@openclaw/voice-call 2026.8.1-beta.2 → 2026.8.1

package/dist/{runtime-entry-F13eJ4pp.js → runtime-entry-q02qkX8F.js}

@@ -1,13 +1,13 @@
 import { TtsConfigSchema, isBlockedHostnameOrIp, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "./runtime-api.js";
 import "./api.js";
 import { t as TWILIO_REGIONS } from "./twilio-region-4fkgz3UG.js";
-import { _ as releaseRejectedProviderCall, b as setVoiceCallStateRuntime, d as loadActiveCallsFromStore, g as appendCallReplayKey, l as findCallMatchesInStore, p as persistCallRecord, t as resolveDefaultVoiceCallStoreDir, u as getCallHistoryFromStore, v as rememberManagerReplayKey, x as TerminalStates, y as reserveRejectedProviderCall } from "./store-path-51_oC_xn.js";
+import { _ as releaseRejectedProviderCall, b as setVoiceCallStateRuntime, d as loadActiveCallsFromStore, g as appendCallReplayKey, l as findCallMatchesInStore, p as persistCallRecord, t as resolveDefaultVoiceCallStoreDir, u as getCallHistoryFromStore, v as rememberManagerReplayKey, x as TerminalStates, y as reserveRejectedProviderCall } from "./store-path-Cf6k3F2U.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { isLoopbackHost } from "openclaw/plugin-sdk/gateway-runtime";
 import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createSubsystemLogger } from "openclaw/plugin-sdk/runtime-env";
-import { resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-runtime";
+import { listAgentIds, resolveDefaultAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, REALTIME_VOICE_AGENT_CONSULT_TOOL_POLICIES, assertRealtimeVoiceAgentConsultModelSelectionUnlocked, buildRealtimeVoiceAgentConsultPolicyInstructions, consultRealtimeVoiceAgent, convertPcmToMulaw8k, createTalkSessionController, recordTalkObservabilityEvent, resolveRealtimeVoiceAgentConsultTools, resolveRealtimeVoiceAgentConsultToolsAllow, resolveRealtimeVoiceFastContextConsult } from "openclaw/plugin-sdk/realtime-voice";
 import { mergeDeep } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -16,11 +16,11 @@ import { canonicalizeMainSessionAlias } from "openclaw/plugin-sdk/session-store-
 import { resolveSpeechProviderApiKey } from "openclaw/plugin-sdk/speech-core";
 import { WEBHOOK_BODY_READ_DEFAULTS, createWebhookInFlightLimiter, normalizeWebhookPath } from "openclaw/plugin-sdk/webhook-ingress";
 import { z } from "zod";
+import { MAX_TCP_PORT, MAX_TIMER_TIMEOUT_MS, asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs";
 import crypto from "node:crypto";
 import { redactIdentifier } from "openclaw/plugin-sdk/logging-core";
 import path from "node:path";
-import { MAX_TIMER_TIMEOUT_MS, asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import os from "node:os";
 import { root } from "openclaw/plugin-sdk/security-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -31,9 +31,51 @@ import { URL as URL$1 } from "node:url";
 import { resolveConfiguredCapabilityProvider } from "openclaw/plugin-sdk/provider-selection-runtime";
 import { WebSocket, WebSocketServer } from "ws";
 import { canonicalizeBase64 } from "openclaw/plugin-sdk/media-runtime";
+//#region extensions/voice-call/src/realtime-call-control.ts
+/** Stable provider-facing tool name for ending the current phone call. */
+const REALTIME_VOICE_END_CALL_TOOL_NAME = "openclaw_end_call";
+/** Closure-bound end-call control exposed on every realtime phone call. */
+const REALTIME_VOICE_END_CALL_TOOL = {
+	type: "function",
+	name: REALTIME_VOICE_END_CALL_TOOL_NAME,
+	description: "End the current phone call immediately. Speak any final words to the caller before invoking this tool because the call ends as soon as it is invoked and no further reply will be spoken.",
+	parameters: {
+		type: "object",
+		properties: {}
+	}
+};
+/** Merge built-in call controls with consult and configured realtime tools. */
+function resolveVoiceCallRealtimeTools(policy, customTools = []) {
+	const tools = resolveRealtimeVoiceAgentConsultTools(policy, customTools).filter((tool) => tool.name !== REALTIME_VOICE_END_CALL_TOOL_NAME);
+	return [REALTIME_VOICE_END_CALL_TOOL, ...tools];
+}
+//#endregion
 //#region extensions/voice-call/src/realtime-defaults.ts
 /** Baseline instructions that keep realtime calls brief and route deep work to agent consult. */
-const DEFAULT_VOICE_CALL_REALTIME_INSTRUCTIONS = `You are OpenClaw's phone-call realtime voice interface. Keep spoken replies brief and natural. When a question needs deeper reasoning, current information, or tools, call ${REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME} before answering.`;
+const DEFAULT_VOICE_CALL_REALTIME_INSTRUCTIONS = `You are OpenClaw's phone-call realtime voice interface. Keep spoken replies brief and natural. When a question needs deeper reasoning, current information, or tools, call ${REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME} before answering. When the caller asks to end the call, speak any final words first, then call ${REALTIME_VOICE_END_CALL_TOOL_NAME}; it ends the call immediately and nothing after it will be spoken.`;
+//#endregion
+//#region extensions/voice-call/src/tailscale-config.ts
+const VoiceCallTailscaleConfigSchema = z.object({
+	mode: z.enum([
+		"off",
+		"serve",
+		"funnel"
+	]).default("off"),
+	port: z.number().int().positive().max(MAX_TCP_PORT).default(443),
+	path: z.string().min(1).default("/voice/webhook")
+}).strict().default({
+	mode: "off",
+	port: 443,
+	path: "/voice/webhook"
+});
+const TAILSCALE_FUNNEL_HTTPS_PORTS = /* @__PURE__ */ new Set([
+	443,
+	8443,
+	1e4
+]);
+function isTailscalePortAllowed(config) {
+	return !(config.tailscale.mode === "funnel" || config.tunnel.provider === "tailscale-funnel") || TAILSCALE_FUNNEL_HTTPS_PORTS.has(config.tailscale.port);
+}
 //#endregion
 //#region extensions/voice-call/src/config.ts
 /**
@@ -103,24 +145,6 @@ const VoiceCallServeConfigSchema = z.object({
 	bind: "127.0.0.1",
 	path: "/voice/webhook"
 });
-const VoiceCallTailscaleConfigSchema = z.object({
-	/**
-	* Tailscale exposure mode:
-	* - "off": No Tailscale exposure
-	* - "serve": Tailscale serve (private to tailnet)
-	* - "funnel": Tailscale funnel (public HTTPS)
-	*/
-	mode: z.enum([
-		"off",
-		"serve",
-		"funnel"
-	]).default("off"),
-	/** Path for Tailscale serve/funnel (should usually match serve.path) */
-	path: z.string().min(1).default("/voice/webhook")
-}).strict().default({
-	mode: "off",
-	path: "/voice/webhook"
-});
