@floomhq/signaldash 0.39.13 → 0.39.14

package/README.md

@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.13 <invite-code>
+npx -y @floomhq/signaldash@0.39.14 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -412,9 +412,14 @@ same cards as scheduled posts, marked by a visible `DRAFT` tag and an
 `Unscheduled` time label. Saved SignalDash media uses separate protected
 `/calendar/drafts/...` URLs. Each saved SignalDash draft also exposes an
 authenticated edit-and-feedback form. Its CSRF token is bound to the live
-calendar session, draft UUID, and current version. Copy edits and feedback use
-one atomic compare-and-swap, preserve existing media and the first comment,
-append bounded editorial metadata, and never schedule or publish the draft.
+60-minute calendar session, draft UUID, and current version. Copy edits,
+feedback, and up to four private reference images use one atomic
+compare-and-swap. Inline saves keep the active filter and scroll position;
+the server-rendered fallback returns to the same card. Reference images are
+stored separately from post attachments and are only served through the
+tenant-scoped calendar session. Reviews preserve existing post media and the
+first comment, append bounded editorial metadata, and never schedule or publish
+the draft.
 Drafts never enter the `items` returned by
 `li_scheduled_posts`, preserving its existing calendar contract.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.13",
+  "version": "0.39.14",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -451,7 +451,7 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_draft_post` | `text` required, max 3000; `publish` optional; `scheduled_at` optional offset-qualified ISO date-time; `content_pipeline_id` normally required for scheduling while that user's pipeline is enabled; `content_pipeline_override` optional exact `{reason,confirm?,approval_hash?}`; `mentions` optional array of up to 25 exact `{name,profile_id}` objects; `attachments` optional array of up to 20 exact `{filename,content_type,content_base64}` images, max 5 MiB each and 12 MiB total; `first_comment` optional, max 1250 | Create a server-confirmed draft, publish now, or persist an exact future LinkedIn post and its approved first comment. An enabled pipeline normally runs its fact, exact-text, shared-calendar, frequency, and breathing preflight. For one deliberate exception, preview the exact payload with `{reason}`, show it to the human, then repeat it with `confirm:true` and the returned single-use payload-bound `approval_hash`. The audit record preserves the reason, preview ID, and approval time; every non-pipeline provider safety guard remains active. |
 | `li_set_scheduled_post_first_comment` | `id` required UUID; `first_comment` required, max 1250; `confirm:true` required | Attach one exact approved first comment to a scheduled post. SignalDash publishes it through the same connected account after the post and never republishes the post if the comment fails. |
 | `li_save_post_draft` | `text` required, max 3000; `mentions` optional up to 25; `attachments` optional up to 20 exact images, max 5 MiB each and 12 MiB total; `first_comment` optional, max 1250; `source_key` optional tenant-scoped idempotency key, max 256; `metadata` optional bounded structured source/editorial context | Persist one arbitrary LinkedIn draft without scheduling or publishing. Exact ordered image bytes and ordinary duplicate drafts are retained. An identical `source_key` replay returns the existing draft; changed content under that key is refused. Tenant limits are 1,000 drafts and 100 MiB decoded attachment bytes. No provider call or action budget is used. |
-| `li_post_drafts` | no arguments | List durable SignalDash drafts with attachment metadata, never base64, and return a fresh one-use calendar link. The calendar uses the scheduled-post card design for unscheduled SignalDash and Buffer drafts, with a visible `DRAFT` tag. Stored drafts remain separate from scheduled posts and never appear in `li_scheduled_posts.items`. |
+| `li_post_drafts` | no arguments | List durable SignalDash drafts with attachment metadata, never base64, and return a fresh one-use calendar link. The calendar uses the scheduled-post card design for unscheduled SignalDash and Buffer drafts, with a visible `DRAFT` tag. Its 60-minute review session saves copy, notes, and up to four private reference images inline without reloading the calendar. Reference images remain separate from post attachments. Stored drafts remain separate from scheduled posts and never appear in `li_scheduled_posts.items`. |
 | `li_update_post_draft` | `id`, complete replacement `text`, and current `expected_version` required; `mentions`, `attachments`, and `first_comment` optional | Atomically replace the complete saved draft. A stale version is refused with the current version and timestamp. Omitting an optional field clears it. No provider call occurs. |
 | `li_delete_post_draft` | `id`, current `expected_version`, and `confirm:true` required | Permanently delete one exact saved SignalDash draft. Unknown, foreign, deleted, and replayed identifiers are indistinguishable. This cannot delete LinkedIn-native or scheduled content. |
 | `li_post_draft_preview` | `id` required UUID | Create a short-lived, single-use `https://signaldash.dev/d/<token>` browser handoff for one exact saved draft. Its page and exact image bytes are protected by a tenant-, draft-, and originating-session-scoped cookie under `/drafts`. |