build(deps): update openai-agents requirement from <0.18,>=0.12 to >=0.12,<0.19 in /engine

[dependabot]

Updates the requirements on openai-agents to permit the latest version.

Release notes

Sourced from openai-agents's releases.

v0.18.3

What's Changed

• feat: make task and turn tracing spans configurable by @​seratch in openai/openai-agents-python#3834
• feat(realtime): track response usage in session context by @​seratch in openai/openai-agents-python#3812
• fix(memory): serialize OpenAI conversation session initialization by @​russeell in openai/openai-agents-python#3821
• fix(models): raise UserError for conflicting provider args instead of assert by @​Dhruva-Das in openai/openai-agents-python#3809
• fix(handoffs): preserve user messages containing history wrappers by @​russeell in openai/openai-agents-python#3815
• fix(computer): isolate provider instances across concurrent runs by @​russeell in openai/openai-agents-python#3843
• fix(sandbox): avoid redundant E2B workspace root creation by @​seratch in openai/openai-agents-python#3845
• fix: preserve streamed session input across model retries by @​seratch in openai/openai-agents-python#3857
• fix: prevent stale prepared-item identity reuse by @​seratch in openai/openai-agents-python#3858
• fix: AdvancedSQLiteSession clear_session and pop_item metadata leaks by @​okaditya84 in openai/openai-agents-python#3755
• fix: parse Google docstrings missing the blank line before a section by @​sohumt123 in openai/openai-agents-python#3832
• fix: bound $ref expansion in strict JSON schema conversion by @​ioleksiuk in openai/openai-agents-python#3838
• fix: redact non-tool trace error details by @​seratch in openai/openai-agents-python#3848

Documentation & Other Changes

• docs: updates for hosted multi-agent support by @​seratch in openai/openai-agents-python#3789
• docs: make UserContext example runnable in Agents documentation by @​MuhammadHamidRaza in openai/openai-agents-python#3851
• chore: enable flake8-async for runtime source by @​seratch in openai/openai-agents-python#3813
• Release 0.18.3 by @​github-actions[bot] in openai/openai-agents-python#3859

New Contributors

• @​Dhruva-Das made their first contribution in openai/openai-agents-python#3809
• @​russeell made their first contribution in openai/openai-agents-python#3815
• @​okaditya84 made their first contribution in openai/openai-agents-python#3755
• @​sohumt123 made their first contribution in openai/openai-agents-python#3832

Full Changelog: openai/openai-agents-python@v0.18.2...v0.18.3

Changelog

Sourced from openai-agents's changelog.

Release process/changelog

The project follows a slightly modified version of semantic versioning using the form 0.Y.Z. The leading 0 indicates the SDK is still evolving rapidly. Increment the components as follows:

Minor (Y) versions

We will increase minor versions Y for breaking changes to any public interfaces that are not marked as beta. For example, going from 0.0.x to 0.1.x might include breaking changes.

If you don't want breaking changes, we recommend pinning to 0.0.x versions in your project.

Patch (Z) versions

We will increment Z for non-breaking changes:

• Bug fixes
• New features
• Changes to private interfaces
• Updates to beta features

Breaking change changelog

0.18.0

This minor release does not introduce a breaking change. The minor version bump is for the Realtime agents default model update only.

Highlights:

• Realtime agents now use gpt-realtime-2.1 as the default model, so new Realtime setups use the latest recommended model without extra configuration.

0.17.0

In this version, sandbox local source materialization keeps LocalFile.src and LocalDir.src within the materialization base_dir unless the source path is covered by Manifest.extra_path_grants. The base_dir is the SDK process current working directory when the manifest is applied; relative local sources are resolved from that directory, while absolute local sources must already be inside it or under an explicit grant. This closes a local artifact boundary issue, but it can affect applications that intentionally copy trusted host files or directories from outside that base directory into a sandbox workspace.

To migrate, grant trusted host roots at the manifest level with SandboxPathGrant, preferably as read-only when the sandbox only needs to read those files:

from pathlib import Path
from agents.sandbox import Manifest, SandboxPathGrant
from agents.sandbox.entries import Dir, LocalDir
This is an absolute host path outside the SDK process base_dir.
TRUSTED_DOCS_ROOT = Path("/opt/my-app/docs")
manifest = Manifest(
extra_path_grants=(
# This host root is outside the SDK process base_dir, so the manifest must grant it.
SandboxPathGrant(path=str(TRUSTED_DOCS_ROOT), read_only=True),
),
entries={
</tr></table>

... (truncated)

Commits

• 3e788a4 Release 0.18.3 (#3859)
• d02972e fix: prevent stale prepared-item identity reuse (#3858)
• 5313a82 fix: preserve streamed session input across model retries (#3857)
• 5e8d067 docs: make UserContext example runnable in Agents documentation (#3851)
• 697a46c fix: redact non-tool trace error details (#3848)
• e29b023 fix(sandbox): avoid redundant E2B workspace root creation (#3845)
• 585053b fix(computer): isolate provider instances across concurrent runs (#3843)
• 8ce548e fix: bound $ref expansion in strict JSON schema conversion (#3838)
• 7369b73 feat: make task and turn tracing spans configurable (#3834)
• df20e83 fix: parse Google docstrings missing the blank line before a section (#3832)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)