@floomhq/signaldash 0.39.2 → 0.39.3

package/README.md

@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.2 <invite-code>
+npx -y @floomhq/signaldash@0.39.3 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -200,6 +200,7 @@ SignalDash exposes:
 - `li_set_scheduled_post_first_comment(id, first_comment, confirm)`
 - `li_scheduled_posts()`
 - `li_scheduled_post_preview(id)`
+- `li_edit_scheduled_post(id, text, scheduled_at, mentions?, attachments?, first_comment?, confirm?, approval_hash?, expected_version?, expected_updated_at?)`
 - `li_cancel_scheduled_post(id, confirm)`
 - `sd_schedule_message(channel, chat_id, text, scheduled_at, confirm)`
 - `sd_scheduled_messages(state?, channel?)`
@@ -394,6 +395,20 @@ shows only that post, including its stored image attachments. Preview sessions
 and media routes remain account- and post-scoped, expire independently, and
 are revoked on logout.
 
+`li_edit_scheduled_post` replaces one complete scheduled-post payload in place.
+The preview call takes the exact UUID, text, offset-qualified time, mentions,
+image bytes, and optional first comment. Confirmation repeats that identical
+payload with the single-use approval hash and exact source version and
+`updated_at`. One atomic compare-and-swap preserves the UUID, `created_at`,
+provider account, and content-pipeline audit fields. A changed, executing,
+published, cancelled, failed, foreign, expired, or replayed target is refused,
+and the edit path never contacts LinkedIn or Unipile. Omitting `mentions`,
+`attachments`, or `first_comment` in the replacement clears that field.
+Scheduled-post duplicate identity covers the complete normalized payload:
+text, time, mentions, exact attachment bytes, and first comment. Only active
+`scheduled` or `executing` rows participate, so a cancelled, published, or
+failed historical row never blocks a legitimate new schedule.
+
 `sd_schedule_message` puts one exact message into one exact chat at one exact
 time, on WhatsApp or LinkedIn, text only. It enqueues; it never sends. The
 attachment bytes a WhatsApp send accepts are refused here rather than held on

