@openclaw/voice-call 2026.7.1 → 2026.7.2-beta.2

package/dist/{runtime-entry-DwMgbq2p.js → runtime-entry-DSgyqIwE.js}

@@ -1,27 +1,658 @@
-import { isBlockedHostnameOrIp, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "./runtime-api.js";
+import { TtsConfigSchema, isBlockedHostnameOrIp, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "./runtime-api.js";
 import "./api.js";
-import { a as resolveVoiceCallEffectiveConfig, c as validateProviderConfig, d as deepMergeDefined, i as resolveVoiceCallConfig, n as normalizeVoiceCallConfig, o as resolveVoiceCallNumberRouteKeyForCall, r as resolveTwilioAuthToken, s as resolveVoiceCallSessionKey } from "./config-CDSeuGp3.js";
-import { c as findCallMatchesInStore, f as persistCallRecord, g as TerminalStates, h as setVoiceCallStateRuntime, l as getCallHistoryFromStore, u as loadActiveCallsFromStore } from "./store-DtewuuOb.js";
+import { t as TWILIO_REGIONS } from "./twilio-region-4fkgz3UG.js";
+import { _ as TerminalStates, d as loadActiveCallsFromStore, g as setVoiceCallStateRuntime, l as findCallMatchesInStore, p as persistCallRecord, t as resolveDefaultVoiceCallStoreDir, u as getCallHistoryFromStore } from "./store-path-nYL-yM0S.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { isLoopbackHost } from "openclaw/plugin-sdk/gateway-runtime";
 import { MAX_TIMER_TIMEOUT_MS, asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
-import { REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, buildRealtimeVoiceAgentConsultPolicyInstructions, consultRealtimeVoiceAgent, convertPcmToMulaw8k, createTalkSessionController, recordTalkObservabilityEvent, resolveRealtimeVoiceAgentConsultTools, resolveRealtimeVoiceAgentConsultToolsAllow, resolveRealtimeVoiceFastContextConsult } from "openclaw/plugin-sdk/realtime-voice";
+import { REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, REALTIME_VOICE_AGENT_CONSULT_TOOL_POLICIES, assertRealtimeVoiceAgentConsultModelSelectionUnlocked, buildRealtimeVoiceAgentConsultPolicyInstructions, consultRealtimeVoiceAgent, convertPcmToMulaw8k, createTalkSessionController, recordTalkObservabilityEvent, resolveRealtimeVoiceAgentConsultTools, resolveRealtimeVoiceAgentConsultToolsAllow, resolveRealtimeVoiceFastContextConsult } from "openclaw/plugin-sdk/realtime-voice";
+import { mergeDeep } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { canonicalizeMainSessionAlias } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveSpeechProviderApiKey } from "openclaw/plugin-sdk/speech-core";
 import { WEBHOOK_BODY_READ_DEFAULTS, createWebhookInFlightLimiter, normalizeWebhookPath } from "openclaw/plugin-sdk/webhook-ingress";
+import { z } from "zod";
 import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
 import crypto from "node:crypto";
+import { redactIdentifier } from "openclaw/plugin-sdk/logging-core";
+import path from "node:path";
+import os from "node:os";
 import { root } from "openclaw/plugin-sdk/security-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
+import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { parseTtsDirectives } from "openclaw/plugin-sdk/speech";
 import { spawn } from "node:child_process";
+import { runCommandWithTimeout } from "openclaw/plugin-sdk/process-runtime";
 import http from "node:http";
 import { URL as URL$1 } from "node:url";
 import { resolveConfiguredCapabilityProvider } from "openclaw/plugin-sdk/provider-selection-runtime";
 import { WebSocket, WebSocketServer } from "ws";
+//#region extensions/voice-call/src/realtime-defaults.ts
+/** Baseline instructions that keep realtime calls brief and route deep work to agent consult. */
+const DEFAULT_VOICE_CALL_REALTIME_INSTRUCTIONS = `You are OpenClaw's phone-call realtime voice interface. Keep spoken replies brief and natural. When a question needs deeper reasoning, current information, or tools, call ${REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME} before answering.`;
+//#endregion
+//#region extensions/voice-call/src/config.ts
+/**
+* E.164 phone number format: +[country code][number]
+* Examples use 555 prefix (reserved for fictional numbers)
+*/
+const E164Schema = z.string().regex(/^\+[1-9]\d{1,14}$/, "Expected E.164 format, e.g. +15550001234");
+/**
+* Controls how inbound calls are handled:
+* - "disabled": Block all inbound calls (outbound only)
+* - "allowlist": Only accept calls from numbers in allowFrom
+* - "pairing": Unknown callers can request pairing (future)
+* - "open": Accept all inbound calls (dangerous!)
+*/
+const InboundPolicySchema = z.enum([
+	"disabled",
+	"allowlist",
+	"pairing",
+	"open"
+]);
+const SecretInputSchema = buildSecretInputSchema();
+const TelnyxConfigSchema = z.object({
+	/** Telnyx API v2 key */
+	apiKey: z.string().min(1).optional(),
+	/** Telnyx connection ID (from Call Control app) */
+	connectionId: z.string().min(1).optional(),
+	/** Public key for webhook signature verification */
+	publicKey: z.string().min(1).optional()
+}).strict();
+const TwilioConfigSchema = z.object({
+	/** Twilio Account SID */
+	accountSid: z.string().min(1).optional(),
+	/** Twilio Auth Token */
+	authToken: SecretInputSchema.optional(),
+	/** Twilio processing Region (for example, ie1) */
+	region: z.enum(TWILIO_REGIONS).optional()
+}).strict();
+const PlivoConfigSchema = z.object({
+	/** Plivo Auth ID (starts with MA/SA) */
+	authId: z.string().min(1).optional(),
+	/** Plivo Auth Token */
+	authToken: z.string().min(1).optional()
+}).strict();
+const VoiceCallNumberRouteConfigSchema = z.object({
+	/** Greeting message for inbound calls to this number. */
+	inboundGreeting: z.string().optional(),
+	/** TTS override for inbound calls to this number. Deep-merges with global voice-call TTS. */
+	tts: TtsConfigSchema,
+	/** Agent ID to use for voice response generation for this number. */
+	agentId: z.string().min(1).optional(),
+	/** Optional model override for voice responses for this number. */
+	responseModel: z.string().optional(),
+	/** System prompt for voice responses for this number. */
+	responseSystemPrompt: z.string().optional(),
+	/** Timeout for response generation in ms for this number. */
+	responseTimeoutMs: z.number().int().positive().optional()
+}).strict();
+const VoiceCallServeConfigSchema = z.object({
+	/** Port to listen on */
+	port: z.number().int().positive().default(3334),
+	/** Bind address */
+	bind: z.string().default("127.0.0.1"),
+	/** Webhook path */
+	path: z.string().min(1).default("/voice/webhook")
+}).strict().default({
+	port: 3334,
+	bind: "127.0.0.1",
+	path: "/voice/webhook"
+});
+const VoiceCallTailscaleConfigSchema = z.object({
+	/**
+	* Tailscale exposure mode:
+	* - "off": No Tailscale exposure
+	* - "serve": Tailscale serve (private to tailnet)
+	* - "funnel": Tailscale funnel (public HTTPS)
+	*/
+	mode: z.enum([
+		"off",
+		"serve",
+		"funnel"
+	]).default("off"),
+	/** Path for Tailscale serve/funnel (should usually match serve.path) */
+	path: z.string().min(1).default("/voice/webhook")
+}).strict().default({
+	mode: "off",
+	path: "/voice/webhook"
+});
+const VoiceCallTunnelConfigSchema = z.object({
+	/**
+	* Tunnel provider:
+	* - "none": No tunnel (use publicUrl if set, or manual setup)
+	* - "ngrok": Use ngrok for public HTTPS tunnel
+	* - "tailscale-serve": Tailscale serve (private to tailnet)
+	* - "tailscale-funnel": Tailscale funnel (public HTTPS)
+	*/
+	provider: z.enum([
+		"none",
+		"ngrok",
+		"tailscale-serve",
+		"tailscale-funnel"
+	]).default("none"),
+	/** ngrok auth token (optional, enables longer sessions and more features) */
+	ngrokAuthToken: z.string().min(1).optional(),
+	/** ngrok custom domain (paid feature, e.g., "myapp.ngrok.io") */
+	ngrokDomain: z.string().min(1).optional(),
+	/**
+	* Allow ngrok free tier compatibility mode.
+	* When true, forwarded headers may be trusted for loopback requests
+	* to reconstruct the public ngrok URL used for signing.
+	*
+	* IMPORTANT: This does NOT bypass signature verification.
+	*/
+	allowNgrokFreeTierLoopbackBypass: z.boolean().default(false)
+}).strict().default({
+	provider: "none",
+	allowNgrokFreeTierLoopbackBypass: false
+});
+const VoiceCallWebhookSecurityConfigSchema = z.object({
+	/**
+	* Allowed hostnames for webhook URL reconstruction.
+	* Only these hosts are accepted from forwarding headers.
+	*/
+	allowedHosts: z.array(z.string().min(1)).default([]),
+	/**
+	* Trust X-Forwarded-* headers without a hostname allowlist.
+	* WARNING: Only enable if you trust your proxy configuration.
+	*/
+	trustForwardingHeaders: z.boolean().default(false),
+	/**
+	* Trusted proxy IP addresses. Forwarded headers are only trusted when
+	* the remote IP matches one of these addresses.
