- File transfer: reject malformed inline `file_write` base64 before computing hashes or invoking paired nodes, avoiding Node's lenient base64 decoder.

- QA channel: skip malformed inline inbound attachment base64 instead of staging silently corrupted media for agent turns.

- Microsoft Teams: reject malformed inline HTML image base64 padding instead of decoding corrupted `data:` image attachments.

- Voice-call realtime: ignore malformed provider media-frame base64 before forwarding audio into bridge and transcription paths.

- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.

- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.

- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.

expect(

adapter.parseInbound(JSON.stringify({ event: "start", start: { streamSid: "MZ-only" } })),

).toEqual({ kind: "ignored" });

expect(

adapter.parseInbound(JSON.stringify({ event: "media", media: { payload: "AAA@@@" } })),

).toEqual({ kind: "ignored" });

});

it("serializes outbound frames with the streamSid captured at start", () => {

const adapter = new TelnyxStreamFrameAdapter();

expect(adapter.parseInbound("not json")).toEqual({ kind: "ignored" });

expect(adapter.parseInbound(JSON.stringify({ event: "media" }))).toEqual({ kind: "ignored" });

expect(

adapter.parseInbound(JSON.stringify({ event: "media", media: { payload: "AAA@@@" } })),

).toEqual({ kind: "ignored" });

expect(adapter.parseInbound(JSON.stringify({ event: "something-else" }))).toEqual({

kind: "ignored",

});

return null;

}

function normalizeBase64ForCompare(value: string): string {

return value.replace(/=+$/u, "").replace(/-/gu, "+").replace(/_/gu, "/");

}

function isValidBase64Payload(value: string): boolean {

const buffer = Buffer.from(value, "base64");

return normalizeBase64ForCompare(buffer.toString("base64")) === normalizeBase64ForCompare(value);

}

export class TwilioStreamFrameAdapter implements StreamFrameAdapter {

readonly providerName = "twilio" as const;

private streamSid = "";

? (msg.media as Record<string, unknown>)

: undefined;

const payload = typeof mediaData?.payload === "string" ? mediaData.payload : undefined;

if (!payload) {

if (!payload || !isValidBase64Payload(payload)) {

return { kind: "ignored" };

}

return {

? (msg.media as Record<string, unknown>)

: undefined;

const payload = typeof mediaData?.payload === "string" ? mediaData.payload : undefined;

if (!payload) {

if (!payload || !isValidBase64Payload(payload)) {

return { kind: "ignored" };

}

return {