03bec9d438
fix(voice): make signed callback replay reservations durable and retryable ( #118754 )
2026-08-03 10:35:32 -07:00
87c71cf0ab
fix(voice-call): reject malformed telnyx timestamps ( #107565 )
2026-07-30 09:12:10 +08:00
458bb58ae5
fix(voice-call): pin Twilio webhook verification to the configured public path ( #112800 )
...
* fix(voice-call): pin Twilio webhook verification to the configured public path
buildTwilioVerificationUrl overwrote the configured publicUrl path with the
incoming request path, so behind a path-rewriting reverse proxy the
reconstructed verification URL no longer matched the URL Twilio signed and
valid webhooks were rejected. Use the configured public path (keep the request
query), mirroring the Plivo sibling fixed in #112559 . Restores callback-path
binding and adds proxy-prefix accept + local-path reject regression tests.
* fix(voice-call): pin Twilio verification to public URL path
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-30 01:08:38 +08:00
3d4d2b7f5f
fix(voice-call): bracket IPv6 webhook hosts ( #115135 )
...
Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com >
2026-07-28 11:47:39 -04:00
5c9d59a881
fix: pin plivo callback paths to public url ( #112559 )
2026-07-22 19:48:45 +05:30
218dcd815a
feat(tooling): enforce noUncheckedIndexedAccess in the extensions lane (NUIA phase 4) ( #105132 )
...
* fix(extensions): make indexed access explicit across channel plugins
Transport-payload-safe burn-down: malformed Telegram/Discord/QQ/LINE
and sibling channel input keeps existing skip paths; no synthesized
fields, no new throws in delivery loops. Zalo escape sentinels preserve
literal matches instead of undefined replacements.
* fix(extensions): make indexed access explicit across provider and memory plugins
Stream and model iteration, tool-block guards, capture guards, and
sparse accumulators; singleton model reads carry named invariants.
* fix(extensions): make indexed access explicit across tooling plugins, flip the extensions lane
Remaining plugins (oc-path, qa-lab, browser, logbook, and siblings) plus
the tsconfig.extensions.json flag flip. Cleanup: logbook sampleFrames
NaN index at max=1, QA retry clamp at non-positive attempts, dead Canvas
probe and OpenShell no-op slice removed, twitch test setup leak excluded
from the prod lane.
* refactor(plugin-sdk): expose expectDefined via a focused SDK subpath
Extensions imported @openclaw/normalization-core directly, crossing the
external-plugin packaging boundary (it only worked because the runtime
builder bundles undeclared workspace helpers). expect-runtime joins the
canonical entrypoints JSON, generated exports, API baseline, docs, and
subpath contract test; all 78 extension imports now use the SDK seam.
Two scanner-shaped locals renamed for review-bundle hygiene.
* chore(plugin-sdk): raise surface budgets for the expect-runtime subpath
One new entrypoint with one callable export, added intentionally as the
packaging-honest seam for extension invariant helpers.
2026-07-12 09:17:31 +01:00
b37476ab0b
fix(twilio): redact webhook turnToken diagnostics ( #102089 )
...
* fix(twilio): redact webhook turnToken diagnostics
* chore(twilio): rerun ci
* fix(twilio): contain webhook URL diagnostics
Co-authored-by: Alix-007 <li.long15@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-09 11:19:40 +01:00
f535b2a3ec
fix(voice-call): normalize mapped proxy addresses ( #100261 )
...
Co-authored-by: Rohit <rohitjavvadi2@gmail.com >
2026-07-05 06:10:36 -07:00
43fd44a28c
fix(voice-call): share webhook replay tracking ( #100263 )
...
* fix(voice-call): share webhook replay tracking
Co-authored-by: xialonglee <li.xialong@xydigit.com >
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
* fix(voice-call): share webhook replay tracking
---------
Co-authored-by: xialonglee <li.xialong@xydigit.com >
2026-07-05 05:32:41 -07:00
194dd6fe50
refactor(security): consolidate secret primitives ( #99746 )
...
