@elitedcs/ghl-mcp 3.53.0 → 3.53.2

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 3.53.2 — Fixes a serious 3.53.1 regression: upgrade immediately
+
+3.53.1 resolved the machine identity randomly when nothing was passed in, and
+that is exactly how attestation verification asks for it. Cached attestations
+failed to verify, the tool dropped to bootstrap, and each restart would have
+claimed another install slot until the member hit their cap.
+
+- No-argument identity resolution is deterministic again: stored `device_id`
+  first, then the fingerprint inside an existing attestation (so an upgrade
+  keeps the slot it already holds), then the legacy scheme as a last resort.
+- Two tests pin the determinism so this cannot ship again.
+
+If you ran 3.53.1, upgrade. If your install count looks inflated, write to
+support@ghlcommand.com and we will reset it.
+
+## 3.53.1 — Laptops stop eating install slots; "cancelled" stops lying
+
+Reported by Carlos Boyd, who hit his install cap with two physical machines.
+
+- **Device identity is stable now.** The fingerprint was derived from the
+  machine hostname, and a Mac's `.local` hostname changes with the network
+  (new Wi-Fi, DHCP, a name collision) — so the same laptop could present a new
+  identity and claim another install slot. Identity is now a random id
+  persisted in the config dir, so it survives reinstalls and renames. On
+  upgrade it ADOPTS the fingerprint from the existing cached attestation, so no
+  current install loses the slot it already holds. `legacyDeviceFingerprint()`
+  is kept for reference.
+- **Install-limit is no longer reported as "cancelled".** Both conditions come
+  back from the gate as 403, and the client labelled both `cancelled`, so a
+  full machine list read as a billing failure — two contradictory lines in the
+  same block. `install_limit` is its own reason, and the gate prints the
+  server's own sentence instead of a reason code beside it.
+
 ## 3.52.1 — Docs: positioning vs. HighLevel's official Anthropic MCP
 
 No behavior changes; README only.

package/dist/capture-helper.js

@@ -48,7 +48,11 @@ var CredentialsSchema = import_zod.z.object({
   // hand-crafted-credentials.json bypass that existed through v3.23.0).
   // Optional in the schema only so files written by earlier versions still
   // parse — index.ts's gate forces a re-validate when the field is missing.
-  signed_attestation: import_zod.z.string().optional()
+  signed_attestation: import_zod.z.string().optional(),
+  /** Stable machine id (2026-07-28). Replaces the hostname-derived
+   *  fingerprint, which changed with the network on laptops and silently ate
+   *  install slots. Written once and reused forever. */
+  device_id: import_zod.z.string().optional()
 });
 function appDataDir() {
   const override = process.env.GHL_MCP_CONFIG_DIR?.trim();

package/dist/index.js

@@ -41,6 +41,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/retry.ts
 function computeRetryDelay(retryAfterHeader, attempt, baseMs) {
@@ -214,6 +215,16 @@ ${errorBody}`
 });
 
 // src/credentials-store.ts
+var credentials_store_exports = {};
+__export(credentials_store_exports, {
+  appDataDir: () => appDataDir,
+  credentialsPath: () => credentialsPath,
+  ensureAppDataDir: () => ensureAppDataDir,
+  foldCredentialsIntoEnv: () => foldCredentialsIntoEnv,
+  readCredentials: () => readCredentials,
+  tokenRegistryPath: () => tokenRegistryPath,
+  writeCredentials: () => writeCredentials
+});
 function appDataDir() {
   const override = process.env.GHL_MCP_CONFIG_DIR?.trim();
   if (override) {
@@ -331,7 +342,11 @@ var init_credentials_store = __esm({
       // hand-crafted-credentials.json bypass that existed through v3.23.0).
       // Optional in the schema only so files written by earlier versions still
       // parse — index.ts's gate forces a re-validate when the field is missing.
-      signed_attestation: import_zod.z.string().optional()
+      signed_attestation: import_zod.z.string().optional(),
+      /** Stable machine id (2026-07-28). Replaces the hostname-derived
+       *  fingerprint, which changed with the network on laptops and silently ate
+       *  install slots. Written once and reused forever. */
+      device_id: import_zod.z.string().optional()
     });
   }
 });
@@ -962,10 +977,184 @@ var init_interactive_capture = __esm({
   }
 });
 
