@openclaw/voice-call 2026.2.12 → 2026.2.14

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026.2.14
+
+### Changes
+
+- Version alignment with core OpenClaw release numbers.
+
+## 2026.2.13
+
+### Changes
+
+- Version alignment with core OpenClaw release numbers.
+
 ## 2026.2.6-3
 
 ### Changes

package/README.md

@@ -45,6 +45,14 @@ Put under `plugins.entries.voice-call.config`:
     authToken: "your_token",
   },
 
+  telnyx: {
+    apiKey: "KEYxxxx",
+    connectionId: "CONNxxxx",
+    // Telnyx webhook public key from the Telnyx Mission Control Portal
+    // (Base64 string; can also be set via TELNYX_PUBLIC_KEY).
+    publicKey: "...",
+  },
+
   plivo: {
     authId: "MAxxxxxxxxxxxxxxxxxxxx",
     authToken: "your_token",
@@ -76,6 +84,7 @@ Notes:
 
 - Twilio/Telnyx/Plivo require a **publicly reachable** webhook URL.
 - `mock` is a local dev provider (no network calls).
+- Telnyx requires `telnyx.publicKey` (or `TELNYX_PUBLIC_KEY`) unless `skipSignatureVerification` is true.
 - `tunnel.allowNgrokFreeTierLoopbackBypass: true` allows Twilio webhooks with invalid signatures **only** when `tunnel.provider="ngrok"` and `serve.bind` is loopback (ngrok local agent). Use for local dev only.
 
 ## TTS for calls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/voice-call",
-  "version": "2026.2.12",
+  "version": "2026.2.14",
   "description": "OpenClaw voice-call plugin",
   "type": "module",
   "dependencies": {

package/src/config.test.ts

@@ -47,6 +47,7 @@ describe("validateProviderConfig", () => {
     delete process.env.TWILIO_AUTH_TOKEN;
     delete process.env.TELNYX_API_KEY;
     delete process.env.TELNYX_CONNECTION_ID;
+    delete process.env.TELNYX_PUBLIC_KEY;
     delete process.env.PLIVO_AUTH_ID;
     delete process.env.PLIVO_AUTH_TOKEN;
   });
@@ -121,7 +122,7 @@ describe("validateProviderConfig", () => {
   describe("telnyx provider", () => {
     it("passes validation when credentials are in config", () => {
       const config = createBaseConfig("telnyx");
-      config.telnyx = { apiKey: "KEY123", connectionId: "CONN456" };
+      config.telnyx = { apiKey: "KEY123", connectionId: "CONN456", publicKey: "public-key" };
 
       const result = validateProviderConfig(config);
 
@@ -132,6 +133,7 @@ describe("validateProviderConfig", () => {
     it("passes validation when credentials are in environment variables", () => {
       process.env.TELNYX_API_KEY = "KEY123";
       process.env.TELNYX_CONNECTION_ID = "CONN456";
+      process.env.TELNYX_PUBLIC_KEY = "public-key";
       let config = createBaseConfig("telnyx");
       config = resolveVoiceCallConfig(config);
 
@@ -163,7 +165,7 @@ describe("validateProviderConfig", () => {
 
       expect(result.valid).toBe(false);
       expect(result.errors).toContain(
-        "plugins.entries.voice-call.config.telnyx.publicKey is required for inboundPolicy allowlist/pairing",
+        "plugins.entries.voice-call.config.telnyx.publicKey is required (or set TELNYX_PUBLIC_KEY env)",
       );
     });
 