+	*/
+	trustedProxyIPs: z.array(z.string().min(1)).default([])
+}).strict().default({
+	allowedHosts: [],
+	trustForwardingHeaders: false,
+	trustedProxyIPs: []
+});
+/**
+* Call mode determines how outbound calls behave:
+* - "notify": Deliver message and auto-hangup after delay (one-way notification)
+* - "conversation": Stay open for back-and-forth until explicit end or timeout
+*/
+const CallModeSchema = z.enum(["notify", "conversation"]);
+const VoiceCallSessionScopeSchema = z.enum(["per-phone", "per-call"]);
+const OutboundConfigSchema = z.object({
+	/** Default call mode for outbound calls */
+	defaultMode: CallModeSchema.default("notify"),
+	/** Seconds to wait after TTS before auto-hangup in notify mode */
+	notifyHangupDelaySec: z.number().int().nonnegative().default(3)
+}).strict().default({
+	defaultMode: "notify",
+	notifyHangupDelaySec: 3
+});
+const RealtimeToolSchema = z.object({
+	type: z.literal("function"),
+	name: z.string().min(1),
+	description: z.string(),
+	parameters: z.object({
+		type: z.literal("object"),
+		properties: z.record(z.string(), z.unknown()),
+		required: z.array(z.string()).optional()
+	})
+}).strict();
+const VoiceCallRealtimeProvidersConfigSchema = z.record(z.string(), z.record(z.string(), z.unknown())).default({});
+const VoiceCallRealtimeToolPolicySchema = z.enum(REALTIME_VOICE_AGENT_CONSULT_TOOL_POLICIES);
+const VoiceCallRealtimeConsultPolicySchema = z.enum([
+	"auto",
+	"substantive",
+	"always"
+]);
+const VoiceCallRealtimeFastContextSourceSchema = z.enum(["memory", "sessions"]);
+const VoiceCallRealtimeFastContextConfigSchema = z.object({
+	/** Enable bounded memory/session lookup before the full consult agent. */
+	enabled: z.boolean().default(false),
+	/** Hard deadline for the fast context lookup. */
+	timeoutMs: z.number().int().positive().default(800),
+	/** Maximum memory/session hits to inject into the realtime tool result. */
+	maxResults: z.number().int().positive().default(3),
+	/** Indexed sources used by the fast context lookup. */
+	sources: z.array(VoiceCallRealtimeFastContextSourceSchema).min(1).default(["memory", "sessions"]),
+	/** Fall back to the full agent consult when fast context has no answer. */
+	fallbackToConsult: z.boolean().default(false)
+}).strict().default({
+	enabled: false,
+	timeoutMs: 800,
+	maxResults: 3,
+	sources: ["memory", "sessions"],
+	fallbackToConsult: false
+});
+const VoiceCallRealtimeAgentContextConfigSchema = z.object({
+	/** Inject a compact agent persona/context capsule into realtime voice instructions. */
+	enabled: z.boolean().default(false),
+	/** Maximum number of characters from the generated capsule to append. */
+	maxChars: z.number().int().positive().default(6e3),
+	/** Include configured agent identity fields. */
+	includeIdentity: z.boolean().default(true),
+	/** Include selected workspace files such as SOUL.md and IDENTITY.md. */
+	includeWorkspaceFiles: z.boolean().default(true),
+	/** Workspace-relative files to include, bounded by maxChars. */
+	files: z.array(z.string().min(1)).default([
+		"SOUL.md",
+		"IDENTITY.md",
+		"USER.md"
+	])
+}).strict().default({
+	enabled: false,
+	maxChars: 6e3,
+	includeIdentity: true,
+	includeWorkspaceFiles: true,
+	files: [
+		"SOUL.md",
+		"IDENTITY.md",
+		"USER.md"
+	]
+});
+const VoiceCallRealtimeConsultThinkingLevelSchema = z.enum([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"adaptive",
+	"max",
+	"ultra"
+]);
+const VoiceCallStreamingProvidersConfigSchema = z.record(z.string(), z.record(z.string(), z.unknown())).default({});
+const VoiceCallRealtimeConfigSchema = z.object({
+	/** Enable realtime voice-to-voice mode. */
+	enabled: z.boolean().default(false),
+	/** Provider id from registered realtime voice providers. */
+	provider: z.string().min(1).optional(),
+	/** Optional override for the local WebSocket route path. */
+	streamPath: z.string().min(1).optional(),
+	/** System instructions passed to the realtime provider. */
+	instructions: z.string().default(DEFAULT_VOICE_CALL_REALTIME_INSTRUCTIONS),
+	/** Tool policy for the shared OpenClaw agent consult tool. */
+	toolPolicy: VoiceCallRealtimeToolPolicySchema.default("safe-read-only"),
+	/** Guidance for when the realtime model should call the OpenClaw agent consult tool. */
+	consultPolicy: VoiceCallRealtimeConsultPolicySchema.default("auto"),
+	/** Optional thinking level override for the regular agent behind realtime consults. */
+	consultThinkingLevel: VoiceCallRealtimeConsultThinkingLevelSchema.optional(),
+	/** Optional fast mode override for the regular agent behind realtime consults. */
+	consultFastMode: z.boolean().optional(),
+	/** Tool definitions exposed to the realtime provider. */
+	tools: z.array(RealtimeToolSchema).default([]),
+	/** Low-latency memory/session context for the consult tool. */
+	fastContext: VoiceCallRealtimeFastContextConfigSchema,
+	/** Bounded agent persona/context injection for the fast realtime voice path. */
+	agentContext: VoiceCallRealtimeAgentContextConfigSchema,
+	/** Provider-owned raw config blobs keyed by provider id. */
+	providers: VoiceCallRealtimeProvidersConfigSchema
+}).strict().default({
+	enabled: false,
+	instructions: DEFAULT_VOICE_CALL_REALTIME_INSTRUCTIONS,
+	toolPolicy: "safe-read-only",
+	consultPolicy: "auto",
+	tools: [],
+	fastContext: {
+		enabled: false,
+		timeoutMs: 800,
+		maxResults: 3,
+		sources: ["memory", "sessions"],
+		fallbackToConsult: false
+	},
+	agentContext: {
+		enabled: false,
+		maxChars: 6e3,
+		includeIdentity: true,
+		includeWorkspaceFiles: true,
+		files: [
+			"SOUL.md",
+			"IDENTITY.md",
+			"USER.md"
+		]
+	},
+	providers: {}
+});
+const VoiceCallStreamingConfigSchema = z.object({
+	/** Enable Twilio Media Streams for real-time transcription. */
+	enabled: z.boolean().default(false),
+	/** Provider id from registered realtime transcription providers. */
+	provider: z.string().min(1).optional(),
+	/** WebSocket path for media stream connections */
+	streamPath: z.string().min(1).default("/voice/stream"),
+	/** Provider-owned raw config blobs keyed by provider id. */
+	providers: VoiceCallStreamingProvidersConfigSchema,
+	/**
+	* Close unauthenticated media stream sockets if no valid `start` frame arrives in time.
+	* Protects against pre-auth idle connection hold attacks.
+	*/
+	preStartTimeoutMs: z.number().int().positive().default(5e3),
+	/** Maximum number of concurrently pending (pre-start) media stream sockets. */
+	maxPendingConnections: z.number().int().positive().default(32),
+	/** Maximum pending media stream sockets per source IP. */
+	maxPendingConnectionsPerIp: z.number().int().positive().default(4),
+	/** Hard cap for all open media stream sockets (pending + active). */
+	maxConnections: z.number().int().positive().default(128)
+}).strict().default({
+	enabled: false,
+	streamPath: "/voice/stream",
+	providers: {},
+	preStartTimeoutMs: 5e3,
+	maxPendingConnections: 32,
+	maxPendingConnectionsPerIp: 4,
+	maxConnections: 128
+});
+const VoiceCallConfigSchema = z.object({
+	/** Enable voice call functionality */
+	enabled: z.boolean().default(false),
+	/** Active provider (telnyx, twilio, plivo, or mock) */
+	provider: z.enum([
+		"telnyx",
+		"twilio",
+		"plivo",
+		"mock"
+	]).optional(),
+	/** Telnyx-specific configuration */
+	telnyx: TelnyxConfigSchema.optional(),
+	/** Twilio-specific configuration */
+	twilio: TwilioConfigSchema.optional(),
+	/** Plivo-specific configuration */
+	plivo: PlivoConfigSchema.optional(),
+	/** Phone number to call from (E.164) */
+	fromNumber: E164Schema.optional(),
+	/** Default phone number to call (E.164) */
+	toNumber: E164Schema.optional(),
+	/** Inbound call policy */
+	inboundPolicy: InboundPolicySchema.default("disabled"),
+	/** Allowlist of phone numbers for inbound calls (E.164) */
+	allowFrom: z.array(E164Schema).default([]),
+	/** Greeting message for inbound calls */
+	inboundGreeting: z.string().optional(),
+	/** Per-dialed-number overrides for inbound calls. Keys are E.164 numbers. */
+	numbers: z.record(E164Schema, VoiceCallNumberRouteConfigSchema).default({}),
+	/** Outbound call configuration */
+	outbound: OutboundConfigSchema,
+	/** Maximum call duration in seconds */
+	maxDurationSeconds: z.number().int().positive().default(300),
+	/**
+	* Maximum age of a call in seconds before it is automatically reaped.
+	* Catches calls stuck before answer (for example, local mock calls that
+	* never receive provider webhooks). Set to 0 to disable.
