openai 7.5.0 → 7.6.0

package/src/internal/uploads.ts

@@ -36,7 +36,10 @@ export interface StreamingFile {
   /** Source chunks read incrementally as the multipart request body is transmitted. */
   readonly data: StreamingFileInput;
 
-  /** Filename sent in the multipart part's `Content-Disposition` header. */
+  /**
+   * Logical source filename; ordinary uploads send its basename, while Skills can preserve
+   * a validated relative directory path.
+   */
   readonly name: string;
 
   /** Optional MIME type; defaults to `application/octet-stream` when omitted. */
@@ -51,7 +54,8 @@ export interface StreamingFile {
  * form data when the request is sent.
  *
  * @param data Async-iterable or readable-stream chunks containing text, binary data, or blobs.
- * @param name Non-empty filename sent in the multipart request.
+ * @param name Non-empty logical/source filename. Ordinary uploads send only its basename; Skills
+ * uploads may preserve a validated relative path with normalized forward slashes.
  * @param options Optional MIME type for the streaming file.
  * @throws {TypeError} If `name` is empty or the content type contains control characters.
  */
@@ -117,7 +121,7 @@ export const checkFileSupport = () => {
 /**
  * Values accepted by SDK methods that upload multipart files.
  *
- * Supports native files, fetch responses, named blobs, Node.js filesystem read
+ * Supports native files, fetch responses, blobs, Node.js filesystem read
  * streams, async byte sources, web readable streams, and files created with
  * {@link toStreamingFile}. Use {@link toFile} to materialize compatible content
  * as a native `File` when buffering the complete upload is acceptable.
@@ -152,7 +156,7 @@ export function makeFile(
  *
  * Directory components separated by either `/` or `\\` are discarded unless an
  * explicitly supplied `name` or `filename` opts into preserving its path. Preserved
- * paths use forward slashes. Paths inferred from URLs and filesystem streams always
+ * paths must be safe and relative, and use forward slashes. Paths inferred from URLs and filesystem streams
  * discard their directories.
  */
 export function getName(value: any, options?: { stripFilename?: boolean | undefined }): string | undefined {
@@ -160,9 +164,9 @@ export function getName(value: any, options?: { stripFilename?: boolean | undefi
     return undefined;
   }
 
+  const name = 'name' in value ? value.name : undefined;
   const explicitName =
-    ('name' in value && value.name && String(value.name)) ||
-    ('filename' in value && value.filename && String(value.filename));
+    (name && String(name)) || ('filename' in value && value.filename && String(value.filename));
   if (explicitName) {
     return options?.stripFilename === false ? normalizeFilenamePath(explicitName) : basename(explicitName);
   }
@@ -185,7 +189,11 @@ function basename(value: string): string | undefined {
 }
 
 function normalizeFilenamePath(value: string): string {
-  return value.replace(/\\/g, '/');
+  const normalized = value.replace(/\\/g, '/');
+  if (normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized) || normalized.split('/').includes('..')) {
+    throw new TypeError('Upload file name must be a safe relative path without parent directory segments');
+  }
+  return normalized;
 }
 
 /** Identifies objects that expose a callable `Symbol.asyncIterator` method. */
@@ -195,7 +203,7 @@ export const isAsyncIterable = (value: any): value is AsyncIterable<any> =>
 /**
  * Converts a request to multipart form data when its body contains an upload.
  *
- * Uploads include files, named blobs, responses, async iterables, readable
+ * Uploads include files, blobs, responses, async iterables, readable
  * streams, and {@link StreamingFile} values anywhere in a nested body. Bodies
  * containing streaming values are encoded lazily; other uploads use `FormData`.
  * Requests without uploads are returned unchanged.
@@ -287,7 +295,7 @@ export type CreateFormOptions = {
 /**
  * Materializes an object into platform `FormData` after verifying fetch support.
  *
- * Strings, numbers, and booleans become text fields; responses, named blobs,
+ * Strings, numbers, and booleans become text fields; responses, blobs,
  * and async byte sources become file fields. Arrays and nested objects use
  * bracketed field names, while `undefined` values are omitted.
  *
@@ -311,9 +319,8 @@ export const createForm = async <T = Record<string, unknown>>(
   return form;
 };
 
