@elitedcs/ghl-mcp 3.83.6 → 3.83.7

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## Unreleased
 
+## 3.83.7 — the cockpit answers only to its own address, and keeps its key to itself
+
+**Security fix. Update to this version.**
+
+The cockpit runs on your own computer and only accepts connections from it. Two
+things it should have refused, it did not:
+
+- **A design run's details were readable without the cockpit's key.** Anything
+  able to reach the cockpit on your computer could list the Design Studio runs it
+  had started: the brand, headline, points and audience you typed, the run's log,
+  and the folder it saved to, which includes your computer's user name.
+- **The cockpit handed its key to a request that used a different address for
+  it.** A web page that tricks your browser into reaching the cockpit under
+  another name could have picked up that key, and with it read what the cockpit
+  reads for your clients: intake answers, uploaded intake documents, what each
+  account already has set up, and your snapshot list. Nothing could be changed
+  that way; every change the cockpit makes kept refusing such requests. No
+  GoHighLevel key was exposed by either path.
+
+Now the cockpit refuses any request that is not addressed to `localhost` or
+`127.0.0.1` on its own port, before it does anything else. It gives its key only
+to its own pages opened on your computer, never to anything else. Design Studio's
+run list and progress need the key, like the cockpit's other private reads. And a
+request that spells a page's address in an unusual way is refused rather than
+guessed at.
+
+Nothing changes in how you open it: the address the cockpit opens for you is one of
+the two it accepts.
+
 ## 3.83.6 — what a design run actually costs you, measured
 
 3.83.5 gave a running job a clock. This gives it an honest number on it.

