@floomhq/signaldash 0.39.3 → 0.39.4

package/README.md

@@ -34,7 +34,7 @@ when those providers are enabled on the Unipile account. The CLI prints
 
 When the CLI runs without a TTY, it requests a session-bound browser handoff
 instead. `POST /connect/<provider>/handoff` returns a short-lived `/c/<token>`
-link for the human to open; only the token hash is persisted, and requesting a
+link on `https://signaldash.dev` for the human to open; only the token hash is persisted, and requesting a
 new link for the same provider invalidates the previous one. The default
 15-minute lifetime can be configured with
 `SIGNALDASH_CONNECT_HANDOFF_TTL_MS`. Opening the link creates no SignalDash
@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.3 <invite-code>
+npx -y @floomhq/signaldash@0.39.4 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -393,7 +393,12 @@ calendar is empty.
 for one exact active SignalDash post owned by the authenticated user. The page
 shows only that post, including its stored image attachments. Preview sessions
 and media routes remain account- and post-scoped, expire independently, and
-are revoked on logout.
+are revoked on logout. New exact-post links use
+`https://signaldash.dev/p/<token>` and calendar links use
+`https://signaldash.dev/c/<token>`. Each compact token is 24 base64url
+characters generated from 18 random bytes. Already-issued
+`/scheduled-post/h/<token>` and `/calendar/h/<token>` links remain valid until
+their normal expiry.
 
 `li_edit_scheduled_post` replaces one complete scheduled-post payload in place.
 The preview call takes the exact UUID, text, offset-qualified time, mentions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.3",
+  "version": "0.39.4",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -451,7 +451,7 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_draft_post` | `text` required, max 3000; `publish` optional; `scheduled_at` optional offset-qualified ISO date-time; `content_pipeline_id` normally required for scheduling while that user's pipeline is enabled; `content_pipeline_override` optional exact `{reason,confirm?,approval_hash?}`; `mentions` optional array of up to 20 exact `{name,profile_id}` objects; `attachments` optional array of up to 4 exact `{filename,content_type,content_base64}` images; `first_comment` optional, max 1250 | Create a server-confirmed draft, publish now, or persist an exact future LinkedIn post and its approved first comment. An enabled pipeline normally runs its fact, exact-text, shared-calendar, frequency, and breathing preflight. For one deliberate exception, preview the exact payload with `{reason}`, show it to the human, then repeat it with `confirm:true` and the returned single-use payload-bound `approval_hash`. The audit record preserves the reason, preview ID, and approval time; every non-pipeline provider safety guard remains active. |
 | `li_set_scheduled_post_first_comment` | `id` required UUID; `first_comment` required, max 1250; `confirm:true` required | Attach one exact approved first comment to a scheduled post. SignalDash publishes it through the same connected account after the post and never republishes the post if the comment fails. |
 | `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
-| `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
+| `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use `https://signaldash.dev/p/<token>` browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |
 | `li_edit_scheduled_post` | `id`, `text`, and offset-qualified `scheduled_at` required; full replacement `mentions`, `attachments`, and `first_comment` optional; confirmation repeats the identical payload with `confirm:true`, `approval_hash`, `expected_version`, and `expected_updated_at` from preview | Atomically replace one scheduled post in place. The UUID, creation time, provider account, and content-pipeline audit fields remain unchanged. A changed or non-scheduled row is refused, approval is single-use and expires, and no provider call occurs. Omitting an optional replacement field clears it. Duplicate identity covers the complete normalized payload, including exact attachment bytes, and only active scheduled or executing rows participate; cancelled history never blocks a replacement. |
 | `li_cancel_scheduled_post` | `id` required UUID; `confirm:true` required | Cancel one exact post while it is still scheduled. It cannot recall an executing or published post. |
 | `sd_schedule_message` | `channel` required, `whatsapp` or `linkedin`; `chat_id` required, max 500; `text` required, max 5000; `scheduled_at` required offset-qualified ISO date-time from 60 seconds to 365 days ahead; `confirm:true` required | Schedule one exact message into one chat you have already read. Read that exact chat first, at `limit` 10 or more on LinkedIn: SignalDash records what the thread looked like and refuses at send time if the conversation moved. Text only; attachments are refused rather than dropped. One message at one time, never a sequence. |