@openclaw/voice-call 2026.7.1-beta.2 → 2026.7.1-beta.5

package/README.md

@@ -98,6 +98,7 @@ Put under `plugins.entries.voice-call.config`:
 Notes:
 
 - Twilio/Telnyx/Plivo require a **publicly reachable** webhook URL.
+- Twilio defaults to US1. For a non-US Region, set `twilio.region` to `ie1` or `au1` and use credentials created in that Region; see [Twilio's regional REST API guide](https://www.twilio.com/docs/global-infrastructure/using-the-twilio-rest-api-in-a-non-us-region).
 - `mock` is a local dev provider (no network calls).
 - Telnyx requires `telnyx.publicKey` (or `TELNYX_PUBLIC_KEY`) unless `skipSignatureVerification` is true.
 - If older configs still use `provider: "log"`, `twilio.from`, or legacy `streaming.*` OpenAI keys, run `openclaw doctor --fix` to rewrite them.

package/dist/{config-DNtTB7Iw.js → config-CgigQDrF.js}

@@ -1,13 +1,14 @@
 import { TtsConfigSchema } from "./runtime-api.js";
 import "./api.js";
+import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { REALTIME_VOICE_AGENT_CONSULT_TOOL_NAME, REALTIME_VOICE_AGENT_CONSULT_TOOL_POLICIES } from "openclaw/plugin-sdk/realtime-voice";
-import { normalizeAgentId, parseAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { canonicalizeMainSessionAlias } from "openclaw/plugin-sdk/session-store-runtime";
+import { normalizeWebhookPath } from "openclaw/plugin-sdk/webhook-ingress";
 import { z } from "zod";
 //#region extensions/voice-call/src/deep-merge.ts
-const BLOCKED_MERGE_KEYS = new Set([
+const BLOCKED_MERGE_KEYS = /* @__PURE__ */ new Set([
 	"__proto__",
 	"prototype",
 	"constructor"
@@ -24,13 +25,28 @@ function deepMergeDefined(base, override) {
 	return result;
 }
 //#endregion
-//#region extensions/voice-call/src/path-utils.ts
-function normalizePath(pathname) {
-	const trimmed = pathname.trim();
-	if (!trimmed) return "/";
-	const prefixed = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
-	if (prefixed === "/") return prefixed;
-	return prefixed.endsWith("/") ? prefixed.slice(0, -1) : prefixed;
+//#region extensions/voice-call/src/providers/twilio-region.ts
+const TWILIO_REGIONS = [
+	"us1",
+	"ie1",
+	"au1"
+];
+const TWILIO_API_HOSTNAME_BY_REGION = {
+	us1: "api.twilio.com",
+	ie1: "api.dublin.ie1.twilio.com",
+	au1: "api.sydney.au1.twilio.com"
+};
+const TWILIO_API_HOSTNAMES = new Set(Object.values(TWILIO_API_HOSTNAME_BY_REGION));
+function resolveTwilioApiHostname(region) {
+	return TWILIO_API_HOSTNAME_BY_REGION[region ?? "us1"];
+}
+function resolveTwilioApiBaseUrl(params) {
+	return `https://${resolveTwilioApiHostname(params.region)}/2010-04-01/Accounts/${params.accountSid}`;
+}
+function requireSupportedTwilioApiHostname(baseUrl) {
+	const hostname = new URL(baseUrl).hostname;
+	if (!TWILIO_API_HOSTNAMES.has(hostname)) throw new Error(`Unsupported Twilio API hostname: ${hostname}`);
+	return hostname;
 }
 //#endregion
 //#region extensions/voice-call/src/realtime-defaults.ts
@@ -69,7 +85,9 @@ const TwilioConfigSchema = z.object({
 	/** Twilio Account SID */
 	accountSid: z.string().min(1).optional(),
 	/** Twilio Auth Token */
-	authToken: SecretInputSchema.optional()
+	authToken: SecretInputSchema.optional(),
+	/** Twilio processing Region (for example, ie1) */
+	region: z.enum(TWILIO_REGIONS).optional()
 }).strict();
 const PlivoConfigSchema = z.object({
 	/** Plivo Auth ID (starts with MA/SA) */
@@ -424,7 +442,7 @@ function cloneDefaultVoiceCallConfig() {
 	return structuredClone(DEFAULT_VOICE_CALL_CONFIG);
 }
 function defaultRealtimeStreamPathForServePath(servePath) {
-	const normalized = normalizePath(servePath);
+	const normalized = normalizeWebhookPath(servePath);
 	if (normalized.endsWith("/webhook")) return `${normalized.slice(0, -8)}/stream/realtime`;
 	if (normalized === "/") return "/voice/stream/realtime";
 	return `${normalized}/stream/realtime`;
@@ -645,11 +663,11 @@ function validateProviderConfig(config) {
 	}
 	if (config.realtime.enabled && config.inboundPolicy === "disabled") errors.push("plugins.entries.voice-call.config.inboundPolicy must not be \"disabled\" when realtime.enabled is true");
 	if (config.realtime.enabled && config.streaming.enabled) errors.push("plugins.entries.voice-call.config.realtime.enabled and plugins.entries.voice-call.config.streaming.enabled cannot both be true");
-	if (config.realtime.enabled && config.provider && config.provider !== "twilio" && config.provider !== "telnyx") errors.push("plugins.entries.voice-call.config.provider must be \"twilio\" or \"telnyx\" when realtime.enabled is true");
+	if (config.realtime.enabled && config.provider && config.provider !== "twilio" && config.provider !== "telnyx" && config.provider !== "mock") errors.push("plugins.entries.voice-call.config.provider must be \"twilio\", \"telnyx\", or \"mock\" when realtime.enabled is true");
 	return {
 		valid: errors.length === 0,
 		errors
 	};
 }
 //#endregion
-export { resolveVoiceCallEffectiveConfig as a, validateProviderConfig as c, resolveVoiceCallConfig as i, normalizePath as l, normalizeVoiceCallConfig as n, resolveVoiceCallNumberRouteKeyForCall as o, resolveTwilioAuthToken as r, resolveVoiceCallSessionKey as s, VoiceCallConfigSchema as t, deepMergeDefined as u };
+export { resolveVoiceCallEffectiveConfig as a, validateProviderConfig as c, deepMergeDefined as d, resolveVoiceCallConfig as i, requireSupportedTwilioApiHostname as l, normalizeVoiceCallConfig as n, resolveVoiceCallNumberRouteKeyForCall as o, resolveTwilioAuthToken as r, resolveVoiceCallSessionKey as s, VoiceCallConfigSchema as t, resolveTwilioApiBaseUrl as u };