package/bin/sd.mjs

@@ -1690,6 +1690,51 @@ const TOOLS = [
       additionalProperties: false,
     },
   },
+  {
+    name: "li_edit_scheduled_post",
+    path: "/li/edit_scheduled_post",
+    description: "Atomically replace the text, time, mentions, image attachments, and optional first comment of one exact SignalDash post while it is still scheduled. The first call previews the complete replacement. Repeat the identical full payload with confirm:true, the single-use approval_hash, expected_version, and expected_updated_at returned by the preview. The post UUID, created_at, provider account, and content-pipeline audit binding are preserved; no provider call occurs.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", format: "uuid" },
+        text: { type: "string", minLength: 1, maxLength: 3000 },
+        scheduled_at: { type: "string", format: "date-time" },
+        mentions: {
+          type: "array", maxItems: 20,
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string", minLength: 1, maxLength: 120 },
+              profile_id: { type: "string", minLength: 1, maxLength: 250 },
+            },
+            required: ["name", "profile_id"],
+            additionalProperties: false,
+          },
+        },
+        attachments: {
+          type: "array", maxItems: 4,
+          items: {
+            type: "object",
+            properties: {
+              filename: { type: "string", minLength: 1, maxLength: 180 },
+              content_type: { type: "string", enum: ["image/png", "image/jpeg", "image/webp", "image/gif"] },
+              content_base64: { type: "string", minLength: 1 },
+            },
+            required: ["filename", "content_type", "content_base64"],
+            additionalProperties: false,
+          },
+        },
+        first_comment: { type: "string", minLength: 1, maxLength: 1250 },
+        confirm: { type: "boolean", const: true },
+        approval_hash: { type: "string", minLength: 64, maxLength: 64, pattern: "^[0-9a-f]{64}$" },
+        expected_version: { type: "integer", minimum: 0 },
+        expected_updated_at: { type: "string", format: "date-time" },
+      },
+      required: ["id", "text", "scheduled_at"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "li_cancel_scheduled_post",
     path: "/li/cancel_scheduled_post",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.2",
+  "version": "0.39.3",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -452,6 +452,7 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_set_scheduled_post_first_comment` | `id` required UUID; `first_comment` required, max 1250; `confirm:true` required | Attach one exact approved first comment to a scheduled post. SignalDash publishes it through the same connected account after the post and never republishes the post if the comment fails. |
 | `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
 | `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
+| `li_edit_scheduled_post` | `id`, `text`, and offset-qualified `scheduled_at` required; full replacement `mentions`, `attachments`, and `first_comment` optional; confirmation repeats the identical payload with `confirm:true`, `approval_hash`, `expected_version`, and `expected_updated_at` from preview | Atomically replace one scheduled post in place. The UUID, creation time, provider account, and content-pipeline audit fields remain unchanged. A changed or non-scheduled row is refused, approval is single-use and expires, and no provider call occurs. Omitting an optional replacement field clears it. Duplicate identity covers the complete normalized payload, including exact attachment bytes, and only active scheduled or executing rows participate; cancelled history never blocks a replacement. |
 | `li_cancel_scheduled_post` | `id` required UUID; `confirm:true` required | Cancel one exact post while it is still scheduled. It cannot recall an executing or published post. |
 | `sd_schedule_message` | `channel` required, `whatsapp` or `linkedin`; `chat_id` required, max 500; `text` required, max 5000; `scheduled_at` required offset-qualified ISO date-time from 60 seconds to 365 days ahead; `confirm:true` required | Schedule one exact message into one chat you have already read. Read that exact chat first, at `limit` 10 or more on LinkedIn: SignalDash records what the thread looked like and refuses at send time if the conversation moved. Text only; attachments are refused rather than dropped. One message at one time, never a sequence. |
 | `sd_scheduled_messages` | `state` optional, one of `scheduled`, `executing`, `sent`, `cancelled`, `failed`, `needs_review`; `channel` optional | List only this authenticated user's scheduled messages and their durable states. Returns every matching row, unpaginated, and always reports `needs_review_count` outside your filter. |
@@ -517,6 +518,7 @@ li_draft_post({"text":"Most agents need better context, not more autonomy."})
 li_set_scheduled_post_first_comment({"id":"00000000-0000-4000-8000-000000000000","first_comment":"https://github.com/xai-org/x-algorithm","confirm":true})
 li_scheduled_posts({})
 li_scheduled_post_preview({"id":"00000000-0000-4000-8000-000000000000"})
+li_edit_scheduled_post({"id":"00000000-0000-4000-8000-000000000000","text":"Exact replacement","scheduled_at":"2026-09-07T08:00:00Z"})
 li_cancel_scheduled_post({"id":"00000000-0000-4000-8000-000000000000","confirm":true})
 sd_schedule_message({"channel":"whatsapp","chat_id":"chat_wa_91b2","text":"Following up on the Q3 numbers, as promised.","scheduled_at":"2026-08-19T09:00:00Z","confirm":true})
 sd_scheduled_messages({})
@@ -556,7 +558,10 @@ commit atomically. Once scheduled, its override-bound first comment is
 immutable. Native LinkedIn remains explicitly blind, so never call
 an empty result an empty calendar. For an existing scheduled post, use
 `li_scheduled_post_preview` when the human wants to review the exact stored
-copy and images in isolation. Use
+copy and images in isolation. Use `li_edit_scheduled_post` for an in-place
+replacement: preview the complete payload, show the exact result, then repeat
+it with the returned approval, source version, and source timestamp. Never
+reuse an approval after any row change. Use
 `li_set_scheduled_post_first_comment` only after approval of the exact comment.
 SignalDash persists the published post ID before sending the comment, so a
 comment failure never republishes the post. It fails interrupted or ambiguous