@floomhq/signaldash 0.33.2 → 0.35.0

package/README.md

@@ -102,7 +102,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.33.2 <invite-code>
+npx -y @floomhq/signaldash@0.35.0 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -121,6 +121,12 @@ SignalDash exposes:
 
 - `sd_version()`
 - `sd_secretary_latest(limit?, continuation?, ack_token?)`
+- `sd_secretary_push_set(enabled, confirm)`
+- `sd_inspiration_list(limit?, status?, content_kind?)`
+- `sd_inspiration_status(id, status, resulting_post_urn?, confirm)`
+- `sd_inspiration_import(source, source_author?, federico_note?, purpose?, content_kind?, credit_required?, credit_note?, format_description?)`
+- `sd_inspiration_channel_configure(chat_id, provider_id, chat_name, confirm)`
+- `sd_inspiration_channel_set(capture_enabled, confirm)`
 - `sd_secretary_approve(disposition_id, payload_hash, confirm)`
 - `sd_secretary_reject(disposition_id, confirm)`
 - `li_list_chats`
@@ -181,6 +187,16 @@ SignalDash exposes:
 Every operation runs through the hosted SignalDash backend. Agents never
 receive the Unipile access key.
 
+The hourly Secretary push reuses the existing LinkedIn collector cycle and
+adds no second inbox poll. It sends only when a new tracked-thread reply,
+own-post comment or reaction, or approval-ready draft was stored after push was
+enabled. No change means no WhatsApp provider call and no notification. Every
+push resolves the exact configured Secretary group from the connected account
+and live chat list, reads before sending, and requires an exact one-message
+readback. `sd_secretary_push_set` is the database kill switch; enabling starts
+from that instant so old rows do not create a backlog. The self-chat is never a
+fallback.
+
 `li_reply_to_comment` acts only on an inbound comment on the authenticated
 sender's own post. A preceding `li_post_comments` read records an exact
 per-comment watermark. Immediately before the write, SignalDash re-proves the

