@floomhq/signaldash 0.39.2 → 0.39.4

package/README.md

@@ -34,7 +34,7 @@ when those providers are enabled on the Unipile account. The CLI prints
 
 When the CLI runs without a TTY, it requests a session-bound browser handoff
 instead. `POST /connect/<provider>/handoff` returns a short-lived `/c/<token>`
-link for the human to open; only the token hash is persisted, and requesting a
+link on `https://signaldash.dev` for the human to open; only the token hash is persisted, and requesting a
 new link for the same provider invalidates the previous one. The default
 15-minute lifetime can be configured with
 `SIGNALDASH_CONNECT_HANDOFF_TTL_MS`. Opening the link creates no SignalDash
@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.2 <invite-code>
+npx -y @floomhq/signaldash@0.39.4 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -200,6 +200,7 @@ SignalDash exposes:
 - `li_set_scheduled_post_first_comment(id, first_comment, confirm)`
 - `li_scheduled_posts()`
 - `li_scheduled_post_preview(id)`
+- `li_edit_scheduled_post(id, text, scheduled_at, mentions?, attachments?, first_comment?, confirm?, approval_hash?, expected_version?, expected_updated_at?)`
 - `li_cancel_scheduled_post(id, confirm)`
 - `sd_schedule_message(channel, chat_id, text, scheduled_at, confirm)`
 - `sd_scheduled_messages(state?, channel?)`
@@ -392,7 +393,26 @@ calendar is empty.
 for one exact active SignalDash post owned by the authenticated user. The page
 shows only that post, including its stored image attachments. Preview sessions
 and media routes remain account- and post-scoped, expire independently, and
-are revoked on logout.
+are revoked on logout. New exact-post links use
+`https://signaldash.dev/p/<token>` and calendar links use
+`https://signaldash.dev/c/<token>`. Each compact token is 24 base64url
+characters generated from 18 random bytes. Already-issued
+`/scheduled-post/h/<token>` and `/calendar/h/<token>` links remain valid until
+their normal expiry.
+
+`li_edit_scheduled_post` replaces one complete scheduled-post payload in place.
+The preview call takes the exact UUID, text, offset-qualified time, mentions,
+image bytes, and optional first comment. Confirmation repeats that identical
+payload with the single-use approval hash and exact source version and
+`updated_at`. One atomic compare-and-swap preserves the UUID, `created_at`,
+provider account, and content-pipeline audit fields. A changed, executing,
+published, cancelled, failed, foreign, expired, or replayed target is refused,
+and the edit path never contacts LinkedIn or Unipile. Omitting `mentions`,
+`attachments`, or `first_comment` in the replacement clears that field.
+Scheduled-post duplicate identity covers the complete normalized payload:
+text, time, mentions, exact attachment bytes, and first comment. Only active
+`scheduled` or `executing` rows participate, so a cancelled, published, or
+failed historical row never blocks a legitimate new schedule.
 
 `sd_schedule_message` puts one exact message into one exact chat at one exact
 time, on WhatsApp or LinkedIn, text only. It enqueues; it never sends. The