@@ -181,6 +183,17 @@ describe("validateProviderConfig", () => {
       expect(result.valid).toBe(true);
       expect(result.errors).toEqual([]);
     });
+
+    it("passes validation when skipSignatureVerification is true (even without public key)", () => {
+      const config = createBaseConfig("telnyx");
+      config.skipSignatureVerification = true;
+      config.telnyx = { apiKey: "KEY123", connectionId: "CONN456" };
+
+      const result = validateProviderConfig(config);
+
+      expect(result.valid).toBe(true);
+      expect(result.errors).toEqual([]);
+    });
   });
 
   describe("plivo provider", () => {

package/src/config.ts

@@ -207,8 +207,10 @@ export const VoiceCallTunnelConfigSchema = z
     ngrokDomain: z.string().min(1).optional(),
     /**
      * Allow ngrok free tier compatibility mode.
-     * When true, signature verification failures on ngrok-free.app URLs
-     * will be allowed only for loopback requests (ngrok local agent).
+     * When true, forwarded headers may be trusted for loopback requests
+     * to reconstruct the public ngrok URL used for signing.
+     *
+     * IMPORTANT: This does NOT bypass signature verification.
      */
     allowNgrokFreeTierLoopbackBypass: z.boolean().default(false),
   })
@@ -483,12 +485,9 @@ export function validateProviderConfig(config: VoiceCallConfig): {
         "plugins.entries.voice-call.config.telnyx.connectionId is required (or set TELNYX_CONNECTION_ID env)",
       );
     }
-    if (
-      (config.inboundPolicy === "allowlist" || config.inboundPolicy === "pairing") &&
-      !config.telnyx?.publicKey
-    ) {
+    if (!config.skipSignatureVerification && !config.telnyx?.publicKey) {
       errors.push(
-        "plugins.entries.voice-call.config.telnyx.publicKey is required for inboundPolicy allowlist/pairing",
+        "plugins.entries.voice-call.config.telnyx.publicKey is required (or set TELNYX_PUBLIC_KEY env)",
       );
     }
   }

package/src/manager/context.ts

@@ -8,14 +8,32 @@ export type TranscriptWaiter = {
   timeout: NodeJS.Timeout;
 };
 
-export type CallManagerContext = {
+export type CallManagerRuntimeState = {
   activeCalls: Map<CallId, CallRecord>;
   providerCallIdMap: Map<string, CallId>;
   processedEventIds: Set<string>;
+  /** Provider call IDs we already sent a reject hangup for; avoids duplicate hangup calls. */
+  rejectedProviderCallIds: Set<string>;
+};
+
+export type CallManagerRuntimeDeps = {
   provider: VoiceCallProvider | null;
   config: VoiceCallConfig;
   storePath: string;
   webhookUrl: string | null;
+};
+
+export type CallManagerTransientState = {
   transcriptWaiters: Map<CallId, TranscriptWaiter>;
   maxDurationTimers: Map<CallId, NodeJS.Timeout>;
 };
+
+export type CallManagerHooks = {
+  /** Optional runtime hook invoked after an event transitions a call into answered state. */
+  onCallAnswered?: (call: CallRecord) => void;
+};
+
+export type CallManagerContext = CallManagerRuntimeState &
+  CallManagerRuntimeDeps &
+  CallManagerTransientState &
+  CallManagerHooks;