-// We check for Blob not File because Bun.File doesn't inherit from File,
-// but they both inherit from Blob and have a `name` property at runtime.
-const isNamedBlob = (value: unknown): value is NamedBlob => value instanceof Blob && 'name' in value;
+// Native files, Bun files, and unnamed upload values all inherit from Blob.
+const isBlob = (value: unknown): value is Blob => value instanceof Blob;
 
 const isReadableStream = (value: unknown): value is ReadableStream<BlobPart> =>
   typeof value === 'object' &&
@@ -331,7 +338,7 @@ const isUploadable = (value: unknown): value is Uploadable =>
     isAsyncIterable(value) ||
     isReadableStream(value) ||
     isStreamingFile(value) ||
-    isNamedBlob(value));
+    isBlob(value));
 
 const hasStreamingUploadableValue = (value: unknown): boolean => {
   if (isStreamingFile(value) || isAsyncIterable(value) || isReadableStream(value)) {
@@ -340,7 +347,7 @@ const hasStreamingUploadableValue = (value: unknown): boolean => {
   if (Array.isArray(value)) {
     return value.some(hasStreamingUploadableValue);
   }
-  if (value && typeof value === 'object' && !isNamedBlob(value) && !(value instanceof Response)) {
+  if (value && typeof value === 'object' && !isBlob(value) && !(value instanceof Response)) {
     for (const k in value) {
       if (hasStreamingUploadableValue((value as Record<string, unknown>)[k])) {
         return true;
@@ -369,12 +376,34 @@ const hasUploadableValue = (value: unknown): boolean => {
 
 type FormEntry = { key: string; value: unknown };
 
+const snapshotPreservedUploadEntries = (
+  entries: Iterable<FormEntry>,
+  filenames: WeakMap<object, string>,
+): FormEntry[] => {
+  const snapshot: FormEntry[] = [];
+  for (const entry of entries) {
+    if (isUploadable(entry.value) && !filenames.has(entry.value)) {
+      filenames.set(entry.value, getStreamingFileName(entry.value, { stripFilenames: false }));
+    }
+    snapshot.push(entry);
+  }
+  return snapshot;
+};
+
 const createStreamingFormRequestOptions = (
   opts: RequestOptions,
   options: CreateFormOptions = {},
 ): RequestOptions => {
+  const entries = iterateFormEntries(opts.body);
+  const preservedFilenames = options.stripFilenames === false ? new WeakMap<object, string>() : undefined;
+  const multipartEntries = preservedFilenames
+    ? snapshotPreservedUploadEntries(entries, preservedFilenames)
+    : entries;
+
   const boundary = `openai-${Math.random().toString(36).slice(2)}`;
-  const body = ReadableStreamFrom(iterateMultipartBody(opts.body, boundary, options));
+  const body = ReadableStreamFrom(
+    iterateMultipartBody(multipartEntries, boundary, options, preservedFilenames),
+  );
 
   return {
     ...opts,
@@ -384,13 +413,14 @@ const createStreamingFormRequestOptions = (
 };
 
 async function* iterateMultipartBody(
-  body: unknown,
+  entries: Iterable<FormEntry>,
   boundary: string,
   options: CreateFormOptions,
+  preservedFilenames?: WeakMap<object, string>,
 ): AsyncGenerator<Uint8Array> {
-  for await (const { key, value } of iterateFormEntries(body)) {
+  for await (const { key, value } of entries) {
     if (isUploadable(value)) {
-      const filename = getStreamingFileName(value, options);
+      const filename = preservedFilenames?.get(value) ?? getStreamingFileName(value, options);
       const type = getStreamingFileType(value);
       yield encodeUTF8(`--${boundary}\r\n`);
       yield encodeUTF8(
@@ -410,7 +440,7 @@ async function* iterateMultipartBody(
   yield encodeUTF8(`--${boundary}--\r\n`);
 }
 
-async function* iterateFormEntries(body: unknown): AsyncGenerator<FormEntry> {
+function* iterateFormEntries(body: unknown): Generator<FormEntry> {
   if (!body || typeof body !== 'object') {
     return;
   }
@@ -420,7 +450,7 @@ async function* iterateFormEntries(body: unknown): AsyncGenerator<FormEntry> {
   }
 }
 
-async function* iterateFormValue(key: string, value: unknown): AsyncGenerator<FormEntry> {
+function* iterateFormValue(key: string, value: unknown): Generator<FormEntry> {
   if (value === undefined) {
     return;
   }
@@ -459,7 +489,9 @@ function getStreamingFileName(value: Uploadable, options: CreateFormOptions): st
       throw new TypeError('Streaming upload file name must be a non-empty string');
     }
 
-    return options.stripFilenames === false ? normalizeFilenamePath(name) : name;
+    return options.stripFilenames === false
+      ? normalizeFilenamePath(name)
+      : (basename(name) ?? 'unknown_file');
   }
 
   return getName(value, { stripFilename: options.stripFilenames }) ?? 'unknown_file';
@@ -468,7 +500,7 @@ function getStreamingFileName(value: Uploadable, options: CreateFormOptions): st
 function getStreamingFileType(value: Uploadable): string {
   let type: string | undefined;
 