+// src/attestation.ts
+var attestation_exports = {};
+__export(attestation_exports, {
+  ATTESTATION_GRACE_DAYS: () => ATTESTATION_GRACE_DAYS,
+  ATTESTATION_TTL_DAYS: () => ATTESTATION_TTL_DAYS,
+  ATTESTATION_VERSION: () => ATTESTATION_VERSION,
+  deviceFingerprint: () => deviceFingerprint,
+  legacyDeviceFingerprint: () => legacyDeviceFingerprint,
+  parseAttestationPayload: () => parseAttestationPayload,
+  planFromPayload: () => planFromPayload,
+  shouldRenew: () => shouldRenew,
+  tierFromPayload: () => tierFromPayload,
+  verifyAttestation: () => verifyAttestation
+});
+function tierFromPayload(payload) {
+  return payload?.tier === "free" ? "free" : "full";
+}
+function planFromPayload(payload) {
+  return payload?.plan === "command-os" ? "command-os" : "mcp";
+}
+function legacyDeviceFingerprint() {
+  const os5 = require("node:os");
+  const crypto4 = require("node:crypto");
+  const raw = `${os5.hostname()}:${os5.userInfo().username}:${os5.platform()}:${os5.arch()}`;
+  return crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 16);
+}
+function deviceFingerprint(opts) {
+  if (opts?.stored) return opts.stored;
+  if (opts?.cached) {
+    opts.persist?.(opts.cached);
+    return opts.cached;
+  }
+  const crypto4 = require("node:crypto");
+  if (!opts) {
+    try {
+      const store = (init_credentials_store(), __toCommonJS(credentials_store_exports));
+      const creds = store.readCredentials();
+      if (creds?.device_id) return creds.device_id;
+      const adopted = creds?.signed_attestation ? parseAttestationPayload(creds.signed_attestation)?.device_fingerprint : void 0;
+      const id = adopted || crypto4.randomBytes(8).toString("hex");
+      if (creds) {
+        try {
+          store.writeCredentials({ ...creds, device_id: id });
+        } catch {
+        }
+      }
+      return id;
+    } catch {
+      return legacyDeviceFingerprint();
+    }
+  }
+  const fresh = crypto4.randomBytes(8).toString("hex");
+  opts.persist?.(fresh);
+  return fresh;
+}
+function base64urlDecode(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+async function getPublicKey() {
+  if (cachedPublicKey) return cachedPublicKey;
+  const raw = Buffer.from(ATTESTATION_PUBLIC_KEY_B64, "base64");
+  cachedPublicKey = await import_node_crypto.webcrypto.subtle.importKey(
+    "raw",
+    raw,
+    { name: "Ed25519" },
+    false,
+    ["verify"]
+  );
+  return cachedPublicKey;
+}
+function parseAttestationPayload(token) {
+  try {
+    const dot = token.indexOf(".");
+    if (dot <= 0 || dot === token.length - 1) return null;
+    const payloadJson = new TextDecoder().decode(base64urlDecode(token.slice(0, dot)));
+    const payload = JSON.parse(payloadJson);
+    if (typeof payload.v !== "number" || typeof payload.email !== "string" || typeof payload.license_key !== "string" || typeof payload.device_fingerprint !== "string" || typeof payload.installs_max !== "number" || typeof payload.issued_at !== "string" || typeof payload.expires_at !== "string") {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+async function verifyAttestation(token, bindings, now = /* @__PURE__ */ new Date()) {
+  if (typeof token !== "string" || !token) return { ok: false, reason: "malformed" };
+  const dot = token.indexOf(".");
+  if (dot <= 0 || dot === token.length - 1) return { ok: false, reason: "malformed" };
+  let payloadBytes;
+  let signatureBytes;
+  try {
+    payloadBytes = base64urlDecode(token.slice(0, dot));
+    signatureBytes = base64urlDecode(token.slice(dot + 1));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  let payload;
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(payloadBytes));
+    if (typeof parsed.v !== "number") return { ok: false, reason: "malformed" };
+    if (parsed.v !== ATTESTATION_VERSION) return { ok: false, reason: "unsupported-version" };
+    payload = parsed;
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  let signatureValid;
+  try {
+    const key = await getPublicKey();
+    signatureValid = await import_node_crypto.webcrypto.subtle.verify({ name: "Ed25519" }, key, signatureBytes, payloadBytes);