* refactor(security): consolidate secret primitives
* fix(plugin-sdk): align secret display metadata
* chore(plugin-sdk): refresh API baseline after rebase
* refactor(security): trim secret primitive consolidation
2026-07-04 16:38:13 -07:00
6868cde4d4
docs: document large extension sources
2026-06-04 21:40:44 -04:00
3ae521745e
fix(voice-call): bound webhook replay cache expiry
2026-05-30 13:51:12 -04:00
77d9ac30bb
refactor: reuse shared coercion helpers ( #86419 )
...
* refactor: share talk event metric extraction
* refactor: reuse shared coercion helpers
* refactor: reuse shared primitive guards
* refactor: reuse shared record guard
* refactor: reuse shared primitive helpers
* refactor: reuse shared string guards
* refactor: reuse shared non-empty string guard
* refactor: share plugin primitive coercion helpers
* refactor: reuse plugin coercion helpers
* refactor: reuse plugin coercion helpers in more plugins
* refactor: reuse channel coercion helpers
* refactor: reuse monitor coercion helpers
* refactor: reuse provider coercion helpers
* refactor: reuse core coercion helpers
* refactor: reuse runtime coercion helpers
* refactor: reuse helper coercion in codex paths
* refactor: reuse helper coercion in runtime paths
* refactor: reuse codex app-server coercion helpers
* refactor: reuse codex record helpers
* refactor: reuse migration and qa record helpers
* refactor: reuse feishu and core helper guards
* refactor: reuse browser and policy coercion helpers
* refactor: reuse memory wiki record helper
* refactor: share boolean coercion helpers
* refactor: reuse finite number coercion
* refactor: reuse trimmed string list helpers
* refactor: reuse string list normalization
* refactor: reuse remaining string list helpers
* refactor: reuse string entry normalizer
* refactor: share sorted string helpers
* refactor: share string list normalization
* test: preserve command registry browser imports
* refactor: reuse trimmed list helpers
* refactor: reuse string dedupe helpers
* refactor: reuse local dedupe helpers
* refactor: reuse more string dedupe helpers
* refactor: reuse command string dedupe helpers
* refactor: dedupe memory path lists with helper
* refactor: expose string dedupe helpers to plugins
* refactor: reuse core string dedupe helpers
* refactor: reuse shared unique value helpers
* refactor: reuse unique helpers in agent utilities
* refactor: reuse unique helpers in config plumbing
* refactor: reuse unique helpers in extensions
* refactor: reuse unique helpers in core utilities
* refactor: reuse unique helpers in qa plugins
* refactor: reuse unique helpers in memory plugins
* refactor: reuse unique helpers in channel plugins
* refactor: reuse unique helpers in core tails
* refactor: reuse unique helper in comfy workflow
* refactor: reuse unique helpers in test utilities
* refactor: expose unique value helper to plugins
* refactor: reuse unique helpers for numeric lists
* refactor: replace index dedupe filters
* refactor: reuse string entry normalization
* refactor: reuse string normalization in plugin helpers
* refactor: reuse string normalization in extension helpers
* refactor: reuse string normalization in channel parsers
* refactor: reuse string normalization in memory search
* refactor: reuse string normalization in provider parsers
* refactor: reuse string normalization in qa helpers
* refactor: reuse string normalization in infra parsers
* refactor: reuse string normalization in messaging parsers
* refactor: reuse string normalization in core parsers
* refactor: reuse string normalization in extension parsers
* refactor: reuse string normalization in remaining parsers
* refactor: reuse string normalization in final parser spots
* refactor: reuse string normalization in qa media helpers
* refactor: reuse normalization in provider and media lists
* refactor: reuse normalization for remaining set filters
* refactor: reuse normalization in policy allowlists
* refactor: reuse normalization in session and owner lists
* refactor: centralize primitive string lists
* refactor: reuse lowercase entry helpers
* refactor: reuse sorted string helpers
* refactor: reuse unique trimmed helpers
* refactor: reuse string normalization helpers
* refactor: reuse catalog string helpers
* refactor: reuse remaining string helpers
* refactor: simplify remaining list normalization
* refactor: reuse codex auth order normalization
* chore: refresh plugin sdk api baseline
* fix: make shared string sorting deterministic
* chore: refresh plugin sdk api baseline
* fix: align host env security ordering
2026-05-25 21:20:41 +01:00
827b0de0ce
refactor: reduce plugin sdk surface
2026-05-10 12:37:10 +01:00
6a4069dead
fix: share plugin runtime helpers
...