package/dist/{config-compat-CCEjHjAJ.js → config-compat-DAFd5tVH.js}

@@ -1,4 +1,4 @@
-import { t as VoiceCallConfigSchema } from "./config-DNtTB7Iw.js";
+import { t as VoiceCallConfigSchema } from "./config-CgigQDrF.js";
 import { asOptionalRecord, readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/voice-call/src/config-compat.ts
 /** Version where legacy voice-call config shape support is removed. */
@@ -26,7 +26,8 @@ function mergeProviderConfig(providersValue, providerId, compatValues) {
 /** Collect legacy voice-call config keys that should be migrated. */
 function collectVoiceCallLegacyConfigIssues(value) {
 	const raw = asObject(value) ?? {};
-	const realtimeAgentContext = asObject(asObject(raw.realtime)?.agentContext);
+	const realtime = asObject(raw.realtime);
+	const realtimeAgentContext = asObject(realtime?.agentContext);
 	const twilio = asObject(raw.twilio);
 	const streaming = asObject(raw.streaming);
 	const issues = [];

package/dist/doctor-contract-api.js

@@ -1,8 +1,9 @@
-import { a as MAX_CALL_RECORD_EVENTS, f as prepareVoiceCallRecordForStorage, i as CALL_RECORD_EVENT_META_MAX_ENTRIES, n as CALL_RECORD_EVENTS_NAMESPACE, o as RAW_CALL_RECORD_CHUNK_BYTES, p as resolveVoiceCallLegacyCallLogPath, r as CALL_RECORD_EVENT_CHUNKS_NAMESPACE, s as buildVoiceCallLegacyJsonlEventKey, t as CALL_RECORD_CHUNK_MAX_ENTRIES, u as parseVoiceCallRecordLine } from "./store-8M2m4Isq.js";
+import { a as MAX_CALL_RECORD_EVENTS, d as parseVoiceCallRecordLine, i as CALL_RECORD_EVENT_META_MAX_ENTRIES, m as resolveVoiceCallLegacyCallLogPath, n as CALL_RECORD_EVENTS_NAMESPACE, o as RAW_CALL_RECORD_CHUNK_BYTES, p as prepareVoiceCallRecordForStorage, r as CALL_RECORD_EVENT_CHUNKS_NAMESPACE, s as buildVoiceCallLegacyJsonlEventKey, t as CALL_RECORD_CHUNK_MAX_ENTRIES } from "./store-DtewuuOb.js";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs/promises";
+import { archiveLegacyStateSource } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/voice-call/doctor-contract-api.ts
 /** Resolve home from doctor env with OS fallback. */
 function resolveHome(env) {
@@ -52,13 +53,6 @@ function resolveVoiceCallStorePath(params) {
 	return path.join(resolveHome(params.env), ".openclaw", "voice-calls");
 }
 /** Return true when a path exists and is a file. */
-async function fileExists(filePath) {
-	try {
-		return (await fs.stat(filePath)).isFile();
-	} catch {
-		return false;
-	}
-}
 /** Build the plugin state key for one migrated event chunk. */
 function buildChunkKey(eventKey, index) {
 	return `${eventKey}:chunk:${String(index).padStart(4, "0")}`;
@@ -129,19 +123,6 @@ async function readLegacyCallRecords(filePath) {
 	};
 }
 /** Archive the legacy JSONL source after a complete migration. */
-async function archiveLegacySource(params) {
-	const archivedPath = `${params.filePath}.migrated`;
-	if (await fileExists(archivedPath)) {
-		params.warnings.push(`Left migrated Voice Call call-log source in place because ${archivedPath} already exists`);
-		return;
-	}
-	try {
-		await fs.rename(params.filePath, archivedPath);
-		params.changes.push(`Archived Voice Call call-log legacy source -> ${archivedPath}`);
-	} catch (err) {
-		params.warnings.push(`Failed archiving Voice Call call-log legacy source: ${String(err)}`);
-	}
-}
 /** Select newest missing records that fit remaining plugin state capacity. */
 async function selectEntriesForImport(params) {
 	const existingEventKeys = new Set((await params.eventStore.entries()).map((entry) => entry.key));
@@ -229,8 +210,9 @@ const stateMigrations = [{
 				warnings
 			};
 		}
-		await archiveLegacySource({
+		await archiveLegacyStateSource({
 			filePath,
+			label: "Voice Call call-log",
 			changes,
 			warnings
 		});

