@elitedcs/ghl-mcp 3.91.1 → 3.92.2

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 3.92.2: The agency cockpit says only what is true
+
+This release fixes what a full test of the agency cockpit found on a real account. Nothing here changes what GHL Command ($97) does for a client account.
+
+**Each cockpit plan shows its own name, and the one-client plan gets a daily brief and the agency profile.** Every screen, page title and the line printed when the cockpit starts name the plan you are on. On the one-client plan, the daily brief covers the client you pick, in chat and on its screen, and its screen now finishes loading (it stayed at "0 of 1 accounts read"). Your own calendar shows on the brief, labelled as yours, and never to a team login, on every plan. The agency profile now works on the one-client plan in chat and on its screen.
+
+**The client brain is offered only where it works.** Plans without the client brain, and the existing-member gift, no longer see the Client brain card on Connections, and connect_system no longer saves a brain token their plan cannot use. The brain card asks for an access token, not a bot token.
+
+**The Assessment reaches a build.** If your account has no Assessments pipeline, the Assessment page offers one button that creates it and adds the deal in the same click, instead of a chat setting it had no box for. The offer belongs to the account it was made for. The deal is said to be on your Assessments pipeline. The build's attach step says what to do when there is no saved assessment. City and website are saved on the contact, and the client's name, role, city and website on the readable note. Saving again with the same answers writes no second identical note, and the pipeline offer stays after a reload. The "head is not a function" error is gone. The close-rate question now asks for a percentage ("Four in ten is 40%"), which is what its box always took.
+
+**The client's pages promise only what was built.** The Handoff says a text, an email, both or neither, exactly as Speed to Lead sends; names a new-lead alert and call duties only when Speed to Lead was built; asks the owner only for what was built (no Google review link without Review Requests); and is titled with the business's own name, as are the agency's detail page and the Blueprint document. The notes inside built workflows name only the messages and workflows that exist. Jobs about Quote Follow-up or Review Request appear only when those were bought, a job kept from an earlier plan about a workflow this build does not make is dropped, and a reworded job takes the current plan's words. With texting off, the review request email now goes when the owner was told (the day after, or a few hours after) instead of about four days later, and its email template is now named "Review Request - Email". The planning Review no longer names or prefixes workflows, forms or pipeline stages the build will name itself. The Blueprint document says a field's kind in words and hides ordering numbers.
+
+**Workflow Audit Pro grades what it saw.** A text or email step skipped only because the test lead has no phone number or email address is marked "Not tested" and never charged. A step that names a staff member who is not in the account now carries the Checkup's own finding instead of "no reason". A gap that could hide a failure (a step log that could not be read in full, a step that could not be judged, a skip nobody explained) means no grade, with the reason; a gap that is by design (a branch the lead did not take, a message not due yet, a link not opened) is graded on what could be checked and listed. A check started by a tag says first that its steps were not read. A check where nothing arrived and nothing went wrong is not graded, rather than shown as 100. The coverage line reads "Checked what 1 of 1 step did", or "1 step, which did not run during the check", so it no longer seems to contradict "0 ran". When nothing arrived, the step log's own reason comes first (a text skipped because the test lead had no phone is named) instead of a guess that the workflows may be drafts.
+
+**Undo, Verify and the Workflows page say what is true.** Undoing a build reads back the objects it reused before describing them (still there, already removed, or not readable), clears the build approval, so Build needs approving again, and clears Verify's results and the prepared handoff and account detail, which say to run Build and Verify again. When the undo removed everything, Build and the later steps are back to not started and that build's jobs and hand-off history are cleared; when something it made is still there, the build is still shown as built. Verify names, on a workflow's own row, a tag the build made or reused that the account no longer has. The Workflows page claims a workflow as the build's only when the build created it and GoHighLevel's read shows its id. A build approval that went stale can be given again; while the intake itself changed, the button says to review it first. Before Verify, the handoff card says the handoff and account detail are prepared when Verify finishes, instead of linking to empty pages.
+
+**Smaller fixes.** The undo report names an object it left alone and could not read back. list_email_templates reads every page instead of GoHighLevel's first ten (up to 1,000 templates; it takes no limit or offset). Google Calendar is not shown or counted on Connections, and has no panel on the brief, until it can connect on this computer. The brief's note on what was not read is headed "What was not read, and why", and the brief reads again when you come back to it, so a build started meanwhile shows under Running. Step 8's Blueprint Review card names the business. A page opened without the cockpit's sign-in names the plan you are on. A client row on Your agency shows what was just saved. The brain pages ask in words ("Export my client brain") rather than tool names. The Documents and Forms pages read again (they asked GoHighLevel for more rows than it allows) and say when a list may have more. Connections no longer shows installer settings or systems that are not built yet, and its count says what it counts. The board's in-progress card is titled "Builds in progress". A run that stops without a reason says the last step it reported. The daily brief lists the client whose build step is running. The Brain Owner page says numbers were cleared only when numbers were shown. Workflow Builder help links now point at ghlcommand.com. After enabling the Workflow Builder, setup states your own plan's tool count.
