@openclaw/voice-call 2026.2.21 → 2026.2.23

package/src/manager.test.ts

@@ -17,12 +17,16 @@ import type {
 } from "./types.js";
 
 class FakeProvider implements VoiceCallProvider {
-  readonly name = "plivo" as const;
+  readonly name: "plivo" | "twilio";
   readonly playTtsCalls: PlayTtsInput[] = [];
   readonly hangupCalls: HangupCallInput[] = [];
   readonly startListeningCalls: StartListeningInput[] = [];
   readonly stopListeningCalls: StopListeningInput[] = [];
 
+  constructor(name: "plivo" | "twilio" = "plivo") {
+    this.name = name;
+  }
+
   verifyWebhook(_ctx: WebhookContext): WebhookVerificationResult {
     return { ok: true };
   }
@@ -46,17 +50,44 @@ class FakeProvider implements VoiceCallProvider {
   }
 }
 
+let storeSeq = 0;
+
+function createTestStorePath(): string {
+  storeSeq += 1;
+  return path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}-${storeSeq}`);
+}
+
+function createManagerHarness(
+  configOverrides: Record<string, unknown> = {},
+  provider = new FakeProvider(),
+): {
+  manager: CallManager;
+  provider: FakeProvider;
+} {
+  const config = VoiceCallConfigSchema.parse({
+    enabled: true,
+    provider: "plivo",
+    fromNumber: "+15550000000",
+    ...configOverrides,
+  });
+  const manager = new CallManager(config, createTestStorePath());
+  manager.initialize(provider, "https://example.com/voice/webhook");
+  return { manager, provider };
+}
+
+function markCallAnswered(manager: CallManager, callId: string, eventId: string): void {
+  manager.processEvent({
+    id: eventId,
+    type: "call.answered",
+    callId,
+    providerCallId: "request-uuid",
+    timestamp: Date.now(),
+  });
+}
+
 describe("CallManager", () => {
   it("upgrades providerCallId mapping when provider ID changes", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
-    });
-
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const manager = new CallManager(config, storePath);
-    manager.initialize(new FakeProvider(), "https://example.com/voice/webhook");
+    const { manager } = createManagerHarness();
 
     const { callId, success, error } = await manager.initiateCall("+15550000001");
     expect(success).toBe(true);
@@ -81,16 +112,7 @@ describe("CallManager", () => {
   });
 
   it("speaks initial message on answered for notify mode (non-Twilio)", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
-    });
-
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
+    const { manager, provider } = createManagerHarness();
 
     const { callId, success } = await manager.initiateCall("+15550000002", undefined, {
       message: "Hello there",
@@ -113,19 +135,11 @@ describe("CallManager", () => {
   });
 
   it("rejects inbound calls with missing caller ID when allowlist enabled", () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       inboundPolicy: "allowlist",
       allowFrom: ["+15550001234"],
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     manager.processEvent({
       id: "evt-allowlist-missing",
       type: "call.initiated",
@@ -142,19 +156,11 @@ describe("CallManager", () => {
   });
 
   it("rejects inbound calls with anonymous caller ID when allowlist enabled", () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       inboundPolicy: "allowlist",
       allowFrom: ["+15550001234"],
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     manager.processEvent({
       id: "evt-allowlist-anon",
       type: "call.initiated",
@@ -172,19 +178,11 @@ describe("CallManager", () => {
   });
 
   it("rejects inbound calls that only match allowlist suffixes", () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       inboundPolicy: "allowlist",
       allowFrom: ["+15550001234"],
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     manager.processEvent({
       id: "evt-allowlist-suffix",
       type: "call.initiated",
@@ -202,18 +200,10 @@ describe("CallManager", () => {
   });
 
   it("rejects duplicate inbound events with a single hangup call", () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       inboundPolicy: "disabled",
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     manager.processEvent({
       id: "evt-reject-init",
       type: "call.initiated",
@@ -242,18 +232,11 @@ describe("CallManager", () => {
   });
 
   it("accepts inbound calls that exactly match the allowlist", () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager } = createManagerHarness({
       inboundPolicy: "allowlist",
       allowFrom: ["+15550001234"],
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const manager = new CallManager(config, storePath);
-    manager.initialize(new FakeProvider(), "https://example.com/voice/webhook");
-
     manager.processEvent({
       id: "evt-allowlist-exact",
       type: "call.initiated",
@@ -269,28 +252,14 @@ describe("CallManager", () => {
   });
 
   it("completes a closed-loop turn without live audio", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       transcriptTimeoutMs: 5000,
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     const started = await manager.initiateCall("+15550000003");
     expect(started.success).toBe(true);
 
-    manager.processEvent({
-      id: "evt-closed-loop-answered",
-      type: "call.answered",
-      callId: started.callId,
-      providerCallId: "request-uuid",
-      timestamp: Date.now(),
-    });
+    markCallAnswered(manager, started.callId, "evt-closed-loop-answered");
 
     const turnPromise = manager.continueCall(started.callId, "How can I help?");
     await new Promise((resolve) => setTimeout(resolve, 0));
@@ -323,28 +292,14 @@ describe("CallManager", () => {
   });
 
   it("rejects overlapping continueCall requests for the same call", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       transcriptTimeoutMs: 5000,
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     const started = await manager.initiateCall("+15550000004");
     expect(started.success).toBe(true);
 