package/dist/{guarded-json-api-7ITxTL6G.js → guarded-json-api-BrBbW_RJ.js}

@@ -1,53 +1,22 @@
 import { fetchWithSsrFGuard } from "./runtime-api.js";
 import "./api.js";
-import { a as getHeader } from "./runtime-entry-DN7HllXj.js";
+import { n as normalizeProxyIp, o as getHeader } from "./runtime-entry-kCq5Xjph.js";
+import { n as markWebhookReplay, t as createWebhookReplayCache } from "./webhook-replay-aaP79dI8.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { isLoopbackHost } from "openclaw/plugin-sdk/gateway-runtime";
-import { isFutureDateTimestampMs, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { normalizeLowercaseStringOrEmpty, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/voice-call/src/webhook-security.ts
-const REPLAY_WINDOW_MS = 600 * 1e3;
-const REPLAY_CACHE_MAX_ENTRIES = 1e4;
-const REPLAY_CACHE_PRUNE_INTERVAL = 64;
-const twilioReplayCache = {
-	seenUntil: /* @__PURE__ */ new Map(),
-	calls: 0
-};
-const plivoReplayCache = {
-	seenUntil: /* @__PURE__ */ new Map(),
-	calls: 0
-};
-const telnyxReplayCache = {
-	seenUntil: /* @__PURE__ */ new Map(),
-	calls: 0
-};
+const twilioReplayCache = createWebhookReplayCache();
+const plivoReplayCache = createWebhookReplayCache();
+const telnyxReplayCache = createWebhookReplayCache();
 function sha256Hex(input) {
 	return crypto.createHash("sha256").update(input).digest("hex");
 }
 function createSkippedVerificationReplayKey(provider, ctx) {
 	return `${provider}:skip:${sha256Hex(`${ctx.method}\n${ctx.url}\n${ctx.rawBody}`)}`;
 }
-function pruneReplayCache(cache, now) {
-	for (const [key, expiresAt] of cache.seenUntil) if (!isFutureDateTimestampMs(expiresAt, { nowMs: now })) cache.seenUntil.delete(key);
-	while (cache.seenUntil.size > REPLAY_CACHE_MAX_ENTRIES) {
-		const oldest = cache.seenUntil.keys().next().value;
-		if (!oldest) break;
-		cache.seenUntil.delete(oldest);
-	}
-}
-function markReplay(cache, replayKey) {
-	const now = Date.now();
-	cache.calls += 1;
-	if (cache.calls % REPLAY_CACHE_PRUNE_INTERVAL === 0) pruneReplayCache(cache, now);
-	const existing = cache.seenUntil.get(replayKey);
-	if (existing !== void 0 && isFutureDateTimestampMs(existing, { nowMs: now })) return true;
-	const expiresAt = resolveExpiresAtMsFromDurationMs(REPLAY_WINDOW_MS, { nowMs: now });
-	if (expiresAt !== void 0) cache.seenUntil.set(replayKey, expiresAt);
-	if (cache.seenUntil.size > REPLAY_CACHE_MAX_ENTRIES) pruneReplayCache(cache, now);
-	return false;
-}
 /**
 * Validate Twilio webhook signature using HMAC-SHA1.
 *
@@ -59,7 +28,7 @@ function markReplay(cache, replayKey) {
 function validateTwilioSignature(authToken, signature, url, params) {
 	if (!signature) return false;
 	const dataToSign = buildTwilioDataToSign(url, params);
-	return timingSafeEqual(signature, crypto.createHmac("sha1", authToken).update(dataToSign).digest("base64"));
+	return safeEqualSecret(signature, crypto.createHmac("sha1", authToken).update(dataToSign).digest("base64"));
 }
 function buildTwilioDataToSign(url, params) {
 	let dataToSign = url;
@@ -71,12 +40,6 @@ function buildCanonicalTwilioParamString(params) {
 	return Array.from(params.entries()).toSorted((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([key, value]) => `${key}=${value}`).join("&");
 }
 /**
-* Timing-safe string comparison to prevent timing attacks.
-*/
-function timingSafeEqual(a, b) {
-	return safeEqualSecret(a, b);
-}
-/**
 * Validate that a hostname matches RFC 1123 format.
 * Prevents injection of malformed hostnames.
 */
@@ -141,7 +104,9 @@ function reconstructWebhookUrl(ctx, options) {
 	const trustedProxyIPs = options?.trustedProxyIPs?.filter(Boolean) ?? [];
 	const hasTrustedProxyIPs = trustedProxyIPs.length > 0;
 	const remoteIP = options?.remoteIP ?? ctx.remoteAddress;
-	const fromTrustedProxy = !hasTrustedProxyIPs || (remoteIP ? trustedProxyIPs.includes(remoteIP) : false);
+	const normalizedTrustedProxyIps = new Set(trustedProxyIPs.map((ip) => normalizeProxyIp(ip)).filter((ip) => Boolean(ip)));
+	const normalizedRemoteIp = normalizeProxyIp(remoteIP);
