@elitedcs/ghl-mcp 3.83.8 → 3.84.0

package/CHANGELOG.md

@@ -2,6 +2,99 @@
 
 ## Unreleased
 
+## 3.84.0 — the brief reaches past GoHighLevel, Slack arrives, the build follows what the client bought
+
+**The morning brief now asks your own Gmail, Google Calendar, Drive and Slack.** It ends with each
+client's email addresses and website, read from the client's own account record, and tells the
+assistant you already use what to ask: which client mail is waiting on a reply, what your own day
+holds, and what is waiting unanswered in Slack. Nothing is stored on our side and no Google
+sign-up is needed: the assistant's own connectors answer. Only clients are listed, only addresses
+that look like addresses, and a source that is not connected is said out loud rather than skipped.
+
+**Slack is connected.** Connect it once with a bot token from a Slack app you own; the token is
+tried before it is saved and never shown again. Post the brief, or anything, to a channel. Read
+what is waiting unanswered in the channels the bot has been invited to.
+
+**Build what the client bought.** The build now follows one record: the features the member
+confirms in the cockpit, prefilled from what the Assessment recorded as bought. An empty
+selection builds nothing and asks. Clearing the selection never erases the purchase record. The
+client document, the Review screen and the build tell one story.
+
+**Every build is on file before it happens.** A build killed at any point is already in the
+journal, so the undo list is complete. A staff member found only after a failed create is marked
+"Check", never "Reused".
+
+**Quote follow-up and review requests** are now preset workflows in the clinic, med-spa,
+local-service and coach presets, held draft behind the same handoffs as every other text-bearing
+workflow. Review requests never fire after a consultation or estimate, only after delivered
+service.
+
+**Leads by source.** New leads in the brief and the client week are broken down by where they
+came from, from GoHighLevel's own attribution, with a read that refuses to report a partial count
+as a whole one.
+
+**Your own automations are checked at the door.** The planner now reads the account and refuses
+any id it cannot see, including ids hidden inside a step's arguments.
+
+**The Assessment is attached to the client.** It fills the intake, the Review quotes it, and the
+client document prices what they did not buy in their own numbers.
+
+**Google Calendar, read-only.** Your own day, from your own calendar, beside the clients'
+appointments and never merged with them.
+
+Also: eight rows in the defect ledger that had already shipped are now recorded against their
+releases; a client record can hold the addresses of the people who write to you.
+
+## 3.83.9 — the first outside beta reports: keys stay private, a damaged download is named, Windows finds Claude Code
+
+Six fixes. Three come from the first external beta tester, one closes a
+security edge left open in 3.83.7, one prepares the Windows beta, and one is
+housekeeping for what the cockpit prints.
+
+- **Your GoHighLevel key is never shown, only named.** A health check, "which
+  account am I in", switching accounts and registering an agency key used to
+  print the first 12 characters of the live key. They now say "key ending
+  …ab12": enough to tell two keys apart, useless to anyone who reads it. A test
+  fails if any of those screens, or the command line, ever shows more than four
+  characters of a key again.
+- **"Skills: 43 installed" was counting files.** The startup line and the
+  install_skills reply now count skills and name them: "Skills: 3 installed
+  (blueprint, clone-site, ghl-reports)".
+- **A damaged download is named instead of "Connection closed".** When an
+  earlier npx download of GHL Command on your computer loses its package.json,
+  Claude cannot start it and shows only "Connection closed", which looks like a
+  dead licence. GHL Command cannot report this itself, because it never starts.
+  The installer command, `npx -y @elitedcs/ghl-mcp@latest cli install`, now
+  checks for that exact damage and prints one line naming the folder to delete.
+  It deletes nothing. When the damaged download is the very one that command
+  runs from, npm stops first with its own error, so the install guide's new
+  "Connection closed" entry gives the fix the Members Hub gives: quit Claude,
+  drag the npx download folder to the Trash in Finder, reopen. Every install instruction now names
+  @latest, the form the installer and the cockpit's launcher already used.
+- **The cockpit refuses a request that sends its Host twice, or Sec-Fetch-Site
+  twice.** Two request shapes a program on your own computer could send, and a
+  web page cannot, passed the 3.83.7 address checks: a second Host after the
+  allowed one, and two Sec-Fetch-Site values that Node joined into one. Host,
+  Origin and Sec-Fetch-Site are now read exactly as they arrived on the wire; a
+  repeated one is refused, and Sec-Fetch-Site is accepted only as same-origin
+  or none, or absent.
+- **Addresses the cockpit prints carry no http://.** The cockpit's start-up
+  line and its "already running" line now name the address as
+  localhost:7300, and the reply after creating a client says "Open
+  localhost:7300/new…". Printed addresses get pasted into support threads and
+  emails, where click tracking rewrites any http address, so one plain form is
+  used everywhere. The cost: a bare address is not a clickable link in
+  Terminal or in Claude Desktop, so you type it rather than click it.
+- **Windows: the cockpit finds Claude Code.** On Windows, Claude Code is
+  claude.exe (Anthropic's installer, WinGet) or a claude.cmd shim (npm). The
+  cockpit looked for a file named exactly "claude", so a Windows member reached
+  the first powered stage and read "Claude Code CLI not found". The lookup now
+  follows Windows' own rules (PATHEXT, and %USERPROFILE%\.local\bin\claude.exe
+  where Anthropic's installer puts it), and an npm shim is started the way Node
+  requires on Windows, with prompts passed to Claude untouched. **This has not
+  yet run on a Windows machine.** The tests simulate Windows; the first real run
+  is our Windows beta tester's, after this release.
+
 ## 3.83.8 — plain sentences where a few screens showed raw data
 
