@elitedcs/ghl-mcp 3.83.7 → 3.83.9

package/CHANGELOG.md

@@ -2,6 +2,80 @@
 
 ## Unreleased
 
+## 3.83.9 — the first outside beta reports: keys stay private, a damaged download is named, Windows finds Claude Code
+
+Six fixes. Three come from the first external beta tester, one closes a
+security edge left open in 3.83.7, one prepares the Windows beta, and one is
+housekeeping for what the cockpit prints.
+
+- **Your GoHighLevel key is never shown, only named.** A health check, "which
+  account am I in", switching accounts and registering an agency key used to
+  print the first 12 characters of the live key. They now say "key ending
+  …ab12": enough to tell two keys apart, useless to anyone who reads it. A test
+  fails if any of those screens, or the command line, ever shows more than four
+  characters of a key again.
+- **"Skills: 43 installed" was counting files.** The startup line and the
+  install_skills reply now count skills and name them: "Skills: 3 installed
+  (blueprint, clone-site, ghl-reports)".
+- **A damaged download is named instead of "Connection closed".** When an
+  earlier npx download of GHL Command on your computer loses its package.json,
+  Claude cannot start it and shows only "Connection closed", which looks like a
+  dead licence. GHL Command cannot report this itself, because it never starts.
+  The installer command, `npx -y @elitedcs/ghl-mcp@latest cli install`, now
+  checks for that exact damage and prints one line naming the folder to delete.
+  It deletes nothing. When the damaged download is the very one that command
+  runs from, npm stops first with its own error, so the install guide's new
+  "Connection closed" entry gives the fix the Members Hub gives: quit Claude,
+  drag the npx download folder to the Trash in Finder, reopen. Every install instruction now names
+  @latest, the form the installer and the cockpit's launcher already used.
+- **The cockpit refuses a request that sends its Host twice, or Sec-Fetch-Site
+  twice.** Two request shapes a program on your own computer could send, and a
+  web page cannot, passed the 3.83.7 address checks: a second Host after the
+  allowed one, and two Sec-Fetch-Site values that Node joined into one. Host,
+  Origin and Sec-Fetch-Site are now read exactly as they arrived on the wire; a
+  repeated one is refused, and Sec-Fetch-Site is accepted only as same-origin
+  or none, or absent.
+- **Addresses the cockpit prints carry no http://.** The cockpit's start-up
+  line and its "already running" line now name the address as
+  localhost:7300, and the reply after creating a client says "Open
+  localhost:7300/new…". Printed addresses get pasted into support threads and
+  emails, where click tracking rewrites any http address, so one plain form is
+  used everywhere. The cost: a bare address is not a clickable link in
+  Terminal or in Claude Desktop, so you type it rather than click it.
+- **Windows: the cockpit finds Claude Code.** On Windows, Claude Code is
+  claude.exe (Anthropic's installer, WinGet) or a claude.cmd shim (npm). The
+  cockpit looked for a file named exactly "claude", so a Windows member reached
+  the first powered stage and read "Claude Code CLI not found". The lookup now
+  follows Windows' own rules (PATHEXT, and %USERPROFILE%\.local\bin\claude.exe
+  where Anthropic's installer puts it), and an npm shim is started the way Node
+  requires on Windows, with prompts passed to Claude untouched. **This has not
+  yet run on a Windows machine.** The tests simulate Windows; the first real run
+  is our Windows beta tester's, after this release.
+
+## 3.83.8 — plain sentences where a few screens showed raw data
+
+Four places in the cockpit could show raw technical data where a sentence
+belonged. Each now says what happened in plain words.
+
+- **Saving an Assessment to GoHighLevel.** A client detail that was too long came
+  back as a block of validation data. The client fields now stop at the length the
+  save accepts, and a refusal names the field: "Client name is too long, 120
+  characters at most."
+- **Design Studio's "Make it".** The form accepted slide and point counts that the
+  design run itself refuses, so the run failed with an error in its log. The form
+  and the cockpit now use the design run's own limits and say so before anything
+  starts: "Choose a whole number of slides from 3 to 24." A run that would be
+  refused never starts, so it never uses your Claude.
+- **Errors from GoHighLevel.** Saving an Assessment, attaching one on a client card,
+  and preparing or sending the handoff email could put GoHighLevel's own error text
+  on the page. Those screens now say what failed and what to check, and keep the
+  technical detail in the cockpit's own log. Messages the cockpit itself gives you,
+  like a step that still needs approving, reach you unchanged.
+- **"Save answers" in the Assessment.** Every save opened a box full of the answers
+  file's contents, even when the download worked. The download is unchanged; the
+  contents now appear only if you choose "Show the file's contents", for when a
+  browser blocks the download.
+
 ## 3.83.7 — the cockpit answers only to its own address, and keeps its key to itself
 