Consolidate shared plugin runtime MIME/schema helpers, preserve canonical runtime behavior, and guard QQBot STT fetches.
2026-05-08 00:28:43 +01:00
456e1c0a6a
refactor: trim voice-call helper exports
2026-05-01 16:01:48 +01:00
0141471dd5
refactor: move shared helpers off reserved sdk seams
2026-04-27 13:07:54 +01:00
0b0662b1c9
chore: apply extension lint cleanups
2026-04-23 05:30:49 +01:00
a15a5a1edc
refactor: dedupe lowercase helper readers
2026-04-07 13:44:41 +01:00
782247b423
refactor: dedupe voice-call error formatting
2026-04-07 02:03:34 +01:00
8cb85ff85f
refactor: harden plugin metadata and bundled channel entry seams
2026-04-06 00:15:38 +01:00
be10ecef77
fix(compare): reuse shared secret comparison helper ( #58432 )
...
* fix(compare): reuse shared secret comparison helper
* fix(compare): reject empty bluebubbles auth tokens
* docs: add changelog entry for shared secret comparison fix
---------
Co-authored-by: Jacob Tomlinson <jtomlinson@nvidia.com >
2026-04-02 13:53:19 +01:00
ad77666054
fix(voice-call): canonicalize Telnyx replay request keys ( #57829 )
2026-03-30 20:01:43 +01:00
85777e726c
Voice Call: canonicalize Plivo V3 replay key ( #56003 )
...
Co-authored-by: zsx <git@zsxsoft.com >
2026-03-27 20:27:23 +00:00
b0ce53a79c
fix(voice-call): stabilize plivo v2 replay keys
2026-03-23 09:31:40 -07:00
c5ddba52d7
fix(voice-call): retry Twilio signature verification without port in URL
...
Twilio signs webhook requests using the URL without the port component,
even when the publicUrl config includes a non-standard port. Add a fallback
that strips the port from the verification URL when initial validation fails,
matching the behavior of Twilio's official helper library.
Closes #6334
2026-03-03 00:02:03 +00:00
535ef8991c
refactor(voice-call): enforce verified webhook key contract
2026-02-26 21:54:09 +01:00
1aadf26f9a
fix(voice-call): bind webhook dedupe to verified request identity
2026-02-26 21:43:51 +01:00
a3c4f56b0b
security(voice-call): detect Telnyx webhook replay
2026-02-24 23:50:30 +00:00
1d28da55a5
fix(voice-call): block Twilio webhook replay and stale transitions
2026-02-24 02:37:24 +00:00
f47584fec8
refactor(voice-call): centralize Telnyx webhook verification
2026-02-14 19:02:10 +01:00
ff11d8793b
fix(voice-call): require Twilio signature in ngrok loopback mode
2026-02-14 18:14:59 +01:00
a749db9820
fix: harden voice-call webhook verification
2026-02-03 23:47:27 -08:00
f06dd8df06
chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.
2026-02-01 10:03:47 +09:00
230ca789e2
chore: Lint extensions folder.
2026-01-31 22:42:45 +09:00
8cab78abbc
chore: Run pnpm format:fix.
2026-01-31 21:13:13 +09:00
b3a60af71c
fix: gate ngrok free-tier bypass to loopback
2026-01-26 22:26:26 +00:00
97200984f8
fix: secure twilio webhook verification
2026-01-26 16:18:37 +00:00
b04b51d2c4
Voice-call: fix Twilio signature ordering
2026-01-18 20:03:13 -08:00
fa1079214b
fix: include query in Twilio webhook verification
2026-01-18 04:25:28 +00:00
2579609922
Voice Call: fix Plivo webhook method typing
2026-01-15 07:21:40 +00:00
946b0229e8
Voice Call: add Plivo provider
2026-01-15 07:21:40 +00:00
42c17adb5e
feat: restore voice-call plugin parity
2026-01-12 21:44:19 +00:00
Peter Steinberger