@floomhq/signaldash 0.13.0 → 0.27.0

package/bin/sd.mjs

@@ -4,15 +4,13 @@
 // tools an agent uses all proxy through the backend, so agents access channels
 // THROUGH SignalDash, not around it.
 import {
-  chmodSync,
   readFileSync,
   realpathSync,
-  writeFileSync,
-  mkdirSync,
 } from "node:fs";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
+import { readConfigFile, updateConfigFile } from "../lib/config-file.js";
 
 // Lazy-load presentation deps so `mcp` (stdio, machine-facing) stays clean/fast.
 async function ui() {
@@ -32,28 +30,41 @@ function configPaths() {
 }
 function loadCfg() {
   try {
-    return JSON.parse(readFileSync(configPaths().file, "utf8"));
+    return readConfigFile(configPaths().file);
   } catch {
     return {};
   }
 }
-function saveCfg(c) {
-  const config = configPaths();
-  mkdirSync(config.directory, { recursive: true, mode: 0o700 });
-  chmodSync(config.directory, 0o700);
-  writeFileSync(config.file, JSON.stringify(c, null, 2), { mode: 0o600 });
-  chmodSync(config.file, 0o600);
+function updateCfg(update) {
+  return updateConfigFile(configPaths().file, update);
 }
 
-async function api(path, body, { auth = true, method = "POST" } = {}) {
+async function api(
+  path,
+  body,
+  { auth = true, method = "POST", backend, token } = {},
+) {
   const cfg = loadCfg();
-  const backend = cfg.backend || DEFAULT_BACKEND;
-  const r = await fetch(backend + path, {
+  const targetBackend = backend || cfg.backend || DEFAULT_BACKEND;
+  const targetToken = token || cfg.token;
+  const r = await fetch(targetBackend + path, {
     method,
-    headers: { "Content-Type": "application/json", ...(auth && cfg.token ? { Authorization: `Bearer ${cfg.token}` } : {}) },
+    headers: {
+      "Content-Type": "application/json",
+      ...(auth && targetToken ? { Authorization: `Bearer ${targetToken}` } : {}),
+    },
     ...(method === "GET" ? {} : { body: JSON.stringify(body || {}) }),
   });
-  return { status: r.status, json: await r.json().catch(() => ({})) };
+  const json = await r.json().catch(() => ({}));
+  if (
+    json &&
+    typeof json === "object" &&
+    typeof json.approval_path === "string" &&
+    json.approval_path.startsWith("/")
+  ) {
+    json.approval_url = new URL(json.approval_path, targetBackend).toString();
+  }
+  return { status: r.status, json };
 }
 
 const wait = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
@@ -69,10 +80,12 @@ export async function cmdLogin(code, backend, dependencies = {}) {
   const request = dependencies.request || api;
   const log = dependencies.log || console.log;
   const error = dependencies.error || console.error;
-  const cfg = loadCfg();
-  cfg.backend = backend || cfg.backend || DEFAULT_BACKEND;
-  saveCfg(cfg);
-  const r = await request("/login", { code }, { auth: false });
+  const targetBackend = backend || loadCfg().backend || DEFAULT_BACKEND;
+  const r = await request(
+    "/login",
+    { code },
+    { auth: false, backend: targetBackend },
+  );
   if (r.status !== 200) {
     const msg = String(r.json.error || r.status);
     if (/used|invalid/i.test(msg) && loadCfg().token) {
@@ -83,8 +96,12 @@ export async function cmdLogin(code, backend, dependencies = {}) {
     if (/used/i.test(msg)) error("Invite codes are single-use. If you already ran this, try: signaldash status");
     process.exitCode = 1; return;
   }
-  cfg.token = r.json.token; saveCfg(cfg);
-  log(`Logged in to SignalDash (${cfg.backend}).`);
+  updateCfg(current => ({
+    ...current,
+    backend: targetBackend,
+    token: r.json.token,
+  }));
+  log(`Logged in to SignalDash (${targetBackend}).`);
   log("Your LinkedIn/WhatsApp/email credentials live on that server, not on this");
   log("machine, and are never exposed to your agent. Only you can see your data.");
 }
@@ -98,14 +115,24 @@ export async function cmdLogout(dependencies = {}) {
     log("Already logged out.");
     return;
   }
-  const response = await request("/logout", {});
+  const response = await request(
+    "/logout",
+    {},
+    { backend: cfg.backend, token: cfg.token },
+  );
   if (response.status !== 200 && response.status !== 401) {
     error("logout failed:", response.json.error || response.status);
     process.exitCode = 1;
     return;
   }
-  delete cfg.token;
-  saveCfg(cfg);
+  updateCfg(current => {
+    if (current.backend !== cfg.backend || current.token !== cfg.token) {
+      return current;
+    }
+    const next = { ...current };
+    delete next.token;
+    return next;
+  });
   log(
     response.status === 200
       ? "Logged out of SignalDash. The session was revoked."