package/src/manager/events.test.ts

@@ -0,0 +1,240 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import type { HangupCallInput, NormalizedEvent } from "../types.js";
+import type { CallManagerContext } from "./context.js";
+import { VoiceCallConfigSchema } from "../config.js";
+import { processEvent } from "./events.js";
+
+function createContext(overrides: Partial<CallManagerContext> = {}): CallManagerContext {
+  const storePath = path.join(os.tmpdir(), `openclaw-voice-call-events-test-${Date.now()}`);
+  fs.mkdirSync(storePath, { recursive: true });
+  return {
+    activeCalls: new Map(),
+    providerCallIdMap: new Map(),
+    processedEventIds: new Set(),
+    rejectedProviderCallIds: new Set(),
+    provider: null,
+    config: VoiceCallConfigSchema.parse({
+      enabled: true,
+      provider: "plivo",
+      fromNumber: "+15550000000",
+    }),
+    storePath,
+    webhookUrl: null,
+    transcriptWaiters: new Map(),
+    maxDurationTimers: new Map(),
+    ...overrides,
+  };
+}
+
+describe("processEvent (functional)", () => {
+  it("calls provider hangup when rejecting inbound call", () => {
+    const hangupCalls: HangupCallInput[] = [];
+    const provider = {
+      name: "plivo" as const,
+      async hangupCall(input: HangupCallInput): Promise<void> {
+        hangupCalls.push(input);
+      },
+    };
+
+    const ctx = createContext({
+      config: VoiceCallConfigSchema.parse({
+        enabled: true,
+        provider: "plivo",
+        fromNumber: "+15550000000",
+        inboundPolicy: "disabled",
+      }),
+      provider,
+    });
+    const event: NormalizedEvent = {
+      id: "evt-1",
+      type: "call.initiated",
+      callId: "prov-1",
+      providerCallId: "prov-1",
+      timestamp: Date.now(),
+      direction: "inbound",
+      from: "+15559999999",
+      to: "+15550000000",
+    };
+
+    processEvent(ctx, event);
+
+    expect(ctx.activeCalls.size).toBe(0);
+    expect(hangupCalls).toHaveLength(1);
+    expect(hangupCalls[0]).toEqual({
+      callId: "prov-1",
+      providerCallId: "prov-1",
+      reason: "hangup-bot",
+    });
+  });
+
+  it("does not call hangup when provider is null", () => {
+    const ctx = createContext({
+      config: VoiceCallConfigSchema.parse({
+        enabled: true,
+        provider: "plivo",
+        fromNumber: "+15550000000",
+        inboundPolicy: "disabled",
+      }),
+      provider: null,
+    });
+    const event: NormalizedEvent = {
+      id: "evt-2",
+      type: "call.initiated",
+      callId: "prov-2",
+      providerCallId: "prov-2",
+      timestamp: Date.now(),
+      direction: "inbound",
+      from: "+15551111111",
+      to: "+15550000000",
+    };
+
+    processEvent(ctx, event);
+
+    expect(ctx.activeCalls.size).toBe(0);
+  });
+
+  it("calls hangup only once for duplicate events for same rejected call", () => {
+    const hangupCalls: HangupCallInput[] = [];
+    const provider = {
+      name: "plivo" as const,
+      async hangupCall(input: HangupCallInput): Promise<void> {
+        hangupCalls.push(input);
+      },
+    };
+    const ctx = createContext({
+      config: VoiceCallConfigSchema.parse({
+        enabled: true,
+        provider: "plivo",
+        fromNumber: "+15550000000",
+        inboundPolicy: "disabled",
+      }),
+      provider,
+    });
+    const event1: NormalizedEvent = {
+      id: "evt-init",
+      type: "call.initiated",
+      callId: "prov-dup",
+      providerCallId: "prov-dup",
+      timestamp: Date.now(),
+      direction: "inbound",
+      from: "+15552222222",
+      to: "+15550000000",
+    };
+    const event2: NormalizedEvent = {
+      id: "evt-ring",
+      type: "call.ringing",
+      callId: "prov-dup",
+      providerCallId: "prov-dup",
+      timestamp: Date.now(),
+      direction: "inbound",
+      from: "+15552222222",
+      to: "+15550000000",
+    };
+
+    processEvent(ctx, event1);
+    processEvent(ctx, event2);
+
+    expect(ctx.activeCalls.size).toBe(0);
+    expect(hangupCalls).toHaveLength(1);
+    expect(hangupCalls[0]?.providerCallId).toBe("prov-dup");
+  });
+
+  it("updates providerCallId map when provider ID changes", () => {
+    const now = Date.now();
+    const ctx = createContext();
+    ctx.activeCalls.set("call-1", {
+      callId: "call-1",
+      providerCallId: "request-uuid",
+      provider: "plivo",
+      direction: "outbound",
+      state: "initiated",
+      from: "+15550000000",
+      to: "+15550000001",
+      startedAt: now,
+      transcript: [],
+      processedEventIds: [],
+      metadata: {},
+    });
+    ctx.providerCallIdMap.set("request-uuid", "call-1");
+
+    processEvent(ctx, {
+      id: "evt-provider-id-change",
+      type: "call.answered",
+      callId: "call-1",
+      providerCallId: "call-uuid",
+      timestamp: now + 1,
+    });
+
+    expect(ctx.activeCalls.get("call-1")?.providerCallId).toBe("call-uuid");
+    expect(ctx.providerCallIdMap.get("call-uuid")).toBe("call-1");
+    expect(ctx.providerCallIdMap.has("request-uuid")).toBe(false);
+  });
+
+  it("invokes onCallAnswered hook for answered events", () => {
+    const now = Date.now();
+    let answeredCallId: string | null = null;
+    const ctx = createContext({
+      onCallAnswered: (call) => {
+        answeredCallId = call.callId;
+      },
+    });
+    ctx.activeCalls.set("call-2", {
+      callId: "call-2",
+      providerCallId: "call-2-provider",
+      provider: "plivo",
+      direction: "inbound",
+      state: "ringing",
+      from: "+15550000002",
+      to: "+15550000000",
+      startedAt: now,
+      transcript: [],
+      processedEventIds: [],
+      metadata: {},
+    });
+    ctx.providerCallIdMap.set("call-2-provider", "call-2");
+
+    processEvent(ctx, {
+      id: "evt-answered-hook",
+      type: "call.answered",
+      callId: "call-2",
+      providerCallId: "call-2-provider",
+      timestamp: now + 1,
+    });
+
+    expect(answeredCallId).toBe("call-2");
+  });
+
+  it("when hangup throws, logs and does not throw", () => {
+    const provider = {
+      name: "plivo" as const,
+      async hangupCall(): Promise<void> {
+        throw new Error("provider down");
+      },
+    };
+    const ctx = createContext({
+      config: VoiceCallConfigSchema.parse({
+        enabled: true,
+        provider: "plivo",
+        fromNumber: "+15550000000",
+        inboundPolicy: "disabled",
+      }),
+      provider,
+    });
+    const event: NormalizedEvent = {
+      id: "evt-fail",
+      type: "call.initiated",
+      callId: "prov-fail",
+      providerCallId: "prov-fail",
+      timestamp: Date.now(),
+      direction: "inbound",
+      from: "+15553333333",
+      to: "+15550000000",
+    };
+
+    expect(() => processEvent(ctx, event)).not.toThrow();
+    expect(ctx.activeCalls.size).toBe(0);
+  });
+});

