$ the-wire · showcase
Both SDKs break Rules on Decisions instructions
By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology
openai-node 7.43.0 and openai-python 3.37.0 each shipped a breaking change in a minor release to Live response Decisions question types, while the Codex proxy learned to sign non-empty AWS payloads.
v7.43.0 openai/openai-node
A Live response's Decisions question `instructions` can now be a string or an array of text, image, or JSON parts, so code like `question.instructions.trim()` can throw when it receives an array; the release notes, which call it a "Breaking change in a minor release," direct callers to branch on `typeof question.instructions === 'string'`. Decisions request inputs also accept new message roles ...
v3.37.0 openai/openai-python
The Python SDK carries the same breaking Decisions change: `instructions` can be a `str` or a list of structured text, image, or JSON parts, so check `isinstance(question.instructions, str)` before any string operation and handle the structured form. Decisions request input types also gained message roles and tool history.
Support bounded request bodies in AWS SigV4 signing openai/codex
The network proxy previously required AWS signing requests to have an empty body or use `UNSIGNED-PAYLOAD`; it now buffers and hashes the body before signing and forwards the original bytes. New `max_body_bytes` defaults to 8 MiB with a 16 MiB ceiling, a 30-second body read timeout, and at most eight concurrent buffered requests with a five-second capacity wait.
Scope model catalogs and caches by thread originator openai/codex
Model catalogs and disk caches are now scoped per thread originator: supported originators send their own `originator` header and get separate in-memory catalogs and disk caches, so each thread resolves the model instructions and tools that belong to it. Unsupported originators keep the default manager, and the API-key discovery setting is shared across them.
Mark built-in dummy credentials and strengthen collision checks (#56297) openai/codex
Built-in dummy credentials now carry `masked` after the provider prefix plus at least 22 random alphanumeric characters instead of copying punctuation from the real credential, and candidate dummies are checked against observed credential owners and configured-provider aliases before being accepted.
Action items