+  } catch {
+    return { ok: false, reason: "bad-signature" };
+  }
+  if (!signatureValid) return { ok: false, reason: "bad-signature" };
+  if (payload.email.toLowerCase() !== bindings.email.toLowerCase()) {
+    return { ok: false, reason: "wrong-email" };
+  }
+  if (payload.license_key !== bindings.license_key) {
+    return { ok: false, reason: "wrong-license" };
+  }
+  const fingerprint = bindings.expectedFingerprint ?? deviceFingerprint();
+  if (payload.device_fingerprint !== fingerprint) {
+    return { ok: false, reason: "wrong-device" };
+  }
+  const expiry = Date.parse(payload.expires_at);
+  if (!Number.isFinite(expiry)) return { ok: false, reason: "malformed" };
+  const graceDeadline = expiry + ATTESTATION_GRACE_DAYS * 24 * 60 * 60 * 1e3;
+  if (now.getTime() <= expiry) {
+    return { ok: true, payload, reason: "valid" };
+  }
+  if (now.getTime() <= graceDeadline) {
+    return { ok: true, payload, reason: "in-grace" };
+  }
+  return { ok: false, reason: "expired" };
+}
+function shouldRenew(payload, now = /* @__PURE__ */ new Date()) {
+  const expiry = Date.parse(payload.expires_at);
+  if (!Number.isFinite(expiry)) return true;
+  const remainingMs = expiry - now.getTime();
+  return remainingMs < 7 * 24 * 60 * 60 * 1e3;
+}
+var import_node_crypto, ATTESTATION_PUBLIC_KEY_B64, ATTESTATION_VERSION, ATTESTATION_TTL_DAYS, ATTESTATION_GRACE_DAYS, cachedPublicKey;
+var init_attestation = __esm({
+  "src/attestation.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    ATTESTATION_PUBLIC_KEY_B64 = "8KJo8V3Z7ngeToIQfOXpKdlr/EA34hXJVEIpW0A7wqs=";
+    ATTESTATION_VERSION = 1;
+    ATTESTATION_TTL_DAYS = 30;
+    ATTESTATION_GRACE_DAYS = 14;
+    cachedPublicKey = null;
+  }
+});
+
 // src/setup-tool.ts
-function deviceFingerprint() {
-  const raw = `${os2.hostname()}:${os2.userInfo().username}:${os2.platform()}:${os2.arch()}`;
-  return crypto2.createHash("sha256").update(raw).digest("hex").slice(0, 16);
+function deviceFingerprint2() {
+  try {
+    const store = (init_credentials_store(), __toCommonJS(credentials_store_exports));
+    const creds = store.readCredentials();
+    if (creds?.device_id) return creds.device_id;
+    let adopted;
+    if (creds?.signed_attestation) {
+      const att = (init_attestation(), __toCommonJS(attestation_exports));
+      adopted = att.parseAttestationPayload(creds.signed_attestation)?.device_fingerprint;
+    }
+    const id = adopted || crypto2.randomBytes(8).toString("hex");
+    if (creds) {
+      try {
+        store.writeCredentials({ ...creds, device_id: id });
+      } catch {
+      }
+    }
+    return id;
+  } catch {
+    const raw = `${os2.userInfo().username}:${os2.platform()}:${os2.arch()}`;
+    return crypto2.createHash("sha256").update(raw).digest("hex").slice(0, 16);
+  }
 }
 async function validateLicense(email, licenseKey) {
   let res;
@@ -976,7 +1165,7 @@ async function validateLicense(email, licenseKey) {
       body: JSON.stringify({
         email: email.trim(),
         license_key: licenseKey.trim(),
-        device_fingerprint: deviceFingerprint()
+        device_fingerprint: deviceFingerprint2()
       }),
       signal: AbortSignal.timeout(1e4)
     });
@@ -997,11 +1186,12 @@ async function validateLicense(email, licenseKey) {
     };
   }
   const errorText = String(data.error || data.message || "").toLowerCase();
-  const looksCancelled = res.status === 403 || errorText.includes("cancel") || errorText.includes("install limit");
+  const isInstallLimit = errorText.includes("install limit") || errorText.includes("installs");
+  const looksCancelled = !isInstallLimit && (res.status === 403 || errorText.includes("cancel"));
   return {
     ok: false,
     error: data.error || data.message || `License validation failed (HTTP ${res.status})`,
-    reason: looksCancelled ? "cancelled" : "unauthorized"
+    reason: isInstallLimit ? "install_limit" : looksCancelled ? "cancelled" : "unauthorized"
   };
 }
 async function validateGhl(apiKey2, locationId2) {
@@ -1907,118 +2097,12 @@ var init_question_set = __esm({
   }
 });
 