package/bin/sd.mjs

@@ -337,6 +337,100 @@ const TOOLS = [
       additionalProperties: false,
     },
   },
+  {
+    name: "sd_secretary_push_set",
+    path: "/sd/secretary/push/set",
+    description: "Enable or disable hourly change-only Secretary notifications to the exact verified WhatsApp group. Enabling re-proves the live WhatsApp account and group and starts from that instant, so old signals do not create a backlog. Disabling is a database kill switch and needs no deploy or restart.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        enabled: { type: "boolean" },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["enabled", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_inspiration_list",
+    path: "/sd/inspiration/list",
+    description: "Read Federico's stored inspiration formats, ranked by source engagement at capture. Defaults to status offen and post formats, so genutzt entries and business ideas are never proposed accidentally. Every row carries source author, URL, exact text, credit requirement, and draft provenance. Makes zero provider requests.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 20 },
+        status: { type: "string", enum: ["offen", "in arbeit", "genutzt", "alle"], default: "offen" },
+        content_kind: { type: "string", enum: ["post_format", "business_idea", "all"], default: "post_format" },
+      },
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_inspiration_status",
+    path: "/sd/inspiration/status",
+    description: "Move one inspiration entry to offen, in arbeit, or genutzt. Genutzt is terminal and requires the exact resulting LinkedIn post URN, preventing the format from ever being proposed again.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", minLength: 1, maxLength: 200 },
+        status: { type: "string", enum: ["offen", "in arbeit", "genutzt"] },
+        resulting_post_urn: { type: "string", pattern: "^urn:li:(activity|ugcPost|share):[0-9]+$" },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["id", "status", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_inspiration_import",
+    path: "/sd/inspiration/import",
+    description: "Import one exact LinkedIn post URL or URN into the inspiration library through Unipile's documented post endpoint. This is the migration/manual lane; normal capture is automatic when a URL is pasted into the configured Secretary WhatsApp group.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        source: { type: "string", minLength: 1, maxLength: 2048 },
+        source_author: { type: "string", minLength: 1, maxLength: 1024 },
+        federico_note: { type: "string", minLength: 1, maxLength: 16384 },
+        purpose: { type: "string", minLength: 1, maxLength: 4096 },
+        content_kind: { type: "string", enum: ["post_format", "business_idea"] },
+        credit_required: { type: "boolean" },
+        credit_note: { type: "string", minLength: 1, maxLength: 4096 },
+        format_description: { type: "string", minLength: 1, maxLength: 4096 },
+      },
+      required: ["source"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_inspiration_channel_configure",
+    path: "/sd/inspiration/channel/configure",
+    description: "Verify and bind the exact Secretary WhatsApp group against the connected account and live chat list, then enable automatic LinkedIn URL capture and same-group acknowledgements. Never use a self-chat fallback.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        chat_id: { type: "string", minLength: 1, maxLength: 500 },
+        provider_id: { type: "string", minLength: 1, maxLength: 500 },
+        chat_name: { type: "string", minLength: 1, maxLength: 200 },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["chat_id", "provider_id", "chat_name", "confirm"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "sd_inspiration_channel_set",
+    path: "/sd/inspiration/channel/set",
+    description: "Database kill switch for automatic inspiration capture and acknowledgements. Disabling requires no deploy or restart.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        capture_enabled: { type: "boolean" },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["capture_enabled", "confirm"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "sd_secretary_reject",
     path: "/sd/secretary/reject",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.33.2",
+  "version": "0.35.0",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "test": "node --test",
-    "check": "node --check bin/sd.mjs && node --check server/server.cjs && node --check server/composio-email.cjs && node --check server/attachments.cjs && node --check server/write-control.cjs && node --check server/secretary-store.cjs && node --check server/secretary-collector.cjs && node --check server/secretary-latest.cjs && node --check server/secretary-approvals.cjs && node --check server/secretary-rules.cjs && node --check server/secretary-shadow-gate.cjs && node --check server/secretary-vault-importer.cjs && node --check server/linkedin-archive-importer.cjs && node --check server/voice-profile.cjs && node --check server/campaign-store.cjs && node --check server/campaign-runner.cjs && node --check server/withdrawal-store.cjs && node --check server/post-scheduler.cjs && node --check server/message-scheduler.cjs && node --check scripts/import-linkedin-archive.mjs && node --check scripts/import-secretary-vault-snapshot.mjs && node --check scripts/rebuild-secretary-actors.mjs && node --check bin/signaldash.js && node --check lib/cli.js && node --check lib/config-file.js && node --check lib/mcp.js && node --check lib/rate-guard.js && node --check lib/secrets.js && node --check lib/unipile.js"
+    "check": "node --check bin/sd.mjs && node --check server/server.cjs && node --check server/composio-email.cjs && node --check server/attachments.cjs && node --check server/write-control.cjs && node --check server/secretary-store.cjs && node --check server/secretary-collector.cjs && node --check server/secretary-latest.cjs && node --check server/secretary-approvals.cjs && node --check server/secretary-push.cjs && node --check server/secretary-rules.cjs && node --check server/secretary-shadow-gate.cjs && node --check server/secretary-vault-importer.cjs && node --check server/secretary-inspiration.cjs && node --check server/linkedin-archive-importer.cjs && node --check server/voice-profile.cjs && node --check server/campaign-store.cjs && node --check server/campaign-runner.cjs && node --check server/withdrawal-store.cjs && node --check server/post-scheduler.cjs && node --check server/message-scheduler.cjs && node --check scripts/import-linkedin-archive.mjs && node --check scripts/import-secretary-vault-snapshot.mjs && node --check scripts/rebuild-secretary-actors.mjs && node --check bin/signaldash.js && node --check lib/cli.js && node --check lib/config-file.js && node --check lib/mcp.js && node --check lib/rate-guard.js && node --check lib/secrets.js && node --check lib/unipile.js"
   },
   "keywords": [
     "mcp",

package/skills/secretary/SKILL.md

@@ -5,6 +5,42 @@ description: Render Federico's stored inbound SignalDash triage when he asks for
 
