@vellumai/vellum-gateway 0.7.3 → 0.8.1

package/src/http/routes/log-tail.test.ts

@@ -43,6 +43,7 @@ mock.module("../../logger.js", () => {
     getLogger: () => noopLogger,
     initLogger: noop,
     LOG_FILE_PATTERN: /^gateway-(\d{4}-\d{2}-\d{2})\.log$/,
+    LOG_FILE_JSON_PATTERN: /^gateway-(\d{4}-\d{2}-\d{2})\.jsonl$/,
   };
 });
 
@@ -137,7 +138,7 @@ describe("log-tail handler", () => {
       makeLogLine(30, "entry 4"),
       makeLogLine(30, "entry 5"),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -161,7 +162,7 @@ describe("log-tail handler", () => {
       makeLogLine(50, "error msg"),
       makeLogLine(60, "fatal msg"),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -184,7 +185,7 @@ describe("log-tail handler", () => {
       makeLogLine(30, "trust message", { module: "trust" }),
       makeLogLine(30, "another mcp", { module: "mcp" }),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -205,7 +206,7 @@ describe("log-tail handler", () => {
       makeLogLine(30, "valid entry"),
       "{broken json",
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -225,7 +226,7 @@ describe("log-tail handler", () => {
       makeLogLine(30, "entry 3"),
       makeLogLine(30, "entry 4"),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -244,7 +245,7 @@ describe("log-tail handler", () => {
       makeLogLine(30, "entry 2"),
       makeLogLine(30, "entry 3"),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), lines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), lines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -264,11 +265,11 @@ describe("log-tail handler", () => {
       makeLogLine(30, "yesterday 2"),
       makeLogLine(30, "yesterday 3"),
     ];
-    writeFileSync(join(tmpDir, "gateway-2026-05-03.log"), yesterdayLines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-03.jsonl"), yesterdayLines.join("\n"));
 
     // Today file: 1 entry
     const todayLines = [makeLogLine(30, "today 1")];
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), todayLines.join("\n"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), todayLines.join("\n"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);
@@ -296,7 +297,7 @@ describe("log-tail handler", () => {
   test("n=1001 in querystring → returns successfully (clamped to 1000)", async () => {
     tmpDir = mkdtempSync(join(tmpdir(), "gw-log-tail-test-"));
 
-    writeFileSync(join(tmpDir, "gateway-2026-05-04.log"), makeLogLine(30, "entry"));
+    writeFileSync(join(tmpDir, "gateway-2026-05-04.jsonl"), makeLogLine(30, "entry"));
 
     const config = makeConfig(tmpDir);
     const handler = createLogTailHandler(config);

package/src/http/routes/log-tail.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 
 import type { GatewayConfig } from "../../config.js";
-import { getLogger } from "../../logger.js";
+import { getLogger, LOG_FILE_JSON_PATTERN } from "../../logger.js";
 
 const log = getLogger("log-tail");
 
@@ -18,7 +18,10 @@ const LEVEL_MAP: Record<LevelName, number> = {
   fatal: 60,
 };
 
-const LOG_FILE_PATTERN = /^gateway-\d{4}-\d{2}-\d{2}\.log$/;
+// Server-side level/module filtering walks the JSONL sidecar produced by the
+// logger. The default human-readable .log file is pino-pretty multi-line and
+// not safely parseable line-by-line.
+const LOG_FILE_PATTERN = LOG_FILE_JSON_PATTERN;
 
 export function createLogTailHandler(
   config: GatewayConfig,

package/src/http/routes/pair.ts

@@ -30,6 +30,7 @@ import { KNOWN_EXTENSION_ORIGINS } from "../../chrome-extension-origins.js";
 import { assistantDbQuery } from "../../db/assistant-db-proxy.js";
 import { getLogger } from "../../logger.js";
 import { isLoopbackAddress } from "../../util/is-loopback-address.js";
+import { VELAY_FORWARDED_HEADER } from "../../velay/bridge-utils.js";
 
 const log = getLogger("pair");
 
