@elitedcs/ghl-mcp 3.83.5 → 3.83.7

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 ## Unreleased
 
+## 3.83.7 — the cockpit answers only to its own address, and keeps its key to itself
+
+**Security fix. Update to this version.**
+
+The cockpit runs on your own computer and only accepts connections from it. Two
+things it should have refused, it did not:
+
+- **A design run's details were readable without the cockpit's key.** Anything
+  able to reach the cockpit on your computer could list the Design Studio runs it
+  had started: the brand, headline, points and audience you typed, the run's log,
+  and the folder it saved to, which includes your computer's user name.
+- **The cockpit handed its key to a request that used a different address for
+  it.** A web page that tricks your browser into reaching the cockpit under
+  another name could have picked up that key, and with it read what the cockpit
+  reads for your clients: intake answers, uploaded intake documents, what each
+  account already has set up, and your snapshot list. Nothing could be changed
+  that way; every change the cockpit makes kept refusing such requests. No
+  GoHighLevel key was exposed by either path.
+
+Now the cockpit refuses any request that is not addressed to `localhost` or
+`127.0.0.1` on its own port, before it does anything else. It gives its key only
+to its own pages opened on your computer, never to anything else. Design Studio's
+run list and progress need the key, like the cockpit's other private reads. And a
+request that spells a page's address in an unusual way is refused rather than
+guessed at.
+
+Nothing changes in how you open it: the address the cockpit opens for you is one of
+the two it accepts.
+
+## 3.83.6 — what a design run actually costs you, measured
+
+3.83.5 gave a running job a clock. This gives it an honest number on it.
+
+How long a run takes was written by hand in three places and every one was wrong.
+The brand page said a deck takes "roughly ten minutes". The run API said "twenty
+minutes or more". The clock added in 3.83.5 said "ten to twenty". Nobody had ever
+timed one.
+
+Two runs have now been measured. A six-slide deck took 12 minutes 39 seconds and
+$1.74 for a single pass. A conversion page on a real brand took 26 minutes and
+$3.75 across three. So a pass is 9 to 13 minutes and $1.25 to $1.75, and a run may
+use three of them.
+
+That sentence now lives in one file and every screen reads it, so the three cannot
+drift apart again.
+
+**The cost is now stated before you press the button, not discovered afterwards.**
+These runs use your own Claude, never ours. On a Max plan that is usage rather than
+a bill, which is exactly why the figure belongs on the screen: on pay as you go it
+is real money, and you should know roughly what a button costs before you press it.
+
 ## 3.83.5 — the brand page's buttons work, and a run tells you it is working
 
 If you use Design Studio, every button on a brand's own page has been dead since

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.5
+**Version:** 3.83.7
 
 ---
 

package/dist/index.js

@@ -27187,6 +27187,20 @@ var init_run_jobs = __esm({
   }
 });
 
+// src/command-os/design/run-expectations.ts
+var RUN_MAX_PASSES, RUN_PASS_MINUTES, RUN_PASS_COST, RUN_TOTAL_MINUTES, RUN_TOTAL_COST, RUN_EXPECTATION;
+var init_run_expectations = __esm({
+  "src/command-os/design/run-expectations.ts"() {
+    "use strict";
+    RUN_MAX_PASSES = 3;
+    RUN_PASS_MINUTES = "9 to 13 minutes";
+    RUN_PASS_COST = "$1.25 to $1.75";
+    RUN_TOTAL_MINUTES = "25 to 40 minutes";
+    RUN_TOTAL_COST = "about $5";
+    RUN_EXPECTATION = `Each pass takes ${RUN_PASS_MINUTES} and costs ${RUN_PASS_COST} of your own Claude usage, and a run may take up to ${RUN_MAX_PASSES} passes. Allow ${RUN_TOTAL_MINUTES} and up to ${RUN_TOTAL_COST}.`;
+  }
+});
+
 // src/run-cost.ts
 function runCostPath() {
   return path18.join(appDataDir(), "command-os-run-cost.jsonl");
@@ -28591,7 +28605,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.5",
+      version: "3.83.7",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -32369,7 +32383,7 @@ ${d.voice.samples.length ? `<h2>Voice</h2><ul>${d.voice.samples.map((s) => `<li>
 </div>
 ${opts.screenshot ? `<h2>Their site, as rendered</h2><img class="shot" src="/brand/${encodeURIComponent(d.slug)}/screenshot.png" alt="Screenshot of ${esc5(d.name)}'s website">` : ""}