 # Secretary latest
 
+## Standing operating rules
+
+Apply this priority order to the rows SignalDash returns. Do not reorder rows
+inside one server category:
+
+1. Always do: every inbound comment on Federico's own posts gets a drafted
+   reply and a like. This includes short, generic, and critical comments.
+   Critical replies stay factual, calm, and non-defensive. Every commenter and
+   reactor is captured as a signal and checked against the ICP while the post
+   is still live.
+2. Same day: expiring travel or location context, concrete scheduling options,
+   and threads where Federico wrote last.
+3. Within 24 hours: real-fund investors, network intro offers, design partners,
+   customers, and existing valuable conversations.
+4. Batch at low priority: student or junior mentoring, vague sparring or
+   participation offers, and internship requests under posts.
+5. Ignore: cold agency or automation pitches and generic tool sellers.
+
+Draft in the counterparty's language only when it is English or German. Use
+English for every other language. Never reply in Italian or another language
+Federico does not speak, because doing so represents that he speaks it.
+
+Nothing in this skill auto-sends. Federico approves every exact reply, comment
+reply, like, or other third-party action until he explicitly changes that
+rule. SignalDash separately owns one server-rendered exception: when explicitly
+enabled, an hourly change-only notice may go to Federico's exact verified
+Secretary WhatsApp group. The skill does not compose or send that notice. The
+server remains the authority for its dedupe, kill switch, group proof,
+read-before-send guard, and exact readback.
+
+When Federico asks for inspiration or formats, call `sd_inspiration_list`.
+Use `offen` post formats unless he explicitly asks for business ideas or history.
+Keep the returned `draft_provenance` attached to any draft. Add a credit line
+when `credit_required` is true or when recognisable framing or wording is
+borrowed. A `genutzt` entry is terminal and must never be proposed again.
+
 When Federico asks `latest`, call `sd_secretary_latest`. This is a stored-data
 read. Do not call LinkedIn, list chats, read threads, draft with a model, or use
 any provider-backed tool as part of this flow.