 const VoiceCallTunnelConfigSchema = z.object({
 	/**
 	* Tunnel provider:
@@ -178,7 +202,11 @@ const VoiceCallWebhookSecurityConfigSchema = z.object({
 * - "conversation": Stay open for back-and-forth until explicit end or timeout
 */
 const CallModeSchema = z.enum(["notify", "conversation"]);
-const VoiceCallSessionScopeSchema = z.enum(["per-phone", "per-call"]);
+const VoiceCallSessionScopeSchema = z.enum([
+	"per-phone",
+	"per-call",
+	"main"
+]);
 const OutboundConfigSchema = z.object({
 	/** Default call mode for outbound calls */
 	defaultMode: CallModeSchema.default("notify"),
@@ -418,7 +446,10 @@ const VoiceCallConfigSchema = z.object({
 	responseSystemPrompt: z.string().optional(),
 	/** Timeout for response generation in ms (default 30s) */
 	responseTimeoutMs: z.number().int().positive().default(3e4)
-}).strict();
+}).strict().refine(isTailscalePortAllowed, {
+	path: ["tailscale", "port"],
+	message: "Tailscale Funnel HTTPS port must be one of 443, 8443, 10000"
+});
 const TWILIO_AUTH_TOKEN_PATH = "plugins.entries.voice-call.config.twilio.authToken";
 const DEFAULT_VOICE_CALL_CONFIG = VoiceCallConfigSchema.parse({});
 function cloneDefaultVoiceCallConfig() {
@@ -430,6 +461,31 @@ function defaultRealtimeStreamPathForServePath(servePath) {
 	if (normalized === "/") return "/voice/stream/realtime";
 	return `${normalized}/stream/realtime`;
 }
+function resolveVoiceCallPublicPathPrefix(publicWebhookPath, localWebhookPath) {
+	const publicPath = normalizeWebhookPath(publicWebhookPath);
+	const localPathIndex = publicPath.indexOf(normalizeWebhookPath(localWebhookPath));
+	return localPathIndex > 0 ? publicPath.slice(0, localPathIndex) : "";
+}
+function resolveVoiceCallStreamExposurePaths(config, webhookPaths = {}) {
+	const exposurePaths = [];
+	const localWebhookPath = webhookPaths.localWebhookPath ?? config.serve.path;
+	const publicPathPrefix = resolveVoiceCallPublicPathPrefix(webhookPaths.publicWebhookPath ?? config.tailscale.path, localWebhookPath);
+	if (config.realtime.enabled) {
+		const localPath = normalizeWebhookPath(config.realtime.streamPath ?? defaultRealtimeStreamPathForServePath(config.serve.path));
+		exposurePaths.push({
+			localPath,
+			publicPath: `${publicPathPrefix}${localPath}`
+		});
+	}
+	if (config.streaming.enabled) {
+		const localPath = normalizeWebhookPath(config.streaming.streamPath);
+		if (!exposurePaths.some((path) => path.localPath === localPath && path.publicPath === localPath)) exposurePaths.push({
+			localPath,
+			publicPath: localPath
+		});
+	}
+	return exposurePaths;
+}
 function normalizeVoiceCallTtsConfig(defaults, overrides) {
 	if (!defaults && !overrides) return;
 	return TtsConfigSchema.parse(mergeDeep(defaults ?? {}, overrides ?? {}));
@@ -553,6 +609,11 @@ function resolveVoiceCallSessionKey(params) {
 		sessionKey: explicit,
 		coreSession: params.coreSession
 	});
+	if (params.config.sessionScope === "main") return resolveVoiceCallAgentSessionKey({
+		config: params.config,
+		sessionKey: "main",
+		coreSession: params.coreSession
+	});
 	const prefix = `agent:${normalizeAgentId(params.config.agentId)}:voice`;
 	if (params.config.sessionScope === "per-call") return `${prefix}:call:${params.callId}`.toLowerCase();
 	const normalizedPhone = params.phone?.replace(/\D/g, "");
@@ -734,9 +795,12 @@ function startMaxDurationTimer(params) {
 			const call = params.ctx.activeCalls.get(params.callId);
 			if (call && !TerminalStates.has(call.state)) {
 				console.log(`[voice-call] Max duration reached (${Math.ceil(maxDurationMs / 1e3)}s), ending call ${params.callId}`);
-				call.endReason = "timeout";
-				persistCallRecord(params.ctx.storePath, call);
-				await params.onTimeout(params.callId);
+				try {
+					const result = await params.onTimeout(params.callId);
+					if (!result.success) console.warn(`[voice-call] Failed to end max-duration call ${params.callId}: ${result.error ?? "unknown error"}`);
+				} catch (error) {
+					console.warn(`[voice-call] Failed to end max-duration call ${params.callId}: ${formatErrorMessage(error)}`);
+				}
 			}
 		})();
 	}, maxDurationMs);
@@ -794,6 +858,7 @@ function waitForFinalTranscript(ctx, callId, turnToken) {
 }
 //#endregion
 //#region extensions/voice-call/src/manager/lifecycle.ts
+const log$1 = createSubsystemLogger("voice-call/lifecycle");
 /** Remove a provider-call mapping only when it still points at this call. */
 function removeProviderCallMapping(providerCallIdMap, call) {
 	if (!call.providerCallId) return;
@@ -802,10 +867,14 @@ function removeProviderCallMapping(providerCallIdMap, call) {
 /** Persist terminal state, clean timers/waiters, and remove active call indexes. */
 function finalizeCall(params) {
 	const { ctx, call, endReason } = params;
-	call.endedAt = params.endedAt ?? Date.now();
-	call.endReason = endReason;
-	transitionState(call, endReason);
-	persistCallRecord(ctx.storePath, call);
+	const previousState = call.state;
+	if (!TerminalStates.has(previousState)) {
+		call.endedAt = params.endedAt ?? Date.now();
+		call.endReason = endReason;
+		transitionState(call, endReason);
+		persistCallRecord(ctx.storePath, call);
+		log$1.info(`[voice-call] Call finalized callId=${call.callId} providerCallId=${call.providerCallId ?? "unknown"} endReason=${endReason}`);
+	}
 	if (ctx.maxDurationTimers) clearMaxDurationTimer({ maxDurationTimers: ctx.maxDurationTimers }, call.callId);
 	if (ctx.transcriptWaiters) rejectTranscriptWaiter({ transcriptWaiters: ctx.transcriptWaiters }, call.callId, params.transcriptRejectReason ?? `Call ended: ${endReason}`);
 	ctx.activeCalls.delete(call.callId);
@@ -1073,9 +1142,7 @@ async function speak(ctx, callId, text, options) {
 			ctx,
 			call,
 			liveAt: Date.now(),
-			onTimeout: async (id) => {
-				await endCall(ctx, id, { reason: "timeout" });
-			}
+			onTimeout: (id) => endCall(ctx, id, { reason: "timeout" })
 		});
 		transitionState(call, "speaking");
 		persistCallRecord(ctx.storePath, call);
@@ -1176,7 +1243,8 @@ async function speakInitialMessage(ctx, providerCallId) {
 					const currentCall = ctx.activeCalls.get(call.callId);
 					if (currentCall && !TerminalStates.has(currentCall.state)) {
 						console.log(`[voice-call] Notify mode: hanging up call ${call.callId}`);
-						await endCall(ctx, call.callId);
+						const endResult = await endCall(ctx, call.callId);
+						if (!endResult.success) console.warn(`[voice-call] Notify mode failed to hang up call ${call.callId}: ${endResult.error ?? "unknown error"}`);