@@ -211,6 +212,13 @@ export async function handlePair(
     });
   }
 
+  // Defense-in-depth: reject Velay-bridged requests. The bridge injects this
+  // header on every forwarded request; it cannot be stripped by a Velay client.
+  if (req.headers.get(VELAY_FORWARDED_HEADER)) {
+    auditDeny(req, clientIp, "velay_bridged");
+    return errorResponse("FORBIDDEN", "endpoint is local-only", 403);
+  }
+
   if (!clientIp || !isLoopbackAddress(clientIp)) {
     auditDeny(req, clientIp, "non_loopback_peer");
     return errorResponse("FORBIDDEN", "endpoint is local-only", 403);

package/src/http/routes/twilio-voice-webhook.ts

@@ -152,20 +152,29 @@ export function createTwilioVoiceWebhookHandler(
           // this number themselves, so disclosing their own name is expected.
           const unverifiedStatuses = new Set(["unverified", "pending"]);
           if (callerRecord && unverifiedStatuses.has(callerRecord.channel.status)) {
+            const isGuardian = callerRecord.contact.role === "guardian";
             log.info(
               {
                 callSid: params.CallSid,
                 contactId: callerRecord.contact.id,
                 channelStatus: callerRecord.channel.status,
+                isGuardian,
               },
               "Known-but-unverified caller — returning verification guidance TwiML",
             );
             const name = escapeXml(callerRecord.contact.displayName);
+            // Conditional guidance: only the guardian has direct access to the
+            // assistant's contacts page; other contacts must ask the guardian
+            // to (re)start a verification session for them.
+            const action = isGuardian
+              ? `To verify, open your assistant's contacts page, click Verify next to the phone channel, ` +
+                `and follow the prompts. Then call back once the verification session is active.`
+              : `Please reach out to the account guardian to start a new verification session, ` +
+                `then call back once the verification session is active.`;
             const twiml =
               `<?xml version="1.0" encoding="UTF-8"?><Response>` +
               `<Say>This number is registered as ${name}'s phone but has not been verified yet. ` +
-              `To verify, open your assistant's contacts page, click Verify next to the phone channel, ` +
-              `and follow the prompts. Then call back once the verification session is active.</Say>` +
+              `${action}</Say>` +
               `</Response>`;
             return new Response(twiml, { status: 200, headers: TWIML_HEADERS });
           }

package/src/index.ts

@@ -106,6 +106,14 @@ import {
   createBackupSnapshotHandler,
 } from "./backup/backup-routes.js";
 import { startBackupWorker } from "./backup/backup-worker.js";
+import {
+  startVoiceApprovalSync,
+  stopVoiceApprovalSync,
+} from "./verification/voice-approval-sync.js";
+import {
+  startOutboundVoiceVerificationSync,
+  stopOutboundVoiceVerificationSync,
+} from "./verification/outbound-voice-verification-sync.js";
 import { createWorkspaceCommitProxyHandler } from "./http/routes/workspace-commit-proxy.js";
 import { createBrainGraphProxyHandler } from "./http/routes/brain-graph-proxy.js";
 import { createLogExportHandler } from "./http/routes/log-export.js";
@@ -417,7 +425,9 @@ async function main() {
 
   const audioProxy = createAudioProxyHandler(config);
 
-  const backupDeps = { assistantRuntimeBaseUrl: config.assistantRuntimeBaseUrl };
+  const backupDeps = {
+    assistantRuntimeBaseUrl: config.assistantRuntimeBaseUrl,
+  };
   const handleListBackups = createListBackupsHandler(backupDeps);
   const handleCreateBackup = createBackupSnapshotHandler(backupDeps);
 