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.6
+**Version:** 3.83.7
 
 ---
 

package/dist/index.js

@@ -28605,7 +28605,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.6",
+      version: "3.83.7",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -32442,7 +32442,7 @@ document.getElementById("make").addEventListener("submit",async function(e){
     document.getElementById("mk-cancel").hidden=false;
     started=Date.now();passes=0;tick();ticker=setInterval(tick,1000);
     poll=setInterval(async function(){
-      var s=await (await fetch("/api/design/run?id="+encodeURIComponent(runId))).json();
+      var s=await (await fetch("/api/design/run?id="+encodeURIComponent(runId),{headers:{"x-command-os-seat":KEY}})).json();
       var lines=s.tail||[];
       show(lines.join("\\n"));
       passes=lines.filter(function(l){return l.trim().slice(0,5)==="pass "}).length;
@@ -33985,9 +33985,11 @@ __export(dashboard_exports, {
   insideDir: () => insideDir,
   intakeInput: () => intakeInput,
   intakeRequestError: () => intakeRequestError,
+  isAllowedCockpitHost: () => isAllowedCockpitHost,
   isLoopback: () => isLoopback,
   launcherAlreadyOffered: () => launcherAlreadyOffered,
   listClientDocs: () => listClientDocs,
+  mayServeSeat: () => mayServeSeat,
   memberFacingError: () => memberFacingError,
   newClientFailure: () => newClientFailure,
   normalizedIntake: () => normalizedIntake,
@@ -35752,22 +35754,45 @@ function checkSeatToken(req, expected) {
   }
   return null;
 }
-function checkMutationGuard(req, port) {
-  const method = (req.method || "GET").toUpperCase();
-  if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
-  const header = (name) => {
-    const v = req.headers[name];
-    return (Array.isArray(v) ? v[0] : v ?? "").trim();
-  };
-  const allowedHosts = [`127.0.0.1:${port}`, `localhost:${port}`];
-  if (!allowedHosts.includes(header("host").toLowerCase())) {
-    return { status: 403, error: "host not allowed" };
+function cockpitHeader(req, name) {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value.join(",") : value ?? "";
+}
+function isAllowedCockpitHost(req, port) {
+  const host = cockpitHeader(req, "host").toLowerCase();
+  return host === `127.0.0.1:${port}` || host === `localhost:${port}`;
+}
+function mayServeSeat(req, port) {
+  return isLoopback(req) && isAllowedCockpitHost(req, port);
+}
+function cockpitPath(req) {
+  return (req.url || "/").split("?")[0];
+}
+function checkCockpitPath(req) {
+  const pathname = cockpitPath(req);
+  if (!pathname.startsWith("/") || /\/\/|\\|#|[\x00-\x20\x7f]|%(?:2e|2f|5c)|%(?![0-9a-f]{2})/i.test(pathname) || pathname.split("/").some((segment) => segment === "." || segment === "..")) {
+    return { status: 400, error: "Use a canonical cockpit path." };
   }
-  const origin = header("origin").toLowerCase();
-  if (origin && !allowedHosts.some((h) => origin === `http://${h}`)) {
+  return null;
+}
+function checkCockpitOrigin(req, port) {
+  const origin = cockpitHeader(req, "origin").toLowerCase();
+  if (req.headers.origin !== void 0 && origin !== `http://127.0.0.1:${port}` && origin !== `http://localhost:${port}`) {
     return { status: 403, error: "cross-origin request rejected" };
   }
-  if (header("content-type").split(";")[0].trim().toLowerCase() !== "application/json") {
+  return null;
+}
+function checkMutationGuard(req, port) {
+  if (!isAllowedCockpitHost(req, port)) {
+    return { status: 403, error: "This Host is not allowed to access the cockpit." };
+  }
+  const pathDenied = checkCockpitPath(req);
+  if (pathDenied) return pathDenied;
+  const method = (req.method || "GET").toUpperCase();
+  if (method === "GET" || method === "HEAD" || method === "OPTIONS") return null;
+  const originDenied = checkCockpitOrigin(req, port);
+  if (originDenied) return originDenied;
+  if (cockpitHeader(req, "content-type").split(";")[0].trim().toLowerCase() !== "application/json") {
     return { status: 415, error: "expected application/json" };
   }
   return null;
@@ -35775,8 +35800,13 @@ function checkMutationGuard(req, port) {
 function cockpitGate(req, seatToken, port) {
   const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
   if (denied) return denied;
-  const pathname = (req.url ?? "/").split("?")[0];
-  if (SEAT_GUARDED_READS.includes(pathname)) return checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  const pathname = cockpitPath(req);
+  if (SEAT_GUARDED_READS.includes(pathname) || pathname === "/api/design" || pathname.startsWith("/api/design/")) {
+    if (cockpitHeader(req, "sec-fetch-site").toLowerCase() === "cross-site") {
+      return { status: 403, error: "cross-site request rejected" };
+    }
+    return checkCockpitOrigin(req, port) ?? checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  }
   return null;
 }
 function guarded(seatToken, port, routes) {
@@ -35901,7 +35931,7 @@ async function runDashboard(argv) {
     questions: (id) => composeQuestionSet({ industry: readCockpitState().accounts?.[id]?.industry, agency: readOverlay() })
   };
   const server2 = http.createServer(guarded(seatToken, port, (req, res) => {
-    const url = req.url || "/";
+    const url = cockpitPath(req);
     if (req.method === "POST" && url === "/api/client-assessment") {
       readBody(req, res, 2e4, async (body) => {
         try {
@@ -35923,10 +35953,10 @@ async function runDashboard(argv) {
         return;
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", "for", cap));
+      res.end(html(currentRoster(), mayServeSeat(req, port) ? seatToken : "", "for", cap));
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/capability")) {
+    if (req.method === "GET" && url === "/api/capability") {
       const u = new URL(req.url ?? "/", "http://127.0.0.1");
       const cap = capabilityByKey(u.searchParams.get("key") ?? "");
       const locationId2 = u.searchParams.get("locationId") ?? "";
@@ -36061,7 +36091,7 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/intake-documents")) {
+    if (req.method === "GET" && url === "/api/intake-documents") {
       const u = new URL(req.url ?? "/", "http://127.0.0.1");
       const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
       if (seat) {
@@ -36109,7 +36139,7 @@ async function runDashboard(argv) {
     const boardScreen = BOARD_ROUTES[url];
     if (req.method === "GET" && boardScreen) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", boardScreen));
+      res.end(html(currentRoster(), mayServeSeat(req, port) ? seatToken : "", boardScreen));
       return;
     }
     if ((req.method === "GET" || req.method === "HEAD") && (url === "/assessment" || url === "/assessment.html")) {
@@ -36121,7 +36151,7 @@ async function runDashboard(argv) {
         "X-Robots-Tag": "noindex, nofollow"
       });
       const roster2 = currentRoster().map((r) => ({ locationId: r.locationId, name: r.name }));
-      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(isLoopback(req) ? seatToken : "")};</script>`;
+      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(mayServeSeat(req, port) ? seatToken : "")};</script>`;
       res.end(req.method === "HEAD" ? void 0 : withCockpitShell(ASSESSMENT_HTML, "assessment", assessmentAgencyTag() + clientsTag));
       return;
     }