+
+**Test contacts.** Workflow Audit Pro still never deletes a contact; each contact the test lead left now has one line to copy, "To remove it, ask Claude: delete contact <id>.", and shows its name as GoHighLevel stores it.
+
+**Descriptions.** The npm and registry descriptions no longer claim the only programmatic workflow builder.
+
+**Known limits.**
+- Assessment re-save: when a save matches an existing contact by email or phone, the city and website typed on the page replace the contact's.
+- Assessments saved before 3.92.2 with a close rate of 10 or less were typed as a count out of ten: open each one and re-enter that answer as a percentage.
+- Fast-forward checks in Workflow Audit Pro do not yet run the staff check.
+- Google Calendar connect is not available yet.
+- Accounts built before 3.92.2 keep the email template named "Review Request - Day 3 Email". Building such an account again adds a second template named "Review Request - Email"; the existing Review Request workflow keeps using the first.
+- If a client brain secret changes, re-run brain_setup so the brain picks it up dependably (a new secret can reach it sooner, but nothing guarantees when). The brain's longer license wait reaches a client brain only when brain_setup redeploys it.
+- The planning Review's rules lower, but cannot rule out, a model naming a piece; a name with the account's own prefix is removed before it is shown.
+
+## 3.92.1: 3.92.0, released
+
+This release is exactly 3.92.0's content, the client brain. 3.92.0 never reached npm because a packaging step ran in the wrong order; 3.92.1 fixes that step and changes nothing else.
+
+## 3.92.0: The client brain, a memory of each client that every agent reads first (the top Cockpit plan)
+
+This release is everything in 3.91.1, plus the changes below.
+
+**The client brain.** The client brain comes only with the top Cockpit plan. On every other plan, its tools answer that they are not included in your license, except export and the off switch (see Known limits). One small memory for each client, kept in a database in your own Supabase account, never ours. For each client it holds the status of every lead it has heard about (booked, opted out, or needs a person), the client's own rules with their reasons, a few facts with where each came from, the client's words, and example replies. The brain reads one short brief from it before every draft, and Claude can read the same brief when you ask about a lead.
+
+**Drafts, never sends.** When a lead replies, the brain writes a draft answer as a note on the contact in GoHighLevel. Code checks every draft before the note is written. A draft that fails is still written, headed "BLOCKED, not for sending" or "HELD, not sent", with the reason. Sending is switched off in this version: you send the reply yourself in GoHighLevel. The brain writes no draft for a lead with do-not-disturb on, a lead who replied STOP or another opt-out word, or a lead carrying an opt-out tag, and it hands a lead to a person when a message only might mean stop or uses one of its escalation words.
+
+**Every change waits for your yes.** Each tool that changes the brain shows you the plan first and writes nothing. It applies only when you say yes to that exact plan, and that yes lapses after 30 minutes. Facts are proposed with their source and reach agents only after a person approves them.
+
+**The brain adds 15 tools, on the top Cockpit plan only:** brain_setup, brain_wire_ghl, brain_set_rules, brain_set_glossary, brain_set_caps, brain_set_examples, brain_propose_fact, brain_review, brain_clear_human, brain_forget_contact, brain_log, brain_audit, brain_export, brain_retire and get_contact_brief. GHL Command's own tool count does not change. Setting the brain up or connecting a client's GoHighLevel works only on accounts marked as a practice sandbox in this version, and only on the computer that set the brain up. Pause and retire work on any account.
+
+**Your data stays yours.** brain_export saves the brain's records to your computer: its rules, active facts, examples, glossary, each lead's status, events, decisions and proposals, plus a record of every lead you asked it to forget. When a license for the top Cockpit plan ends, export and the off switches keep working only when the owner's signed license is on this computer; team logins are refused.
+
+**Your saved settings are protected from being undone.** Every save of the settings file on this computer now reads the file again first and changes only its own fields, so a slow license check, a Workflow Builder login or a second setup can no longer roll back something saved a moment earlier. Re-running setup with the same license now keeps your saved Anthropic key and cockpit key.
+
+**Privacy wording corrected.** The connector, checkup and README text now says plainly what leaves your computer. In short, each key goes only to its own service, except that the client brain keeps the client's GoHighLevel key, its own Anthropic key, your GHL Command license key and the credential it uses to check that license inside your own Supabase project. The brain's own write key is stored only in the workflows it wires in GoHighLevel. Account data goes only to GoHighLevel, your own Claude account and services you connect yourself, and GHL Command sends us a few anonymous install, startup and first-use counts with no account data. Turn those off with GHL_TELEMETRY=0 or DO_NOT_TRACK=1.
+
+**Known limits.** When the license is not active, export and the off switch for the client brain check that the owner's signed license is on this computer. They do not check who is typing. So anyone using the owner's computer, or a copy of its config folder, can export the brain or switch it off, even after the license ends. Keep that folder as private as the keys it holds. GHL Command in Claude and the cockpit can both save the settings file. Each save checks the license is still the one on file, but two saves in the same instant from the two programs can still lose one of them; at worst a setting has to be saved again. After a cancel, the cockpit's hand-off page works only while the cockpit is still running (closing the browser tab is fine; it reopens). Once the cockpit stops, export and the off switch run from Claude chat with brain_export and brain_retire.
+
 ## 3.91.1: Step 7, Staff, says what is true, and one rule decides who gets an admin login
 
