@elitedcs/ghl-mcp 3.91.0 → 3.92.1

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 3.92.1: 3.92.0, released
+
+This release is exactly 3.92.0's content, the client brain. 3.92.0 never reached npm because a packaging step ran in the wrong order; 3.92.1 fixes that step and changes nothing else.
+
+## 3.92.0: The client brain, a memory of each client that every agent reads first (the plan above Command Pro)
+
+This release is everything in 3.91.1, plus the changes below.
+
+**The client brain.** The client brain comes only with the plan above Command Pro. On GHL Command and Command Pro, its tools answer that they are not included in your license, except export and the off switch (see Known limits). One small memory for each client, kept in a database in your own Supabase account, never ours. For each client it holds the status of every lead it has heard about (booked, opted out, or needs a person), the client's own rules with their reasons, a few facts with where each came from, the client's words, and example replies. The brain reads one short brief from it before every draft, and Claude can read the same brief when you ask about a lead.
+
+**Drafts, never sends.** When a lead replies, the brain writes a draft answer as a note on the contact in GoHighLevel. Code checks every draft before the note is written. A draft that fails is still written, headed "BLOCKED, not for sending" or "HELD, not sent", with the reason. Sending is switched off in this version: you send the reply yourself in GoHighLevel. The brain writes no draft for a lead with do-not-disturb on, a lead who replied STOP or another opt-out word, or a lead carrying an opt-out tag, and it hands a lead to a person when a message only might mean stop or uses one of its escalation words.
+
+**Every change waits for your yes.** Each tool that changes the brain shows you the plan first and writes nothing. It applies only when you say yes to that exact plan, and that yes lapses after 30 minutes. Facts are proposed with their source and reach agents only after a person approves them.
+
+**The brain adds 15 tools, on the plan above Command Pro only:** brain_setup, brain_wire_ghl, brain_set_rules, brain_set_glossary, brain_set_caps, brain_set_examples, brain_propose_fact, brain_review, brain_clear_human, brain_forget_contact, brain_log, brain_audit, brain_export, brain_retire and get_contact_brief. GHL Command's own tool count does not change. Setting the brain up or connecting a client's GoHighLevel works only on accounts marked as a practice sandbox in this version, and only on the computer that set the brain up. Pause and retire work on any account.
+
+**Your data stays yours.** brain_export saves the brain's records to your computer: its rules, active facts, examples, glossary, each lead's status, events, decisions and proposals, plus a record of every lead you asked it to forget. When a license for the plan above Command Pro ends, export and the off switches keep working only when the owner's signed license is on this computer; team logins are refused.
+
+**Your saved settings are protected from being undone.** Every save of the settings file on this computer now reads the file again first and changes only its own fields, so a slow license check, a Workflow Builder login or a second setup can no longer roll back something saved a moment earlier. Re-running setup with the same license now keeps your saved Anthropic key and cockpit key.
+
+**Privacy wording corrected.** The connector, checkup and README text now says plainly what leaves your computer. In short, each key goes only to its own service, except that the client brain keeps the client's GoHighLevel key, its own Anthropic key, your GHL Command license key and the credential it uses to check that license inside your own Supabase project. The brain's own write key is stored only in the workflows it wires in GoHighLevel. Account data goes only to GoHighLevel, your own Claude account and services you connect yourself, and GHL Command sends us a few anonymous install, startup and first-use counts with no account data. Turn those off with GHL_TELEMETRY=0 or DO_NOT_TRACK=1.
+
+**Known limits.** When the license is not active, export and the off switch for the client brain check that the owner's signed license is on this computer. They do not check who is typing. So anyone using the owner's computer, or a copy of its config folder, can export the brain or switch it off, even after the license ends. Keep that folder as private as the keys it holds. GHL Command in Claude and the cockpit can both save the settings file. Each save checks the license is still the one on file, but two saves in the same instant from the two programs can still lose one of them; at worst a setting has to be saved again. After a cancel, the cockpit's hand-off page works only while the cockpit is still running (closing the browser tab is fine; it reopens). Once the cockpit stops, export and the off switch run from Claude chat with brain_export and brain_retire.
+
+## 3.91.1: Step 7, Staff, says what is true, and one rule decides who gets an admin login
+
+This release is everything in 3.91.0, plus the changes below.
+
+**One rule for who gets an admin login.** Anyone whose job says owner, founder, admin, administrator, CEO, principal or director gets an admin login. If nobody on the team has a job like that, the first person listed gets one, so someone can run the account. Build and Add them for me now follow the same rule, and both mark that person with Admin login before anything is made. Someone who already has a login keeps the level they have.
+
+**Step 7, Staff, says only what it checked.** It says Build waits for the staff, not Intake, it no longer says calendars and lead alerts will use the people it found, and when it cannot add people it says why: the agency key is not connected yet, your plan does not allow it, or GoHighLevel refused it. The board's staff panel now says when someone is in the account at a different login level, as step 7 does. Blueprint Review says the staff are not checked yet, rather than not in the account, when it could not read them.
+
+**A one-time password stays on the page you are on.** When GoHighLevel sets a password for someone it has not listed yet, the page keeps it and shows it the first time a check finds them; Check again and a second Add them for me keep it too. Reloading the page still clears it, so copy it when it appears. Someone taken off the team while their login was being made is shown as still being set up, never as could not be added. When a Build in the cockpit makes someone and GoHighLevel requires a password, the cockpit never shows or keeps it: reset that person's password in GoHighLevel.
+
+**Known limits.** Other programs on this computer, or other people signed in to it, can read what the cockpit shows, including a one-time password while it is on step 7, Staff. Keep the computer to yourself. If two people on the team share a name, their password lines look the same; check the email in GoHighLevel. If you take someone off the team while their login is still being set up, their password is not shown; reset it in GoHighLevel if you add them back.
+
 ## 3.91.0: The board and the brief open much faster
 