+	*/
+	staleCallReaperSeconds: z.number().int().nonnegative().default(120),
+	/** Silence timeout for end-of-speech detection (ms) */
+	silenceTimeoutMs: z.number().int().positive().default(800),
+	/** Timeout for user transcript (ms) */
+	transcriptTimeoutMs: z.number().int().positive().default(18e4),
+	/** Ring timeout for outbound calls (ms) */
+	ringTimeoutMs: z.number().int().positive().default(3e4),
+	/** Maximum concurrent calls */
+	maxConcurrentCalls: z.number().int().positive().default(1),
+	/** Webhook server configuration */
+	serve: VoiceCallServeConfigSchema,
+	/** @deprecated Prefer tunnel config. */
+	tailscale: VoiceCallTailscaleConfigSchema,
+	/** Tunnel configuration (unified ngrok/tailscale) */
+	tunnel: VoiceCallTunnelConfigSchema,
+	/** Webhook signature reconstruction and proxy trust configuration */
+	webhookSecurity: VoiceCallWebhookSecurityConfigSchema,
+	/** Real-time audio streaming configuration */
+	streaming: VoiceCallStreamingConfigSchema,
+	/** Realtime voice-to-voice configuration */
+	realtime: VoiceCallRealtimeConfigSchema,
+	/** Session memory scope for voice conversations. */
+	sessionScope: VoiceCallSessionScopeSchema.default("per-phone"),
+	/** Public webhook URL override (if set, bypasses tunnel auto-detection) */
+	publicUrl: z.string().url().optional(),
+	/** Skip webhook signature verification (development only, NOT for production) */
+	skipSignatureVerification: z.boolean().default(false),
+	/** TTS override (deep-merges with core messages.tts) */
+	tts: TtsConfigSchema,
+	/** Store path for call logs */
+	store: z.string().optional(),
+	/** Agent ID to use for voice response generation. Defaults to "main". */
+	agentId: z.string().min(1).optional(),
+	/** Optional model override for generating voice responses. */
+	responseModel: z.string().optional(),
+	/** System prompt for voice responses */
+	responseSystemPrompt: z.string().optional(),
+	/** Timeout for response generation in ms (default 30s) */
+	responseTimeoutMs: z.number().int().positive().default(3e4)
+}).strict();
+const TWILIO_AUTH_TOKEN_PATH = "plugins.entries.voice-call.config.twilio.authToken";
+const DEFAULT_VOICE_CALL_CONFIG = VoiceCallConfigSchema.parse({});
+function cloneDefaultVoiceCallConfig() {
+	return structuredClone(DEFAULT_VOICE_CALL_CONFIG);
+}
+function defaultRealtimeStreamPathForServePath(servePath) {
+	const normalized = normalizeWebhookPath(servePath);
+	if (normalized.endsWith("/webhook")) return `${normalized.slice(0, -8)}/stream/realtime`;
+	if (normalized === "/") return "/voice/stream/realtime";
+	return `${normalized}/stream/realtime`;
+}
+function normalizeVoiceCallTtsConfig(defaults, overrides) {
+	if (!defaults && !overrides) return;
+	return TtsConfigSchema.parse(mergeDeep(defaults ?? {}, overrides ?? {}));
+}
+function normalizePhoneRouteKey(phone) {
+	return phone?.replace(/\D/g, "") ?? "";
+}
+function resolveVoiceCallNumberRouteKey(config, phone) {
+	const routes = config.numbers;
+	if (!routes) return;
+	if (phone && Object.hasOwn(routes, phone)) return phone;
+	const normalizedPhone = normalizePhoneRouteKey(phone);
+	if (!normalizedPhone) return;
+	return Object.keys(routes).find((routeKey) => normalizePhoneRouteKey(routeKey) === normalizedPhone);
+}
+/** Resolve inbound-only number routing from a persisted call record. */
+function resolveVoiceCallNumberRouteKeyForCall(call) {
+	if (call.direction !== "inbound") return;
+	const storedRouteKey = call.metadata?.numberRouteKey;
+	if (typeof storedRouteKey === "string") return storedRouteKey;
+	return call.to;
+}
+function resolveVoiceCallEffectiveConfig(config, phoneOrRouteKey) {
+	const numberRouteKey = resolveVoiceCallNumberRouteKey(config, phoneOrRouteKey);
+	if (!numberRouteKey) return { config };
+	const route = config.numbers[numberRouteKey];
+	if (!route) return { config };
+	return {
+		numberRouteKey,
+		config: {
+			...config,
+			...route,
+			tts: normalizeVoiceCallTtsConfig(config.tts, route.tts),
+			numbers: config.numbers
+		}
+	};
+}
+function sanitizeVoiceCallProviderConfigs(value) {
+	if (!value) return {};
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
+}
+function sanitizeVoiceCallNumberRoutes(value) {
+	if (!value) return {};
+	return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0).map(([key, route]) => [key, VoiceCallNumberRouteConfigSchema.parse(route)]));
+}
+function resolveTwilioAuthToken(config) {
+	return normalizeResolvedSecretInputString({
+		value: config.twilio?.authToken,
+		path: TWILIO_AUTH_TOKEN_PATH
+	});
+}
+function normalizeVoiceCallConfig(config) {
+	const defaults = cloneDefaultVoiceCallConfig();
+	const serve = {
+		...defaults.serve,
+		...config.serve
+	};
+	const streamingProvider = config.streaming?.provider;
+	const streamingProviders = sanitizeVoiceCallProviderConfigs(config.streaming?.providers ?? defaults.streaming.providers);
+	const realtimeProvider = config.realtime?.provider ?? defaults.realtime.provider;
+	const realtimeProviders = sanitizeVoiceCallProviderConfigs(config.realtime?.providers ?? defaults.realtime.providers);
+	const realtimeFastContext = {
+		...defaults.realtime.fastContext,
+		...config.realtime?.fastContext,
+		sources: config.realtime?.fastContext?.sources ?? defaults.realtime.fastContext.sources
+	};
+	const realtimeAgentContext = {
+		...defaults.realtime.agentContext,
+		...config.realtime?.agentContext,
+		files: config.realtime?.agentContext?.files ?? defaults.realtime.agentContext.files
+	};
+	return {
+		...defaults,
+		...config,
+		allowFrom: config.allowFrom ?? defaults.allowFrom,
+		numbers: sanitizeVoiceCallNumberRoutes(config.numbers ?? defaults.numbers),
+		outbound: {
+			...defaults.outbound,
+			...config.outbound
+		},
+		serve,
+		tailscale: {
+			...defaults.tailscale,
+			...config.tailscale
+		},
+		tunnel: {
+			...defaults.tunnel,
+			...config.tunnel
+		},
+		webhookSecurity: {
+			...defaults.webhookSecurity,
+			...config.webhookSecurity,
+			allowedHosts: config.webhookSecurity?.allowedHosts ?? defaults.webhookSecurity.allowedHosts,
+			trustedProxyIPs: config.webhookSecurity?.trustedProxyIPs ?? defaults.webhookSecurity.trustedProxyIPs
+		},
+		streaming: {
+			...defaults.streaming,
+			...config.streaming,
+			provider: streamingProvider,
+			providers: streamingProviders
+		},
+		realtime: {
+			...defaults.realtime,
+			...config.realtime,
+			provider: realtimeProvider,
+			streamPath: config.realtime?.streamPath ?? defaultRealtimeStreamPathForServePath(serve.path ?? defaults.serve.path),
+			tools: config.realtime?.tools ?? defaults.realtime.tools,
+			consultThinkingLevel: VoiceCallRealtimeConsultThinkingLevelSchema.optional().parse(config.realtime?.consultThinkingLevel ?? defaults.realtime.consultThinkingLevel),
+			consultFastMode: config.realtime?.consultFastMode ?? defaults.realtime.consultFastMode,
+			fastContext: realtimeFastContext,
+			agentContext: realtimeAgentContext,
+			providers: realtimeProviders
+		},
+		tts: normalizeVoiceCallTtsConfig(defaults.tts, config.tts)
+	};
+}
+function resolveVoiceCallSessionKey(params) {
+	const explicit = params.explicitSessionKey?.trim();
+	if (explicit) return resolveVoiceCallAgentSessionKey({
+		config: params.config,
+		sessionKey: explicit,
+		coreSession: params.coreSession
+	});
+	const prefix = `agent:${normalizeAgentId(params.config.agentId)}:voice`;
+	if (params.config.sessionScope === "per-call") return `${prefix}:call:${params.callId}`.toLowerCase();
+	const normalizedPhone = params.phone?.replace(/\D/g, "");
+	return (normalizedPhone ? `${prefix}:${normalizedPhone}` : `${prefix}:${params.callId}`).toLowerCase();
+}
+/** Resolve persisted or integration-provided keys into the configured agent namespace. */
+function resolveVoiceCallAgentSessionKey(params) {
+	const sessionKey = params.sessionKey.trim();
+	if (!sessionKey) throw new Error("Voice Call session key cannot be empty");
+	const lower = sessionKey.toLowerCase();
+	const agentId = normalizeAgentId(params.config.agentId);
+	if (lower === "global" || lower === "unknown") return lower;
+	const parsedInput = parseAgentSessionKey(sessionKey);
+	let normalizedScopedKey;
+	if (parsedInput && normalizeAgentId(parsedInput.agentId) === parsedInput.agentId && parsedInput.agentId === agentId) normalizedScopedKey = `agent:${parsedInput.agentId}:${parsedInput.rest}`;
+	else {
+		const wrappedInput = parseAgentSessionKey(`agent:${agentId}:${sessionKey}`);
+		if (!wrappedInput) throw new Error("Voice Call session key could not be normalized");
+		normalizedScopedKey = `agent:${agentId}:${wrappedInput.rest}`;
+	}
+	const canonicalMain = canonicalizeMainSessionAlias({
+		cfg: { session: params.coreSession },
+		agentId,
+		sessionKey: normalizedScopedKey
+	});
+	return canonicalMain === normalizedScopedKey ? normalizedScopedKey : canonicalMain;
+}
+/**
+* Resolves the configuration by merging environment variables into missing fields.