@@ -187,12 +214,822 @@ export async function cmdClaim(provider, accountId, dependencies = {}) {
 
 // ---- MCP (stdio). Every tool proxies through the backend with the token. ----
 const TOOLS = [
-  { name: "li_list_chats", ch: "li", action: "list_chats", description: "List your LinkedIn chats." },
-  { name: "li_read_messages", ch: "li", action: "read", description: "Read messages in a LinkedIn chat. args: chat_id" },
-  { name: "li_send_message", ch: "li", action: "send", description: "Send a LinkedIn message (rate-safe). args: chat_id, text" },
-  { name: "wa_list_chats", ch: "wa", action: "list_chats", description: "List your WhatsApp chats." },
-  { name: "wa_read_messages", ch: "wa", action: "read", description: "Read messages in a WhatsApp chat. args: chat_id" },
-  { name: "wa_send_message", ch: "wa", action: "send", description: "Send a WhatsApp message (rate-safe). args: chat_id, text" },
+  {
+    name: "li_list_chats",
+    ch: "li",
+    action: "list_chats",
+    description: "List or search your LinkedIn chats. `search` filters on identifiers, never on a person name (a 1:1 chat has no name); the response reports how far it scanned.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "How many chats to return. With `search`, how many MATCHES to return." },
+        cursor: { type: "string", maxLength: 4000, description: "Continue from a previous page or a previous search." },
+        search: { type: "string", minLength: 1, maxLength: 200, description: "Filter chats on name and counterpart identifiers. The provider cannot filter a chat list, so SignalDash filters over a bounded scan and the response reports `scanned_chats` and `exhaustive` so a miss is never mistaken for a proven absence. A 1:1 chat has no name, so search by identifier or phone number, not by person name." },
+        max_scan: { type: "integer", minimum: 1, maximum: 500, description: "How many chats the search may scan before it stops and reports exhaustive:false. Default 200, and never more than five provider pages: bulk reading is the top account-restriction trigger, so go deeper with the returned cursor rather than with a bigger scan." },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_read_messages",
+    ch: "li",
+    action: "read",
+    description: "Read messages in a LinkedIn chat. args: chat_id",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+      },
+      required: ["chat_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_send_message",
+    ch: "li",
+    action: "send",
+    description: "Send a LinkedIn message (rate-safe). args: chat_id, text",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        text: { type: "string", minLength: 1, maxLength: 5000 },
+      },
+      required: ["chat_id", "text"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_send_invitation",
+    path: "/li/send_invitation",
+    description: "Preview or send one exact LinkedIn invitation. First call without confirm, obtain approval, then repeat the exact provider_id and note with confirm:true.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        provider_id: { type: "string", minLength: 1, maxLength: 500 },
+        note: { type: "string", maxLength: 300 },
+        confirm: { type: "boolean", default: false },
+      },
+      required: ["provider_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_invitations_received",
+    path: "/li/invitations/received",
+    description: "List a bounded page of received LinkedIn invitations and authorize exact later accept actions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+        cursor: { type: "string", maxLength: 1000 },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_accept_invitation",
+    path: "/li/accept_invitation",
+    description: "Accept one exact received LinkedIn invitation after listing current received invitations and obtaining approval.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        invitation_id: { type: "string", minLength: 1, maxLength: 500 },
+        confirm: { type: "boolean" },
+      },
+      required: ["invitation_id", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_invitations_sent",
+    path: "/li/invitations/sent",
+    description: "List a bounded page of sent LinkedIn invitations and authorize exact later withdrawal actions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+        cursor: { type: "string", maxLength: 1000 },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_withdraw_invitation",
+    path: "/li/withdraw_invitation",
+    description: "Withdraw one exact sent LinkedIn invitation after listing current sent invitations and obtaining approval.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        invitation_id: { type: "string", minLength: 1, maxLength: 500 },
+        confirm: { type: "boolean" },
+      },
+      required: ["invitation_id", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_contact_state",
+    path: "/sd/contact_state",
+    description: "Inspect exact per-user, per-channel contact state or add a protective suppression. SignalDash never infers cross-channel identity.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        channel: {
+          type: "string",
+          enum: ["linkedin", "whatsapp", "email"],
+        },
+        identifiers: {
+          type: "array",
+          minItems: 1,
+          maxItems: 8,
+          items: {
+            type: "object",
+            properties: {
+              kind: {
+                type: "string",
+                enum: [
+                  "provider_id",
+                  "public_identifier",
+                  "profile_url",
+                  "member_urn",
+                  "chat_id",
+                  "phone",
+                  "email",
+                ],
+              },
+              value: { type: "string", minLength: 1, maxLength: 1000 },
+            },
+            required: ["kind", "value"],
+            additionalProperties: false,
+          },
+        },
+        action: {
+          type: "string",
+          enum: ["get", "suppress"],
+          default: "get",
+        },
+        reason: {
+          type: "string",
+          enum: [
+            "opt_out",
+            "not_interested",
+            "provider_block",
+            "manual",
+            "legal",
+          ],
+        },
+        confirm: { type: "boolean", default: false },
+      },
+      required: ["channel", "identifiers"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_budget_status",