 This release is everything in 3.90.1, plus the change below.
@@ -26,8 +62,6 @@ This release is everything in 3.90.0, plus the fix below. It fixes behavior that
 
 **A new login is never made twice while GoHighLevel catches up.** GoHighLevel can take a minute to list a login it has just made. Until it does, step 7 and the board say the person "is still being set up in GoHighLevel", and Add them for me does not send them again, from any page or window, for up to 10 minutes. If GoHighLevel insisted on a password, step 7 now shows the one-time password, as the board does.
 
-**Known limits, fixed in the next release.** The board's staff panel does not show when someone's login level differs from the list. If someone is taken off the team while their login is being made and the connection drops, step 7 can still say they could not be added. Without an agency key, step 7 says your plan does not let you add people. The staff step says Intake waits for it (only Build does), and says calendars and lead alerts will use the people found, which it does not check. Blueprint Review says staff are not in the account when it could not read them. When nobody's job says owner, Build makes the first person listed an admin, while Add them for me makes them a user; Build's confirmation shows it before anything is made.
-
 After Add them for me or Confirm and build, check the client's GoHighLevel Users list.
 
 ## 3.90.0: the cockpit never acts on the wrong client, and refuses a change made from an old page
@@ -391,6 +425,19 @@ This is a beta, a test build for members who want the next release early. It is
 **verify_design and extract_brand open pages in a fresh browser** with no saved logins. verify_design renders a local page only from your project folder or your brand folder. To use another folder, set GHL_MCP_DESIGN_DIR to it.
 
 **The cockpit intake no longer reads a link.** Open the page, copy its text, and paste it into Paste a transcript.
+## Unreleased: Brain drafts are easier to read
+
+On the Brain drafts screen, each draft now names the lead it is for (their name, or their email or phone when there is no name) instead of a code, and every check reads in plain English, such as "Not opted out". After you approve or reject, a confirmation stays on screen for a few seconds, or until you dismiss it, and says plainly whether anything was sent. While sending is switched off it reads "Approved. Sending is switched off, so nothing was sent."
+
+## Unreleased
+
+Client brain sending, still switched off and sandbox only: every draft now shows how long ago the facts behind it were read, and a send is refused when those facts are more than 30 minutes old. Drafting and sending both skip a lead who is on do-not-disturb, carries an opt-out tag or replied STOP, and this is checked again right before a send. The brain sends at most one reply to a lead and 20 replies per client each day, counted from its send log.
+
+The cockpit's Approve button is now wired all the way to the send, still switched off in this version. When sending is switched on in a future release, you approve one reply, confirm with Touch ID, and that exact reply goes to that lead once, at the address or number the Touch ID prompt showed you, on the channel you chose. A note on the contact says who approved it. If the lead's address changes after you approve, nothing is sent. A client is put into send mode from the cockpit only, with Touch ID, after 7 days of drafts with at least 95% approved, and switching back to drafts takes effect at once.
+
+Every brain send, every refused send and every outcome is now one line in a send log on your computer: who approved it, which approval, a fingerprint of the exact words, the recipient, the channel, the time, the result and GoHighLevel's message id. The Brain drafts screen lists it for each client, newest first, with the recipient partly hidden. No keys or signatures are ever written to it.
+
+If your membership ends, your client brain is yours. A new page, Your client brain, lets you download everything the brain holds as one file you keep, and pause the brain for every client, which stops drafting and any sending at once and deletes nothing. It keeps working in a cockpit that is still open after your membership ends, and the page that says your license needs attention links to it. Sending stops the moment a membership ends; drafting carries on in your own accounts until you pause or retire it.
 
