@floomhq/signaldash 0.39.9 → 0.39.10

package/README.md

@@ -120,7 +120,7 @@ setup installs both from the same pinned npm package
 the human chose to execute:
 
 ```bash
-npx -y @floomhq/signaldash@0.39.9 <invite-code>
+npx -y @floomhq/signaldash@0.39.10 <invite-code>
 ```
 
 Run that command in a terminal, not in an agent chat. Do not ask an agent to
@@ -442,6 +442,12 @@ per-client throttle. Already-issued 24-character compact tokens and 48-character
 `/scheduled-post/h/<token>` or `/calendar/h/<token>` links remain valid until
 their normal expiry.
 
+The shared calendar preserves validated Buffer LinkedIn tag ranges in the post
+body and also keeps the separate tag audit pills. Buffer image assets and
+video/document thumbnails render through the same authenticated, no-store
+media surface as SignalDash attachments; provider asset URLs are never placed
+in the browser HTML.
+
 `li_edit_scheduled_post` replaces one complete scheduled-post payload in place.
 The preview call takes the exact UUID, text, offset-qualified time, mentions,
 image bytes, and optional first comment. Confirmation repeats that identical

package/bin/sd.mjs

@@ -1909,6 +1909,7 @@ const TOOLS = [
               meta: { type: "array", maxItems: 4, items: { type: "string", maxLength: 80 } },
               org: { type: "string", maxLength: 120 },
               tags: { type: "array", maxItems: 5, items: { type: "string", maxLength: 28 } },
+              facts: { type: "array", maxItems: 4, items: { type: "object", properties: { label: { type: "string", maxLength: 24 }, value: { type: "string", maxLength: 120 } }, required: ["label","value"], additionalProperties: false } },
               factors: {
                 type: "array", maxItems: 6,
                 items: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/signaldash",
-  "version": "0.39.9",
+  "version": "0.39.10",
   "description": "Secure LinkedIn, WhatsApp, and email access for AI agents",
   "type": "module",
   "bin": {

package/skills/signaldash/SKILL.md

@@ -455,7 +455,7 @@ Use the exact tool names and argument keys below. Limits are optional.
 | `li_update_post_draft` | `id`, complete replacement `text`, and current `expected_version` required; `mentions`, `attachments`, and `first_comment` optional | Atomically replace the complete saved draft. A stale version is refused with the current version and timestamp. Omitting an optional field clears it. No provider call occurs. |
 | `li_delete_post_draft` | `id`, current `expected_version`, and `confirm:true` required | Permanently delete one exact saved SignalDash draft. Unknown, foreign, deleted, and replayed identifiers are indistinguishable. This cannot delete LinkedIn-native or scheduled content. |
 | `li_post_draft_preview` | `id` required UUID | Create a short-lived, single-use `https://signaldash.dev/d/<token>` browser handoff for one exact saved draft. Its page and exact image bytes are protected by a tenant-, draft-, and originating-session-scoped cookie under `/drafts`. |
-| `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
+| `li_scheduled_posts` | no arguments | Read one shared content-calendar view across SignalDash and the configured Buffer LinkedIn channel. The browser calendar renders validated Buffer company tags both inline and as audit pills, and proxies supported Buffer image previews through its authenticated no-store media route without exposing provider URLs. Inspect `completeness` and every `sources.*.state` before treating absence as an empty calendar. Native LinkedIn scheduled posts and drafts are invisible because Unipile has no documented read route for them; SignalDash does not use raw Voyager routes or linkedin.com browser access. An empty `items` array proves only that the visible sources returned no entries. |
 | `li_profile` | `identifier` required, a public id or member id | Read one LinkedIn profile: name, headline, public identifier, provider id, network distance and the profile picture url. Read-only, one provider call, and it returns those six fields rather than the provider's whole record about a person. It exists because pictures were otherwise a by-product of engagement only: reactions and comments carry one, the stored connections carry no picture field, chats carry none, and the invitation preview refuses anyone already connected, so every new name in a shortlist stayed faceless. |
 | `sd_share_list` | `action` create/list/revoke, plus `title`, `columns`, `rows`, optional `note`, or `token` to revoke | Share one selection as a standalone `https://signaldash.dev/l/<token>` page that anyone with the link can open. `create` returns the url ONCE and stores only its SHA-256 hash, so a lost link can be revoked but never recovered. The page is a fixed snapshot and never re-reads the source, so a list shared today does not keep disclosing tomorrow's data. Pass `people` instead of `rows` for a shortlist of humans: each renders as a card with a photo where the provider supplies one and initials where it does not, an optional `score` out of 100, and the `reason` that earned it, with the scoring rule in `rubric` so the reader can check it. For a plain table, every row must have exactly as many cells as there are columns, because a crooked table reads as a claim about the wrong person. `list` shows every live link with its non-secret `list_id` and open count, so a link whose url is lost can still be switched off and a forgotten one stays visible; `revoke` takes either the `token` or that `list_id` and kills it immediately, and a revoked token is indistinguishable from one that never existed. |
 | `li_scheduled_post_preview` | `id` required UUID | Create a short-lived, single-use `https://signaldash.dev/p/<token>` browser handoff for one exact active SignalDash post. The isolated page includes its stored image attachments through account- and post-scoped protected media routes. |