+* Returns a new configuration object with environment variables applied.
+*/
+function resolveVoiceCallConfig(config) {
+	const resolved = normalizeVoiceCallConfig(config);
+	if (resolved.provider === "telnyx") {
+		resolved.telnyx = resolved.telnyx ?? {};
+		resolved.telnyx.apiKey = resolved.telnyx.apiKey ?? resolveSpeechProviderApiKey(process.env.TELNYX_API_KEY);
+		resolved.telnyx.connectionId = resolved.telnyx.connectionId ?? resolveSpeechProviderApiKey(process.env.TELNYX_CONNECTION_ID);
+		resolved.telnyx.publicKey = resolved.telnyx.publicKey ?? resolveSpeechProviderApiKey(process.env.TELNYX_PUBLIC_KEY);
+	}
+	if (resolved.provider === "twilio") {
+		resolved.fromNumber = resolved.fromNumber ?? resolveSpeechProviderApiKey(process.env.TWILIO_FROM_NUMBER);
+		resolved.twilio = resolved.twilio ?? {};
+		resolved.twilio.accountSid = resolved.twilio.accountSid ?? resolveSpeechProviderApiKey(process.env.TWILIO_ACCOUNT_SID);
+		resolved.twilio.authToken = resolved.twilio.authToken ?? resolveSpeechProviderApiKey(process.env.TWILIO_AUTH_TOKEN);
+	}
+	if (resolved.provider === "plivo") {
+		resolved.plivo = resolved.plivo ?? {};
+		resolved.plivo.authId = resolved.plivo.authId ?? resolveSpeechProviderApiKey(process.env.PLIVO_AUTH_ID);
+		resolved.plivo.authToken = resolved.plivo.authToken ?? resolveSpeechProviderApiKey(process.env.PLIVO_AUTH_TOKEN);
+	}
+	resolved.tunnel = resolved.tunnel ?? {
+		provider: "none",
+		allowNgrokFreeTierLoopbackBypass: false
+	};
+	resolved.tunnel.allowNgrokFreeTierLoopbackBypass = resolved.tunnel.allowNgrokFreeTierLoopbackBypass ?? false;
+	resolved.tunnel.ngrokAuthToken = resolved.tunnel.ngrokAuthToken ?? resolveSpeechProviderApiKey(process.env.NGROK_AUTHTOKEN);
+	resolved.tunnel.ngrokDomain = resolved.tunnel.ngrokDomain ?? resolveSpeechProviderApiKey(process.env.NGROK_DOMAIN);
+	resolved.webhookSecurity = resolved.webhookSecurity ?? {
+		allowedHosts: [],
+		trustForwardingHeaders: false,
+		trustedProxyIPs: []
+	};
+	resolved.webhookSecurity.allowedHosts = resolved.webhookSecurity.allowedHosts ?? [];
+	resolved.webhookSecurity.trustForwardingHeaders = resolved.webhookSecurity.trustForwardingHeaders ?? false;
+	resolved.webhookSecurity.trustedProxyIPs = resolved.webhookSecurity.trustedProxyIPs ?? [];
+	return normalizeVoiceCallConfig(resolved);
+}
+/**
+* Validate that the configuration has all required fields for the selected provider.
+*/
+function validateProviderConfig(config) {
+	const errors = [];
+	if (!config.enabled) return {
+		valid: true,
+		errors: []
+	};
+	if (!config.provider) errors.push("plugins.entries.voice-call.config.provider is required");
+	if (!config.fromNumber && config.provider !== "mock") errors.push(config.provider === "twilio" ? "plugins.entries.voice-call.config.fromNumber is required (or set TWILIO_FROM_NUMBER env)" : "plugins.entries.voice-call.config.fromNumber is required");
+	if (config.provider === "telnyx") {
+		if (!config.telnyx?.apiKey) errors.push("plugins.entries.voice-call.config.telnyx.apiKey is required (or set TELNYX_API_KEY env)");
+		if (!config.telnyx?.connectionId) errors.push("plugins.entries.voice-call.config.telnyx.connectionId is required (or set TELNYX_CONNECTION_ID env)");
+		if (!config.skipSignatureVerification && !config.telnyx?.publicKey) errors.push("plugins.entries.voice-call.config.telnyx.publicKey is required (or set TELNYX_PUBLIC_KEY env)");
+	}
+	if (config.provider === "twilio") {
+		if (!config.twilio?.accountSid) errors.push("plugins.entries.voice-call.config.twilio.accountSid is required (or set TWILIO_ACCOUNT_SID env)");
+		if (!hasConfiguredSecretInput(config.twilio?.authToken)) errors.push("plugins.entries.voice-call.config.twilio.authToken is required (or set TWILIO_AUTH_TOKEN env)");
+	}
+	if (config.provider === "plivo") {
+		if (!config.plivo?.authId) errors.push("plugins.entries.voice-call.config.plivo.authId is required (or set PLIVO_AUTH_ID env)");
+		if (!config.plivo?.authToken) errors.push("plugins.entries.voice-call.config.plivo.authToken is required (or set PLIVO_AUTH_TOKEN env)");
+	}
+	if (config.realtime.enabled && config.inboundPolicy === "disabled") errors.push("plugins.entries.voice-call.config.inboundPolicy must not be \"disabled\" when realtime.enabled is true");
+	if (config.realtime.enabled && config.streaming.enabled) errors.push("plugins.entries.voice-call.config.realtime.enabled and plugins.entries.voice-call.config.streaming.enabled cannot both be true");
+	if (config.streaming.enabled && config.provider && config.provider !== "twilio") errors.push("plugins.entries.voice-call.config.provider must be \"twilio\" when streaming.enabled is true");
+	if (config.realtime.enabled && config.provider && config.provider !== "twilio" && config.provider !== "telnyx" && config.provider !== "mock") errors.push("plugins.entries.voice-call.config.provider must be \"twilio\", \"telnyx\", or \"mock\" when realtime.enabled is true");
+	return {
+		valid: errors.length === 0,
+		errors
+	};
+}
+//#endregion
 //#region extensions/voice-call/src/allowlist.ts
 /** Normalize a phone number to digits only. */
 function normalizePhoneNumber(input) {
@@ -244,7 +875,7 @@ const DEFAULT_POLLY_VOICE = "Polly.Joanna";
 function mapVoiceToPolly(voice) {
 	if (!voice) return DEFAULT_POLLY_VOICE;
 	if (voice.startsWith("Polly.") || voice.startsWith("Google.")) return voice;
-	return OPENAI_TO_POLLY_MAP[normalizeLowercaseStringOrEmpty(voice)] || "Polly.Joanna";
+	return OPENAI_TO_POLLY_MAP[normalizeLowercaseStringOrEmpty(voice)] || DEFAULT_POLLY_VOICE;
 }
 //#endregion
 //#region extensions/voice-call/src/manager/twiml.ts
@@ -646,24 +1277,26 @@ async function endCall(ctx, callId, options) {
 }
 //#endregion
 //#region extensions/voice-call/src/manager/events.ts
+const log = createSubsystemLogger("voice-call/events");
 function shouldAcceptInbound(config, from) {
 	const { inboundPolicy: policy, allowFrom } = config;
 	switch (policy) {
 		case "disabled":
-			console.log("[voice-call] Inbound call rejected: policy is disabled");
+			log.info("Inbound call rejected: policy is disabled");
 			return false;
 		case "open":
-			console.log("[voice-call] Inbound call accepted: policy is open");
+			log.info("Inbound call accepted: policy is open");
 			return true;
 		case "allowlist":
 		case "pairing": {
 			const normalized = normalizePhoneNumber(from);
 			if (!normalized) {
-				console.log("[voice-call] Inbound call rejected: missing caller ID");
+				log.info("Inbound call rejected: missing caller ID");
 				return false;
 			}
 			const allowed = isAllowlistedCaller(normalized, allowFrom);
-			console.log(`[voice-call] Inbound call ${allowed ? "accepted" : "rejected"}: ${from} ${allowed ? "is in" : "not in"} allowlist`);
+			const status = allowed ? "accepted" : "rejected";
+			log.info(`Inbound call ${status}: caller=${redactIdentifier(from)} allowlisted=${allowed}`);
 			return allowed;
 		}
 		default: return false;
@@ -698,7 +1331,7 @@ function createWebhookCall(params) {
 	params.ctx.activeCalls.set(callId, callRecord);
 	params.ctx.providerCallIdMap.set(params.providerCallId, callId);
 	persistCallRecord(params.ctx.storePath, callRecord);
-	console.log(`[voice-call] Created ${params.direction} call record: ${callId} from ${params.from}`);
+	log.info(`Created ${params.direction} call record: ${callId} caller=${redactIdentifier(params.from)}`);
 	return callRecord;
 }
 function persistRejectedInboundCall(params) {
@@ -735,7 +1368,7 @@ function processEvent(ctx, event) {
 		if (eventDirection === "inbound" && !shouldAcceptInbound(ctx.config, event.from)) {
 			const pid = providerCallId;
 			if (!ctx.provider) {
-				console.warn(`[voice-call] Inbound call rejected by policy but no provider to hang up (providerCallId: ${pid}, from: ${event.from}); call will time out on provider side.`);
+				log.warn(`Inbound call rejected by policy but no provider to hang up (providerCallId: ${pid}, caller=${redactIdentifier(event.from)}); call will time out on provider side.`);
 				return { kind: "ignored" };
 			}
 			ctx.processedEventIds.add(dedupeKey);
@@ -748,7 +1381,7 @@ function processEvent(ctx, event) {
 				dedupeKey,
 				providerCallId: pid
 			});
-			console.log(`[voice-call] Rejecting inbound call by policy: ${pid}`);
+			log.info(`Rejecting inbound call by policy: ${pid}`);
 			ctx.provider.hangupCall({
 				callId,
 				providerCallId: pid,
@@ -756,7 +1389,7 @@ function processEvent(ctx, event) {
 			}).catch((err) => {
 				ctx.rejectedProviderCallIds.delete(pid);
 				const message = formatErrorMessage(err);
-				console.warn(`[voice-call] Failed to reject inbound call ${pid}:`, message);
+				log.warn(`Failed to reject inbound call ${pid}: ${message}`);
 			});
 			return { kind: "processed" };
 		}
@@ -803,7 +1436,7 @@ function processEvent(ctx, event) {
 					} : {}
 				}).catch((err) => {
 					const message = formatErrorMessage(err);
-					console.warn(`[voice-call] Failed to answer inbound call ${call.providerCallId}:`, message);
+					log.warn(`Failed to answer inbound call ${call.providerCallId}: ${message}`);
 				});
 			}
 			break;
@@ -843,7 +1476,7 @@ function processEvent(ctx, event) {
 				const hadWaiter = ctx.transcriptWaiters.has(call.callId);
 				const resolved = resolveTranscriptWaiter(ctx, call.callId, event.transcript, event.turnToken);
 				if (hadWaiter && !resolved) {
-					console.warn(`[voice-call] Ignoring speech event with mismatched turn token for ${call.callId}`);
+					log.warn(`Ignoring speech event with mismatched turn token for ${call.callId}`);
 					result = { kind: "ignored" };
 					break;
 				}
@@ -920,14 +1553,7 @@ function resolveRestoredMaxDurationAnchor(call) {
 function resolveDefaultStoreBase(config, storePath) {
 	const rawOverride = storePath?.trim() || config.store?.trim();
 	if (rawOverride) return resolveUserPath(rawOverride);
-	const preferred = path.join(os.homedir(), ".openclaw", "voice-calls");
-	return [preferred].map((dir) => resolveUserPath(dir)).find((dir) => {
-		try {
-			return fs.existsSync(path.join(dir, "calls.jsonl")) || fs.existsSync(dir);
-		} catch {
-			return false;
-		}
-	}) ?? resolveUserPath(preferred);
+	return resolveDefaultVoiceCallStoreDir();
 }
 /**
 * Manages voice calls: state ownership and delegation to manager helper modules.