 					}
 				})();
 			}, delayMs);
@@ -1249,33 +1317,42 @@ async function continueCall(ctx, callId, prompt) {
 		clearTranscriptWaiter(ctx, callId);
 	}
 }
-async function endCall(ctx, callId, options) {
+function endCall(ctx, callId, options) {
+	const inFlight = ctx.endCallOperations.get(callId);
+	if (inFlight) return inFlight;
 	const lookup = lookupConnectedCall(ctx, callId);
-	if (lookup.kind === "error") return {
+	if (lookup.kind === "error") return Promise.resolve({
 		success: false,
 		error: lookup.error
-	};
-	if (lookup.kind === "ended") return { success: true };
+	});
+	if (lookup.kind === "ended") return Promise.resolve({ success: true });
 	const { call, providerCallId, provider } = lookup;
 	const reason = options?.reason ?? "hangup-bot";
-	try {
-		await provider.hangupCall({
-			callId,
-			providerCallId,
-			reason
-		});
-		finalizeCall({
-			ctx,
-			call,
-			endReason: reason
-		});
-		return { success: true };
-	} catch (err) {
-		return {
-			success: false,
-			error: formatErrorMessage(err)
-		};
-	}
+	const operation = (async () => {
+		try {
+			await provider.hangupCall({
+				callId,
+				providerCallId,
+				reason
+			});
+			finalizeCall({
+				ctx,
+				call,
+				endReason: reason
+			});
+			return { success: true };
+		} catch (err) {
+			return {
+				success: false,
+				error: formatErrorMessage(err)
+			};
+		}
+	})();
+	ctx.endCallOperations.set(callId, operation);
+	operation.then(() => {
+		if (ctx.endCallOperations.get(callId) === operation) ctx.endCallOperations.delete(callId);
+	});
+	return operation;
 }
 //#endregion
 //#region extensions/voice-call/src/manager/events.ts
@@ -1319,7 +1396,8 @@ function createWebhookCall(params) {
 		sessionKey: resolveVoiceCallSessionKey({
 			config: effectiveConfig,
 			callId,
-			phone: params.direction === "outbound" ? params.to : params.from
+			phone: params.direction === "outbound" ? params.to : params.from,
+			coreSession: params.ctx.coreSession
 		}),
 		agentId: normalizeAgentId(effectiveConfig.agentId),
 		startedAt: Date.now(),
@@ -1426,9 +1504,7 @@ function processEvent(ctx, event) {
 		startMaxDurationTimer({
 			ctx,
 			callId: activeCall.callId,
-			onTimeout: async (callId) => {
-				await endCall(ctx, callId, { reason: "timeout" });
-			}
+			onTimeout: (callId) => endCall(ctx, callId, { reason: "timeout" })
 		});
 	};
 	const prepareLiveDurationTimer = () => {
@@ -1493,7 +1569,7 @@ function processEvent(ctx, event) {
 				if (event.type === "call.assistant-speech" && event.transcript.trim()) addTranscriptEntry(activeCall, "bot", event.transcript);
 				break;
 			case "call.speech":
-				if (event.isFinal) {
+				if (event.isFinal && event.transcript.trim()) {
 					const waiter = ctx.transcriptWaiters.get(activeCall.callId);
 					if (waiter?.turnToken && waiter.turnToken !== event.turnToken) {
 						log.warn(`Ignoring speech event with mismatched turn token for ${activeCall.callId}`);
@@ -1570,7 +1646,7 @@ function resolveUserPath(input) {
 	const trimmed = input.trim();
 	if (!trimmed) return trimmed;
 	if (trimmed.startsWith("~")) {
-		const expanded = trimmed.replace(/^~(?=$|[\\/])/, os.homedir());
+		const expanded = trimmed.replace(/^~(?=$|[\\/])/, () => os.homedir());
 		return path.resolve(expanded);
 	}
 	return path.resolve(trimmed);
@@ -1606,6 +1682,7 @@ var CallManager = class {
 		this.provider = null;
 		this.webhookUrl = null;
 		this.activeTurnCalls = /* @__PURE__ */ new Set();
+		this.endCallOperations = /* @__PURE__ */ new Map();
 		this.transcriptWaiters = /* @__PURE__ */ new Map();
 		this.maxDurationTimers = /* @__PURE__ */ new Map();
 		this.initialMessageInFlight = /* @__PURE__ */ new Set();
@@ -1648,9 +1725,7 @@ var CallManager = class {
 					ctx: this.getContext(),
 					callId,
 					timeoutMs: maxDurationMs - elapsed,
-					onTimeout: async (id) => {
-						await endCall(this.getContext(), id, { reason: "timeout" });
-					}
+					onTimeout: (id) => this.endCall(id, { reason: "timeout" })
 				});
 				console.log(`[voice-call] Restarted max-duration timer for restored call ${callId}`);
 			}
@@ -1763,8 +1838,8 @@ var CallManager = class {
 	/**
 	* End an active call.
 	*/
-	async endCall(callId) {
-		return endCall(this.getContext(), callId);
+	endCall(callId, options) {
+		return endCall(this.getContext(), callId, options);
 	}
 	getContext() {
 		return {
@@ -1778,6 +1853,7 @@ var CallManager = class {
 			storePath: this.storePath,
 			webhookUrl: this.webhookUrl,
 			activeTurnCalls: this.activeTurnCalls,
+			endCallOperations: this.endCallOperations,
 			transcriptWaiters: this.transcriptWaiters,
 			maxDurationTimers: this.maxDurationTimers,
 			initialMessageInFlight: this.initialMessageInFlight,
@@ -1951,6 +2027,20 @@ function chunkAudio(audio, chunkSize = 160) {
 //#region extensions/voice-call/src/telephony-tts.ts
 /** Default timeout for one telephony synthesis request. */
 const TELEPHONY_DEFAULT_TTS_TIMEOUT_MS = 8e3;
+var UnsupportedTelephonyTtsOutputFormatError = class extends Error {
+	constructor(outputFormat, provider) {
+		super(`Unsupported telephony TTS output format "${outputFormat}" from provider "${provider}"`);
+		this.outputFormat = outputFormat;
+		this.provider = provider;
+		this.name = "UnsupportedTelephonyTtsOutputFormatError";
+	}
+};
+function convertTelephonyTtsOutput(result) {
+	const format = result.outputFormat?.trim().toLowerCase();
+	if ((format === "raw-8khz-8bit-mono-mulaw" || format === "ulaw_8000") && result.sampleRate === 8e3) return result.audioBuffer;
+	if (!format || format === "pcm" || /^pcm[_-]\d+$/.test(format) || format.includes("raw") && (format.includes("16bit") || format.includes("16-bit")) && format.includes("pcm")) return convertPcmToMulaw8k(result.audioBuffer, result.sampleRate);
+	throw new UnsupportedTelephonyTtsOutputFormatError(result.outputFormat ?? "absent", result.provider ?? "unknown");
+}
 /** Create a TTS provider that honors voice-call overrides and converts PCM to mulaw. */
 async function createTelephonyTtsProvider(params) {
 	const { coreConfig, ttsOverride, runtime, logger } = params;
@@ -1979,7 +2069,12 @@ async function createTelephonyTtsProvider(params) {
 				const attemptedChain = result.attemptedProviders && result.attemptedProviders.length > 0 ? result.attemptedProviders.join(" -> ") : `${result.fallbackFrom} -> ${result.provider}`;
