@floomhq/signaldash 0.34.0 → 0.36.0

package/README.md

@@ -102,7 +102,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.34.0 <invite-code>
+npx -y @floomhq/signaldash@0.36.0 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -121,6 +121,7 @@ SignalDash exposes:
 
 - `sd_version()`
 - `sd_secretary_latest(limit?, continuation?, ack_token?)`
+- `sd_secretary_push_set(enabled, confirm)`
 - `sd_inspiration_list(limit?, status?, content_kind?)`
 - `sd_inspiration_status(id, status, resulting_post_urn?, confirm)`
 - `sd_inspiration_import(source, source_author?, federico_note?, purpose?, content_kind?, credit_required?, credit_note?, format_description?)`
@@ -186,6 +187,26 @@ SignalDash exposes:
 Every operation runs through the hosted SignalDash backend. Agents never
 receive the Unipile access key.
 
+The inspiration library also extracts LinkedIn post references already stored
+inside conversation `signals`. This path scans SQLite only and makes zero
+LinkedIn or Unipile calls. Feed URLs and post slugs become canonical activity
+URNs; `lnkd.in` is contacted with redirects disabled, and the redirect location
+is parsed without requesting `linkedin.com`. An unresolved short link remains
+an `offen` library row with its raw URL. `conversation_sources` preserves each
+sharing signal, thread, time, direction, and exact or unresolved sharer identity
+even when several signals deduplicate to one library URN. The dedicated database
+flag can disable extraction without a deployment.
+
+The hourly Secretary push reuses the existing LinkedIn collector cycle and
+adds no second inbox poll. It sends only when a new tracked-thread reply,
+own-post comment or reaction, or approval-ready draft was stored after push was
+enabled. No change means no WhatsApp provider call and no notification. Every
+push resolves the exact configured Secretary group from the connected account
+and live chat list, reads before sending, and requires an exact one-message
+readback. `sd_secretary_push_set` is the database kill switch; enabling starts
+from that instant so old rows do not create a backlog. The self-chat is never a
+fallback.
+
 `li_reply_to_comment` acts only on an inbound comment on the authenticated
 sender's own post. A preceding `li_post_comments` read records an exact
 per-comment watermark. Immediately before the write, SignalDash re-proves the

package/bin/sd.mjs

@@ -337,6 +337,20 @@ const TOOLS = [
       additionalProperties: false,
     },
   },
+  {
+    name: "sd_secretary_push_set",
+    path: "/sd/secretary/push/set",
+    description: "Enable or disable hourly change-only Secretary notifications to the exact verified WhatsApp group. Enabling re-proves the live WhatsApp account and group and starts from that instant, so old signals do not create a backlog. Disabling is a database kill switch and needs no deploy or restart.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        enabled: { type: "boolean" },
+        confirm: { type: "boolean", const: true },
+      },
+      required: ["enabled", "confirm"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "sd_inspiration_list",
     path: "/sd/inspiration/list",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
   },
   "scripts": {
     "test": "node --test",
-    "check": "node --check bin/sd.mjs && node --check server/server.cjs && node --check server/composio-email.cjs && node --check server/attachments.cjs && node --check server/write-control.cjs && node --check server/secretary-store.cjs && node --check server/secretary-collector.cjs && node --check server/secretary-latest.cjs && node --check server/secretary-approvals.cjs && node --check server/secretary-rules.cjs && node --check server/secretary-shadow-gate.cjs && node --check server/secretary-vault-importer.cjs && node --check server/secretary-inspiration.cjs && node --check server/linkedin-archive-importer.cjs && node --check server/voice-profile.cjs && node --check server/campaign-store.cjs && node --check server/campaign-runner.cjs && node --check server/withdrawal-store.cjs && node --check server/post-scheduler.cjs && node --check server/message-scheduler.cjs && node --check scripts/import-linkedin-archive.mjs && node --check scripts/import-secretary-vault-snapshot.mjs && node --check scripts/rebuild-secretary-actors.mjs && node --check bin/signaldash.js && node --check lib/cli.js && node --check lib/config-file.js && node --check lib/mcp.js && node --check lib/rate-guard.js && node --check lib/secrets.js && node --check lib/unipile.js"
+    "check": "node --check bin/sd.mjs && node --check server/server.cjs && node --check server/composio-email.cjs && node --check server/attachments.cjs && node --check server/write-control.cjs && node --check server/secretary-store.cjs && node --check server/secretary-collector.cjs && node --check server/secretary-latest.cjs && node --check server/secretary-approvals.cjs && node --check server/secretary-push.cjs && node --check server/secretary-rules.cjs && node --check server/secretary-shadow-gate.cjs && node --check server/secretary-vault-importer.cjs && node --check server/secretary-inspiration.cjs && node --check server/linkedin-archive-importer.cjs && node --check server/voice-profile.cjs && node --check server/campaign-store.cjs && node --check server/campaign-runner.cjs && node --check server/withdrawal-store.cjs && node --check server/post-scheduler.cjs && node --check server/message-scheduler.cjs && node --check scripts/import-linkedin-archive.mjs && node --check scripts/import-secretary-vault-snapshot.mjs && node --check scripts/rebuild-secretary-actors.mjs && node --check scripts/extract-conversation-inspiration.mjs && node --check bin/signaldash.js && node --check lib/cli.js && node --check lib/config-file.js && node --check lib/mcp.js && node --check lib/rate-guard.js && node --check lib/secrets.js && node --check lib/unipile.js"
   },
   "keywords": [
     "mcp",

package/skills/secretary/SKILL.md

@@ -28,8 +28,12 @@ English for every other language. Never reply in Italian or another language
 Federico does not speak, because doing so represents that he speaks it.
 