@@ -635,6 +645,13 @@ async function main() {
       handler: (req, params) =>
         contactsControlPlaneProxy.handleUpdateContactChannel(req, params[0]),
     },
+    {
+      path: /^\/v1\/contact-channels\/([^/]+)\/verify$/,
+      method: "POST",
+      auth: "edge-guardian",
+      handler: (req, params) =>
+        contactsControlPlaneProxy.handleVerifyContactChannel(req, params[0]),
+    },
     // ── Contacts/invites control plane ──
     {
       path: "/v1/contacts/invites",
@@ -671,7 +688,15 @@ async function main() {
     {
       // Keep DELETE on the invite collection unsupported; only /invites/:id
       // should revoke an invite.
-      path: /^\/v1\/contacts\/(?!invites$)([^/]+)$/,
+      path: /^\/v1\/contacts\/(?!invites\/?$)([^/]+)\/?$/,
+      method: "DELETE",
+      auth: "edge",
+      handler: (_req, params) =>
+        contactsControlPlaneProxy.handleDeleteContact(params[0]),
+    },
+    {
+      // Assistant-scoped variant for clients using the auto-prefix.
+      path: /^\/v1\/assistants\/[^/]+\/contacts\/(?!invites\/?$)([^/]+)\/?$/,
       method: "DELETE",
       auth: "edge",
       handler: (_req, params) =>
@@ -707,8 +732,8 @@ async function main() {
       path: "/v1/guardian/reset-bootstrap",
       method: "POST",
       auth: "none",
-      handler: (_req, _params, getClientIp) =>
-        channelVerificationSessionProxy.handleResetBootstrap(getClientIp()),
+      handler: (req, _params, getClientIp) =>
+        channelVerificationSessionProxy.handleResetBootstrap(getClientIp(), req),
     },
     {
       path: "/v1/channel-verification-sessions",
@@ -1271,6 +1296,57 @@ async function main() {
       auth: "edge",
       handler: (req, params) => handleTrustRulesDelete(req, params[0]),
     },
+
+    // ── Trust rules v3 — assistant-scoped variants ──
+    // Mirror the flat /v1/trust-rules routes for clients that use
+    // GatewayHTTPClient's auto-prefix (Swift TrustRuleClient and
+    // vellum-assistant-platform's web/src/lib/trust-rules/api.ts), which build
+    // URLs like /v1/assistants/<id>/trust-rules/. Without these, the request
+    // falls through to the runtime-proxy catch-all and the daemon serves 404
+    // on mutations (the daemon HTTP handlers were stripped by #28784).
+    //
+    // Trust rules are gateway-global, so the assistant id is matched and
+    // discarded. Same precedent as the assistant-scoped /v1/assistants/.../
+    // contacts DELETE route above.
+    {
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/?$/,
+      method: "GET",
+      auth: "edge",
+      handler: (req) => handleTrustRulesList(req),
+    },
+    {
+      // Must appear before the create entry and before the /:id catch-all
+      // so the literal /suggest segment is matched first.
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/suggest\/?$/,
+      method: "POST",
+      auth: "edge",
+      handler: (req) => handleTrustRulesSuggest(req),
+    },
+    {
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/?$/,
+      method: "POST",
+      auth: "edge",
+      handler: (req) => handleTrustRulesCreate(req),
+    },
+    {
+      // Reset must be registered before the /:id catch-all regex.
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/([^/]+)\/reset\/?$/,
+      method: "POST",
+      auth: "edge",
+      handler: (req, params) => handleTrustRulesReset(req, params[0]),
+    },
+    {
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/([^/]+)\/?$/,
+      method: "PATCH",
+      auth: "edge",
+      handler: (req, params) => handleTrustRulesUpdate(req, params[0]),
+    },
+    {
+      path: /^\/v1\/assistants\/[^/]+\/trust-rules\/([^/]+)\/?$/,
+      method: "DELETE",
+      auth: "edge",
+      handler: (req, params) => handleTrustRulesDelete(req, params[0]),
+    },
   ];
 
   // Runtime proxy catch-all — must be last so specific routes are checked first.
@@ -1516,15 +1592,13 @@ async function main() {
 
     // ── Route table dispatch ──
     try {
-      const response = router(req, url, resolveClientIp, svr);
+      const response = await router(req, url, resolveClientIp, svr);
       if (response !== null) {
         if (extensionOrigin) {
-          const resolved = await response;
-          return withExtensionCorsHeaders(resolved, extensionOrigin);
+          return withExtensionCorsHeaders(response, extensionOrigin);
         }
         if (webviewOrigin) {
-          const resolved = await response;
-          return withCorsHeaders(resolved, webviewOrigin);
+          return withCorsHeaders(response, webviewOrigin);
         }
         return response;
       }
@@ -1544,7 +1618,8 @@ async function main() {
             headers: { "Retry-After": String(err.retryAfterSecs) },
           },
         );
-        if (extensionOrigin) return withExtensionCorsHeaders(body, extensionOrigin);
+        if (extensionOrigin)
+          return withExtensionCorsHeaders(body, extensionOrigin);
         return withCorsHeaders(body, webviewOrigin!);
       }
       log.error({ err }, "Unhandled gateway error");
@@ -1552,7 +1627,8 @@ async function main() {
         { error: "Internal server error" },
         { status: 500 },
       );
-      if (extensionOrigin) return withExtensionCorsHeaders(errBody, extensionOrigin);
+      if (extensionOrigin)
+        return withExtensionCorsHeaders(errBody, extensionOrigin);
       return withCorsHeaders(errBody, webviewOrigin!);
     }
 