+    path: "/sd/budget_status",
+    description: "Read authoritative SignalDash LinkedIn attempt capacity for this UTC day and week across manual work and all campaigns. Reports the campaign-excluded portion without promising a reserved manual slot.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_settings_get",
+    path: "/sd/settings/get",
+    description: "Read this SignalDash user's persistent settings. Auto-accept is the first supported setting and is false by default for every existing user.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_settings_set",
+    path: "/sd/settings/set",
+    description: "Update this SignalDash user's persistent settings. Currently supports opt-in, rate-capped LinkedIn invitation auto-accept and exact optional filters. Changing a persistent setting requires explicit approval and confirm:true.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        auto_accept_linkedin: { type: "boolean" },
+        auto_accept_linkedin_filters: {
+          type: "object",
+          properties: {
+            public_identifiers: {
+              type: "array",
+              maxItems: 100,
+              items: {
+                type: "string",
+                minLength: 1,
+                maxLength: 200,
+              },
+            },
+            description_keywords: {
+              type: "array",
+              maxItems: 20,
+              items: {
+                type: "string",
+                minLength: 1,
+                maxLength: 100,
+              },
+            },
+          },
+          additionalProperties: false,
+        },
+        confirm: { type: "boolean" },
+      },
+      required: ["auto_accept_linkedin", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_auto_accept_status",
+    path: "/sd/auto_accept/status",
+    description: "Inspect this user's persistent auto-accept setting, filters, accepted/failed attempts today, remaining dedicated cap, repeated-error stop state, and any unparseable invitation records.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_voice_profile",
+    path: "/sd/voice/profile",
+    description: "Build or fetch this user's personal writing-voice profile for one channel, mined ONLY from up to ~50 of their own SENT messages on that channel (never the other side of any conversation, never another user's data). Returns compact markdown: hard length stats (median/p75/p90 characters), 5-10 verbatim redacted exemplars, negative constraints, and language behavior. Computed once and cached; call with force_recompute:true only when explicitly asked to refresh. Call this before drafting on the user's behalf and match the returned stats and exemplars.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        channel: { type: "string", enum: ["linkedin", "whatsapp", "email"] },
+        force_recompute: { type: "boolean", default: false },
+      },
+      required: ["channel"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_search_connections",
+    path: "/li/connections/search",
+    description: "Search only your locally stored LinkedIn connections by name, headline, or company and join exact local contact state. Makes zero LinkedIn, Unipile, or paid discovery API calls.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: { type: "string", minLength: 1, maxLength: 200 },
+        filters: {
+          type: "object",
+          properties: {
+            company: { type: "string", minLength: 1, maxLength: 200 },
+            headline_keyword: {
+              type: "string",
+              minLength: 1,
+              maxLength: 200,
+            },
+            connected_after: { type: "string", format: "date" },
+            connected_before: { type: "string", format: "date" },
+          },
+          additionalProperties: false,
+        },
+        limit: {
+          type: "integer",
+          minimum: 1,
+          maximum: 100,
+          default: 20,
+        },
+      },
+      required: ["query"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_discover_people",
+    path: "/li/discover_people",
+    description: "Discover public LinkedIn profile cards beyond your completed stored network through one capped HarvestAPI page. Local matches always win. First preview the exact paid request without confirm, obtain approval, then repeat with confirm:true. Each preview authorizes one provider request.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          minLength: 1,
+          maxLength: 200,
+          description: "Role or title to search.",
+        },
+        filters: {
+          type: "object",
+          properties: {
+            company: { type: "string", minLength: 1, maxLength: 200 },
+            location: { type: "string", minLength: 1, maxLength: 200 },
+          },
+          additionalProperties: false,
+        },
+        limit: {
+          type: "integer",
+          minimum: 1,
+          maximum: 10,
+          default: 10,
+        },
+        confirm: { type: "boolean", default: false },
+      },
+      required: ["query"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_create_invitation_batch",
+    path: "/li/invitation_batch/create",
+    description: "Create one immutable LinkedIn Classic invitation-batch preview from exact user-approved profile URLs, inclusion reasons, and optional notes. The agent structures the natural-language request; the server never generates targets or text. Maximum 10 targets.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        source_label: {
+          type: "string",
+          minLength: 1,
+          maxLength: 120,
+        },
+        time_zone: {
+          type: "string",
+          minLength: 1,
+          description: "Sender IANA timezone.",
+        },
+        targets: {
+          type: "array",
+          minItems: 1,
+          maxItems: 10,
+          items: {
+            type: "object",
+            properties: {
+              profile_url: {
+                type: "string",
+                format: "uri",
+                description: "Exact LinkedIn Classic https://www.linkedin.com/in/... URL.",
+              },
+              inclusion_reason: {
+                type: "string",
+                minLength: 1,
+                maxLength: 240,
+              },
+              note: {
+                type: "string",
+                maxLength: 200,
+              },
+            },
+            required: ["profile_url", "inclusion_reason"],
+            additionalProperties: false,
+          },
+        },
+      },
