@elitedcs/ghl-mcp 3.12.0 → 3.13.1

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 3.13.1 — Firebase token persistence fixes (reported by Don Harris)
+
+**Bug fixes. No tool changes — still 201 tools across 43 modules.**
+
+Two related Firebase refresh-token persistence bugs that hit the `npx @elitedcs/ghl-mcp@latest` install path. Both reported by Don Harris (flasheffect@sbcglobal.net) on 2026-05-24.
+
+### 1. Rotated refresh token was silently dropped
+
+`WorkflowBuilderClient.persistRefreshToken` only wrote to `cwd/.env`. Under npx there is no `.env` in cwd, so the rotated token was discarded and the next restart reloaded the stale token from `credentials.json` — eventually failing Firebase auth once the old token expired.
+
+Now persists to **`credentials.json`** (the authoritative store for npm installs) and still writes `.env` when present (legacy wrapper-script / local-dev path). Both writes are independent and non-fatal.
+
+### 2. Token registry lived inside the npm cache
+
+`TokenRegistry`'s default path resolved via `__dirname` into `~/.npm/_npx/<hash>/...`. Every `@latest` update produced a new hash, orphaning the previous registry (and losing it on cache cleanup).
+
+Now defaults to `.ghl-tokens.json` in the per-user app-data dir, alongside `credentials.json`. A one-time migration moves any legacy package-root registry on first run. The registry directory is created (0700) on save if absent, and the file is hardened to 0600.
+
+## 3.13.0 — Memberships read + 200-tool milestone (gap-closure round 6, final)
+
+**201 tools across 43 modules. Bundle: ~318 KB.**
+
+Closes the last Phase-2 gap. Memberships read tools — and the tool count crosses 200.
+
+### 3 new tools (Firebase-gated, read-only)
+
+- **`list_membership_offers`** — offers + products in one call (`{products, offers}`). Products are courses/communities; offers are the access grants.
+- **`list_membership_categories`** — all course categories in a location.
+- **`list_membership_lessons`** — all course lessons in a location.
+
+Most useful for fetching the IDs that membership trigger conditions reference: `offer_access_granted`, `product_completed`, `category_completed`, `lesson_completed`, etc.
+
+### Endpoint discovery
+
+From the workflow bundle's `LocationMembership` class:
+```js
+membershipUrl = `${config.membershipURL}`  // → backend.leadconnectorhq.com/membership
+endpoint = `${membershipUrl}/smart-list/offers-products/${locationId}`
+```
+
+Verified endpoints (Firebase auth):
+- `GET /membership/smart-list/offers-products/{loc}`
+- `GET /membership/smart-list/location/{loc}/workflow?type=category`
+- `GET /membership/smart-list/location/{loc}/workflow?type=lesson`
+
+Bearer/PIT returns 401 — Firebase-gated, same as the other internal-API tools.
+
+### Read-only by design
+
+The workflow bundle only READS membership data (to populate trigger/action dropdowns). Creating/editing courses, offers, and lessons lives in the Memberships app and isn't exposed here — that would need a DevTools capture against a live account with actual courses. The per-product (`?product_id=`) and per-category (`/category/{id}/lessons`) filtered endpoints returned 401 for synthetic IDs and couldn't be verified without real course data, so they're not exposed; the location-scoped "list all" endpoints return everything anyway.
+
+### Phase-2 complete
+
+All 6 Phase-2 gap areas from the v3.8.1 analysis have now been addressed:
+
+| Area | Result |
+|---|---|
+| Email templates | list/create/update (v3.10.0) |
+| SMS/snippet templates | list-only — write is scope-walled (v3.10.1) |
+| Smart Lists | full CRUD (v3.11.0) |
+| Reputation | review-link-list; reviews capture-pending (v3.11.1) |
+| Email campaigns | list (fixed) + create-draft; send capture-pending (v3.12.0) |
+| Memberships | read-only (this release) |
+
+The recurring limiter: high-value write actions (send a campaign, list reviews, create a course, delete a template) sit behind either GHL's IAM wall or location-resolution quirks that need a DevTools capture against a live account. Read + create-draft surfaces were reachable; full write automation for those areas is the next frontier when a live-account capture session happens.
+
+### Tool count impact
+
+- Total: 198 → 201 (+3) — crosses 200
+- Modules: 42 → 43
+
+### Files changed
+
+- `src/tools/memberships.ts` — NEW
+- `src/tools/index.ts` — registered membership tools
+- `src/setup-tool.ts` — count 198 → 201
+
 ## 3.12.0 — Email campaigns: create-draft + list fix (gap-closure round 5)
 
 **198 tools across 42 modules. Bundle: ~316 KB.**

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 198 tools across 42 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers.
+**Full GoHighLevel API access for Claude.** 201 tools across 43 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).