+	const fromTrustedProxy = !hasTrustedProxyIPs || (normalizedRemoteIp ? normalizedTrustedProxyIps.has(normalizedRemoteIp) : false);
 	const shouldTrustForwardingHeaders = (hasAllowedHosts || explicitlyTrusted) && fromTrustedProxy;
 	const isAllowedForwardedHost = (host) => !allowedHosts || allowedHosts.has(host);
 	let proto = "https";
@@ -268,7 +233,7 @@ function verifyTelnyxWebhook(ctx, publicKey, options) {
 		return {
 			ok: true,
 			reason: "verification skipped (dev mode)",
-			isReplay: markReplay(telnyxReplayCache, replayKey),
+			isReplay: markWebhookReplay(telnyxReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	}
@@ -305,7 +270,7 @@ function verifyTelnyxWebhook(ctx, publicKey, options) {
 		const replayKey = `telnyx:${sha256Hex(`${timestamp}\n${canonicalSignature}\n${ctx.rawBody}`)}`;
 		return {
 			ok: true,
-			isReplay: markReplay(telnyxReplayCache, replayKey),
+			isReplay: markWebhookReplay(telnyxReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	} catch (err) {
@@ -324,7 +289,7 @@ function verifyTwilioWebhook(ctx, authToken, options) {
 		return {
 			ok: true,
 			reason: "verification skipped (dev mode)",
-			isReplay: markReplay(twilioReplayCache, replayKey),
+			isReplay: markWebhookReplay(twilioReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	}
@@ -351,7 +316,7 @@ function verifyTwilioWebhook(ctx, authToken, options) {
 		return {
 			ok: true,
 			verificationUrl,
-			isReplay: markReplay(twilioReplayCache, replayKey),
+			isReplay: markWebhookReplay(twilioReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	}
@@ -375,7 +340,7 @@ function verifyTwilioWebhook(ctx, authToken, options) {
 		return {
 			ok: true,
 			verificationUrl: candidateUrl,
-			isReplay: markReplay(twilioReplayCache, replayKey),
+			isReplay: markWebhookReplay(twilioReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	}
@@ -404,12 +369,9 @@ function createPlivoV3ReplayKey(params) {
 		postParams: params.postParams
 	})}\n${params.nonce}`)}`;
 }
-function timingSafeEqualString(a, b) {
-	return safeEqualSecret(a, b);
-}
 function validatePlivoV2Signature(params) {
 	const baseUrl = getBaseUrlNoQuery(params.url);
-	return timingSafeEqualString(normalizeSignatureBase64(crypto.createHmac("sha256", params.authToken).update(baseUrl + params.nonce).digest("base64")), normalizeSignatureBase64(params.signature));
+	return safeEqualSecret(normalizeSignatureBase64(crypto.createHmac("sha256", params.authToken).update(baseUrl + params.nonce).digest("base64")), normalizeSignatureBase64(params.signature));
 }
 function toParamMapFromSearchParams(sp) {
 	const map = {};
@@ -454,7 +416,7 @@ function validatePlivoV3Signature(params) {
 	})}.${params.nonce}`;
 	const expected = normalizeSignatureBase64(crypto.createHmac("sha256", params.authToken).update(hmacBase).digest("base64"));
 	const provided = normalizeStringEntries(params.signatureHeader.split(",")).map((s) => normalizeSignatureBase64(s));
-	for (const sig of provided) if (timingSafeEqualString(expected, sig)) return true;
+	for (const sig of provided) if (safeEqualSecret(expected, sig)) return true;
 	return false;
 }
 /**
@@ -470,7 +432,7 @@ function verifyPlivoWebhook(ctx, authToken, options) {
 		return {
 			ok: true,
 			reason: "verification skipped (dev mode)",
-			isReplay: markReplay(plivoReplayCache, replayKey),
+			isReplay: markWebhookReplay(plivoReplayCache, replayKey),
 			verifiedRequestKey: replayKey
 		};
 	}
@@ -522,7 +484,7 @@ function verifyPlivoWebhook(ctx, authToken, options) {
 			postParams,
 			nonce: nonceV3
 		});
-		const isReplay = markReplay(plivoReplayCache, replayKey);
+		const isReplay = markWebhookReplay(plivoReplayCache, replayKey);
 		return {
 			ok: true,
 			version: "v3",
@@ -544,7 +506,7 @@ function verifyPlivoWebhook(ctx, authToken, options) {
 			reason: "Invalid Plivo V2 signature"
 		};
 		const replayKey = createPlivoV2ReplayKey(verificationUrl, nonceV2);
-		const isReplay = markReplay(plivoReplayCache, replayKey);
+		const isReplay = markWebhookReplay(plivoReplayCache, replayKey);
 		return {
 			ok: true,
 			version: "v2",

