Developer CLI

v2.24.12 — solid update brings everything current, and never leaves you stuck

solid update tries every way this machine can install the CLI — the one it detects first, then npm, then Homebrew or scoop — and counts the update done only when the solid your terminal runs reports the new version. The Homebrew tap is added for you. If Homebrew has not picked up the release yet, it says so and does not install a second copy. You only see a command to run yourself when every way has failed.Once the CLI is updated, the new version refreshes everything else it set up: the MCP server your AI tools launch, the Claude Code session hook, your shell completion, the agent skills and plugin in every project where you ran solid agent setup, and the render browser. Only what you set up is refreshed — nothing new is installed.A second copy of solid first on your PATH — an npm install under another Node version — is updated where it lives. solid update --check lists every part and what it would do; --json reports each part for an agent.Coming from 2.24.11 or earlier? That version runs its own update code for this one step. If it stops, run npm install -g @solidnumber/cli@latest once — every update after that takes care of itself.

v2.24.11 — inventory import reports every row

solid inventory import <file> prints how many rows were created, updated and unchanged, names every row that failed with its row number, SKU and reason, and lists the columns it did not import. It exits 1 if any row failed. --dry-run says nothing was written and previews what each row would do.Server-side, shipped with it: the import now writes your real products and per-location stock — it used to fail for every company. Rows match by SKU in your company, a blank cell never overwrites, a new SKU needs a name, and a location column sets that location’s count. --dry-run is now truly a dry run — the server used to ignore the flag the CLI sends. New verb: inventory.import_csv.solid update installs with --prefer-online, so updating to @latest no longer fails with ETARGET in the first minutes after a release. The MCP self-update uses the same flag.

solid docs listed GET /api/v1/cms/public/availability for open appointment slots. That route never existed. It now lists the host-resolved routes: GET /api/v1/cms/pages/public/booking?host=<site> for bookable services, GET /api/v1/cms/pages/public/booking/times?host=<site>&service_id=<id>&date=YYYY-MM-DD for open slots, and POST /api/v1/cms/pages/public/book?host=<site> to book one.Server-side, not part of this release — new verbs reachable today through solid verbs invoke <verb> with no CLI update: the calendar (appointment.confirm, appointment.unconfirm, appointment.update, appointment.book_series, appointment.series_update, appointment.series_end), staff.* (hours, time off, link a user), team.* (invite, roles, deactivate), reminder.set / reminder.list / reminder.cancel, sales.motion_*, and appointment.public_times — the open times a website shows visitors. solid verbs list appointment. shows the rest.

Configs written before 2.24.8 launch a bare @solidnumber/mcp, which npx serves from its cache forever — updating the CLI never touched it. solid update now switches every Solid# launch in Claude Desktop, Cursor, Windsurf and Claude Code to @solidnumber/mcp@latest (only that argument changes; a deliberate pin is left alone and reported) and upgrades a global install of the MCP server when it is behind — even when the CLI itself is already current.solid update --json performs the update and reports it, so an agent can run it; --check changes nothing, with or without --json.

solid inbox --limit 5 was read as a subcommand named “5”. Fixed — and inbox list --limit now reaches the route instead of running with the default 20.A missing scope now says SCOPE_MISSING and names the scope, not “check your tier”. solid keys rotate --add-scope <scope> exists, and rotate creates the new key before revoking the old one.solid mcp install writes an sk_ key for this company and @solidnumber/mcp@latest — never a login token that expires. solid verbs invoke, solid ucp and solid subscriptions list call what the server actually serves. Homebrew and scoop now pick up a release within minutes of npm.

solid nest <folder> used to send the folder’s path to the server as if it were the site’s HTML. It now reads the folder — relative paths kept, text as text, images and fonts as binary, hidden and node_modules items skipped and listed — imports every page with the links between them kept, and builds each one. --entry names the home page; --single imports only it.solid mcp doctor --fix removes the local duplicate Solid# connections that made “which company is the AI on?” unanswerable, backing each config file up first. The claude.ai connector is never touched — it is named as a step for you, and the report says plainly when a conflict remains. --dry-run shows the plan.solid auth login --token sets the previous account’s refresh token aside before the key is verified and restores it only if the key is bad — a typo never logs you out, and a good key never refreshes back into the old account.

