@openclaw/voice-call 2026.9.7 → 2026.10.1-beta.1

package/dist/.setup/{cli-D6uwMXyS.mjs → cli-Cn1leykM.mjs}

@@ -1,13 +1,14 @@
 import { sleep } from "../api.js";
-import { l as resolveVoiceCallStreamExposurePaths, u as validateProviderConfig } from "./config-Ds7xoZbI.mjs";
-import { d as findCallInStore, f as getCallHistoryFromStore, n as resolveDefaultVoiceCallStoreDir, p as loadActiveCallsFromStore, s as MAX_CALL_RECORD_EVENTS, t as resolveUserPath, x as setVoiceCallStateRuntime } from "./utils-B5pnM_Ij.mjs";
-import { d as cleanupTailscaleExposureRoute, f as getTailscaleSelfInfo, p as setupTailscaleExposureRoutes, u as resolveWebhookExposureStatus, v as resolveVoiceCallAgentId } from "./runtime-entry-BNOQRXii.mjs";
+import { l as resolveVoiceCallStreamExposurePaths, u as validateProviderConfig } from "./config-CX9J-053.mjs";
+import { _ as MAX_CALL_RECORD_EVENTS, b as loadActiveCallsFromStore, c as resolveWebhookExposureStatus, d as setupTailscaleExposureRoutes, h as resolveVoiceCallAgentId, l as cleanupTailscaleExposureRoute, u as getTailscaleSelfInfo, v as findCallInStore, x as setVoiceCallStateRuntime, y as getCallHistoryFromStore } from "./runtime-entry-CbSKxSKk.mjs";
+import { r as resolveUserPath, t as resolveDefaultVoiceCallStoreDir } from "./store-path-Cfwff6j7.mjs";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { callGatewayFromCli, isGatewayClientRequestError, isGatewayTransportError, redactSensitiveUrlLikeString } from "openclaw/plugin-sdk/gateway-runtime";
 import { isRecord, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { MAX_TCP_PORT, MAX_TIMER_TIMEOUT_MS, addTimerTimeoutGraceMs, clampTimerTimeoutMs, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import fs from "node:fs";
 import path from "node:path";
+import { createDeferred } from "openclaw/plugin-sdk/concurrency-runtime";
 import { once } from "node:events";
 import { format } from "node:util";
 //#region extensions/voice-call/src/cli-command-io.ts
@@ -94,11 +95,6 @@ async function* readLogLines(file, last, pollMs) {
 		await sleep(pollMs);
 	}
 }
-function percentile(values, p) {
-	if (values.length === 0) return 0;
-	const sorted = [...values].toSorted((a, b) => a - b);
-	return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil(p / 100 * sorted.length) - 1))] ?? 0;
-}
 function summarizeSeries(values) {
 	if (values.length === 0) return {
 		count: 0,
@@ -108,16 +104,16 @@ function summarizeSeries(values) {
 		p50Ms: 0,
 		p95Ms: 0
 	};
-	const minMs = values.reduce((min, value) => value < min ? value : min);
-	const maxMs = values.reduce((max, value) => value > max ? value : max);
+	const sorted = values.toSorted((a, b) => a - b);
+	const percentile = (fraction) => sorted[Math.ceil(fraction * sorted.length) - 1] ?? 0;
 	const avgMs = values.reduce((sum, value) => sum + value, 0) / values.length;
 	return {
 		count: values.length,
-		minMs,
-		maxMs,
+		minMs: sorted[0] ?? 0,
+		maxMs: sorted[sorted.length - 1] ?? 0,
 		avgMs,
-		p50Ms: percentile(values, 50),
-		p95Ms: percentile(values, 95)
+		p50Ms: percentile(.5),
+		p95Ms: percentile(.95)
 	};
 }
 async function writeVoiceCallLatencySummary(calls) {
@@ -388,8 +384,40 @@ function writeSetupStatus(status) {
 	writeCliLine("Voice Call setup: %s", status.ok ? "OK" : "needs attention");
 	for (const check of status.checks) writeCliLine("%s %s: %s", check.ok ? "OK" : "FAIL", check.id, check.message);
 }
+async function runWithStandaloneRuntime(createRuntime, run) {
+	let runtime;
+	const interrupted = createDeferred();
+	let exitSignal;
+	const interrupt = (signal) => {