package/dist/index.js

@@ -1,13 +1,15 @@
 import { definePluginEntry, sleep } from "./runtime-api.js";
 import "./api.js";
-import { c as validateProviderConfig, i as resolveVoiceCallConfig } from "./config-DNtTB7Iw.js";
-import { c as getTailscaleSelfInfo, l as setupTailscaleExposureRoute, o as resolveWebhookExposureStatus, p as resolveUserPath, s as cleanupTailscaleExposureRoute, t as createVoiceCallRuntime } from "./runtime-entry-DN7HllXj.js";
-import { c as getCallHistoryFromStore, m as setVoiceCallStateRuntime } from "./store-8M2m4Isq.js";
-import { i as parseVoiceCallPluginConfig, r as normalizeVoiceCallLegacyConfigInput, t as formatVoiceCallLegacyConfigWarnings } from "./config-compat-CCEjHjAJ.js";
+import { c as validateProviderConfig, i as resolveVoiceCallConfig } from "./config-CgigQDrF.js";
+import { c as cleanupTailscaleExposureRoute, h as resolveUserPath, l as getTailscaleSelfInfo, s as resolveWebhookExposureStatus, t as createVoiceCallRuntime, u as setupTailscaleExposureRoute } from "./runtime-entry-kCq5Xjph.js";
+import { h as setVoiceCallStateRuntime, l as getCallHistoryFromStore } from "./store-DtewuuOb.js";
+import { i as parseVoiceCallPluginConfig, r as normalizeVoiceCallLegacyConfigInput, t as formatVoiceCallLegacyConfigWarnings } from "./config-compat-DAFd5tVH.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { ErrorCodes, callGatewayFromCli, errorShape } from "openclaw/plugin-sdk/gateway-runtime";
 import { MAX_TCP_PORT, MAX_TIMER_TIMEOUT_MS, addTimerTimeoutGraceMs, clampTimerTimeoutMs, parseStrictNonNegativeInteger, resolveTimerTimeoutMs, timestampMsToIsoString } from "openclaw/plugin-sdk/number-runtime";
+import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { isRecord, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { jsonResult } from "openclaw/plugin-sdk/tool-results";
 import { Type } from "typebox";
 import fs from "node:fs";
 import os from "node:os";
@@ -403,7 +405,7 @@ function registerVoiceCallCli(params) {
 		}
 		const rt = await ensureRuntime();
 		if (options.callId) {
-			writeStdoutJson(rt.manager.getCall(options.callId) ?? { found: false });
+			writeStdoutJson(await rt.manager.getCallFromMemoryOrStore(options.callId) ?? { found: false });
 			return;
 		}
 		writeStdoutJson({
@@ -702,6 +704,10 @@ const voiceCallConfigSchema = {
 			label: "Twilio Auth Token",
 			sensitive: true
 		},
+		"twilio.region": {
+			label: "Twilio Region",
+			advanced: true
+		},
 		"outbound.defaultMode": { label: "Default Call Mode" },
 		"outbound.notifyHangupDelaySec": {
 			label: "Notify Hangup Delay (sec)",
@@ -1001,7 +1007,7 @@ var voice_call_default = definePluginEntry({
 			respondError(respond, formatErrorMessage(err));
 		};
 		const describeHistoricalCall = async (rt, callId) => {
-			const call = (await rt.manager.getCallHistory(100)).toReversed().find((candidate) => candidate.callId === callId || candidate.providerCallId === callId);
+			const call = await rt.manager.getCallFromMemoryOrStore(callId);
 			if (!call) return;
 			const endedAt = timestampMsToIsoString(call.endedAt);
 			return `call is not active (${[
@@ -1028,7 +1034,8 @@ var voice_call_default = definePluginEntry({
 				message: params.message,
 				mode: params.mode,
 				dtmfSequence: params.dtmfSequence,
-				...params.requesterSessionKey ? { requesterSessionKey: params.requesterSessionKey } : {}
+				...params.requesterSessionKey ? { requesterSessionKey: params.requesterSessionKey } : {},
+				...params.agentId ? { agentId: params.agentId } : {}
 			});
 			if (!result.success) {
 				respondError(params.respond, result.error || "initiate failed");
@@ -1068,12 +1075,13 @@ var voice_call_default = definePluginEntry({
 					respondError(respond, "to required", ErrorCodes.INVALID_REQUEST);
 					return;
 				}