@@ -1337,7 +1963,7 @@ function mergeTtsConfig(base, override) {
 	if (!base && !override) return;
 	if (!override) return base;
 	if (!base) return override;
-	return deepMergeDefined(base, override);
+	return mergeDeep(base, override);
 }
 /** Resolve directive override policy for telephony synthesis. */
 function resolveTelephonyModelOverridePolicy(overrides) {
@@ -1424,7 +2050,7 @@ function appendBoundedChildOutput(current, chunk, maxChars = DEFAULT_MAX_OUTPUT_
 		truncated: current.truncated
 	};
 	return {
-		text: appended.slice(-maxChars),
+		text: sliceUtf16Safe(appended, -maxChars),
 		truncated: true
 	};
 }
@@ -1435,77 +2061,32 @@ function formatBoundedChildOutput(output) {
 //#endregion
 //#region extensions/voice-call/src/webhook/tailscale.ts
 const TAILSCALE_COMMAND_STDOUT_MAX_BYTES = 4 * 1024 * 1024;
-function appendTailscaleCommandStdout(current, data, maxBytes = TAILSCALE_COMMAND_STDOUT_MAX_BYTES) {
-	if (current.exceeded) return current;
-	const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
-	const bytes = current.bytes + buffer.byteLength;
-	if (bytes > maxBytes) return {
-		bytes,
-		exceeded: true,
-		text: ""
-	};
-	return {
-		bytes,
-		exceeded: false,
-		text: `${current.text}${buffer.toString("utf8")}`
-	};
-}
-function runTailscaleCommand(args, timeoutMs = 2500) {
-	return new Promise((resolve) => {
-		const proc = spawn("tailscale", args, { stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		] });
-		let stdout = {
-			bytes: 0,
-			exceeded: false,
-			text: ""
+async function runTailscaleCommand(args, timeoutMs = 2500) {
+	try {
+		const result = await runCommandWithTimeout(["tailscale", ...args], {
+			killProcessTree: true,
+			maxOutputBytes: {
+				stdout: TAILSCALE_COMMAND_STDOUT_MAX_BYTES,
+				stderr: 1
+			},
+			outputCapture: "head",
+			terminateOnOutputLimit: { stdout: true },
+			timeoutMs
+		});
+		if (result.termination !== "exit" || result.outputLimitExceeded) return {
+			code: -1,
+			stdout: ""
 		};
-		let settled = false;
-		const finish = (result) => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timer);
-			resolve(result);
+		return {
+			code: result.code ?? -1,
+			stdout: result.stdout
 		};
-		const timer = setTimeout(() => {
-			proc.kill("SIGKILL");
-			finish({
-				code: -1,
-				stdout: ""
-			});
-		}, timeoutMs);
-		proc.stdout.on("data", (data) => {
-			stdout = appendTailscaleCommandStdout(stdout, data);
-			if (stdout.exceeded) {
-				proc.kill("SIGKILL");
-				finish({
-					code: -1,
-					stdout: ""
-				});
-			}
-		});
-		proc.stdout.on("error", () => {
-			proc.kill("SIGKILL");
-			finish({
-				code: -1,
-				stdout: ""
-			});
-		});
-		proc.on("error", () => {
-			finish({
-				code: -1,
-				stdout: ""
-			});
-		});
-		proc.on("close", (code) => {
-			finish({
-				code: code ?? -1,
-				stdout: stdout.text
-			});
-		});
-	});
+	} catch {
+		return {
+			code: -1,
+			stdout: ""
+		};
+	}
 }
 async function getTailscaleSelfInfo() {
 	const { code, stdout } = await runTailscaleCommand([
@@ -1576,6 +2157,8 @@ async function cleanupTailscaleExposure(config) {
 //#endregion
 //#region extensions/voice-call/src/tunnel.ts
 const NGROK_LOG_BUFFER_MAX_CHARS = 16384;
+const NGROK_ERROR_MARKER = "ERR_NGROK";
+const TUNNEL_COMMAND_OUTPUT_MAX_BYTES = 16384;
 function listenForChildStreamErrors(proc, onError) {
 	proc.stdout.on("error", (error) => onError("stdout", error));
 	proc.stderr.on("error", (error) => onError("stderr", error));
@@ -1615,6 +2198,7 @@ async function startNgrokTunnel(config) {
 		let closed = false;
 		let publicUrl = null;
 		let outputBuffer = "";
+		let stderrTail = "";
 		const timeout = setTimeout(() => {
 			if (!resolved) {
 				resolved = true;
@@ -1671,12 +2255,13 @@ async function startNgrokTunnel(config) {
 		proc.stdout.on("data", (data) => {
 			const lines = (outputBuffer + data.toString()).split("\n");
 			outputBuffer = lines.pop() || "";
-			if (outputBuffer.length > NGROK_LOG_BUFFER_MAX_CHARS) outputBuffer = outputBuffer.slice(-16384);
+			if (outputBuffer.length > NGROK_LOG_BUFFER_MAX_CHARS) outputBuffer = sliceUtf16Safe(outputBuffer, -16384);
 			for (const line of lines) if (line.trim()) processLine(line);
 		});
 		proc.stderr.on("data", (data) => {
-			const msg = data.toString();
-			if (msg.includes("ERR_NGROK")) rejectIfPending(`ngrok error: ${formatBoundedChildOutput(appendBoundedChildOutput(emptyBoundedChildOutput(), msg))}`, true);
+			const combined = stderrTail + data.toString();
+			if (combined.includes(NGROK_ERROR_MARKER)) rejectIfPending(`ngrok error: ${formatBoundedChildOutput(appendBoundedChildOutput(emptyBoundedChildOutput(), combined))}`, true);
+			stderrTail = sliceUtf16Safe(combined, -8);
 		});
 		listenForChildStreamErrors(proc, (stream, error) => {
 			rejectIfPending(`ngrok ${stream} error: ${error.message}`, true);
@@ -1698,41 +2283,22 @@ async function startNgrokTunnel(config) {
 * Run an ngrok command and wait for completion.
 */
 async function runNgrokCommand(args) {
-	return new Promise((resolve, reject) => {
-		const proc = spawn("ngrok", args, { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		let stdout = emptyBoundedChildOutput();
-		let stderr = emptyBoundedChildOutput();
-		let settled = false;
-		const rejectIfPending = (error, kill = false) => {
-			if (settled) return;
-			settled = true;
-			if (kill) proc.kill("SIGKILL");
-			reject(error);
-		};
-		proc.stdout.on("data", (data) => {
-			stdout = appendBoundedChildOutput(stdout, data.toString());
-		});
-		proc.stderr.on("data", (data) => {
-			stderr = appendBoundedChildOutput(stderr, data.toString());
-		});
-		listenForChildStreamErrors(proc, (stream, error) => {
-			rejectIfPending(/* @__PURE__ */ new Error(`ngrok command ${stream} error: ${error.message}`), true);
-		});
-		proc.on("close", (code) => {
-			if (settled) return;
-			settled = true;
-			if (code === 0) resolve(stdout.text);
-			else {
-				const output = stderr.text ? stderr : stdout;
-				reject(/* @__PURE__ */ new Error(`ngrok command failed: ${formatBoundedChildOutput(output)}`));
-			}
-		});
-		proc.on("error", (error) => rejectIfPending(error));
+	const result = await runCommandWithTimeout(["ngrok", ...args], {
+		killProcessTree: true,
+		maxOutputBytes: TUNNEL_COMMAND_OUTPUT_MAX_BYTES,
+		outputCapture: "tail",
+		timeoutMs: 3e4
 	});
+	if (result.termination === "timeout") throw new Error("ngrok command timed out");
+	if (result.code === 0) return result.stdout;
+	const output = result.stderr ? {
+		text: result.stderr,
+		truncated: Boolean(result.stderrTruncatedBytes)
+	} : {
+		text: result.stdout,
+		truncated: Boolean(result.stdoutTruncatedBytes)
+	};
+	throw new Error(`ngrok command failed: ${formatBoundedChildOutput(output)}`);
 }
 /**
 * Start a Tailscale serve/funnel tunnel.
