@elitedcs/ghl-mcp 3.83.6 → 3.83.8

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## Unreleased
 
+## 3.83.8 — plain sentences where a few screens showed raw data
+
+Four places in the cockpit could show raw technical data where a sentence
+belonged. Each now says what happened in plain words.
+
+- **Saving an Assessment to GoHighLevel.** A client detail that was too long came
+  back as a block of validation data. The client fields now stop at the length the
+  save accepts, and a refusal names the field: "Client name is too long, 120
+  characters at most."
+- **Design Studio's "Make it".** The form accepted slide and point counts that the
+  design run itself refuses, so the run failed with an error in its log. The form
+  and the cockpit now use the design run's own limits and say so before anything
+  starts: "Choose a whole number of slides from 3 to 24." A run that would be
+  refused never starts, so it never uses your Claude.
+- **Errors from GoHighLevel.** Saving an Assessment, attaching one on a client card,
+  and preparing or sending the handoff email could put GoHighLevel's own error text
+  on the page. Those screens now say what failed and what to check, and keep the
+  technical detail in the cockpit's own log. Messages the cockpit itself gives you,
+  like a step that still needs approving, reach you unchanged.
+- **"Save answers" in the Assessment.** Every save opened a box full of the answers
+  file's contents, even when the download worked. The download is unchanged; the
+  contents now appear only if you choose "Show the file's contents", for when a
+  browser blocks the download.
+
+## 3.83.7 — the cockpit answers only to its own address, and keeps its key to itself
+
+**Security fix. Update to this version.**
+
+The cockpit runs on your own computer and only accepts connections from it. Two
+things it should have refused, it did not:
+
+- **A design run's details were readable without the cockpit's key.** Anything
+  able to reach the cockpit on your computer could list the Design Studio runs it
+  had started: the brand, headline, points and audience you typed, the run's log,
+  and the folder it saved to, which includes your computer's user name.
+- **The cockpit handed its key to a request that used a different address for
+  it.** A web page that tricks your browser into reaching the cockpit under
+  another name could have picked up that key, and with it read what the cockpit
+  reads for your clients: intake answers, uploaded intake documents, what each
+  account already has set up, and your snapshot list. Nothing could be changed
+  that way; every change the cockpit makes kept refusing such requests. No
+  GoHighLevel key was exposed by either path.
+
+Now the cockpit refuses any request that is not addressed to `localhost` or
+`127.0.0.1` on its own port, before it does anything else. It gives its key only
+to its own pages opened on your computer, never to anything else. Design Studio's
+run list and progress need the key, like the cockpit's other private reads. And a
+request that spells a page's address in an unusual way is refused rather than
+guessed at.
+
+Nothing changes in how you open it: the address the cockpit opens for you is one of
+the two it accepts.
+
 ## 3.83.6 — what a design run actually costs you, measured
 
 3.83.5 gave a running job a clock. This gives it an honest number on it.

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.6
+**Version:** 3.83.8
 
 ---