+				const mode = params?.mode === "notify" || params?.mode === "conversation" ? params.mode : void 0;
 				await initiateCallAndRespond({
 					rt,
 					respond,
 					to,
 					message,
-					mode: params?.mode === "notify" || params?.mode === "conversation" ? params.mode : void 0,
+					mode,
 					sessionKey: normalizeOptionalString(params?.sessionKey),
 					requesterSessionKey: normalizeOptionalString(params?.requesterSessionKey)
 				});
@@ -1200,7 +1208,7 @@ var voice_call_default = definePluginEntry({
 					});
 					return;
 				}
-				const call = rt.manager.getCall(raw) || rt.manager.getCallByProviderCallId(raw);
+				const call = await rt.manager.getCallFromMemoryOrStore(raw);
 				if (!call) {
 					respond(true, { found: false });
 					return;
@@ -1213,46 +1221,49 @@ var voice_call_default = definePluginEntry({
 				sendError(respond, err);
 			}
 		}, VOICE_CALL_READ_METHOD_SCOPE);
-		api.registerGatewayMethod("voicecall.start", async ({ params, respond }) => {
+		api.registerGatewayMethod("voicecall.start", async ({ params, client, respond }) => {
 			try {
 				const to = normalizeOptionalString(params?.to) ?? "";
 				const message = normalizeOptionalString(params?.message) ?? "";
 				const dtmfSequence = normalizeOptionalString(params?.dtmfSequence);
 				const sessionKey = normalizeOptionalString(params?.sessionKey);
 				const requesterSessionKey = normalizeOptionalString(params?.requesterSessionKey);
+				const requestedAgentId = normalizeOptionalString(params?.agentId);
+				const normalizedAgentId = requestedAgentId ? normalizeAgentId(requestedAgentId) : void 0;
+				const pluginOwnerId = normalizeOptionalString(client?.internal?.pluginRuntimeOwnerId);
+				if (requestedAgentId && (!pluginOwnerId || normalizedAgentId !== requestedAgentId.toLowerCase())) {
+					respondError(respond, "agentId requires a trusted plugin caller and a valid agent id", ErrorCodes.INVALID_REQUEST);
+					return;
+				}
 				if (!to) {
 					respondError(respond, "to required", ErrorCodes.INVALID_REQUEST);
 					return;
 				}
 				const mode = params?.mode === "notify" || params?.mode === "conversation" ? params.mode : void 0;
+				const rt = await ensureRuntime();
 				await initiateCallAndRespond({
-					rt: await ensureRuntime(),
+					rt,
 					respond,
 					to,
 					message: message || void 0,
 					mode,
 					dtmfSequence,
 					sessionKey,
-					...requesterSessionKey ? { requesterSessionKey } : {}
+					...requesterSessionKey ? { requesterSessionKey } : {},
+					...normalizedAgentId ? { agentId: normalizedAgentId } : {}
 				});
 			} catch (err) {
 				sendError(respond, err);
 			}
 		}, VOICE_CALL_WRITE_METHOD_SCOPE);
-		api.registerTool({
+		api.registerTool((toolContext) => ({
 			name: "voice_call",
 			label: "Voice Call",
 			description: "Make phone calls and have voice conversations via the voice-call plugin.",
 			parameters: VoiceCallToolSchema,
 			async execute(_toolCallId, params) {
 				const rawParams = asParamRecord(params);
-				const json = (payload) => ({
-					content: [{
-						type: "text",
-						text: JSON.stringify(payload, null, 2)
-					}],
-					details: payload
-				});
+				const agentId = normalizeOptionalString(toolContext.agentId);
 				try {
 					const rt = await ensureRuntime();
 					if (typeof rawParams.action === "string") switch (rawParams.action) {
@@ -1264,10 +1275,11 @@ var voice_call_default = definePluginEntry({
 							const result = await rt.manager.initiateCall(to, void 0, {
 								message,
 								dtmfSequence: normalizeOptionalString(rawParams.dtmfSequence),
-								mode: rawParams.mode === "notify" || rawParams.mode === "conversation" ? rawParams.mode : void 0
+								mode: rawParams.mode === "notify" || rawParams.mode === "conversation" ? rawParams.mode : void 0,
+								...agentId ? { agentId } : {}
 							});