+		exitSignal ??= signal;
+		process.exitCode = exitSignal === "SIGINT" ? 130 : 143;
+		interrupted.resolve();
+	};
+	const onSigint = () => interrupt("SIGINT");
+	const onSigterm = () => interrupt("SIGTERM");
+	try {
+		await run(async () => {
+			if (!runtime) {
+				process.on("SIGINT", onSigint);
+				process.on("SIGTERM", onSigterm);
+				runtime = createRuntime();
+			}
+			const active = await runtime;
+			if (exitSignal) throw new Error(`Voice call command interrupted by ${exitSignal}`);
+			return active;
+		});
+		if (runtime) await interrupted.promise;
+	} finally {
+		try {
+			await (await runtime?.catch(() => void 0))?.stop();
+		} finally {
+			process.off("SIGINT", onSigint);
+			process.off("SIGTERM", onSigterm);
+		}
+	}
+}
 function registerVoiceCallCli(params) {
-	const { program, config, coreConfig, ensureRuntime, stateRuntime } = params;
+	const { program, config, coreConfig, ensureRuntime: createRuntime, stateRuntime } = params;
 	const ensureHistoryStateRuntime = () => {
 		if (stateRuntime) setVoiceCallStateRuntime({ state: stateRuntime });
 	};
@@ -402,7 +430,7 @@ function registerVoiceCallCli(params) {
 		}
 		writeSetupStatus(status);
 	});
-	root.command("smoke").description("Check Voice Call readiness and optionally place a short outbound test call").option("-t, --to <phone>", "Phone number to call for a live smoke").option("--message <text>", "Message to speak during the smoke call", "OpenClaw voice call smoke test.").option("--mode <mode>", "Call mode: notify or conversation", "notify").option("--yes", "Actually place the live outbound call").option("--json", "Print machine-readable JSON").action(async (options) => {
+	root.command("smoke").description("Check Voice Call readiness and optionally place a short outbound test call").option("-t, --to <phone>", "Phone number to call for a live smoke").option("--message <text>", "Message to speak during the smoke call", "OpenClaw voice call smoke test.").option("--mode <mode>", "Call mode: notify or conversation", "notify").option("--yes", "Actually place the live outbound call").option("--json", "Print machine-readable JSON").action(async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		const setup = buildSetupStatus(config, coreConfig);
 		if (!setup.ok) {
 			if (options.json) writeCliJson({
@@ -459,28 +487,20 @@ function registerVoiceCallCli(params) {
 		}
 		writeSetupStatus(setup);
 		writeCliLine("live-call: started %s", callId);
-	});
-	root.command("call").description("Initiate an outbound voice call").requiredOption("-m, --message <text>", "Message to speak when call connects").option("-t, --to <phone>", "Phone number to call (E.164 format, uses config toNumber if not set)").option("--mode <mode>", "Call mode: notify (hangup after message) or conversation (stay open)", "conversation").action(async (options) => {
-		writeCliJson({ callId: await initiateVoiceCall({
-			ensureRuntime,
-			config,
-			method: "voicecall.initiate",
-			to: options.to,
-			message: options.message,
-			mode: options.mode
-		}) });
-	});
-	root.command("start").description("Alias for voicecall call").requiredOption("--to <phone>", "Phone number to call").option("--message <text>", "Message to speak when call connects").option("--mode <mode>", "Call mode: notify (hangup after message) or conversation (stay open)", "conversation").action(async (options) => {
+	}));
+	const callAction = (method) => async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		writeCliJson({ callId: await initiateVoiceCall({
 			ensureRuntime,
 			config,