package/src/manager/events.ts

@@ -13,10 +13,21 @@ import {
   startMaxDurationTimer,
 } from "./timers.js";
 
-function shouldAcceptInbound(
-  config: CallManagerContext["config"],
-  from: string | undefined,
-): boolean {
+type EventContext = Pick<
+  CallManagerContext,
+  | "activeCalls"
+  | "providerCallIdMap"
+  | "processedEventIds"
+  | "rejectedProviderCallIds"
+  | "provider"
+  | "config"
+  | "storePath"
+  | "transcriptWaiters"
+  | "maxDurationTimers"
+  | "onCallAnswered"
+>;
+
+function shouldAcceptInbound(config: EventContext["config"], from: string | undefined): boolean {
   const { inboundPolicy: policy, allowFrom } = config;
 
   switch (policy) {
@@ -49,7 +60,7 @@ function shouldAcceptInbound(
 }
 
 function createInboundCall(params: {
-  ctx: CallManagerContext;
+  ctx: EventContext;
   providerCallId: string;
   from: string;
   to: string;
@@ -80,7 +91,7 @@ function createInboundCall(params: {
   return callRecord;
 }
 
-export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): void {
+export function processEvent(ctx: EventContext, event: NormalizedEvent): void {
   if (ctx.processedEventIds.has(event.id)) {
     return;
   }
@@ -94,7 +105,29 @@ export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): v
 
   if (!call && event.direction === "inbound" && event.providerCallId) {
     if (!shouldAcceptInbound(ctx.config, event.from)) {
-      // TODO: Could hang up the call here.
+      const pid = event.providerCallId;
+      if (!ctx.provider) {
+        console.warn(
+          `[voice-call] Inbound call rejected by policy but no provider to hang up (providerCallId: ${pid}, from: ${event.from}); call will time out on provider side.`,
+        );
+        return;
+      }
+      if (ctx.rejectedProviderCallIds.has(pid)) {
+        return;
+      }
+      ctx.rejectedProviderCallIds.add(pid);
+      const callId = event.callId ?? pid;
+      console.log(`[voice-call] Rejecting inbound call by policy: ${pid}`);
+      void ctx.provider
+        .hangupCall({
+          callId,
+          providerCallId: pid,
+          reason: "hangup-bot",
+        })
+        .catch((err) => {
+          const message = err instanceof Error ? err.message : String(err);
+          console.warn(`[voice-call] Failed to reject inbound call ${pid}:`, message);
+        });
       return;
     }
 