 Nothing in this skill auto-sends. Federico approves every exact reply, comment
-reply, like, or other outward action until he explicitly changes that rule.
-The server remains the authority for approval receipts and write guards.
+reply, like, or other third-party action until he explicitly changes that
+rule. SignalDash separately owns one server-rendered exception: when explicitly
+enabled, an hourly change-only notice may go to Federico's exact verified
+Secretary WhatsApp group. The skill does not compose or send that notice. The
+server remains the authority for its dedupe, kill switch, group proof,
+read-before-send guard, and exact readback.
 
 When Federico asks for inspiration or formats, call `sd_inspiration_list`.
 Use `offen` post formats unless he explicitly asks for business ideas or history.

package/skills/signaldash/SKILL.md

@@ -364,7 +364,8 @@ Use the exact tool names and argument keys below. Limits are optional.
 |---|---|---|
 | `sd_version` | no arguments | Read the backend commit, dirty-at-start state, process start time, and package version captured when the serving process started. Use it to distinguish stale deployment from a code failure. |
 | `sd_secretary_latest` | `limit` optional integer 1-100, default 50; `continuation` optional signed token; `ack_token` optional signed token from the previous successful response | Read the stored Secretary inbox with zero provider calls. Render its rows plus the ignored aggregate as one table. Preserve the prior tokens after an error; on the next successful call pass its acknowledgement and continuation exactly as returned. |
-| `sd_inspiration_list` | `limit` optional 1-100, default 20; `status` optional `offen`, `in arbeit`, `genutzt`, or `alle`; `content_kind` optional `post_format`, `business_idea`, or `all` | Read stored inspiration ranked by source engagement with zero provider calls. Defaults exclude genutzt entries and business ideas. Preserve every row's `draft_provenance`, and add credit when `credit_required` is true or recognisable framing or wording is reused. |
+| `sd_secretary_push_set` | `enabled` boolean and `confirm:true` required | Enable or disable change-only hourly notifications to Federico's exact verified Secretary WhatsApp group. Enabling re-proves the account and group from the live chat list and starts from that instant. Disabling is an immediate database kill switch and needs no deploy or restart. |
+| `sd_inspiration_list` | `limit` optional 1-100, default 20; `status` optional `offen`, `in arbeit`, `genutzt`, or `alle`; `content_kind` optional `post_format`, `business_idea`, or `all` | Read stored inspiration ranked by source engagement with zero provider calls. Defaults exclude genutzt entries and business ideas. `conversation_sources` distinguishes who shared a stored post, in which thread, and when; unresolved short links remain visible by raw URL. Preserve every row's `draft_provenance`, and add credit when `credit_required` is true or recognisable framing or wording is reused. |
 | `sd_inspiration_status` | `id`, `status`, and `confirm:true` required; `resulting_post_urn` required exactly when status is `genutzt` | Record offen, in arbeit, or genutzt state. Genutzt is terminal and the resulting own-post URN prevents the source from ever being proposed again. |
 | `sd_inspiration_import` | `source` exact LinkedIn post URL or URN; optional source author, Federico note, purpose, content kind, credit fields, and format description | Migration/manual capture through Unipile's documented post retrieval endpoint. The primary capture path remains pasting a URL into the verified Secretary WhatsApp group. |
 | `sd_inspiration_channel_configure` | exact `chat_id`, `provider_id`, `chat_name`, and `confirm:true` | Re-prove the connected WhatsApp account and exact group in the live chat list, then enable automatic URL capture and same-group acknowledgements. Never substitute a self-chat. |
@@ -431,6 +432,7 @@ Representative calls:
 ```text
 sd_version({})
 sd_secretary_latest({})
+sd_secretary_push_set({"enabled":false,"confirm":true})
 sd_inspiration_list({})
 li_list_chats({"limit":20})
 li_read_messages({"chat_id":"chat_li_7f3a","limit":20})
@@ -1242,9 +1244,13 @@ These rules apply to LinkedIn messages and invitations, WhatsApp, email, and
 public LinkedIn posts.
 
 1. Never send or publish without explicit human approval of the exact
-   recipient or audience and the exact final text. The only standing-action
-   exception is invitation auto-accept after explicit approval of its exact
-   persistent setting and filters.
+   recipient or audience and the exact final text. The standing-action
+   exceptions are invitation auto-accept after explicit approval of its exact
+   persistent setting and filters, and the server-rendered hourly Secretary
+   notification to Federico's exact verified Secretary WhatsApp group after
+   `sd_secretary_push_set` is explicitly enabled. The latter never sends to a
+   third party, never uses a self-chat, and sends nothing when no stored change
+   exists.
 2. Read the exact thread immediately before a message action. For invitations,
    preview the exact target and note or list the exact current invitation.
    Check the recipient, latest inbound message, prior context, relationship,

package/skills/signaldash-safe-usage/SKILL.md

@@ -20,6 +20,13 @@ Treat LinkedIn, WhatsApp, and email as human accounts, not bulk messaging APIs.
    the user has not already approved both.
 6. Send one message, then read the thread again to confirm delivery.
 
+The only Secretary notification exception is server-rendered and goes to
+Federico's exact verified Secretary WhatsApp group after its database setting
+is explicitly enabled. It re-resolves that group live, never uses a self-chat,
+sends only for a newly stored exact signal or draft identity, and sends nothing
+on a no-change cycle. This exception grants no authority to contact a third
+party.
+
 Never infer a recipient from a partial name. Never send blind. Never retry a
 send after an ambiguous timeout without first reading the thread.