-			method: "voicecall.start",
+			method,
 			to: options.to,
 			message: options.message,
 			mode: options.mode
 		}) });
 	});
-	root.command("continue").description("Speak a message and wait for a response").requiredOption("--call-id <id>", "Call ID").requiredOption("--message <text>", "Message to speak").action(async (options) => {
+	root.command("call").description("Initiate an outbound voice call").requiredOption("-m, --message <text>", "Message to speak when call connects").option("-t, --to <phone>", "Phone number to call (E.164 format, uses config toNumber if not set)").option("--mode <mode>", "Call mode: notify (hangup after message) or conversation (stay open)", "conversation").action(callAction("voicecall.initiate"));
+	root.command("start").description("Alias for voicecall call").requiredOption("--to <phone>", "Phone number to call").option("--message <text>", "Message to speak when call connects").option("--mode <mode>", "Call mode: notify (hangup after message) or conversation (stay open)", "conversation").action(callAction("voicecall.start"));
+	root.command("continue").description("Speak a message and wait for a response").requiredOption("--call-id <id>", "Call ID").requiredOption("--message <text>", "Message to speak").action(async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		const gatewayParams = {
 			callId: options.callId,
 			message: options.message
@@ -501,8 +521,8 @@ function registerVoiceCallCli(params) {
 			managerFallback: (manager) => manager.continueCall(options.callId, options.message),
 			failureLabel: "continue"
 		});
-	});
-	root.command("speak").description("Speak a message without waiting for response").requiredOption("--call-id <id>", "Call ID").requiredOption("--message <text>", "Message to speak").action(async (options) => {
+	}));
+	root.command("speak").description("Speak a message without waiting for response").requiredOption("--call-id <id>", "Call ID").requiredOption("--message <text>", "Message to speak").action(async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		await runGatewayManagerCommand({
 			config,
 			ensureRuntime,
@@ -513,8 +533,8 @@ function registerVoiceCallCli(params) {
 			managerFallback: (manager) => manager.speak(options.callId, options.message),
 			failureLabel: "speak"
 		});
-	});
-	root.command("dtmf").description("Send DTMF digits to an active call").requiredOption("--call-id <id>", "Call ID").requiredOption("--digits <digits>", "DTMF digits").action(async (options) => {
+	}));
+	root.command("dtmf").description("Send DTMF digits to an active call").requiredOption("--call-id <id>", "Call ID").requiredOption("--digits <digits>", "DTMF digits").action(async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		await runGatewayManagerCommand({
 			config,
 			ensureRuntime,
@@ -525,8 +545,8 @@ function registerVoiceCallCli(params) {
 			managerFallback: (manager) => manager.sendDtmf(options.callId, options.digits),
 			failureLabel: "dtmf"
 		});
-	});
-	root.command("end").description("Hang up an active call").requiredOption("--call-id <id>", "Call ID").action(async (options) => {
+	}));
+	root.command("end").description("Hang up an active call").requiredOption("--call-id <id>", "Call ID").action(async (options) => runWithStandaloneRuntime(createRuntime, async (ensureRuntime) => {
 		await runGatewayManagerCommand({
 			config,
 			ensureRuntime,
@@ -534,7 +554,7 @@ function registerVoiceCallCli(params) {
 			managerFallback: (manager) => manager.endCall(options.callId),
 			failureLabel: "end"
 		});
-	});
+	}));
