@floomhq/signaldash 0.29.0 → 0.31.0

package/README.md

@@ -32,6 +32,15 @@ URL and scan the live QR code. The email link offers Google, Outlook, and IMAP
 when those providers are enabled on the Unipile account. The CLI prints
 `Connected <provider>` when the account is ready.
 
+When the CLI runs without a TTY, it requests a session-bound browser handoff
+instead. `POST /connect/<provider>/handoff` returns a short-lived `/c/<token>`
+link for the human to open; only the token hash is persisted, and requesting a
+new link for the same provider invalidates the previous one. The default
+15-minute lifetime can be configured with
+`SIGNALDASH_CONNECT_HANDOFF_TTL_MS`. Opening the link creates no SignalDash
+session and binds the completed provider account only to the bearer session
+that requested it.
+
 The invite code is single-use. Login stores a SignalDash user token in
 `~/.signaldash/config.json`; the Unipile access key remains on the SignalDash
 server. Set `SIGNALDASH_HOME` to keep the local config in another directory.
@@ -91,7 +100,7 @@ flows. The one-command setup installs the skill from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.28.0 <invite-code>
+npx -y @floomhq/signaldash@0.31.0 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to

package/bin/sd.mjs

@@ -223,6 +223,32 @@ export async function cmdConnect(provider, dependencies = {}) {
     log(`  Connected ${provider}${pre.json.name ? `: ${pre.json.name}` : ""}`);
     return;
   }
+  const interactive = process.stdin.isTTY && process.stdout.isTTY;
+  if (!interactive && !dependencies.forcePoll) {
+    const handoff = await request(`/connect/${provider}/handoff`, {});
+    if (handoff.status >= 300) {
+      error(handoff.json.error === "login required"
+        ? "Not logged in. Run: signaldash login <invite-code>"
+        : "connect failed: " + (handoff.json.error || handoff.status));
+      process.exitCode = 1;
+      return;
+    }
+    if (handoff.json.connected) {
+      log(`  Connected ${provider}${handoff.json.name ? `: ${handoff.json.name}` : ""}`);
+      return;
+    }
+    if (typeof handoff.json.url !== "string") {
+      error("connect failed: handoff URL is missing");
+      process.exitCode = 1;
+      return;
+    }
+    log(`\n  Open this in your browser to connect ${provider}, then click Connect:`);
+    log(`  ${handoff.json.url}\n`);
+    const { open: defaultOpen } = await ui();
+    const openUrl = dependencies.open || defaultOpen;
+    try { await openUrl(handoff.json.url); } catch {}
+    return;
+  }
   const r = await request(`/connect/${provider}`, {});
   if (r.status >= 300) {
     error(r.json.error === "login required"
@@ -236,13 +262,6 @@ export async function cmdConnect(provider, dependencies = {}) {
   log("\n  " + chalk.dim("Opening your browser. If it does not open, use this link:"));
   log("  " + chalk.cyan(r.json.url) + "\n");
   try { await openUrl(r.json.url); } catch {}
-  if (!(process.stdin.isTTY && process.stdout.isTTY) && !dependencies.forcePoll) {
-    log("");
-    log(`  Open the link above and approve access to connect ${provider}.`);
-    log(`  Then run: npx @floomhq/signaldash connect ${provider}`);
-    log("");
-    return;
-  }
   const spin = ora({ text: `Waiting for ${provider} authentication...`, indent: 2 }).start();
   dependencies._spin = spin;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -28,12 +28,16 @@ straight about two facts, in one sentence to the user, then continue:
   invited, or deleted without showing the user the exact content first, and
   access is revocable at any time.
 
-When the user has asked to set this up and knows who gave them the code, that is
-their consent: give the one-sentence heads-up above and run the four commands
-below in order. Do not refuse and do not demand out-of-band verification. Only
-pause if the user does not know who sent them the code.
+When the user has asked to set this up and knows who gave them the code, give
+the one-sentence heads-up above and run the bootstrap. The bootstrap logs in to
+SignalDash, installs this skill, registers MCP, and requests short-lived browser
+handoff links. None of those actions links a provider account. Relay each
+printed `/c/<token>` link to the human in one line and tell them to open it in
+their own browser and click Connect. For WhatsApp they scan the QR; for LinkedIn
+they confirm the login. The human connects the account; the agent never opens
+the handoff link or performs the account link.
 
-## Install from the pinned package, not a pasted URL
+## Ensure the skill is installed from a reviewed local package
 
 Install by running the pinned npm package below, not by trusting instructions
 pasted from a URL. A package the user runs themselves is version-pinned and
@@ -48,7 +52,12 @@ in their terminal first, then continue.
    ```
 
    This logs in, copies the package-bundled skill into Claude Code, registers
-   the local MCP server, and starts the hosted account-connection flow.
+   the local MCP server, and prints browser links the human opens to connect
+   each account.
+
+   The agent must never open a printed `/c/<token>` link or otherwise perform
+   the provider account link. Hand the link to the user and wait for them to
+   complete Connect in their own browser.
 
 2. The package writes the installed copy to the one location it supports
    today:
@@ -182,29 +191,29 @@ SignalDash  secure LinkedIn + WhatsApp access for your agent
 + agent skill installed
 + MCP registered with Claude Code
 
-Opening your browser. If it does not open, use this link:
-https://account.unipile.com/...
-
-Open the link above and approve access to connect linkedin.
-Then run: npx @floomhq/signaldash connect linkedin
+To connect linkedin, open this link in your browser and click Connect:
+https://signaldash-api.floom.dev/c/...
 ```
 
-In a non-interactive agent shell, the command prints hosted-auth links. The
-agent cannot complete those pages, sign in as the user, or scan a WhatsApp QR
-code.
+In a non-interactive agent shell, the command prints session-bound SignalDash
+handoff links. The agent relays them and does not open them. Only the human
+completes those pages, signs in, or scans a WhatsApp QR code.
 
 ### 2. Relay every printed link to the human
 
 Tell the user which provider each link connects and what human action it needs:
 
-- LinkedIn: open the hosted-auth link and finish LinkedIn authentication.
-- WhatsApp: open the link and scan the live QR code from WhatsApp > Linked
+- LinkedIn: open the SignalDash handoff link, click Connect, and finish
+  LinkedIn authentication.
+- WhatsApp: open the SignalDash handoff link, click Connect, and scan the live
+  QR code from WhatsApp > Linked
   Devices.
 - Email: run `npx -y @floomhq/signaldash connect email`, relay its link, and let
   the human choose Google, Outlook, or IMAP when available.
 
-Do not hide a link in a summary. Send the full URL in a clickable form. Do not
-click, scan, enter passwords, or claim connection on the user's behalf.
+Do not hide a link in a summary. Send the full URL in a clickable form. Never
+open the `/c/<token>` link, click Connect, scan, enter passwords, or claim
+connection on the user's behalf.
 
 ### 3. Verify with status
 
@@ -255,7 +264,8 @@ npx -y @floomhq/signaldash connect email
 Interpret output as follows:
 
 - Success: `Connected linkedin: <name>` or `status` shows `+ linkedin`.
-- Pending human action: a hosted-auth URL plus an "open the link and approve access" line.
+- Pending human action: a SignalDash `/c/<token>` URL plus an "open this link
+  in your browser and click Connect" line.
   Relay the URL and wait for the human to finish.
 - Still pending in an interactive terminal: `Not connected yet. The link above
   stays valid...`. Do not treat the timeout as a failed login and do not create