feat(api): add agent session review and tool settings

Castiron-Internal-PR: openai/openai-python-internal#379
Castiron-Source-SHA: b39b068d9fd3d67d942499cb9fdadc660ee0fd05
Castiron-Public-Base-SHA: bd61e84

Author: markstuart-oai

.castiron.stats.yml

@@ -1,7 +1,7 @@
 schema_version: 1
-generation_id: 7b7feee1-6807-4c20-98e0-610aab05b2da
-openapi_spec_hash: 51b199ef7fd5542bc4910765f9becd60
-openapi_transformed_spec_hash: 73822d924c15a6ed58dcfe8f616bd4be
+generation_id: 02d4f0c7-8393-440e-a93a-39956ee04c68
+openapi_spec_hash: 305993fa2c84b50a0e0337094c8126c5
+openapi_transformed_spec_hash: 2c32c80a270cfbe9f55a0da534778ce7
 config_hash: b707b209c892562880c415693d111ad6
-codegen_sha: e1054c07fb03a8025411f0ff6ee0a5ff17e09109
-codegen_hash: 73c66bd2bff47ee2bbd2d04a174184dec767ebe300a3bd41443938d914013ef0
+codegen_sha: f32119a692a8ae837d9c1cf3916100c7ffd6363c
+codegen_hash: 8897330eea226e74e84660fd7c0b6b0096b52a6176930760065cce69008b1d70

api_reference/openapi.transformed.yml

@@ -33545,7 +33545,7 @@ paths:
     post:
       operationId: updateAgentSession
       summary: Update an agent session
-      description: Updates session metadata, model, reasoning effort, or service tier. Model settings apply to subsequent turns. Omitted fields are unchanged. See [managing sessions](https://developers.openai.com/api/docs/guides/agents-api/sessions/manage).
+      description: Updates session tools, metadata, model, reasoning effort, or service tier. Model settings apply to subsequent turns. Omitted fields are unchanged. See [managing sessions](https://developers.openai.com/api/docs/guides/agents-api/sessions/manage).
       tags:
       - Agents
       parameters:
@@ -85706,6 +85706,9 @@ components:
         defer_loading:
           type: boolean
           description: Whether the function is deferred and discovered through tool search.
+        async:
+          type: boolean
+          description: If true, Managed Agents immediately acknowledges the call to the model. The client submits only the final result.
       required:
       - type
       - name
@@ -87122,6 +87125,10 @@ components:
           type: boolean
           default: false
           description: Whether this function is deferred and discovered through tool search. Defaults to `false`.
+        async:
+          type: boolean
+          default: false
+          description: If true, Managed Agents immediately acknowledges the call to the model. The client submits only the final result. Defaults to `false`.
       required:
       - type
       - name
@@ -90675,6 +90682,9 @@ components:
         defer_loading:
           type: boolean
           description: Whether the function is deferred and discovered through tool search.
+        async:
+          type: boolean
+          description: If true, Managed Agents immediately acknowledges the call to the model. The client submits only the final result.
       required:
       - type
       - name
@@ -91129,6 +91139,10 @@ components:
           type: boolean
           default: false
           description: Whether this function is deferred and discovered through tool search. Defaults to `false`.
+        async:
+          type: boolean
+          default: false
+          description: If true, Managed Agents immediately acknowledges the call to the model. The client submits only the final result. Defaults to `false`.
       required:
       - type
       - name
@@ -92387,6 +92401,9 @@ components:
           - $ref: '#/components/schemas/TokenUsageResource'
           - type: 'null'