 	root.command("status").description("Show call status").option("--call-id <id>", "Call ID").option("--json", "Print machine-readable JSON").action(async (options) => {
 		const gateway = await callVoiceCallGateway("voicecall.status", options.callId ? { callId: options.callId } : void 0);
 		if (gateway.ok) {

package/dist/.setup/{config-Ds7xoZbI.mjs → config-CX9J-053.mjs}

@@ -1,5 +1,5 @@
 import { TtsConfigSchema } from "../api.js";
-import { t as TWILIO_REGIONS } from "./twilio-region-4fkgz3UG.mjs";
+import { t as TWILIO_REGIONS } from "./twilio-region-wBOx-8sz.mjs";
 import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, REALTIME_VOICE_AGENT_CONSULT_TOOL_POLICIES, resolveRealtimeVoiceAgentConsultTools } from "openclaw/plugin-sdk/realtime-voice";
 import { mergeDeep } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -10,18 +10,13 @@ import { normalizeWebhookPath } from "openclaw/plugin-sdk/webhook-ingress";
 import { z } from "zod";
 import { MAX_TCP_PORT } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/voice-call/src/allowlist.ts
-/** Normalize a phone number to digits only. */
 function normalizePhoneNumber(input) {
-	if (!input) return "";
-	return input.replace(/\D/g, "");
+	return input?.replace(/\D/g, "") ?? "";
 }
 /** Return true when the normalized caller exactly matches an allowlist entry. */
 function isAllowlistedCaller(normalizedFrom, allowFrom) {
 	if (!normalizedFrom) return false;
-	return (allowFrom ?? []).some((num) => {
-		const normalizedAllow = normalizePhoneNumber(num);
-		return normalizedAllow !== "" && normalizedAllow === normalizedFrom;
-	});
+	return (allowFrom ?? []).some((num) => normalizePhoneNumber(num) === normalizedFrom);
 }
 //#endregion
 //#region extensions/voice-call/src/realtime-call-control.ts
@@ -71,18 +66,7 @@ function isTailscalePortAllowed(config) {
 }
 //#endregion
 //#region extensions/voice-call/src/config.ts
-/**
-* E.164 phone number format: +[country code][number]
-* Examples use 555 prefix (reserved for fictional numbers)
-*/
 const E164Schema = z.string().regex(/^\+[1-9]\d{1,14}$/, "Expected E.164 format, e.g. +15550001234");
-/**
-* Controls how inbound calls are handled:
-* - "disabled": Block all inbound calls (outbound only)
-* - "allowlist": Only accept calls from numbers in allowFrom
-* - "pairing": Unknown callers can request pairing (future)
-* - "open": Accept all inbound calls (dangerous!)
-*/
 const InboundPolicySchema = z.enum([
 	"disabled",
 	"allowlist",
@@ -91,47 +75,33 @@ const InboundPolicySchema = z.enum([
 ]);
 const SecretInputSchema = buildSecretInputSchema();
 const TelnyxConfigSchema = z.object({
-	/** Telnyx API v2 key */
 	apiKey: z.string().min(1).optional(),
-	/** Telnyx connection ID (from Call Control app) */
 	connectionId: z.string().min(1).optional(),
 	/** Public key for webhook signature verification */
 	publicKey: z.string().min(1).optional()
 }).strict();
 const TwilioConfigSchema = z.object({
-	/** Twilio Account SID */
 	accountSid: z.string().min(1).optional(),
-	/** Twilio Auth Token */
 	authToken: SecretInputSchema.optional(),
 	/** Twilio processing Region (for example, ie1) */
 	region: z.enum(TWILIO_REGIONS).optional()
 }).strict();
 const PlivoConfigSchema = z.object({
-	/** Plivo Auth ID (starts with MA/SA) */
 	authId: z.string().min(1).optional(),
-	/** Plivo Auth Token */
 	authToken: z.string().min(1).optional()
 }).strict();
 const VoiceCallNumberRouteConfigSchema = z.object({
-	/** Greeting message for inbound calls to this number. */
 	inboundGreeting: z.string().optional(),