 							if (!result.success) throw new Error(result.error || "initiate failed");
-							return json({
+							return jsonResult({
 								callId: result.callId,
 								initiated: true
 							});
@@ -1278,7 +1290,7 @@ var voice_call_default = definePluginEntry({
 							if (!callId || !message) throw new Error("callId and message required");
 							const result = await rt.manager.continueCall(callId, message);
 							if (!result.success) throw new Error(result.error || "continue failed");
-							return json({
+							return jsonResult({
 								success: true,
 								transcript: result.transcript
 							});
@@ -1289,7 +1301,7 @@ var voice_call_default = definePluginEntry({
 							if (!callId || !message) throw new Error("callId and message required");
 							const result = await rt.manager.speak(callId, message);
 							if (!result.success) throw new Error(result.error || "speak failed");
-							return json({ success: true });
+							return jsonResult({ success: true });
 						}
 						case "send_dtmf": {
 							const callId = normalizeOptionalString(rawParams.callId) ?? "";
@@ -1297,20 +1309,20 @@ var voice_call_default = definePluginEntry({
 							if (!callId || !digits) throw new Error("callId and digits required");
 							const result = await rt.manager.sendDtmf(callId, digits);
 							if (!result.success) throw new Error(result.error || "dtmf failed");
-							return json({ success: true });
+							return jsonResult({ success: true });
 						}
 						case "end_call": {
 							const callId = normalizeOptionalString(rawParams.callId) ?? "";
 							if (!callId) throw new Error("callId required");
 							const result = await rt.manager.endCall(callId);
 							if (!result.success) throw new Error(result.error || "end failed");
-							return json({ success: true });
+							return jsonResult({ success: true });
 						}
 						case "get_status": {
 							const callId = normalizeOptionalString(rawParams.callId) ?? "";
 							if (!callId) throw new Error("callId required");
-							const call = rt.manager.getCall(callId) || rt.manager.getCallByProviderCallId(callId);
-							return json(call ? {
+							const call = await rt.manager.getCallFromMemoryOrStore(callId);
+							return jsonResult(call ? {
 								found: true,
 								call: toVoiceCallStatus(call)
 							} : { found: false });
@@ -1319,8 +1331,8 @@ var voice_call_default = definePluginEntry({
 					if ((rawParams.mode ?? "call") === "status") {
 						const sid = normalizeOptionalString(rawParams.sid) ?? "";
 						if (!sid) throw new Error("sid required for status");
-						const call = rt.manager.getCall(sid) || rt.manager.getCallByProviderCallId(sid);
-						return json(call ? {
+						const call = await rt.manager.getCallFromMemoryOrStore(sid);
+						return jsonResult(call ? {
 							found: true,
 							call: toVoiceCallStatus(call)
 						} : { found: false });
@@ -1330,18 +1342,19 @@ var voice_call_default = definePluginEntry({
 					const result = await rt.manager.initiateCall(to, normalizeOptionalString(rawParams.sessionKey), {
 						dtmfSequence: normalizeOptionalString(rawParams.dtmfSequence),
 						message: normalizeOptionalString(rawParams.message),
+						...agentId ? { agentId } : {},
 						...normalizeOptionalString(rawParams.requesterSessionKey) ? { requesterSessionKey: normalizeOptionalString(rawParams.requesterSessionKey) } : {}
 					});
 					if (!result.success) throw new Error(result.error || "initiate failed");
-					return json({
+					return jsonResult({
 						callId: result.callId,
 						initiated: true
 					});
 				} catch (err) {
-					return json({ error: formatErrorMessage(err) });
+					return jsonResult({ error: formatErrorMessage(err) });
 				}
 			}
-		});
+		}));
 		api.registerCli(({ program }) => registerVoiceCallCli({
 			program,
 			config,