@@ -1742,89 +2308,56 @@ async function startTailscaleTunnel(config) {
 	if (!dnsName) throw new Error("Could not get Tailscale DNS name. Is Tailscale running?");
 	const path = config.path.startsWith("/") ? config.path : `/${config.path}`;
 	const localUrl = `http://127.0.0.1:${config.port}${path}`;
-	return new Promise((resolve, reject) => {
-		const proc = spawn("tailscale", [
-			config.mode,
-			"--bg",
-			"--yes",
-			"--set-path",
-			path,
-			localUrl
-		], { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		let resolved = false;
-		let stdout = emptyBoundedChildOutput();
-		let stderr = emptyBoundedChildOutput();
-		const rejectIfPending = (error, kill = false) => {
-			if (resolved) return;
-			resolved = true;
-			clearTimeout(timeout);
-			if (kill) proc.kill("SIGKILL");
-			reject(error);
-		};
-		const timeout = setTimeout(() => {
-			rejectIfPending(/* @__PURE__ */ new Error(`Tailscale ${config.mode} timed out`), true);
-		}, 1e4);
-		proc.stdout.on("data", (data) => {
-			stdout = appendBoundedChildOutput(stdout, data.toString());
-		});
-		proc.stderr.on("data", (data) => {
-			stderr = appendBoundedChildOutput(stderr, data.toString());
-		});
-		listenForChildStreamErrors(proc, (stream, error) => {
-			rejectIfPending(/* @__PURE__ */ new Error(`Tailscale ${config.mode} ${stream} error: ${error.message}`), true);
-		});
-		proc.on("close", (code) => {
-			clearTimeout(timeout);
-			if (resolved) return;
-			resolved = true;
-			if (code === 0) {
-				const publicUrl = `https://${dnsName}${path}`;
-				console.log(`[voice-call] Tailscale ${config.mode} active: ${publicUrl}`);
-				resolve({
-					publicUrl,
-					provider: `tailscale-${config.mode}`,
-					stop: async () => {
-						await stopTailscaleTunnel(config.mode, path);
-					}
-				});
-			} else {
-				const output = stderr.text ? stderr : stdout;
-				const detail = output.text ? `: ${formatBoundedChildOutput(output)}` : "";
-				reject(/* @__PURE__ */ new Error(`Tailscale ${config.mode} failed with code ${code}${detail}`));
-			}
-		});
-		proc.on("error", (err) => {
-			rejectIfPending(err);
-		});
+	const result = await runCommandWithTimeout([
+		"tailscale",
+		config.mode,
+		"--bg",
+		"--yes",
+		"--set-path",
+		path,
+		localUrl
+	], {
+		killProcessTree: true,
+		maxOutputBytes: TUNNEL_COMMAND_OUTPUT_MAX_BYTES,
+		outputCapture: "tail",
+		timeoutMs: 1e4
 	});
+	if (result.termination === "timeout") throw new Error(`Tailscale ${config.mode} timed out`);
+	if (result.code !== 0) {
+		const output = result.stderr ? {
+			text: result.stderr,
+			truncated: Boolean(result.stderrTruncatedBytes)
+		} : {
+			text: result.stdout,
+			truncated: Boolean(result.stdoutTruncatedBytes)
+		};
+		const detail = output.text ? `: ${formatBoundedChildOutput(output)}` : "";
+		throw new Error(`Tailscale ${config.mode} failed with code ${result.code}${detail}`);
+	}
+	const publicUrl = `https://${dnsName}${path}`;
+	console.log(`[voice-call] Tailscale ${config.mode} active: ${publicUrl}`);
+	return {
+		publicUrl,
+		provider: `tailscale-${config.mode}`,
+		stop: async () => {
+			await stopTailscaleTunnel(config.mode, path);
+		}
+	};
 }
 /**
 * Stop a Tailscale serve/funnel tunnel.
 */
 async function stopTailscaleTunnel(mode, path) {
-	return new Promise((resolve) => {
-		const proc = spawn("tailscale", [
-			mode,
-			"off",
-			path
-		], { stdio: "ignore" });
-		const timeout = setTimeout(() => {
-			proc.kill("SIGKILL");
-			resolve();
-		}, 5e3);
-		proc.on("close", () => {
-			clearTimeout(timeout);
-			resolve();
-		});
-		proc.on("error", () => {
-			clearTimeout(timeout);
-			resolve();
-		});
-	});
+	await runCommandWithTimeout([
+		"tailscale",
+		mode,
+		"off",
+		path
+	], {
+		killProcessTree: true,
+		maxOutputBytes: 1,
+		timeoutMs: 5e3
+	}).catch(() => {});
 }
 /**
 * Start a tunnel based on configuration.
@@ -2308,9 +2841,7 @@ Content-Length: ${Buffer.byteLength(body)}\r\n\r
 			bufferedAfterBytes: session.ws.bufferedAmount
 		};
 		if (bufferedBeforeBytes > MAX_WS_BUFFERED_BYTES) {
-			try {
-				session.ws.close(1013, "Backpressure: send buffer exceeded");
-			} catch {}
+			session.ws.close(1013, "Backpressure: send buffer exceeded");
 			return {
 				sent: false,
 				readyState,
@@ -2322,9 +2853,7 @@ Content-Length: ${Buffer.byteLength(body)}\r\n\r
 			session.ws.send(JSON.stringify(message));
 			const bufferedAfterBytes = session.ws.bufferedAmount;
 			if (bufferedAfterBytes > MAX_WS_BUFFERED_BYTES) {
-				try {
-					session.ws.close(1013, "Backpressure: send buffer exceeded");
-				} catch {}
+				session.ws.close(1013, "Backpressure: send buffer exceeded");
 				return {
 					sent: false,
 					readyState,
@@ -2584,15 +3113,19 @@ function startStaleCallReaper(params) {
 	const maxAgeSeconds = params.staleCallReaperSeconds;
 	if (!maxAgeSeconds || maxAgeSeconds <= 0) return null;
 	const maxAgeMs = maxAgeSeconds * 1e3;
+	const callsBeingReaped = /* @__PURE__ */ new Set();
 	const interval = setInterval(() => {
 		const now = Date.now();
 		for (const call of params.manager.getActiveCalls()) {
 			if (call.answeredAt || TerminalStates.has(call.state) || LiveConversationStates.has(call.state)) continue;
 			const age = now - call.startedAt;
-			if (age > maxAgeMs) {
+			if (age > maxAgeMs && !callsBeingReaped.has(call.callId)) {
+				callsBeingReaped.add(call.callId);
 				console.log(`[voice-call] Reaping stale call ${call.callId} (age: ${Math.round(age / 1e3)}s, state: ${call.state})`);
 				params.manager.endCall(call.callId).catch((err) => {
 					console.warn(`[voice-call] Reaper failed to end call ${call.callId}:`, err);
+				}).finally(() => {
+					callsBeingReaped.delete(call.callId);
 				});
 			}
 		}
@@ -2607,14 +3140,8 @@ const MAX_WEBHOOK_BODY_BYTES = WEBHOOK_BODY_READ_DEFAULTS.preAuth.maxBytes;
 const WEBHOOK_BODY_TIMEOUT_MS = WEBHOOK_BODY_READ_DEFAULTS.preAuth.timeoutMs;
 const MISSING_REMOTE_ADDRESS_IN_FLIGHT_KEY = "__voice_call_no_remote__";
 const STREAM_DISCONNECT_HANGUP_GRACE_MS = 2e3;
-const TRANSCRIPT_LOG_MAX_CHARS = 200;
 const loadRealtimeTranscriptionRuntime = createLazyRuntimeModule(() => import("./realtime-transcription.runtime-CbJAs5t_.js"));
-const loadResponseGeneratorModule = createLazyRuntimeModule(() => import("./response-generator-D3YO-WtN.js"));
-function sanitizeTranscriptForLog(value) {
-	const sanitized = value.replace(/\p{Cc}/gu, " ").replace(/\s+/g, " ").trim();
-	if (sanitized.length <= TRANSCRIPT_LOG_MAX_CHARS) return sanitized;
-	return `${truncateUtf16Safe(sanitized, TRANSCRIPT_LOG_MAX_CHARS)}...`;
-}
+const loadResponseGeneratorModule = createLazyRuntimeModule(() => import("./response-generator-Cdj8EuLg.js"));
 function appendRecentTalkEventMetadata(call, event) {
 	const metadata = call.metadata ?? {};
 	const recent = Array.isArray(metadata.recentTalkEvents) ? metadata.recentTalkEvents.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
@@ -2709,6 +3236,14 @@ var VoiceCallWebhookServer = class {
 			error: console.error,
 			debug: console.debug
 		};
+		const rawLogger = this.logger;
+		const rawDebug = rawLogger.debug;
+		this.logger = {
+			info: (msg) => rawLogger.info(`[voice-call] ${msg}`),
+			warn: (msg) => rawLogger.warn(`[voice-call] ${msg}`),
+			error: (msg) => rawLogger.error(`[voice-call] ${msg}`),
+			debug: rawDebug ? (msg) => rawDebug(`[voice-call] ${msg}`) : void 0
+		};
 	}
 	/**
 	* Get the media stream handler (for wiring to provider).