 				logger?.warn?.(`[voice-call] Telephony TTS fallback used from=${result.fallbackFrom} to=${result.provider} attempts=${attemptedChain}`);
 			}
-			return convertPcmToMulaw8k(result.audioBuffer, result.sampleRate);
+			return convertTelephonyTtsOutput({
+				audioBuffer: result.audioBuffer,
+				outputFormat: result.outputFormat,
+				provider: result.provider,
+				sampleRate: result.sampleRate
+			});
 		}
 	};
 }
@@ -2012,6 +2107,24 @@ function formatBoundedChildOutput(output) {
 //#endregion
 //#region extensions/voice-call/src/webhook/tailscale.ts
 const TAILSCALE_COMMAND_STDOUT_MAX_BYTES = 4 * 1024 * 1024;
+const DEFAULT_TAILSCALE_HTTPS_PORT = 443;
+function buildTailscaleExposureArgs(opts) {
+	if (!opts.localUrl && opts.port === DEFAULT_TAILSCALE_HTTPS_PORT) return [
+		opts.mode,
+		"off",
+		opts.path
+	];
+	const portArgs = opts.port === DEFAULT_TAILSCALE_HTTPS_PORT ? [] : ["--https", String(opts.port)];
+	return [
+		opts.mode,
+		"--bg",
+		"--yes",
+		...portArgs,
+		"--set-path",
+		opts.path,
+		opts.localUrl ?? "off"
+	];
+}
 async function runTailscaleCommand(args, timeoutMs = 2500) {
 	try {
 		const result = await runCommandWithTimeout(["tailscale", ...args], {
@@ -2059,57 +2172,74 @@ async function getTailscaleSelfInfo() {
 async function getTailscaleDnsName() {
 	return (await getTailscaleSelfInfo())?.dnsName ?? null;
 }
-async function setupTailscaleExposureRoute(opts) {
+async function cleanupTailscaleExposureRoute(opts) {
+	await runTailscaleCommand(buildTailscaleExposureArgs(opts));
+}
+async function setupTailscaleExposureRoutes(opts) {
 	const dnsName = await getTailscaleDnsName();
 	if (!dnsName) {
 		console.warn("[voice-call] Could not get Tailscale DNS name");
 		return null;
 	}
-	const { code } = await runTailscaleCommand([
-		opts.mode,
-		"--bg",
-		"--yes",
-		"--set-path",
-		opts.path,
-		opts.localUrl
-	]);
-	if (code === 0) {
-		const publicUrl = `https://${dnsName}${opts.path}`;
-		console.log(`[voice-call] Tailscale ${opts.mode} active: ${publicUrl}`);
-		return publicUrl;
+	const mountedPaths = [];
+	let publicUrl = null;
+	for (const route of opts.routes) {
+		const { code } = await runTailscaleCommand(buildTailscaleExposureArgs({
+			mode: opts.mode,
+			port: opts.port,
+			...route
+		}));
+		if (code !== 0) {
+			for (const path of mountedPaths.toReversed()) await cleanupTailscaleExposureRoute({
+				mode: opts.mode,
+				port: opts.port,
+				path
+			});
+			console.warn(`[voice-call] Tailscale ${opts.mode} exposure failed for ${route.path}; rolled back ${mountedPaths.length} mounted route(s)`);
+			return null;
+		}
+		const routePublicUrl = `https://${dnsName}${opts.port === DEFAULT_TAILSCALE_HTTPS_PORT ? "" : `:${opts.port}`}${route.path}`;
+		console.log(`[voice-call] Tailscale ${opts.mode} active: ${routePublicUrl}`);
+		publicUrl ??= routePublicUrl;
+		mountedPaths.push(route.path);
 	}
-	console.warn(`[voice-call] Tailscale ${opts.mode} failed`);
-	return null;
-}
-async function cleanupTailscaleExposureRoute(opts) {
-	await runTailscaleCommand([
-		opts.mode,
-		"off",
-		opts.path
-	]);
+	return publicUrl;
 }
 async function setupTailscaleExposure(config) {
 	if (config.tailscale.mode === "off") return null;
 	const mode = config.tailscale.mode === "funnel" ? "funnel" : "serve";
 	const localUrl = `http://127.0.0.1:${config.serve.port}${config.serve.path}`;
-	return setupTailscaleExposureRoute({
+	const streamRoutes = resolveVoiceCallStreamExposurePaths(config).map(({ publicPath, localPath }) => ({
+		path: publicPath,
+		localUrl: `http://127.0.0.1:${config.serve.port}${localPath}`
+	}));
+	return setupTailscaleExposureRoutes({
 		mode,
-		path: config.tailscale.path,
-		localUrl
+		port: config.tailscale.port,
+		routes: [{
+			path: config.tailscale.path,
+			localUrl
+		}, ...streamRoutes]
 	});
 }
 async function cleanupTailscaleExposure(config) {
 	if (config.tailscale.mode === "off") return;
+	const mode = config.tailscale.mode === "funnel" ? "funnel" : "serve";
 	await cleanupTailscaleExposureRoute({
-		mode: config.tailscale.mode === "funnel" ? "funnel" : "serve",
+		mode,
+		port: config.tailscale.port,
 		path: config.tailscale.path
 	});
+	for (const { publicPath } of resolveVoiceCallStreamExposurePaths(config)) await cleanupTailscaleExposureRoute({
+		mode,
+		port: config.tailscale.port,
+		path: publicPath
+	});
 }
 //#endregion
 //#region extensions/voice-call/src/tunnel.ts
 const NGROK_LOG_BUFFER_MAX_CHARS = 16384;
 const NGROK_ERROR_MARKER = "ERR_NGROK";
-const TUNNEL_COMMAND_OUTPUT_MAX_BYTES = 16384;
 const NGROK_STOP_GRACE_MS = 2e3;
 const NGROK_FORCE_KILL_WAIT_MS = 1e3;
 async function terminateNgrokProcess(proc, isClosed) {
@@ -2149,11 +2279,6 @@ function listenForChildStreamErrors(proc, onError) {
 * // Later: await tunnel.stop();
 */
 async function startNgrokTunnel(config) {
-	if (config.authToken) await runNgrokCommand([
-		"config",
-		"add-authtoken",
-		config.authToken
-	]);
 	const args = [
 		"http",
 		String(config.port),
@@ -2164,11 +2289,17 @@ async function startNgrokTunnel(config) {
 	];
 	if (config.domain) args.push("--domain", config.domain);
 	return new Promise((resolve, reject) => {
-		const proc = spawn("ngrok", args, { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
+		const proc = spawn("ngrok", args, {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			...config.authToken ? { env: {
+				...process.env,
+				NGROK_AUTHTOKEN: config.authToken
+			} } : {}
+		});
 		let startupSettled = false;
 		let childClosed = false;
 		let publicUrl = null;
@@ -2241,86 +2372,40 @@ async function startNgrokTunnel(config) {
 	});
 }
 /**
-* Run an ngrok command and wait for completion.
-*/
-async function runNgrokCommand(args) {
-	const result = await runCommandWithTimeout(["ngrok", ...args], {
-		killProcessTree: true,
-		maxOutputBytes: TUNNEL_COMMAND_OUTPUT_MAX_BYTES,
-		outputCapture: "tail",
-		timeoutMs: 3e4
-	});
-	if (result.termination === "timeout") throw new Error("ngrok command timed out");
-	if (result.code === 0) return result.stdout;
-	const output = result.stderr ? {
-		text: result.stderr,
-		truncated: Boolean(result.stderrTruncatedBytes)
-	} : {
-		text: result.stdout,
-		truncated: Boolean(result.stdoutTruncatedBytes)
-	};
-	throw new Error(`ngrok command failed: ${formatBoundedChildOutput(output)}`);
-}
-/**
 * Start a Tailscale serve/funnel tunnel.