 <h2>Make something in this brand</h2>
-<p class="small">Runs on <b>your own Claude</b>, on this computer \u2014 never our key. A deck takes roughly ten minutes, a page twenty or more; the run keeps going if you close this tab. Write the headline and the points you want made, not instructions.</p>
+<p class="small">Runs on <b>your own Claude</b>, on this computer, never our key. ${esc5(RUN_EXPECTATION)} The run keeps going if you close this tab. Write the headline and the points you want made, not instructions.</p>
 <form id="make"><div class="two">
 <div><label for="mk-medium">What</label><select id="mk-medium"><option value="deck">A deck</option><option value="site">A landing page</option><option value="report">A report</option></select></div>
 <div><label for="mk-slides">Slides (a deck only)</label><input id="mk-slides" type="number" min="1" max="40" value="6"></div>
@@ -32398,6 +32412,7 @@ ${opts.dir ? `<p class="small">Stored at ${esc5(opts.dir)}</p>` : ""}
 ${foot(SHELL_JS(opts.seatToken ?? "") + `
 (function(){
 var poll=null,runId=null,started=0,ticker=null,passes=0;
+var EXPECT=${scriptJson(RUN_EXPECTATION)};
 function stopPolling(){if(poll){clearInterval(poll);poll=null}if(ticker){clearInterval(ticker);ticker=null}}
 function elapsed(ms){var s=Math.floor(ms/1000),m=Math.floor(s/60);s=s%60;return m?(m+"m "+(s<10?"0":"")+s+"s"):(s+"s")}
 /* The run prints NOTHING while Claude writes - it answers in one go, so the log
@@ -32407,7 +32422,7 @@ function elapsed(ms){var s=Math.floor(ms/1000),m=Math.floor(s/60);s=s%60;return
    from the child process, and it ticks every second, not every poll. */
 function tick(){
   if(!started)return;
-  say("mk-status","Working on your Claude: "+elapsed(Date.now()-started)+" so far"+(passes?(", on pass "+(passes+1)):"")+". Claude writes the whole file in one answer, so nothing appears below until a pass finishes. Ten to twenty minutes is normal. Closing this tab does not stop it.");
+  say("mk-status","Working on your Claude: "+elapsed(Date.now()-started)+" so far"+(passes?(", on pass "+(passes+1)):"")+". Claude writes the whole file in one answer, so nothing appears below until a pass finishes. "+EXPECT+" Closing this tab does not stop it.");
 }
 function show(t){var el=document.getElementById("mk-log");el.hidden=false;el.textContent=t}
 document.getElementById("make").addEventListener("submit",async function(e){
@@ -32427,7 +32442,7 @@ document.getElementById("make").addEventListener("submit",async function(e){
     document.getElementById("mk-cancel").hidden=false;
     started=Date.now();passes=0;tick();ticker=setInterval(tick,1000);
     poll=setInterval(async function(){
-      var s=await (await fetch("/api/design/run?id="+encodeURIComponent(runId))).json();
+      var s=await (await fetch("/api/design/run?id="+encodeURIComponent(runId),{headers:{"x-command-os-seat":KEY}})).json();
       var lines=s.tail||[];
       show(lines.join("\\n"));
       passes=lines.filter(function(l){return l.trim().slice(0,5)==="pass "}).length;
@@ -32453,6 +32468,7 @@ var esc5, STYLE, SHELL_JS, foot;
 var init_brand_page = __esm({
   "src/command-os/design/brand-page.ts"() {
     "use strict";
+    init_run_expectations();
     init_fonts();
     init_cockpit_shell();
     init_script_json();
@@ -33969,9 +33985,11 @@ __export(dashboard_exports, {
   insideDir: () => insideDir,
   intakeInput: () => intakeInput,
   intakeRequestError: () => intakeRequestError,
+  isAllowedCockpitHost: () => isAllowedCockpitHost,
   isLoopback: () => isLoopback,
   launcherAlreadyOffered: () => launcherAlreadyOffered,
   listClientDocs: () => listClientDocs,
+  mayServeSeat: () => mayServeSeat,
   memberFacingError: () => memberFacingError,
   newClientFailure: () => newClientFailure,
   normalizedIntake: () => normalizedIntake,
@@ -35736,22 +35754,45 @@ function checkSeatToken(req, expected) {
   }
   return null;
 }
-function checkMutationGuard(req, port) {
-  const method = (req.method || "GET").toUpperCase();
-  if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
-  const header = (name) => {
-    const v = req.headers[name];
-    return (Array.isArray(v) ? v[0] : v ?? "").trim();
-  };
-  const allowedHosts = [`127.0.0.1:${port}`, `localhost:${port}`];
-  if (!allowedHosts.includes(header("host").toLowerCase())) {
-    return { status: 403, error: "host not allowed" };
