← Journal/2026-11-05·8 min·openai agents sdk

OpenAI Agents SDK 0.24.0-alpha.6: A Codex-Backed Preview Wheel, Tool Policies and NetworkPolicy, Read From the Docs

Q: Can a tool policy undo a tool call?

No. The guide says after cannot undo the tool's effects, and a completion status does not prove earlier effects were rolled back.

OpenAI's Agents SDK for Python shipped a preview wheel on November 3 that runs Codex's native runtime under a Python API, outside PyPI. I read the release notes, the pinned-commit docs and the pyproject to see what changed, what the tool and network controls cover, and where the docs and the release disagree.

By Harel Asaf·AI Builder·Tel Aviv

If you use the openai-agents Python package, the preview that shipped on November 3 is a different thing from the package on PyPI. Release v0.24.0-alpha.6 of openai/openai-agents-python installs from GitHub release wheels, bundles a compiled native runtime, and its own README says the SDK uses Codex to run model turns. Your Python code still defines instructions, tools and context.

I read the release page, the changelog, the pyproject and the SDK guides at the release commit. I did not install the wheel or read the Rust source. Everything below is what those documents say, not something I ran.

What shipped

The release page for v0.24.0-alpha.6 (marked November 3, 16:44 on the page) says to use standard CPython 3.10 to 3.14 and install a wheel with pip. It lists three wheels: Linux x86_64 (glibc 2.39 or newer, 145.1 MB), macOS 11 or newer on Apple Silicon (114.0 MB) and Windows x64 (109.3 MB). It says there are no wheels for Intel Macs, ARM Linux, ARM Windows, Alpine or musl, PyPy or free-threaded Python. A SHA256SUMS file covers the three wheels, and the page says the preview is distributed through GitHub Releases, not PyPI.

The release commit is 2808233, "Correct child policy timeout checks for alpha.6", authored by markstuart-oai, dated November 3 08:40 UTC and marked verified.

The pyproject at that commit sets the version to 0.24.0-alpha.6, points the package readme at packages/codex/README.md, and lists four runtime dependencies: jsonschema, referencing, pydantic and typing-extensions. The build uses hatchling with maturin, and the source distribution includes a packages/codex directory with Cargo files, a CODEX_REVISION file, patches and a rust folder. The homepage URL points at a branch named feat/codex-harness.

The preview changelog says alpha.5 and earlier were distributed through an earlier preview program and that their release tags are not hosted in this repository. So alpha.6 is the first preview with public release notes in this repo, and the changes it lists are relative to a version most readers never saw.

What the release notes say changed

From the "Added" section of the notes:

A captured Turn with get_result(), passive events(), manual request handling, steering and cancellation. Prompts can queue with if_busy="queue" or steer the active Turn with if_busy="steer".
LocalStorage to reopen conversations from a local profile, plus portable SessionState capture, idle forks, caller-supplied compaction summaries and checks for feature support and checkpoint readiness.
NativeOutput for native strict schemas and PromptedOutput for JSON validated in Python, with optional bounded max_retries.
Tool policies that inspect arguments and results, native MCP argument replacement and result transforms, and application-managed form and URL interactions.
NetworkPolicy for native commands on supported Linux and macOS executors, and an Environment for remote executors.
Native OpenTelemetry export, and agents.testing.ScriptedResponses to test real sessions against scripted responses without a live model.

The "API changes" section is a migration list. Runner aliases are removed in favor of Agent.run() and Agent.run_sync(). Turn.wait() and Session.wait() become Turn.get_result(). Session.interrupt() becomes Turn.cancel() or Session.cancel_all(). Subagent.submit() becomes Subagent.start(). ManualTool is folded into FunctionTool. Agent declarations become immutable. The notes also say tool selection and session updates cannot expand the permissions captured when the Session opened.

How the docs describe the controls

The tools guide says Python tools run application code with the application's permissions. For a Python function tool, before receives the validated arguments and returns Allow, Deny or ReplaceArguments. after receives and returns the tool output, and the guide says it cannot undo the tool's effects. The same guide says a callback deadline cannot undo earlier effects either.

For MCP tools, the default approval_mode="auto" keeps Codex's native approval rules, which can require interaction when a tool lacks annotations or can make changes. Setting approval_mode="approve" approves calls to selected tools, and the guide says native constraints and strict review still apply. It also says approval does not sandbox server startup. A stdio MCP server runs on the host by default, with the host's permissions, so the guide tells you to supply a trusted command.

The guide's table of controls is useful as a map. For an environment executor tool, approval sees the original arguments and only an allowance permits argument transforms. For an MCP server, before sees the original input and approval sees the effective input after before. For a native collaboration tool, approval can allow or deny but cannot replace arguments.

Tool notifications are thin on purpose. ToolStarted and ToolFinished records carry call identity and sequence, without arguments or results. The guide says an MCP start record can come before approval and execution, and that a completion status does not prove earlier effects were rolled back.