package/skills/signaldash/SKILL.md

@@ -364,6 +364,12 @@ Use the exact tool names and argument keys below. Limits are optional.
 |---|---|---|
 | `sd_version` | no arguments | Read the backend commit, dirty-at-start state, process start time, and package version captured when the serving process started. Use it to distinguish stale deployment from a code failure. |
 | `sd_secretary_latest` | `limit` optional integer 1-100, default 50; `continuation` optional signed token; `ack_token` optional signed token from the previous successful response | Read the stored Secretary inbox with zero provider calls. Render its rows plus the ignored aggregate as one table. Preserve the prior tokens after an error; on the next successful call pass its acknowledgement and continuation exactly as returned. |
+| `sd_secretary_push_set` | `enabled` boolean and `confirm:true` required | Enable or disable change-only hourly notifications to Federico's exact verified Secretary WhatsApp group. Enabling re-proves the account and group from the live chat list and starts from that instant. Disabling is an immediate database kill switch and needs no deploy or restart. |
+| `sd_inspiration_list` | `limit` optional 1-100, default 20; `status` optional `offen`, `in arbeit`, `genutzt`, or `alle`; `content_kind` optional `post_format`, `business_idea`, or `all` | Read stored inspiration ranked by source engagement with zero provider calls. Defaults exclude genutzt entries and business ideas. Preserve every row's `draft_provenance`, and add credit when `credit_required` is true or recognisable framing or wording is reused. |
+| `sd_inspiration_status` | `id`, `status`, and `confirm:true` required; `resulting_post_urn` required exactly when status is `genutzt` | Record offen, in arbeit, or genutzt state. Genutzt is terminal and the resulting own-post URN prevents the source from ever being proposed again. |
+| `sd_inspiration_import` | `source` exact LinkedIn post URL or URN; optional source author, Federico note, purpose, content kind, credit fields, and format description | Migration/manual capture through Unipile's documented post retrieval endpoint. The primary capture path remains pasting a URL into the verified Secretary WhatsApp group. |
+| `sd_inspiration_channel_configure` | exact `chat_id`, `provider_id`, `chat_name`, and `confirm:true` | Re-prove the connected WhatsApp account and exact group in the live chat list, then enable automatic URL capture and same-group acknowledgements. Never substitute a self-chat. |
+| `sd_inspiration_channel_set` | `capture_enabled` and `confirm:true` | Disable or re-enable capture and acknowledgements through the database kill switch without a deploy. |
 | `sd_secretary_approve` | `disposition_id` required; `payload_hash` required exact 64-character hash from latest; `confirm:true` required | Create one single-use, 15-minute receipt for the exact current stored draft. It derives the sender and executable payload from storage. |
 | `sd_secretary_reject` | `disposition_id` required; `confirm:true` required | Reject one exact current stored draft. It sends nothing. |
 | `li_list_chats` | `limit` integer 1-100, default 20; `cursor` optional; `search` optional string, max 200 characters; `max_scan` optional integer 1-500; `unread` optional boolean | Find recent LinkedIn chats, unread counts, and exact `chat_id` values. `unread:true` is forwarded to the provider as `unread=true`; SignalDash does not fetch a full chat page and filter it locally. Search accepts a unique stored display name, exact `public_id`, member id, or ordinary chat field. A stored name/public id is resolved to its verified member id before matching, so a provider row with `name:null` remains findable. Without an explicit `max_scan`, a zero-match search extends from 200 up to a hard 500-chat/five-page bound; explicit bounds remain exact. Read `scanned_chats`, `pages_fetched`, `scan_limit`, and `exhaustive` before concluding absence. The response also reports any resolved public/member ids. Any other key, including `text` and `member_id`, is refused with `unsupported_parameter` rather than accepted and ignored. |
@@ -426,6 +432,8 @@ Representative calls:
 ```text
 sd_version({})
 sd_secretary_latest({})
+sd_secretary_push_set({"enabled":false,"confirm":true})
+sd_inspiration_list({})
 li_list_chats({"limit":20})
 li_read_messages({"chat_id":"chat_li_7f3a","limit":20})
 li_send_message({"chat_id":"chat_li_7f3a","text":"Yes. I’ll send it this afternoon."})
@@ -1236,9 +1244,13 @@ These rules apply to LinkedIn messages and invitations, WhatsApp, email, and
 public LinkedIn posts.
 
 1. Never send or publish without explicit human approval of the exact
-   recipient or audience and the exact final text. The only standing-action
-   exception is invitation auto-accept after explicit approval of its exact
-   persistent setting and filters.
+   recipient or audience and the exact final text. The standing-action
+   exceptions are invitation auto-accept after explicit approval of its exact
+   persistent setting and filters, and the server-rendered hourly Secretary
+   notification to Federico's exact verified Secretary WhatsApp group after
+   `sd_secretary_push_set` is explicitly enabled. The latter never sends to a
+   third party, never uses a self-chat, and sends nothing when no stored change
+   exists.
 2. Read the exact thread immediately before a message action. For invitations,
    preview the exact target and note or list the exact current invitation.
    Check the recipient, latest inbound message, prior context, relationship,

package/skills/signaldash-safe-usage/SKILL.md

@@ -20,6 +20,13 @@ Treat LinkedIn, WhatsApp, and email as human accounts, not bulk messaging APIs.
    the user has not already approved both.
 6. Send one message, then read the thread again to confirm delivery.
 
+The only Secretary notification exception is server-rendered and goes to
+Federico's exact verified Secretary WhatsApp group after its database setting
+is explicitly enabled. It re-resolves that group live, never uses a self-chat,
+sends only for a newly stored exact signal or draft identity, and sends nothing
+on a no-change cycle. This exception grants no authority to contact a third
+party.
+
 Never infer a recipient from a partial name. Never send blind. Never retry a
 send after an ambiguous timeout without first reading the thread.