessions ([#711](https://github.com/openai/openai-ruby/issues/711)) ([a619653](https://github.com/openai/openai-ruby/commit/a61965302b90800fbdb2b888a0a666695cfbf825))
+* **api:** add prompt-cache prewarming ([#712](https://github.com/openai/openai-ruby/issues/712)) ([61b5692](https://github.com/openai/openai-ruby/commit/61b56920641a4b241ded57b289b587b5698db55a))
+
+
+### Chores
+
+* **api:** clarify incoming SIP call ID usage ([#709](https://github.com/openai/openai-ruby/issues/709)) ([cedfada](https://github.com/openai/openai-ruby/commit/cedfada1f4bbdd4e106c84b6564c03271d5bf133))
+* **deps-dev:** bump sorbet-runtime from 0.6.13455 to 0.6.13486 in the development-dependencies group ([#698](https://github.com/openai/openai-ruby/issues/698)) ([ef1dc85](https://github.com/openai/openai-ruby/commit/ef1dc859af816214dbd244a2da431e64193ac6e1))
+* **deps:** bump ruby/setup-ruby from 1.321.0 to 1.322.0 ([#700](https://github.com/openai/openai-ruby/issues/700)) ([5bdc477](https://github.com/openai/openai-ruby/commit/5bdc477abc7e9e040debca40dd14e530b1c80ff1))
+* **deps:** bump ruby/setup-ruby from 1.322.0 to 1.323.0 ([#707](https://github.com/openai/openai-ruby/issues/707)) ([460148c](https://github.com/openai/openai-ruby/commit/460148cd775fc588d1b20ccd6a4ef35f9985ad10))
+
 ## [0.90.0](https://github.com/openai/openai-ruby/compare/v0.89.0...v0.90.0) (2026-09-10)
 
 

data/README.md

@@ -15,7 +15,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "openai", "~> 0.90.0"
+gem "openai", "~> 0.91.0"
 ```
 
 <!-- x-release-please-end -->

data/examples/realtime/README.md

@@ -10,6 +10,8 @@ This directory contains runnable examples for the Realtime WebSocket surface:
 - `websocket_voice_turn.rb` uploads one raw 24 kHz mono PCM16 turn, explicitly
   commits it, streams the assistant's PCM response to standard output, returns
   its transcript to embedded callers, verifies a completed response, and exits.
+- [`sip_webhook.rb`](SIP.md) verifies signed SIP incoming calls, applies a fixed
+  tenant/admission policy, deduplicates attempts, and owns accepted-call cleanup.
 - `sideband.rb` attaches to an existing, application-authorized WebRTC or SIP
   call, updates its session policy, verifies the typed update event, and exits.
 - `function_calling.rb` forces one local function call, validates and executes
@@ -218,3 +220,9 @@ require a separately reviewed concurrency and device-lifecycle boundary.
 
 See the repository's [Realtime WebSocket guide](../../realtime.md) for the
 public connection API, custom transports, proxy behavior, and TLS setup.
+
+## Native browser reference workflows
+
+See [browser/README.md](browser/README.md) for the runnable short-lived-secret
+and backend-owned SDP workflows, local application authentication, native
+browser Start/Stop, optional trusted sideband, and failed-handoff cleanup.

data/examples/realtime/browser/README.md

@@ -0,0 +1,167 @@
+# Native browser peers with a Ruby signaling application
+
+Two **ordinary Realtime API** examples share a small, single-operator local app:
+
+1. `/direct`: Ruby issues a short-lived client secret. The browser sends its
+   native SDP directly to OpenAI and owns the peer lifetime.
+2. `/backend`: Ruby forwards the browser's opaque SDP to the shipped
+   `client.realtime.calls.create`. Ruby retains the known call, returns the
+   answer, optionally confirms trusted sideband policy, and explicitly hangs up.
+
+These do not use the distinct [Live API example](../../live/webrtc.rb).
+`RTCPeerConnection`, `getUserMedia`, browser data channels and browser audio own
+all negotiation, ICE, DTLS, RTP, codecs, echo cancellation and device permissions.
+Ruby implements only application authentication, signaling and call ownership.
+
+## Run
+
+Use Ruby 3.3+, the repository's installed dependencies (`./scripts/bootstrap`),
+and a separately installed WEBrick. WEBrick is an example server, not a gem
+runtime dependency. No JavaScript package installation or build is needed.
+
+```sh
+gem install webrick -v '~> 1.9'
+# Supply OPENAI_API_KEY through your environment/secret manager.