+function cockpitHeader(req, name) {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value.join(",") : value ?? "";
+}
+function isAllowedCockpitHost(req, port) {
+  const host = cockpitHeader(req, "host").toLowerCase();
+  return host === `127.0.0.1:${port}` || host === `localhost:${port}`;
+}
+function mayServeSeat(req, port) {
+  return isLoopback(req) && isAllowedCockpitHost(req, port);
+}
+function cockpitPath(req) {
+  return (req.url || "/").split("?")[0];
+}
+function checkCockpitPath(req) {
+  const pathname = cockpitPath(req);
+  if (!pathname.startsWith("/") || /\/\/|\\|#|[\x00-\x20\x7f]|%(?:2e|2f|5c)|%(?![0-9a-f]{2})/i.test(pathname) || pathname.split("/").some((segment) => segment === "." || segment === "..")) {
+    return { status: 400, error: "Use a canonical cockpit path." };
   }
-  const origin = header("origin").toLowerCase();
-  if (origin && !allowedHosts.some((h) => origin === `http://${h}`)) {
+  return null;
+}
+function checkCockpitOrigin(req, port) {
+  const origin = cockpitHeader(req, "origin").toLowerCase();
+  if (req.headers.origin !== void 0 && origin !== `http://127.0.0.1:${port}` && origin !== `http://localhost:${port}`) {
     return { status: 403, error: "cross-origin request rejected" };
   }
-  if (header("content-type").split(";")[0].trim().toLowerCase() !== "application/json") {
+  return null;
+}
+function checkMutationGuard(req, port) {
+  if (!isAllowedCockpitHost(req, port)) {
+    return { status: 403, error: "This Host is not allowed to access the cockpit." };
+  }
+  const pathDenied = checkCockpitPath(req);
+  if (pathDenied) return pathDenied;
+  const method = (req.method || "GET").toUpperCase();
+  if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
+  const originDenied = checkCockpitOrigin(req, port);
+  if (originDenied) return originDenied;
+  if (cockpitHeader(req, "content-type").split(";")[0].trim().toLowerCase() !== "application/json") {
     return { status: 415, error: "expected application/json" };
   }
   return null;
@@ -35759,8 +35800,13 @@ function checkMutationGuard(req, port) {
 function cockpitGate(req, seatToken, port) {
   const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
   if (denied) return denied;
-  const pathname = (req.url ?? "/").split("?")[0];
-  if (SEAT_GUARDED_READS.includes(pathname)) return checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  const pathname = cockpitPath(req);
+  if (SEAT_GUARDED_READS.includes(pathname) || pathname === "/api/design" || pathname.startsWith("/api/design/")) {
+    if (cockpitHeader(req, "sec-fetch-site").toLowerCase() === "cross-site") {
+      return { status: 403, error: "cross-site request rejected" };
+    }
+    return checkCockpitOrigin(req, port) ?? checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  }
   return null;
 }
 function guarded(seatToken, port, routes) {
@@ -35885,7 +35931,7 @@ async function runDashboard(argv) {
     questions: (id) => composeQuestionSet({ industry: readCockpitState().accounts?.[id]?.industry, agency: readOverlay() })
   };
   const server2 = http.createServer(guarded(seatToken, port, (req, res) => {
-    const url = req.url || "/";
+    const url = cockpitPath(req);
     if (req.method === "POST" && url === "/api/client-assessment") {
       readBody(req, res, 2e4, async (body) => {
         try {
@@ -35907,10 +35953,10 @@ async function runDashboard(argv) {
         return;
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", "for", cap));
+      res.end(html(currentRoster(), mayServeSeat(req, port) ? seatToken : "", "for", cap));
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/capability")) {
+    if (req.method === "GET" && url === "/api/capability") {
       const u = new URL(req.url ?? "/", "http://127.0.0.1");
       const cap = capabilityByKey(u.searchParams.get("key") ?? "");
       const locationId2 = u.searchParams.get("locationId") ?? "";
@@ -36045,7 +36091,7 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/intake-documents")) {
+    if (req.method === "GET" && url === "/api/intake-documents") {
       const u = new URL(req.url ?? "/", "http://127.0.0.1");
       const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
       if (seat) {
@@ -36093,7 +36139,7 @@ async function runDashboard(argv) {
     const boardScreen = BOARD_ROUTES[url];
     if (req.method === "GET" && boardScreen) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", boardScreen));