+      required: ["source_label", "time_zone", "targets"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_get_invitation_batch",
+    path: "/li/invitation_batch/get",
+    description: "Inspect one exact immutable invitation batch, every target and exclusion, approval hash, timing, capacity, and execution result. This read authorizes a later exact cancel; MCP cannot approve.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        batch_id: { type: "string", minLength: 36, maxLength: 36 },
+      },
+      required: ["batch_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_cancel_invitation_batch",
+    path: "/li/invitation_batch/cancel",
+    description: "Permanently cancel one freshly inspected invitation batch. Cancels only unstarted targets and cannot recall an executing invitation. Restart requires a new preview and human approval.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        batch_id: { type: "string", minLength: 36, maxLength: 36 },
+        approval_view_hash: {
+          type: ["string", "null"],
+          pattern: "^[0-9a-f]{64}$",
+        },
+        confirm: { type: "boolean" },
+      },
+      required: ["batch_id", "approval_view_hash", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_campaign_create",
+    path: "/sd/campaign/create",
+    description: "Create one campaign: a paced connection request to each exact person, then the exact approved message(s) once that person is PROVEN to have accepted, then an optional follow-up that stops the moment they reply. Nothing is sent until a human approves this exact recipient list and this exact message text on the approval page. Targets come from an explicit list you supply (for example one you built with li_search_connections or li_post_reactions) or from your own post engagers, which costs zero profile fetches. If the user already sent someone a connection request by hand and just wants the follow-up automated, set adopt_existing_invitation on that target instead of leaving them out. Draft the messages in the user's own voice and keep them short: the on-acceptance group is 2-3 separate short sends, never one block.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        source_label: { type: "string", minLength: 1, maxLength: 120 },
+        time_zone: {
+          type: "string",
+          minLength: 1,
+          description: "Sender IANA timezone. Execution is Mon-Fri 09:00-17:00 sender-local.",
+        },
+        target_source: {
+          type: "string",
+          enum: ["explicit", "post_engagers"],
+          default: "explicit",
+        },
+        targets: {
+          type: "array",
+          minItems: 1,
+          maxItems: 150,
+          description: "Explicit targets. Each needs a canonical linkedin.com/in/ URL or an exact provider_id.",
+          items: {
+            type: "object",
+            properties: {
+              profile_url: { type: "string", format: "uri" },
+              provider_id: { type: "string", minLength: 5, maxLength: 500 },
+              inclusion_reason: { type: "string", minLength: 1, maxLength: 240 },
+              note: {
+                type: "string",
+                maxLength: 200,
+                description: "Optional invitation note.",
+              },
+              display_name: { type: "string", maxLength: 160 },
+              headline: { type: "string", maxLength: 300 },
+              adopt_existing_invitation: {
+                type: "boolean",
+                default: false,
+                description: "Set true ONLY when the user already sent this exact person a connection request by hand and now wants the follow-up automated. SignalDash then REQUIRES a still-pending sent invitation to that person and sends none of its own: it adopts the existing one, watches for acceptance, and runs the message sequence. If no pending invitation is found the person is dropped, never invited. Incompatible with note, because no invitation goes out.",
+              },
+            },
+            required: ["inclusion_reason"],
+            additionalProperties: false,
+          },
+        },
+        engagers: {
+          type: "object",
+          description: "Only with target_source post_engagers. The server reads your own recent posts and their reactions and comments, which return member id and network distance directly, so no profiles are fetched.",
+          properties: {
+            post_limit: { type: "integer", minimum: 1, maximum: 10, default: 5 },
+            max_targets: { type: "integer", minimum: 1, maximum: 150, default: 50 },
+            inclusion_reason: { type: "string", minLength: 1, maxLength: 240 },
+            note: { type: "string", maxLength: 200 },
+          },
+          additionalProperties: false,
+        },
+        messages: {
+          type: "array",
+          minItems: 1,
+          maxItems: 5,
+          description: "The exact frozen texts. after_days 0 means sent once the invitation is accepted (1-3 of these, sent as separate consecutive messages); a later step needs after_days 1-30 and only goes out if there has been no reply.",
+          items: {
+            type: "object",
+            properties: {
+              text: { type: "string", minLength: 1, maxLength: 1200 },
+              after_days: { type: "integer", minimum: 0, maximum: 30 },
+            },
+            required: ["text"],
+            additionalProperties: false,
+          },
+        },
+        invite_ttl_days: {
+          type: "integer",
+          minimum: 1,
+          maximum: 60,
+          default: 21,
+          description: "An invitation not accepted within this many days is dropped and never messaged.",
+        },
+      },
+      required: ["source_label", "time_zone", "messages"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_campaign_preview",
+    path: "/sd/campaign/preview",
+    description: "Inspect one campaign before approval: every exact recipient, every exclusion and its reason, the exact message text for each step, the timing, the shared daily budget, and the approval_url to send the human. Show the human this content. This read also authorizes a later exact cancel. An agent cannot approve a campaign; only the authenticated human page can, and it can hand you a one-time code for sd_campaign_approve.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        campaign_id: { type: "string", minLength: 36, maxLength: 36 },
+      },
+      required: ["campaign_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_campaign_approve",