-    manager.processEvent({
-      id: "evt-overlap-answered",
-      type: "call.answered",
-      callId: started.callId,
-      providerCallId: "request-uuid",
-      timestamp: Date.now(),
-    });
+    markCallAnswered(manager, started.callId, "evt-overlap-answered");
 
     const first = manager.continueCall(started.callId, "First prompt");
     const second = await manager.continueCall(started.callId, "Second prompt");
@@ -368,30 +323,71 @@ describe("CallManager", () => {
     expect(provider.stopListeningCalls).toHaveLength(1);
   });
 
-  it("tracks latency metadata across multiple closed-loop turns", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
-      transcriptTimeoutMs: 5000,
-    });
-
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
+  it("ignores speech events with mismatched turnToken while waiting for transcript", async () => {
+    const { manager, provider } = createManagerHarness(
+      {
+        transcriptTimeoutMs: 5000,
+      },
+      new FakeProvider("twilio"),
+    );
 
-    const started = await manager.initiateCall("+15550000005");
+    const started = await manager.initiateCall("+15550000004");
     expect(started.success).toBe(true);
 
+    markCallAnswered(manager, started.callId, "evt-turn-token-answered");
+
+    const turnPromise = manager.continueCall(started.callId, "Prompt");
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    const expectedTurnToken = provider.startListeningCalls[0]?.turnToken;
+    expect(typeof expectedTurnToken).toBe("string");
+
     manager.processEvent({
-      id: "evt-multi-answered",
-      type: "call.answered",
+      id: "evt-turn-token-bad",
+      type: "call.speech",
       callId: started.callId,
       providerCallId: "request-uuid",
       timestamp: Date.now(),
+      transcript: "stale replay",
+      isFinal: true,
+      turnToken: "wrong-token",
+    });
+
+    const pendingState = await Promise.race([
+      turnPromise.then(() => "resolved"),
+      new Promise<"pending">((resolve) => setTimeout(() => resolve("pending"), 0)),
+    ]);
+    expect(pendingState).toBe("pending");
+
+    manager.processEvent({
+      id: "evt-turn-token-good",
+      type: "call.speech",
+      callId: started.callId,
+      providerCallId: "request-uuid",
+      timestamp: Date.now(),
+      transcript: "final answer",
+      isFinal: true,
+      turnToken: expectedTurnToken,
     });
 
+    const turnResult = await turnPromise;
+    expect(turnResult.success).toBe(true);
+    expect(turnResult.transcript).toBe("final answer");
+
+    const call = manager.getCall(started.callId);
+    expect(call?.transcript.map((entry) => entry.text)).toEqual(["Prompt", "final answer"]);
+  });
+
+  it("tracks latency metadata across multiple closed-loop turns", async () => {
+    const { manager, provider } = createManagerHarness({
+      transcriptTimeoutMs: 5000,
+    });
+
+    const started = await manager.initiateCall("+15550000005");
+    expect(started.success).toBe(true);
+
+    markCallAnswered(manager, started.callId, "evt-multi-answered");
+
     const firstTurn = manager.continueCall(started.callId, "First question");
     await new Promise((resolve) => setTimeout(resolve, 0));
     manager.processEvent({
@@ -436,28 +432,14 @@ describe("CallManager", () => {
   });
 
   it("handles repeated closed-loop turns without waiter churn", async () => {
-    const config = VoiceCallConfigSchema.parse({
-      enabled: true,
-      provider: "plivo",
-      fromNumber: "+15550000000",
+    const { manager, provider } = createManagerHarness({
       transcriptTimeoutMs: 5000,
     });
 
-    const storePath = path.join(os.tmpdir(), `openclaw-voice-call-test-${Date.now()}`);
-    const provider = new FakeProvider();
-    const manager = new CallManager(config, storePath);
-    manager.initialize(provider, "https://example.com/voice/webhook");
-
     const started = await manager.initiateCall("+15550000006");
     expect(started.success).toBe(true);
 
-    manager.processEvent({
-      id: "evt-loop-answered",
-      type: "call.answered",
-      callId: started.callId,
-      providerCallId: "request-uuid",
-      timestamp: Date.now(),
-    });
+    markCallAnswered(manager, started.callId, "evt-loop-answered");
 
     for (let i = 1; i <= 5; i++) {
       const turnPromise = manager.continueCall(started.callId, `Prompt ${i}`);

package/src/media-stream.test.ts

@@ -1,4 +1,7 @@
+import { once } from "node:events";
+import http from "node:http";
 import { describe, expect, it } from "vitest";
+import { WebSocket } from "ws";
 import { MediaStreamHandler } from "./media-stream.js";
 import type {
   OpenAIRealtimeSTTProvider,
@@ -34,6 +37,70 @@ const waitForAbort = (signal: AbortSignal): Promise<void> =>
     signal.addEventListener("abort", () => resolve(), { once: true });
   });
 
