- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.

- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.

- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.

- Matrix: ignore malformed percent-encoding in optional location URI parameters instead of letting a bad `geo:` event abort inbound message handling.

- Plugins: discover provider plugins from `setup.providers[].envVars` credentials during provider discovery while keeping the deprecated `providerAuthEnvVars` fallback. (#81542) Thanks @JARVIS-Glasses.

- Docs/Codex harness: clarify that per-agent `CODEX_HOME` isolates `~/.codex` while inherited `HOME` intentionally keeps `.agents` discovery and subprocess user-home state available.

- CLI/plugins: keep bare plugin and parent-command help on the lightweight path, avoiding plugin registry discovery before rendering help.

import { describe, expect, it } from "vitest";

import { resolveMatrixLocation } from "./location.js";

import { EventType } from "./types.js";

describe("resolveMatrixLocation", () => {

it("decodes encoded geo uri accuracy", () => {

const result = resolveMatrixLocation({

eventType: EventType.Location,

content: {

msgtype: EventType.Location,

geo_uri: "geo:1.5,2.5;u=%31%30",

},

});

expect(result?.context).toMatchObject({

LocationLat: 1.5,

LocationLon: 2.5,

LocationAccuracy: 10,

});

});

it("ignores malformed geo uri parameter encoding", () => {

const result = resolveMatrixLocation({

eventType: EventType.Location,

content: {

msgtype: EventType.Location,

geo_uri: "geo:1.5,2.5;u=%zz",

},

});

expect(result?.context).toMatchObject({

LocationLat: 1.5,

LocationLon: 2.5,

});

expect(result?.context.LocationAccuracy).toBeUndefined();

});

});

accuracy?: number;

};

function decodeGeoUriParamValue(value: string): string {

try {

return decodeURIComponent(value);

} catch {

return value;

}

}

function parseGeoUri(value: string): GeoUriParams | null {

const trimmed = value.trim();

if (!trimmed) {

continue;

}

const valuePart = rawValue.trim();

params.set(key, valuePart ? decodeURIComponent(valuePart) : "");

params.set(key, valuePart ? decodeGeoUriParamValue(valuePart) : "");

}

const accuracyRaw = params.get("u");