OpenAI Agents SDK for JS 0.14.2 rejects ephemeral paths during sandbox archive hydration

GitHub (openai/openai-agents-js)·medium signalXBlueskyLinkedInCopy link

Released August 1, v0.14.2 of the TypeScript Agents SDK is almost entirely a hardening pass by maintainer seratch. It rejects ephemeral paths during sandbox archive hydration (a path-traversal-shaped hole in restoring sandbox state), preserves sandbox environment secret references instead of inlining them, redacts endpoint credentials from MCP transport errors and MCP URL credentials from external metadata, and cleans MCP servers before reconnecting. The pattern mirrors what the Python SDK shipped in 0.19.1/0.19.2 — both OpenAI SDKs are now systematically sweeping credentials out of every MCP error and diagnostic path, which suggests the leak class was found internally rather than reported piecemeal.