openai 7.16.0 → 7.17.0

package/src/providers/bedrock/aws.ts

@@ -96,11 +96,12 @@ function validateStaticCredentials(options: BedrockProviderOptions): AwsCredenti
   return {
     accessKeyId: options.accessKeyId,
     secretAccessKey: options.secretAccessKey,
+    // Spread creates an own data property without invoking inherited setters or changing the object prototype.
     ...(options.sessionToken ? { sessionToken: options.sessionToken } : {}),
   };
 }
 
-function requestTarget(parsedURL: URL): { path: string; query: Record<string, string | string[]> } {
+function requestTarget(parsedURL: URL) {
   const query: Record<string, string | string[]> = Object.create(null);
   for (const [name, value] of parsedURL.searchParams) {
     if (name === '__proto__') {
@@ -195,6 +196,7 @@ class BedrockSigV4Auth implements BedrockRequestAuth {
   }
 
   async prepareRequest(request: FinalizedRequestInit, context: ProviderRequestContext): Promise<void> {
+    // SAFETY: process is optional outside Node; the native process tag is checked before using Node-specific signing and credential behavior.
     if (Object.prototype.toString.call((globalThis as any).process) !== '[object process]') {
       throw new Errors.OpenAIError(
         'Bedrock AWS credential authentication is only supported in Node.js and compatible server runtimes. Use bearer authentication in this runtime.',
@@ -230,10 +232,12 @@ class BedrockSigV4Auth implements BedrockRequestAuth {
         this.signatureV4().sign({
           protocol: parsedURL.protocol,
           hostname: parsedURL.hostname,
+          // Spread creates an own data property without invoking inherited setters or changing the object prototype.
           ...(parsedURL.port ? { port: Number(parsedURL.port) } : {}),
           method,
           ...target,
           headers: Object.fromEntries(headers.entries()),
+          // Spread creates an own data property without invoking inherited setters or changing the object prototype.
           ...(body === undefined ? {} : { body }),
         }),
       failureMessage: this.options.usesDefaultChain

package/src/realtime/internal-base.ts

@@ -13,6 +13,7 @@ import { assertX509WebSocketSupported } from '../internal/auth/x509-workload-ide
 /** Parses frame data without exposing malformed payloads through JSON syntax errors. */
 export function parseRealtimeEvent(data: string): RealtimeServerEvent {
   try {
+    // SAFETY: RealtimeServerEvent is the API wire contract; JSON syntax is checked here while future event types remain accepted at runtime.
     return JSON.parse(data) as RealtimeServerEvent;
   } catch (error) {
     if (error instanceof SyntaxError) {
@@ -87,6 +88,7 @@ type RealtimeEvents = Simplify<
           type: EventType;
         }
       >,
+      // oxlint-disable-next-line anti-slop/no-unknown-returns -- Preserve the published event-callback contract, which accepts and ignores arbitrary return values.
     ) => unknown;
   }
 >;

package/src/realtime/websocket.ts

@@ -43,6 +43,7 @@ function isRunningInBrowserOrBrowserWorker(): boolean {
     return true;
   }
 
+  // SAFETY: RuntimeScope describes optional host capabilities; the following predicates verify their presence and value before use.
   const scope = globalThis as RuntimeScope;
   return (
     typeof scope.WorkerGlobalScope === 'function' &&
@@ -61,6 +62,7 @@ function isRunningInBrowserOrBrowserWorker(): boolean {
 
 /** Reports whether the runtime supports request headers in native WebSocket options. */
 function supportsWebSocketRequestHeaders(): boolean {
+  // SAFETY: RuntimeScope describes optional host capabilities; the following predicates verify their presence and value before use.
   const scope = globalThis as RuntimeScope;
   if (
     isRunningInBrowserOrBrowserWorker() ||
@@ -183,7 +185,9 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
   ) {
     super();
     let apiKey = getRealtimeAPIKey(client, props.__apiKey);
+    // SAFETY: The supplied OpenAI client owns _options; these compatibility reads preserve its provider and browser-consent settings.
     const hasProvider = typeof (client as any)?._options?.apiKey === 'function';
+    // SAFETY: The supplied OpenAI client owns _options; these compatibility reads preserve its provider and browser-consent settings.
     const dangerouslyAllowBrowser =
       props.dangerouslyAllowBrowser ??
       (client as any)?._options?.dangerouslyAllowBrowser ??
@@ -257,7 +261,12 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     });
 
     this.socket.addEventListener('error', (event: any) => {
-      this._onError(null, event.message, null);
+      // Native ErrorEvents can carry an empty message while `error` still holds the failure.
+      const cause = event.error ?? null;
+      const message = [event.message, cause?.message].find(
+        (value) => typeof value === 'string' && value !== '',
+      );
+      this._onError(null, message ?? 'unknown error', cause);
     });
   }
 