 **Security fix. Update to this version.**

package/README.md

@@ -94,7 +94,7 @@ This MCP (Model Context Protocol) server connects Claude directly to GoHighLevel
 One command in any terminal (Terminal on Mac, PowerShell on Windows):
 
 ```
-npx -y @elitedcs/ghl-mcp cli install
+npx -y @elitedcs/ghl-mcp@latest cli install
 ```
 
 It finds Claude Desktop's settings file, adds GHL Command **alongside any MCP servers you already have** (nothing gets overwritten), and saves a backup first. If the file has a formatting problem, it repairs it. Then **quit Claude completely** — Cmd+Q on Mac; on Windows right-click the Claude icon by the clock and choose Quit — and reopen.
@@ -121,7 +121,7 @@ Open Claude Desktop → **Settings...** → **Developer** → **Edit Config**. T
 }
 ```
 
-If it already has other tools in it, do **not** paste over them — add only the `"ghl": { ... }` entry inside your existing `"mcpServers"` object. Save, then fully quit and reopen Claude. (Unsure? Run `npx -y @elitedcs/ghl-mcp cli install --dry-run` to preview exactly what would change, or `--print-only` to get the merged file printed for you.)
+If it already has other tools in it, do **not** paste over them — add only the `"ghl": { ... }` entry inside your existing `"mcpServers"` object. Save, then fully quit and reopen Claude. (Unsure? Run `npx -y @elitedcs/ghl-mcp@latest cli install --dry-run` to preview exactly what would change, or `--print-only` to get the merged file printed for you.)
 
 </details>
 
@@ -257,9 +257,9 @@ Highlights (full guide: [`docs/HEADLESS.md`](docs/HEADLESS.md)):
 
 - **Scriptable multi-account setup** — pre-seed the documented `.ghl-tokens.json`, or use the CLI in a Dockerfile/entrypoint:
   ```bash
-  npx -y @elitedcs/ghl-mcp cli register-location --location-id XXXX --api-key pit-... --name "Account"
-  npx -y @elitedcs/ghl-mcp cli register-company-firebase --company-id YYYY --refresh-token ... --user-id ...
-  npx -y @elitedcs/ghl-mcp cli register-agency-key --api-key pit-...
+  npx -y @elitedcs/ghl-mcp@latest cli register-location --location-id XXXX --api-key pit-... --name "Account"
+  npx -y @elitedcs/ghl-mcp@latest cli register-company-firebase --company-id YYYY --refresh-token ... --user-id ...
+  npx -y @elitedcs/ghl-mcp@latest cli register-agency-key --api-key pit-...
   ```
 - **Persistent config dir** — set `GHL_MCP_CONFIG_DIR=/data/ghl-mcp` (absolute path) on a mounted volume so auto-rotated Firebase tokens survive container restarts.
 - **Firebase is per-company, not per-sub-account** — one credential set covers all sub-accounts under a company.
@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.7
+**Version:** 3.83.9
 
 ---