From 16fd60421949e4de434465964ae4ac3452278064 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Tue, 3 Mar 2026 01:45:17 +0000
Subject: [PATCH] fix(security): pin tlon api source and secure hold music url

---
 extensions/tlon/package.json         | 2 +-
 extensions/voice-call/src/webhook.ts | 2 +-
 pnpm-lock.yaml                       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/extensions/tlon/package.json b/extensions/tlon/package.json
index fabadbb8b7c..3978298c880 100644
--- a/extensions/tlon/package.json
+++ b/extensions/tlon/package.json
@@ -4,7 +4,7 @@
   "description": "OpenClaw Tlon/Urbit channel plugin",
   "type": "module",
   "dependencies": {
-    "@tloncorp/api": "github:tloncorp/api-beta#main",
+    "@tloncorp/api": "github:tloncorp/api-beta#7eede1c1a756977b09f96aa14a92e2b06318ae87",
     "@tloncorp/tlon-skill": "0.1.9",
     "@urbit/aura": "^3.0.0",
     "@urbit/http-api": "^3.0.0"
diff --git a/extensions/voice-call/src/webhook.ts b/extensions/voice-call/src/webhook.ts
index a091ed031b2..ec1969c25fc 100644
--- a/extensions/voice-call/src/webhook.ts
+++ b/extensions/voice-call/src/webhook.ts
@@ -304,7 +304,7 @@ export class VoiceCallWebhookServer {
         body: `<?xml version="1.0" encoding="UTF-8"?>
 <Response>
   <Say voice="alice">All agents are currently busy. Please hold.</Say>
-  <Play loop="0">http://com.twilio.sounds.music.s3.amazonaws.com/MARKOVICHAMP-B8.mp3</Play>
+  <Play loop="0">https://s3.amazonaws.com/com.twilio.music.classical/BusyStrings.mp3</Play>
 </Response>`,
       };
     }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8286468513f..2b8f40f5e7f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -437,7 +437,7 @@ importers:
   extensions/tlon:
     dependencies:
       '@tloncorp/api':
-        specifier: github:tloncorp/api-beta#main
+        specifier: github:tloncorp/api-beta#7eede1c1a756977b09f96aa14a92e2b06318ae87
         version: https://codeload.github.com/tloncorp/api-beta/tar.gz/7eede1c1a756977b09f96aa14a92e2b06318ae87
       '@tloncorp/tlon-skill':
         specifier: 0.1.9