+    path: "/sd/campaign/approve",
+    description: "Record the human's approval of one campaign using the one-time code they generated on the authenticated approval page. You cannot create that code, guess it, or approve without it, and it only ever approves the exact payload and exact recipients they reviewed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        campaign_id: { type: "string", minLength: 36, maxLength: 36 },
+        confirm_token: {
+          type: "string",
+          pattern: "^sd-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$",
+          description: "The code the human read off the approval page.",
+        },
+      },
+      required: ["campaign_id", "confirm_token"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_campaign_status",
+    path: "/sd/campaign/status",
+    description: "Monitor one campaign: invited, acceptance proven, messaged, replied and halted, expired, or excluded per person, plus every message step and any provider response SignalDash could not parse.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        campaign_id: { type: "string", minLength: 36, maxLength: 36 },
+      },
+      required: ["campaign_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_campaign_cancel",
+    path: "/sd/campaign/cancel",
+    description: "Revoke the human approval and cancel one freshly inspected campaign. Stops every unsent invitation and every unsent message. Cannot recall an executing write. Restarting requires a new preview and a new human approval.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        campaign_id: { type: "string", minLength: 36, maxLength: 36 },
+        approval_view_hash: {
+          type: ["string", "null"],
+          pattern: "^[0-9a-f]{64}$",
+        },
+        confirm: { type: "boolean" },
+      },
+      required: ["campaign_id", "approval_view_hash", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_withdrawal_batch_create",
+    path: "/li/withdrawal_batch/create",
+    description:
+      "Clear a backlog of old PENDING SENT LinkedIn invitations. Freezes the exact invitation ids matching an age rule, then one human approval withdraws them one at a time. Two things you must tell the user, because both are LinkedIn's own documented behaviour: (1) this does NOT free up sending capacity, withdrawing does not lift an active sending restriction, it only clears a stale backlog; (2) after withdrawing you cannot re-invite that person for UP TO THREE WEEKS. `exclude` is REQUIRED, not optional: ask the user who must NOT be withdrawn before you call this, because a blanket age rule will otherwise catch people they wanted to keep pending. Passing an empty array is allowed but it means nobody is protected. Age labels are buckets ('sent 4 months ago'), not dates, so the filter is bucket-accurate at best and deliberately holds back anyone whose bucket straddles the threshold.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        account: {
+          type: "string",
+          enum: ["linkedin"],
+          description: "Only LinkedIn sent invitations can be swept.",
+        },
+        older_than_days: {
+          type: "integer",
+          minimum: 30,
+          maximum: 3650,
+          default: 90,
+          description:
+            "Withdraw invitations older than this. Bucket-accurate at best. Minimum 30.",
+        },
+        exclude: {
+          type: "array",
+          maxItems: 100,
+          description:
+            "REQUIRED. People to protect from the sweep, matched exactly, never fuzzily. Ask the user for these by name before calling. An empty array means nobody is protected.",
+          items: {
+            type: "object",
+            properties: {
+              kind: {
+                type: "string",
+                enum: [
+                  "invitation_id",
+                  "provider_id",
+                  "public_identifier",
+                  "profile_url",
+                  "member_urn",
+                  "display_name",
+                ],
+              },
+              value: { type: "string", minLength: 1, maxLength: 1000 },
+            },
+            required: ["kind", "value"],
+            additionalProperties: false,
+          },
+        },
+        time_zone: {
+          type: "string",
+          minLength: 1,
+          maxLength: 64,
+          description:
+            "IANA sender timezone. Withdrawals only run Monday-Friday 09:00-17:00 in this zone.",
+        },
+        limit: {
+          type: "integer",
+          minimum: 1,
+          maximum: 1500,
+          description: "Optional ceiling on how many to withdraw.",
+        },
+        source_label: { type: "string", minLength: 1, maxLength: 120 },
+        allow_unmatched_exclusions: {
+          type: "boolean",
+          description:
+            "By default an exclusion that matches nobody fails the preview, because that is what a typo looks like and a typo means the protected person gets withdrawn. Set true only when the user confirms the mismatch is expected.",
+        },
+      },
+      required: ["account", "exclude", "time_zone"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_withdrawal_batch_status",
+    path: "/li/withdrawal_batch/status",
+    description:
+      "Inspect or monitor one withdrawal sweep: how many are done and remaining, the per-day pace and this sweep's own daily allowance (it never consumes your send budget), the stop reason if it stopped, any provider response SignalDash could not parse, the exact people your exclusions protected, and the approval_url to send the human. This read also authorizes a later exact cancel.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        withdrawal_batch_id: { type: "string", minLength: 36, maxLength: 36 },
+      },
+      required: ["withdrawal_batch_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_withdrawal_batch_approve",
+    path: "/li/withdrawal_batch/approve",
+    description:
+      "Record the human's approval of one withdrawal sweep using the one-time code they generated on the authenticated approval page. You cannot create that code, guess it, or approve without it, and it only ever approves the exact invitations they left ticked.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        withdrawal_batch_id: { type: "string", minLength: 36, maxLength: 36 },
+        confirm_token: {
+          type: "string",
+          pattern: "^sd-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$",