+export BROWSER_APP_TOKEN="$(ruby -rsecurerandom -e 'puts SecureRandom.hex(32)')"
+ruby examples/realtime/browser/server.rb
+```
+
+Open `http://127.0.0.1:9292/direct` or `http://127.0.0.1:9292/backend` in a browser
+with microphone and native WebRTC support. Paste **BROWSER_APP_TOKEN**, not the
+OpenAI key, into the password field. Start, allow the microphone, wait for
+`Connected`, and speak. Stop releases microphone tracks, remote tracks, the data
+channel, peer and audio element. Stop works even during a permission prompt;
+if permission later resolves, those new tracks are immediately stopped.
+Start stays disabled through backend cleanup acknowledgment and a subsequent
+five-second creation cooldown. If cleanup fails, Start remains disabled; reload
+only after confirming that the backend released the call. This example does not
+poll for readiness or automatically retry startup.
+
+The app uses the standard OpenAI endpoint and requires project access to
+`gpt-realtime-2.1` (or `OPENAI_REALTIME_MODEL`). Real requests incur API usage.
+`PORT` defaults to 9292. Use the exact numeric loopback URL, not `localhost`.
+Browsers allow microphone capture on loopback; remote deployment requires HTTPS.
+Autoplay may require using the audio controls. Permission and local offer
+preparation have a 30-second deadline. Signaling and peer establishment then have
+a separate 60-second deadline: up to 15 seconds for creation, 15 for optional
+sideband setup, 20 for the server handoff lease, plus delivery time. The server
+lease still expires 20 seconds after answer preparation if no acknowledgment
+arrives; the longer browser deadline does not extend it.
+
+For the backend's optional existing Ruby sideband example, install
+`async-websocket` and launch with `BROWSER_SIDEBAND=1`. Before handing back the
+answer, it waits (up to 15 seconds) for a typed `session.updated` acknowledging
+its policy. It closes the control socket after the acknowledgement; closing a
+sideband alone does not hang up a call. Tools are empty here. Real tool execution
+must independently authorize every operation against the authenticated user.
+
+## Authentication and authorization boundary
+
+This is a loopback-only, single-operator example, not a multi-user hosted service.
+The random application bearer token grants this operator permission to spend
+this project's Realtime quota and control this app's single backend call.
+Static assets are public on loopback. Every API operation requires the token
+and an exact Origin; every request requires the exact Host. Cross-origin
+preflights are rejected. There are no ambient authentication cookies: the
+explicit bearer header plus Origin check provides the CSRF boundary. Responses
+use `no-store`, a restrictive CSP, no-referrer and same-origin resource policy.
+The application token stays in page memory; no credentials enter URLs or web
+storage. The standard API key stays on Ruby's backend.
+
+The app limits creation/issuance to one request per five seconds and one known
+backend call at a time. It supplies a trusted `OpenAI-Safety-Identifier` derived
+from the operator token. For a deployed application, replace this local auth
+with your existing login and user entitlements, use a stable pseudonymous user
+identifier, add per-user quotas, HTTPS and shared durable call ownership. Never
+accept a browser-supplied OpenAI call ID as proof of ownership.
+
+The direct secret expires after 30 seconds, **not** the resulting session.
+Secrets can establish multiple sessions before expiration and clients can
+change session configuration. They are delegated capabilities, not immutable
+policy or single-use grants. A failed token response allocates no backend call;
+the unused secret expires. Ruby cannot revoke that secret through an invented
+endpoint. Closing a browser peer is best effort remote termination; if a direct
+SDP request is accepted but its response is lost, Ruby has no known call to
+reconcile. Choose backend ownership when explicit server hangup is needed.
+
+## Backend ownership and failure handling
+
+The shipped SDK owns a known allocation during creation-response buffering and
+already cleans up failed delivery to Ruby. This app does not replace that code.
+Once `calls.create` returns, the app validates Location against the fixed OpenAI
+origin and call path, records the call immediately, and then consumes the answer.
+It never returns the call ID to the browser.
+
+The browser supplies a random **application operation ID** before allocation;
+Stop can therefore request cleanup even if the answer response is lost. Stopped
+operation IDs are retained in memory until process exit, so a Stop that overtakes
+its create prevents that later allocation. This single-operator example is
+intended for bounded local runs; a deployed service needs durable operation
+records and a retention policy tied to a defined request-expiry contract. The
+app remains the owner after successful HTTP delivery. It requires `/api/ack`
+after native remote-description application, peer connection and channel open.
+A 20-second handoff lease is refreshed after answer preparation and optional
+sideband setup, before delivery, and expires without that acknowledgement. An acknowledged
+call has a 60-second lease, renewed by the browser every ten seconds. A paused
+background tab can lose its lease and must Start again. Expired leases cannot
+be revived. Page exit sends best effort Stop; the timer covers lost requests.