 ## 3.88.2: a workflow waiting on a calendar is never switched on
 
@@ -860,7 +907,6 @@ website, and that pages are a separate job after the account exists, on hosting
 member owns. A test pins the skill and the plan format together so they cannot
 disagree again.
 
-
 ## 3.83.0 — a build you can check, and no funnel at the end of it
 
 **Blueprint no longer builds a funnel, a page, or a website of any kind.** GoHighLevel's own page
@@ -889,14 +935,12 @@ retried into a duplicate; and read-backs retry a timeout but never retry a genui
 running GHL Command, the stages use the plan you already pay for. Saving a key switches every stage to
 usage billing, which the cockpit and the member hub now say plainly.
 
-
 - Brief checks the intake and writes the review; the build plan is prepared when Build runs.
 - Changed intake answers require a fresh review, changed build plans require verification, and live workflow repairs need approval of the listed changes.
 - Client pages keep the selected client, open the shared intake answers, separate existing inventory from build evidence, and keep generated drafts for review.
 - Verify prepares the client handoff. Local files are shown as prepared, not published, and handoff email delivery requires a reviewed recipient and explicit confirmation.
 - Your agency now has a creation-only switch for sub-accounts from chat. Package preparation creates catalog products and leaves pricing and payment links as a visible manual task.
 
-
 - Register an existing sub-account on either plan path, replace a saved account key, and see chat registrations in the cockpit without restarting. Creation checks the agency connection first and keeps an account visible when its key could not be saved.
 - Intake keeps Interview answers, loads submitted answers, asks before replacing corrections, and identifies missing respondent details. Source uploads are limited to supported text formats and show the 60,000-character limit. Prepared forms and client documents have clickable links.
 - Client Builds checks account access and setup before running, explains Intake’s writes, and uses the same practice-account rules everywhere. Failed verification blocks sign-off, and manual obligations remain visible until checked.
@@ -910,7 +954,6 @@ usage billing, which the cockpit and the member hub now say plainly.
 - **Build a client account guidance corrected.** Existing clients are behind “Work on a client already registered →” and are never pre-selected. Registration confirms the sub-account name and id, never a key hint.
 - **Deletion is separate from registration.** Removing a saved key does not delete the GoHighLevel account. Deletion requires separate authorization; no claim is made that the account's creation method determines whether it can be deleted.
 
-
 ## 3.82.0 — the cockpit laid out like the hub, for Command OS subscribers
 
 The Command OS cockpit was built for one job, the Blueprint build, and that one section
@@ -1502,7 +1545,6 @@ It caught two files that a careful pass by hand had already missed.
 
 Counts unchanged: 247 tools, 51 modules, free tier 111. No tool behaviour changed.
 
-
 ## 3.72.0 — an audit that counts your workflows once
 
 A member ran the account audit on a large agency account. The report came back claiming
@@ -2088,7 +2130,6 @@ them were visible until a guide was written against them and run for real.
   supported). Documented so nobody builds a "send to a third party" node that
   silently mails the contact.
 
-
 ## 3.62.0 — The user guide ships inside the product
 
 - **New tool `get_user_guide`** (free tier included): opens the full GHL Command
@@ -2487,7 +2528,6 @@ builds inside it and verify_funnel proves it.
   a temp dir AND writeCredentials refuses to run under vitest without an
   override.
 
-
 ## 3.50.0 — FREE read-only tier
 
 A free license (`ghlcommand.com/free`, key by email, no card) now runs the same
@@ -2541,7 +2581,6 @@ No behavior changes; text only.
 - `enable_workflow_builder` and `auto_capture_firebase_script` tool descriptions
   point to `capture_firebase_interactive` first.
 