NetworkPolicy, and what it does not cover

The guide's network section describes Environment.network. Its limits are specific:

It applies to native commands. It does not control the model connection, Python functions or MCP clients.
On macOS, an empty NetworkPolicy() grants no destinations and no Unix sockets.
Linux cannot enforce Unix socket denial, so an explicit policy is rejected before commands start unless allow_all_unix_sockets=True.
Windows rejects every explicit network policy in this revision.
Domain rules cover a host across all ports. The proxy checks hostnames and cannot inspect encrypted traffic. A denial wins over an allowance.
allow_all_unix_sockets=True grants every reachable socket, and the guide says to use it only on an executor private to the job. On macOS, local binding can also allow direct traffic to any reachable IP on port 53, including non-DNS traffic, so stricter limits need isolation outside the executor.
Any explicit policy disables sandbox escalation, and a call with sandbox_permissions="require_escalated" fails before it starts.

The guide also says the application must isolate workspaces and tenants and choose an executor that enforces the OS limits it needs. Environment has no sandbox_mode option.

Checkpoints and trust

A portable SessionState is the way to move a conversation to another worker. The sessions guide says to keep it in trusted application storage and says checkpoint history contains instructions and may contain private application data. Restore needs current tools, context and provider configuration, and saved history grants no credentials or permissions. If you restore with state.instructions, the guide says you trust the saved instructions without confirming current policy still permits them. It suggests supplying your own instructions, in which case restore requires an exact match.

For network settings, restore requires the same normalized policy from current application code. The checkpoint stores only a comparison digest, which grants no access.

The choosing guide adds limits for capture. Native strict output, a pending request in a child thread, or any executed code cell blocks manual suspension. Programmatic tool calling, which aggregates results with generated JavaScript in V8, cannot run arbitrary Python, and the JavaScript runtime state is not kept in idle checkpoints.

Where the docs and the release disagree

Three mismatches are worth knowing before you plan around this.

The installation guide at the release commit says the first public preview wheels are not available yet, while the release published them. The guide reads as written before the release.
The tools guide labels NetworkPolicy as unreleased, and the changelog at that commit heads alpha.6 with "(Unreleased)", while the release notes list NetworkPolicy as added. I read the docs at the commit, not a later republished set.
The default branch README that GitHub shows on the repository page still describes the previous SDK, with Runner, SandboxAgent and pip install openai-agents. The preview guides live in the commit's docs and, per the pyproject, a feat/codex-harness branch. The installation guide says the PyPI package is the previous SDK and does not provide the preview API.

The topics index in the commit sets status to "unreleased", with release and published_release null and source_ref set to feat/codex-harness. That is another sign the docs were written ahead of the release.

What I would check

These are my untested suggestions.

Pin by wheel filename and compare it against SHA256SUMS from the same release before installing. The preview is not on PyPI, so your usual index controls do not apply.
Treat the migration list as a real port. Search your code for Runner, Turn.wait, Session.interrupt, Subagent.submit and ManualTool.
Write a test for each before policy with ScriptedResponses, including the Deny and ReplaceArguments paths, since the guide says after cannot undo effects.
If you plan to use NetworkPolicy, run a command that tries a denied host and a Unix socket on your actual executor OS, and confirm failures happen where the guide says.
Keep checkpoints out of shared storage, and decide where restore gets its instructions from.

What I would not conclude

That this replaces the PyPI openai-agents package. The docs say the two APIs differ and that the preview stays off PyPI until general availability.
That NetworkPolicy gives you an offline job. The guide says the SDK cannot infer an offline boundary and the backend must verify it.
That a tool policy is a sandbox. The guide says Python tools run with the application's permissions.
That alpha.6 is stable. The version is an alpha and the release page calls it a preview.
That the early preview history matches these notes. Alpha.5 and earlier tags are not in this repository.

Frequently asked questions

What is new in this release?

A preview wheel that bundles a native runtime based on Codex, a new Session and Turn API, tool policies, NetworkPolicy, remote executors, native OpenTelemetry export and a scripted test harness.

Is it on PyPI?

No. The release page and installation guide say the preview is distributed through GitHub Releases and stays off PyPI until general availability.

Which platforms have wheels?

Linux x86_64 with glibc 2.39 or newer, macOS 11 or newer on Apple Silicon, and Windows x64. There are none for Intel Macs, ARM Linux, ARM Windows, Alpine or musl, PyPy or free-threaded Python.

Does this break existing code?

The release notes list removed and renamed calls, and the docs say the PyPI package is the previous SDK without this API. Plan a port, not an upgrade in place.

Can a tool policy undo a tool call?

No. The guide says after cannot undo the tool's effects, and a completion status does not prove earlier effects were rolled back.

Does NetworkPolicy restrict Python functions or MCP servers?

No. The guide says it covers native commands only, not the model connection, Python functions or MCP clients.

Did you run the preview?

No. I read the release notes, changelog, pyproject and guides at the release commit. I did not install the wheel or read the native source.

Sources

All read on November 5, 2026.

Not read: the Rust source, the API reference, the recipes, providers, configuration, testing and troubleshooting guides, the feat/codex-harness branch itself, and the wheels.

SWE-2 Flash: Cognition's cheaper coding model for Devin, claims checked

Cognition released SWE-2 Flash, a 276B-A12B coding model built on Thinking Machines' Inkling-Small, at one-fifth the price and 3x the speed of SWE-2. What the vendor benchmarks actually show, how it was trained, and why the weights stay closed.