 */
 async function startTailscaleTunnel(config) {
-	const dnsName = await getTailscaleDnsName();
-	if (!dnsName) throw new Error("Could not get Tailscale DNS name. Is Tailscale running?");
 	const path = config.path.startsWith("/") ? config.path : `/${config.path}`;
-	const localUrl = `http://127.0.0.1:${config.port}${path}`;
-	const result = await runCommandWithTimeout([
-		"tailscale",
-		config.mode,
-		"--bg",
-		"--yes",
-		"--set-path",
-		path,
-		localUrl
-	], {
-		killProcessTree: true,
-		maxOutputBytes: TUNNEL_COMMAND_OUTPUT_MAX_BYTES,
-		outputCapture: "tail",
-		timeoutMs: 1e4
-	});
-	if (result.termination === "timeout") throw new Error(`Tailscale ${config.mode} timed out`);
-	if (result.code !== 0) {
-		const output = result.stderr ? {
-			text: result.stderr,
-			truncated: Boolean(result.stderrTruncatedBytes)
-		} : {
-			text: result.stdout,
-			truncated: Boolean(result.stdoutTruncatedBytes)
+	const routes = [{
+		publicPath: path,
+		localPath: path
+	}, ...config.streamPaths ?? []].map(({ publicPath, localPath }) => {
+		const normalizedPublicPath = publicPath.startsWith("/") ? publicPath : `/${publicPath}`;
+		const normalizedLocalPath = localPath.startsWith("/") ? localPath : `/${localPath}`;
+		return {
+			path: normalizedPublicPath,
+			localUrl: `http://127.0.0.1:${config.port}${normalizedLocalPath}`
 		};
-		const detail = output.text ? `: ${formatBoundedChildOutput(output)}` : "";
-		throw new Error(`Tailscale ${config.mode} failed with code ${result.code}${detail}`);
-	}
-	const publicUrl = `https://${dnsName}${path}`;
-	console.log(`[voice-call] Tailscale ${config.mode} active: ${publicUrl}`);
+	});
+	const publicUrl = await setupTailscaleExposureRoutes({
+		mode: config.mode,
+		port: config.tailscalePort,
+		routes
+	});
+	if (!publicUrl) throw new Error(`Tailscale ${config.mode} failed`);
 	return {
 		publicUrl,
 		provider: `tailscale-${config.mode}`,
 		stop: async () => {
-			await stopTailscaleTunnel(config.mode, path);
+			for (const route of routes) await cleanupTailscaleExposureRoute({
+				mode: config.mode,
+				port: config.tailscalePort,
+				path: route.path
+			});
 		}
 	};
 }
 /**
-* Stop a Tailscale serve/funnel tunnel.
-*/
-async function stopTailscaleTunnel(mode, path) {
-	await runCommandWithTimeout([
-		"tailscale",
-		mode,
-		"off",
-		path
-	], {
-		killProcessTree: true,
-		maxOutputBytes: 1,
-		timeoutMs: 5e3
-	}).catch(() => {});
-}
-/**
 * Start a tunnel based on configuration.
 */
 async function startTunnel(config) {
@@ -2334,12 +2419,16 @@ async function startTunnel(config) {
 		case "tailscale-serve": return startTailscaleTunnel({
 			mode: "serve",
 			port: config.port,
-			path: config.path
+			tailscalePort: config.tailscalePort ?? 443,
+			path: config.path,
+			streamPaths: config.streamPaths
 		});
 		case "tailscale-funnel": return startTailscaleTunnel({
 			mode: "funnel",
 			port: config.port,
-			path: config.path
+			tailscalePort: config.tailscalePort ?? 443,
+			path: config.path,
+			streamPaths: config.streamPaths
 		});
 		default: return null;
 	}
@@ -2420,6 +2509,8 @@ const DEFAULT_MAX_CONNECTIONS = 128;
 const MAX_INBOUND_MESSAGE_BYTES = 64 * 1024;
 const MAX_WS_BUFFERED_BYTES = 1024 * 1024;
 const MAX_PENDING_TTS_OPERATIONS_PER_STREAM = 8;
+const MAX_IGNORED_PLAYBACK_MARKS_PER_STREAM = 64;
+const PLAYBACK_MARK_TIMEOUT_GRACE_MS = 2e3;
 const CLOSE_REASON_LOG_MAX_CHARS = 120;
 function sanitizeLogText(value, maxChars) {
 	const sanitized = value.replace(/\p{Cc}/gu, " ").replace(/\s+/g, " ").trim();
@@ -2454,6 +2545,8 @@ var MediaStreamHandler = class {
 		this.ttsQueues = /* @__PURE__ */ new Map();
 		this.ttsPlaying = /* @__PURE__ */ new Map();
 		this.ttsActiveControllers = /* @__PURE__ */ new Map();
+		this.pendingPlaybackMarks = /* @__PURE__ */ new Map();
+		this.ignoredPlaybackMarks = /* @__PURE__ */ new Map();
 		this.config = config;
 		this.preStartTimeoutMs = resolveTimerTimeoutMs(config.preStartTimeoutMs, DEFAULT_PRE_START_TIMEOUT_MS);
 		this.maxPendingConnections = config.maxPendingConnections ?? DEFAULT_MAX_PENDING_CONNECTIONS;
@@ -2577,8 +2670,10 @@ var MediaStreamHandler = class {
 							session = null;
 						}
 						break;
-					case "clear":
-					case "mark": break;
+					case "mark":
+						if (session && message.mark?.name) this.acknowledgePlaybackMark(session.streamSid, message.mark.name);
+						break;
+					case "clear": break;
 				}
 			} catch (error) {
 				console.error("[MediaStream] Error processing message:", error);
@@ -2904,10 +2999,44 @@ Content-Length: ${Buffer.byteLength(body)}\r\n\r
 			mark: { name }
 		});
 	}
+	/** Send a completion mark and wait until Twilio reports that buffered playback reached it. */
+	async sendMarkAndWait(streamSid, name, audioDurationMs, signal) {
+		signal.throwIfAborted();
+		const marks = this.getPendingPlaybackMarks(streamSid);
+		if (marks.has(name)) throw new Error(`Telephony playback mark is already pending: ${name}`);
+		this.ignoredPlaybackMarks.get(streamSid)?.delete(name);
+		let pending;
+		const acknowledgement = new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				console.warn(`[MediaStream] Playback mark timed out; continuing stream=${streamSid}`);
+				pending.settle();
+			}, Math.max(1, audioDurationMs + PLAYBACK_MARK_TIMEOUT_GRACE_MS));
+			timeout.unref?.();
+			const onAbort = () => {
+				const reason = signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("Telephony playback mark wait aborted");
+				pending.settle(reason, true);
+			};
+			pending = { settle: (error, ignoreLateAck = false) => {
+				if (marks.get(name) !== pending) return;
+				clearTimeout(timeout);
+				signal.removeEventListener("abort", onAbort);
+				marks.delete(name);
+				if (marks.size === 0) this.pendingPlaybackMarks.delete(streamSid);
+				if (ignoreLateAck) this.ignorePlaybackMark(streamSid, name);
+				if (error) reject(error);
+				else resolve();
+			} };
+			marks.set(name, pending);
+			signal.addEventListener("abort", onAbort, { once: true });
+		});
+		if (!this.sendMark(streamSid, name).sent) pending.settle(/* @__PURE__ */ new Error("Telephony stream playback failed: completion mark not delivered"));
+		return acknowledgement;
+	}
 	/**
 	* Clear audio buffer (interrupt playback).