-
 ## 3.49.0 — One-click Workflow Builder unlock (`capture_firebase_interactive`)
 
 The buyer's whole job is now: log into GHL in a Chrome window the tool opens.
@@ -2566,7 +2605,6 @@ No DevTools, no console paste, no JSON shuttling.
   console-paste path, unchanged).
 - Tool count: 228 → 229 (177 without Firebase).
 
-
 ## 3.48.2 — Docs patch: tool-count claims corrected (the real number is 228)
 
 No behavior changes; text only, plus one new test.
@@ -2581,7 +2619,6 @@ No behavior changes; text only, plus one new test.
   `registerAllTools` and fails the suite if package.json, README, or setup-tool copy
   ever disagrees again.
 
-
 ## 3.48.1 — Docs patch: Firebase capture friction + live pricing copy
 
 No behavior changes; text only.
@@ -2597,7 +2634,6 @@ No behavior changes; text only.
   7-step IndexedDB walk is demoted to a collapsed fallback for locked-down browsers;
   multi-tenant instructions reference the script instead of the manual steps.
 
-
 ## 3.48.0 — Blueprint: complete workflow-building (opportunities, branching, appointment timers, opt-in publish)
 
 Completes the `apply_build_plan` executor so a Blueprint build produces workflows that

package/README.md

@@ -602,7 +602,7 @@ npm run dev      # tsc --watch (type-checking only)
 User prompt → Claude Code → MCP tool call → GHL Client → GHL API → JSON response → Claude Code → User
 ```
 
-Every tool returns structured JSON. Claude interprets the response and presents it naturally. No data is stored locally — it's a pass-through to GHL's API.
+Every tool returns structured JSON. Claude interprets the response and presents it naturally. Tools read and write GoHighLevel directly. This computer keeps your keys and settings, the cockpit's last read of each account so its screens open quickly, a record of each change it makes, working logs, the Workflow Builder's own browser sign-in, and anything you choose to save, such as an export or a report.
 
 ---
 
@@ -705,7 +705,7 @@ This MCP server is safe to share via GitHub.
 | **API Keys** | Stored in a per-user credentials file (`~/Library/Application Support/elitedcs-ghl-mcp/credentials.json` on Mac) at chmod 0600. Never in code, never committed. |
 | **License validation** | Checked at `setup_ghl_mcp` against the elitedcs.com license server, then cached as a signed attestation (~30 days). The server renews the attestation in the background as expiry approaches — never per-request, and your GHL keys are never sent to us. |
 | **Multi-user** | Each user brings their own license key + GHL API key. Complete account isolation. |
-| **Scope** | The server only talks to GHL's API, the elitedcs.com license server (setup + periodic attestation renewal), and npm's registry (startup version banner — `GHL_MCP_DISABLE_UPDATE_CHECK=1` to disable). No filesystem access beyond its config dir, no shell commands. |
+| **Scope** | The server talks to GHL's API, the elitedcs.com license server (setup and periodic attestation renewal), elitedcs.com/api/telemetry for anonymous install, startup and first-use counts (off with `GHL_TELEMETRY=0` or `DO_NOT_TRACK=1`), and npm's registry (startup version banner, off with `GHL_MCP_DISABLE_UPDATE_CHECK=1`). |
 | **Permissions** | Controlled by your GHL Private Integration scopes. Disable what you don't need. |
 
 ---
@@ -738,7 +738,7 @@ Run `health_check` any time to see whether it's on and confirm an opt-out took e
 | `reason_code` | `ghl_key_wrong_location` | If setup failed, which of eleven fixed labels. Never a raw error message. |
 | `ts` | `2026-08-04T03:31:08Z` | When it happened. |
 
-**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. Nothing about your GHL account or your clients' accounts ever leaves your machine.
+**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. The counts never include any of your GHL account data or your clients' data. That data goes only to GoHighLevel, to your own Claude account, and to services you connect yourself, such as your own Supabase project for the client brain or a connected Stripe, Slack or Zoom account.
 
 The receiving endpoint **rejects** any payload containing a field not on that list rather than quietly dropping it, and the database enforces the same list a second time — so the shape can't drift without both being changed deliberately.
 
@@ -899,7 +899,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.91.0
+**Version:** 3.92.1
 
 ---