 	/** TTS override for inbound calls to this number. Deep-merges with global voice-call TTS. */
 	tts: TtsConfigSchema,
-	/** Agent ID to use for voice response generation for this number. */
 	agentId: z.string().min(1).optional(),
-	/** Optional model override for voice responses for this number. */
 	responseModel: z.string().optional(),
-	/** System prompt for voice responses for this number. */
 	responseSystemPrompt: z.string().optional(),
-	/** Timeout for response generation in ms for this number. */
 	responseTimeoutMs: z.number().int().positive().optional()
 }).strict();
 const VoiceCallServeConfigSchema = z.object({
-	/** Port to listen on */
 	port: z.number().int().positive().default(3334),
-	/** Bind address */
 	bind: z.string().default("127.0.0.1"),
-	/** Webhook path */
 	path: z.string().min(1).default("/voice/webhook")
 }).strict().default({
 	port: 3334,
@@ -139,13 +109,6 @@ const VoiceCallServeConfigSchema = z.object({
 	path: "/voice/webhook"
 });
 const VoiceCallTunnelConfigSchema = z.object({
-	/**
-	* Tunnel provider:
-	* - "none": No tunnel (use publicUrl if set, or manual setup)
-	* - "ngrok": Use ngrok for public HTTPS tunnel
-	* - "tailscale-serve": Tailscale serve (private to tailnet)
-	* - "tailscale-funnel": Tailscale funnel (public HTTPS)
-	*/
 	provider: z.enum([
 		"none",
 		"ngrok",
@@ -156,23 +119,14 @@ const VoiceCallTunnelConfigSchema = z.object({
 	ngrokAuthToken: z.string().min(1).optional(),
 	/** ngrok custom domain (paid feature, e.g., "myapp.ngrok.io") */
 	ngrokDomain: z.string().min(1).optional(),
-	/**
-	* Allow ngrok free tier compatibility mode.
-	* When true, forwarded headers may be trusted for loopback requests
-	* to reconstruct the public ngrok URL used for signing.
-	*
-	* IMPORTANT: This does NOT bypass signature verification.
-	*/
+	/** Trust loopback forwarding for ngrok URL reconstruction; signatures remain mandatory. */
 	allowNgrokFreeTierLoopbackBypass: z.boolean().default(false)
 }).strict().default({
 	provider: "none",
 	allowNgrokFreeTierLoopbackBypass: false
 });
 const VoiceCallWebhookSecurityConfigSchema = z.object({
-	/**
-	* Allowed hostnames for webhook URL reconstruction.
-	* Only these hosts are accepted from forwarding headers.
-	*/
+	/** Only these hosts are accepted from forwarding headers. */
 	allowedHosts: z.array(z.string().min(1)).default([]),
 	/**
 	* Trust X-Forwarded-* headers without a hostname allowlist.
@@ -189,11 +143,6 @@ const VoiceCallWebhookSecurityConfigSchema = z.object({
 	trustForwardingHeaders: false,
 	trustedProxyIPs: []
 });
-/**
-* Call mode determines how outbound calls behave:
-* - "notify": Deliver message and auto-hangup after delay (one-way notification)
-* - "conversation": Stay open for back-and-forth until explicit end or timeout
-*/
 const CallModeSchema = z.enum(["notify", "conversation"]);
 const VoiceCallSessionScopeSchema = z.enum([
 	"per-phone",
@@ -201,7 +150,6 @@ const VoiceCallSessionScopeSchema = z.enum([
 	"main"
 ]);
 const OutboundConfigSchema = z.object({
-	/** Default call mode for outbound calls */
 	defaultMode: CallModeSchema.default("notify"),
 	/** Seconds to wait after TTS before auto-hangup in notify mode */
 	notifyHangupDelaySec: z.number().int().nonnegative().default(3)
@@ -250,7 +198,6 @@ const VoiceCallRealtimeAgentContextConfigSchema = z.object({
 	enabled: z.boolean().default(false),
 	/** Maximum number of characters in the generated profile-file block. */
 	maxChars: z.number().int().positive().default(6e3),
-	/** Include configured agent identity fields. */
 	includeIdentity: z.boolean().default(true),