-  if (isStreamingFile(value) || isNamedBlob(value)) {
+  if (isStreamingFile(value) || isBlob(value)) {
     ({ type } = value);
   } else if (value instanceof Response) {
     type = value.headers.get('content-type') ?? undefined;
@@ -555,9 +587,10 @@ const addFormValue = async (
   if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
     form.append(key, String(value));
   } else if (value instanceof Response) {
+    const blob = await value.blob();
     form.append(
       key,
-      makeFile([await value.blob()], getName(value, { stripFilename: options.stripFilenames })),
+      makeFile([blob], getName(value, { stripFilename: options.stripFilenames }), { type: blob.type }),
     );
   } else if (isAsyncIterable(value)) {
     form.append(
@@ -567,10 +600,32 @@ const addFormValue = async (
         getName(value, { stripFilename: options.stripFilenames }),
       ),
     );
-  } else if (isNamedBlob(value)) {
-    form.append(key, value, getName(value, { stripFilename: options.stripFilenames }));
+  } else if (isBlob(value)) {
+    const filename = getName(value, { stripFilename: options.stripFilenames });
+    if (filename === undefined) {
+      form.append(key, value);
+    } else {
+      form.append(key, value, filename);
+    }
   } else if (Array.isArray(value)) {
-    await Promise.all(value.map((entry) => addFormValue(form, key + '[]', entry, options)));
+    // Prepare array elements concurrently, then preserve their repeated-field order.
+    const entries = await Promise.all(
+      value.map(async (entry) => {
+        const entryForm = new FormData();
+        await addFormValue(entryForm, key + '[]', entry, options);
+        return entryForm;
+      }),
+    );
+
+    for (const entryForm of entries) {
+      if (!entryForm) {
+        continue;
+      }
+
+      for (const [entryKey, entryValue] of entryForm.entries()) {
+        form.append(entryKey, entryValue);
+      }
+    }
   } else if (typeof value === 'object') {
     await Promise.all(
       Object.entries(value).map(([name, prop]) => addFormValue(form, `${key}[${name}]`, prop, options)),

package/src/internal/utils/env.ts

@@ -6,11 +6,15 @@
  * Will return undefined if the environment variable doesn't exist or cannot be accessed.
  */
 export const readEnv = (env: string): string | undefined => {
-  if (typeof (globalThis as any).process !== 'undefined') {
-    return (globalThis as any).process.env?.[env]?.trim() || undefined;
-  }
-  if (typeof (globalThis as any).Deno !== 'undefined') {
-    return (globalThis as any).Deno.env?.get?.(env)?.trim() || undefined;
+  try {
+    if (typeof (globalThis as any).process !== 'undefined') {
+      return (globalThis as any).process.env?.[env]?.trim() || undefined;
+    }
+    if (typeof (globalThis as any).Deno !== 'undefined') {
+      return (globalThis as any).Deno.env?.get?.(env)?.trim() || undefined;
+    }
+  } catch {
+    return undefined;
   }
   return undefined;
 };

package/src/internal/ws.ts

@@ -44,13 +44,34 @@ interface CredentialedWebSocketOptions {
   headers?: object | null | undefined;
 }
 
+const REDIRECT_SAFE_WEBSOCKET_HEADERS = new Set([
+  'connection',
+  'host',
+  'openai-beta',
+  'origin',
+  'sec-websocket-extensions',
+  'sec-websocket-key',
+  'sec-websocket-version',
+  'upgrade',
+  'user-agent',
+  'x-access-level',
+  'x-auth-metadata',
+  'x-auth-tokenization',
+  'x-authentication-metadata',
+  'x-authentication-tokenization',
+  'x-security-policy',
+  'x-token-budget',
+  'x-trace-id',
+]);
+
 /** Prevents WebSocket redirects from forwarding caller or SDK credentials to another origin. */
 export function protectWebSocketOptionsFromCredentialRedirects<Options extends CredentialedWebSocketOptions>(
   options: Options,
 ): Options {
-  const hasSensitiveHeader = Object.keys(options.headers ?? {}).some(
-    (name) => /^(?:authorization|proxy-authorization|cookie)$/iu.test(name) || /api[-_]?key/iu.test(name),
-  );
+  const hasSensitiveHeader = Object.keys(options.headers ?? {}).some((name) => {
+    const normalized = name.toLowerCase().split('_').join('-');
+    return !REDIRECT_SAFE_WEBSOCKET_HEADERS.has(normalized);
+  });
 
