RepoJournal
OpenAI OpenAI
111 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-08
stories 149
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Realtime credentials isolated in openai-node

By RepoJournal · Filed · About OpenAI

copyberry Hayden
2 people shipped this
copyberry @copyberry 4 cited Hayden @HAYDEN-OAI 3 cited

A breaking fix in openai-node ensures concurrent Realtime connections keep their own API credentials, so a later provider response cannot hijack an earlier connection's authentication.

openai-node ships a breaking fix to Realtime connection handling [1]: concurrent factories now capture the API credential at connection time, and both stable and beta transports use that captured value for WebSocket auth and native browser eligibility. Previously a later provider response or URL callback could replace a connection's credential, so concurrent sessions could authenticate with the wrong key over time. `_callApiKey()` keeps its boolean return and `client.apiKey` update; an optional internal capture callback supplies the connection-local value.

Codex's bundled TUI gains live WebRTC voice conversations behind a feature gate [2]: new `/voice`, `/voice mute`, and `/voice stop` commands stream local audio with app-server signaling, show live transcripts and mic/speaker levels, preserve captions and undelivered answers across thread switches, and speak only final answers while keeping delegated reasoning hidden. Separately, the TUI now groups adjacent computer actions into a compact "Using computer" or "Used computer" summary with action/failure counts and a `ctrl+t` hint to expand [3].

In related fixes, openai-node's raw streaming proxy example now respects `ServerResponse.write(false)` by waiting for Node's `drain` event before reading the next upstream chunk [4]. The vendored Zod converter preserves a registered definition named `__proto__`, which previously dropped from serialized output and left references unresolved [5]. Codex's managed app-server shutdown grace period is now configurable via the new `shutdownGraceSeconds` daemon setting, accepting 0 to 300 seconds and defaulting to 60 [6].

User verification for the bundled TUI is enabled on supported devices [7]: the device-support probe previously always returned `false`; now `native::device_supported` drives the existing initialization path, and eligible in-process `codex-tui` clients with `experimentalApi` advertise the `userVerification` MCP extension capability.

Action items

References

  1. [1] fix: isolate realtime connection credentials (#2690) ↗ openai/openai-node
  2. [2] Add live WebRTC voice conversations to the TUI ↗ openai/codex
  3. [3] Group adjacent computer actions in the TUI ↗ openai/codex
  4. [4] fix(examples): respect raw streaming proxy backpressure ↗ openai/openai-node
  5. [5] fix: preserve own Zod schema definition names (#2695) ↗ openai/openai-node
  6. [6] Make the managed app-server shutdown grace period configurable ↗ openai/codex
  7. [7] Enable user verification for the bundled TUI on supported devices ↗ openai/codex

$ ls openai/reviews/ # the step-back reads

the week in review Codex hardens sandbox and auth across platforms the month in review August: Codex hardens, SDKs consolidate security, GPT-5.5 lands
Topics: AI / ML Full archive →

Quick answers

What shipped in OpenAI on September 8, 2026?
A breaking fix in openai-node ensures concurrent Realtime connections keep their own API credentials, so a later provider response cannot hijack an earlier connection's authentication. In total, 69 commits, 79 pull requests, and 1 releases landed.
Who contributed to OpenAI on September 8, 2026?
2 developers shipped this update, including copyberry and Hayden.
What were the notable OpenAI updates?
fix: isolate realtime connection credentials (#2690), Add live WebRTC voice conversations to the TUI, and Group adjacent computer actions in the TUI.
♥

$ log OpenAI --recent

Codex TUI and openai-node fix stale state and timers 66 shipped Codex voice-host ships real-time microphone audio; openai-node fixes streaming hangs 108 shipped OpenAI ships retry fix, prompt cache diagnostics, sandbox security 152 shipped macOS Codex sandbox hardened against terminal input injection 174 shipped

$ log --all # elsewhere on the wire

@openclaw Selective evidence collection and truthful reviewer prompts land in ClawSweeper AI Agents Cline desktop commands unblocked from slow backend startup

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.