 	/** Include selected workspace files such as SOUL.md and IDENTITY.md. */
 	includeWorkspaceFiles: z.boolean().default(true),
@@ -283,7 +230,6 @@ const VoiceCallRealtimeConsultThinkingLevelSchema = z.enum([
 	"ultra"
 ]);
 const VoiceCallRealtimeConfigSchema = z.object({
-	/** Enable realtime voice-to-voice mode. */
 	enabled: z.boolean().default(false),
 	/** Provider id from registered realtime voice providers. */
 	provider: z.string().min(1).optional(),
@@ -299,7 +245,6 @@ const VoiceCallRealtimeConfigSchema = z.object({
 	consultThinkingLevel: VoiceCallRealtimeConsultThinkingLevelSchema.optional(),
 	/** Optional fast mode override for the regular agent behind realtime consults. */
 	consultFastMode: z.boolean().optional(),
-	/** Tool definitions exposed to the realtime provider. */
 	tools: z.array(RealtimeToolSchema).default([]),
 	/** Low-latency memory/session context for the consult tool. */
 	fastContext: VoiceCallRealtimeFastContextConfigSchema,
@@ -313,24 +258,8 @@ const VoiceCallRealtimeConfigSchema = z.object({
 	toolPolicy: "safe-read-only",
 	consultPolicy: "auto",
 	tools: [],
-	fastContext: {
-		enabled: false,
-		timeoutMs: 800,
-		maxResults: 3,
-		sources: ["memory", "sessions"],
-		fallbackToConsult: false
-	},
-	agentContext: {
-		enabled: false,
-		maxChars: 6e3,
-		includeIdentity: true,
-		includeWorkspaceFiles: true,
-		files: [
-			"SOUL.md",
-			"IDENTITY.md",
-			"USER.md"
-		]
-	},
+	fastContext: VoiceCallRealtimeFastContextConfigSchema.parse({}),
+	agentContext: VoiceCallRealtimeAgentContextConfigSchema.parse({}),
 	providers: {}
 });
 const VoiceCallStreamingConfigSchema = z.object({
@@ -338,7 +267,6 @@ const VoiceCallStreamingConfigSchema = z.object({
 	enabled: z.boolean().default(false),
 	/** Provider id from registered realtime transcription providers. */
 	provider: z.string().min(1).optional(),
-	/** WebSocket path for media stream connections */
 	streamPath: z.string().min(1).default("/voice/stream"),
 	/** Provider-owned raw config blobs keyed by provider id. */
 	providers: VoiceCallProvidersConfigSchema,
@@ -363,36 +291,25 @@ const VoiceCallStreamingConfigSchema = z.object({
 	maxConnections: 128
 });
 const VoiceCallConfigSchema = z.object({
-	/** Enable voice call functionality */
 	enabled: z.boolean().default(false),
-	/** Active provider (telnyx, twilio, plivo, or mock) */
 	provider: z.enum([
 		"telnyx",
 		"twilio",
 		"plivo",
 		"mock"
 	]).optional(),
-	/** Telnyx-specific configuration */
 	telnyx: TelnyxConfigSchema.optional(),
-	/** Twilio-specific configuration */
 	twilio: TwilioConfigSchema.optional(),
-	/** Plivo-specific configuration */
 	plivo: PlivoConfigSchema.optional(),
-	/** Phone number to call from (E.164) */
 	fromNumber: E164Schema.optional(),
-	/** Default phone number to call (E.164) */
+	/** Default outbound target. */
 	toNumber: E164Schema.optional(),
-	/** Inbound call policy */
 	inboundPolicy: InboundPolicySchema.default("disabled"),
-	/** Allowlist of phone numbers for inbound calls (E.164) */
 	allowFrom: z.array(E164Schema).default([]),
-	/** Greeting message for inbound calls */
 	inboundGreeting: z.string().optional(),
 	/** Per-dialed-number overrides for inbound calls. Keys are E.164 numbers. */
 	numbers: z.record(E164Schema, VoiceCallNumberRouteConfigSchema).default({}),
-	/** Outbound call configuration */
 	outbound: OutboundConfigSchema,
-	/** Maximum call duration in seconds */
 	maxDurationSeconds: z.number().int().positive().default(300),
 	/**
 	* Maximum age of a call in seconds before it is automatically reaped.
