openclaw - 💡(How to fix) Fix Voice-call webhooks ignore trusted proxies reported as IPv4-mapped addresses [1 pull requests]

Voice-call webhook URL reconstruction currently checks trustedProxyIPs with a literal string match against the request remote address. That makes a trusted proxy configured as 127.0.0.1 fail to match when Node reports the same peer as ::ffff:127.0.0.1, which can happen on dual-stack listeners.

Impact: Twilio and Plivo webhook signature verification can reject otherwise valid provider callbacks behind a loopback/local reverse proxy, because forwarded host/proto headers are ignored and the verifier falls back to the local Host value.

Source evidence on current origin/main (489e4153396fb2f5b9a24c0b94ab3b66229d2026):

• extensions/voice-call/src/webhook-security.ts:263-268 filters trustedProxyIPs, reads remoteIP, and then uses trustedProxyIPs.includes(remoteIP) for the proxy trust decision.
• The media-stream IP path already handles the same Node address shape: extensions/voice-call/src/webhook.ts:107-122 normalizes ::ffff:<ipv4> to <ipv4>, and extensions/voice-call/src/webhook.ts:255-265 applies that normalization before checking trusted proxies.

Minimal repro shape:

1. Configure voice-call webhook security with trustForwardingHeaders: true and trustedProxyIPs: ["127.0.0.1"].
2. Receive a provider webhook where Node exposes remoteAddress: "::ffff:127.0.0.1", with x-forwarded-proto: https and x-forwarded-host: proxy.example.com.
3. Sign the request for https://proxy.example.com/voice/webhook.
4. The current verifier reconstructs https://localhost/voice/webhook instead, so the valid signature fails.

Expected behavior: the webhook verifier should treat IPv4-mapped and plain IPv4 forms of the same proxy address equivalently, without trusting spoofed forwarding headers from unrelated remotes.

Proposed fix direction: normalize both configured trusted proxy IPs and the socket remote address before the forwarding-header trust check, matching the existing voice-call media-stream client-IP path. Add regression tests for Twilio and Plivo signed webhooks with remoteAddress: "::ffff:127.0.0.1" and trustedProxyIPs: ["127.0.0.1"].

Duplicate/overlap check: searched open issues and open/all-state PRs for webhook-security.ts trustedProxyIPs, verifyTwilioWebhook trustedProxyIPs, reconstructWebhookUrl ::ffff, voice-call IPv4-mapped, Twilio signature trusted proxy, and Plivo signature trusted proxy; no overlapping issue or PR found.