 This release is everything in 3.91.0, plus the changes below.
@@ -99,7 +154,7 @@ This is a release candidate, for testers only. It is everything in 3.89.0-beta.1
 
 Some things always ship as not checked: colors and the logo (what a phone actually paints cannot be confirmed from outside), text inside a slider, a folded menu or another box that hides part of its content (a page holding it gives no "no" for the whole site), a tap-to-call link that sits only in a folded menu it did not open, the Google Business Profile itself, and follow-up speed. On 10 clinic and wellness websites whose facts we had checked by hand, its answers about a phone number shown, a tap-to-call link, reviews shown and an enquiry form were 27 yes, 13 not checked and 0 wrong. The blind test on 15 randomly drawn sites follows with the stable release.
 
-**It is part of Command Pro and the plans above it, not GHL Command.** A license that does not include it says so in one sentence and changes nothing.
+**It is part of the plans with the Cockpit, not GHL Command.** A license that does not include it says so in one sentence and changes nothing.
 
 **extract_brand refuses a page under 150 words and says so,** rather than taking colors and fonts from a page too short to be sure it is the site.
 
@@ -401,6 +456,19 @@ This is a beta, a test build for members who want the next release early. It is
 **verify_design and extract_brand open pages in a fresh browser** with no saved logins. verify_design renders a local page only from your project folder or your brand folder. To use another folder, set GHL_MCP_DESIGN_DIR to it.
 
 **The cockpit intake no longer reads a link.** Open the page, copy its text, and paste it into Paste a transcript.
+## Unreleased: Brain drafts are easier to read
+
+On the Brain drafts screen, each draft now names the lead it is for (their name, or their email or phone when there is no name) instead of a code, and every check reads in plain English, such as "Not opted out". After you approve or reject, a confirmation stays on screen for a few seconds, or until you dismiss it, and says plainly whether anything was sent. While sending is switched off it reads "Approved. Sending is switched off, so nothing was sent."
+
+## Unreleased
+
+Client brain sending, still switched off and sandbox only: every draft now shows how long ago the facts behind it were read, and a send is refused when those facts are more than 30 minutes old. Drafting and sending both skip a lead who is on do-not-disturb, carries an opt-out tag or replied STOP, and this is checked again right before a send. The brain sends at most one reply to a lead and 20 replies per client each day, counted from its send log.
+
+The cockpit's Approve button is now wired all the way to the send, still switched off in this version. When sending is switched on in a future release, you approve one reply, confirm with Touch ID, and that exact reply goes to that lead once, at the address or number the Touch ID prompt showed you, on the channel you chose. A note on the contact says who approved it. If the lead's address changes after you approve, nothing is sent. A client is put into send mode from the cockpit only, with Touch ID, after 7 days of drafts with at least 95% approved, and switching back to drafts takes effect at once.
+
+Every brain send, every refused send and every outcome is now one line in a send log on your computer: who approved it, which approval, a fingerprint of the exact words, the recipient, the channel, the time, the result and GoHighLevel's message id. The Brain drafts screen lists it for each client, newest first, with the recipient partly hidden. No keys or signatures are ever written to it.
+
+If your membership ends, your client brain is yours. A new page, Your client brain, lets you download everything the brain holds as one file you keep, and pause the brain for every client, which stops drafting and any sending at once and deletes nothing. It keeps working in a cockpit that is still open after your membership ends, and the page that says your license needs attention links to it. Sending stops the moment a membership ends; drafting carries on in your own accounts until you pause or retire it.
 
 ## 3.88.2: a workflow waiting on a calendar is never switched on
 

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 250 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
+**GoHighLevel for Claude.** 250 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes a workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning.** **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).
 