@@ -402,23 +319,15 @@ const VoiceCallConfigSchema = z.object({
 	staleCallReaperSeconds: z.number().int().nonnegative().default(120),
 	/** Silence timeout for end-of-speech detection (ms) */
 	silenceTimeoutMs: z.number().int().positive().default(800),
-	/** Timeout for user transcript (ms) */
 	transcriptTimeoutMs: z.number().int().positive().default(18e4),
-	/** Ring timeout for outbound calls (ms) */
 	ringTimeoutMs: z.number().int().positive().default(3e4),
-	/** Maximum concurrent calls */
 	maxConcurrentCalls: z.number().int().positive().default(1),
-	/** Webhook server configuration */
 	serve: VoiceCallServeConfigSchema,
 	/** @deprecated Prefer tunnel config. */
 	tailscale: VoiceCallTailscaleConfigSchema,
-	/** Tunnel configuration (unified ngrok/tailscale) */
 	tunnel: VoiceCallTunnelConfigSchema,
-	/** Webhook signature reconstruction and proxy trust configuration */
 	webhookSecurity: VoiceCallWebhookSecurityConfigSchema,
-	/** Real-time audio streaming configuration */
 	streaming: VoiceCallStreamingConfigSchema,
-	/** Realtime voice-to-voice configuration */
 	realtime: VoiceCallRealtimeConfigSchema,
 	/** Session memory scope for voice conversations. */
 	sessionScope: VoiceCallSessionScopeSchema.default("per-phone"),
@@ -428,15 +337,11 @@ const VoiceCallConfigSchema = z.object({
 	skipSignatureVerification: z.boolean().default(false),
 	/** TTS override (deep-merges with core tts) */
 	tts: TtsConfigSchema,
-	/** Store path for call logs */
 	store: z.string().optional(),
 	/** Response/session owner. Required when multiple agents have no legacy owner. */
 	agentId: z.string().min(1).optional(),
-	/** Optional model override for generating voice responses. */
 	responseModel: z.string().optional(),
-	/** System prompt for voice responses */
 	responseSystemPrompt: z.string().optional(),
-	/** Timeout for response generation in ms (default 30s) */
 	responseTimeoutMs: z.number().int().positive().default(3e4)
 }).strict().refine(isTailscalePortAllowed, {
 	path: ["tailscale", "port"],
@@ -626,10 +531,6 @@ function resolveVoiceCallAgentSessionKey(params) {
 		sessionKey: normalizedScopedKey
 	});
 }
-/**
-* Resolves the configuration by merging environment variables into missing fields.
-* Returns a new configuration object with environment variables applied.
-*/
 function resolveVoiceCallConfig(config) {
 	const resolved = normalizeVoiceCallConfig(config);
 	if (resolved.provider === "telnyx") {
@@ -652,14 +553,9 @@ function resolveVoiceCallConfig(config) {
 	resolved.tunnel.allowNgrokFreeTierLoopbackBypass = resolved.tunnel.allowNgrokFreeTierLoopbackBypass ?? false;
 	resolved.tunnel.ngrokAuthToken = resolved.tunnel.ngrokAuthToken ?? resolveSpeechProviderApiKey(process.env.NGROK_AUTHTOKEN);
 	resolved.tunnel.ngrokDomain = resolved.tunnel.ngrokDomain ?? resolveSpeechProviderApiKey(process.env.NGROK_DOMAIN);
-	resolved.webhookSecurity.allowedHosts = resolved.webhookSecurity.allowedHosts ?? [];
 	resolved.webhookSecurity.trustForwardingHeaders = resolved.webhookSecurity.trustForwardingHeaders ?? false;
-	resolved.webhookSecurity.trustedProxyIPs = resolved.webhookSecurity.trustedProxyIPs ?? [];
 	return normalizeVoiceCallConfig(resolved);
 }
-/**
-* Validate that the configuration has all required fields for the selected provider.