 Four places in the cockpit could show raw technical data where a sentence

package/README.md

@@ -94,7 +94,7 @@ This MCP (Model Context Protocol) server connects Claude directly to GoHighLevel
 One command in any terminal (Terminal on Mac, PowerShell on Windows):
 
 ```
-npx -y @elitedcs/ghl-mcp cli install
+npx -y @elitedcs/ghl-mcp@latest cli install
 ```
 
 It finds Claude Desktop's settings file, adds GHL Command **alongside any MCP servers you already have** (nothing gets overwritten), and saves a backup first. If the file has a formatting problem, it repairs it. Then **quit Claude completely** — Cmd+Q on Mac; on Windows right-click the Claude icon by the clock and choose Quit — and reopen.
@@ -121,7 +121,7 @@ Open Claude Desktop → **Settings...** → **Developer** → **Edit Config**. T
 }
 ```
 
-If it already has other tools in it, do **not** paste over them — add only the `"ghl": { ... }` entry inside your existing `"mcpServers"` object. Save, then fully quit and reopen Claude. (Unsure? Run `npx -y @elitedcs/ghl-mcp cli install --dry-run` to preview exactly what would change, or `--print-only` to get the merged file printed for you.)
+If it already has other tools in it, do **not** paste over them — add only the `"ghl": { ... }` entry inside your existing `"mcpServers"` object. Save, then fully quit and reopen Claude. (Unsure? Run `npx -y @elitedcs/ghl-mcp@latest cli install --dry-run` to preview exactly what would change, or `--print-only` to get the merged file printed for you.)
 
 </details>
 
@@ -257,9 +257,9 @@ Highlights (full guide: [`docs/HEADLESS.md`](docs/HEADLESS.md)):
 
 - **Scriptable multi-account setup** — pre-seed the documented `.ghl-tokens.json`, or use the CLI in a Dockerfile/entrypoint:
   ```bash
-  npx -y @elitedcs/ghl-mcp cli register-location --location-id XXXX --api-key pit-... --name "Account"
-  npx -y @elitedcs/ghl-mcp cli register-company-firebase --company-id YYYY --refresh-token ... --user-id ...
-  npx -y @elitedcs/ghl-mcp cli register-agency-key --api-key pit-...
+  npx -y @elitedcs/ghl-mcp@latest cli register-location --location-id XXXX --api-key pit-... --name "Account"
+  npx -y @elitedcs/ghl-mcp@latest cli register-company-firebase --company-id YYYY --refresh-token ... --user-id ...
+  npx -y @elitedcs/ghl-mcp@latest cli register-agency-key --api-key pit-...
   ```
 - **Persistent config dir** — set `GHL_MCP_CONFIG_DIR=/data/ghl-mcp` (absolute path) on a mounted volume so auto-rotated Firebase tokens survive container restarts.
 - **Firebase is per-company, not per-sub-account** — one credential set covers all sub-accounts under a company.
@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.8
+**Version:** 3.84.0
 
 ---