-// src/attestation.ts
-function tierFromPayload(payload) {
-  return payload?.tier === "free" ? "free" : "full";
-}
-function planFromPayload(payload) {
-  return payload?.plan === "command-os" ? "command-os" : "mcp";
-}
-function deviceFingerprint2() {
-  const os5 = require("node:os");
-  const crypto4 = require("node:crypto");
-  const raw = `${os5.hostname()}:${os5.userInfo().username}:${os5.platform()}:${os5.arch()}`;
-  return crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 16);
-}
-function base64urlDecode(s) {
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
-  return new Uint8Array(Buffer.from(padded, "base64"));
-}
-async function getPublicKey() {
-  if (cachedPublicKey) return cachedPublicKey;
-  const raw = Buffer.from(ATTESTATION_PUBLIC_KEY_B64, "base64");
-  cachedPublicKey = await import_node_crypto.webcrypto.subtle.importKey(
-    "raw",
-    raw,
-    { name: "Ed25519" },
-    false,
-    ["verify"]
-  );
-  return cachedPublicKey;
-}
-function parseAttestationPayload(token) {
-  try {
-    const dot = token.indexOf(".");
-    if (dot <= 0 || dot === token.length - 1) return null;
-    const payloadJson = new TextDecoder().decode(base64urlDecode(token.slice(0, dot)));
-    const payload = JSON.parse(payloadJson);
-    if (typeof payload.v !== "number" || typeof payload.email !== "string" || typeof payload.license_key !== "string" || typeof payload.device_fingerprint !== "string" || typeof payload.installs_max !== "number" || typeof payload.issued_at !== "string" || typeof payload.expires_at !== "string") {
-      return null;
-    }
-    return payload;
-  } catch {
-    return null;
-  }
-}
-async function verifyAttestation(token, bindings, now = /* @__PURE__ */ new Date()) {
-  if (typeof token !== "string" || !token) return { ok: false, reason: "malformed" };
-  const dot = token.indexOf(".");
-  if (dot <= 0 || dot === token.length - 1) return { ok: false, reason: "malformed" };
-  let payloadBytes;
-  let signatureBytes;
-  try {
-    payloadBytes = base64urlDecode(token.slice(0, dot));
-    signatureBytes = base64urlDecode(token.slice(dot + 1));
-  } catch {
-    return { ok: false, reason: "malformed" };
-  }
-  let payload;
-  try {
-    const parsed = JSON.parse(new TextDecoder().decode(payloadBytes));
-    if (typeof parsed.v !== "number") return { ok: false, reason: "malformed" };
-    if (parsed.v !== ATTESTATION_VERSION) return { ok: false, reason: "unsupported-version" };
-    payload = parsed;
-  } catch {
-    return { ok: false, reason: "malformed" };
-  }
-  let signatureValid;
-  try {
-    const key = await getPublicKey();
-    signatureValid = await import_node_crypto.webcrypto.subtle.verify({ name: "Ed25519" }, key, signatureBytes, payloadBytes);