@@ -317,6 +326,7 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     return new OpenAIRealtimeWebSocket(
       {
         ...connection,
+        // Preserve explicit browser consent as an own data property without invoking an inherited setter.
         ...(dangerouslyAllowBrowser === undefined ? {} : { dangerouslyAllowBrowser }),
         __resolvedApiKey: isApiKeyProvider,
         __apiKey: apiKey,

package/src/realtime/ws.ts

@@ -55,6 +55,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     super();
     client ??= new OpenAI();
     const apiKey = props.__apiKey === undefined ? client.apiKey : props.__apiKey;
+    // SAFETY: The supplied OpenAI client owns _options; this read detects its existing API-key provider without changing its public surface.
     const hasProvider = typeof (client as any)?._options?.apiKey === 'function';
     if (hasProvider && !props.__resolvedApiKey) {
       throw new Error(
@@ -69,6 +70,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     const headers = {
       'User-Agent': `${client.constructor.name}/JS ${VERSION}`,
       ...props.options?.headers,
+      // A credential must be an own data property without invoking an inherited setter.
       ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${apiKey}` }),
     };
 
@@ -178,6 +180,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
           ...props.options,
           headers: {
             ...props.options?.headers,
+            // A credential must be an own data property without invoking an inherited setter.
             ...(isApiKeyProvider ? {} : { 'api-key': apiKey }),
           },
         },

package/src/resources/beta/agents/agents.ts

@@ -4048,6 +4048,7 @@ export interface SessionTurnError {
    * - `session_budget_exceeded` - The session has reached its usage budget.
    * - `usage_limit_exceeded` - The organization has reached a usage, plan, or
    *   billing limit.
+   * - `credit_balance_exhausted` - The organization has no API credits remaining.
    * - `rate_limit_exceeded` - The request exceeds the available rate limit.
    * - `server_overloaded` - The model service is temporarily overloaded.
    * - `cyber_policy` - The request was rejected by a safety policy.
@@ -4070,6 +4071,7 @@ export interface SessionTurnError {
     | 'context_length_exceeded'
     | 'session_budget_exceeded'
     | 'usage_limit_exceeded'
+    | 'credit_balance_exhausted'
     | 'rate_limit_exceeded'
     | 'server_overloaded'
     | 'cyber_policy'

package/src/resources/beta/beta.ts

@@ -217,6 +217,7 @@ import {
   BetaResponseCodeInterpreterCallInProgressEvent,
   BetaResponseCodeInterpreterCallInterpretingEvent,
   BetaResponseCodeInterpreterToolCall,
+  BetaResponseCompactionCompactingEvent,
   BetaResponseCompactionItem,
   BetaResponseCompactionItemParam,
   BetaResponseCompletedEvent,
@@ -588,6 +589,7 @@ export declare namespace Beta {
     type BetaResponseCodeInterpreterCallInProgressEvent as BetaResponseCodeInterpreterCallInProgressEvent,
     type BetaResponseCodeInterpreterCallInterpretingEvent as BetaResponseCodeInterpreterCallInterpretingEvent,
     type BetaResponseCodeInterpreterToolCall as BetaResponseCodeInterpreterToolCall,
+    type BetaResponseCompactionCompactingEvent as BetaResponseCompactionCompactingEvent,
     type BetaResponseCompactionItem as BetaResponseCompactionItem,
     type BetaResponseCompactionItemParam as BetaResponseCompactionItemParam,
     type BetaResponseCompletedEvent as BetaResponseCompletedEvent,

package/src/resources/beta/index.ts

@@ -165,6 +165,7 @@ export {
   type BetaResponseCodeInterpreterCallInProgressEvent,
   type BetaResponseCodeInterpreterCallInterpretingEvent,
   type BetaResponseCodeInterpreterToolCall,
+  type BetaResponseCompactionCompactingEvent,
   type BetaResponseCompactionItem,
   type BetaResponseCompactionItemParam,
   type BetaResponseCompletedEvent,

package/src/resources/beta/responses/index.ts

@@ -40,6 +40,7 @@ export {
   type BetaResponseCodeInterpreterCallInProgressEvent,
   type BetaResponseCodeInterpreterCallInterpretingEvent,
   type BetaResponseCodeInterpreterToolCall,
+  type BetaResponseCompactionCompactingEvent,
   type BetaResponseCompactionItem,
   type BetaResponseCompactionItemParam,
   type BetaResponseCompletedEvent,