+          description: "The code the human read off the approval page.",
+        },
+      },
+      required: ["withdrawal_batch_id", "confirm_token"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_withdrawal_batch_cancel",
+    path: "/li/withdrawal_batch/cancel",
+    description:
+      "Revoke the human approval and stop one freshly inspected withdrawal sweep. Stops every withdrawal that has not started. Cannot recall one already submitted, and cannot restore the three-week re-invite block for people already withdrawn.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        withdrawal_batch_id: { type: "string", minLength: 36, maxLength: 36 },
+        approval_view_hash: {
+          type: ["string", "null"],
+          pattern: "^[0-9a-f]{64}$",
+        },
+        confirm: { type: "boolean" },
+      },
+      required: ["withdrawal_batch_id", "approval_view_hash", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_list_chats",
+    ch: "wa",
+    action: "list_chats",
+    description: "List or search your WhatsApp chats. `search` matches the phone number (chats carry it as attendee_public_identifier), not a person name; the response reports how far it scanned.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 100, description: "How many chats to return. With `search`, how many MATCHES to return." },
+        cursor: { type: "string", maxLength: 4000, description: "Continue from a previous page or a previous search." },
+        search: { type: "string", minLength: 1, maxLength: 200, description: "Filter chats on name and counterpart identifiers. The provider cannot filter a chat list, so SignalDash filters over a bounded scan and the response reports `scanned_chats` and `exhaustive` so a miss is never mistaken for a proven absence. A 1:1 chat has no name, so search by identifier or phone number, not by person name." },
+        max_scan: { type: "integer", minimum: 1, maximum: 500, description: "How many chats the search may scan before it stops and reports exhaustive:false. Default 200, and never more than five provider pages: bulk reading is the top account-restriction trigger, so go deeper with the returned cursor rather than with a bigger scan." },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_read_messages",
+    ch: "wa",
+    action: "read",
+    description: "Read messages in a WhatsApp chat. args: chat_id",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+      },
+      required: ["chat_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_get_attachment",
+    path: "/wa/get_attachment",
+    description: "Download one attachment of one WhatsApp message this account owns and store it on the SignalDash host. Read the chat first to obtain the exact message_id and attachment_id. Returns the stored path, mimetype, byte size and sha256.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        message_id: { type: "string", minLength: 1, maxLength: 500 },
+        attachment_id: { type: "string", minLength: 1, maxLength: 500 },
+      },
+      required: ["chat_id", "message_id", "attachment_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_transcribe_voice",
+    path: "/wa/transcribe_voice",
+    description: "Transcribe one WhatsApp voice note or audio attachment this account owns. Fetches the audio through SignalDash, transcribes it on the SignalDash host, and returns the transcript text, the stored audio path, and the `backend` that produced the text. Optional `backend` picks the engine: `gemini` (default, accurate on German with English terms mixed in) or `whisper` (local small model, much weaker on code-switching). A `gemini` request that cannot reach Gemini falls back to the local model and says so in `backend` and `fallback_reason`.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        message_id: { type: "string", minLength: 1, maxLength: 500 },
+        attachment_id: { type: "string", minLength: 1, maxLength: 500 },
+        backend: { type: "string", enum: ["gemini", "whisper"] },
+      },
+      required: ["chat_id", "message_id", "attachment_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_send_message",
+    ch: "wa",
+    action: "send",
+    description: "Send a WhatsApp message (rate-safe). args: chat_id, text, attachments. Read the chat first: a send into a thread this account has not read recently is refused. `attachments` optionally carries up to 4 base64 files as exact {filename, content_type, content_base64} objects, at most 16 MiB per file and 16 MiB per message, and accepts images, PDF, CSV, plain text, JSON, xlsx and zip. `text` is the caption and may be omitted when a file is attached, but a call carrying neither text nor an attachment is refused. An attachment send is rate-limited, deduplicated and recorded exactly like a text send, and spends the same daily budget. If a send times out or the provider never confirms it, the message may still have been delivered: SignalDash records it and refuses an identical retry with `409 send_outcome_unknown`. Read the chat, and only if the message is genuinely absent, resend the identical payload with `confirm_resend:true`.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        text: { type: "string", minLength: 1, maxLength: 5000 },
+        attachments: {
+          type: "array", maxItems: 4,
+          items: {
+            type: "object",
+            properties: {
+              filename: { type: "string", minLength: 1, maxLength: 180 },
+              content_type: {
+                type: "string",
+                enum: [
+                  "image/png",
+                  "image/jpeg",
+                  "image/webp",
+                  "image/gif",
+                  "application/pdf",
+                  "text/csv",
+                  "text/plain",
+                  "application/json",
+                  "application/zip",
+                  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+                ],
+              },
+              content_base64: { type: "string", minLength: 1 },
+            },
+            required: ["filename", "content_type", "content_base64"],
+          },
+        },
+        confirm_resend: { type: "boolean", const: true },
+      },
+      // `text` alone is no longer required: a document with no caption is a
+      // legitimate message. `anyOf` states the real rule to any client that
+      // validates locally, and the backend refuses a call carrying neither
+      // regardless of whether the client checked.