@@ -1560,7 +1636,8 @@ async function main() {
       { error: "Not found", source: "gateway" },
       { status: 404 },
     );
-    if (extensionOrigin) return withExtensionCorsHeaders(notFound, extensionOrigin);
+    if (extensionOrigin)
+      return withExtensionCorsHeaders(notFound, extensionOrigin);
     if (webviewOrigin) return withCorsHeaders(notFound, webviewOrigin);
     return notFound;
   }
@@ -1709,7 +1786,10 @@ async function main() {
               sourceChannel: "slack",
               externalUserId: normalized.event.actor.actorExternalId,
               ...(normalized.event.source.chatType === "im"
-                ? { externalChatId: normalized.event.message.conversationExternalId }
+                ? {
+                    externalChatId:
+                      normalized.event.message.conversationExternalId,
+                  }
                 : {}),
               displayName: normalized.event.actor.displayName,
               username: normalized.event.actor.username,
@@ -2049,6 +2129,9 @@ async function main() {
     assistantRuntimeBaseUrl: config.assistantRuntimeBaseUrl,
   });
 
+  startVoiceApprovalSync();
+  startOutboundVoiceVerificationSync();
+
   const featureFlagWatcher = new FeatureFlagWatcher();
   featureFlagWatcher.start();
 
@@ -2095,6 +2178,8 @@ async function main() {
     const shutdownTasks: Promise<void>[] = [];
     sleepWakeDetector.stop();
     backupWorkerHandle.stop();
+    stopVoiceApprovalSync();
+    stopOutboundVoiceVerificationSync();
     credentialWatcher.stop();
     configFileWatcher.stop();
     avatarSyncWatcher.stop();

package/src/ipc/assistant-client.test.ts

@@ -14,7 +14,12 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { ipcCallAssistant, ipcSuggestTrustRule } from "./assistant-client.js";
+import {
+  IpcHandlerError,
+  IpcTransportError,
+  ipcCallAssistant,
+  ipcSuggestTrustRule,
+} from "./assistant-client.js";
 
 // ---------------------------------------------------------------------------
 // Test infrastructure
@@ -22,10 +27,16 @@ import { ipcCallAssistant, ipcSuggestTrustRule } from "./assistant-client.js";
 
 let server: Server | undefined;
 let origWorkspaceDir: string | undefined;
+let origAssistantIpcDir: string | undefined;
 
-// Save and restore VELLUM_WORKSPACE_DIR around each test.
+// Save and restore VELLUM_WORKSPACE_DIR + ASSISTANT_IPC_SOCKET_DIR around
+// each test. The sandbox sets ASSISTANT_IPC_SOCKET_DIR, which would
+// otherwise win over VELLUM_WORKSPACE_DIR in `resolveIpcSocketPath` and
+// route requests to the real daemon socket instead of our test server.
 beforeEach(() => {
   origWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+  origAssistantIpcDir = process.env.ASSISTANT_IPC_SOCKET_DIR;
+  delete process.env.ASSISTANT_IPC_SOCKET_DIR;
   server = undefined;
 });
 
@@ -36,6 +47,12 @@ afterEach(async () => {
     delete process.env.VELLUM_WORKSPACE_DIR;
   }
 
+  if (origAssistantIpcDir !== undefined) {
+    process.env.ASSISTANT_IPC_SOCKET_DIR = origAssistantIpcDir;
+  } else {
+    delete process.env.ASSISTANT_IPC_SOCKET_DIR;
+  }
+
   if (server) {
     await new Promise<void>((resolve) => {
       server!.close(() => resolve());
@@ -72,6 +89,19 @@ function sendError(socket: Socket, id: string, error: string): void {
   socket.write(JSON.stringify({ id, error }) + "\n");
 }
 
+/** Send a handler-level error (with statusCode) over the socket. */
+function sendHandlerError(
+  socket: Socket,
+  id: string,
+  error: string,
+  statusCode: number,
+  errorCode: string,
+): void {
+  socket.write(
+    JSON.stringify({ id, error, statusCode, errorCode }) + "\n",
+  );
+}
+
 /**
  * Start an in-process NDJSON server that reads one request and calls
  * `handler` with the parsed method, params, and socket.
@@ -131,14 +161,15 @@ describe("ipcCallAssistant", () => {
     expect(result).toEqual(expectedResult);
   });
 