-  } catch {
-    return { ok: false, reason: "bad-signature" };
-  }
-  if (!signatureValid) return { ok: false, reason: "bad-signature" };
-  if (payload.email.toLowerCase() !== bindings.email.toLowerCase()) {
-    return { ok: false, reason: "wrong-email" };
-  }
-  if (payload.license_key !== bindings.license_key) {
-    return { ok: false, reason: "wrong-license" };
-  }
-  const fingerprint = bindings.expectedFingerprint ?? deviceFingerprint2();
-  if (payload.device_fingerprint !== fingerprint) {
-    return { ok: false, reason: "wrong-device" };
-  }
-  const expiry = Date.parse(payload.expires_at);
-  if (!Number.isFinite(expiry)) return { ok: false, reason: "malformed" };
-  const graceDeadline = expiry + ATTESTATION_GRACE_DAYS * 24 * 60 * 60 * 1e3;
-  if (now.getTime() <= expiry) {
-    return { ok: true, payload, reason: "valid" };
-  }
-  if (now.getTime() <= graceDeadline) {
-    return { ok: true, payload, reason: "in-grace" };
-  }
-  return { ok: false, reason: "expired" };
-}
-var import_node_crypto, ATTESTATION_PUBLIC_KEY_B64, ATTESTATION_VERSION, ATTESTATION_GRACE_DAYS, cachedPublicKey;
-var init_attestation = __esm({
-  "src/attestation.ts"() {
-    "use strict";
-    import_node_crypto = require("node:crypto");
-    ATTESTATION_PUBLIC_KEY_B64 = "8KJo8V3Z7ngeToIQfOXpKdlr/EA34hXJVEIpW0A7wqs=";
-    ATTESTATION_VERSION = 1;
-    ATTESTATION_GRACE_DAYS = 14;
-    cachedPublicKey = null;
-  }
-});
-
 // package.json
 var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.53.0",
+      version: "3.53.2",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 232 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -16986,10 +17070,11 @@ async function renewAttestation(creds) {
     }
     return "renewed";
   }
-  if (lic.reason === "cancelled" || lic.reason === "unauthorized") {
+  if (lic.reason === "cancelled" || lic.reason === "unauthorized" || lic.reason === "install_limit") {
     try {
       writeCredentials({ ...creds, signed_attestation: void 0 });
-      process.stderr.write(`[ghl-mcp] Server rejected license (${lic.reason}). Dropping to bootstrap mode.
+      process.stderr.write(lic.reason === "install_limit" ? `[ghl-mcp] ${lic.error}
+` : `[ghl-mcp] ${lic.error} Dropping to bootstrap mode.
 `);
     } catch {
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.53.0",
+  "version": "3.53.2",
   "mcpName": "io.github.drjerryrelth/ghl-command",
-  "description": "GoHighLevel MCP Server for Claude. 232 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+  "description": "GoHighLevel MCP Server for Claude. 232 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",
   "bin": {
     "ghl-mcp": "dist/index.js"