package/bin/sd.mjs

@@ -1690,6 +1690,51 @@ const TOOLS = [
       additionalProperties: false,
     },
   },
+  {
+    name: "li_edit_scheduled_post",
+    path: "/li/edit_scheduled_post",
+    description: "Atomically replace the text, time, mentions, image attachments, and optional first comment of one exact SignalDash post while it is still scheduled. The first call previews the complete replacement. Repeat the identical full payload with confirm:true, the single-use approval_hash, expected_version, and expected_updated_at returned by the preview. The post UUID, created_at, provider account, and content-pipeline audit binding are preserved; no provider call occurs.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", format: "uuid" },
+        text: { type: "string", minLength: 1, maxLength: 3000 },
+        scheduled_at: { type: "string", format: "date-time" },
+        mentions: {
+          type: "array", maxItems: 20,
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string", minLength: 1, maxLength: 120 },
+              profile_id: { type: "string", minLength: 1, maxLength: 250 },
+            },
+            required: ["name", "profile_id"],
+            additionalProperties: false,
+          },
+        },
+        attachments: {
+          type: "array", maxItems: 4,
+          items: {
+            type: "object",
+            properties: {
+              filename: { type: "string", minLength: 1, maxLength: 180 },
+              content_type: { type: "string", enum: ["image/png", "image/jpeg", "image/webp", "image/gif"] },
+              content_base64: { type: "string", minLength: 1 },
+            },
+            required: ["filename", "content_type", "content_base64"],
+            additionalProperties: false,
+          },
+        },
+        first_comment: { type: "string", minLength: 1, maxLength: 1250 },
+        confirm: { type: "boolean", const: true },
+        approval_hash: { type: "string", minLength: 64, maxLength: 64, pattern: "^[0-9a-f]{64}$" },
+        expected_version: { type: "integer", minimum: 0 },
+        expected_updated_at: { type: "string", format: "date-time" },
+      },
+      required: ["id", "text", "scheduled_at"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "li_cancel_scheduled_post",
     path: "/li/cancel_scheduled_post",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.2",
+  "version": "0.39.4",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -451,7 +451,8 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_draft_post` | `text` required, max 3000; `publish` optional; `scheduled_at` optional offset-qualified ISO date-time; `content_pipeline_id` normally required for scheduling while that user's pipeline is enabled; `content_pipeline_override` optional exact `{reason,confirm?,approval_hash?}`; `mentions` optional array of up to 20 exact `{name,profile_id}` objects; `attachments` optional array of up to 4 exact `{filename,content_type,content_base64}` images; `first_comment` optional, max 1250 | Create a server-confirmed draft, publish now, or persist an exact future LinkedIn post and its approved first comment. An enabled pipeline normally runs its fact, exact-text, shared-calendar, frequency, and breathing preflight. For one deliberate exception, preview the exact payload with `{reason}`, show it to the human, then repeat it with `confirm:true` and the returned single-use payload-bound `approval_hash`. The audit record preserves the reason, preview ID, and approval time; every non-pipeline provider safety guard remains active. |
 | `li_set_scheduled_post_first_comment` | `id` required UUID; `first_comment` required, max 1250; `confirm:true` required | Attach one exact approved first comment to a scheduled post. SignalDash publishes it through the same connected account after the post and never republishes the post if the comment fails. |
 | `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
-| `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
+| `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use `https://signaldash.dev/p/<token>` browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
+| `li_edit_scheduled_post` | `id`, `text`, and offset-qualified `scheduled_at` required; full replacement `mentions`, `attachments`, and `first_comment` optional; confirmation repeats the identical payload with `confirm:true`, `approval_hash`, `expected_version`, and `expected_updated_at` from preview | Atomically replace one scheduled post in place. The UUID, creation time, provider account, and content-pipeline audit fields remain unchanged. A changed or non-scheduled row is refused, approval is single-use and expires, and no provider call occurs. Omitting an optional replacement field clears it. Duplicate identity covers the complete normalized payload, including exact attachment bytes, and only active scheduled or executing rows participate; cancelled history never blocks a replacement. |
 | `li_cancel_scheduled_post` | `id` required UUID; `confirm:true` required | Cancel one exact post while it is still scheduled. It cannot recall an executing or published post. |
 | `sd_schedule_message` | `channel` required, `whatsapp` or `linkedin`; `chat_id` required, max 500; `text` required, max 5000; `scheduled_at` required offset-qualified ISO date-time from 60 seconds to 365 days ahead; `confirm:true` required | Schedule one exact message into one chat you have already read. Read that exact chat first, at `limit` 10 or more on LinkedIn: SignalDash records what the thread looked like and refuses at send time if the conversation moved. Text only; attachments are refused rather than dropped. One message at one time, never a sequence. |
 | `sd_scheduled_messages` | `state` optional, one of `scheduled`, `executing`, `sent`, `cancelled`, `failed`, `needs_review`; `channel` optional | List only this authenticated user's scheduled messages and their durable states. Returns every matching row, unpaginated, and always reports `needs_review_count` outside your filter. |
@@ -517,6 +518,7 @@ li_draft_post({"text":"Most agents need better context, not more autonomy."})
 li_set_scheduled_post_first_comment({"id":"00000000-0000-4000-8000-000000000000","first_comment":"https://github.com/xai-org/x-algorithm","confirm":true})
 li_scheduled_posts({})
 li_scheduled_post_preview({"id":"00000000-0000-4000-8000-000000000000"})
+li_edit_scheduled_post({"id":"00000000-0000-4000-8000-000000000000","text":"Exact replacement","scheduled_at":"2026-09-07T08:00:00Z"})
 li_cancel_scheduled_post({"id":"00000000-0000-4000-8000-000000000000","confirm":true})
 sd_schedule_message({"channel":"whatsapp","chat_id":"chat_wa_91b2","text":"Following up on the Q3 numbers, as promised.","scheduled_at":"2026-08-19T09:00:00Z","confirm":true})
 sd_scheduled_messages({})
@@ -556,7 +558,10 @@ commit atomically. Once scheduled, its override-bound first comment is
 immutable. Native LinkedIn remains explicitly blind, so never call
 an empty result an empty calendar. For an existing scheduled post, use
 `li_scheduled_post_preview` when the human wants to review the exact stored
-copy and images in isolation. Use
+copy and images in isolation. Use `li_edit_scheduled_post` for an in-place
+replacement: preview the complete payload, show the exact result, then repeat
+it with the returned approval, source version, and source timestamp. Never
+reuse an approval after any row change. Use
 `li_set_scheduled_post_first_comment` only after approval of the exact comment.
 SignalDash persists the published post ID before sending the comment, so a
 comment failure never republishes the post. It fails interrupted or ambiguous