-  test("returns undefined when the socket does not exist", async () => {
+  test("throws IpcTransportError when the socket does not exist", async () => {
     setupWorkspace();
     // No server started — socket file does not exist
-    const result = await ipcCallAssistant("test_method");
-    expect(result).toBeUndefined();
+    await expect(ipcCallAssistant("test_method")).rejects.toBeInstanceOf(
+      IpcTransportError,
+    );
   });
 
-  test("returns undefined when server returns an error field", async () => {
+  test("throws IpcTransportError when server returns an error without statusCode", async () => {
     const sockPath = setupWorkspace();
 
     await startServer(sockPath, (id, _method, _params, socket) => {
@@ -146,8 +177,29 @@ describe("ipcCallAssistant", () => {
       socket.end();
     });
 
-    const result = await ipcCallAssistant("failing_method");
-    expect(result).toBeUndefined();
+    await expect(ipcCallAssistant("failing_method")).rejects.toBeInstanceOf(
+      IpcTransportError,
+    );
+  });
+
+  test("throws IpcHandlerError when server returns error with statusCode", async () => {
+    const sockPath = setupWorkspace();
+
+    await startServer(sockPath, (id, _method, _params, socket) => {
+      sendHandlerError(socket, id, "Not found", 404, "NOT_FOUND");
+      socket.end();
+    });
+
+    const promise = ipcCallAssistant("failing_method");
+    await expect(promise).rejects.toBeInstanceOf(IpcHandlerError);
+    try {
+      await promise;
+    } catch (err) {
+      const handlerErr = err as IpcHandlerError;
+      expect(handlerErr.message).toBe("Not found");
+      expect(handlerErr.statusCode).toBe(404);
+      expect(handlerErr.code).toBe("NOT_FOUND");
+    }
   });
 
   test("passes method and params to the server", async () => {
@@ -227,7 +279,7 @@ describe("ipcSuggestTrustRule", () => {
     expect(receivedMethod).toBe("suggest_trust_rule");
   });
 
-  test("throws when the assistant returns an error field", async () => {
+  test("propagates IpcTransportError when the assistant returns an error field", async () => {
     const sockPath = setupWorkspace();
 
     await startServer(sockPath, (id, _method, _params, socket) => {
@@ -235,8 +287,8 @@ describe("ipcSuggestTrustRule", () => {
       socket.end();
     });
 
-    await expect(ipcSuggestTrustRule(validRequest)).rejects.toThrow(
-      "ipcSuggestTrustRule: unexpected response shape",
+    await expect(ipcSuggestTrustRule(validRequest)).rejects.toBeInstanceOf(
+      IpcTransportError,
     );
   });
 
@@ -279,12 +331,12 @@ describe("ipcSuggestTrustRule", () => {
     );
   });
 
-  test("throws when the socket is unavailable (assistant not running)", async () => {
+  test("propagates IpcTransportError when the socket is unavailable", async () => {
     setupWorkspace();
-    // No server — socket does not exist, ipcCallAssistant returns undefined
+    // No server — socket does not exist, ipcCallAssistant throws IpcTransportError.
 
-    await expect(ipcSuggestTrustRule(validRequest)).rejects.toThrow(
-      "ipcSuggestTrustRule: unexpected response shape",
+    await expect(ipcSuggestTrustRule(validRequest)).rejects.toBeInstanceOf(
+      IpcTransportError,
     );
   });
 });

package/src/ipc/assistant-client.ts

@@ -15,7 +15,6 @@
 
 import { connect, type Socket } from "node:net";
 
-import { getLogger } from "../logger.js";
 import type { ScopeOption, DirectoryScopeOption } from "../risk/risk-types.js";
 import { resolveIpcSocketPath } from "./socket-path.js";
 
@@ -49,8 +48,8 @@ interface IpcResponse {
 // ---------------------------------------------------------------------------
 
 /**
- * Error thrown by {@link ipcCallAssistantStrict} when the daemon returns
- * a handler-level error (e.g. a RouteError with statusCode).
+ * Error thrown by {@link ipcCallAssistant} when the daemon returns a
+ * handler-level error (e.g. a RouteError with statusCode).
  */
 export class IpcHandlerError extends Error {
   readonly statusCode: number;
@@ -65,8 +64,8 @@ export class IpcHandlerError extends Error {
 }
 