+      res.end(html(currentRoster(), mayServeSeat(req, port) ? seatToken : "", boardScreen));
       return;
     }
     if ((req.method === "GET" || req.method === "HEAD") && (url === "/assessment" || url === "/assessment.html")) {
@@ -36105,7 +36151,7 @@ async function runDashboard(argv) {
         "X-Robots-Tag": "noindex, nofollow"
       });
       const roster2 = currentRoster().map((r) => ({ locationId: r.locationId, name: r.name }));
-      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(isLoopback(req) ? seatToken : "")};</script>`;
+      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(mayServeSeat(req, port) ? seatToken : "")};</script>`;
       res.end(req.method === "HEAD" ? void 0 : withCockpitShell(ASSESSMENT_HTML, "assessment", assessmentAgencyTag() + clientsTag));
       return;
     }
@@ -36148,14 +36194,14 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/client-preflight?")) {
+    if (req.method === "GET" && url === "/api/client-preflight") {
       const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
       if (seat) {
         res.writeHead(seat.status);
         res.end(JSON.stringify({ ok: false, error: seat.error }));
         return;
       }
-      const id = new URL(url, "http://x").searchParams.get("locationId") || "";
+      const id = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       if (!readableAccount(id)) {
         res.writeHead(400);
         res.end(JSON.stringify({ ok: false, error: "Choose a registered client." }));
@@ -36311,8 +36357,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/intake")) {
-      const industry = new URL(url, "http://x").searchParams.get("industry") || void 0;
+    if (req.method === "GET" && url === "/api/intake") {
+      const industry = new URL(req.url || "/", "http://x").searchParams.get("industry") || void 0;
       const agency = readOverlay();
       const composed = composeQuestionSet({ industry, agency });
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -36341,10 +36387,10 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/client-intake")) {
+    if (req.method === "GET" && url === "/api/client-intake") {
       (async () => {
         try {
-          const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+          const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
           const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
           if (seat) {
             res.writeHead(seat.status, { "Content-Type": "application/json" });
@@ -36368,7 +36414,7 @@ async function runDashboard(argv) {
           res.end(JSON.stringify({ ok: true, ...snap, questions, industry, inputHash: hash, unansweredRequired: questions.filter((q2) => q2.required && !String(answers[q2.label] ?? answers[q2.key] ?? "").trim()).map((q2) => q2.label), costs: readRunCosts().filter((r) => r.locationId === locationId2 && (r.kind === "intake extraction" || r.kind === "engine-check")).slice(-10), submittedAnswers: snap.answers ?? {}, answers, savedAt: st.intakeDrafts?.[locationId2]?.savedAt, connectionPending: !c }));
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
-          logQuietly(`client-intake ${new URL(url, "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
+          logQuietly(`client-intake ${new URL(req.url || "/", "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
           res.end(JSON.stringify({ ok: false, error: intakeRequestError(e) }));
         }
       })();
@@ -36492,12 +36538,12 @@ async function runDashboard(argv) {
         if (!rows.some((r) => r.locationId === locationId2)) rows.push({ locationId: locationId2, name: e.clientName || "(no account connected)", engagement: e });
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(agencyProfilePageHtml(readAgencyProfile(), rows, isLoopback(req) ? seatToken : ""));
+      res.end(agencyProfilePageHtml(readAgencyProfile(), rows, mayServeSeat(req, port) ? seatToken : ""));
       return;
     }
     if (req.method === "GET" && url === "/brands") {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-      res.end(brandsPageHtml(listBrands(), houseLooks(), listReferenceLooks(), isLoopback(req) ? seatToken : ""));
+      res.end(brandsPageHtml(listBrands(), houseLooks(), listReferenceLooks(), mayServeSeat(req, port) ? seatToken : ""));
       return;
     }
     if (req.method === "GET" && /^\/brand\/[a-z0-9-]+\/screenshot\.png$/.test(url)) {