@@ -2777,15 +3312,15 @@ var VoiceCallWebhookServer = class {
 			})
 		});
 		if (!resolution.ok && resolution.code === "missing-configured-provider") {
-			console.warn(`[voice-call] Streaming enabled but realtime transcription provider "${resolution.configuredProviderId}" is not registered`);
+			this.logger.warn(`Streaming enabled but realtime transcription provider "${resolution.configuredProviderId}" is not registered`);
 			return;
 		}
 		if (!resolution.ok && resolution.code === "no-registered-provider") {
-			console.warn("[voice-call] Streaming enabled but no realtime transcription provider is registered");
+			this.logger.warn("Streaming enabled but no realtime transcription provider is registered");
 			return;
 		}
 		if (!resolution.ok) {
-			console.warn(`[voice-call] Streaming enabled but provider "${resolution.provider?.id}" is not configured`);
+			this.logger.warn(`Streaming enabled but provider "${resolution.provider?.id}" is not configured`);
 			return;
 		}
 		const streamConfig = {
@@ -2798,25 +3333,26 @@ var VoiceCallWebhookServer = class {
 			maxConnections: streaming.maxConnections,
 			resolveClientIp: (request) => this.resolveMediaStreamClientIp(request),
 			shouldAcceptStream: ({ callId, token }) => {
+				if (this.provider.name !== "twilio") {
+					this.logger.warn(`Rejecting media stream: provider ${this.provider.name} does not support authenticated classic streaming`);
+					return false;
+				}
 				if (!this.manager.getCallByProviderCallId(callId)) return false;
-				if (this.provider.name === "twilio") {
-					if (!this.provider.isValidStreamToken(callId, token)) {
-						console.warn(`[voice-call] Rejecting media stream: invalid token for ${callId}`);
-						return false;
-					}
+				if (!this.provider.isValidStreamToken(callId, token)) {
+					this.logger.warn(`Rejecting media stream: invalid token for ${callId}`);
+					return false;
 				}
 				return true;
 			},
 			onTranscript: (providerCallId, transcript) => {
-				const safeTranscript = sanitizeTranscriptForLog(transcript);
-				console.log(`[voice-call] Transcript for ${providerCallId}: ${safeTranscript} (chars=${transcript.length})`);
+				this.logger.info(`Transcript received ${providerCallId} chars=${transcript.length}`);
 				const call = this.manager.getCallByProviderCallId(providerCallId);
 				if (!call) {
-					console.warn(`[voice-call] No active call found for provider ID: ${providerCallId}`);
+					this.logger.warn(`No active call found for provider ID: ${providerCallId}`);
 					return;
 				}
 				if (this.shouldSuppressBargeInForInitialMessage(call)) {
-					console.log(`[voice-call] Ignoring barge transcript while initial message is still playing (${providerCallId})`);
+					this.logger.info(`Ignoring barge transcript while initial message is still playing (${providerCallId})`);
 					return;
 				}
 				if (this.provider.name === "twilio") this.provider.clearTtsQueue(providerCallId);
@@ -2838,25 +3374,24 @@ var VoiceCallWebhookServer = class {
 				this.provider.clearTtsQueue(providerCallId);
 			},
 			onPartialTranscript: (callId, partial) => {
-				const safePartial = sanitizeTranscriptForLog(partial);
-				console.log(`[voice-call] Partial for ${callId}: ${safePartial} (chars=${partial.length})`);
+				this.logger.info(`Partial transcript ${callId} chars=${partial.length}`);
 			},
 			onTalkEvent: (providerCallId, _streamSid, event) => {
 				const call = this.manager.getCallByProviderCallId(providerCallId);
 				if (call) appendRecentTalkEventMetadata(call, event);
 			},
 			onConnect: (callId, streamSid) => {
-				console.log(`[voice-call] Media stream connected: ${callId} -> ${streamSid}`);
+				this.logger.info(`Media stream connected: ${callId} -> ${streamSid}`);
 				this.clearPendingDisconnectHangup(callId);
 				if (this.provider.name === "twilio") this.provider.registerCallStream(callId, streamSid);
 			},
 			onTranscriptionReady: (callId) => {
 				this.manager.speakInitialMessage(callId).catch((err) => {
-					console.warn(`[voice-call] Failed to speak initial message:`, err);
+					this.logger.warn(`Failed to speak initial message: ${String(err)}`);
 				});
 			},
 			onDisconnect: (callId, streamSid) => {
-				console.log(`[voice-call] Media stream disconnected: ${callId} (${streamSid})`);
+				this.logger.info(`Media stream disconnected: ${callId} (${streamSid})`);
 				if (this.provider.name === "twilio") this.provider.unregisterCallStream(callId, streamSid);
 				this.clearPendingDisconnectHangup(callId);
 				const timer = setTimeout(() => {
@@ -2866,9 +3401,9 @@ var VoiceCallWebhookServer = class {
 					if (this.provider.name === "twilio") {
 						if (this.provider.hasRegisteredStream(callId)) return;
 					}
-					console.log(`[voice-call] Auto-ending call ${disconnectedCall.callId} after stream disconnect grace`);
+					this.logger.info(`Auto-ending call ${disconnectedCall.callId} after stream disconnect grace`);
 					this.manager.endCall(disconnectedCall.callId).catch((err) => {
-						console.warn(`[voice-call] Failed to auto-end call ${disconnectedCall.callId}:`, err);
+						this.logger.warn(`Failed to auto-end call ${disconnectedCall.callId}: ${String(err)}`);
 					});
 				}, STREAM_DISCONNECT_HANGUP_GRACE_MS);
 				timer.unref?.();
@@ -2876,7 +3411,7 @@ var VoiceCallWebhookServer = class {
 			}
 		};
 		this.mediaStreamHandler = new MediaStreamHandler(streamConfig);
-		console.log("[voice-call] Media streaming initialized");
+		this.logger.info("Media streaming initialized");
 	}
 	/**
 	* Start the webhook server.
@@ -2891,7 +3426,7 @@ var VoiceCallWebhookServer = class {
 		this.startPromise = new Promise((resolve, reject) => {
 			this.server = http.createServer((req, res) => {
 				this.handleRequest(req, res, webhookPath).catch((err) => {
-					console.error("[voice-call] Webhook error:", err);
+					this.logger.error(`Webhook error: ${String(err)}`);
 					res.statusCode = 500;
 					res.end("Internal Server Error");
 				});
@@ -2914,11 +3449,11 @@ var VoiceCallWebhookServer = class {
 				const url = this.resolveListeningUrl(bind, webhookPath);
 				this.listeningUrl = url;
 				this.startPromise = null;
-				this.logger.info(`[voice-call] Webhook server listening on ${url}`);
+				this.logger.info(`Webhook server listening on ${url}`);
 				if (this.mediaStreamHandler) {
 					const address = this.server?.address();
 					const actualPort = address && typeof address === "object" ? address.port : this.config.serve.port;
-					this.logger.info(`[voice-call] Media stream WebSocket on ws://${bind}:${actualPort}${streamPath}`);
+					this.logger.info(`Media stream WebSocket on ws://${bind}:${actualPort}${streamPath}`);
 				}
 				resolve(url);
 				this.stopStaleCallReaper = startStaleCallReaper({
@@ -2999,17 +3534,17 @@ var VoiceCallWebhookServer = class {
 		};
 		const headerGate = this.verifyPreAuthWebhookHeaders(req.headers);
 		if (!headerGate.ok) {
-			console.warn(`[voice-call] Webhook rejected before body read: ${headerGate.reason}`);
+			this.logger.warn(`Webhook rejected before body read: ${headerGate.reason}`);
 			return {
 				statusCode: 401,
 				body: "Unauthorized"
 			};
 		}
 		const remoteAddress = req.socket.remoteAddress;
-		if (!remoteAddress) console.warn(`[voice-call] Webhook accepted with no remote address; using shared fallback in-flight key`);
+		if (!remoteAddress) this.logger.warn(`Webhook accepted with no remote address; using shared fallback in-flight key`);
 		const inFlightKey = remoteAddress || MISSING_REMOTE_ADDRESS_IN_FLIGHT_KEY;
 		if (!this.webhookInFlightLimiter.tryAcquire(inFlightKey)) {
-			console.warn(`[voice-call] Webhook rejected before body read: too many in-flight requests`);
+			this.logger.warn(`Webhook rejected before body read: too many in-flight requests`);
 			return {
 				statusCode: 429,
 				body: "Too Many Requests"
@@ -3040,14 +3575,14 @@ var VoiceCallWebhookServer = class {
 			};
 			const verification = this.provider.verifyWebhook(ctx);
 			if (!verification.ok) {
-				console.warn(`[voice-call] Webhook verification failed: ${verification.reason}`);
+				this.logger.warn(`Webhook verification failed: ${verification.reason}`);
 				return {
 					statusCode: 401,
 					body: "Unauthorized"
 				};
 			}
 			if (!verification.verifiedRequestKey) {
-				console.warn("[voice-call] Webhook verification succeeded without request identity key");
+				this.logger.warn("Webhook verification succeeded without request identity key");
 				return {