package/src/resources/beta/responses/internal-base.ts

@@ -27,13 +27,21 @@ type WebSocketErrorEvent = Extract<ResponsesAPI.BetaResponsesServerEvent, { type
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: WebSocketErrorEvent | undefined;
 
   constructor(message: string, event: WebSocketErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -77,13 +85,8 @@ export abstract class ResponsesEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: WebSocketErrorEvent, message?: string | undefined): void;
   protected _onError(event: WebSocketErrorEvent | null, message?: string | undefined, cause?: any): void {
-    const eventMessage = event && ('error' in event ? event.error?.message : event.message);
-    message = message ?? eventMessage ?? safeJSONStringify(event) ?? 'unknown error';
-    try {
-      message = String(message);
-    } catch {
-      message = '[unserializable error value]';
-    }
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -114,10 +117,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }

package/src/resources/beta/responses/responses.ts

@@ -2443,6 +2443,49 @@ export namespace BetaResponseCodeInterpreterToolCall {
   }
 }
 
+/**
+ * Emitted when new summary content is sampled for a compaction trigger. Contains
+ * no summary content.
+ */
+export interface BetaResponseCompactionCompactingEvent {
+  /**
+   * The ID of the compaction output item.
+   */
+  item_id: string;
+
+  /**
+   * The index of the compaction output item.
+   */
+  output_index: number;
+
+  /**
+   * The sequence number of the event that was emitted.
+   */
+  sequence_number: number;
+
+  /**
+   * The type of the event, always `response.compaction.compacting`.
+   */
+  type: 'response.compaction.compacting';
+
+  /**
+   * The agent that owns this multi-agent streaming event.
+   */
+  agent?: BetaResponseCompactionCompactingEvent.Agent;
+}
+
+export namespace BetaResponseCompactionCompactingEvent {
+  /**
+   * The agent that owns this multi-agent streaming event.
+   */
+  export interface Agent {
+    /**
+     * The canonical name of the agent that produced this item.
+     */
+    agent_name: string;
+  }
+}
+
 /**
  * A compaction item generated by the
  * [`v1/responses/compact` API](https://developers.openai.com/api/reference/resources/responses/methods/compact).
@@ -10942,6 +10985,7 @@ export type BetaResponseStreamEvent =
   | BetaResponseCodeInterpreterCallCompletedEvent
   | BetaResponseCodeInterpreterCallInProgressEvent
   | BetaResponseCodeInterpreterCallInterpretingEvent
+  | BetaResponseCompactionCompactingEvent
   | BetaResponseCompletedEvent
   | BetaResponseContentPartAddedEvent
   | BetaResponseContentPartDoneEvent
@@ -12231,6 +12275,7 @@ export type BetaResponsesServerEvent =
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallWsCompleted
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallInWsProgress
   | BetaResponsesServerEvent.BetaResponseCodeInterpreterCallWsInterpreting
+  | BetaResponsesServerEvent.BetaResponseCompactionWsCompacting
   | BetaResponsesServerEvent.BetaResponseWsCompleted
   | BetaResponsesServerEvent.BetaResponseContentPartWsAdded
   | BetaResponsesServerEvent.BetaResponseContentPartWsDone
@@ -12387,6 +12432,18 @@ export namespace BetaResponsesServerEvent {
     stream_id?: string;
   }
 
+  /**
+   * Emitted when new summary content is sampled for a compaction trigger. Contains
+   * no summary content.
+   */
+  export interface BetaResponseCompactionWsCompacting extends BetaResponseCompactionCompactingEvent {
+    /**
+     * The WebSocket lane that emitted this event. This field is present when the
+     * originating `response.create` event supplied a `stream_id`.
+     */
+    stream_id?: string;
+  }
+
   /**
    * Emitted when the model response is complete.
    */
@@ -14820,6 +14877,7 @@ export declare namespace Responses {
     type BetaResponseCodeInterpreterCallInProgressEvent as BetaResponseCodeInterpreterCallInProgressEvent,
     type BetaResponseCodeInterpreterCallInterpretingEvent as BetaResponseCodeInterpreterCallInterpretingEvent,
     type BetaResponseCodeInterpreterToolCall as BetaResponseCodeInterpreterToolCall,
+    type BetaResponseCompactionCompactingEvent as BetaResponseCompactionCompactingEvent,
     type BetaResponseCompactionItem as BetaResponseCompactionItem,
     type BetaResponseCompactionItemParam as BetaResponseCompactionItemParam,
     type BetaResponseCompletedEvent as BetaResponseCompletedEvent,

package/src/resources/beta/responses/ws-base.ts

@@ -103,7 +103,11 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
     this.socket = this._connect();
   }
 