+
+Answer-write failures, sideband failures and explicit Stop immediately attempt
+hangup. Each cleanup attempt has a five-second deadline and no SDK retry. A
+failed attempt retains ownership, blocks new allocations, and is retried by the
+application timer after five seconds. Never retry uncertain creation requests.
+INT/TERM drains HTTP work and attempts one final bounded cleanup.
+
+This small in-memory example cannot recover registry state after SIGKILL or a
+machine crash. A missing/invalid Location causes a sanitized 502 and **cannot be
+reclaimed without an identifiable allocation**. Neither case is claimed as
+reliable cleanup; a production deployment needs a platform-approved durable
+reconciliation/TTL contract. HTTP success does not prove browser handoff, and
+best effort hangup does not guarantee remote termination during an outage.
+
+## Stable launch and verification contract
+
+A protected live harness can launch this exact server with the environment above,
+plus `BROWSER_SIDEBAND=1 BROWSER_MANUAL_TURNS=1`. Manual-turn mode configures
+`audio.input.turn_detection: null` **before** media attaches; the harness must
+explicitly commit audio/create a response on the native data channel. All modes
+start with `max_output_tokens: 128`. Do not log credentials, SDP, audio or events.
+
+The UI has `#token`, `#start`, `#stop`, `#status` and an `audio` element. For more
+precise harness control, import `/peer.js` and construct
+`new BrowserPeer({mode: 'backend', audio, status})`. `await peer.start(token)`
+finishes startup; success requires status `Connected` (failure is handled and
+reported through status). Failed startup waits for its bounded backend cleanup
+attempt. Autoplay denial leaves `Connected` intact; playback help appears beside
+the audio controls. `peer.current.pc` and `.dc` are the native browser
+objects. Attach event observers without replacing its lifecycle handlers.
+`await peer.stop()` returns `true` only after the backend acknowledges cleanup,
+`false` on failed cleanup. Repeated Stop calls share the retained cleanup promise
+and result, including when an event callback initiated cleanup. A new run clears
+that result; a run stopped before backend submission or a direct peer has no
+server acknowledgment.
+Local media stops immediately. The cleanup request can wait up to 40 seconds for
+serialized creation and sideband setup (up to 30 seconds), hangup (five seconds),
+and delivery. Failed startup can wait this additional cleanup interval before
+settling. Expired requests remain best effort; server leases and retries still
+cover unsuccessful delivery.
+The cleanup result does not include the subsequent five-second restart cooldown;
+wait until `peer.stopping` is false before starting another run. Failed cleanup
+keeps that flag set until reload and displays the recovery guidance above.
+Server diagnostics include only fixed lifecycle metadata, including
+`[browser] call released` and the existing sideband success marker. The harness
+must require successful cleanup and stop the server after its bounded run.
+
+Offline tests (Node 22.7+ for the browser-controller tests):
+
+```sh
+bundle exec ruby test/openai/realtime/browser/server_test.rb
+node --test test/openai/realtime/browser/peer_test.mjs
+```
+
+The required Ruby CI test job also runs the controller suite. The controller
+tests simulate browser boundaries; they are not evidence of a
+real ICE/media exchange. Ruby tests exercise real SDK serialization with fake
+HTTP responses. Live API/audio evidence must be reported separately by the
+protected harness; do not equate a rendered page or fake SDP test with a paid
+end-to-end call.