@@ -113,9 +146,16 @@ export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): v
     return;
   }
 
-  if (event.providerCallId && !call.providerCallId) {
+  if (event.providerCallId && event.providerCallId !== call.providerCallId) {
+    const previousProviderCallId = call.providerCallId;
     call.providerCallId = event.providerCallId;
     ctx.providerCallIdMap.set(event.providerCallId, call.callId);
+    if (previousProviderCallId) {
+      const mapped = ctx.providerCallIdMap.get(previousProviderCallId);
+      if (mapped === call.callId) {
+        ctx.providerCallIdMap.delete(previousProviderCallId);
+      }
+    }
   }
 
   call.processedEventIds.push(event.id);
@@ -139,6 +179,7 @@ export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): v
           await endCall(ctx, callId);
         },
       });
+      ctx.onCallAnswered?.(call);
       break;
 
     case "call.active":

package/src/manager/outbound.ts

@@ -19,8 +19,39 @@ import {
 } from "./timers.js";
 import { generateNotifyTwiml } from "./twiml.js";
 
+type InitiateContext = Pick<
+  CallManagerContext,
+  "activeCalls" | "providerCallIdMap" | "provider" | "config" | "storePath" | "webhookUrl"
+>;
+
+type SpeakContext = Pick<
+  CallManagerContext,
+  "activeCalls" | "providerCallIdMap" | "provider" | "config" | "storePath"
+>;
+
+type ConversationContext = Pick<
+  CallManagerContext,
+  | "activeCalls"
+  | "providerCallIdMap"
+  | "provider"
+  | "config"
+  | "storePath"
+  | "transcriptWaiters"
+  | "maxDurationTimers"
+>;
+
+type EndCallContext = Pick<
+  CallManagerContext,
+  | "activeCalls"
+  | "providerCallIdMap"
+  | "provider"
+  | "storePath"
+  | "transcriptWaiters"
+  | "maxDurationTimers"
+>;
+
 export async function initiateCall(
-  ctx: CallManagerContext,
+  ctx: InitiateContext,
   to: string,
   sessionKey?: string,
   options?: OutboundCallOptions | string,
@@ -113,7 +144,7 @@ export async function initiateCall(
 }
 
 export async function speak(
-  ctx: CallManagerContext,
+  ctx: SpeakContext,
   callId: CallId,
   text: string,
 ): Promise<{ success: boolean; error?: string }> {
@@ -149,7 +180,7 @@ export async function speak(
 }
 
 export async function speakInitialMessage(
-  ctx: CallManagerContext,
+  ctx: ConversationContext,
   providerCallId: string,
 ): Promise<void> {
   const call = getCallByProviderCallId({
@@ -197,7 +228,7 @@ export async function speakInitialMessage(
 }
 
 export async function continueCall(
-  ctx: CallManagerContext,
+  ctx: ConversationContext,
   callId: CallId,
   prompt: string,
 ): Promise<{ success: boolean; transcript?: string; error?: string }> {
@@ -234,7 +265,7 @@ export async function continueCall(
 }
 
 export async function endCall(
-  ctx: CallManagerContext,
+  ctx: EndCallContext,
   callId: CallId,
 ): Promise<{ success: boolean; error?: string }> {
   const call = ctx.activeCalls.get(callId);

package/src/manager/store.ts

@@ -16,6 +16,7 @@ export function loadActiveCallsFromStore(storePath: string): {
   activeCalls: Map<CallId, CallRecord>;
   providerCallIdMap: Map<string, CallId>;
   processedEventIds: Set<string>;
+  rejectedProviderCallIds: Set<string>;
 } {
   const logPath = path.join(storePath, "calls.jsonl");
   if (!fs.existsSync(logPath)) {
@@ -23,6 +24,7 @@ export function loadActiveCallsFromStore(storePath: string): {
       activeCalls: new Map(),
       providerCallIdMap: new Map(),
       processedEventIds: new Set(),
+      rejectedProviderCallIds: new Set(),
     };
   }
 
