@elitedcs/ghl-mcp 3.91.1 → 3.92.1

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 3.92.1: 3.92.0, released
+
+This release is exactly 3.92.0's content, the client brain. 3.92.0 never reached npm because a packaging step ran in the wrong order; 3.92.1 fixes that step and changes nothing else.
+
+## 3.92.0: The client brain, a memory of each client that every agent reads first (the plan above Command Pro)
+
+This release is everything in 3.91.1, plus the changes below.
+
+**The client brain.** The client brain comes only with the plan above Command Pro. On GHL Command and Command Pro, its tools answer that they are not included in your license, except export and the off switch (see Known limits). One small memory for each client, kept in a database in your own Supabase account, never ours. For each client it holds the status of every lead it has heard about (booked, opted out, or needs a person), the client's own rules with their reasons, a few facts with where each came from, the client's words, and example replies. The brain reads one short brief from it before every draft, and Claude can read the same brief when you ask about a lead.
+
+**Drafts, never sends.** When a lead replies, the brain writes a draft answer as a note on the contact in GoHighLevel. Code checks every draft before the note is written. A draft that fails is still written, headed "BLOCKED, not for sending" or "HELD, not sent", with the reason. Sending is switched off in this version: you send the reply yourself in GoHighLevel. The brain writes no draft for a lead with do-not-disturb on, a lead who replied STOP or another opt-out word, or a lead carrying an opt-out tag, and it hands a lead to a person when a message only might mean stop or uses one of its escalation words.
+
+**Every change waits for your yes.** Each tool that changes the brain shows you the plan first and writes nothing. It applies only when you say yes to that exact plan, and that yes lapses after 30 minutes. Facts are proposed with their source and reach agents only after a person approves them.
+
+**The brain adds 15 tools, on the plan above Command Pro only:** brain_setup, brain_wire_ghl, brain_set_rules, brain_set_glossary, brain_set_caps, brain_set_examples, brain_propose_fact, brain_review, brain_clear_human, brain_forget_contact, brain_log, brain_audit, brain_export, brain_retire and get_contact_brief. GHL Command's own tool count does not change. Setting the brain up or connecting a client's GoHighLevel works only on accounts marked as a practice sandbox in this version, and only on the computer that set the brain up. Pause and retire work on any account.
+
+**Your data stays yours.** brain_export saves the brain's records to your computer: its rules, active facts, examples, glossary, each lead's status, events, decisions and proposals, plus a record of every lead you asked it to forget. When a license for the plan above Command Pro ends, export and the off switches keep working only when the owner's signed license is on this computer; team logins are refused.
+
+**Your saved settings are protected from being undone.** Every save of the settings file on this computer now reads the file again first and changes only its own fields, so a slow license check, a Workflow Builder login or a second setup can no longer roll back something saved a moment earlier. Re-running setup with the same license now keeps your saved Anthropic key and cockpit key.
+
+**Privacy wording corrected.** The connector, checkup and README text now says plainly what leaves your computer. In short, each key goes only to its own service, except that the client brain keeps the client's GoHighLevel key, its own Anthropic key, your GHL Command license key and the credential it uses to check that license inside your own Supabase project. The brain's own write key is stored only in the workflows it wires in GoHighLevel. Account data goes only to GoHighLevel, your own Claude account and services you connect yourself, and GHL Command sends us a few anonymous install, startup and first-use counts with no account data. Turn those off with GHL_TELEMETRY=0 or DO_NOT_TRACK=1.
+
+**Known limits.** When the license is not active, export and the off switch for the client brain check that the owner's signed license is on this computer. They do not check who is typing. So anyone using the owner's computer, or a copy of its config folder, can export the brain or switch it off, even after the license ends. Keep that folder as private as the keys it holds. GHL Command in Claude and the cockpit can both save the settings file. Each save checks the license is still the one on file, but two saves in the same instant from the two programs can still lose one of them; at worst a setting has to be saved again. After a cancel, the cockpit's hand-off page works only while the cockpit is still running (closing the browser tab is fine; it reopens). Once the cockpit stops, export and the off switch run from Claude chat with brain_export and brain_retire.
+
 ## 3.91.1: Step 7, Staff, says what is true, and one rule decides who gets an admin login
 
 This release is everything in 3.91.0, plus the changes below.
@@ -401,6 +425,19 @@ This is a beta, a test build for members who want the next release early. It is
 **verify_design and extract_brand open pages in a fresh browser** with no saved logins. verify_design renders a local page only from your project folder or your brand folder. To use another folder, set GHL_MCP_DESIGN_DIR to it.
 
