@floomhq/signaldash 0.39.1 → 0.39.2

package/README.md

@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.1 <invite-code>
+npx -y @floomhq/signaldash@0.39.2 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -199,6 +199,7 @@ SignalDash exposes:
 - `li_draft_post(text, publish, scheduled_at?, content_pipeline_id?, content_pipeline_override?, mentions?, attachments?, first_comment?)`
 - `li_set_scheduled_post_first_comment(id, first_comment, confirm)`
 - `li_scheduled_posts()`
+- `li_scheduled_post_preview(id)`
 - `li_cancel_scheduled_post(id, confirm)`
 - `sd_schedule_message(channel, chat_id, text, scheduled_at, confirm)`
 - `sd_scheduled_messages(state?, channel?)`
@@ -387,6 +388,12 @@ linkedin.com to fill the gap. An empty item list therefore means only that the
 visible SignalDash and Buffer sources are empty, never that the native LinkedIn
 calendar is empty.
 
+`li_scheduled_post_preview` returns a short-lived, single-use browser handoff
+for one exact active SignalDash post owned by the authenticated user. The page
+shows only that post, including its stored image attachments. Preview sessions
+and media routes remain account- and post-scoped, expire independently, and
+are revoked on logout.
+
 `sd_schedule_message` puts one exact message into one exact chat at one exact
 time, on WhatsApp or LinkedIn, text only. It enqueues; it never sends. The
 attachment bytes a WhatsApp send accepts are refused here rather than held on

package/bin/sd.mjs

@@ -1677,6 +1677,19 @@ const TOOLS = [
     description: "Read the shared LinkedIn content calendar from SignalDash and the configured Buffer channel. Always inspect completeness and per-source state. Native LinkedIn scheduled posts and drafts are NOT visible because Unipile has no documented read route for them, and SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty items array is never proof that the native LinkedIn calendar is empty.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
   },
+  {
+    name: "li_scheduled_post_preview",
+    path: "/li/scheduled_post_preview",
+    description: "Create a short-lived one-use browser link for one exact active SignalDash scheduled post. The preview renders only that post, its stored image attachments, and its queued first comment in a read-only session. Requires the exact SignalDash post UUID returned by li_draft_post or li_scheduled_posts.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", format: "uuid" },
+      },
+      required: ["id"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "li_cancel_scheduled_post",
     path: "/li/cancel_scheduled_post",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/content/SKILL.md

@@ -47,7 +47,9 @@ schedule without Federico approving the exact final text and time.
    through `li_draft_post` with the exact `content_pipeline_id`. SignalDash
    binds it in the same request only after the preflight passes. Same-day
    conflicts, three posts in one week, and a post above baseline inside its
-   two-day breathing window refuse before a schedule row exists.
+   two-day breathing window refuse before a schedule row exists. When Federico
+   asks to inspect the stored result, call `li_scheduled_post_preview` with its
+   exact schedule ID and share the isolated one-post handoff.
 7. Record exact publication evidence, then read the live own post at 24 and 72
    hours and pass its reactions, comments, impressions, and provider evidence
    to `sd_content_pipeline_measure`. The evidence must name `li_my_posts`, the

package/skills/signaldash/SKILL.md

@@ -451,6 +451,7 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_draft_post` | `text` required, max 3000; `publish` optional; `scheduled_at` optional offset-qualified ISO date-time; `content_pipeline_id` normally required for scheduling while that user's pipeline is enabled; `content_pipeline_override` optional exact `{reason,confirm?,approval_hash?}`; `mentions` optional array of up to 20 exact `{name,profile_id}` objects; `attachments` optional array of up to 4 exact `{filename,content_type,content_base64}` images; `first_comment` optional, max 1250 | Create a server-confirmed draft, publish now, or persist an exact future LinkedIn post and its approved first comment. An enabled pipeline normally runs its fact, exact-text, shared-calendar, frequency, and breathing preflight. For one deliberate exception, preview the exact payload with `{reason}`, show it to the human, then repeat it with `confirm:true` and the returned single-use payload-bound `approval_hash`. The audit record preserves the reason, preview ID, and approval time; every non-pipeline provider safety guard remains active. |
 | `li_set_scheduled_post_first_comment` | `id` required UUID; `first_comment` required, max 1250; `confirm:true` required | Attach one exact approved first comment to a scheduled post. SignalDash publishes it through the same connected account after the post and never republishes the post if the comment fails. |
 | `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
+| `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
 | `li_cancel_scheduled_post` | `id` required UUID; `confirm:true` required | Cancel one exact post while it is still scheduled. It cannot recall an executing or published post. |
 | `sd_schedule_message` | `channel` required, `whatsapp` or `linkedin`; `chat_id` required, max 500; `text` required, max 5000; `scheduled_at` required offset-qualified ISO date-time from 60 seconds to 365 days ahead; `confirm:true` required | Schedule one exact message into one chat you have already read. Read that exact chat first, at `limit` 10 or more on LinkedIn: SignalDash records what the thread looked like and refuses at send time if the conversation moved. Text only; attachments are refused rather than dropped. One message at one time, never a sequence. |
 | `sd_scheduled_messages` | `state` optional, one of `scheduled`, `executing`, `sent`, `cancelled`, `failed`, `needs_review`; `channel` optional | List only this authenticated user's scheduled messages and their durable states. Returns every matching row, unpaginated, and always reports `needs_review_count` outside your filter. |
@@ -515,6 +516,7 @@ li_delete_comment({"post_id":"exact-v2-post-id","comment_id":"exact-own-comment-
 li_draft_post({"text":"Most agents need better context, not more autonomy."})
 li_set_scheduled_post_first_comment({"id":"00000000-0000-4000-8000-000000000000","first_comment":"https://github.com/xai-org/x-algorithm","confirm":true})
 li_scheduled_posts({})
+li_scheduled_post_preview({"id":"00000000-0000-4000-8000-000000000000"})
 li_cancel_scheduled_post({"id":"00000000-0000-4000-8000-000000000000","confirm":true})
 sd_schedule_message({"channel":"whatsapp","chat_id":"chat_wa_91b2","text":"Following up on the Q3 numbers, as promised.","scheduled_at":"2026-08-19T09:00:00Z","confirm":true})
 sd_scheduled_messages({})
@@ -553,6 +555,8 @@ disable the pipeline as a shortcut. The schedule and approval consumption
 commit atomically. Once scheduled, its override-bound first comment is
 immutable. Native LinkedIn remains explicitly blind, so never call
 an empty result an empty calendar. For an existing scheduled post, use
+`li_scheduled_post_preview` when the human wants to review the exact stored
+copy and images in isolation. Use
 `li_set_scheduled_post_first_comment` only after approval of the exact comment.
 SignalDash persists the published post ID before sending the comment, so a
 comment failure never republishes the post. It fails interrupted or ambiguous