@@ -36164,14 +36194,14 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/client-preflight?")) {
+    if (req.method === "GET" && url === "/api/client-preflight") {
       const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
       if (seat) {
         res.writeHead(seat.status);
         res.end(JSON.stringify({ ok: false, error: seat.error }));
         return;
       }
-      const id = new URL(url, "http://x").searchParams.get("locationId") || "";
+      const id = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       if (!readableAccount(id)) {
         res.writeHead(400);
         res.end(JSON.stringify({ ok: false, error: "Choose a registered client." }));
@@ -36327,8 +36357,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/intake")) {
-      const industry = new URL(url, "http://x").searchParams.get("industry") || void 0;
+    if (req.method === "GET" && url === "/api/intake") {
+      const industry = new URL(req.url || "/", "http://x").searchParams.get("industry") || void 0;
       const agency = readOverlay();
       const composed = composeQuestionSet({ industry, agency });
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -36357,10 +36387,10 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/client-intake")) {
+    if (req.method === "GET" && url === "/api/client-intake") {
       (async () => {
         try {
-          const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+          const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
           const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
           if (seat) {
             res.writeHead(seat.status, { "Content-Type": "application/json" });
@@ -36384,7 +36414,7 @@ async function runDashboard(argv) {
           res.end(JSON.stringify({ ok: true, ...snap, questions, industry, inputHash: hash, unansweredRequired: questions.filter((q2) => q2.required && !String(answers[q2.label] ?? answers[q2.key] ?? "").trim()).map((q2) => q2.label), costs: readRunCosts().filter((r) => r.locationId === locationId2 && (r.kind === "intake extraction" || r.kind === "engine-check")).slice(-10), submittedAnswers: snap.answers ?? {}, answers, savedAt: st.intakeDrafts?.[locationId2]?.savedAt, connectionPending: !c }));
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
-          logQuietly(`client-intake ${new URL(url, "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
+          logQuietly(`client-intake ${new URL(req.url || "/", "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
           res.end(JSON.stringify({ ok: false, error: intakeRequestError(e) }));
         }
       })();
@@ -36508,12 +36538,12 @@ async function runDashboard(argv) {
         if (!rows.some((r) => r.locationId === locationId2)) rows.push({ locationId: locationId2, name: e.clientName || "(no account connected)", engagement: e });
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(agencyProfilePageHtml(readAgencyProfile(), rows, isLoopback(req) ? seatToken : ""));
+      res.end(agencyProfilePageHtml(readAgencyProfile(), rows, mayServeSeat(req, port) ? seatToken : ""));
       return;
     }
     if (req.method === "GET" && url === "/brands") {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-      res.end(brandsPageHtml(listBrands(), houseLooks(), listReferenceLooks(), isLoopback(req) ? seatToken : ""));
+      res.end(brandsPageHtml(listBrands(), houseLooks(), listReferenceLooks(), mayServeSeat(req, port) ? seatToken : ""));
       return;
     }
     if (req.method === "GET" && /^\/brand\/[a-z0-9-]+\/screenshot\.png$/.test(url)) {
@@ -36534,7 +36564,7 @@ async function runDashboard(argv) {
         const dna = houseLooks().find((d) => d.slug === slug3) ?? readBrand(slug3);
         const dir = brandExists(slug3) ? brandDir(slug3) : void 0;
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-        res.end(brandCardHtml(dna, { screenshot: dir ? fs27.existsSync(path26.join(dir, "screenshot.png")) : false, dir, seatToken: isLoopback(req) ? seatToken : "" }));
+        res.end(brandCardHtml(dna, { screenshot: dir ? fs27.existsSync(path26.join(dir, "screenshot.png")) : false, dir, seatToken: mayServeSeat(req, port) ? seatToken : "" }));
       } catch (e) {
         res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
         res.end(e.message);
@@ -36560,8 +36590,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/design/run")) {
-      const id = new URL(url, "http://x").searchParams.get("id");
+    if (req.method === "GET" && url === "/api/design/run") {
+      const id = new URL(req.url || "/", "http://x").searchParams.get("id");
       const payload = id ? designRunStatus(id) : { runs: listDesignRuns() };
       res.writeHead(payload ? 200 : 404, { "Content-Type": "application/json", "Cache-Control": "no-store" });
       res.end(JSON.stringify(payload ?? { ok: false, error: "no such run" }));
@@ -36687,8 +36717,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/handoff?")) {
-      const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+    if (req.method === "GET" && url === "/handoff") {
+      const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       if (!readableAccount(locationId2)) {
         res.writeHead(400);
         res.end("Choose a registered client.");
@@ -36791,8 +36821,8 @@ async function runDashboard(argv) {
       });
       return;
     }
-    if (req.method === "GET" && url.startsWith("/blueprint")) {
-      const q2 = new URL(url, "http://x").searchParams;
+    if (req.method === "GET" && url === "/blueprint") {
+      const q2 = new URL(req.url || "/", "http://x").searchParams;
       const locationId2 = q2.get("locationId") || "";
       const st = readCockpitState();
       const review = st.reviews?.[locationId2];
@@ -36806,8 +36836,8 @@ async function runDashboard(argv) {
       res.end(reviewDocumentHtml(review, { assessment: st.assessmentAttachments?.[locationId2], purchasedFeatureIds: st.assessmentPurchases?.[locationId2], planLines: readSavedPlan(locationId2) ? executablePlanLines(readSavedPlan(locationId2)) : [], clientName: name, agencyName: q2.get("agency") || st.agencyName, accent: q2.get("accent") || st.agencyAccent }));
       return;
     }
-    if (req.method === "GET" && url.startsWith("/api/review")) {
-      const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+    if (req.method === "GET" && url === "/api/review") {
+      const locationId2 = new URL(req.url || "/", "http://x").searchParams.get("locationId") || "";
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(readCockpitState().reviews?.[locationId2] ?? { ok: false, error: "not generated yet" }));
       return;
@@ -37399,7 +37429,7 @@ var init_dashboard = __esm({
     anthropicKeyWrites = Promise.resolve();
     SEAT_TOKEN_HEADER = "x-command-os-seat";
     NOT_SIGNED_IN_MSG = "This browser isn't signed in to Command OS on this computer. Open Command OS on the machine it runs on, and use the page it opens for you.";
-    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots"];
+    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots", "/api/agency-connection", "/api/client-preflight"];
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.6",
+  "version": "3.83.7",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",