 **The cockpit intake no longer reads a link.** Open the page, copy its text, and paste it into Paste a transcript.
+## Unreleased: Brain drafts are easier to read
+
+On the Brain drafts screen, each draft now names the lead it is for (their name, or their email or phone when there is no name) instead of a code, and every check reads in plain English, such as "Not opted out". After you approve or reject, a confirmation stays on screen for a few seconds, or until you dismiss it, and says plainly whether anything was sent. While sending is switched off it reads "Approved. Sending is switched off, so nothing was sent."
+
+## Unreleased
+
+Client brain sending, still switched off and sandbox only: every draft now shows how long ago the facts behind it were read, and a send is refused when those facts are more than 30 minutes old. Drafting and sending both skip a lead who is on do-not-disturb, carries an opt-out tag or replied STOP, and this is checked again right before a send. The brain sends at most one reply to a lead and 20 replies per client each day, counted from its send log.
+
+The cockpit's Approve button is now wired all the way to the send, still switched off in this version. When sending is switched on in a future release, you approve one reply, confirm with Touch ID, and that exact reply goes to that lead once, at the address or number the Touch ID prompt showed you, on the channel you chose. A note on the contact says who approved it. If the lead's address changes after you approve, nothing is sent. A client is put into send mode from the cockpit only, with Touch ID, after 7 days of drafts with at least 95% approved, and switching back to drafts takes effect at once.
+
+Every brain send, every refused send and every outcome is now one line in a send log on your computer: who approved it, which approval, a fingerprint of the exact words, the recipient, the channel, the time, the result and GoHighLevel's message id. The Brain drafts screen lists it for each client, newest first, with the recipient partly hidden. No keys or signatures are ever written to it.
+
+If your membership ends, your client brain is yours. A new page, Your client brain, lets you download everything the brain holds as one file you keep, and pause the brain for every client, which stops drafting and any sending at once and deletes nothing. It keeps working in a cockpit that is still open after your membership ends, and the page that says your license needs attention links to it. Sending stops the moment a membership ends; drafting carries on in your own accounts until you pause or retire it.
 
 ## 3.88.2: a workflow waiting on a calendar is never switched on
 

package/README.md

@@ -602,7 +602,7 @@ npm run dev      # tsc --watch (type-checking only)
 User prompt → Claude Code → MCP tool call → GHL Client → GHL API → JSON response → Claude Code → User
 ```
 
-Every tool returns structured JSON. Claude interprets the response and presents it naturally. No data is stored locally — it's a pass-through to GHL's API.
+Every tool returns structured JSON. Claude interprets the response and presents it naturally. Tools read and write GoHighLevel directly. This computer keeps your keys and settings, the cockpit's last read of each account so its screens open quickly, a record of each change it makes, working logs, the Workflow Builder's own browser sign-in, and anything you choose to save, such as an export or a report.
 
 ---
 
@@ -705,7 +705,7 @@ This MCP server is safe to share via GitHub.
 | **API Keys** | Stored in a per-user credentials file (`~/Library/Application Support/elitedcs-ghl-mcp/credentials.json` on Mac) at chmod 0600. Never in code, never committed. |
 | **License validation** | Checked at `setup_ghl_mcp` against the elitedcs.com license server, then cached as a signed attestation (~30 days). The server renews the attestation in the background as expiry approaches — never per-request, and your GHL keys are never sent to us. |
 | **Multi-user** | Each user brings their own license key + GHL API key. Complete account isolation. |
-| **Scope** | The server only talks to GHL's API, the elitedcs.com license server (setup + periodic attestation renewal), and npm's registry (startup version banner — `GHL_MCP_DISABLE_UPDATE_CHECK=1` to disable). No filesystem access beyond its config dir, no shell commands. |
+| **Scope** | The server talks to GHL's API, the elitedcs.com license server (setup and periodic attestation renewal), elitedcs.com/api/telemetry for anonymous install, startup and first-use counts (off with `GHL_TELEMETRY=0` or `DO_NOT_TRACK=1`), and npm's registry (startup version banner, off with `GHL_MCP_DISABLE_UPDATE_CHECK=1`). |
 | **Permissions** | Controlled by your GHL Private Integration scopes. Disable what you don't need. |
 
 ---
@@ -738,7 +738,7 @@ Run `health_check` any time to see whether it's on and confirm an opt-out took e
 | `reason_code` | `ghl_key_wrong_location` | If setup failed, which of eleven fixed labels. Never a raw error message. |
 | `ts` | `2026-08-04T03:31:08Z` | When it happened. |
 
-**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. Nothing about your GHL account or your clients' accounts ever leaves your machine.
+**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. The counts never include any of your GHL account data or your clients' data. That data goes only to GoHighLevel, to your own Claude account, and to services you connect yourself, such as your own Supabase project for the client brain or a connected Stripe, Slack or Zoom account.
 
 The receiving endpoint **rejects** any payload containing a field not on that list rather than quietly dropping it, and the database enforces the same list a second time — so the shape can't drift without both being changed deliberately.
 
@@ -899,7 +899,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.91.1
+**Version:** 3.92.1
 
 ---