+const withTimeout = async <T>(promise: Promise<T>, timeoutMs = 2000): Promise<T> => {
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`Timed out after ${timeoutMs}ms`)), timeoutMs);
+  });
+
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+};
+
+const startWsServer = async (
+  handler: MediaStreamHandler,
+): Promise<{
+  url: string;
+  close: () => Promise<void>;
+}> => {
+  const server = http.createServer();
+  server.on("upgrade", (request, socket, head) => {
+    handler.handleUpgrade(request, socket, head);
+  });
+
+  await new Promise<void>((resolve) => {
+    server.listen(0, "127.0.0.1", resolve);
+  });
+
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("Failed to resolve test server address");
+  }
+
+  return {
+    url: `ws://127.0.0.1:${address.port}/voice/stream`,
+    close: async () => {
+      await new Promise<void>((resolve, reject) => {
+        server.close((err) => (err ? reject(err) : resolve()));
+      });
+    },
+  };
+};
+
+const connectWs = async (url: string): Promise<WebSocket> => {
+  const ws = new WebSocket(url);
+  await withTimeout(once(ws, "open") as Promise<[unknown]>);
+  return ws;
+};
+
+const waitForClose = async (
+  ws: WebSocket,
+): Promise<{
+  code: number;
+  reason: string;
+}> => {
+  const [code, reason] = (await withTimeout(once(ws, "close") as Promise<[number, Buffer]>)) ?? [];
+  return {
+    code,
+    reason: Buffer.isBuffer(reason) ? reason.toString() : String(reason || ""),
+  };
+};
+
 describe("MediaStreamHandler TTS queue", () => {
   it("serializes TTS playback and resolves in order", async () => {
     const handler = new MediaStreamHandler({
@@ -94,3 +161,111 @@ describe("MediaStreamHandler TTS queue", () => {
     expect(queuedRan).toBe(false);
   });
 });
+
+describe("MediaStreamHandler security hardening", () => {
+  it("closes idle pre-start connections after timeout", async () => {
+    const shouldAcceptStreamCalls: Array<{ callId: string; streamSid: string; token?: string }> =
+      [];
+    const handler = new MediaStreamHandler({
+      sttProvider: createStubSttProvider(),
+      preStartTimeoutMs: 40,
+      shouldAcceptStream: (params) => {
+        shouldAcceptStreamCalls.push(params);
+        return true;
+      },
+    });
+    const server = await startWsServer(handler);
+
+    try {
+      const ws = await connectWs(server.url);
+      const closed = await waitForClose(ws);
+
+      expect(closed.code).toBe(1008);
+      expect(closed.reason).toBe("Start timeout");
+      expect(shouldAcceptStreamCalls).toEqual([]);
+    } finally {
+      await server.close();
+    }
+  });
+
+  it("enforces pending connection limits", async () => {
+    const handler = new MediaStreamHandler({
+      sttProvider: createStubSttProvider(),
+      preStartTimeoutMs: 5_000,
+      maxPendingConnections: 1,
+      maxPendingConnectionsPerIp: 1,
+    });
+    const server = await startWsServer(handler);
+
+    try {
+      const first = await connectWs(server.url);
+      const second = await connectWs(server.url);
+      const secondClosed = await waitForClose(second);
+
+      expect(secondClosed.code).toBe(1013);
+      expect(secondClosed.reason).toContain("Too many pending");
+      expect(first.readyState).toBe(WebSocket.OPEN);
+
+      first.close();
+      await waitForClose(first);
+    } finally {
+      await server.close();
+    }
+  });
+
+  it("rejects upgrades when max connection cap is reached", async () => {
+    const handler = new MediaStreamHandler({
+      sttProvider: createStubSttProvider(),
+      preStartTimeoutMs: 5_000,
+      maxConnections: 1,
+      maxPendingConnections: 10,
+      maxPendingConnectionsPerIp: 10,
+    });
+    const server = await startWsServer(handler);
+
+    try {
+      const first = await connectWs(server.url);
+      const secondError = await withTimeout(
+        new Promise<Error>((resolve) => {
+          const ws = new WebSocket(server.url);
+          ws.once("error", (err) => resolve(err as Error));
+        }),
+      );
+
+      expect(secondError.message).toContain("Unexpected server response: 503");
+
+      first.close();
+      await waitForClose(first);
+    } finally {
+      await server.close();
+    }
+  });
+
+  it("clears pending state after valid start", async () => {
+    const handler = new MediaStreamHandler({
+      sttProvider: createStubSttProvider(),
+      preStartTimeoutMs: 40,
+      shouldAcceptStream: () => true,
+    });
+    const server = await startWsServer(handler);
+
+    try {
+      const ws = await connectWs(server.url);
+      ws.send(
+        JSON.stringify({
+          event: "start",
+          streamSid: "MZ123",
+          start: { callSid: "CA123", customParameters: { token: "token-123" } },
+        }),
+      );
+
+      await new Promise((resolve) => setTimeout(resolve, 80));
+      expect(ws.readyState).toBe(WebSocket.OPEN);
+
+      ws.close();
+      await waitForClose(ws);
+    } finally {
+      await server.close();
+    }
+  });
+});