 	*/
 	clearAudio(streamSid) {
+		this.invalidatePlaybackMarks(streamSid);
 		return this.sendToStream(streamSid, {
 			event: "clear",
 			streamSid
@@ -2960,6 +3089,36 @@ Content-Length: ${Buffer.byteLength(body)}\r\n\r
 		this.ttsQueues.set(streamSid, queue);
 		return queue;
 	}
+	getPendingPlaybackMarks(streamSid) {
+		const existing = this.pendingPlaybackMarks.get(streamSid);
+		if (existing) return existing;
+		const marks = /* @__PURE__ */ new Map();
+		this.pendingPlaybackMarks.set(streamSid, marks);
+		return marks;
+	}
+	acknowledgePlaybackMark(streamSid, name) {
+		const ignored = this.ignoredPlaybackMarks.get(streamSid);
+		if (ignored?.delete(name)) {
+			if (ignored.size === 0) this.ignoredPlaybackMarks.delete(streamSid);
+			return;
+		}
+		this.pendingPlaybackMarks.get(streamSid)?.get(name)?.settle();
+	}
+	invalidatePlaybackMarks(streamSid) {
+		const marks = this.pendingPlaybackMarks.get(streamSid);
+		if (!marks) return;
+		for (const pending of marks.values()) pending.settle(/* @__PURE__ */ new Error("Telephony playback cleared before completion"), true);
+	}
+	ignorePlaybackMark(streamSid, name) {
+		const ignored = this.ignoredPlaybackMarks.get(streamSid) ?? /* @__PURE__ */ new Set();
+		ignored.add(name);
+		while (ignored.size > MAX_IGNORED_PLAYBACK_MARKS_PER_STREAM) {
+			const oldest = ignored.values().next().value;
+			if (oldest === void 0) break;
+			ignored.delete(oldest);
+		}
+		this.ignoredPlaybackMarks.set(streamSid, ignored);
+	}
 	/**
 	* Process the TTS queue for a stream.
 	* Uses iterative approach to avoid stack accumulation from recursion.
@@ -3055,6 +3214,8 @@ Content-Length: ${Buffer.byteLength(body)}\r\n\r
 		this.ttsActiveControllers.delete(streamSid);
 		this.ttsPlaying.delete(streamSid);
 		this.ttsQueues.delete(streamSid);
+		this.invalidatePlaybackMarks(streamSid);
+		this.ignoredPlaybackMarks.delete(streamSid);
 	}
 	resolveQueuedTtsEntries(queue) {
 		const pending = queue.splice(0);
@@ -3121,7 +3282,9 @@ function startStaleCallReaper(params) {
 			if (age > maxAgeMs && !callsBeingReaped.has(call.callId)) {
 				callsBeingReaped.add(call.callId);
 				console.log(`[voice-call] Reaping stale call ${call.callId} (age: ${Math.round(age / 1e3)}s, state: ${call.state})`);
-				params.manager.endCall(call.callId).catch((err) => {
+				params.manager.endCall(call.callId).then((result) => {
+					if (!result.success) console.warn(`[voice-call] Reaper failed to end call ${call.callId}: ${result.error ?? "unknown error"}`);
+				}).catch((err) => {
 					console.warn(`[voice-call] Reaper failed to end call ${call.callId}:`, err);
 				}).finally(() => {
 					callsBeingReaped.delete(call.callId);
@@ -3134,13 +3297,51 @@ function startStaleCallReaper(params) {
 	};
 }
 //#endregion
+//#region extensions/voice-call/src/webhook/stream-disconnect-grace.ts
+const STREAM_DISCONNECT_GRACE_MS = 2e3;
+/** Track the current carrier stream and expire disconnected calls after reconnect grace. */
+var StreamDisconnectGrace = class {
+	constructor(onGraceExpired) {
+		this.onGraceExpired = onGraceExpired;
+		this.streams = /* @__PURE__ */ new Map();
+	}
+	connect(providerCallId, streamId) {
+		const current = this.streams.get(providerCallId);
+		if (current?.disconnectTimer) clearTimeout(current.disconnectTimer);
+		this.streams.set(providerCallId, { streamId });
+	}
+	disconnect(providerCallId, streamId) {
+		const current = this.streams.get(providerCallId);
+		if (!current || current.streamId !== streamId || current.disconnectTimer) return;
+		const disconnectTimer = setTimeout(() => {
+			if (this.streams.get(providerCallId)?.disconnectTimer !== disconnectTimer) return;
+			this.streams.delete(providerCallId);
+			this.onGraceExpired({
+				providerCallId,
+				streamId
+			});
+		}, STREAM_DISCONNECT_GRACE_MS);
+		disconnectTimer.unref?.();
+		current.disconnectTimer = disconnectTimer;
+	}
+	retire(providerCallId, streamId) {
+		const current = this.streams.get(providerCallId);
+		if (!current || current.streamId !== streamId) return;
+		if (current.disconnectTimer) clearTimeout(current.disconnectTimer);
+		this.streams.delete(providerCallId);
+	}
+	close() {
+		for (const state of this.streams.values()) if (state.disconnectTimer) clearTimeout(state.disconnectTimer);
+		this.streams.clear();
+	}
+};
+//#endregion
 //#region extensions/voice-call/src/webhook.ts
 const MAX_WEBHOOK_BODY_BYTES = WEBHOOK_BODY_READ_DEFAULTS.preAuth.maxBytes;
 const WEBHOOK_BODY_TIMEOUT_MS = WEBHOOK_BODY_READ_DEFAULTS.preAuth.timeoutMs;
 const MISSING_REMOTE_ADDRESS_IN_FLIGHT_KEY = "__voice_call_no_remote__";
-const STREAM_DISCONNECT_HANGUP_GRACE_MS = 2e3;
 const loadRealtimeTranscriptionRuntime = createLazyRuntimeModule(() => import("./realtime-transcription.runtime-CbJAs5t_.js"));
-const loadResponseGeneratorModule = createLazyRuntimeModule(() => import("./response-generator-D-hkzo5Y.js"));
+const loadResponseGeneratorModule = createLazyRuntimeModule(() => import("./response-generator-xbT37lYx.js"));
 function appendRecentTalkEventMetadata(call, event) {
 	const metadata = call.metadata ?? {};
 	const recent = Array.isArray(metadata.recentTalkEvents) ? metadata.recentTalkEvents.filter((entry) => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
@@ -3220,7 +3421,6 @@ var VoiceCallWebhookServer = class {
 		this.stopStaleCallReaper = null;
 		this.webhookInFlightLimiter = createWebhookInFlightLimiter();
 		this.mediaStreamHandler = null;
-		this.pendingDisconnectHangups = /* @__PURE__ */ new Map();
 		this.realtimeHandler = null;
 		this.replayResponses = /* @__PURE__ */ new Map();
 		this.replayResponseCacheCalls = 0;
@@ -3244,6 +3444,16 @@ var VoiceCallWebhookServer = class {
 			error: (msg) => rawLogger.error(`[voice-call] ${msg}`),
 			debug: rawDebug ? (msg) => rawDebug(`[voice-call] ${msg}`) : void 0
 		};
+		this.streamDisconnectGrace = new StreamDisconnectGrace(({ providerCallId }) => {
+			const call = this.manager.getCallByProviderCallId(providerCallId);
+			if (!call) return;
+			this.logger.info(`Call finalization requested reason=stream-disconnect-grace-expired callId=${call.callId} providerCallId=${providerCallId}`);
+			this.manager.endCall(call.callId).then((result) => {
+				if (!result.success) this.logger.warn(`Failed to auto-end call ${call.callId}: ${result.error ?? "unknown error"}`);
+			}).catch((err) => {
+				this.logger.warn(`Failed to auto-end call ${call.callId}: ${String(err)}`);
+			});
+		});
 	}
 	/**
 	* Get the media stream handler (for wiring to provider).