-  /** Creates a platform-specific WebSocket for the given URL and auth headers. */
+  /**
+   * Creates a platform-specific WebSocket for the given URL and captured client auth headers.
+   * The transport must supply or validate its final credentials before connecting;
+   * these headers may be empty when authentication is managed by the transport.
+   */
   protected abstract _createSocket(url: URL, authHeaders: Record<string, string>): TSocket;
 
   send(event: ResponsesAPI.BetaResponsesClientEvent) {
@@ -696,9 +700,7 @@ export abstract class ResponsesWSBase<TSocket extends WebSocketLike> extends Res
   }
 
   protected _authHeaders(): Record<string, string> {
-    if (this._client.apiKey) {
-      return { Authorization: `Bearer ${this._client.apiKey}` };
-    }
-    return {};
+    const apiKey = this._client.apiKey;
+    return typeof apiKey === 'string' && apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
   }
 }

package/src/resources/beta/responses/ws.ts

@@ -5,12 +5,17 @@ import { NodeWebSocket } from '../../../internal/ws-adapter-node';
 import { ResponsesWSBase, type ResponsesWSBaseOptions } from './ws-base';
 import { OpenAI } from '../../../client';
 import { VERSION } from '../../../version';
+import { OpenAIError } from '../../../core/error';
+import { snapshotWebSocketCredentials } from '../../../internal/ws';
 
 export type { WebSocketStreamOptions } from '../../../internal/ws';
 
 export type { ResponsesWSReconnectOptions } from './ws-base';
 
-export interface ResponsesWSClientOptions extends WS.ClientOptions, ResponsesWSBaseOptions {}
+export interface ResponsesWSClientOptions extends WS.ClientOptions, ResponsesWSBaseOptions {
+  /** Basic authentication forwarded by the Node `ws` transport. */
+  auth?: string;
+}
 
 export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
   private _wsOptions: WS.ClientOptions | null | undefined;
@@ -21,7 +26,6 @@ export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
         'ResponsesWS from "openai/resources/beta/responses/ws" requires the "ws" package but it could not be loaded.',
       );
     }
-
     const { reconnect, maxQueueSize, ...wsOptions } = options ?? {};
     super(client, { reconnect, maxQueueSize });
     this._wsOptions = wsOptions;
@@ -29,16 +33,27 @@ export class ResponsesWS extends ResponsesWSBase<NodeWebSocket> {
   }
 
   protected _createSocket(url: URL, authHeaders: Record<string, string>): NodeWebSocket {
-    const ws = new WS.WebSocket(url, {
+    const capturedAuthHeaders = { ...authHeaders };
+    const socketOptions: ResponsesWSClientOptions = {
       ...this._wsOptions,
       headers: {
         'User-Agent': `${this._client.constructor.name}/JS ${VERSION}`,
-
-        ...authHeaders,
+        ...capturedAuthHeaders,
         ...this._wsOptions?.headers,
       },
       followRedirects: false,
-    });
+    };
+    if (
+      this._client._hasApiKeyProvider() &&
+      !capturedAuthHeaders['Authorization'] &&
+      !snapshotWebSocketCredentials(socketOptions)
+    ) {
+      throw new OpenAIError(
+        'Cannot open a Responses WebSocket with an unresolved function-based apiKey. Resolve it before constructing the WebSocket or provide explicit WebSocket credentials.',
+      );
+    }
+
+    const ws = new WS.WebSocket(url, socketOptions);
     return new NodeWebSocket(ws);
   }
 }

package/src/resources/live/forks/internal-base.ts

@@ -22,13 +22,21 @@ export type ForksStreamMessage =
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: LiveAPI.ErrorEvent | undefined;
 
   constructor(message: string, event: LiveAPI.ErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -68,7 +76,8 @@ export abstract class ForksEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: LiveAPI.ErrorEvent, message?: string | undefined): void;
   protected _onError(event: LiveAPI.ErrorEvent | null, message?: string | undefined, cause?: any): void {
-    message = message ?? safeJSONStringify(event) ?? 'unknown error';
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -98,10 +107,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }

package/src/resources/live/internal-base.ts

@@ -19,13 +19,21 @@ export type LiveStreamMessage =
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: LiveAPI.ErrorEvent | undefined;
 
   constructor(message: string, event: LiveAPI.ErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -65,7 +73,8 @@ export abstract class LiveEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: LiveAPI.ErrorEvent, message?: string | undefined): void;
   protected _onError(event: LiveAPI.ErrorEvent | null, message?: string | undefined, cause?: any): void {
-    message = message ?? safeJSONStringify(event) ?? 'unknown error';
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -95,10 +104,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }

package/src/resources/live/sideband/internal-base.ts

@@ -22,13 +22,21 @@ export type SidebandStreamMessage =
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: LiveAPI.ErrorEvent | undefined;
 
   constructor(message: string, event: LiveAPI.ErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -68,7 +76,8 @@ export abstract class SidebandEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: LiveAPI.ErrorEvent, message?: string | undefined): void;
   protected _onError(event: LiveAPI.ErrorEvent | null, message?: string | undefined, cause?: any): void {
-    message = message ?? safeJSONStringify(event) ?? 'unknown error';
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -98,10 +107,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }

package/src/resources/responses/api.md

@@ -38,6 +38,7 @@ Types:
 - <code><a href="./src/resources/responses/responses.ts">ResponseCodeInterpreterCallInProgressEvent</a></code>
 - <code><a href="./src/resources/responses/responses.ts">ResponseCodeInterpreterCallInterpretingEvent</a></code>
 - <code><a href="./src/resources/responses/responses.ts">ResponseCodeInterpreterToolCall</a></code>
+- <code><a href="./src/resources/responses/responses.ts">ResponseCompactionCompactingEvent</a></code>
 - <code><a href="./src/resources/responses/responses.ts">ResponseCompactionItem</a></code>
 - <code><a href="./src/resources/responses/responses.ts">ResponseCompactionItemParam</a></code>
 - <code><a href="./src/resources/responses/responses.ts">ResponseCompletedEvent</a></code>

package/src/resources/responses/internal-base.ts

@@ -27,13 +27,21 @@ type WebSocketErrorEvent = Extract<ResponsesAPI.ResponsesServerEvent, { type: 'e
 export class WebSocketError extends OpenAIError {
   /**
    * The error data that the API sent back in an error event.
+   *
+   * This property is non-enumerable to avoid exposing the event through
+   * JSON serialization, object spread, or Object.assign.
    */
   error?: WebSocketErrorEvent | undefined;
 
   constructor(message: string, event: WebSocketErrorEvent | null) {
     super(message);
 
-    this.error = event ?? undefined;
+    Object.defineProperty(this, 'error', {
+      value: event ?? undefined,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
   }
 }
 
@@ -73,13 +81,8 @@ export abstract class ResponsesEmitter extends EventEmitter<WebSocketEvents> {
   protected _onError(event: null, message: string, cause: any): void;
   protected _onError(event: WebSocketErrorEvent, message?: string | undefined): void;
   protected _onError(event: WebSocketErrorEvent | null, message?: string | undefined, cause?: any): void {
-    const eventMessage = event && ('error' in event ? event.error?.message : event.message);
-    message = message ?? eventMessage ?? safeJSONStringify(event) ?? 'unknown error';
-    try {
-      message = String(message);
-    } catch {
-      message = '[unserializable error value]';
-    }
+    const safeMessage = safeWebSocketErrorMessage(event, message);
+    message = safeMessage ?? 'unknown error';
 
     if (!this._hasListener('error')) {
       const error = new WebSocketError(
@@ -110,10 +113,20 @@ export function buildURL(client: OpenAI, parameters: Record<string, unknown>): U
   return url;
 }
 
-function safeJSONStringify(value: unknown): string | null {
+function safeWebSocketErrorMessage(event: unknown, message: unknown): string | undefined {
+  if (typeof message === 'string') return message;
+  if (typeof event !== 'object' || event === null) return undefined;
+
   try {
-    return JSON.stringify(value);
+    const error = Object.getOwnPropertyDescriptor(event, 'error')?.value;
+    const nestedMessage =
+      typeof error === 'object' && error !== null
+        ? Object.getOwnPropertyDescriptor(error, 'message')?.value
+        : undefined;
+    const eventMessage = Object.getOwnPropertyDescriptor(event, 'message')?.value;
+    const candidate = typeof nestedMessage === 'string' ? nestedMessage : eventMessage;
+    return typeof candidate === 'string' ? candidate : undefined;
   } catch {
-    return null;
+    return undefined;
   }
 }