 /**
- * Error thrown by {@link ipcCallAssistantStrict} when the daemon is
- * unreachable (socket error, timeout, closed before response).
+ * Error thrown by {@link ipcCallAssistant} when the daemon is unreachable
+ * (socket error, timeout, closed before response).
  */
 export class IpcTransportError extends Error {
   constructor(message: string) {
@@ -87,124 +86,19 @@ function getAssistantSocketPath(): string {
 // One-shot IPC call to the assistant
 // ---------------------------------------------------------------------------
 
-const log = getLogger("assistant-client");
-
 /**
  * One-shot IPC helper: connect to assistant.sock, call a method, disconnect.
  *
- * Returns `undefined` on any failure (socket not found, timeout, parse error)
- * so callers can fall back gracefully. Uses a 30-second call timeout to
- * accommodate LLM latency on the assistant side.
- */
-export async function ipcCallAssistant(
-  method: string,
-  params?: Record<string, unknown>,
-): Promise<unknown> {
-  const socketPath = getAssistantSocketPath();
-
-  return new Promise<unknown>((resolve) => {
-    let settled = false;
-    let callTimer: ReturnType<typeof setTimeout> | undefined;
-
-    const finish = (value: unknown) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(connectTimer);
-      if (callTimer) clearTimeout(callTimer);
-      socket.destroy();
-      resolve(value);
-    };
-
-    const connectTimer = setTimeout(() => {
-      log.warn(
-        { method, socketPath, timeoutMs: CONNECT_TIMEOUT_MS },
-        "Assistant IPC connect timed out",
-      );
-      finish(undefined);
-    }, CONNECT_TIMEOUT_MS);
-
-    const socket: Socket = connect(socketPath);
-    socket.unref();
-
-    let buffer = "";
-    const reqId = crypto.randomUUID();
-
-    socket.on("connect", () => {
-      clearTimeout(connectTimer);
-      const req: IpcRequest = { id: reqId, method, params };
-      socket.write(JSON.stringify(req) + "\n");
-
-      callTimer = setTimeout(() => {
-        log.warn(
-          { method, socketPath, timeoutMs: CALL_TIMEOUT_MS },
-          "Assistant IPC call timed out waiting for response",
-        );
-        finish(undefined);
-      }, CALL_TIMEOUT_MS);
-
-      socket.on("data", (chunk) => {
-        buffer += chunk.toString();
-        let newlineIdx: number;
-        while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
-          const line = buffer.slice(0, newlineIdx).trim();
-          buffer = buffer.slice(newlineIdx + 1);
-          if (!line) continue;
-
-          try {
-            const msg = JSON.parse(line) as IpcResponse;
-            if (msg.id === reqId) {
-              if (msg.error) {
-                log.warn(
-                  { error: msg.error, method },
-                  "Assistant IPC call returned error",
-                );
-                finish(undefined);
-              } else {
-                finish(msg.result);
-              }
-              return;
-            }
-          } catch {
-            // Ignore malformed lines
-          }
-        }
-      });
-    });
-
-    socket.on("error", (err) => {
-      log.warn(
-        {
-          err: err instanceof Error ? err.message : String(err),
-          code: (err as NodeJS.ErrnoException).code ?? "unknown",
-          method,
-          socketPath,
-        },
-        "Assistant IPC socket error",
-      );
-      finish(undefined);
-    });
-
-    socket.on("close", () => {
-      if (!settled) {
-        log.warn(
-          { method, socketPath },
-          "Assistant IPC socket closed before response",
-        );
-      }
-      finish(undefined);
-    });
-  });
-}
-
-/**
- * Strict IPC call that distinguishes handler errors from transport failures.
- *
  * - On success: resolves with the result value.
- * - On handler error (RouteError): throws {@link IpcHandlerError} with
- *   statusCode and code.
- * - On transport failure: throws {@link IpcTransportError}.
+ * - On handler error (assistant RouteError): throws {@link IpcHandlerError}
+ *   with statusCode and code.
+ * - On transport failure (socket not found, timeout, parse error, closed
+ *   before response): throws {@link IpcTransportError}.
+ *
+ * Uses a 30-second call timeout to accommodate LLM latency on the
+ * assistant side.
  */
-export async function ipcCallAssistantStrict(
+export async function ipcCallAssistant(
   method: string,
   params?: Record<string, unknown>,
 ): Promise<unknown> {