data/examples/realtime/browser/index.html

@@ -0,0 +1,19 @@
+<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Ruby Realtime browser reference</title></head>
+<body>
+  <h1>Ruby Realtime browser reference</h1>
+  <nav><a href="/direct">Browser-owned</a> | <a href="/backend">Backend-owned</a></nav>
+  <h2 id="mode"></h2>
+  <p>Ordinary Realtime API. Your browser owns the microphone, media and peer connection.</p>
+  <p>Paste the local application's BROWSER_APP_TOKEN. Never paste your OpenAI API key.</p>
+  <label>Application token <input id="token" type="password" autocomplete="off" spellcheck="false"></label>
+  <button id="start" type="button">Start</button>
+  <button id="stop" type="button" disabled>Stop</button>
+  <p id="status" role="status">Stopped</p>
+  <p>Allow microphone access, then speak after Connected. Stop releases microphone and peer resources.</p>
+  <p>If audio does not play automatically, use the Play control below.</p>
+  <audio controls autoplay></audio>
+  <script type="module" src="/page.js"></script>
+</body>
+</html>

data/examples/realtime/browser/page.js

@@ -0,0 +1,21 @@
+import {BrowserPeer} from './peer.js';
+
+const mode = location.pathname === '/backend' ? 'backend' : 'direct';
+const start = document.querySelector('#start');
+const stop = document.querySelector('#stop');
+const status = document.querySelector('#status');
+const token = document.querySelector('#token');
+document.querySelector('#mode').textContent = mode === 'direct'
+  ? '1. Browser-owned secret and direct SDP exchange'
+  : '2. Backend-owned SDP forwarding and call lifetime';
+const peer = new BrowserPeer({mode, audio: document.querySelector('audio'), status(message) {
+  status.textContent = message;
+  start.disabled = Boolean(peer.current) || peer.stopping;
+  stop.disabled = !peer.current;
+}});
+start.addEventListener('click', () => {
+  if (token.value.length < 32) { status.textContent = 'Enter the application token (not an OpenAI API key).'; return; }
+  peer.start(token.value);
+});
+stop.addEventListener('click', () => peer.stop());
+window.addEventListener('pagehide', () => peer.stop());

data/examples/realtime/browser/peer.js

@@ -0,0 +1,180 @@
+// Native browser APIs own negotiation, ICE, media and data channels.
+export class BrowserPeer {
+  constructor({mode, audio, status, environment = globalThis}) {
+    this.mode = mode;
+    this.audio = audio;
+    this.status = status;
+    this.env = environment;
+    this.current = null;
+    this.stopping = false;
+  }
+
+  async request(run, path, body = '', type = 'text/plain', cleanup = false) {
+    const response = await this.env.fetch(path, {
+      method: 'POST', body, cache: 'no-store', redirect: 'error',
+      headers: {Authorization: `Bearer ${run.token}`, 'Content-Type': type,
+        'X-Operation-Id': run.id},
+      // Cleanup may wait for serialized creation (15s), sideband (15s), then hangup (5s).
+      signal: cleanup ? this.env.AbortSignal.timeout(40000) : run.abort.signal,
+      keepalive: cleanup,
+    });
+    if (!response.ok) throw new Error('Application request failed.');
+    return response;
+  }
+
+  check(run) {
+    if (this.current !== run) throw new DOMException('Stopped', 'AbortError');
+  }
+
+  async wait(run, operation) {
+    let cancel;
+    const cancelled = new Promise((_, reject) => {
+      cancel = () => reject(new DOMException('Stopped', 'AbortError'));
+      run.abort.signal.addEventListener('abort', cancel, {once: true});
+      if (run.abort.signal.aborted) cancel();
+    });
+    try { return await Promise.race([operation, cancelled]); }
+    finally { run.abort.signal.removeEventListener('abort', cancel); }
+  }
+
+  async start(token) {
+    if (this.current || this.stopping) return;
+    this.cleanup = undefined;
+    const run = {token, id: this.env.crypto.randomUUID(), abort: new this.env.AbortController()};
+    this.current = run;
+    this.status('Starting');
+    run.deadline = this.env.setTimeout(() => this.stop('Startup timed out'), 30000);
+    try {
+      // The permission prompt itself cannot be aborted. Settle start on Stop,
+      // and separately release any tracks that arrive after cancellation.
+      const media = this.env.navigator.mediaDevices.getUserMedia({audio: true}).then(stream => {
+        if (this.current !== run) stream.getTracks().forEach(track => track.stop());
+        else run.stream = stream;
+        return stream;
+      });
+      const stream = await this.wait(run, media);
+      this.check(run);
+      run.stream = stream;
+      run.pc = new this.env.RTCPeerConnection();
+      stream.getTracks().forEach(track => {
+        track.addEventListener('ended', () => { if (this.current === run) this.stop('Microphone ended'); });
+        run.pc.addTrack(track, stream);
+      });
+      run.pc.ontrack = event => {
+        if (this.current === run) {
+          this.audio.srcObject = event.streams[0] || new this.env.MediaStream([event.track]);
+          // Playback help remains beside the controls, independent of connection status.
+          this.audio.play().catch(() => {});
+        }
+      };
+      run.dc = run.pc.createDataChannel('oai-events');
+      const ready = new Promise((resolve, reject) => {
+        const checkReady = () => {
+          if (run.pc.connectionState === 'connected' && run.dc.readyState === 'open') resolve();
+        };
+        run.abort.signal.addEventListener('abort', () => reject(new DOMException('Stopped', 'AbortError')), {once: true});
+        run.pc.onconnectionstatechange = () => {
+          if (this.current !== run) return;
+          if (['failed', 'closed'].includes(run.pc.connectionState)) this.stop('Peer failed');
+          else checkReady(); // disconnected is transient; backend lease still bounds abandonment.