@@ -45,6 +47,7 @@ export function loadActiveCallsFromStore(storePath: string): {
   const activeCalls = new Map<CallId, CallRecord>();
   const providerCallIdMap = new Map<string, CallId>();
   const processedEventIds = new Set<string>();
+  const rejectedProviderCallIds = new Set<string>();
 
   for (const [callId, call] of callMap) {
     if (TerminalStates.has(call.state)) {
@@ -59,7 +62,7 @@ export function loadActiveCallsFromStore(storePath: string): {
     }
   }
 
-  return { activeCalls, providerCallIdMap, processedEventIds };
+  return { activeCalls, providerCallIdMap, processedEventIds, rejectedProviderCallIds };
 }
 
 export async function getCallHistoryFromStore(

package/src/manager/timers.ts

@@ -2,7 +2,20 @@ import type { CallManagerContext } from "./context.js";
 import { TerminalStates, type CallId } from "../types.js";
 import { persistCallRecord } from "./store.js";
 
-export function clearMaxDurationTimer(ctx: CallManagerContext, callId: CallId): void {
+type TimerContext = Pick<
+  CallManagerContext,
+  "activeCalls" | "maxDurationTimers" | "config" | "storePath" | "transcriptWaiters"
+>;
+type MaxDurationTimerContext = Pick<
+  TimerContext,
+  "activeCalls" | "maxDurationTimers" | "config" | "storePath"
+>;
+type TranscriptWaiterContext = Pick<TimerContext, "transcriptWaiters">;
+
+export function clearMaxDurationTimer(
+  ctx: Pick<MaxDurationTimerContext, "maxDurationTimers">,
+  callId: CallId,
+): void {
   const timer = ctx.maxDurationTimers.get(callId);
   if (timer) {
     clearTimeout(timer);
@@ -11,7 +24,7 @@ export function clearMaxDurationTimer(ctx: CallManagerContext, callId: CallId):
 }
 
 export function startMaxDurationTimer(params: {
-  ctx: CallManagerContext;
+  ctx: MaxDurationTimerContext;
   callId: CallId;
   onTimeout: (callId: CallId) => Promise<void>;
 }): void {
@@ -38,7 +51,7 @@ export function startMaxDurationTimer(params: {
   params.ctx.maxDurationTimers.set(params.callId, timer);
 }
 
-export function clearTranscriptWaiter(ctx: CallManagerContext, callId: CallId): void {
+export function clearTranscriptWaiter(ctx: TranscriptWaiterContext, callId: CallId): void {
   const waiter = ctx.transcriptWaiters.get(callId);
   if (!waiter) {
     return;
@@ -48,7 +61,7 @@ export function clearTranscriptWaiter(ctx: CallManagerContext, callId: CallId):
 }
 
 export function rejectTranscriptWaiter(
-  ctx: CallManagerContext,
+  ctx: TranscriptWaiterContext,
   callId: CallId,
   reason: string,
 ): void {
@@ -61,7 +74,7 @@ export function rejectTranscriptWaiter(
 }
 
 export function resolveTranscriptWaiter(
-  ctx: CallManagerContext,
+  ctx: TranscriptWaiterContext,
   callId: CallId,
   transcript: string,
 ): void {
@@ -73,7 +86,7 @@ export function resolveTranscriptWaiter(
   waiter.resolve(transcript);
 }
 
-export function waitForFinalTranscript(ctx: CallManagerContext, callId: CallId): Promise<string> {
+export function waitForFinalTranscript(ctx: TimerContext, callId: CallId): Promise<string> {
   // Only allow one in-flight waiter per call.
   rejectTranscriptWaiter(ctx, callId, "Transcript waiter replaced");