+      required: ["chat_id"],
+      anyOf: [{ required: ["text"] }, { required: ["attachments"] }],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_delete_message",
+    path: "/wa/delete_message",
+    description: "Delete one WhatsApp message this account SENT, in a chat this account owns. Read the chat first: the exact `message_id` comes from `wa_read_messages`. Only your own messages can be deleted; someone else's is refused with `403 message_not_own`. This is irreversible and is never retried: a delete already recorded for this exact chat and message is refused with `409 duplicate_delete` rather than replayed. WhatsApp applies its own time and role limits to deleting for everyone and can answer successfully without removing anything, so re-read the chat afterwards to confirm. Deletes spend their own daily budget and never consume your send budget.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        message_id: { type: "string", minLength: 1, maxLength: 500 },
+      },
+      required: ["chat_id", "message_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "wa_delete_messages",
+    path: "/wa/delete_messages",
+    description: "Delete several WhatsApp messages this account sent, at most 200 per call. Every entry runs the exact same ownership, budget and audit path as `wa_delete_message`, one at a time with a pause between them, never in parallel. Returns a per-entry `ok` with the refusal `code` and `error` for each one that did not go through, so a partial result is readable rather than all-or-nothing. Entries the batch never reached before its time limit come back with `skipped:true` and `code:batch_deadline`; resend exactly those to resume.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        messages: {
+          type: "array",
+          minItems: 1,
+          maxItems: 200,
+          items: {
+            type: "object",
+            properties: {
+              chat_id: { type: "string", minLength: 1, maxLength: 500 },
+              message_id: { type: "string", minLength: 1, maxLength: 500 },
+            },
+            required: ["chat_id", "message_id"],
+            additionalProperties: false,
+          },
+        },
+      },
+      required: ["messages"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "email_list",
     path: "/email/list",
@@ -200,6 +1037,7 @@ const TOOLS = [
     inputSchema: {
       type: "object",
       properties: { limit: { type: "integer", minimum: 1, maximum: 100 } },
+      additionalProperties: false,
     },
   },
   {
@@ -213,6 +1051,7 @@ const TOOLS = [
         limit: { type: "integer", minimum: 1, maximum: 100 },
       },
       required: ["thread_id"],
+      additionalProperties: false,
     },
   },
   {
@@ -232,17 +1071,146 @@ const TOOLS = [
         body: { type: "string", minLength: 1, maxLength: 5000 },
       },
       required: ["to", "subject", "body"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_my_posts",
+    path: "/li/posts",
+    description: "List the user's own LinkedIn posts with engagement counts (reactions, comments, impressions). args: limit",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 50 },
+        member_id: { type: "string", minLength: 1, maxLength: 500, description: "Whose posts to list. Defaults to your own." },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_post_reactions",
+    path: "/li/post_reactions",
+    description: "Who reacted to a post — name + headline. These are warm inbound signals. args: post_id, limit",
+    inputSchema: {
+      type: "object",
+      properties: {
+        post_id: { type: "string", minLength: 1, maxLength: 500 },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+      },
+      required: ["post_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_post_comments",
+    path: "/li/post_comments",
+    description: "Comments on a post, with author. args: post_id, limit",
+    inputSchema: {
+      type: "object",
+      properties: {
+        post_id: { type: "string", minLength: 1, maxLength: 500 },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+      },
+      required: ["post_id"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_draft_post",
+    path: "/li/create_post",
+    description: "Draft, publish, or schedule a LinkedIn post. Scheduling requires an offset-qualified scheduled_at plus publish:true after exact human approval. Optional mentions, base64 image attachments, and an account-owner-authored first_comment are preserved for the scheduled publish.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        text: { type: "string", minLength: 1, maxLength: 3000 },
+        publish: { type: "boolean" },
+        scheduled_at: { type: "string", format: "date-time" },
+        first_comment: { type: "string", minLength: 1, maxLength: 1250 },
+        mentions: {
+          type: "array", maxItems: 20,
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string", minLength: 1, maxLength: 120 },