@@ -36518,7 +36564,7 @@ async function runDashboard(argv) {
         const dna = houseLooks().find((d) => d.slug === slug3) ?? readBrand(slug3);
         const dir = brandExists(slug3) ? brandDir(slug3) : void 0;
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-        res.end(brandCardHtml(dna, { screenshot: dir ? fs27.existsSync(path26.join(dir, "screenshot.png")) : false, dir, seatToken: isLoopback(req) ? seatToken : "" }));
+        res.end(brandCardHtml(dna, { screenshot: dir ? fs27.existsSync(path26.join(dir, "screenshot.png")) : false, dir, seatToken: mayServeSeat(req, port) ? seatToken : "" }));
       } catch (e) {
         res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
         res.end(e.message);
@@ -36536,7 +36582,7 @@ async function runDashboard(argv) {
           }
           const job = startDesignRun(checked.value);
           res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: true, id: job.id, outDir: job.outDir, note: "Started on your own Claude. This takes twenty minutes or more; poll /api/design/run?id= for progress." }));
+          res.end(JSON.stringify({ ok: true, id: job.id, outDir: job.outDir, note: `Started on your own Claude. ${RUN_EXPECTATION} Poll /api/design/run?id= for progress.` }));
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: false, error: e.message }));
@@ -36544,8 +36590,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/design/run")) {
-      const id = new URL(url, "http://x").searchParams.get("id");
+    if (req.method === "GET" && url === "/api/design/run") {
+      const id = new URL(req.url || "/", "http://x").searchParams.get("id");
       const payload = id ? designRunStatus(id) : { runs: listDesignRuns() };
       res.writeHead(payload ? 200 : 404, { "Content-Type": "application/json", "Cache-Control": "no-store" });
       res.end(JSON.stringify(payload ?? { ok: false, error: "no such run" }));
@@ -36671,8 +36717,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/handoff?")) {
-      const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+    if (req.method === "GET" && url === "/handoff") {
+      const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       if (!readableAccount(locationId2)) {
         res.writeHead(400);
         res.end("Choose a registered client.");
@@ -36775,8 +36821,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/blueprint")) {
-      const q2 = new URL(url, "http://x").searchParams;
+    if (req.method === "GET" && url === "/blueprint") {
+      const q2 = new URL(req.url || "/", "http://x").searchParams;
       const locationId2 = q2.get("locationId") || "";
       const st = readCockpitState();
       const review = st.reviews?.[locationId2];
@@ -36790,8 +36836,8 @@ async function runDashboard(argv) {
       res.end(reviewDocumentHtml(review, { assessment: st.assessmentAttachments?.[locationId2], purchasedFeatureIds: st.assessmentPurchases?.[locationId2], planLines: readSavedPlan(locationId2) ? executablePlanLines(readSavedPlan(locationId2)) : [], clientName: name, agencyName: q2.get("agency") || st.agencyName, accent: q2.get("accent") || st.agencyAccent }));
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/review")) {
-      const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+    if (req.method === "GET" && url === "/api/review") {
+      const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(readCockpitState().reviews?.[locationId2] ?? { ok: false, error: "not generated yet" }));
       return;
@@ -37294,6 +37340,7 @@ var init_dashboard = __esm({
     init_claude_cli();
     init_token_registry();
     init_run_jobs();
+    init_run_expectations();
     init_stage_runner();
     init_account_rules();
     init_claude_call();
@@ -37382,7 +37429,7 @@ var init_dashboard = __esm({
     anthropicKeyWrites = Promise.resolve();
     SEAT_TOKEN_HEADER = "x-command-os-seat";
     NOT_SIGNED_IN_MSG = "This browser isn't signed in to Command OS on this computer. Open Command OS on the machine it runs on, and use the page it opens for you.";
-    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots"];
+    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots", "/api/agency-connection", "/api/client-preflight"];
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.5",
+  "version": "3.83.7",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",