@@ -67,7 +67,7 @@ This MCP (Model Context Protocol) server connects Claude directly to GoHighLevel
 | **Conversations** | Read message threads, send SMS/email/WhatsApp, update message status. |
 | **Pipeline** | Create and manage opportunities. Move deals through stages. |
 | **Scheduling** | Check availability, book appointments, manage calendars. |
-| **Automation** | **Full workflow builder** — create, read, edit, and publish workflows. See every action, trigger, condition, and branch. Clone workflows with deep ID remapping. |
+| **Automation** | **Workflow builder** — create, read, edit, and publish workflows. See every action, trigger, condition, and branch. Clone workflows with deep ID remapping. |
 | **Marketing** | **Funnel/page editor** — read and edit existing funnel page content (sections, elements, CSS). **Full form builder** — read/edit all fields, conditional logic, auto-responder. |
 | **Pipelines** | **Full pipeline builder** — create, edit, delete pipelines. Add, remove, rename, reorder stages. |
 | **Bulk Ops** | Batch tag, untag, update fields, enroll in workflows, or delete contacts — all rate-limited. |
@@ -198,7 +198,7 @@ The builder + cloner + validator tools (workflow builder, funnel builder, form b
 4. Back in Claude: `Run enable_workflow_builder` and paste the JSON into the `firebase_paste` field. (First-time setup? You can instead add `firebase_paste` as a fifth field on `setup_ghl_mcp`.)
 5. Restart Claude. The Firebase-gated tools are live.
 
-Screenshots and the same script behind a copy button: [elitedcs.com/ghl-mcp-firebase](https://elitedcs.com/ghl-mcp-firebase)
+Step-by-step help and the same script behind a copy button: [ghlcommand.com/ghl-mcp-firebase](https://ghlcommand.com/ghl-mcp-firebase)
 
 </details>
 
@@ -602,7 +602,7 @@ npm run dev      # tsc --watch (type-checking only)
 User prompt → Claude Code → MCP tool call → GHL Client → GHL API → JSON response → Claude Code → User
 ```
 
-Every tool returns structured JSON. Claude interprets the response and presents it naturally. No data is stored locally — it's a pass-through to GHL's API.
+Every tool returns structured JSON. Claude interprets the response and presents it naturally. Tools read and write GoHighLevel directly. This computer keeps your keys and settings, the cockpit's last read of each account so its screens open quickly, a record of each change it makes, working logs, the Workflow Builder's own browser sign-in, and anything you choose to save, such as an export or a report.
 
 ---
 
@@ -705,7 +705,7 @@ This MCP server is safe to share via GitHub.
 | **API Keys** | Stored in a per-user credentials file (`~/Library/Application Support/elitedcs-ghl-mcp/credentials.json` on Mac) at chmod 0600. Never in code, never committed. |
 | **License validation** | Checked at `setup_ghl_mcp` against the elitedcs.com license server, then cached as a signed attestation (~30 days). The server renews the attestation in the background as expiry approaches — never per-request, and your GHL keys are never sent to us. |
 | **Multi-user** | Each user brings their own license key + GHL API key. Complete account isolation. |
-| **Scope** | The server only talks to GHL's API, the elitedcs.com license server (setup + periodic attestation renewal), and npm's registry (startup version banner — `GHL_MCP_DISABLE_UPDATE_CHECK=1` to disable). No filesystem access beyond its config dir, no shell commands. |
+| **Scope** | The server talks to GHL's API, the elitedcs.com license server (setup and periodic attestation renewal), elitedcs.com/api/telemetry for anonymous install, startup and first-use counts (off with `GHL_TELEMETRY=0` or `DO_NOT_TRACK=1`), and npm's registry (startup version banner, off with `GHL_MCP_DISABLE_UPDATE_CHECK=1`). |
 | **Permissions** | Controlled by your GHL Private Integration scopes. Disable what you don't need. |
 
 ---
@@ -738,7 +738,7 @@ Run `health_check` any time to see whether it's on and confirm an opt-out took e
 | `reason_code` | `ghl_key_wrong_location` | If setup failed, which of eleven fixed labels. Never a raw error message. |
 | `ts` | `2026-08-04T03:31:08Z` | When it happened. |
 
-**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. Nothing about your GHL account or your clients' accounts ever leaves your machine.
+**Never sent:** your license key, email, GHL API key, location ID, contact or client data, hostname, usernames, file paths, IP-derived location, or raw error text. The counts never include any of your GHL account data or your clients' data. That data goes only to GoHighLevel, to your own Claude account, and to services you connect yourself, such as your own Supabase project for the client brain or a connected Stripe, Slack or Zoom account.
 
 The receiving endpoint **rejects** any payload containing a field not on that list rather than quietly dropping it, and the database enforces the same list a second time — so the shape can't drift without both being changed deliberately.
 
@@ -899,7 +899,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.91.1
+**Version:** 3.92.2
 
 ---