- Google Meet: report malformed node-host params JSON with plugin-owned errors instead of leaking raw JSON parser failures.

- CLI/export-trajectory: report malformed encoded request JSON with a stable CLI error instead of leaking raw parser output.

- Twilio voice-call: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures.

- Voice-call provider APIs: report malformed successful guarded JSON responses with provider-prefixed errors instead of leaking raw parser failures.

- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.

- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.

- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.

expect(release).toHaveBeenCalledTimes(1);

});

it("throws prefixed errors for malformed json success responses", async () => {

const release = vi.fn(async () => {});

fetchWithSsrFGuardMock.mockResolvedValue({

response: new Response("{not json", { status: 200 }),

release,

});

await expect(

guardedJsonApiRequest({

url: "https://api.example.com/v1/calls/4",

method: "GET",

headers: {},

allowedHostnames: ["api.example.com"],

auditContext: "voice-call:test",

errorPrefix: "provider error",

}),

).rejects.toThrow("provider error: malformed JSON response");

expect(release).toHaveBeenCalledTimes(1);

});

});

}

const text = await response.text();

return text ? (JSON.parse(text) as T) : (undefined as T);

if (!text) {

return undefined as T;

}

try {

return JSON.parse(text) as T;

} catch {

throw new Error(`${params.errorPrefix}: malformed JSON response`);

}

} finally {

await release();

}