@@ -3264,11 +3474,8 @@ var VoiceCallWebhookServer = class {
 	setRealtimeHandler(handler) {
 		this.realtimeHandler = handler;
 	}
-	clearPendingDisconnectHangup(providerCallId) {
-		const existing = this.pendingDisconnectHangups.get(providerCallId);
-		if (!existing) return;
-		clearTimeout(existing);
-		this.pendingDisconnectHangups.delete(providerCallId);
+	getStreamDisconnectLifecycle() {
+		return this.streamDisconnectGrace;
 	}
 	resolveMediaStreamClientIp(request) {
 		const remoteIp = request.socket.remoteAddress ?? void 0;
@@ -3382,7 +3589,7 @@ var VoiceCallWebhookServer = class {
 			},
 			onConnect: (callId, streamSid) => {
 				this.logger.info(`Media stream connected: ${callId} -> ${streamSid}`);
-				this.clearPendingDisconnectHangup(callId);
+				this.streamDisconnectGrace.connect(callId, streamSid);
 				if (this.provider.name === "twilio") this.provider.registerCallStream(callId, streamSid);
 			},
 			onTranscriptionReady: (callId) => {
@@ -3393,21 +3600,7 @@ var VoiceCallWebhookServer = class {
 			onDisconnect: (callId, streamSid) => {
 				this.logger.info(`Media stream disconnected: ${callId} (${streamSid})`);
 				if (this.provider.name === "twilio") this.provider.unregisterCallStream(callId, streamSid);
-				this.clearPendingDisconnectHangup(callId);
-				const timer = setTimeout(() => {
-					this.pendingDisconnectHangups.delete(callId);
-					const disconnectedCall = this.manager.getCallByProviderCallId(callId);
-					if (!disconnectedCall) return;
-					if (this.provider.name === "twilio") {
-						if (this.provider.hasRegisteredStream(callId)) return;
-					}
-					this.logger.info(`Auto-ending call ${disconnectedCall.callId} after stream disconnect grace`);
-					this.manager.endCall(disconnectedCall.callId).catch((err) => {
-						this.logger.warn(`Failed to auto-end call ${disconnectedCall.callId}: ${String(err)}`);
-					});
-				}, STREAM_DISCONNECT_HANGUP_GRACE_MS);
-				timer.unref?.();
-				this.pendingDisconnectHangups.set(callId, timer);
+				this.streamDisconnectGrace.disconnect(callId, streamSid);
 			}
 		};
 		this.mediaStreamHandler = new MediaStreamHandler(streamConfig);
@@ -3485,8 +3678,7 @@ var VoiceCallWebhookServer = class {
 			});
 		});
 		this.startPromise = null;
-		for (const timer of this.pendingDisconnectHangups.values()) clearTimeout(timer);
-		this.pendingDisconnectHangups.clear();
+		this.streamDisconnectGrace.close();
 		if (this.stopStaleCallReaper) {
 			this.stopStaleCallReaper();
 			this.stopStaleCallReaper = null;
@@ -3498,8 +3690,7 @@ var VoiceCallWebhookServer = class {
 				this.mediaStreamHandler?.close(serverClosePromise) ?? Promise.resolve(),
 				this.realtimeHandler?.close(serverClosePromise) ?? Promise.resolve()
 			]);
-			for (const timer of this.pendingDisconnectHangups.values()) clearTimeout(timer);
-			this.pendingDisconnectHangups.clear();
+			this.streamDisconnectGrace.close();
 			if (this.server === server) this.server = null;
 			this.listeningUrl = null;
 			const failure = results.find((result) => result.status === "rejected");
@@ -3817,6 +4008,7 @@ var VoiceCallWebhookServer = class {
 				callId,
 				sessionKey: call.sessionKey,
 				from: call.from,
+				senderIsOwner: call.direction === "inbound" ? false : void 0,
 				agentId: resolveCallAgentId(call, effectiveConfig),
 				transcript: call.transcript,
 				userMessage,
@@ -3848,12 +4040,12 @@ const REALTIME_VOICE_CONSULT_SYSTEM_PROMPT = [
 	"Do not print secret values or dump environment variables; only check whether required configuration is present.",
 	"Be accurate, brief, and speakable."