Class 5 of the Atlas is curated with three-digit addresses — 530 is taking payment, 531 is refunds — and solid verbs list accepted only one or two digits, so a real address was refused as malformed. It now takes a class, a noun or a curated address.An address the platform has retired used to answer with an empty list, which reads exactly like “nothing lives here”. It now answers with the standard error envelope — 410 address_retired — with the replacement addresses in did_you_mean and a fix you can run. When there is more than one candidate the fix is solid map: the CLI does not pick one for you.

solid audit --limit 3 failed with “Unknown command: solid audit 3”. A hand-written guard re-read the raw command line and dropped anything starting with a dash — which drops the flag and keeps its value. Every option on that command takes a value, so the ordinary spaced syntax was broken for all of them and only --limit=3 worked. The guard is gone: the parser already knows what is an option and what is not.crm contacts --limit=2 returned all 31 contacts. It asked for page_size, a name that route does not declare, so the filter was dropped in silence and the route answered with its own default of 100. blog list did the same, and its --status never filtered anything. Both now send the names the routes read. Where a filter genuinely cannot run on the server — a contact’s status is worked out per row, not stored — it is applied to the rows and the output says so, because a filter applied to one page is a different claim from a filter applied to the company.solid today showed four identical “FOLLOW UP: Voice call with Customer” items. Calls whose caller we could not identify are now one item with a count, the way the chat backlog already was — and a follow-up that knows who to ring, or has a number, still keeps its own card, because that is a job someone can do now.When the server refuses a request, its reason now reaches you instead of a bare “Request failed” — with echoed input and anything secret-shaped removed first. --token works on every command, spinners never touch --json output, pages create --site attaches the page where you said, and publish reports the page’s real URL.

solid audit sent its filters as user_email and action_type; the server reads user_id and event_type, so every filter quietly returned the whole log. It read rows by field names the server never sends, so the columns printed blank. Both now match: each row shows the event, the user, and where it came from — channel (web, CLI, MCP) and IP — with the company the read was scoped to in the header.solid audit export -o file.csv wrote the JSON envelope into the file. It now writes the CSV, and says when the export hit its cap. --from/--to are not applied by the server yet, and the command now says so instead of pretending.

When the platform spells one operation twice, the manifest marks the second spelling with same_as. solid find collapsed those pairs but kept whichever scored higher — so when both halves were dotted (contact.create / crm.contacts.create) it could hand the agent the very alias the manifest said not to use. It now always returns the declared canonical name. The MCP connector (1.3.0) uses the same rule to decide what it lists.solid today renders the platform’s own daily brief — the payload the web Daily Brief and the phone read — instead of a private aggregator that looked for revenue and pipeline in the wrong place and printed “—” forever. A metric the platform marks unavailable is shown as unavailable, never as a number. Did-you-mean suggestions stay inside the namespace you typed.

solid setup detected Claude Code, reported success, and wrote the server into Claude Desktop’s config — a file the terminal never opens. So the machine had no Solid connection at all, and an account-level connector approved months earlier, bound to a different business, answered instead. It now writes ~/.claude.json, and a test asserts where the bytes land rather than what the command prints — which is why every existing test passed through it.On a machine that has never had a Solid server, solid auth login and solid switch now create one instead of reporting success and configuring nothing.

An AI tool can hold more than one Solid# connection at a time — an account-level connector you approved once in a browser, and a local server the CLI configures — and nothing in the protocol decides which one it uses. Sign in to one business, open the assistant, and it may answer about the other. Not a leak: each credential returns its own company’s data, correctly. That is precisely what makes it hard to catch, because every answer reads right.solid ai now enumerates every Solid# connection the tool can reach — including account-level connectors, which live on the server and appear in no file on your machine — resolves the company behind each one, and refuses to launch if two are active or if one disagrees with your session. Two connections is a refusal, not a preference: a matching company on one proves nothing about which the agent will read.solid mcp doctor reports the whole census — every connection, where it is configured, which company it serves, and whether the CLI can re-point it. It used to check one local file and call a keyless entry “wired”. --json was documented but never implemented; it works now, and exits non-zero on a bad verdict so CI can gate on it.The login screen no longer claims that AI tools inherit your CLI token. They never did — they read a separate credential — and that one reassuring sentence was the reason nobody checked. solid auth login and solid switch now re-point the local credential to the company you just chose.Also in this release: a publish-time guard that refuses to ship source under a version already on npm, so an installed build and a repo build can never again claim the same number while differing.