+        };
+        run.dc.onopen = checkReady;
+        run.dc.onclose = () => { if (this.current === run) this.stop('Data channel closed'); };
+        run.dc.onerror = () => { if (this.current === run) this.stop('Data channel failed'); };
+      });
+      // Attach a rejection handler now; negotiation can fail before awaiting ready.
+      ready.catch(() => {});
+      run.dc.onmessage = event => {
+        if (this.current !== run) return;
+        try {
+          const message = JSON.parse(event.data);
+          if (message.type === 'error') this.stop('Realtime error');
+        } catch { this.stop('Invalid Realtime event'); }
+      };
+      const offer = await this.wait(run, run.pc.createOffer());
+      this.check(run);
+      await this.wait(run, run.pc.setLocalDescription(offer));
+      this.check(run);
+      // Give signaling its own budget after permission/local offer preparation:
+      // creation (15s), optional sideband (15s), handoff (20s), and delivery time.
+      this.env.clearTimeout(run.deadline);
+      run.deadline = this.env.setTimeout(() => this.stop('Startup timed out'), 60000);
+      let answer;
+      if (this.mode === 'direct') {
+        const secretResponse = await this.request(run, '/api/secret');
+        const secret = await secretResponse.json();
+        this.check(run);
+        const response = await this.env.fetch('https://api.openai.com/v1/realtime/calls', {
+          method: 'POST', body: run.pc.localDescription.sdp, signal: run.abort.signal,
+          headers: {Authorization: `Bearer ${secret.value}`, 'Content-Type': 'application/sdp'},
+          cache: 'no-store', redirect: 'error',
+        });
+        if (!response.ok) throw new Error('Direct SDP exchange failed.');
+        answer = await response.text();
+      } else {
+        run.submitted = true;
+        const response = await this.request(run, '/api/calls', run.pc.localDescription.sdp, 'application/sdp');
+        answer = (await response.json()).sdp;
+      }
+      this.check(run);
+      await this.wait(run, run.pc.setRemoteDescription({type: 'answer', sdp: answer}));
+      this.check(run);
+      await ready;
+      this.check(run);
+      if (this.mode === 'backend') {
+        await this.request(run, '/api/ack');
+        this.check(run);
+        // No overlapping renewals. A stalled request times out and stops locally.
+        const renew = async () => {
+          if (this.current !== run) return;
+          run.renewDeadline = this.env.setTimeout(() => this.stop('Lease renewal timed out'), 10000);
+          try {
+            await this.request(run, '/api/renew');
+            this.env.clearTimeout(run.renewDeadline);
+            if (this.current === run) run.heartbeat = this.env.setTimeout(renew, 10000);
+          } catch { if (this.current === run) this.stop('Lease renewal failed'); }
+        };
+        run.heartbeat = this.env.setTimeout(renew, 10000);
+      }
+      this.env.clearTimeout(run.deadline);
+      this.status('Connected');
+    } catch {
+      if (this.current === run) this.stop('Start failed');
+      // A timeout or peer callback may already have stopped this run.
+      await run.cleanup;
+    }
+  }
+
+  stop(message = 'Stopped') {
+    const run = this.current;
+    if (!run) return this.cleanup;
+    this.stopping = true;
+    this.current = null; // Invalidate callbacks before closing owned resources.
+    run.abort.abort();
+    this.env.clearTimeout(run.deadline);
+    this.env.clearTimeout(run.heartbeat);
+    this.env.clearTimeout(run.renewDeadline);
+    run.stream?.getTracks().forEach(track => track.stop());
+    run.dc?.close();
+    run.pc?.getReceivers().forEach(receiver => receiver.track?.stop());
+    run.pc?.close();
+    this.audio.pause();
+    this.audio.srcObject = null;
+    const allowRestart = () => this.env.setTimeout(() => {
+      this.stopping = false;
+      this.status(message);
+    }, 5000);
+    if (run.submitted) {
+      // Independent of the aborted startup request. If delivery fails, the
+      // application lease reclaims the known call; pagehide is only best effort.
+      run.cleanup = this.request(run, '/api/stop', '', 'text/plain', true).then(() => true).catch(() => {
+        this.status('Stopped; server cleanup pending. Reload only after backend release is confirmed.');
+        return false;
+      });
+      this.cleanup = run.cleanup;
+      run.cleanup.then(released => { if (released) allowRestart(); });
+    } else allowRestart();
+    this.status(message);
+    return run.cleanup;
+  }
+}