           description: Best-effort token usage for the session, or null if unknown. Recorded usage may change.
+        review:
+          $ref: '#/components/schemas/SessionReviewResource'
+          description: Review applied to eligible actions in this session. Omitted when review is none and automatic review is not enabled. Omission means none.
         spend_control:
           $ref: '#/components/schemas/SessionSpendControlResource'
           description: Configured spending limit and best-effort consumption, in USD cents. Unlimited sessions omit this object.
@@ -92505,6 +92522,9 @@ components:
           type: boolean
           default: false
           description: Whether to stream session events as server-sent events. Defaults to `false`.
+        review:
+          $ref: '#/components/schemas/SessionReviewParam'
+          description: Action review mode. Omit to use none.
         spend_control:
           anyOf:
           - $ref: '#/components/schemas/SessionSpendControlParam'
@@ -94115,14 +94135,23 @@ components:
           - type: 'null'
           description: Omit to keep the current tier. Null resets it to auto.
           x-openai-go-optional-enum: true
+        tools:
+          type:
+          - array
+          - 'null'
+          items:
+            $ref: '#/components/schemas/AgentToolConfigParam'
+          minItems: 0
+          maxItems: 16384
+          description: Replaces the session tools. Functions and MCP servers change on the next model call. Built-in tools change by the next turn. Omit to keep the current tools, or pass null or an empty array to clear them.
       additionalProperties: false
-      description: Model settings that can change after session creation.
+      description: Agent settings that can change after session creation.
     UpdateAgentSessionParams:
       type: object
       properties:
         agent:
           $ref: '#/components/schemas/UpdateSessionAgentParam'
-          description: Model settings for subsequent turns. Omitted fields stay unchanged.
+          description: Agent settings to update on this session. Omitted fields stay unchanged.
         metadata:
           type:
           - object
@@ -94138,6 +94167,9 @@ components:
           minProperties: 0
           maxProperties: 16
           description: Replaces all metadata. Omit to leave unchanged, or pass null or {} to clear it. Up to 16 string key-value pairs, with keys up to 64 and values up to 512 characters.
+        review:
+          $ref: '#/components/schemas/SessionReviewParam'
+          description: Default action review for new root turns. Existing turns and their subagents keep their review mode.
         spend_control:
           anyOf:
           - $ref: '#/components/schemas/SessionSpendControlParam'
@@ -111890,6 +111922,21 @@ components:
       - $ref: '#/components/schemas/BetaResponseCustomToolCallInputDoneEvent'
       discriminator:
         propertyName: type
+    SessionReviewParam:
+      type: string
+      enum:
+      - none
+      - auto_review
+      x-enumDescriptions:
+      - Keep the existing execution behavior without automatic action review.
+      - Review eligible actions automatically. Deny manual approval fallbacks.
+      description: Review applied to eligible actions in a session.
+    SessionReviewResource:
+      type: string
+      enum:
+      - none
+      - auto_review
+      description: The configured action review mode.
     SessionSpendControlResource:
       type: object
       properties:

scripts/castiron/generated-files.json

@@ -287,7 +287,7 @@
     },
     "src/openai/resources/beta/agents/sessions/sessions.py": {
       "mode": "100644",
-      "sha256": "d1719b767d0b16e9eba1c405a66e9c11874da30a6ba2fa873603d1e6a9f6f7e2"
+      "sha256": "264c1c83bc479591e9b70166208a4384e7266c7176a3fea7971f1d876ef54294"
     },
     "src/openai/resources/beta/agents/sessions/subagents/__init__.py": {
       "mode": "100644",
@@ -1703,7 +1703,7 @@
     },
     "src/openai/types/beta/agent_session.py": {
       "mode": "100644",
-      "sha256": "4dbf44628416d12c8cdf46a6a73e293239736ca23dfb096e39850d68ffe5daa6"
+      "sha256": "c3563e065a7d80a1ee1676d31cd4b835a2363a691db2ac778f8a0c13f265e37b"
     },
     "src/openai/types/beta/agent_session_assistant_message.py": {
       "mode": "100644",
@@ -1879,11 +1879,11 @@
     },
     "src/openai/types/beta/agent_tool.py": {
       "mode": "100644",
-      "sha256": "ed568481e6de6956b9deccfbb7cce718bba3cfbab6270851602886141af5230c"
+      "sha256": "9d25cb93e49b88d0cf80ccb7fb93880594332aeab7ee623e8f3c530d6599bbd2"
     },
     "src/openai/types/beta/agent_tool_param.py": {
       "mode": "100644",
-      "sha256": "50116fba12372f68fc831149fafc3896e5b0be3f8f12bc72cc539ead14be34b3"
+      "sha256": "44b83c04613add6637b8de7bb48cbf4b1220ddde3d1a2e50e1edfb9d6d4b8990"
     },
     "src/openai/types/beta/agent_update_params.py": {
       "mode": "100644",
@@ -2019,15 +2019,15 @@
     },
     "src/openai/types/beta/agents/session_create_params.py": {
       "mode": "100644",
-      "sha256": "d4566c2d07b1a1469e929763fa12e626cb1dbeae6dedfd00648f8220b4af8581"
+      "sha256": "89d1618c6a0a6ef4791ee9376bbd8fdd512b8f0c259eb551c0c27281cbf61170"
     },
     "src/openai/types/beta/agents/session_list_params.py": {
       "mode": "100644",
       "sha256": "2de32d51ce2cfdbcf2224acfa8b04a28234717d6c373a3d68ee66bac90f75d2d"
     },
     "src/openai/types/beta/agents/session_update_params.py": {
       "mode": "100644",
-      "sha256": "de3b4a42dfa9591dc07086c3ac888502c8dd0d3c7e77c82969a10a116dcee18e"
+      "sha256": "595ab57453c5678034088224417b1946dc37f4dd11e28c7f6df49d75d7dd3dd0"
     },
     "src/openai/types/beta/agents/sessions/__init__.py": {
       "mode": "100644",
@@ -3403,11 +3403,11 @@
     },
     "src/openai/types/beta/persisted_agent_tool.py": {
       "mode": "100644",
-      "sha256": "337c62e5505ccc43656dad66d619b0a0be532181c8f598e7ccf047b9e6ed8824"
+      "sha256": "d7563a66acc9614a8e4b051512760b1091c05a9aa9bbd6d7cd0606db270573dd"
     },
     "src/openai/types/beta/persisted_agent_tool_param.py": {
       "mode": "100644",
-      "sha256": "d9e83ab1f8347f4acc525746b1e2c0bc42cbcf64742976dea0983cc419e8fe74"
+      "sha256": "11cd9c21954b53b21883fb68c5f751811663ee653bfef429c53a81a24916b934"
     },
     "src/openai/types/beta/persisted_mcp_transport.py": {
       "mode": "100644",
@@ -7707,15 +7707,15 @@
     },
     "tests/api_resources/beta/agents/test_automations.py": {
       "mode": "100644",
-      "sha256": "34501f413c83a2ccd9aa494eb59f5c0ae1ba21fa14619dd2bc41571ad8a6422a"
+      "sha256": "2b10ce0346ce9ff87a52782763f6e544c6a7320a0075c7972624dcc4e8b9cf78"
     },
     "tests/api_resources/beta/agents/test_environments.py": {
       "mode": "100644",
       "sha256": "529f48933850ff09980fbd8a8ec6c9bef538efa5bffa71660e14421693df02fa"
     },
     "tests/api_resources/beta/agents/test_sessions.py": {
       "mode": "100644",
-      "sha256": "8cfecc54a8e76b3714fa35298725eb6b315750fe5a2b112fff6185e14df8f831"
+      "sha256": "bff353017fd3385cdcf0db40291e6ae63da4ac10596b48f5eac031cc02dd95f3"
     },
     "tests/api_resources/beta/agents/test_vaults.py": {
       "mode": "100644",
@@ -7755,7 +7755,7 @@
     },
     "tests/api_resources/beta/test_agents.py": {
       "mode": "100644",
-      "sha256": "6216ae37c6ea996da62e4916570840ed549aeb86603b607d61078b4b30c87d15"
+      "sha256": "3147acf9a9f9628c4aaed1d51aee13cde66c88bea3e9324d3c157daa68070f68"
     },
     "tests/api_resources/beta/test_assistants.py": {
       "mode": "100644",