Jesse Squire

Expand OpenTelemetry support for Responses streaming (#1412) * Update .NET SDK and SourceLink packages Bump Microsoft.SourceLink.GitHub to 10.0.401 to mitigate CVE-2026-62900 for its Microsoft.Build.Tasks.Git dependency. * Record duration for observed raw streaming operations Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ad296912-e997-4e95-8ff4-c8aff086b35d * Fixing standards deviations. * More formatting fixes * Addressing PR feedback * Rebasing on main * Guard telemetry logger creation failures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ad296912-e997-4e95-8ff4-c8aff086b35d --------- Copilot-Session: ad296912-e997-4e95-8ff4-c8aff086b35d

[Diagnostics] Add Stainless telemetry headers (#1260) * [Diagnostics] Add Stainless telemetry headers Outgoing requests now carry six structured headers describing the SDK and the platform that issued them, bringing the .NET library to parity with the other official OpenAI SDKs: X-Stainless-Lang csharp X-Stainless-Package-Version 2.12.0 X-Stainless-Runtime dotnet X-Stainless-Runtime-Version 8.0.11 X-Stainless-OS Windows X-Stainless-Arch x64 These restate, in a machine-parseable form, information already present in the User-Agent, plus the process CPU architecture, so consumers no longer have to parse the user agent string. The User-Agent header itself is unchanged, as Azure services depend on its current shape. System.ClientModel's UserAgentPolicy could not be reused: it exposes only the composed string, and the structured inputs behind it are internal. Parsing that string back apart would reintroduce exactly the fragility this change exists to remove, so the values are derived directly. Also adds an opt-out, via the OpenAI.TelemetryDisabled AppContext switch or the OPENAI_TELEMETRY_DISABLED environment variable. When set, the library sends neither these headers nor the User-Agent it would otherwise add; a User-Agent supplied by the caller is still honored, as are the Authorization, OpenAI-Organization, and OpenAI-Project headers. The setting is read once when a pipeline is built, matching how the experimental OpenTelemetry switch behaves. Implementation notes: - Headers are applied by the single shared per-call policy that every client is built on, so no client can be constructed without them. - Values are computed once per process and are never allowed to fail a request; every path degrades to "unknown" rather than throwing. - Platform detection is netstandard2.0-safe. OSPlatform.FreeBSD and the mobile and browser platforms do not exist in that reference assembly, so they are created by name. Android and the Apple mobile platforms are evaluated before Linux and macOS, because Mono and legacy Xamarin report them as their base platform. - Free-form platform text is normalized to printable ASCII and bounded in length. The package version is not: it is reproduced verbatim so that it always matches the User-Agent, and falls back to "unknown" if it could not be transmitted unaltered, rather than being rewritten into a value that would silently disagree. - Realtime WebSocket handshakes deliberately omit these headers, matching the other official OpenAI SDKs. Regular HTTP requests from RealtimeClient include them. Existing session recordings are unaffected. A RemoveHeaderSanitizer in OpenAIRecordedTestBase strips the headers before the proxy matches a playback request and before a recording is written, so nothing needed to be re-recorded and future recordings will not capture machine-specific values. Coverage lives in 80 new mock-based tests spanning normalization, every OS and architecture branch, never-throw behavior, header application and override, retry de-duplication, and opt-out scope, plus a guard asserting the package version header never drifts from the User-Agent. Measured cost is roughly 590 ns, 912 bytes, and 183 wire bytes per request. No public API change and no new dependencies. * Addressing PR feedback * Addressing additional PR feedback. * Removing arbitrary length for ApplicationId segment of the User-Agent header and allowing a more reasonable 512 characters. * Renaming AppContext switch for telemetry opt-out to better follow naming patterns. * Updating to avoid creating telemetry details when opt-out is active.

Add Responses OpenTelemetry instrumentation (#1347) * Add Responses OpenTelemetry instrumentation Instrument non-streaming response creation with GenAI spans and metrics. Support requests without an explicit model and cover independent tracing and metrics paths.

[Docs] Document SDK security and support policies (#1392) Adapt security guidance for OpenAI trust boundaries. Support only the latest package and official service. Clarify Experimental opt-in and stability.

docs: clarify experimental API lifecycle (#1331) * docs: add README guidance for experimental APIs

[EngSys] Update .NET SDK Version (#1299) * [EngSys] Update .NET SDK Version The focus of these changes is to bump the version of the .NET SDK required by the repository to mitigate a CVE in earlier versions of the SDK. * Fix Build tool restore source Co-authored-by: jsquire <913445+jsquire@users.noreply.github.com> * Pin .NET 10 workflow and devcontainer versions to 10.0.400 Co-authored-by: jsquire <913445+jsquire@users.noreply.github.com> * Update SDK version references in docs to 10.0.400 Co-authored-by: jsquire <913445+jsquire@users.noreply.github.com> * Use global.json in workflows Co-authored-by: jsquire <913445+jsquire@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Fix VectorStore usage byte overflow (#1376) * Fix vector store usage byte overflow Preserve VectorStore.UsageBytes as a 64-bit value during code generation and add regression coverage for values above Int32.MaxValue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f30bb543-4723-49ef-823a-a99ccc0bd819 * Declare vector store usage as int64 Explicitly override the .NET client type so code generation does not restore the previous int contract. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f30bb543-4723-49ef-823a-a99ccc0bd819 * Fix VectorStore usage byte generation Override UsageBytes in custom code so the generator preserves the intentional long type instead of restoring the previous int contract. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f30bb543-4723-49ef-823a-a99ccc0bd819 --------- Copilot-Session: f30bb543-4723-49ef-823a-a99ccc0bd819

Reduce memory pressure for large data URIs (#1277) * Reduce memory pressure for large data URIs Avoid an extra buffer allocation when encoding large image and file content * Fixing potentially unused using

Reduce binary data URI allocations (#1286) * Reduce binary data URI allocations Create data URIs lazily and avoid retaining serialization-only strings. Use a single allocation on modern target frameworks while preserving the netstandard2.0 fallback. Share the optimized path across binary-backed content and add regression coverage. * Include parameter name in data URI errors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a26db616-840e-2844-47f5-930b-4f3538bc5cc5 * Remove incorrect contributor attribution Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a26db616-840e-2844-47f5-930b-4f3538bc5cc5 * Document binary buffer ownership Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a26db616-840e-2844-47f5-930b-4f3538bc5cc5 * Keep data URI optimization in custom code Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a26db616-840e-2844-47f5-930b-4f3538bc5cc5

Clarify NPM settings in dependabot configuration (#1319) * Clarify NPM settings in dependabot configuration Updated comments to clarify NPM usage and pull request settings. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update open-pull-requests-limit in dependabot config Set open-pull-requests-limit to 0 for dependencies. * Update dependabot.yml to remove ignore rule Removed ignore rule for @typespec/http-client-csharp package. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>