feat(twilio-voice): added twilio voice webhook + tool

[aadamgough]

Summary

Twilio voice trigger
Twilio make call
Twilio get recordings
Twilio list calls

Type of Change

• New feature

Testing

Tested calling on @icecrasher321 phone, tested other blocks as well.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screen.Recording.2025-10-30.at.8.25.06.PM.mov

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Nov 5, 2025 7:49am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds comprehensive Twilio Voice integration with webhook triggers and three operational tools. The implementation correctly handles incoming voice calls via webhooks with proper HMAC-SHA1 signature verification, and provides tools for making outbound calls, listing call history, and retrieving recordings with transcriptions.

Key Changes:

• Webhook trigger with signature verification using x-twilio-signature header and URL+params concatenation per Twilio's spec
• TwiML response system allowing custom voice instructions or default hold message
• Make call tool supporting both URL and inline TwiML with proper Basic Auth
• List calls tool with filtering and parallel recording SID fetching
• Get recording tool that automatically fetches transcriptions if created via TwiML <Record transcribe="true">
• Config normalization to prevent cross-provider contamination when switching trigger types
• Security fixes: browser autofill prevention on trigger config inputs

Implementation Quality:

• Follows established patterns from existing integrations (Telegram, Slack, WhatsApp)
• Proper error handling and validation throughout
• Security: HMAC signature verification, constant-time comparison, Basic Auth
• Comprehensive documentation with usage examples

Confidence Score: 5/5

• This PR is safe to merge with high confidence - well-tested implementation following established patterns
• Score reflects thorough implementation with proper security measures (HMAC-SHA1 signature verification, constant-time comparison), comprehensive error handling, established architectural patterns, and real-world testing confirmed by the author. No logical errors, security vulnerabilities, or architectural concerns identified.
• No files require special attention - all implementations follow best practices

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/lib/webhooks/processor.ts	5/5	Webhook signature verification and TwiML response handling for Twilio Voice correctly implemented with proper security measures
apps/sim/lib/webhooks/utils.ts	5/5	Twilio signature validation using HMAC-SHA1 and webhook input formatting correctly implemented following Twilio's spec
apps/sim/triggers/twilio_voice/webhook.ts	5/5	Trigger configuration with comprehensive outputs and normalization logic to handle cross-provider config issues
apps/sim/tools/twilio_voice/make_call.ts	5/5	Make call tool with proper Basic Auth, validation, and parameter handling; correctly requires either URL or TwiML
apps/sim/blocks/blocks/twilio_voice.ts	5/5	Block configuration with comprehensive UI fields, proper type conversions, and trigger integration

Sequence Diagram

sequenceDiagram
participant Twilio
participant WebhookAPI as Webhook API
participant Processor as Webhook Processor
participant Utils as Webhook Utils
participant Executor as Workflow Executor
participant TwilioAPI as Twilio API
Note over Twilio,WebhookAPI: Incoming Voice Call
Twilio->>WebhookAPI: POST /api/webhooks/[path]<br/>(x-twilio-signature header)
WebhookAPI->>Processor: parseWebhookBody()
Processor-->>WebhookAPI: body + rawBody
WebhookAPI->>Processor: findWebhookAndWorkflow()
Processor-->>WebhookAPI: webhook + workflow
WebhookAPI->>Processor: verifyProviderAuth()
Processor->>Utils: validateTwilioSignature()
Note over Utils: HMAC-SHA1 validation<br/>url + sorted params
Utils-->>Processor: signature valid
WebhookAPI->>Processor: queueWebhookExecution()
Processor->>Utils: formatWebhookInput()
Utils-->>Processor: formatted input (callSid, from, to, etc.)
Processor->>Executor: executeWebhookJob()
Note over Executor: Workflow runs with<br/>call metadata
Processor-->>Twilio: TwiML Response<br/>(custom or default)
Note over Twilio: Call continues with<br/>TwiML instructions
Note over Executor,TwilioAPI: Outbound Call (from workflow)
Executor->>TwilioAPI: POST /Accounts/{accountSid}/Calls.json<br/>(Make Call Tool)
Note over TwilioAPI: Basic Auth validation
TwilioAPI-->>Executor: callSid, status
Note over Executor,TwilioAPI: Retrieve Recordings
Executor->>TwilioAPI: GET /Recordings/{recordingSid}.json
TwilioAPI-->>Executor: recording metadata
Executor->>TwilioAPI: GET /Transcriptions?RecordingSid=...
TwilioAPI-->>Executor: transcription (if available)

Loading

_{20 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[waleedlatif1]

overall, just confused why we added logic anywhere outside of the specific handler for trigger/[path] for the path for the twilio_voice webhook

we should actually only change those if we absolutely have to, and I'm confused about the slack webhook. Let's go over the whole PR and try to minimuze any non-twilio-voice specific changes that we made.