package/dist/{mock-YAo3QDri.js → mock-YsvBTX-7.js}

@@ -1,3 +1,4 @@
+import { n as markWebhookReplay, t as createWebhookReplayCache } from "./webhook-replay-aaP79dI8.js";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import crypto from "node:crypto";
 //#region extensions/voice-call/src/providers/mock.ts
@@ -11,9 +12,16 @@ import crypto from "node:crypto";
 var MockProvider = class {
 	constructor() {
 		this.name = "mock";
+		this.replayCache = createWebhookReplayCache();
 	}
-	verifyWebhook(_ctx) {
-		return { ok: true };
+	verifyWebhook(ctx) {
+		const requestMaterial = `${ctx.method}\n${ctx.url}\n${ctx.rawBody}`;
+		const key = `mock:${crypto.createHash("sha256").update(requestMaterial).digest("hex")}`;
+		return {
+			ok: true,
+			verifiedRequestKey: key,
+			isReplay: markWebhookReplay(this.replayCache, key)
+		};
 	}
 	parseWebhookEvent(ctx, _options) {
 		try {
@@ -62,6 +70,14 @@ var MockProvider = class {
 					text: payload.text ?? ""
 				};
 			}
+			case "call.assistant-speech": {
+				const payload = evt;
+				return {
+					...base,
+					type: evt.type,
+					transcript: payload.transcript ?? ""
+				};
+			}
 			case "call.speech": {
 				const payload = evt;
 				return {