 					statusCode: 401,
 					body: "Unauthorized"
@@ -3055,7 +3590,7 @@ var VoiceCallWebhookServer = class {
 			}
 			const isReplay = Boolean(verification.isReplay);
 			if (isReplay) {
-				console.warn("[voice-call] Replay detected; skipping event side effects");
+				this.logger.warn("Replay detected; skipping event side effects");
 				if (this.provider.name === "twilio") return buildTwilioReplayTwiML();
 				const cachedResponse = await this.getCachedReplayResponse(verification.verifiedRequestKey);
 				if (cachedResponse) return cachedResponse;
@@ -3064,7 +3599,7 @@ var VoiceCallWebhookServer = class {
 				const initialTwiML = this.provider.consumeInitialTwiML?.(ctx);
 				if (initialTwiML !== void 0 && initialTwiML !== null) {
 					const params = new URLSearchParams(ctx.rawBody);
-					console.log(`[voice-call] Serving provider initial TwiML before realtime handling (callSid=${params.get("CallSid") ?? "unknown"}, direction=${params.get("Direction") ?? "unknown"})`);
+					this.logger.info(`Serving provider initial TwiML before realtime handling (callSid=${params.get("CallSid") ?? "unknown"}, direction=${params.get("Direction") ?? "unknown"})`);
 					return {
 						statusCode: 200,
 						headers: { "Content-Type": "application/xml" },
@@ -3075,10 +3610,10 @@ var VoiceCallWebhookServer = class {
 				if (realtimeParams) {
 					const direction = realtimeParams.get("Direction");
 					if ((!direction || direction === "inbound") && !this.shouldAcceptRealtimeInboundRequest(realtimeParams)) {
-						console.log("[voice-call] Realtime inbound call rejected before stream setup");
+						this.logger.info("Realtime inbound call rejected before stream setup");
 						return buildRealtimeRejectedTwiML();
 					}
-					console.log(`[voice-call] Serving realtime TwiML for Twilio call ${realtimeParams.get("CallSid") ?? "unknown"} (direction=${direction ?? "unknown"})`);
+					this.logger.info(`Serving realtime TwiML for Twilio call ${realtimeParams.get("CallSid") ?? "unknown"} (direction=${direction ?? "unknown"})`);
 					return this.realtimeHandler.buildTwiMLPayload(req, realtimeParams);
 				}
 				const parsed = this.provider.parseWebhookEvent(ctx, { verifiedRequestKey: verification.verifiedRequestKey });
@@ -3194,7 +3729,7 @@ var VoiceCallWebhookServer = class {
 		for (const event of events) try {
 			this.processEventWithAutoResponse(event);
 		} catch (err) {
-			console.error(`[voice-call] Error processing event ${event.type}:`, err);
+			this.logger.error(`Error processing event ${event.type}: ${String(err)}`);
 		}
 	}
 	processEventWithAutoResponse(event) {
@@ -3203,7 +3738,7 @@ var VoiceCallWebhookServer = class {
 		const callMode = result.call.metadata?.mode;
 		if (result.call.direction !== "inbound" && callMode !== "conversation") return;
 		this.handleInboundResponse(result.call.callId, result.transcript).catch((err) => {
-			console.warn(`[voice-call] Failed to auto-respond:`, err);
+			this.logger.warn(`Failed to auto-respond: ${String(err)}`);
 		});
 	}
 	writeWebhookResponse(res, payload) {
@@ -3225,18 +3760,18 @@ var VoiceCallWebhookServer = class {
 	* Supports tool calling for richer voice interactions.
 	*/
 	async handleInboundResponse(callId, userMessage) {
-		console.log(`[voice-call] Auto-responding to inbound call ${callId}: "${userMessage}"`);
+		this.logger.info(`Auto-responding to inbound call ${callId} chars=${userMessage.length}`);
 		const call = this.manager.getCall(callId);
 		if (!call) {
-			console.warn(`[voice-call] Call ${callId} not found for auto-response`);
+			this.logger.warn(`Call ${callId} not found for auto-response`);
 			return;
 		}
 		if (!this.coreConfig) {
-			console.warn("[voice-call] Core config missing; skipping auto-response");
+			this.logger.warn("Core config missing; skipping auto-response");
 			return;
 		}
 		if (!this.agentRuntime) {
-			console.warn("[voice-call] Agent runtime missing; skipping auto-response");
+			this.logger.warn("Agent runtime missing; skipping auto-response");
 			return;
 		}
 		try {
@@ -3254,20 +3789,20 @@ var VoiceCallWebhookServer = class {
 				transcript: call.transcript,
 				userMessage,
 				onEarlyText: async (text) => {
-					console.log(`[voice-call] Early AI response: "${text}"`);
+					this.logger.info(`Early AI response queued ${callId} chars=${text.length}`);
 					return (await this.manager.speak(callId, text, { listenAfterPlayback: true })).success;
 				}
 			});
 			if (result.error) {
-				console.error(`[voice-call] Response generation error: ${result.error}`);
+				this.logger.error(`Response generation error: ${result.error}`);
 				return;
 			}
 			if (result.text && !result.deliveredEarly) {
-				console.log(`[voice-call] AI response: "${result.text}"`);
+				this.logger.info(`AI response delivered ${callId} chars=${result.text.length}`);
 				await this.manager.speak(callId, result.text, { listenAfterPlayback: true });
 			}
 		} catch (err) {
-			console.error(`[voice-call] Auto-response error:`, err);
+			this.logger.error(`Auto-response error: ${String(err)}`);
 		}
 	}
 };
@@ -3281,12 +3816,12 @@ const REALTIME_VOICE_CONSULT_SYSTEM_PROMPT = [
 	"Do not print secret values or dump environment variables; only check whether required configuration is present.",
 	"Be accurate, brief, and speakable."
 ].join(" ");
-const loadTelnyxProvider = createLazyRuntimeModule(() => import("./telnyx-DksS6q0n.js"));
-const loadTwilioProvider = createLazyRuntimeModule(() => import("./twilio-BYcsdUkj.js"));
-const loadPlivoProvider = createLazyRuntimeModule(() => import("./plivo-D5wI4-pi.js"));
+const loadTelnyxProvider = createLazyRuntimeModule(() => import("./telnyx-DMbLYwj4.js"));
+const loadTwilioProvider = createLazyRuntimeModule(() => import("./twilio-BTKKlkLT.js"));
+const loadPlivoProvider = createLazyRuntimeModule(() => import("./plivo-ByAIoPFp.js"));
 const loadMockProvider = createLazyRuntimeModule(() => import("./mock-YsvBTX-7.js"));
 const loadRealtimeVoiceRuntime = createLazyRuntimeModule(() => import("./realtime-voice.runtime-vtdCOWg-.js"));
-const loadRealtimeHandler = createLazyRuntimeModule(() => import("./realtime-handler-Bz-MNWtD.js"));
+const loadRealtimeHandler = createLazyRuntimeModule(() => import("./realtime-handler-DJk-eYyf.js"));
 function resolveVoiceCallConsultSessionKey(call) {
 	return resolveVoiceCallSessionKey({
 		config: call.config,
@@ -3479,6 +4014,14 @@ async function createVoiceCallRuntime(params) {
 				coreSession: cfg.session
 			});
 			const requesterSessionKey = typeof call.metadata?.requesterSessionKey === "string" ? call.metadata.requesterSessionKey : void 0;
+			const modelLockParams = {
+				cfg,
+				agentRuntime,
+				agentId,
+				sessionKey,
+				spawnedBy: requesterSessionKey
+			};
+			assertRealtimeVoiceAgentConsultModelSelectionUnlocked(modelLockParams);
 			const fastContext = await resolveRealtimeFastContextConsult({
 				cfg,
 				agentId,
@@ -3487,7 +4030,10 @@ async function createVoiceCallRuntime(params) {
 				args,
 				logger: log
 			});
-			if (fastContext.handled) return fastContext.result;
+			if (fastContext.handled) {
+				assertRealtimeVoiceAgentConsultModelSelectionUnlocked(modelLockParams);
+				return fastContext.result;
+			}
 			const { provider: agentProvider, model } = resolveVoiceResponseModel({
 				voiceConfig: effectiveConfig,
 				agentRuntime
@@ -3594,4 +4140,4 @@ async function createVoiceCallRuntime(params) {
 	}
 }
 //#endregion
-export { mapVoiceToPolly as _, normalizeProviderStatus as a, cleanupTailscaleExposureRoute as c, TELEPHONY_DEFAULT_TTS_TIMEOUT_MS as d, chunkAudio as f, escapeXml as g, resolveUserPath as h, mapProviderStatusToEndReason as i, getTailscaleSelfInfo as l, resolveCallAgentId as m, normalizeProxyIp as n, getHeader as o, resolveVoiceResponseModel as p, isProviderStatusTerminal as r, resolveWebhookExposureStatus as s, createVoiceCallRuntime as t, setupTailscaleExposureRoute as u };
+export { mapVoiceToPolly as _, normalizeProviderStatus as a, resolveVoiceCallSessionKey as b, cleanupTailscaleExposureRoute as c, TELEPHONY_DEFAULT_TTS_TIMEOUT_MS as d, chunkAudio as f, escapeXml as g, resolveUserPath as h, mapProviderStatusToEndReason as i, getTailscaleSelfInfo as l, resolveCallAgentId as m, normalizeProxyIp as n, getHeader as o, resolveVoiceResponseModel as p, isProviderStatusTerminal as r, resolveWebhookExposureStatus as s, createVoiceCallRuntime as t, setupTailscaleExposureRoute as u, VoiceCallConfigSchema as v, validateProviderConfig as x, resolveVoiceCallConfig as y };