$ the-wire · showcase
Safety identifiers reach images, plugin approvals bind to contents
By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology
openai-python 3.33.0 and openai-node both ship image safety identifiers and prompt-based voice creation, while Codex closes a plugin hook approval gap that let changed scripts run under an existing approval.
Bind plugin hook approval to plugin contents openai/codex
A plugin's scripts could change without touching its hook declaration, so declaration-only approval let modified plugin code run under the old grant. The approval value from `hooks/list` now carries a fingerprint of the bundle contents, persisted as `trusted_content_hash` with `trusted_hash` kept for older clients, and contents are verified before each command or MCP hook execution.
v3.33.0 openai/openai-python
The 3.33.0 release pulls in safety identifiers on image create and edit, a shared Decisions cache breakpoint parameter type, and prompt-based voice creation. Image requests now accept `safety_identifier` while the deprecated `user` parameter stays in place, and responses and completed streaming events expose the effective value.
feat(api): support project API key scope updates openai/openai-node
openai-node can now update scope restrictions on an existing project API key, alone or alongside its expiration. `expires_in_seconds` became optional for scope-only updates, so rotating a key's permissions no longer forces you to set a new TTL.
feat(api): add Decisions prompt caching options openai/openai-node
Decisions requests gain `prompt_cache_key` and `prompt_cache_options`, with explicit prompt-cache breakpoints on text and image input content. The Python side lands the same capability as a shared breakpoint parameter type that preserves existing imports and request fields.
Defer unknown TUI config fields to the shared strict-config policy (#54766) openai/codex
Unknown fields in TUI keymaps and profile TUI settings no longer fail deserialization when strict config validation is off: Serde's `deny_unknown_fields` is gone and the shared strict-config policy reports them instead, with `schemars(deny_unknown_fields)` retained so the generated schema still rejects them. The quiet long tail: managed macOS daemons drop the `taskpolicy -b` wrapper while keepi...