-*/
 function validateProviderConfig(config) {
 	const errors = [];
 	if (!config.enabled) return {
@@ -668,18 +564,21 @@ function validateProviderConfig(config) {
 	};
 	if (!config.provider) errors.push("plugins.entries.voice-call.config.provider is required");
 	if (!config.fromNumber && config.provider !== "mock") errors.push(config.provider === "twilio" ? "plugins.entries.voice-call.config.fromNumber is required (or set TWILIO_FROM_NUMBER env)" : "plugins.entries.voice-call.config.fromNumber is required");
+	const requireCredential = (field, value, envName) => {
+		if (!value) errors.push(`plugins.entries.voice-call.config.${config.provider}.${field} is required (or set ${envName} env)`);
+	};
 	if (config.provider === "telnyx") {
-		if (!config.telnyx?.apiKey) errors.push("plugins.entries.voice-call.config.telnyx.apiKey is required (or set TELNYX_API_KEY env)");
-		if (!config.telnyx?.connectionId) errors.push("plugins.entries.voice-call.config.telnyx.connectionId is required (or set TELNYX_CONNECTION_ID env)");
-		if (!config.skipSignatureVerification && !config.telnyx?.publicKey) errors.push("plugins.entries.voice-call.config.telnyx.publicKey is required (or set TELNYX_PUBLIC_KEY env)");
+		requireCredential("apiKey", config.telnyx?.apiKey, "TELNYX_API_KEY");
+		requireCredential("connectionId", config.telnyx?.connectionId, "TELNYX_CONNECTION_ID");
+		if (!config.skipSignatureVerification) requireCredential("publicKey", config.telnyx?.publicKey, "TELNYX_PUBLIC_KEY");
 	}
 	if (config.provider === "twilio") {
-		if (!config.twilio?.accountSid) errors.push("plugins.entries.voice-call.config.twilio.accountSid is required (or set TWILIO_ACCOUNT_SID env)");
-		if (!hasConfiguredSecretInput(config.twilio?.authToken)) errors.push("plugins.entries.voice-call.config.twilio.authToken is required (or set TWILIO_AUTH_TOKEN env)");
+		requireCredential("accountSid", config.twilio?.accountSid, "TWILIO_ACCOUNT_SID");
+		requireCredential("authToken", hasConfiguredSecretInput(config.twilio?.authToken), "TWILIO_AUTH_TOKEN");
 	}
 	if (config.provider === "plivo") {
-		if (!config.plivo?.authId) errors.push("plugins.entries.voice-call.config.plivo.authId is required (or set PLIVO_AUTH_ID env)");
-		if (!config.plivo?.authToken) errors.push("plugins.entries.voice-call.config.plivo.authToken is required (or set PLIVO_AUTH_TOKEN env)");
+		requireCredential("authId", config.plivo?.authId, "PLIVO_AUTH_ID");
+		requireCredential("authToken", config.plivo?.authToken, "PLIVO_AUTH_TOKEN");
 	}
 	if (config.realtime.enabled && config.inboundPolicy === "disabled") errors.push("plugins.entries.voice-call.config.inboundPolicy must not be \"disabled\" when realtime.enabled is true");
 	if (config.realtime.enabled && config.streaming.enabled) errors.push("plugins.entries.voice-call.config.realtime.enabled and plugins.entries.voice-call.config.streaming.enabled cannot both be true");