- Telnyx voice-call: use the raw `client_state` fallback when webhook state is malformed base64 instead of using silently corrupted decoded text.

- Google Meet: report malformed node-host params JSON with plugin-owned errors instead of leaking raw JSON parser failures.

- CLI/export-trajectory: report malformed encoded request JSON with a stable CLI error instead of leaking raw parser output.

- Twilio voice-call: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures.

- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.

- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.

- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.

expect(release).toHaveBeenCalledTimes(1);

});

it("wraps malformed json success responses with an owned error", async () => {

const release = vi.fn(async () => {});

fetchWithSsrFGuardMock.mockResolvedValue({

response: new Response("{not json", { status: 200 }),

release,

});

await expect(

twilioApiRequest({

baseUrl: "https://api.twilio.com",

accountSid: "AC123",

authToken: "secret",

endpoint: "/Calls.json",

body: {},

}),

).rejects.toThrow("Twilio API returned malformed JSON.");

expect(release).toHaveBeenCalledTimes(1);

});

it("exposes structured Twilio error codes from json error bodies", async () => {

const release = vi.fn(async () => {});

fetchWithSsrFGuardMock.mockResolvedValue({

}

const text = await response.text();

return text ? (JSON.parse(text) as T) : (undefined as T);

if (!text) {

return undefined as T;

}

try {

return JSON.parse(text) as T;

} catch {

throw new Error("Twilio API returned malformed JSON.");

}

} finally {

await release();

}