   if (!options.auth && !hasSensitiveHeader) {
     return options;

package/src/lib/AbstractChatCompletionRunner.ts

@@ -1,4 +1,4 @@
-import { OpenAIError } from '../error';
+import { APIUserAbortError, OpenAIError } from '../error';
 import type OpenAI from '../index';
 import type { RequestOptions } from '../internal/request-options';
 import { uuid4 } from '../internal/utils/uuid';
@@ -127,6 +127,7 @@ export class AbstractChatCompletionRunner<
   ParsedT,
 > extends EventStream<EventTypes> {
   protected _chatCompletions: ParsedChatCompletion<ParsedT>[] = [];
+  #completionArrivedBeforeAbort = false;
   /** Mutable conversation history, including initial input, assistant replies, and tool results. */
   messages: ChatCompletionMessageParam[] = [];
 
@@ -134,6 +135,7 @@ export class AbstractChatCompletionRunner<
     this: AbstractChatCompletionRunner<AbstractChatCompletionRunnerEvents, ParsedT>,
     chatCompletion: ParsedChatCompletion<ParsedT>,
   ): ParsedChatCompletion<ParsedT> {
+    this.#completionArrivedBeforeAbort = !this.controller.signal.aborted;
     normalizeToolCallIds(chatCompletion);
     this._chatCompletions.push(chatCompletion);
     this._emit('chatCompletion', chatCompletion);
@@ -439,7 +441,11 @@ export class AbstractChatCompletionRunner<
       functionCalled: boolean;
     };
 
+    let allowBufferedToolCall = false;
+
     const runToolCall = async (toolCall: ChatCompletionMessageToolCall): Promise<ToolCallResult> => {
+      const bufferedToolCall = allowBufferedToolCall;
+      allowBufferedToolCall = false;
       if (toolCall.type !== 'function') {
         return { message: undefined, functionCalled: false };
       }
@@ -472,11 +478,20 @@ export class AbstractChatCompletionRunner<
         try {
           parsed = await fn.parse(args);
         } catch (error) {
+          if (this.controller.signal.aborted) {
+            throw new APIUserAbortError();
+          }
           const content = error instanceof Error ? error.message : String(error);
           return { message: { role, tool_call_id, content }, functionCalled: false };
         }
+        if (this.controller.signal.aborted) {
+          throw new APIUserAbortError();
+        }
         rawContent = await fn.function(parsed, runner, toolContext);
       } else {
+        if (this.controller.signal.aborted && !bufferedToolCall) {
+          throw new APIUserAbortError();
+        }
         rawContent = await fn.function(args, runner, toolContext);
       }
 
@@ -495,6 +510,10 @@ export class AbstractChatCompletionRunner<
         },
         options,
       );
+      // A completed buffered turn retains its first immediate callback for
+      // compatibility; delayed parsed callbacks never inherit this exception.
+      allowBufferedToolCall = this.controller.signal.aborted && this.#completionArrivedBeforeAbort;
+
       const message = chatCompletion.choices[0]?.message;
       if (!message) {
         throw new OpenAIError(`missing message in ChatCompletion response`);
@@ -510,6 +529,9 @@ export class AbstractChatCompletionRunner<
           if (result.message) {
             this._addMessage(result.message);
           }
+          if (this.controller.signal.aborted) {
+            throw new APIUserAbortError();
+          }
 
           if (singleFunctionToCall && result.functionCalled) {
             await afterCompletion?.(chatCompletion, runner);
@@ -519,11 +541,13 @@ export class AbstractChatCompletionRunner<
       } else {
         const results = await Promise.allSettled(message.tool_calls.map(runToolCall));
 
-        // Wait for every concurrently running tool to settle before surfacing an
-        // error so tool side effects cannot continue after the runner has ended.
-        for (const result of results) {
-          if (result.status === 'rejected') {
-            throw result.reason;
+        // Wait for all side effects. Ordinary failures retain their existing
+        // behavior; cancellation preserves every callback that already finished.
+        if (!this.controller.signal.aborted) {
+          for (const result of results) {
+            if (result.status === 'rejected') {
+              throw result.reason;
+            }
           }
         }
 
@@ -534,6 +558,9 @@ export class AbstractChatCompletionRunner<
             this._addMessage(result.value.message);
           }
         }
+        if (this.controller.signal.aborted) {
+          throw new APIUserAbortError();
+        }
       }
 
       await afterCompletion?.(chatCompletion, runner);