 ].join(" ");
-const loadTelnyxProvider = createLazyRuntimeModule(() => import("./telnyx-sIS_WgnY.js"));
-const loadTwilioProvider = createLazyRuntimeModule(() => import("./twilio-CbeVrVAl.js"));
-const loadPlivoProvider = createLazyRuntimeModule(() => import("./plivo-DbI17uAc.js"));
-const loadMockProvider = createLazyRuntimeModule(() => import("./mock-BCq0q36l.js"));
+const loadTelnyxProvider = createLazyRuntimeModule(() => import("./telnyx-C9Yizvox.js"));
+const loadTwilioProvider = createLazyRuntimeModule(() => import("./twilio-BLjVv246.js"));
+const loadPlivoProvider = createLazyRuntimeModule(() => import("./plivo-Ct5BT5LQ.js"));
+const loadMockProvider = createLazyRuntimeModule(() => import("./mock-Dv7KxYGt.js"));
 const loadRealtimeVoiceRuntime = createLazyRuntimeModule(() => import("./realtime-voice.runtime-vtdCOWg-.js"));
-const loadRealtimeHandler = createLazyRuntimeModule(() => import("./realtime-handler-uXR0QgVa.js"));
+const loadRealtimeHandler = createLazyRuntimeModule(() => import("./realtime-handler-CSK1A1Gg.js"));
 function resolveVoiceCallConsultSessionKey(call) {
 	return resolveVoiceCallSessionKey({
 		config: call.config,
@@ -3951,17 +4143,9 @@ async function resolveProvider(config) {
 		default: throw new Error(`Unsupported voice-call provider: ${String(config.provider)}`);
 	}
 }
-async function resolveRealtimeProvider(params) {
-	const { resolveConfiguredRealtimeVoiceProvider } = await loadRealtimeVoiceRuntime();
-	return resolveConfiguredRealtimeVoiceProvider({
-		configuredProviderId: params.config.realtime.provider,
-		providerConfigs: params.config.realtime.providers,
-		cfg: params.fullConfig
-	});
-}
 function listRealtimeAgentIds(config, coreConfig) {
 	const agentIds = /* @__PURE__ */ new Set([normalizeAgentId(config.agentId)]);
-	for (const agent of coreConfig.agents?.list ?? []) agentIds.add(normalizeAgentId(agent.id));
+	for (const agentId of listAgentIds(coreConfig)) agentIds.add(normalizeAgentId(agentId));
 	for (const route of Object.values(config.numbers)) if (route.agentId) agentIds.add(normalizeAgentId(route.agentId));
 	return [...agentIds];
 }
@@ -4024,22 +4208,37 @@ async function createVoiceCallRuntime(params) {
 	const provider = await resolveProvider(config);
 	if (stateRuntime) setVoiceCallStateRuntime({ state: stateRuntime });
 	const manager = new CallManager(config, void 0, cfg.session);
-	const realtimeProvider = config.realtime.enabled ? await resolveRealtimeProvider({
-		config,
-		fullConfig: cfg
-	}) : null;
+	const realtimeVoiceRuntime = config.realtime.enabled ? await loadRealtimeVoiceRuntime() : null;
 	const webhookServer = new VoiceCallWebhookServer(config, manager, provider, coreConfig, fullConfig ?? coreConfig, agentRuntime, log);
-	if (realtimeProvider) {
+	if (realtimeVoiceRuntime) {
 		const { RealtimeCallHandler } = await loadRealtimeHandler();
 		const resolveRealtimeInstructions = await createRealtimeInstructionsResolver({
 			config,
 			coreConfig: cfg,
 			agentRuntime
 		});
-		const realtimeHandler = new RealtimeCallHandler({
+		const realtimeConfig = {
 			...config.realtime,
-			tools: resolveRealtimeVoiceAgentConsultTools(config.realtime.toolPolicy, config.realtime.tools)
-		}, manager, provider, realtimeProvider.provider, realtimeProvider.providerConfig, config.serve.path, cfg, resolveRealtimeInstructions);
+			tools: resolveVoiceCallRealtimeTools(config.realtime.toolPolicy, config.realtime.tools)
+		};
+		const resolveCallRegistration = (call) => {
+			const numberRouteKey = resolveVoiceCallNumberRouteKeyForCall(call);
+			const effectiveConfig = resolveVoiceCallEffectiveConfig(config, numberRouteKey).config;
+			const agentId = resolveCallAgentId(call, effectiveConfig);
+			const resolved = realtimeVoiceRuntime.resolveConfiguredRealtimeVoiceProvider({
+				configuredProviderId: effectiveConfig.realtime.provider,
+				providerConfigs: effectiveConfig.realtime.providers,
+				cfg,
+				agentId
+			});
+			return {
+				agentId,
+				provider: resolved.provider,
+				providerConfig: resolved.providerConfig,
+				instructions: resolveRealtimeInstructions(call)
+			};
+		};
+		const realtimeHandler = new RealtimeCallHandler(realtimeConfig, manager, resolveCallRegistration, config.serve.path, webhookServer.getStreamDisconnectLifecycle(), cfg);
 		if (config.realtime.toolPolicy !== "none") realtimeHandler.registerToolHandler(REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, async (args, callId, handlerContext) => {
 			handlerContext.abortSignal?.throwIfAborted();
 			const call = manager.getCall(callId);
@@ -4126,7 +4325,12 @@ async function createVoiceCallRuntime(params) {
 			const nextTunnelResult = await startTunnel({
 				provider: config.tunnel.provider,
 				port: config.serve.port,
+				tailscalePort: config.tailscale.port,
 				path: config.serve.path,
+				streamPaths: resolveVoiceCallStreamExposurePaths(config, {
+					publicWebhookPath: config.serve.path,
+					localWebhookPath: config.serve.path
+				}),
 				ngrokAuthToken: config.tunnel.ngrokAuthToken,
 				ngrokDomain: config.tunnel.ngrokDomain
 			});
@@ -4139,7 +4343,7 @@ async function createVoiceCallRuntime(params) {
 		const webhookUrl = publicUrl ?? localUrl;
 		if (providerRequiresPublicWebhook(provider.name) && isProviderUnreachableWebhookUrl(webhookUrl)) throw new Error(`[voice-call] ${provider.name} requires a publicly reachable webhook URL. Refusing to use local-only webhook ${webhookUrl}. Set plugins.entries.voice-call.config.publicUrl or enable tunnel/tailscale exposure.`);
 		if (publicUrl) provider.setPublicUrl?.(publicUrl);
-		if (publicUrl && realtimeProvider) webhookServer.getRealtimeHandler()?.setPublicUrl(publicUrl);
+		if (publicUrl && realtimeVoiceRuntime) webhookServer.getRealtimeHandler()?.setPublicUrl(publicUrl);
 		const realtimeHandler = webhookServer.getRealtimeHandler();
 		if (realtimeHandler) manager.streamSessionIssuer = (request) => realtimeHandler.issueStreamSession(request);
 		if (provider.name === "twilio" && config.streaming?.enabled) {
@@ -4163,7 +4367,7 @@ async function createVoiceCallRuntime(params) {
 				log.info("[voice-call] Media stream handler wired to provider");
 			}
 		}
-		if (realtimeProvider) log.info(`[voice-call] Realtime voice provider: ${realtimeProvider.provider.id}`);
+		if (realtimeVoiceRuntime) log.info("[voice-call] Realtime voice enabled");
 		await manager.initialize(provider, webhookUrl);
 		const stop = () => lifecycle.stop();
 		log.info("[voice-call] Runtime initialized");
@@ -4184,4 +4388,4 @@ async function createVoiceCallRuntime(params) {
 	}
 }
 //#endregion
-export { validateProviderConfig as S, escapeXml as _, normalizeProviderStatus as a, resolveVoiceCallConfig as b, resolveWebhookExposureStatus as c, setupTailscaleExposureRoute as d, TELEPHONY_DEFAULT_TTS_TIMEOUT_MS as f, resolveUserPath as g, resolveCallAgentId as h, mapProviderStatusToEndReason as i, cleanupTailscaleExposureRoute as l, resolveVoiceResponseModel as m, normalizeProxyIp as n, canonicalizeVoiceCallMediaBase64 as o, chunkAudio as p, isProviderStatusTerminal as r, getHeader as s, createVoiceCallRuntime as t, getTailscaleSelfInfo as u, mapVoiceToPolly as v, resolveVoiceCallSessionKey as x, VoiceCallConfigSchema as y };
+export { resolveVoiceCallStreamExposurePaths as C, resolveVoiceCallSessionKey as S, REALTIME_VOICE_END_CALL_TOOL_NAME as T, escapeXml as _, normalizeProviderStatus as a, resolveVoiceCallConfig as b, resolveWebhookExposureStatus as c, setupTailscaleExposureRoutes as d, TELEPHONY_DEFAULT_TTS_TIMEOUT_MS as f, resolveUserPath as g, resolveCallAgentId as h, mapProviderStatusToEndReason as i, cleanupTailscaleExposureRoute as l, resolveVoiceResponseModel as m, normalizeProxyIp as n, canonicalizeVoiceCallMediaBase64 as o, chunkAudio as p, isProviderStatusTerminal as r, getHeader as s, createVoiceCallRuntime as t, getTailscaleSelfInfo as u, mapVoiceToPolly as v, validateProviderConfig as w, resolveVoiceCallPublicPathPrefix as x, VoiceCallConfigSchema as y };