openai-python 3.48.0 and openai-node 7.54.0: agent session event-stream obfuscation padding and stream_options

The official SDKs shipped again on 2026-11-09: openai-python v3.48.0 and openai-node v7.54.0. The split this time is strikingly asymmetric — the headline change (obfuscation padding for agent session event streams) landed only on the python side, while node carries two small type- and codegen-level updates. Sources for every fact in this article: release notes and PR bodies read via the GitHub API today, per-file PR diffs, and the v3.48.0 / v7.54.0 tag sources on raw.githubusercontent.com (docs-verified; GPTMap did not run live streaming requests). Registry status for both packages was checked against the PyPI and npm registry APIs today.

1. Versions and registry timeline

Both release notes also carry a documentation change, "consolidate AGENTS.md guidance" (python #4254 / node #3121) — housekeeping of the repos' own contributor guidance, with no API impact. The python side additionally bumps the locked multidict dependency from 6.9.1 to 7.1.0, among dev-dependency chores. All times above are raw GitHub API and registry timestamps (read 2026-11-10).

2. The headline change: obfuscation padding on agent session event streams

The core feature of python v3.48.0 is PR #4251, "add stream options for agent sessions" (merged 2026-11-05T18:36:43Z, shipped in this release). Per the PR body, it adds options for controlling padding in agent session event streams. Unpacked, it is three things:

• At session creation: the request body gains a stream_options field, with the docstring "Options for the event stream. Only allowed when stream is true";
• When subscribing to the event stream: GET /agents/sessions/{session_id}/events gains an include_obfuscation query parameter — boolean, default true;
• On event objects: several event types gain an optional obfuscation field, documented as "Random alphanumeric padding. Present when stream obfuscation is enabled."

Both switches default to true — so after upgrading to v3.48.0 the default behavior is unchanged (events may now carry the padding field), and turning it off requires an explicit false.

3. Where the two switches live: stream_options at creation, include_obfuscation at subscription

Quoted from the v3.48.0 tag type files (docs-verified):

# openai-python v3.48.0 tag: src/openai/types/beta/agents/session_create_params.py (excerpt)
class StreamOptions(TypedDict, total=False):
    """Options for the event stream. Only allowed when `stream` is `true`."""

    include_obfuscation: bool
    """Whether to include obfuscation padding in events on this connection.

    Defaults to `true`.
    """

When creating a session that streams from the start (stream=True), the padding option can be preset:

from openai import OpenAI

client = OpenAI()

session = client.beta.agents.sessions.create(
    environment=...,  # required: an inline execution environment or template reference (shape not expanded here)
    input="...",      # required when stream=True on a non-self_hosted environment (per the type docstring)
    stream=True,
    stream_options={"include_obfuscation": True},  # defaults to True; set False to disable
)

Subscribing to the event stream of an existing session takes the parameter directly (the SDK method signature gained the same-named keyword in this release):

events = client.beta.agents.sessions.events.stream(
    "sess_123",
    include_obfuscation=False,  # connection-level switch, defaults to True
)
for event in events:
    print(event.type, event.obfuscation)

The equivalent raw REST call (the /v1/agents path prefix matches the library's existing sessions resources, per this site's standing records):

curl -s "https://api.openai.com/v1/agents/sessions/sess_123/events?include_obfuscation=false" \
  -H "Authorization: Bearer $OPENAI_API_KEY"

Keep the three surfaces distinct: stream_options is the preset at creation (only meaningful for a stream=True creation); the events endpoint's include_obfuscation is the connection-level switch at subscription time (docstring: "on this connection"); and the obfuscation field on events is the product of the switch being on — not a third switch.

4. The obfuscation field on events: 33 event type files

The per-file diff of PR #4251 shows 44 changed files, of which 33 event type files under src/openai/types/beta/ all gained the same optional field:

obfuscation: Optional[str] = None
"""Random alphanumeric padding. Present when stream obfuscation is enabled."""

Coverage, grouped by event name: session lifecycle (agent.session.created / failed / idle / in_progress / requires_action; the error event's literal is the standalone error, without the agent.session. prefix), environment lifecycle (environment.pending / ready / connected / disconnected / expired / failed / suspended / reset), turn lifecycle and content events (turn.created / in_progress / completed / failed / cancelled, turn.item.added / done, turn.content_part.added / done, turn.output_text.delta / done), the four reasoning-summary events (agent.session.turn.reasoning_summary_part.added / .done, agent.session.turn.reasoning_summary_text.delta / .done — an underscore after reasoning_summary, not a dot), the three subagent events (created / active / closed), and the output delta (agent.output.command_execution_output.delta). In other words, whichever event type you subscribe to may carry the field; consumers should treat it as optional.

5. The node-side status and the official docs

Package comparison as of this batch's verification date (2026-11-10):

On the docs side: the agents-api session events guide (fetched in its .md full-text variant on 2026-11-10, roughly 21KB) contains no occurrence of obfuscation — this batch runs "SDK type layer ahead of the official docs," the reverse of the prompt caching TTL case where the guide was ahead of the SDK docstrings. If you build on these switches, trust the actual type files of the version you installed.

6. The rest of the batch: rosalind in beta Responses and the scheduling retention

• gpt-6-rosalind joins the beta Responses model union (python #4257, node #3126 — both PRs merged within the same minute at 2026-11-08T16:17): the visible enum sequence in the diff inserts gpt-6-rosalind after gpt-5.6-cyber, gpt-6-cyber, and gpt-rosalind-research. Background: the stable Responses union already took rosalind in the 11-05 batch (v3.46.0/#4243; node v7.51.0/#3109 — verified by this site on 2026-11-06); this batch aligns the beta namespace. For how gpt-6-cyber entered the same union, see GPT-6 Cyber announced: the Astra-derived cybersecurity variant ships on the API.
• Agent scheduling retention (python #4255 merged 2026-11-07T03:39:32Z, node #3123 merged 03:40:31Z): the PR body is a single line, "Retains the existing agent scheduling APIs," and the file-level diff in both packages is only .castiron.stats.yml (codegen config-hash churn) — there is no source-level API change to point at in either repo. Whether the retention corresponds to a trade-off in an upstream spec regeneration is not stated officially; this site records the action itself.
• python-side housekeeping: the docs change "consolidate AGENTS.md guidance" (#4254), the locked multidict bump 6.9.1 → 7.1.0 (#4259), and several dev-dependency upgrades — no API impact.

7. Common errors and troubleshooting

• Errors around stream_options: first confirm the creation call actually passes stream=True — the docstring states the object is "Only allowed when stream is true"; attaching it to a non-streaming creation is meaningless.
• A new obfuscation field on events after upgrading: that is v3.48.0's default behavior (default true), not an anomaly; pass include_obfuscation=false at either entry point from section 3 if you do not want the padding.
• Missing parameters in a node project: not a version problem on your end — the node type layer genuinely lacks these switches as of v7.54.0 (tag-checked); do not copy the python examples verbatim.
• Questions about the padding's semantics: the official text only says it is random alphanumeric padding; purpose and billing are unstated, so treat official docs as the arbiter — this site does not speculate.

Next steps

• The previous batch of agent session settings (compaction / auto_review / spend_control), unpacked: openai-python 3.42.0 and openai-node 7.46/7.47: agent compaction and review settings, external keys, SIP DTMF.
• Where the beta Agents resource surface first landed (hosted environments, suspension and expiration events): Hosted agent environments surface in the OpenAI SDKs: prewarmed creation, idle suspension, expiration.
• Both packages' release cadence on one timeline: OpenAI Models Release Notes (2026, Living Document).