In `@config/config_helpers_test.go`:
- Around line 559-589: In TestIntegration_ExpandAndFilter replace the manual
os.Setenv("OPENAI_API_KEY", ...) and deferred os.Unsetenv call with
t.Setenv("OPENAI_API_KEY", "sk-openai-123") to ensure the environment variable
is automatically restored on test exit; update the setup in the
TestIntegration_ExpandAndFilter t.Run block so it uses t.Setenv and remove the
os.Unsetenv defer, keeping the rest of the test logic (cfg := defaultConfig(),
cfg.Providers setup, removeEmptyProviders(&cfg) and assertions) unchanged.
- Around line 549-556: The test "skips when no env vars set" can fail if
provider environment variables are present; update the subtest to clear provider
env vars before running by calling the existing clearProviderEnvVars(t) helper
(or implement an equivalent local cleanup) prior to creating cfg and calling
applyProviderEnvVars; reference the test helpers and functions
applyProviderEnvVars and defaultConfig to locate where to add the call, and
ensure any teardown/restoration of env vars is handled so other tests are
unaffected.

In `@config/config_test.go`:
- Around line 48-61: The helper withTempDir mutates the process-wide working
directory (via os.Chdir) which is not safe for tests run with t.Parallel and
also relies on t.Cleanup LIFO behavior when called multiple times (e.g.,
TestLoad_HTTPConfig); update the function comment to explicitly warn about these
constraints—add a note like “NOTE: Not safe for parallel tests — changes
process-wide cwd; relies on t.Cleanup LIFO ordering when called multiple times”
next to the withTempDir declaration so future contributors see the limitation.
- Around line 9-46: Add a one-line clarifying comment above the t.Setenv +
os.Unsetenv calls in clearProviderEnvVars and clearAllConfigEnvVars explaining
the pattern: use t.Setenv to register test cleanup/restoration and then
os.Unsetenv to remove the env var for the test run (so it’s truly absent, not
just empty); place the comment just before the loop or immediately above the
t.Setenv call and reference the use of t.Setenv and os.Unsetenv in the comment
for clarity.

In `@config/config.example.yaml`:
- Around line 30-37: The logging defaults are inconsistent: update the
configuration so the YAML keys logging.log_bodies and logging.log_headers match
the environment variables LOGGING_LOG_BODIES and LOGGING_LOG_HEADERS in
.env.template; choose the intended default (true or false), set that value
consistently in config.example.yaml and .env.template, and update any related
documentation/comments to reflect the chosen default so users see the same
recommended setting across files.

In `@config/config.go`:
- Around line 466-494: Update the comment for expandString to explicitly state
that environment variables set to the empty string are treated as unset:
`${VAR}` will remain literal `${VAR}` and `${VAR:-default}` will use the default
value (matching bash `:-` semantics), and mention this is intentional and may
surprise users who explicitly set an empty value; place the doc comment
immediately above the expandString function (reference: expandString) so callers
and maintainers see the behavior (you can also add a short note next to
parseBool if desired for consistency).
- Around line 416-450: The Ollama-specific guard inside applyProviderEnvVars
(the if checking kp.providerType == "ollama" && apiKey == "" && baseURL == "")
is unreachable because the earlier continue already skips when apiKey == "" &&
baseURL == ""; remove that dead branch from applyProviderEnvVars (referencing
knownProviders and kp.providerType == "ollama") so the function simply uses the
existing generic env-var handling and provider override/add logic without the
redundant special-case check.
- Around line 249-252: In Load(), don’t discard the error from godotenv.Load():
capture err := godotenv.Load() and if err != nil then allow the "file not found"
case to be ignored (errors.Is(err, fs.ErrNotExist) or errors.Is(err,
os.ErrNotExist)) but return the error (or wrap it with context) for any other
parse/read error so syntax problems in the .env surface; update the Load()
function to use that check around godotenv.Load() and return the wrapped error
from Load() when appropriate.

In `@docs/advanced/configuration.mdx`:
- Around line 164-188: Add a security notice near the YAML example warning users
not to commit secrets like master_key and api_key (or config/config.yaml) into
source control and show a safe alternative using environment variable expansion
(e.g. ${ENV_VAR}) instead of plaintext; add a <Warning> block immediately above
or below the code sample that explicitly calls out master_key and api_key and
demonstrates replacing them with ${OPENAI_API_KEY} / ${MASTER_KEY} placeholders
and a brief line about keeping actual config files out of git.
- Around line 42-46: Update the docs table to match the actual default for
BODY_SIZE_LIMIT: change the Default column for `BODY_SIZE_LIMIT` from `_(no
limit)_` to `10M` to reflect the value set in config (DefaultBodySizeLimit = 10
* 1024 * 1024 in config/config.go) and the .env.template default; locate the
`BODY_SIZE_LIMIT` row in docs/advanced/configuration.mdx and replace the default
text accordingly.

In `@config/config.example.yaml`:
- Around line 89-92: Add a consistent blank line separator between the Groq
example comment ("api_key: \"${GROQ_API_KEY}\"") and the next provider header
("# azure-openai:") so the provider blocks match the spacing used elsewhere
(e.g., the blocks around lines with "azure-openai" and the preceding Groq
example should each have one blank line separating them and the block body).
Locate the commented Groq API key line and the "# azure-openai:" header and
adjust spacing so there is one blank line before and after provider headers to
normalize formatting across example blocks.
- Around line 85-101: The examples use shell-style `"${VAR}"` which yaml.v3 will
parse as literal strings and not interpolate environment variables; update the
commented provider examples (the groq, azure-openai, deepseek blocks) to replace
`"${GROQ_API_KEY}"`, `"${AZURE_OPENAI_API_KEY}"`, and `"${DEEPSEEK_API_KEY}"`
with plain placeholder text (e.g. "YOUR_API_KEY") or add a short inline comment
that these are illustrative only and env vars are injected by the code path that
calls applyProviderEnvVars; ensure all three commented examples are changed
consistently.