+              profile_id: { type: "string", minLength: 1, maxLength: 250 },
+            },
+            required: ["name", "profile_id"],
+          },
+        },
+        attachments: {
+          type: "array", maxItems: 4,
+          items: {
+            type: "object",
+            properties: {
+              filename: { type: "string", minLength: 1, maxLength: 180 },
+              content_type: { type: "string", enum: ["image/png", "image/jpeg", "image/webp", "image/gif"] },
+              content_base64: { type: "string", minLength: 1 },
+            },
+            required: ["filename", "content_type", "content_base64"],
+          },
+        },
+      },
+      required: ["text"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_set_scheduled_post_first_comment",
+    path: "/li/set_scheduled_post_first_comment",
+    description: "Attach one exact approved first comment to an existing scheduled LinkedIn post. SignalDash publishes it through the same connected account immediately after the post. Requires id, first_comment, and confirm:true.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", format: "uuid" },
+        first_comment: { type: "string", minLength: 1, maxLength: 1250 },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["id", "first_comment", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "li_scheduled_posts",
+    path: "/li/scheduled_posts",
+    description: "List this authenticated user's scheduled LinkedIn posts and their current states.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+  },
+  {
+    name: "li_cancel_scheduled_post",
+    path: "/li/cancel_scheduled_post",
+    description: "Cancel one exact scheduled LinkedIn post before execution. Requires id and confirm:true.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", format: "uuid" },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["id", "confirm"],
+      additionalProperties: false,
     },
   },
-  { name: "li_my_posts", path: "/li/posts", description: "List the user's own LinkedIn posts with engagement counts (reactions, comments, impressions). args: limit" },
-  { name: "li_post_reactions", path: "/li/post_reactions", description: "Who reacted to a post — name + headline. These are warm inbound signals. args: post_id, limit" },
-  { name: "li_post_comments", path: "/li/post_comments", description: "Comments on a post, with author. args: post_id, limit" },
-  { name: "li_draft_post", path: "/li/create_post", description: "Draft a LinkedIn post. Returns the draft WITHOUT publishing. Publishing requires the human to approve and re-send with publish:true. args: text" },
 ];
+// No catch-all fallback. It advertised one union of keys for every tool that
+// had no schema of its own -- which is how `li_list_chats` came to offer `text`
+// and `member_id` that the route never reads, and how a caller could not tell a
+// filtered search from an unfiltered list.
+//
+// A tool with no schema is dropped from the listing rather than shipped with a
+// promise the backend does not keep. Dropped, not thrown: tools/list maps every
+// tool through here, so throwing would take the whole LinkedIn AND WhatsApp
+// surface down over one bad entry. The test suite is what fails on a missing
+// schema; the live surface degrades by exactly one tool.
 function mcpTool(name) {
   const tool = TOOLS.find(t => t.name === name);
-  return { name, description: tool.description,
-    inputSchema: tool.inputSchema || { type: "object", properties: { chat_id: { type: "string" }, text: { type: "string" }, limit: { type: "number" }, post_id: { type: "string" }, member_id: { type: "string" }, publish: { type: "boolean" } } } };
+  if (!tool || !tool.inputSchema) {
+    process.stderr.write(`[signaldash] tool ${name} has no inputSchema; omitted\n`);
+    return null;
+  }
+  return {
+    name,
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+  };
 }
 export async function runMcp(dependencies = {}) {
   const input = dependencies.input || process.stdin;
@@ -253,8 +1221,8 @@ export async function runMcp(dependencies = {}) {
   for await (const line of rl) {
     let msg; try { msg = JSON.parse(line); } catch { continue; }
     const { id, method, params } = msg;
-    if (method === "initialize") reply(id, { protocolVersion: "2024-11-05", capabilities: { tools: {} }, serverInfo: { name: "signaldash", version: "0.1.0" } });
-    else if (method === "tools/list") reply(id, { tools: TOOLS.map(t => mcpTool(t.name)) });
+    if (method === "initialize") reply(id, { protocolVersion: "2024-11-05", capabilities: { tools: {} }, serverInfo: { name: "signaldash", version: PACKAGE_VERSION } });
+    else if (method === "tools/list") reply(id, { tools: TOOLS.map(t => mcpTool(t.name)).filter(Boolean) });
     else if (method === "tools/call") {
       const t = TOOLS.find(x => x.name === params.name);
       if (!t) { reply(id, null, { code: -32601, message: "unknown tool" }); continue; }